Implement encryption for Consul backups using GPG with automated snapshots and secure storage

#!/usr/bin/env bash

set -euo pipefail

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Configuration
CONSUL_BACKUP_USER="consul-backup"
CONSUL_BACKUP_DIR="/opt/consul-backup"
GPG_KEY_EMAIL="consul-backup@$(hostname -f)"
GPG_KEY_NAME="Consul Backup Key"

log() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

error() {
    echo -e "${RED}[ERROR]${NC} $1" >&2
    exit 1
}

cleanup() {
    if [[ -n "${TEMP_DIR:-}" && -d "$TEMP_DIR" ]]; then
        rm -rf "$TEMP_DIR"
    fi
}

trap cleanup ERR EXIT

check_prerequisites() {
    if [[ $EUID -ne 0 ]]; then
        error "This script must be run as root"
    fi
    
    if ! command -v consul >/dev/null 2>&1; then
        error "Consul is not installed or not in PATH"
    fi
    
    if ! consul version >/dev/null 2>&1; then
        error "Cannot execute consul command"
    fi
}

detect_distro() {
    if [[ ! -f /etc/os-release ]]; then
        error "Cannot detect OS distribution"
    fi
    
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update -y"
            PKG_INSTALL="apt install -y"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            ;;
        *)
            error "Unsupported distribution: $ID"
            ;;
    esac
}

update_packages() {
    log "Updating system packages..."
    $PKG_UPDATE || error "Failed to update packages"
}

install_packages() {
    log "Installing required packages..."
    local packages="gnupg2 gzip bzip2 curl jq rsync"
    
    if command -v aws >/dev/null 2>&1; then
        log "AWS CLI already installed"
    else
        if [[ "$PKG_MGR" == "apt" ]]; then
            packages="$packages awscli"
        else
            packages="$packages awscli2"
        fi
    fi
    
    $PKG_INSTALL $packages || error "Failed to install packages"
}

create_backup_user() {
    log "Creating dedicated backup user..."
    
    if id "$CONSUL_BACKUP_USER" >/dev/null 2>&1; then
        warn "User $CONSUL_BACKUP_USER already exists"
    else
        useradd -r -s /bin/bash -d "$CONSUL_BACKUP_DIR" -m "$CONSUL_BACKUP_USER" || error "Failed to create user"
    fi
    
    mkdir -p "$CONSUL_BACKUP_DIR"/{keys,scripts,backups,logs}
    chown -R "$CONSUL_BACKUP_USER:$CONSUL_BACKUP_USER" "$CONSUL_BACKUP_DIR"
    chmod 700 "$CONSUL_BACKUP_DIR"
}

generate_gpg_key() {
    log "Generating GPG key pair..."
    
    TEMP_DIR=$(mktemp -d)
    
    cat > "$TEMP_DIR/gpg-batch" <<EOF
%echo Generating GPG key for Consul backups
Key-Type: RSA
Key-Length: 4096
Subkey-Type: RSA
Subkey-Length: 4096
Name-Real: $GPG_KEY_NAME
Name-Email: $GPG_KEY_EMAIL
Expire-Date: 2y
Passphrase: 
%commit
%echo Done
EOF

    sudo -u "$CONSUL_BACKUP_USER" gpg --batch --generate-key "$TEMP_DIR/gpg-batch" || error "GPG key generation failed"
    
    local key_id
    key_id=$(sudo -u "$CONSUL_BACKUP_USER" gpg --list-keys --with-colons "$GPG_KEY_EMAIL" | awk -F: '/^pub:/ { print $5 }')
    
    if [[ -z "$key_id" ]]; then
        error "Failed to retrieve GPG key ID"
    fi
    
    echo "$key_id" | sudo -u "$CONSUL_BACKUP_USER" tee "$CONSUL_BACKUP_DIR/keys/gpg-key-id" >/dev/null
    chmod 600 "$CONSUL_BACKUP_DIR/keys/gpg-key-id"
    
    log "GPG key generated with ID: $key_id"
}

create_backup_script() {
    log "Creating backup script..."
    
    cat > "$CONSUL_BACKUP_DIR/scripts/consul-backup.sh" <<'EOF'
#!/bin/bash
set -euo pipefail

