Linux 服务器异地备份与恢复演练

# ================= 全局参数定义 =================
BACKUP_NAME="prod-core-backup"      # 备份业务标识前缀
SRC_DIRS="/opt/hermes /etc/nginx"   # 需要打包备份的关键业务目录 (空格分隔)
REMOTE_USER="backup_user"          # 异地温备机的接收用户名
REMOTE_HOST="standby.example.com"  # 异地温备机公网 IP 或域名
REMOTE_PORT="22"                   # 异地温备机 SSH 端口
REMOTE_DIR="/data/backups/prod"    # 异地温备机落盘存储目录
KEEP_COPIES="7"                    # 异地保留的最新历史版本数量
# ================================================

# 创建临时瞬态工作区
TMP_DIR="/tmp/backup_staging"
mkdir -p ${TMP_DIR}
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
ARCHIVE_FILE="${TMP_DIR}/${BACKUP_NAME}_${TIMESTAMP}.tar.gz"

# 执行打包，排除无用缓存与临时日志
tar -czf ${ARCHIVE_FILE} \
    --exclude='*.log' \
    --exclude='*cache*' \
    --exclude='*/node_modules/*' \
    -C / opt/hermes etc/nginx

# 计算并生成 SHA256 校验指纹文件
sha256sum ${ARCHIVE_FILE} > ${ARCHIVE_FILE}.sha256

# 查看生成的归档与指纹
ls -lh ${ARCHIVE_FILE}*

# 生成无密码保护的专用备份密钥对
ssh-keygen -t ed25519 -N "" -C "backup-transport@production" -f ~/.ssh/id_ed25519_backup

# 确保温备机备份目录就位
sudo mkdir -p /data/backups/prod
sudo chown -R backup_user:backup_user /data/backups/prod

# 在 backup_user 的 authorized_keys 中配置受限公钥
cat << 'EOF' >> ~/.ssh/authorized_keys
# 限制此密钥仅用于 rsync/scp
command="rsync --server -vlogDtprze.iLsfxCIvu . /data/backups/prod",no-pty,no-agent-forwarding,no-X11-forwarding ssh-ed25519 AAAAC3...你的生产端备份公钥... backup-transport@production
EOF

# 执行安全断点续传
rsync -avz -e "ssh -i ~/.ssh/id_ed25519_backup -p ${REMOTE_PORT}" \
    ${ARCHIVE_FILE}* \
    ${REMOTE_USER}@${REMOTE_HOST}:${REMOTE_DIR}/

# 检查传输返回值，如果成功则即刻销毁本地瞬态文件
if [ $? -eq 0 ]; then
    echo "✅ 异地传输成功，执行本地即焚清理..."
    rm -rf ${ARCHIVE_FILE}*
else
    echo "❌ 异地传输失败，保留本地包待排查！"
    exit 1
fi

# 智能保留最新 7 份备份，将其余旧文件安全清除
cd /data/backups/prod
ls -t ${BACKUP_NAME}_*.tar.gz | sed -e "1,${KEEP_COPIES}d" | while read -r old_file; do
    echo "清理过期归档: ${old_file}"
    rm -f "${old_file}" "${old_file}.sha256"
done

DRILL_DIR="/tmp/recovery_drill"
rm -rf ${DRILL_DIR} && mkdir -p ${DRILL_DIR}

echo "=== 1. 从异地机拉取最新一份备份及其哈希指纹 ==="
LATEST_BACKUP=$(ssh -i ~/.ssh/id_ed25519_backup -p ${REMOTE_PORT} ${REMOTE_USER}@${REMOTE_HOST} "ls -t ${REMOTE_DIR}/${BACKUP_NAME}_*.tar.gz | head -n 1")

rsync -avz -e "ssh -i ~/.ssh/id_ed25519_backup -p ${REMOTE_PORT}" \
    ${REMOTE_USER}@${REMOTE_HOST}:${LATEST_BACKUP}* \
    ${DRILL_DIR}/

cd ${DRILL_DIR}
ARCHIVE_BASE=$(basename ${LATEST_BACKUP})

echo "=== 2. 执行 SHA256 完整性校验 ==="
sha256sum -c "${ARCHIVE_BASE}.sha256"
if [ $? -ne 0 ]; then
    echo "🚨 致命错误：最新备份文件哈希校验失败，归档已损坏！"
    exit 2
fi

echo "=== 3. 模拟沙箱解包演练 ==="
mkdir -p unpack_test
tar -xzf "${ARCHIVE_BASE}" -C unpack_test/

# 检查核心关键目录是否存在
if [ -d "unpack_test/opt/hermes" ] && [ -d "unpack_test/etc/nginx" ]; then
    echo "🎉 完美验证：关键业务数据与配置完整可恢复！"
else
    echo "🚨 演练警告：解包后缺少必要核心目录！"
    exit 3
fi

# 演练完毕清理沙箱
rm -rf ${DRILL_DIR}

sudo chmod +x /opt/scripts/offsite_backup.sh

(crontab -l 2>/dev/null; echo "0 3 * * * /opt/scripts/offsite_backup.sh >> /var/log/offsite_backup.log 2>&1") | crontab -

bash /opt/scripts/offsite_backup.sh

ls -lh /data/backups/prod/