MMD
ce0735d775
Security: deep /api/health (DB+MinIO probes, 503 on failure) + /api/live; rate-limited public forms with honeypots; real client IP behind Traefik (--proxy-headers); TipTap URL sanitization on write (nh3); non-root containers + slim .dockerignore; prod MinIO console bound to 127.0.0.1; HSTS/nosniff on TLS routers; JWT 8h; no default credentials in code. Reliability: Alembic migrations (create_all baseline); graceful shutdown (exec uvicorn); hardened backups (checksums, sanity check, freshness gauge, optional rclone off-site) + restore.sh + hourly db-backup sidecar (ops profile); stack.sh ops tooling (deploy/logs/health/backup/restore/monitoring); .gitattributes LF for shell scripts. Orchestration: json-file log rotation, pinned images, per-service memory limits, edge/internal networks, Traefik ping/accesslog/metrics + flood limiter, conditional minio-setup, pgvector db image, one-shot db-init (umami + aramesh_chatbot databases). Chatbot: unified from site-chatbot branch (RAG + pgvector, SSE, ChatWidget). Monitoring: Prometheus/Alertmanager/Loki/Promtail/Grafana + cAdvisor, node/postgres/blackbox exporters, provisioned dashboards and 10 alert rules; alerts delivered to Bale (tapi.bale.ai — Telegram-compatible). Analytics: Umami on shared Postgres, build-time tracker injection, custom events (contact/newsletter/phone/chat/lang) via frontend/src/analytics.ts. Hygiene: CSV export for contact messages and subscribers; upload image optimization (Pillow); CI script + GitHub-compatible workflow; audit.sh; gen-env.sh for strong credentials.
37 lines
1.4 KiB
Bash
37 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
# بازگردانی پشتیبان دیتابیس — از بازگردانی در محیط واقعی قبلش تمرین کنید!
|
|
#
|
|
# bash scripts/restore.sh backups/db-20260918-030000.sql.gz
|
|
#
|
|
# احتیاط: محتوای فعلی دیتابیس با محتوای پشتیبان جایگزین می‌شود.
|
|
# تصاویر MinIO هم اگر پوشه images-* همان زمان را دارید:
|
|
# docker compose run --rm -v "$(pwd)/backups:/backups" --entrypoint sh mc -c \
|
|
# "mc alias set local http://minio:9000 \"\$MINIO_ROOT_USER\" \"\$MINIO_ROOT_PASSWORD\" && \
|
|
# mc mirror --overwrite /backups/images-20260918-030000 local/aramesh-media"
|
|
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
if [ $# -ne 1 ]; then
|
|
echo "استفاده: bash scripts/restore.sh backups/db-<زمان>.sql.gz" >&2
|
|
exit 1
|
|
fi
|
|
|
|
SQL_GZ="$1"
|
|
if [ ! -f "$SQL_GZ" ]; then
|
|
echo "خطا: فایل ${SQL_GZ} پیدا نشد" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# راستی‌آزمایی چک‌سام اگر کنار فایل هست
|
|
if [ -f "${SQL_GZ}.sha256" ]; then
|
|
sha256sum -c "${SQL_GZ}.sha256"
|
|
fi
|
|
|
|
echo "[restore] هشدار: محتوای فعلی arameshplaza جایگزین می‌شود. ۵ ثانیه فرصت لغو (Ctrl+C)…"
|
|
sleep 5
|
|
|
|
gunzip -c "$SQL_GZ" | docker compose exec -T db psql -v ON_ERROR_STOP=1 -U aramesh -d arameshplaza
|
|
|
|
echo "[restore] ✔ بازگردانی تمام شد — حالا: docker compose restart backend"
|