BACKUP_DIR="/opt/consul-backup/backups"
LOG_DIR="/opt/consul-backup/logs"
GPG_KEY_ID=$(cat /opt/consul-backup/keys/gpg-key-id)
CONSUL_TOKEN_FILE="/opt/consul-backup/consul.token"
COMPRESSION_LEVEL=6
RETENTION_DAYS=30

BACKUP_NAME="consul-snapshot-$(date +%Y%m%d-%H%M%S)"
LOG_FILE="${LOG_DIR}/backup-$(date +%Y%m%d).log"

log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "${LOG_FILE}"
}

error_exit() {
    log "ERROR: $1"
    exit 1
}

if ! consul members >/dev/null 2>&1; then
    error_exit "Cannot connect to Consul cluster"
fi

TEMP_DIR=$(mktemp -d)
trap "rm -rf ${TEMP_DIR}" EXIT

log "Creating Consul snapshot"
if [[ -f "${CONSUL_TOKEN_FILE}" ]]; then
    CONSUL_HTTP_TOKEN=$(cat "${CONSUL_TOKEN_FILE}")
    export CONSUL_HTTP_TOKEN
fi

consul snapshot save "${TEMP_DIR}/${BACKUP_NAME}.snap" 2>>"${LOG_FILE}" || error_exit "Failed to create Consul snapshot"

log "Verifying snapshot integrity"
consul snapshot inspect "${TEMP_DIR}/${BACKUP_NAME}.snap" >/dev/null 2>>"${LOG_FILE}" || error_exit "Snapshot verification failed"

log "Compressing snapshot with gzip level ${COMPRESSION_LEVEL}"
gzip -${COMPRESSION_LEVEL} "${TEMP_DIR}/${BACKUP_NAME}.snap" || error_exit "Compression failed"

log "Encrypting backup with GPG key ${GPG_KEY_ID}"
gpg --trust-model always --batch --yes --compress-algo 0 \
    --cipher-algo AES256 --digest-algo SHA512 \
    --s2k-digest-algo SHA512 --s2k-cipher-algo AES256 \
    --recipient "${GPG_KEY_ID}" \
    --encrypt "${TEMP_DIR}/${BACKUP_NAME}.snap.gz" \
    2>>"${LOG_FILE}" || error_exit "GPG encryption failed"

log "Moving encrypted backup to storage directory"
mv "${TEMP_DIR}/${BACKUP_NAME}.snap.gz.gpg" "${BACKUP_DIR}/" || error_exit "Failed to move backup file"

log "Creating backup metadata"
cat > "${BACKUP_DIR}/${BACKUP_NAME}.meta" <<METADATA
{
  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "backup_name": "${BACKUP_NAME}",
  "hostname": "$(hostname)",
  "consul_version": "$(consul version | head -n1)",
  "gpg_key_id": "${GPG_KEY_ID}",
  "compression": "gzip-${COMPRESSION_LEVEL}",
  "encryption": "GPG-AES256"
}
METADATA

log "Cleaning old backups (retention: ${RETENTION_DAYS} days)"
find "${BACKUP_DIR}" -name "consul-snapshot-*.gpg" -mtime +${RETENTION_DAYS} -delete 2>>"${LOG_FILE}" || true
find "${BACKUP_DIR}" -name "consul-snapshot-*.meta" -mtime +${RETENTION_DAYS} -delete 2>>"${LOG_FILE}" || true
find "${LOG_DIR}" -name "backup-*.log" -mtime +7 -delete 2>/dev/null || true

BACKUP_SIZE=$(du -h "${BACKUP_DIR}/${BACKUP_NAME}.snap.gz.gpg" | cut -f1)
BACKUP_COUNT=$(ls -1 "${BACKUP_DIR}"/*.gpg 2>/dev/null | wc -l)

log "Backup completed successfully: ${BACKUP_NAME}.snap.gz.gpg"
log "Backup size: ${BACKUP_SIZE}"
log "Available backups: ${BACKUP_COUNT}"

exit 0
EOF

    chown "$CONSUL_BACKUP_USER:$CONSUL_BACKUP_USER" "$CONSUL_BACKUP_DIR/scripts/consul-backup.sh"
    chmod 750 "$CONSUL_BACKUP_DIR/scripts/consul-backup.sh"
}

create_restore_script() {
    log "Creating restore script..."
    
