Configure MinIO backup and disaster recovery with automated snapshots and replication

#!/usr/bin/env bash
set -euo pipefail

# MinIO Backup and Disaster Recovery Installation Script
# Configures automated snapshots, replication, and backup tools

# Colors for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly BLUE='\033[0;34m'
readonly NC='\033[0m'

# Global variables
readonly SCRIPT_NAME=$(basename "$0")
readonly LOG_FILE="/var/log/minio-backup-install.log"
readonly BACKUP_DIR="/etc/minio/backup-keys"
readonly BACKUP_SCRIPT="/usr/local/bin/minio-backup.sh"

usage() {
    echo "Usage: $SCRIPT_NAME PRIMARY_URL BACKUP_URL [PRIMARY_ACCESS_KEY] [PRIMARY_SECRET_KEY] [BACKUP_ACCESS_KEY] [BACKUP_SECRET_KEY]"
    echo "Example: $SCRIPT_NAME https://minio1.example.com:9000 https://minio2.example.com:9000"
    echo "         $SCRIPT_NAME https://minio1.example.com:9000 https://minio2.example.com:9000 minioadmin SecurePass123 backupadmin BackupPass456"
    exit 1
}

log() {
    local level="$1"
    shift
    local message="$*"
    local color=""
    case "$level" in
        ERROR) color="$RED" ;;
        SUCCESS) color="$GREEN" ;;
        WARNING) color="$YELLOW" ;;
        INFO) color="$BLUE" ;;
    esac
    echo -e "${color}$(date '+%Y-%m-%d %H:%M:%S') [$level] $message${NC}" | tee -a "$LOG_FILE"
}

cleanup() {
    log "WARNING" "Script interrupted. Cleaning up..."
    # Add cleanup logic here if needed
    exit 1
}

trap cleanup ERR INT TERM

check_prerequisites() {
    log "INFO" "[1/8] Checking prerequisites..."
    
    if [[ $EUID -ne 0 ]]; then
        log "ERROR" "This script must be run as root or with sudo"
        exit 1
    fi

    if ! command -v curl >/dev/null 2>&1; then
        log "ERROR" "curl is required but not installed"
        exit 1
    fi
}

detect_distro() {
    log "INFO" "[2/8] Detecting distribution..."
    
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian)
                PKG_MGR="apt"
                PKG_UPDATE="apt update && apt upgrade -y"
                PKG_INSTALL="apt install -y"
                CRON_SERVICE="cron"
                ;;
            almalinux|rocky|centos|rhel|ol)
                PKG_MGR="dnf"
                PKG_UPDATE="dnf update -y"
                PKG_INSTALL="dnf install -y"
                CRON_SERVICE="crond"
                ;;
            fedora)
                PKG_MGR="dnf"
                PKG_UPDATE="dnf update -y"
                PKG_INSTALL="dnf install -y"
                CRON_SERVICE="crond"
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_UPDATE="yum update -y"
                PKG_INSTALL="yum install -y"
                CRON_SERVICE="crond"
                ;;
            *)
                log "ERROR" "Unsupported distribution: $ID"
                exit 1
                ;;
        esac
        log "SUCCESS" "Detected distribution: $PRETTY_NAME"
    else
        log "ERROR" "Cannot detect distribution"
        exit 1
    fi
}

update_system() {
    log "INFO" "[3/8] Updating system packages..."
    
    case "$PKG_MGR" in
        apt)
            $PKG_UPDATE
            $PKG_INSTALL curl wget gnupg2 rsync gzip tar cron openssl
            ;;
        dnf|yum)
            $PKG_UPDATE
            $PKG_INSTALL curl wget gnupg2 rsync gzip tar cronie openssl
            systemctl enable --now "$CRON_SERVICE"
            ;;
    esac
    
    log "SUCCESS" "System packages updated"
}

install_minio_client() {
    log "INFO" "[4/8] Installing MinIO client..."
    
