Implement Redis backup automation with compression and encryption

#!/usr/bin/env bash
set -euo pipefail

# Redis Backup Automation Installation Script
# Implements automated Redis backups with compression and encryption

# Colors for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly NC='\033[0m'

# Configuration
readonly REDIS_USER="redis"
readonly BACKUP_DIR="/var/backups/redis"
readonly SCRIPT_DIR="/opt/redis-backup"
readonly GPG_KEY_NAME="redis-backup@$(hostname)"
readonly RETENTION_DAYS="7"

# Error handling
cleanup() {
    if [[ $? -ne 0 ]]; then
        echo -e "${RED}[ERROR] Installation failed. Cleaning up...${NC}"
        systemctl stop redis-backup.timer 2>/dev/null || true
        rm -rf "$SCRIPT_DIR" "$BACKUP_DIR" /etc/systemd/system/redis-backup.* 2>/dev/null || true
    fi
}
trap cleanup ERR

print_usage() {
    echo "Usage: $0 [OPTIONS]"
    echo "Options:"
    echo "  -r DAYS    Set backup retention days (default: 7)"
    echo "  -h         Show this help message"
    exit 1
}

log() {
    echo -e "${GREEN}$1${NC}"
}

warn() {
    echo -e "${YELLOW}$1${NC}"
}

error() {
    echo -e "${RED}$1${NC}" >&2
}

# Parse arguments
while getopts "r:h" opt; do
    case $opt in
        r) RETENTION_DAYS="$OPTARG" ;;
        h) print_usage ;;
        *) print_usage ;;
    esac
done

# Check prerequisites
if [[ $EUID -ne 0 ]]; then
    error "This script must be run as root"
    exit 1
fi

# Auto-detect distribution
if [[ -f /etc/os-release ]]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            ;;
        *)
            error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    error "Cannot detect distribution"
    exit 1
fi

log "[1/7] Updating system packages..."
$PKG_UPDATE

log "[2/7] Installing backup dependencies..."
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL gzip tar gnupg2 rsync redis-server redis-tools
else
    $PKG_INSTALL gzip tar gnupg2 rsync redis redis-cli
    systemctl enable --now redis
fi

log "[3/7] Creating backup directories..."
mkdir -p "$SCRIPT_DIR"/{scripts,logs}
mkdir -p "$BACKUP_DIR"
chown -R "$REDIS_USER":"$REDIS_USER" "$SCRIPT_DIR" "$BACKUP_DIR"
chmod 750 "$SCRIPT_DIR" "$BACKUP_DIR"

log "[4/7] Generating GPG encryption key..."
if ! sudo -u "$REDIS_USER" gpg --list-keys "$GPG_KEY_NAME" >/dev/null 2>&1; then
    sudo -u "$REDIS_USER" gpg --batch --gen-key <<EOF
Key-Type: RSA
Key-Length: 2048
Name-Real: Redis Backup
Name-Email: $GPG_KEY_NAME
Expire-Date: 0
%no-protection
%commit
EOF
fi

log "[5/7] Creating backup script..."
cat > "$SCRIPT_DIR/scripts/redis-backup.sh" <<'SCRIPT_EOF'
#!/usr/bin/env bash
set -euo pipefail

# Configuration
REDIS_HOST="localhost"
REDIS_PORT="6379"
BACKUP_DIR="/var/backups/redis"
LOG_FILE="/opt/redis-backup/logs/backup.log"
GPG_RECIPIENT="redis-backup@$(hostname)"
RETENTION_DAYS="7"
REDIS_CLI="redis-cli"

# Logging
log_message() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

# Check Redis connectivity
check_redis() {
    if ! $REDIS_CLI -h "$REDIS_HOST" -p "$REDIS_PORT" ping > /dev/null 2>&1; then
        log_message "ERROR: Redis server is not responding"
        exit 1
    fi
}

# Create Redis backup
create_backup() {
    local backup_name="redis_backup_$(date +%Y%m%d_%H%M%S)"
    local redis_data_dir="/var/lib/redis"
    local dump_file="$redis_data_dir/dump.rdb"
    
    log_message "Starting Redis backup: $backup_name"
    
