-
Notifications
You must be signed in to change notification settings - Fork 1
196 lines (190 loc) · 9.07 KB
/
ghes-backup.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
# ghes-backup
# Uses GitHub Enterprise Server Backup Utilities to execute scheduled backups using GitHub Actions
# https://github.com/github/backup-utils
# Runner should be setup on the server which is the backup executor/target and be repository-scoped to
# only be available to this repository.
# See requirements for runner (backup host):
# https://github.com/github/backup-utils/blob/master/docs/requirements.md
name: ghes-backup
on:
workflow_call:
inputs:
GHE_HOSTNAME:
description: |
The hostname of the GitHub Enterprise Server appliance to back up. The host
must be reachable via SSH from the runner (backup host).
required: true
type: string
GHE_DATA_DIR:
description: |
Path to where backup data is stored. This can be a relative or absolute path.
required: true
type: string
GHE_NUM_SNAPSHOTS:
description: |
The number of backup snapshots to retain. Old snapshots are pruned after each
successful ghe-backup run. This option should be tuned based on the frequency
of scheduled backup runs. If backups are scheduled hourly, snapshots will be
available for the past N hours; if backups are scheduled daily, snapshots will
be available for the past N days
required: false
default: 10
type: string
GHE_VERBOSE_LOG:
description: |
When verbose output is enabled with `-v`, it's written to stdout by default. If
you'd prefer it to be written to a separate file, set this option.
required: false
type: string
GHE_EXTRA_SSH_OPTS:
description: |
Any extra options passed to the SSH command.
In a single instance environment, nothing is required by default.
In a clustering environment, "-i abs-path-to-ssh-private-key" is required.
required: false
type: string
GHE_EXTRA_RSYNC_OPTS:
description: |
Any extra options passed to the rsync command. Nothing required by default.
required: false
type: string
GHE_CREATE_DATA_DIR:
description: |
If set to 'no', GHE_DATA_DIR will not be created automatically
and restore/backup will exit 8
required: false
type: string
GHE_MSSQL_BACKUP_CADENCE:
description: |
Cadence of MSSQL backups
<full>,<differential>,<transactionlog> all in minutes
e.g.
- Full backup every week (10080 minutes)
- Differential backup every day (1440 minutes)
- Transactionlog backup every 15 minutes
default: 10080,1440,15
required: false
type: string
GHE_PARALLEL_ENABLED:
description: |
If set to 'yes', ghe-backup jobs will run in parallel. Defaults to 'no'.
WARNING: this feature is in beta.
required: false
type: string
GHE_PARALLEL_MAX_JOBS:
description: |
Sets the maximum number of jobs to run in parallel. Defaults to the number
of available processing units on the machine.
WARNING: this feature is in beta.
required: false
type: string
GHE_PARALLEL_RSYNC_MAX_JOBS:
description: |
Sets the maximum number of rsync jobs to run in parallel. Defaults to the
configured GHE_PARALLEL_MAX_JOBS, or the number of available processing
units on the machine.
WARNING: this feature is in beta.
required: false
type: string
GHE_PARALLEL_MAX_LOAD:
description: |
When jobs are running in parallel wait as needed to avoid starting new jobs
when the system load average is not below the specified percentage. Defaults to
unrestricted.
WARNING: this feature is in beta.
required: false
type: string
GHE_EXTERNAL_DATABASE_BACKUP_SCRIPT:
description: |
When running an external mysql database, run this script to trigger a MySQL backup
rather than attempting to backup via backup-utils directly.
EXTERNAL_DATABASE_BACKUP_SCRIPT="/bin/false"
required: false
type: string
# inputs passed as env variables to mitigate script injection attacks
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#good-practices-for-mitigating-script-injection-attacks
env:
GHE_HOSTNAME: ${{ inputs.GHE_HOSTNAME }}
GHE_DATA_DIR: ${{ inputs.GHE_DATA_DIR }}
GHE_NUM_SNAPSHOTS: ${{ inputs.GHE_NUM_SNAPSHOTS }}
GHE_VERBOSE_LOG: ${{ inputs.GHE_VERBOSE_LOG }}
