| 1 | #!/usr/bin/env bash
|
| 2 | #
|
| 3 | # 2025-09-25 Marcel Herrguth
|
| 4 | # As shown on https://youtu.be/P-Pr7Dy6mP8
|
| 5 | # Attribution back to this GIST is required!
|
| 6 | #
|
| 7 | # Parts of this script are oriented from https://github.com/zammad/zammad/tree/develop/contrib/backup
|
| 8 | # This script supports PostGreSQL (docker) stacks only and expects your media to be in a mounted folder.
|
| 9 | #
|
| 10 | # Restoration only works on a pre-installed Paperless NGX installation of the same version (or higher).
|
| 11 | # During Restore, this script will remove the existing database and stop all relevant containers.
|
| 12 | # Containers will be re-started after the restoration finished.
|
| 13 |
|
| 14 | #----- CONFIG -------------------------------------------------------------------------------#
|
| 15 | # Use either a directory or a supported repository type (like s3:https//domain.tld/bucket)
|
| 16 | BACKUP_REPOSITORY='s3:https://s3.domain.tld/resticsample'
|
| 17 |
|
| 18 | # Data directory where your Paperless NGX stores your files
|
| 19 | # If you're using volumes, use /var/lib/docker/volumes/paperless_*
|
| 20 | # Alternatively, use several folder-paths seperated by space if needed
|
| 21 | DATA_DIR='/opt/paperless-ngx/data/'
|
| 22 | # Path and filename of the environment file of your stack
|
| 23 | # This file will be evaluated for access credentials
|
| 24 | ENV_FILE='/opt/paperless-ngx/.env'
|
| 25 | # Paperless Stack name
|
| 26 | # Used as prefix for being able to
|
| 27 | STACK_NAME='paperless-ngx'
|
| 28 | # If you're not using PostGreSQL but SQlite, set the following to 'no'
|
| 29 | BACKUP_DATABASE='yes'
|
| 30 |
|
| 31 | # How many daily and hourly snapshot should stay available?
|
| 32 | HOLD_DAYS=14
|
| 33 | HOLD_HOURLY=1
|
| 34 |
|
| 35 | # Do you want to cause downtime during backup? (This is the safest backup way)
|
| 36 | STOP_DURING_BACKUP='yes'
|
| 37 | #----- CONFIG END ---------------------------------------------------------------------------#
|
| 38 |
|
| 39 | # ---- Magic --------------------------------------------------------------------------------#
|
| 40 | function pre_flight () {
|
| 41 | # Verify that we have all we need.
|
| 42 | if [[ ""$BACKUP_REPOSITORY"" == s3:* ]]; then
|
| 43 | if [[ -z "${AWS_ACCESS_KEY_ID}" || -z "${AWS_SECRET_ACCESS_KEY}" ]]; then
|
| 44 | echo "You have chosen to backup to S3 (it seems), but either AWS_ACCESS_KEY_ID and/or AWS_SECRET_ACCESS_KEY."
|
| 45 | exit 1
|
| 46 | fi
|
| 47 | else
|
| 48 | echo "This script has been tested with S3 only. This should be fine."
|
| 49 | echo "Ensure that the required environment information for restic are available as per their documentation:"
|
| 50 | echo "https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html"
|
| 51 | fi
|
| 52 |
|
| 53 | if [[ -z "${RESTIC_PASSWORD}" ]]; then
|
| 54 | echo "You forgot to set RESTIC_PASSWORD which is mandatory for your backup repository!"
|
| 55 | exit 1
|
| 56 | fi
|
| 57 |
|
| 58 | # Get all currently running NGX containers
|
| 59 | DC_DB=$(docker ps| grep "${STACK_NAME}-db" |cut -d " " -f1)
|
| 60 | DC_BROKER=$(docker ps| grep "${STACK_NAME}-broker" |cut -d " " -f1)
|
| 61 | DC_GOTENBERG=$(docker ps| grep "${STACK_NAME}-gotenberg" |cut -d " " -f1)
|
| 62 | DC_TIKA=$(docker ps| grep "${STACK_NAME}-tika" |cut -d " " -f1)
|
| 63 | DC_WEB=$(docker ps| grep "${STACK_NAME}-webserver" |cut -d " " -f1)
|
| 64 | }
|
| 65 |
|
| 66 | function start_paperless () {
|
| 67 | echo "# Starting Paperless"
|
| 68 | docker start $DC_WEB $DC_TIKA $DC_GOTENBERG $DC_BROKER
|
| 69 | }
|
| 70 |
|
| 71 | function stop_paperless () {
|
| 72 | echo "# Stopping Paperless"
|
| 73 | docker stop $DC_WEB $DC_TIKA $DC_GOTENBERG $DC_BROKER
|
| 74 |
|
| 75 | for i in {15..1}; do
|
| 76 | echo -ne "... Waiting $i seconds for the stack to stop.\r"; sleep 1
|
| 77 | done
|
| 78 | }
|
| 79 |
|
| 80 | function ensure_variable_set () {
|
| 81 | if [ -z $1 ]; then
|
| 82 | echo "ERROR: environment variable ${1} not set!"