    cat > "$CONSUL_BACKUP_DIR/scripts/consul-restore.sh" <<'EOF'
#!/bin/bash
set -euo pipefail

BACKUP_DIR="/opt/consul-backup/backups"

if [[ $# -ne 1 ]]; then
    echo "Usage: $0 <backup-file.gpg>"
    echo "Available backups:"
    ls -1 "${BACKUP_DIR}"/*.gpg 2>/dev/null | xargs -n1 basename || echo "No backups found"
    exit 1
fi

BACKUP_FILE="$1"
if [[ ! -f "${BACKUP_DIR}/${BACKUP_FILE}" ]]; then
    echo "ERROR: Backup file not found: ${BACKUP_DIR}/${BACKUP_FILE}"
    exit 1
fi

TEMP_DIR=$(mktemp -d)
trap "rm -rf ${TEMP_DIR}" EXIT

echo "Decrypting backup..."
gpg --batch --yes --decrypt "${BACKUP_DIR}/${BACKUP_FILE}" > "${TEMP_DIR}/backup.snap.gz"

echo "Decompressing backup..."
gunzip "${TEMP_DIR}/backup.snap.gz"

echo "Restoring Consul snapshot..."
consul snapshot restore "${TEMP_DIR}/backup.snap"

echo "Restore completed successfully"
EOF

    chown "$CONSUL_BACKUP_USER:$CONSUL_BACKUP_USER" "$CONSUL_BACKUP_DIR/scripts/consul-restore.sh"
    chmod 750 "$CONSUL_BACKUP_DIR/scripts/consul-restore.sh"
}

create_cron_job() {
    log "Creating cron job for automated backups..."
    
    cat > /etc/cron.d/consul-backup <<EOF
# Consul encrypted backup - runs daily at 2 AM
0 2 * * * $CONSUL_BACKUP_USER /opt/consul-backup/scripts/consul-backup.sh >/dev/null 2>&1
EOF
    
    chmod 644 /etc/cron.d/consul-backup
}

verify_installation() {
    log "Verifying installation..."
    
    if [[ ! -f "$CONSUL_BACKUP_DIR/keys/gpg-key-id" ]]; then
        error "GPG key ID file not found"
    fi
    
    if [[ ! -x "$CONSUL_BACKUP_DIR/scripts/consul-backup.sh" ]]; then
        error "Backup script not executable"
    fi
    
    if [[ ! -x "$CONSUL_BACKUP_DIR/scripts/consul-restore.sh" ]]; then
        error "Restore script not executable"
    fi
    
    if [[ ! -f /etc/cron.d/consul-backup ]]; then
        error "Cron job not created"
    fi
    
    local key_id
    key_id=$(cat "$CONSUL_BACKUP_DIR/keys/gpg-key-id")
    
    if ! sudo -u "$CONSUL_BACKUP_USER" gpg --list-keys "$key_id" >/dev/null 2>&1; then
        error "GPG key not accessible"
    fi
}

main() {
    log "Starting Consul backup encryption setup..."
    
    echo "[1/9] Checking prerequisites..."
    check_prerequisites
    
    echo "[2/9] Detecting distribution..."
    detect_distro
    
    echo "[3/9] Updating packages..."
    update_packages
    
    echo "[4/9] Installing required packages..."
    install_packages
    
    echo "[5/9] Creating backup user..."
    create_backup_user
    
    echo "[6/9] Generating GPG key pair..."
    generate_gpg_key
    
    echo "[7/9] Creating backup script..."
    create_backup_script
    
    echo "[8/9] Creating restore script..."
    create_restore_script
    
    echo "[9/9] Setting up automated backups..."
    create_cron_job
    
    log "Verifying installation..."
    verify_installation
    
    log "Setup completed successfully!"
    log "Backup script: $CONSUL_BACKUP_DIR/scripts/consul-backup.sh"
    log "Restore script: $CONSUL_BACKUP_DIR/scripts/consul-restore.sh"
    log "Automated backups: Daily at 2:00 AM"
    
    warn "Optional: Place Consul token in $CONSUL_BACKUP_DIR/consul.token for ACL-enabled clusters"
}

main "$@"