83190422c9
Six findings from a four-agent review of the imported work, plus the contract bump the import owed. Nothing here changes what the imported features do. The contract version was not bumped for a change that widens what a plugin may declare. The asset-panel vocabulary gained two tab groups (serviceprocess, reports), a datetime column format, a map.body key and a tabs section that renders as a table. 0.29.0 bumped for exactly this class of change when the optional group was added, so this is 0.31.0 with a ledger row. All four are optional and resolve server-side when absent, so a plugin declaring none of them is unaffected. Site Backups now answers honestly where it has nothing behind it. The overlay is a compose profile: a separate container writes sets onto a shared volume and the api container only reads them. A Windows/IIS install runs no such container and the default root resolves to a drive-letter path nothing creates, so Back Up Now either failed on PermissionError or reported a run queued that would never happen, under a banner reading "No verified backup yet" - which describes a backup that failed, not a feature that was never installed. The three write routes refuse with the same 404 shape the configuration-policy routes use for a disabled feature, the list and status routes report whether a store exists, and the page says so instead of offering buttons. Two listAll callers still read a response that is not there. listAll resolves to a plain array through fetchAllPages, so response.data.data throws: PC Types settings rendered empty, and in Configuration Policies the throw happened inside the shared try, so PC types, applications, the action catalog and monitors were all left unassigned by one bad read. The agent package upload cannot succeed on IIS as shipped. MAX_CONTENT_LENGTH went to 256 MB to admit the ~69 MB tray binary, but IIS request filtering caps a body at 30,000,000 bytes and answers 413 before waitress sees the request, so web.config needs the matching requestLimits. The backup image could not be built by anyone outside a TLS-intercepting network. Dockerfile.backup did a plain COPY of a gitignored corporate root CA, and a COPY of a missing file fails the build. The trailing glob makes it a no-op when the cert is absent. endpointstates.domain was the one new string column written without a clamp. Under STRICT_TRANS_TABLES an over-long value raises Data too long and aborts the whole check-in, so a single malformed report would stop a machine reporting telemetry and events entirely. Not fixed here, and left with upstream: the restore path finalizes its schema upgrade only from a browser poll loop, so closing the tab mid-restore leaves the data behind the code; it restores instance files from the newest snapshot rather than the set that was asked for; and it takes no safety dump before the destructive load. All three are in the Docker-only overlay, which this site does not run, and none can be validated here. Scope: product
45 lines
2.3 KiB
Docker
45 lines
2.3 KiB
Docker
# Backup sidecar image: mysql:8.4 (for a version-matched mysqldump) plus restic
|
|
# (for deduped, encrypted, destination-agnostic file snapshots) and a small
|
|
# Python for the manifest writer.
|
|
#
|
|
# WHY mysql:8.4 as the base: the dump tool must match the server major/minor so
|
|
# the SQL it emits restores cleanly onto the same engine. Reusing the exact
|
|
# image the db service runs removes version drift as a failure mode.
|
|
FROM mysql:8.4
|
|
|
|
# Track 1 local build unblock: trust the corporate proxy (Zscaler/GE) root CA so
|
|
# the build-time fetches below (Oracle yum, github.com, PyPI) succeed behind TLS
|
|
# interception. This is a local convenience only; the shipping build vendors
|
|
# these deps instead of fetching them (pinned restic + SHA256, vendored
|
|
# bzip2/python3/alembic or a base image that carries them) so the release image
|
|
# needs no outbound calls and no embedded cert. The cert is gitignored (*.pem)
|
|
# and must be staged at scripts/backup/zscaler-root-ca.pem before building.
|
|
#
|
|
# The trailing * makes the COPY optional: a plain COPY of a gitignored file
|
|
# fails the build outright, so nobody outside a TLS-intercepting network -
|
|
# another site, or our own CI - could build this image at all. Absent cert,
|
|
# the glob matches nothing, the layer is a no-op and the fetches below go out
|
|
# over the public trust store.
|
|
COPY scripts/backup/zscaler-root-ca.pem* /etc/pki/ca-trust/source/anchors/
|
|
RUN update-ca-trust
|
|
|
|
# restic from the distro is often stale; pull the pinned release binary so the
|
|
# snapshot format and retention flags are predictable across sites.
|
|
ARG RESTIC_VERSION=0.17.3
|
|
RUN microdnf install -y bzip2 python3 python3-pip ca-certificates \
|
|
&& curl -fsSL -o /tmp/restic.bz2 \
|
|
"https://github.com/restic/restic/releases/download/v${RESTIC_VERSION}/restic_${RESTIC_VERSION}_linux_amd64.bz2" \
|
|
&& bunzip2 /tmp/restic.bz2 \
|
|
&& install -m 0755 /tmp/restic /usr/local/bin/restic \
|
|
&& rm -f /tmp/restic \
|
|
&& microdnf clean all
|
|
|
|
# alembic so the manifest writer can read the current schema head. pip does not
|
|
# read the system trust store, so point it at the extracted system CA bundle
|
|
# (now including the proxy root) to get through TLS interception.
|
|
RUN python3 -m pip install --no-cache-dir \
|
|
--cert /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem \
|
|
alembic
|
|
|
|
ENTRYPOINT ["/opt/backup/backup.sh"]
|