    # Force Redis save
    $REDIS_CLI -h "$REDIS_HOST" -p "$REDIS_PORT" BGSAVE
    
    # Wait for save to complete
    local last_save=$($REDIS_CLI -h "$REDIS_HOST" -p "$REDIS_PORT" LASTSAVE)
    while [[ $($REDIS_CLI -h "$REDIS_HOST" -p "$REDIS_PORT" LASTSAVE) -eq $last_save ]]; do
        sleep 1
    done
    
    if [[ ! -f "$dump_file" ]]; then
        log_message "ERROR: Redis dump file not found"
        exit 1
    fi
    
    # Copy and compress
    cp "$dump_file" "$BACKUP_DIR/${backup_name}.rdb"
    gzip "$BACKUP_DIR/${backup_name}.rdb"
    
    # Encrypt
    cd "$BACKUP_DIR"
    gpg --trust-model always --encrypt -r "$GPG_RECIPIENT" "${backup_name}.rdb.gz"
    rm "${backup_name}.rdb.gz"
    
    # Verify
    if [[ -f "${backup_name}.rdb.gz.gpg" && -s "${backup_name}.rdb.gz.gpg" ]]; then
        log_message "Backup created successfully: ${backup_name}.rdb.gz.gpg"
    else
        log_message "ERROR: Backup verification failed"
        exit 1
    fi
    
    # Cleanup old backups
    find "$BACKUP_DIR" -name "redis_backup_*.gpg" -mtime +$RETENTION_DAYS -delete
    log_message "Cleaned up backups older than $RETENTION_DAYS days"
}

# Main execution
main() {
    check_redis
    create_backup
    log_message "Redis backup completed successfully"
}

main "$@"
SCRIPT_EOF

chmod 755 "$SCRIPT_DIR/scripts/redis-backup.sh"
chown "$REDIS_USER":"$REDIS_USER" "$SCRIPT_DIR/scripts/redis-backup.sh"

# Update retention days in script
sed -i "s/RETENTION_DAYS=\"7\"/RETENTION_DAYS=\"$RETENTION_DAYS\"/" "$SCRIPT_DIR/scripts/redis-backup.sh"

log "[6/7] Creating systemd service and timer..."
cat > /etc/systemd/system/redis-backup.service <<EOF
[Unit]
Description=Redis Backup Service
After=redis.service

[Service]
Type=oneshot
User=$REDIS_USER
Group=$REDIS_USER
ExecStart=$SCRIPT_DIR/scripts/redis-backup.sh
StandardOutput=journal
StandardError=journal
EOF

cat > /etc/systemd/system/redis-backup.timer <<EOF
[Unit]
Description=Redis Backup Timer
Requires=redis-backup.service

[Timer]
OnCalendar=daily
Persistent=true
RandomizedDelaySec=300

[Install]
WantedBy=timers.target
EOF

systemctl daemon-reload
systemctl enable redis-backup.timer
systemctl start redis-backup.timer

log "[7/7] Verifying installation..."

# Test Redis connection
if systemctl is-active redis >/dev/null 2>&1 || systemctl is-active redis-server >/dev/null 2>&1; then
    log "✓ Redis service is running"
else
    warn "! Redis service not running - starting now"
    systemctl start redis 2>/dev/null || systemctl start redis-server
fi

# Test backup script
if sudo -u "$REDIS_USER" "$SCRIPT_DIR/scripts/redis-backup.sh"; then
    log "✓ Backup script executed successfully"
else
    error "✗ Backup script test failed"
    exit 1
fi

# Verify timer status
if systemctl is-active redis-backup.timer >/dev/null 2>&1; then
    log "✓ Backup timer is active"
else
    error "✗ Backup timer failed to start"
    exit 1
fi

log "Redis backup automation installed successfully!"
log "Backups will run daily and retain files for $RETENTION_DAYS days"
log "Check logs: $SCRIPT_DIR/logs/backup.log"
log "Timer status: systemctl status redis-backup.timer"