mirror of
https://github.com/kevinveenbirkenbach/docker-volume-backup.git
synced 2026-07-17 14:15:13 +00:00
Kevin Veen-Birkenbach
e9030e8443
Restore fixes, both hit by the infinito svc-bkp e2e drill: - mariadb --empty dropped tables one docker exec at a time with SET FOREIGN_KEY_CHECKS=0 issued in a separate client session, so the session-scoped toggle never applied and any FK-referenced parent table (mailu.users) died with ERROR 1451. Issue the toggle and all DROPs in one session. - postgres --empty now drops only current_user-owned objects (extension members like pg_trgm's set_limit are superuser-owned) with IF EXISTS absorbing CASCADE fallout, and the replay skips superuser-only dump lines (COMMENT ON EXTENSION, ALTER DEFAULT PRIVILEGES) that abort an app-user psql run under ON_ERROR_STOP. Backup fixes: - pg_dump now runs with --no-owner --no-privileges so future dumps are replayable by the owning app user in the first place. - Swarm task containers are never stopped or started manually: the orchestrator replaces a stopped task and a later docker start fails on the detached overlay network. filter_stoppable skips them visibly and the whitelist stop check ignores them. Validated end to end against a live infinito compose stack: the full svc-bkp-volume-2-local drill (verify, restore cycle, sql replay for mailu, keycloak and one more db) passes with these patches applied. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
71 lines
2.1 KiB
Python
71 lines
2.1 KiB
Python
import tempfile
|
|
import unittest
|
|
from unittest.mock import patch
|
|
|
|
import pandas
|
|
|
|
from baudolo.backup import db as db_mod
|
|
|
|
|
|
def _df(rows):
|
|
return pandas.DataFrame(
|
|
rows, columns=["instance", "database", "username", "password"]
|
|
)
|
|
|
|
|
|
def _capture_commands(*, db_type, rows, container):
|
|
captured = []
|
|
|
|
def _capture(cmd):
|
|
captured.append(cmd)
|
|
return []
|
|
|
|
with tempfile.TemporaryDirectory() as td:
|
|
with patch.object(db_mod, "execute_shell_command", side_effect=_capture):
|
|
db_mod.backup_database(
|
|
container=container,
|
|
volume_dir=td,
|
|
db_type=db_type,
|
|
databases_df=_df(rows),
|
|
database_containers=[container],
|
|
)
|
|
return captured
|
|
|
|
|
|
class TestMariaDBDumpUsesTCP(unittest.TestCase):
|
|
# Regression guard for 'Access denied for user <user>@localhost' when only
|
|
# '<user>'@'%' is granted: the in-container mariadb-dump MUST force TCP so
|
|
# the connection is auth-matched against '%' instead of socket->localhost.
|
|
|
|
def test_mariadb_dump_forces_tcp_loopback(self):
|
|
captured = _capture_commands(
|
|
db_type="mariadb",
|
|
rows=[("mariadb", "appdb", "appuser", "s3cret")],
|
|
container="mariadb",
|
|
)
|
|
dump_cmds = [c for c in captured if "mariadb-dump" in c]
|
|
self.assertEqual(
|
|
len(dump_cmds), 1, f"expected one dump command, got: {captured}"
|
|
)
|
|
|
|
cmd = dump_cmds[0]
|
|
self.assertIn("-h 127.0.0.1", cmd)
|
|
self.assertIn("--protocol=tcp", cmd)
|
|
self.assertIn("-u appuser", cmd)
|
|
self.assertIn("-ps3cret", cmd)
|
|
self.assertIn(" appdb", cmd)
|
|
|
|
def test_postgres_dump_unaffected(self):
|
|
captured = _capture_commands(
|
|
db_type="postgres",
|
|
rows=[("pg", "appdb", "appuser", "s3cret")],
|
|
container="pg",
|
|
)
|
|
dump_cmds = [c for c in captured if "pg_dump" in c and "pg_dumpall" not in c]
|
|
self.assertEqual(len(dump_cmds), 1)
|
|
self.assertNotIn("--protocol=tcp", dump_cmds[0])
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main(verbosity=2)
|