Backup database to Azure storage #353
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Backup production database | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| environment: | |
| description: Environment to backup | |
| required: true | |
| default: test | |
| type: choice | |
| options: | |
| - test | |
| - production | |
| backupFileName: | |
| description: Backup file name. Default is [SERVICE_SHORT]_[CONFIG_SHORT]_adhoc_YYYY-MM-DD | |
| required: false | |
| type: string | |
| default: default | |
| backupPTRServer: | |
| description: Set to true if backing up a point in time restored database server | |
| required: false | |
| type: boolean | |
| default: false | |
| schedule: | |
| - cron: "0 4 * * *" # 04:00 UTC | |
| env: | |
| SERVICE_SHORT: trs | |
| TF_VARS_PATH: terraform/aks/config | |
| jobs: | |
| backup: | |
| name: Backup database | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: ${{ inputs.environment || 'production' }} | |
| env: | |
| DEPLOY_ENV: ${{ inputs.environment || 'production' }} | |
| BACKUP_FILE: ${{ inputs.backupFileName || 'schedule' }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set environment variables | |
| run: | | |
| source global_config/${DEPLOY_ENV}.sh | |
| tf_vars_file=${TF_VARS_PATH}/${DEPLOY_ENV}.tfvars.json | |
| echo "CLUSTER=$(jq -r '.cluster' ${tf_vars_file})" >> $GITHUB_ENV | |
| echo "RESOURCE_GROUP_NAME=${AZURE_RESOURCE_PREFIX}-${SERVICE_SHORT}-${CONFIG_SHORT}-rg" >> $GITHUB_ENV | |
| echo "STORAGE_ACCOUNT_NAME=${AZURE_RESOURCE_PREFIX}${SERVICE_SHORT}dbbkp${CONFIG_SHORT}sa" >> $GITHUB_ENV | |
| TODAY=$(date +"%F") | |
| echo "DB_SERVER=${AZURE_RESOURCE_PREFIX}-${SERVICE_SHORT}-${CONFIG_SHORT}-pg" >> $GITHUB_ENV | |
| if [ "${BACKUP_FILE}" == "schedule" ]; then | |
| BACKUP_FILE=${SERVICE_SHORT}_${CONFIG_SHORT}_${TODAY} | |
| elif [ "${BACKUP_FILE}" == "default" ]; then | |
| BACKUP_FILE=${SERVICE_SHORT}_${CONFIG_SHORT}_adhoc_${TODAY} | |
| else | |
| BACKUP_FILE=${BACKUP_FILE} | |
| fi | |
| echo "BACKUP_FILE=${BACKUP_FILE}" >> $GITHUB_ENV | |
| echo "KEYVAULT_NAME=${AZURE_RESOURCE_PREFIX}-${SERVICE_SHORT}-${CONFIG_SHORT}-inf-kv" >> $GITHUB_ENV | |
| - name: Set PTR variables | |
| if: ${{ github.event.inputs.backupPTRServer == 'true' }} | |
| run: | | |
| echo "PTR_DB_SERVER=${{ env.DB_SERVER }}-ptr" >> $GITHUB_ENV | |
| echo "BACKUP_FILE=${{ env.BACKUP_FILE }}-ptr" >> $GITHUB_ENV | |
| - name: Backup ${{ env.DEPLOY_ENV }} postgres | |
| uses: DFE-Digital/github-actions/backup-postgres@master | |
| with: | |
| storage-account: ${{ env.STORAGE_ACCOUNT_NAME }} | |
| resource-group: ${{ env.RESOURCE_GROUP_NAME }} | |
| app-name: ${{ env.SERVICE_SHORT }}-${{ env.DEPLOY_ENV }}-api | |
| cluster: ${{ env.CLUSTER }} | |
| azure-credentials: ${{ secrets.AZURE_CREDENTIALS }} | |
| backup-file: ${{ env.BACKUP_FILE }}.sql | |
| ptr-db-server-name: ${{ env.PTR_DB_SERVER }} | |
| - name: Backup Summary | |
| if: success() | |
| run: | | |
| NOW=$(TZ=Europe/London date +"%F %R") | |
| echo 'BACKUP SUCCESSFUL!' >> $GITHUB_STEP_SUMMARY | |
| echo ' ENV: ${{ env.DEPLOY_ENV }}' >> $GITHUB_STEP_SUMMARY | |
| echo " AT : ${NOW}" >> $GITHUB_STEP_SUMMARY | |
| echo ' DB SERVER: ${{ env.PTR_DB_SERVER || env.DB_SERVER }}' >> $GITHUB_STEP_SUMMARY | |
| echo ' STORAGE ACCOUNT: ${{ env.STORAGE_ACCOUNT_NAME }}' >> $GITHUB_STEP_SUMMARY | |
| echo ' FILENAME: ${{ env.BACKUP_FILE }}.sql.gz' >> $GITHUB_STEP_SUMMARY | |
| - name: Get Slack webhook | |
| uses: Azure/get-keyvault-secrets@v1 | |
| if: failure() | |
| id: key-vault-secrets | |
| with: | |
| keyvault: ${{ env.KEYVAULT_NAME }} | |
| secrets: "SLACK-WEBHOOK" | |
| - name: Notify Slack channel on job failure | |
| if: failure() | |
| uses: rtCamp/action-slack-notify@v2 | |
| env: | |
| SLACK_USERNAME: CI Deployment | |
| SLACK_TITLE: Database backup failure | |
| SLACK_MESSAGE: Production database backup job failed | |
| SLACK_WEBHOOK: ${{ steps.key-vault-secrets.outputs.SLACK-WEBHOOK }} | |
| SLACK_COLOR: failure | |
| SLACK_FOOTER: Sent from backup job in backup-db workflow |