53 lines
2.9 KiB
PowerShell
53 lines
2.9 KiB
PowerShell
[CmdletBinding()]
|
|
param(
|
|
[string]$ScriptPath = '\\nas\MST\codex\assistent\deploy\windows\Sync-PostgresBackupToNas.ps1',
|
|
[string]$KeyRecordPath = "$env:LOCALAPPDATA\Domovoy\postgres-backup-key.dpapi.json",
|
|
[string]$NasKeyBackupPath = '\\nas\MST\codex\_backups\domovoy\keys\postgres-backup-key.dpapi.json',
|
|
[string]$TaskName = 'Domovoy PostgreSQL Off-host Backup'
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
Set-StrictMode -Version Latest
|
|
|
|
$keyDirectory = Split-Path -Parent $KeyRecordPath
|
|
New-Item -ItemType Directory -Force -Path $keyDirectory | Out-Null
|
|
$identity = [Security.Principal.WindowsIdentity]::GetCurrent().Name
|
|
|
|
if (-not (Test-Path -LiteralPath $KeyRecordPath) -and (Test-Path -LiteralPath $NasKeyBackupPath -PathType Leaf)) {
|
|
Copy-Item -LiteralPath $NasKeyBackupPath -Destination $KeyRecordPath
|
|
}
|
|
|
|
if (-not (Test-Path -LiteralPath $KeyRecordPath)) {
|
|
$random = [byte[]]::new(48)
|
|
[Security.Cryptography.RandomNumberGenerator]::Fill($random)
|
|
$plain = [Convert]::ToBase64String($random)
|
|
try {
|
|
$protected = ConvertFrom-SecureString (ConvertTo-SecureString $plain -AsPlainText -Force)
|
|
$record = [ordered]@{ version = 1; project = 'domovoy'; purpose = 'postgres off-host backup'; protected_value = $protected; created_at_utc = [DateTime]::UtcNow.ToString('o') }
|
|
[IO.File]::WriteAllText($KeyRecordPath, ($record | ConvertTo-Json) + "`n", [Text.UTF8Encoding]::new($false))
|
|
}
|
|
finally {
|
|
[Array]::Clear($random, 0, $random.Length)
|
|
$plain = $null
|
|
}
|
|
}
|
|
& icacls.exe $KeyRecordPath /inheritance:r /grant:r "${identity}:F" | Out-Null
|
|
if ($LASTEXITCODE -ne 0) { throw 'DPAPI key ACL hardening failed' }
|
|
|
|
$nasKeyDirectory = Split-Path -Parent $NasKeyBackupPath
|
|
New-Item -ItemType Directory -Force -Path $nasKeyDirectory | Out-Null
|
|
$nasKeyPartial = "$NasKeyBackupPath.$PID.partial"
|
|
Copy-Item -LiteralPath $KeyRecordPath -Destination $nasKeyPartial
|
|
Move-Item -LiteralPath $nasKeyPartial -Destination $NasKeyBackupPath -Force
|
|
|
|
if (-not (Test-Path -LiteralPath $ScriptPath -PathType Leaf)) { throw "Scheduled sync script not found" }
|
|
$pwsh = (Get-Command pwsh.exe -ErrorAction Stop).Source
|
|
$arguments = "-NoProfile -NonInteractive -ExecutionPolicy Bypass -File `"$ScriptPath`""
|
|
$action = New-ScheduledTaskAction -Execute $pwsh -Argument $arguments
|
|
$daily = New-ScheduledTaskTrigger -Daily -At '04:00'
|
|
$logon = New-ScheduledTaskTrigger -AtLogOn -User $identity
|
|
$principal = New-ScheduledTaskPrincipal -UserId $identity -LogonType Interactive -RunLevel Limited
|
|
$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -MultipleInstances IgnoreNew -ExecutionTimeLimit (New-TimeSpan -Hours 2)
|
|
Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger @($daily, $logon) -Principal $principal -Settings $settings -Description 'Encrypt and replicate the latest Domovoy PostgreSQL backup to the private NAS.' -Force | Out-Null
|
|
Write-Output "Scheduled task registered: $TaskName"
|