    curl -fsSL https://dl.min.io/client/mc/release/linux-amd64/mc -o /usr/local/bin/mc
    chmod 755 /usr/local/bin/mc
    chown root:root /usr/local/bin/mc
    
    if ! mc --version >/dev/null 2>&1; then
        log "ERROR" "MinIO client installation failed"
        exit 1
    fi
    
    log "SUCCESS" "MinIO client installed successfully"
}

setup_backup_directories() {
    log "INFO" "[5/8] Setting up backup directory structure..."
    
    mkdir -p "$BACKUP_DIR"
    chmod 700 "$BACKUP_DIR"
    chown root:root "$BACKUP_DIR"
    
    mkdir -p /var/log
    touch "$LOG_FILE"
    chmod 644 "$LOG_FILE"
    chown root:root "$LOG_FILE"
    
    log "SUCCESS" "Backup directories created"
}

generate_encryption_key() {
    log "INFO" "[6/8] Generating encryption keys..."
    
    local key_file="$BACKUP_DIR/backup-encryption.key"
    openssl rand -hex 32 > "$key_file"
    chmod 600 "$key_file"
    chown root:root "$key_file"
    
    log "SUCCESS" "Encryption key generated at $key_file"
}

create_backup_script() {
    log "INFO" "[7/8] Creating backup automation script..."
    
    cat > "$BACKUP_SCRIPT" << 'EOF'
#!/usr/bin/env bash
set -euo pipefail

# MinIO Backup Automation Script
readonly PRIMARY_ALIAS="primary"
readonly BACKUP_ALIAS="backup"
readonly BACKUP_BUCKET="backups"
readonly ENCRYPTION_KEY_FILE="/etc/minio/backup-keys/backup-encryption.key"
readonly LOG_FILE="/var/log/minio-backup.log"
readonly RETENTION_DAYS=30
readonly DATE=$(date +%Y%m%d-%H%M%S)

log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

backup_bucket() {
    local source_bucket=$1
    local backup_name="${source_bucket}-${DATE}"
    
    log "Starting backup of bucket: $source_bucket"
    
    if [ -f "$ENCRYPTION_KEY_FILE" ]; then
        local encryption_key=$(cat "$ENCRYPTION_KEY_FILE")
        mc mirror --encrypt-key "${PRIMARY_ALIAS}/${source_bucket}=${encryption_key}" \
            "${PRIMARY_ALIAS}/${source_bucket}" \
            "${BACKUP_ALIAS}/${BACKUP_BUCKET}/${backup_name}"
    else
        mc mirror "${PRIMARY_ALIAS}/${source_bucket}" \
            "${BACKUP_ALIAS}/${BACKUP_BUCKET}/${backup_name}"
    fi
    
    log "Backup completed for bucket: $source_bucket"
}

cleanup_old_backups() {
    log "Cleaning up backups older than ${RETENTION_DAYS} days"
    mc find "${BACKUP_ALIAS}/${BACKUP_BUCKET}" --older-than "${RETENTION_DAYS}d" --exec "mc rm {}"
    log "Old backup cleanup completed"
}

main() {
    log "Starting MinIO backup process"
    
    # Get list of buckets from primary
    local buckets
    buckets=$(mc ls "$PRIMARY_ALIAS" | awk '{print $5}' | grep -v "^$" || true)
    
    if [ -z "$buckets" ]; then
        log "No buckets found to backup"
        exit 0
    fi
    
    # Backup each bucket
    while IFS= read -r bucket; do
        if [[ "$bucket" != "$BACKUP_BUCKET" ]]; then
            backup_bucket "$bucket"
        fi
    done <<< "$buckets"
    
