52 lines
2.0 KiB
Markdown
52 lines
2.0 KiB
Markdown
# MSSQL backup via local S3 endpoint
|
|
|
|
Custom S3-compatible HTTPS server (no MinIO). SQL Server 2022+ backs up with `BACKUP TO URL`; files land on disk under `data/sqlbackups/`.
|
|
|
|
## Quick start
|
|
|
|
```bash
|
|
npm run backup:s3
|
|
```
|
|
|
|
First run installs the CA into the `mssql` Docker container (`/var/opt/mssql/security/ca-certificates/`) and restarts SQL Server — required on Linux.
|
|
|
|
## Commands
|
|
|
|
| Command | Description |
|
|
|---------|-------------|
|
|
| `npm run backup:s3` | Start S3 endpoint + backup `MSSQL_DATABASE` from `.env` |
|
|
| `npm run backup:s3:quick` | Same, but skip PAL CA install/restart (after first setup) |
|
|
| `node scripts/s3-backup/backup.mjs --all` | Backup `eazybusiness` and `Mandant_3` |
|
|
| `node scripts/s3-backup/backup.mjs --server-only` | Run endpoint only |
|
|
| `npm run backup:s3 -- --skip-trust` | Skip CA install (npm needs `--` before script args) |
|
|
|
|
## Layout
|
|
|
|
```
|
|
scripts/s3-backup/
|
|
server.mjs S3-compatible HTTPS server (SigV4, multipart upload)
|
|
backup.mjs Orchestrator: trust CA → start server → sqlcmd BACKUP
|
|
config.mjs Host, port, credentials
|
|
ensure-certs.mjs TLS certs + Docker MSSQL PAL trust
|
|
sigv4.mjs AWS Signature V4 verification
|
|
data/sqlbackups/ Backup files written here
|
|
```
|
|
|
|
## Configuration
|
|
|
|
Reads `MSSQL_*` from repo `.env`. Optional overrides:
|
|
|
|
| Variable | Default | Description |
|
|
|----------|---------|-------------|
|
|
| `S3_BACKUP_HOST` | Docker bridge IP (`172.17.0.1`) | Host SQL Server uses in `s3://` URL |
|
|
| `S3_BACKUP_PORT` | `19443` | HTTPS port |
|
|
| `S3_BACKUP_ACCESS_KEY` | `jtlsrv-s3` | S3 access key |
|
|
| `S3_BACKUP_SECRET_KEY` | `jtlsrv-s3-secret` | S3 secret key |
|
|
| `MSSQL_DOCKER_CONTAINER` | `mssql` | Container name for CA install |
|
|
|
|
## Notes
|
|
|
|
- MSSQL runs in Docker: the endpoint binds `0.0.0.0` and uses the docker bridge IP so the container can reach it.
|
|
- SQL Server on Linux uses **SQLPAL** for outbound TLS — the CA must be in `/var/opt/mssql/security/ca-certificates/`, not only the OS trust store.
|
|
- Regenerating certs requires re-running without `--skip-trust` so PAL stays in sync.
|