|
| 83 | exit 1
|
| 84 | fi
|
| 85 | }
|
| 86 |
|
| 87 | function get_db_credentials () {
|
| 88 | if [ ! -f $ENV_FILE ]; then
|
| 89 | echo "ERROR: Could not find the configured environment file!"
|
| 90 | exit 1
|
| 91 | fi
|
| 92 |
|
| 93 | eval $(grep -E '^(POSTGRES_DB|POSTGRES_USER|POSTGRES_PASSWORD|USERMAP_UID|USERMAP_GID)=' "$ENV_FILE")
|
| 94 | }
|
| 95 |
|
| 96 | function kind_exit () {
|
| 97 | # We're nice to our admin and bring Zammad back up before exiting
|
| 98 | start_paperless
|
| 99 | exit 1
|
| 100 | }
|
| 101 |
|
| 102 | function delete_old_backups () {
|
| 103 | echo "# Invoking cleanup as per snapshot rules"
|
| 104 | restic -r "$BACKUP_REPOSITORY" forget --group-by '' --keep-hourly $HOLD_HOURLY --keep-daily $HOLD_DAYS --prune
|
| 105 | }
|
| 106 |
|
| 107 | function write_backup () {
|
| 108 | stop_paperless if "${STOP_DURING_BACKUP}x" == 'yesx'
|
| 109 | echo "# Creating postgresql backup..."
|
| 110 |
|
| 111 | docker exec $DC_DB pg_dump --dbname "${POSTGRES_DB}" \
|
| 112 | --username "${POSTGRES_USER}" \
|
| 113 | --no-privileges --no-owner > /tmp/paperless_db.psql
|
| 114 |
|
| 115 | state=$?
|
| 116 |
|
| 117 | if [ "${state}" == "1" ]; then
|
| 118 | echo -e "\n\n # ERROR(${state}) - Database credentials are wrong or database server configuration is invalid."
|
| 119 | echo -e " #-> BACKUP WAS NOT SUCCESSFUL"
|
| 120 |
|
| 121 | kind_exit
|
| 122 | exit 2
|
| 123 | fi
|
| 124 |
|
| 125 | restic -r "$BACKUP_REPOSITORY" migrate
|
| 126 | restic --no-scan --read-concurrency=25 --pack-size=128 --compression off -r "$BACKUP_REPOSITORY" backup \
|
| 127 | ${DATA_DIR} /tmp/paperless_db.psql
|
| 128 |
|
| 129 | state=$?
|
| 130 |
|
| 131 | # clean up temporary database dump
|
| 132 | rm -f /tmp/paperless_db.psql
|
| 133 |
|
| 134 | start_paperless if "${STOP_DURING_BACKUP}x" == 'yesx'
|
| 135 |
|
| 136 | if [ $state == '1' ]; then
|
| 137 | echo "# FATAL - Restic could not create the snapshot."
|
| 138 | elif [ $state == '3' ]; then
|
| 139 | echo "# WARNING - Files changed during snapshot creation; Snapshot potentially incomplete!"
|
| 140 | fi
|
| 141 |
|
| 142 | if [ $state -gt 0 ]; then
|
| 143 | echo "# BACKUP WAS NOT SUCCESSFUL"
|
| 144 | exit $state
|
| 145 | fi
|
| 146 | }
|
| 147 |
|
| 148 | function list_available_snapshots () {
|
| 149 | pre_flight
|
| 150 | echo "# Here's your currently available snapshots in your backup repository:"
|
| 151 | restic -r "$BACKUP_REPOSITORY" snapshots
|
| 152 | }
|
| 153 |
|
| 154 | function verify_backup_repository_health () {
|
| 155 | pre_flight
|
| 156 |
|
| 157 | VERIFY_PERCENTAGE="${1:-100}"
|
| 158 |
|
| 159 | echo "# Checking ${VERIFY_PERCENTAGE} of your repository ..."
|
| 160 | restic -r "$BACKUP_REPOSITORY" check --read-data-subset="${VERIFY_PERCENTAGE}%"
|
| 161 | }
|
| 162 |
|
| 163 | function get_snapshot_id () {
|
| 164 | if [ -n "${1}" ]; then
|
| 165 | RESTORE_SNAPSHOT_ID="${1}"
|
| 166 | else
|
| 167 | # User did not provide snapshot so we'll hard guess 'latest'
|
| 168 | RESTORE_SNAPSHOT_ID='latest'
|
| 169 |
|
| 170 | echo "... No Snapshot provided, guessing you want to restore 'latest'!"
|
| 171 | for i in {15..1}; do
|
| 172 | echo -ne "... You have $i seconds to abort.\r"; sleep 1
|
| 173 | done
|
| 174 | fi
|
| 175 | }
|
| 176 |
|
| 177 | function restore_backup () {
|
| 178 | stop_paperless
|
| 179 |
|
| 180 | echo "# ... Dropping current database ${POSTGRES_DB}"
|
| 181 |
|
| 182 | docker exec $DC_DB psql -U ${POSTGRES_USER} -c "\c postgres; DROP DATABASE IF EXISTS ${POSTGRES_DB}; CREATE DATABASE ${POSTGRES_DB} OWNED BY ${POSTGRES_USER};"
|
| 183 |
|
| 184 | echo "# Restoring PostgreSQL DB"
|
| 185 |
|
| 186 | # We're removing uncritical dump information that caused "ugly" error
|
| 187 | # messages on older script versions. These could safely be ignored.
