Improve IKAR reliability, security, and Android UX

2026-07-10 15:45:34 +03:00
parent e18f5f5ad6
commit 6a5920ff03
58 changed files with 1698 additions and 320 deletions
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+data_dir="${IKAR_DATA_PATH:-/mnt/data/ikar-data}"
+backup_dir="${IKAR_BACKUP_PATH:-/mnt/data/ikar-backups}"
+retention_days="${IKAR_BACKUP_RETENTION_DAYS:-14}"
+timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
+work_dir="${backup_dir}/.ikar-${timestamp}.tmp"
+archive="${backup_dir}/ikar-${timestamp}.tar.gz"
+
+test -f "${data_dir}/ikar.db"
+mkdir -p "${backup_dir}"
+rm -rf "${work_dir}"
+mkdir -p "${work_dir}/Data"
+
+sqlite3 "${data_dir}/ikar.db" ".timeout 10000" ".backup '${work_dir}/Data/ikar.db'"
+test "$(sqlite3 "${work_dir}/Data/ikar.db" 'PRAGMA integrity_check;')" = "ok"
+
+for directory in Attachments AppUpdates secrets; do
+    if test -d "${data_dir}/${directory}"; then
+        rsync -a "${data_dir}/${directory}/" "${work_dir}/Data/${directory}/"
+    fi
+done
+
+tar -C "${work_dir}" -czf "${archive}.partial" Data
+gzip -t "${archive}.partial"
+mv "${archive}.partial" "${archive}"
+sha256sum "${archive}" > "${archive}.sha256"
+rm -rf "${work_dir}"
+
+find "${backup_dir}" -maxdepth 1 -type f -name 'ikar-*.tar.gz' -mtime "+${retention_days}" -delete
+find "${backup_dir}" -maxdepth 1 -type f -name 'ikar-*.tar.gz.sha256' -mtime "+${retention_days}" -delete
+
+printf '%s\n' "${archive}"
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+verify_only=false
+if test "$#" -eq 2 && test "$2" = "--verify-only"; then
+    archive="$1"
+    staging_dir="$(mktemp -d "$(dirname "${archive}")/.ikar-verify-XXXXXX")"
+    verify_only=true
+elif test "$#" -eq 3 && test "$3" = "--confirm-restore"; then
+    archive="$1"
+    target_dir="$2"
+    mkdir -p "$(dirname "${target_dir}")"
+    staging_dir="$(mktemp -d "${target_dir}.restore-XXXXXX")"
+else
+    echo "Usage: $0 <backup.tar.gz> --verify-only" >&2
+    echo "   or: $0 <backup.tar.gz> <target-data-dir> --confirm-restore" >&2
+    exit 64
+fi
+
+cleanup() {
+    rm -rf -- "${staging_dir}"
+}
+trap cleanup EXIT
+
+test -f "${archive}"
+test -f "${archive}.sha256"
+(cd "$(dirname "${archive}")" && sha256sum -c "$(basename "${archive}.sha256")")
+tar -C "${staging_dir}" -xzf "${archive}"
+test -f "${staging_dir}/Data/ikar.db"
+test "$(sqlite3 "${staging_dir}/Data/ikar.db" 'PRAGMA integrity_check;')" = "ok"
+
+if test "${verify_only}" = true; then
+    echo "Backup verification completed successfully."
+    exit 0
+fi
+
+if test -e "${target_dir}"; then
+    mv "${target_dir}" "${target_dir}.before-restore-$(date -u +%Y%m%dT%H%M%SZ)"
+fi
+mv "${staging_dir}/Data" "${target_dir}"
+rmdir "${staging_dir}"
+trap - EXIT
+
+echo "Restore completed. Start the Ikar server and verify /health before removing the pre-restore directory."