Ilia Denisov
7123ba439d
CI / changes (pull_request) Successful in 2s
CI / unit (pull_request) Successful in 10s
CI / integration (pull_request) Successful in 18s
CI / ui (pull_request) Successful in 1m9s
CI / conformance (pull_request) Successful in 9s
CI / gate (pull_request) Successful in 0s
CI / deploy (pull_request) Successful in 1m46s
docker exec defaults to root, so the systemd base-backup timer connected to the database as role "root" (then "postgres") — neither exists; the superuser role is POSTGRES_USER (scrabble). Run the timer's pgBackRest as the postgres OS user (-u postgres, for lock-dir/PGDATA consistency with archive-push) and connect with --pg1-user=scrabble. archive_command (run by the postgres server process) was already correct. Also record the point-in-time-recovery arming + restore drill in deploy/README.md (correct the runbook commands to the same invocation, fill the drill log) and mark the durability work done in PLAN.md.
18 lines
1007 B
Django/Jinja
18 lines
1007 B
Django/Jinja
# Managed by Ansible (deploy/ansible).
|
|
# Daily full pgBackRest base backup for the payments/game database. Runs pgBackRest
|
|
# inside the postgres container (where the repository configuration and PGDATA live);
|
|
# the continuous WAL between base backups is handled by the container's archive_command.
|
|
# Installed only when pitr_enabled is set (see deploy/ansible/group_vars/all.yml).
|
|
[Unit]
|
|
Description=pgBackRest full base backup (scrabble)
|
|
After=docker.service
|
|
Requires=docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
# docker exec defaults to root, so run as the postgres OS user (-u postgres) for lock-dir and
|
|
# PGDATA consistency with archive-push, and connect to the database as the superuser role via
|
|
# --pg1-user: that role is the POSTGRES_USER (scrabble), not "postgres". It inherits the
|
|
# container's PGBACKREST_* environment (the S3 repository + cipher), so no host-side config.
|
|
ExecStart=/usr/bin/docker exec -u postgres scrabble-postgres pgbackrest --stanza=scrabble --pg1-user=scrabble --type=full backup
|