backupeer/setup.sh at main · persys-dev/backupeer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
#!/usr/bin/env bash

set -eou pipefail

echo "🚀 Setting up Backupeer..."

# Create directories
mkdir -p certs

# Generate CA certificate
echo "📜 Generating CA certificate..."
openssl genrsa -out certs/ca.key 2048
openssl req -new -x509 -days 365 -key certs/ca.key -out certs/ca.crt -subj "/C=US/ST=State/L=City/O=Organization/CN=Backupeer CA"

# Create OpenSSL config for SAN
cat > certs/openssl-san.cnf <<EOF
[req]
default_bits = 2048
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[dn]
C = US
ST = State
L = City
O = Organization
CN = backupeer-manager

[req_ext]
subjectAltName = @alt_names

[alt_names]
DNS.1 = backupeer-manager
DNS.2 = localhost
IP.1 = 127.0.0.1
EOF

# Generate server certificate with SAN
echo "📜 Generating server certificate..."
openssl genrsa -out certs/server.key 2048
openssl req -new -key certs/server.key -out certs/server.csr -config certs/openssl-san.cnf
openssl x509 -req -days 365 -in certs/server.csr -CA certs/ca.crt -CAkey certs/ca.key -CAcreateserial -out certs/server.crt -extfile certs/openssl-san.cnf -extensions req_ext

# Generate client certificates
echo "📜 Generating client certificates..."
openssl genrsa -out certs/cli.key 2048
openssl req -new -key certs/cli.key -out certs/cli.csr -subj "/C=US/ST=State/L=City/O=Organization/CN=backupeer-cli"
openssl x509 -req -days 365 -in certs/cli.csr -CA certs/ca.crt -CAkey certs/ca.key -CAcreateserial -out certs/cli.crt

openssl genrsa -out certs/agent.key 2048
openssl req -new -key certs/agent.key -out certs/agent.csr -subj "/C=US/ST=State/L=City/O=Organization/CN=backupeer-agent"
openssl x509 -req -days 365 -in certs/agent.csr -CA certs/ca.crt -CAkey certs/ca.key -CAcreateserial -out certs/agent.crt

# Clean up temporary files
rm -f certs/server.csr certs/cli.csr certs/agent.csr


if [ "${1:-}" = "copy" ]; then
   echo "🗂️ Copying certificates to service directories..."

        # Create service certs directories
        mkdir -p manager/certs worker/certs cli/certs

        # Copy certificates to manager
        if ! cp certs/server.key certs/server.crt certs/ca.crt manager/certs/; then
            echo "❌ Failed to copy certificates to manager/certs"
            exit 1
        fi

        # Copy certificates to worker
        if ! cp certs/agent.key certs/agent.crt certs/ca.crt worker/certs/; then
            echo "❌ Failed to copy certificates to worker/certs"
            exit 1
        fi

        # Optionally copy certificates to cli (uncomment if needed)
        if ! cp certs/cli.key certs/cli.crt certs/ca.crt cli/certs/; then
            echo "❌ Failed to copy certificates to cli/certs"
            exit 1
        fi

        # Set secure permissions in service directories
        chmod 600 manager/certs/*.key worker/certs/*.key # cli/certs/*.key
        chmod 644 manager/certs/*.crt worker/certs/*.crt # cli/certs/*.crt
else
    echo "📂 Skipping Certificates file copy."
fi

echo "✅ Certificates generated and copied successfully!"
echo ""
echo "📋 Next steps:"
echo "1. Start the services: docker-compose up -d"
echo "2. Access MinIO console: http://localhost:9001 (minioadmin/minioadmin)"
echo "3. Access Grafana: http://localhost:3000 (admin/admin)"
echo "4. Access Prometheus: http://localhost:9090"
echo "5. Use the CLI to schedule backups:"
echo "   ./backupeer-cli schedule postgres configs/postgres-backup.json '0 */6 * * *' agent1"
echo ""
echo "🔐 Certificates generated in ./certs/"