u

scripts/s3-backup/README.md

@@ -0,0 +1,51 @@
+# MSSQL backup via local S3 endpoint
+
+Custom S3-compatible HTTPS server (no MinIO). SQL Server 2022+ backs up with `BACKUP TO URL`; files land on disk under `data/sqlbackups/`.
+
+## Quick start
+
+```bash
+npm run backup:s3
+```
+
+First run installs the CA into the `mssql` Docker container (`/var/opt/mssql/security/ca-certificates/`) and restarts SQL Server — required on Linux.
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `npm run backup:s3` | Start S3 endpoint + backup `MSSQL_DATABASE` from `.env` |
+| `npm run backup:s3:quick` | Same, but skip PAL CA install/restart (after first setup) |
+| `node scripts/s3-backup/backup.mjs --all` | Backup `eazybusiness` and `Mandant_3` |
+| `node scripts/s3-backup/backup.mjs --server-only` | Run endpoint only |
+| `npm run backup:s3 -- --skip-trust` | Skip CA install (npm needs `--` before script args) |
+
+## Layout
+
+```
+scripts/s3-backup/
+  server.mjs      S3-compatible HTTPS server (SigV4, multipart upload)
+  backup.mjs      Orchestrator: trust CA → start server → sqlcmd BACKUP
+  config.mjs      Host, port, credentials
+  ensure-certs.mjs  TLS certs + Docker MSSQL PAL trust
+  sigv4.mjs       AWS Signature V4 verification
+  data/sqlbackups/  Backup files written here
+```
+
+## Configuration
+
+Reads `MSSQL_*` from repo `.env`. Optional overrides:
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `S3_BACKUP_HOST` | Docker bridge IP (`172.17.0.1`) | Host SQL Server uses in `s3://` URL |
+| `S3_BACKUP_PORT` | `19443` | HTTPS port |
+| `S3_BACKUP_ACCESS_KEY` | `jtlsrv-s3` | S3 access key |
+| `S3_BACKUP_SECRET_KEY` | `jtlsrv-s3-secret` | S3 secret key |
+| `MSSQL_DOCKER_CONTAINER` | `mssql` | Container name for CA install |
+
+## Notes
+
+- MSSQL runs in Docker: the endpoint binds `0.0.0.0` and uses the docker bridge IP so the container can reach it.
+- SQL Server on Linux uses **SQLPAL** for outbound TLS — the CA must be in `/var/opt/mssql/security/ca-certificates/`, not only the OS trust store.
+- Regenerating certs requires re-running without `--skip-trust` so PAL stays in sync.