GHE_EXTRA_SSH_OPTS: ${{ inputs.GHE_EXTRA_SSH_OPTS }}
GHE_EXTRA_RSYNC_OPTS: ${{ inputs.GHE_EXTRA_RSYNC_OPTS }}
GHE_CREATE_DATA_DIR: ${{ inputs.GHE_CREATE_DATA_DIR }}
GHE_MSSQL_BACKUP_CADENCE: ${{ inputs.GHE_MSSQL_BACKUP_CADENCE }}
GHE_PARALLEL_ENABLED: ${{ inputs.GHE_PARALLEL_ENABLED }}
GHE_PARALLEL_MAX_JOBS: ${{ inputs.GHE_PARALLEL_MAX_JOBS }}
GHE_PARALLEL_RSYNC_MAX_JOBS: ${{ inputs.GHE_PARALLEL_RSYNC_MAX_JOBS }}
GHE_PARALLEL_MAX_LOAD: ${{ inputs.GHE_PARALLEL_MAX_LOAD }}
GHE_EXTERNAL_DATABASE_BACKUP_SCRIPT: ${{ inputs.GHE_EXTERNAL_DATABASE_BACKUP_SCRIPT }}
jobs:
backup:
runs-on: ghes-backup-runner
# Set a realistic timeout for the job (default is 360 minutes)
timeout-minutes: 1380
steps:
# Run validations before attempting to execute backup to verify any dependencies or pre-req items
- name: verify openSSH
run: which ssh
- name: verify awk
run: which awk
- name: verify rsync
run: which rsync
- name: verify git
run: which git
- name: verify GHES access
run: |
if [ ! -d ~/.ssh ] ; then mkdir ~/.ssh ; fi
grep -q "${GHE_HOSTNAME}" ~/.ssh/known_hosts || (ssh-keyscan -p 122 "${GHE_HOSTNAME}" >> ~/.ssh/known_hosts)
ssh -p 122 "admin@${GHE_HOSTNAME}" ghe-version
# Consider using a locally installed version of backup-utils instead of fresh fetch for each job
- name: fetch backup-utils
run: if [ ! -d backup-utils ] ; then git clone https://github.com/github/backup-utils ; fi
# Create the backup.config file from workflow inputs. Remove existing backup.config, if present
- name: backup-config prep
run: |
cd backup-utils
if [ -f backup.config ] ; then mv backup.config backup.config.old ; fi
- name: backup-config GHE_HOSTNAME
run: cd backup-utils ; echo "GHE_HOSTNAME=${GHE_HOSTNAME}" >> backup.config
if: "${{ inputs.GHE_HOSTNAME != '' }}"
- name: backup-config GHE_DATA_DIR
run: cd backup-utils ; echo "GHE_DATA_DIR=${GHE_DATA_DIR}" >> backup.config
if: "${{ inputs.GHE_DATA_DIR != '' }}"
- name: backup-config GHE_NUM_SNAPSHOTS
run: cd backup-utils ; echo "GHE_NUM_SNAPSHOTS=${GHE_NUM_SNAPSHOTS}" >> backup.config
if: "${{ inputs.GHE_NUM_SNAPSHOTS != '' }}"
- name: backup-config GHE_VERBOSE_LOG
run: cd backup-utils ; echo "GHE_VERBOSE_LOG=${GHE_VERBOSE_LOG}" >> backup.config
if: "${{ inputs.GHE_VERBOSE_LOG != '' }}"
- name: backup-config GHE_EXTRA_SSH_OPTS
run: cd backup-utils ; echo "GHE_EXTRA_SSH_OPTS=${GHE_EXTRA_SSH_OPTS}" >> backup.config
if: "${{ inputs.GHE_EXTRA_SSH_OPTS != '' }}"
- name: backup-config GHE_EXTRA_RSYNC_OPTS
run: cd backup-utils ; echo "GHE_EXTRA_RSYNC_OPTS=${GHE_EXTRA_RSYNC_OPTS}" >> backup.config
if: "${{ inputs.GHE_EXTRA_RSYNC_OPTS != '' }}"
- name: backup-config GHE_CREATE_DATA_DIR
run: cd backup-utils ; echo "GHE_CREATE_DATA_DIR=${GHE_CREATE_DATA_DIR}" >> backup.config
if: "${{ inputs.GHE_CREATE_DATA_DIR != '' }}"
- name: backup-config GHE_MSSQL_BACKUP_CADENCE
run: cd backup-utils ; echo "GHE_MSSQL_BACKUP_CADENCE=${GHE_MSSQL_BACKUP_CADENCE}" >> backup.config
if: "${{ inputs.GHE_MSSQL_BACKUP_CADENCE != '' }}"
- name: backup-config GHE_PARALLEL_ENABLED
run: cd backup-utils ; echo "GHE_PARALLEL_ENABLED=${GHE_PARALLEL_ENABLED}" >> backup.config
if: "${{ inputs.GHE_PARALLEL_ENABLED != '' }}"
- name: backup-config GHE_PARALLEL_MAX_JOBS
run: cd backup-utils ; echo "GHE_PARALLEL_MAX_JOBS=${GHE_PARALLEL_MAX_JOBS}" >> backup.config
if: "${{ inputs.GHE_PARALLEL_MAX_JOBS != '' }}"
- name: backup-config GHE_PARALLEL_RSYNC_MAX_JOBS
run: cd backup-utils ; echo "GHE_PARALLEL_RSYNC_MAX_JOBS=${GHE_PARALLEL_RSYNC_MAX_JOBS}" >> backup.config
if: "${{ inputs.GHE_PARALLEL_RSYNC_MAX_JOBS != '' }}"
- name: backup-config GHE_PARALLEL_MAX_LOAD
run: cd backup-utils ; echo "GHE_PARALLEL_MAX_LOAD=${GHE_PARALLEL_MAX_LOAD}" >> backup.config
if: "${{ inputs.GHE_PARALLEL_MAX_LOAD != '' }}"
- name: backup-config GHE_EXTERNAL_DATABASE_BACKUP_SCRIPT
run: cd backup-utils ; echo "EXTERNAL_DATABASE_BACKUP_SCRIPT=${GHE_EXTERNAL_DATABASE_BACKUP_SCRIPT}" >> backup.config
if: "${{ inputs.GHE_EXTERNAL_DATABASE_BACKUP_SCRIPT != '' }}"
- name: exec backup
run: cd backup-utils ; bin/ghe-backup
- name: verify
run: ls -al "${GHE_DATA_DIR}"