Files
Lageplan/src/lib/backup/destinations.ts
Pepe Ziberi 28d346d0f5
All checks were successful
Build and Push Docker Image / build-and-push (push) Successful in 54m48s
feat(backup): GUI-konfigurierbares, verschlüsseltes Off-Site-Backup (SFTP/Nextcloud) (v1.9.0)
Admin → Backup: Ziel (SFTP oder Nextcloud/WebDAV) konfigurieren, Verbindung testen, Jetzt sichern,
Zeitplan (aus/täglich/wöchentlich) + Aufbewahrung. Best Practice: verschlüsselt + off-site.

- Verschlüsselung: Backup als tar.gz (database.dump + MinIO-Dateien) → AES-256-GCM mit Passphrase.
  Zugangsdaten + Passphrase verschlüsselt in DB (src/lib/crypto-secret.ts, Schlüssel aus Server-Secret)
- Engine (src/lib/backup): pg_dump + archiver-Stream aus MinIO + Stream-Verschlüsselung + Upload + Prune
- Ziel-Adapter: SFTP (ssh2-sftp-client) + WebDAV (webdav), je test/upload/list/delete
- API (SERVER_ADMIN): /api/admin/backup/{config,test,run}; öffentlich per CRON_SECRET: /api/cron/backup
- Scheduler in server-custom.js (stündliche Fälligkeitsprüfung)
- Dockerfile: postgresql16-client (pg_dump) + runtime-Libs; next.config serverExternalPackages
- scripts/decrypt-backup.js + docs/BACKUP.md (Restore-Anleitung), .env.example (CRON_SECRET, BACKUP_ENC_KEY)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-23 23:33:48 +02:00

102 lines
4.6 KiB
TypeScript

import { createReadStream, readFileSync } from 'fs'
import type { BackupDestinationType } from './config'
// Entschlüsselte (Klartext-)Zugangsdaten — werden vom Aufrufer aus der Konfig entschlüsselt.
export interface SftpPlain { host: string; port: number; username: string; password: string; remotePath: string }
export interface WebdavPlain { url: string; username: string; password: string; remotePath: string }
export type PlainDest = SftpPlain | WebdavPlain
export interface RemoteFile { name: string; size?: number; modified?: number }
function joinRemote(dir: string, name: string): string {
return `${dir.replace(/\/+$/, '')}/${name}`
}
// ─── SFTP ───────────────────────────────────────────────
async function withSftp<T>(c: SftpPlain, fn: (sftp: any) => Promise<T>): Promise<T> {
const SftpClient = (await import('ssh2-sftp-client')).default
const sftp = new SftpClient()
await sftp.connect({ host: c.host, port: c.port || 22, username: c.username, password: c.password, readyTimeout: 15000 })
try {
return await fn(sftp)
} finally {
try { await sftp.end() } catch { /* ignore */ }
}
}
// ─── WebDAV (Nextcloud) ─────────────────────────────────
async function getWebdav(c: WebdavPlain) {
const { createClient } = await import('webdav')
return createClient(c.url, { username: c.username, password: c.password })
}
// ─── Öffentliche, typ-übergreifende API ─────────────────
export async function testDestination(type: BackupDestinationType, dest: PlainDest): Promise<{ ok: boolean; message: string }> {
try {
const marker = Buffer.from(`lageplan-backup-test ${new Date().toISOString()}`)
if (type === 'sftp') {
const c = dest as SftpPlain
await withSftp(c, async (sftp) => {
if (!(await sftp.exists(c.remotePath))) await sftp.mkdir(c.remotePath, true)
const p = joinRemote(c.remotePath, '.lageplan-test')
await sftp.put(marker, p)
await sftp.delete(p)
})
return { ok: true, message: 'SFTP-Verbindung und Schreibzugriff ok.' }
}
const c = dest as WebdavPlain
const dav = await getWebdav(c)
if (!(await dav.exists(c.remotePath))) await dav.createDirectory(c.remotePath, { recursive: true } as any)
const p = joinRemote(c.remotePath, '.lageplan-test')
await dav.putFileContents(p, marker)
await dav.deleteFile(p)
return { ok: true, message: 'WebDAV-Verbindung und Schreibzugriff ok.' }
} catch (e: any) {
return { ok: false, message: e?.message || 'Verbindung fehlgeschlagen.' }
}
}
export async function uploadBackup(type: BackupDestinationType, dest: PlainDest, localPath: string, remoteName: string): Promise<void> {
if (type === 'sftp') {
const c = dest as SftpPlain
await withSftp(c, async (sftp) => {
if (!(await sftp.exists(c.remotePath))) await sftp.mkdir(c.remotePath, true)
await sftp.put(createReadStream(localPath), joinRemote(c.remotePath, remoteName))
})
return
}
const c = dest as WebdavPlain
const dav = await getWebdav(c)
if (!(await dav.exists(c.remotePath))) await dav.createDirectory(c.remotePath, { recursive: true } as any)
// Für WebDAV als Buffer hochladen (Backups einer kleinen Feuerwehr sind moderat gross).
await dav.putFileContents(joinRemote(c.remotePath, remoteName), readFileSync(localPath), { overwrite: true } as any)
}
export async function listBackups(type: BackupDestinationType, dest: PlainDest): Promise<RemoteFile[]> {
if (type === 'sftp') {
const c = dest as SftpPlain
return withSftp(c, async (sftp) => {
if (!(await sftp.exists(c.remotePath))) return []
const list = await sftp.list(c.remotePath)
return list.filter((f: any) => f.type === '-').map((f: any) => ({ name: f.name, size: f.size, modified: f.modifyTime }))
})
}
const c = dest as WebdavPlain
const dav = await getWebdav(c)
if (!(await dav.exists(c.remotePath))) return []
const items = (await dav.getDirectoryContents(c.remotePath)) as any[]
return items.filter(i => i.type === 'file').map(i => ({ name: i.basename, size: i.size, modified: i.lastmod ? Date.parse(i.lastmod) : undefined }))
}
export async function deleteBackup(type: BackupDestinationType, dest: PlainDest, name: string): Promise<void> {
if (type === 'sftp') {
const c = dest as SftpPlain
await withSftp(c, async (sftp) => { await sftp.delete(joinRemote(c.remotePath, name)) })
return
}
const c = dest as WebdavPlain
const dav = await getWebdav(c)
await dav.deleteFile(joinRemote(c.remotePath, name))
}