ops: weekly backup verification script + scripts README

verify-backup.sh: restores latest backup to /tmp, runs PRAGMA integrity_check, compares row counts vs prod (>5% drop in users = fail, >48h age = fail). Cron-driven, fails loud on non-zero exit so cron mails the admin. Exit codes: 2=no files, 3=too old, 4=corrupt, 5=row count diverged. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-06 17:16:04 +03:00
parent 513ec059bf
commit cb43538c54
2 changed files with 156 additions and 0 deletions
@@ -0,0 +1,63 @@
+# backend/scripts
+
+Operational scripts for LearnSpace backend.
+
+## Cron setup (production)
+
+```
+# Daily backup at 4am
+0 4 * * *  /path/to/repo/backend/scripts/backup.sh
+
+# Weekly verification at 6am Sunday (cron mails on non-zero exit)
+0 6 * * 0  /path/to/repo/backend/scripts/verify-backup.sh
+```
+
+## Scripts
+
+### backup.sh
+Creates a safe SQLite snapshot via `VACUUM INTO`. Keeps last 7 backups (configurable via `KEEP=14`).
+
+```sh
+./backup.sh                        # default: ../data/learnspace.db → ../../backups/
+./backup.sh /path/to/db /path/to/backups
+KEEP=14 ./backup.sh
+```
+
+### verify-backup.sh
+Restores the latest backup to `/tmp`, runs `PRAGMA integrity_check`, compares row counts vs production.
+
+Exit codes:
+- `0` — all checks passed
+- `2` — no backup files found
+- `3` — latest backup older than 48h (backup job may have stopped)
+- `4` — `integrity_check` failed (backup is corrupt)
+- `5` — user count diverged >5% from production
+
+```sh
+./verify-backup.sh
+BACKUP_DIR=/custom/backups PROD_DB=/custom/db.sqlite ./verify-backup.sh
+```
+
+### check-route-auth.js
+Scans `src/routes/*.js` for `:id`-bearing routes without an auth-guard middleware.
+Fails if new unprotected routes exceed the current baseline.
+
+```sh
+npm run lint:routes
+```
+
+### import-content.js  _(coming in Task 8)_
+Imports question collections from YAML manifests into the database.
+
+```sh
+npm run import:content -- ../content/phys/ct-2024.yaml
+```
+
+## Deploy order (first time / fresh server)
+
+```sh
+npm install
+npm run migrate
+npm run seed:permissions
+npm start
+```