security hardening + drafts/attachments

scripts/backup.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+HERE=$(cd "$(dirname "$0")/.." && pwd)
+TS=$(date +%Y%m%d_%H%M%S)
+OUT="$HERE/backups"
+mkdir -p "$OUT"
+
+ARCHIVE="$OUT/mastermind_backup_${TS}.tar.gz"
+
+echo "[backup] stopping containers for consistent snapshot..."
+cd "$HERE"
+docker compose down
+
+echo "[backup] creating archive: $ARCHIVE"
+tar -czf "$ARCHIVE" \
+  data \
+  .env \
+  docker-compose.yml \
+  README.md INSTALL.md OPERATIONS.md DEVELOPMENT.md CHANGELOG.md \
+  web worker scripts \
+  2>/dev/null || true
+
+echo "[backup] starting containers..."
+docker compose up -d --build
+
+echo "[backup] done: $ARCHIVE"

scripts/restore.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ $# -ne 1 ]; then
+  echo "Usage: $0 <backup-archive.tar.gz>"
+  exit 1
+fi
+
+ARCHIVE="$1"
+HERE=$(cd "$(dirname "$0")/.." && pwd)
+
+cd "$HERE"
+
+echo "[restore] stopping containers..."
+docker compose down
+
+echo "[restore] wiping data/..."
+rm -rf data
+
+echo "[restore] extracting $ARCHIVE"
+tar -xzf "$ARCHIVE" -C "$HERE"
+
+echo "[restore] starting containers..."
+docker compose up -d --build
+
+echo "[restore] done"