|
| 188 | restic -r "$BACKUP_REPOSITORY" dump latest '/tmp/paperless_db.psql' | \
|
| 189 | sed '/^CREATE EXTENSION IF NOT EXISTS plpgsql/d'| \
|
| 190 | sed '/^COMMENT ON EXTENSION plpgsql/d'| \
|
| 191 | docker exec $DC_DB psql -U ${POSTGRES_USER} ${POSTGRES_DB}
|
| 192 |
|
| 193 | state=$?
|
| 194 |
|
| 195 | if [[ ("${state}" == "1") || ( "${state}" == "2") || ( "${state}" == "3") ]]; then
|
| 196 | # We're checking for critical restoration errors
|
| 197 | # It may not cover all possible errors which is out of scope of this script
|
| 198 | echo -e "\n\n # ERROR(${state}) - Database credentials are wrong or database server configuration is invalid."
|
| 199 | echo -e " #-> RESTORE WAS NOT SUCCESSFUL"
|
| 200 |
|
| 201 | kind_exit
|
| 202 | exit 2
|
| 203 | fi
|
| 204 |
|
| 205 | echo "# Restoring Files"
|
| 206 | restic -r "$BACKUP_REPOSITORY" restore $RESTORE_SNAPSHOT_ID --include "$DATA_DIR" --target /
|
| 207 |
|
| 208 | state=$?
|
| 209 |
|
| 210 | if [[ ($state == '1') || ($state == '2') ]]; then
|
| 211 | echo "# ERROR(${state}) - File restore reported an error."
|
| 212 | echo "- Check file permissions, and ensure Zammad IS NOT running, and try again."
|
| 213 | echo -e " \n# RESTORE WAS NOT SUCCESSFUL"
|
| 214 | exit 1
|
| 215 | fi
|
| 216 |
|
| 217 | echo "# Ensuring correct file permissions ..."
|
| 218 | chown -R ${USERMAP_UID}:${USERMAP_GID} ${DATA_DIR}
|
| 219 |
|
| 220 | start_paperless
|
| 221 | }
|
| 222 |
|
| 223 | function start_backup_message () {
|
| 224 | echo -e "\n# Backup script started - $(date)!\n"
|
| 225 | }
|
| 226 |
|
| 227 | function start_restore_message () {
|
| 228 | echo -e "\n# Restore script started - $(date)!\n"
|
| 229 | }
|
| 230 |
|
| 231 | function finished_backup_message () {
|
| 232 | echo -e "\n# Backup script finished; Check output! - $(date)!\n"
|
| 233 | }
|
| 234 |
|
| 235 | function finished_restore_message () {
|
| 236 | echo -e "\n# Restore script finished; Check output! - $(date)!\n"
|
| 237 | }
|
| 238 |
|
| 239 | function execute_backup () {
|
| 240 | pre_flight
|
| 241 | get_db_credentials
|
| 242 | start_backup_message
|
| 243 | write_backup
|
| 244 | delete_old_backups
|
| 245 | finished_backup_message
|
| 246 | }
|
| 247 |
|
| 248 | function execute_restoration () {
|
| 249 | pre_flight
|
| 250 | get_db_credentials
|
| 251 | start_restore_message
|
| 252 | get_snapshot_id $1
|
| 253 | restore_backup
|
| 254 | finished_restore_message
|
| 255 | }
|
| 256 |
|
| 257 | function command_reference () {
|
| 258 | echo "COMMAND REFERENCE"
|
| 259 | echo "- backup: creates a new snapshot and backs up database and storage."
|
| 260 | echo "- restore <snapshot>: Restore a given snapshot from your backup. If you omit the snapshot ID, latest will be used."
|
| 261 | echo "- list_snapshots: List all available snapshot IDs."
|
| 262 | echo "- verify_health <percentage>: Verify the health of your backup repository. If you omit percentage, 100% will be assumed."
|
| 263 | }
|
| 264 |
|
| 265 | # ---- Option part and control --------------------------------------------------------------#
|
| 266 |
|
| 267 | case "$1" in
|
| 268 | backup)
|
| 269 | execute_backup
|
| 270 | ;;
|
| 271 |
|
| 272 | restore)
|
| 273 | execute_restoration $2
|
| 274 | ;;
|
| 275 |
|
| 276 | list_snapshots)
|
| 277 | list_available_snapshots
|
| 278 | ;;
|
| 279 |
|
| 280 | verify_health)
|
| 281 | verify_backup_repository_health "$2"
|
| 282 | ;;
|
| 283 |
|
| 284 | *)
|
| 285 | command_reference
|
| 286 | ;;
|
| 287 | esac
|
