jtlPosSync/scripts/s3-backup

MSSQL backup via local S3 endpoint

Custom S3-compatible HTTPS server (no MinIO). SQL Server 2022+ backs up with BACKUP TO URL; files land on disk under data/sqlbackups/.

Quick start

npm run backup:s3

First run installs the CA into the mssql Docker container (/var/opt/mssql/security/ca-certificates/) and restarts SQL Server — required on Linux.

Commands

Command	Description
npm run backup:s3	Start S3 endpoint + backup MSSQL_DATABASE from .env
npm run backup:s3:quick	Same, but skip PAL CA install/restart (after first setup)
node scripts/s3-backup/backup.mjs --all	Backup eazybusiness and Mandant_3
node scripts/s3-backup/backup.mjs --server-only	Run endpoint only
npm run backup:s3 -- --skip-trust	Skip CA install (npm needs -- before script args)

Layout

scripts/s3-backup/
  server.mjs      S3-compatible HTTPS server (SigV4, multipart upload)
  backup.mjs      Orchestrator: trust CA → start server → sqlcmd BACKUP
  config.mjs      Host, port, credentials
  ensure-certs.mjs  TLS certs + Docker MSSQL PAL trust
  sigv4.mjs       AWS Signature V4 verification
  data/sqlbackups/  Backup files written here

Configuration

Reads MSSQL_* from repo .env. Optional overrides:

Variable	Default	Description
S3_BACKUP_HOST	Docker bridge IP (172.17.0.1)	Host SQL Server uses in s3:// URL
S3_BACKUP_PORT	19443	HTTPS port
S3_BACKUP_ACCESS_KEY	jtlsrv-s3	S3 access key
S3_BACKUP_SECRET_KEY	jtlsrv-s3-secret	S3 secret key
MSSQL_DOCKER_CONTAINER	mssql	Container name for CA install

Notes

• MSSQL runs in Docker: the endpoint binds 0.0.0.0 and uses the docker bridge IP so the container can reach it.
• SQL Server on Linux uses SQLPAL for outbound TLS — the CA must be in /var/opt/mssql/security/ca-certificates/, not only the OS trust store.
• Regenerating certs requires re-running without --skip-trust so PAL stays in sync.