    # Cleanup old backups
    cleanup_old_backups
    
    log "MinIO backup process completed successfully"
}

main "$@"
EOF

    chmod 755 "$BACKUP_SCRIPT"
    chown root:root "$BACKUP_SCRIPT"
    
    log "SUCCESS" "Backup script created at $BACKUP_SCRIPT"
}

configure_minio_aliases() {
    log "INFO" "[8/8] Configuring MinIO client aliases..."
    
    local primary_url="$1"
    local backup_url="$2"
    local primary_access="${3:-minioadmin}"
    local primary_secret="${4:-SecurePassword123!}"
    local backup_access="${5:-minioadmin}"
    local backup_secret="${6:-BackupPassword456!}"
    
    # Configure aliases
    mc alias set primary "$primary_url" "$primary_access" "$primary_secret" 2>/dev/null || {
        log "WARNING" "Could not connect to primary MinIO instance. Please configure manually:"
        log "INFO" "mc alias set primary $primary_url <access_key> <secret_key>"
    }
    
    mc alias set backup "$backup_url" "$backup_access" "$backup_secret" 2>/dev/null || {
        log "WARNING" "Could not connect to backup MinIO instance. Please configure manually:"
        log "INFO" "mc alias set backup $backup_url <access_key> <secret_key>"
    }
    
    # Create backup buckets if connection successful
    if mc alias ls primary >/dev/null 2>&1; then
        mc mb primary/backups 2>/dev/null || log "INFO" "Bucket 'backups' may already exist"
        mc version enable primary/backups 2>/dev/null || true
    fi
    
    if mc alias ls backup >/dev/null 2>&1; then
        mc mb backup/disaster-recovery 2>/dev/null || log "INFO" "Bucket 'disaster-recovery' may already exist"
        mc mb backup/snapshots 2>/dev/null || log "INFO" "Bucket 'snapshots' may already exist"
        mc version enable backup/disaster-recovery 2>/dev/null || true
        mc version enable backup/snapshots 2>/dev/null || true
    fi
    
    log "SUCCESS" "MinIO aliases configured"
}

verify_installation() {
    log "INFO" "Verifying installation..."
    
    local errors=0
    
    if [ ! -f /usr/local/bin/mc ]; then
        log "ERROR" "MinIO client not found"
        ((errors++))
    fi
    
    if [ ! -f "$BACKUP_SCRIPT" ]; then
        log "ERROR" "Backup script not found"
        ((errors++))
    fi
    
    if [ ! -d "$BACKUP_DIR" ]; then
        log "ERROR" "Backup directory not found"
        ((errors++))
    fi
    
    if [ ! -f "$BACKUP_DIR/backup-encryption.key" ]; then
        log "ERROR" "Encryption key not found"
        ((errors++))
    fi
    
    if [ $errors -eq 0 ]; then
        log "SUCCESS" "Installation completed successfully!"
        log "INFO" "Next steps:"
        log "INFO" "1. Review and test backup script: $BACKUP_SCRIPT"
        log "INFO" "2. Set up cron job for automated backups"
        log "INFO" "3. Configure bucket replication with: mc replicate add primary/bucket backup/disaster-recovery"
        log "INFO" "4. Test disaster recovery procedures"
    else
        log "ERROR" "Installation completed with $errors errors"
        exit 1
    fi
}

main() {
    if [ $# -lt 2 ]; then
        usage
    fi
    
    local primary_url="$1"
    local backup_url="$2"
    local primary_access="${3:-}"
    local primary_secret="${4:-}"
    local backup_access="${5:-}"
    local backup_secret="${6:-}"
    
    log "INFO" "Starting MinIO backup and disaster recovery setup"
    
    check_prerequisites
    detect_distro
    update_system
    install_minio_client
    setup_backup_directories
    generate_encryption_key
    create_backup_script
    configure_minio_aliases "$primary_url" "$backup_url" "$primary_access" "$primary_secret" "$backup_access" "$backup_secret"
    verify_installation
    
    log "SUCCESS" "MinIO backup and disaster recovery setup completed!"
}

main "$@"