First Commit

scripts/restore.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# =====================================================================================
+# Disaster recovery: bring the domain back from an online backup archive.
+#
+#   ./scripts/restore.sh backups/<archive>.tar.bz2 <new-dc-hostname> [new-ip]
+#
+# HOW SAMBA RESTORE ACTUALLY WORKS (this surprises people)
+# `samba-tool domain backup restore` performs a *join*: it unpacks the database into a
+# target dir and then ADDS the target host as a NEW domain controller. Restoring under the
+# same server name that the archive was taken from fails with
+#   "Entry CN=<NAME>,OU=Domain Controllers,... already exists"
+# So: pick a NEW hostname (and an IP nothing else is using). The old DC name stays in DNS
+# until you clean it up; point clients at the new DC.
+#
+# Sequence: backup .env -> stop live DC -> move data dir aside (never deleted) ->
+#           restore into fresh tree -> rewrite .env identity -> up -> verify
+# =====================================================================================
+set -uo pipefail
+cd "$(dirname "$0")/.."
+[ -f .env ] || { echo "no .env in $(pwd) - restore expects the production env file" >&2; exit 2; }
+. "$(dirname "$0")/envfile.sh"; ad_env_load .env   # parsed, never executed (see envfile.sh)
+
+BACKUP="${1:-}"
+NEW_HOST="${2:-${AD_RESTORE_AS:-}}"
+NEW_IP="${3:-${AD_RESTORE_IP:-$AD_IP}}"
+
+[ -n "$BACKUP" ] && [ -r "$BACKUP" ] || { echo "usage: $0 <backup.tar.bz2> <new-dc-hostname> [new-ip]" >&2; exit 2; }
+[ -n "$NEW_HOST" ] || { echo "A Samba restore lands as a NEW domain controller. Give it a hostname, e.g. dc3" >&2; exit 2; }
+if [ "${NEW_HOST,,}" = "$(tar -f "$BACKUP" -O ./backup.txt 2>/dev/null | sed -n "s/.*using DC '\([^']*\)'.*/\1/p" | head -1 | cut -d. -f1 | tr 'A-Z' 'a-z')" ]; then
+    echo "refusing: '$NEW_HOST' is the hostname the backup was taken from" >&2
+    exit 2
+fi
+
+src_dc="$(tar -f "$BACKUP" -O ./backup.txt 2>/dev/null | sed -n "s/.*using DC '\([^']*\)'.*/\1/p" | head -1)"
+echo "archive:  $(basename "$BACKUP")"
+echo "from DC:  ${src_dc:-unknown}"
+echo "restore as: ${NEW_HOST}.${AD_DNS_DOMAIN} @ ${NEW_IP}"
+read -r -p "Type RESTORE to proceed: " confirm
+[ "$confirm" = "RESTORE" ] || { echo "aborted"; exit 1; }
+
+if [ -f "${BACKUP}.sha256" ] && ( cd "$(dirname "$BACKUP")" && sha256sum -c "$(basename "$BACKUP").sha256" ); then
+    echo ">> archive checksum OK"
+else
+    echo ">> no checksum (or mismatch) - continuing, you were warned"
+fi
+
+ts="$(date -u +%Y%m%dT%H%M%SZ)"
+cid="${AD_CONTAINER:-ad-dc}"
+
+echo ">> stopping live DC"
+docker compose stop ad-dc || true
+
+echo ">> preserving current data/config so nothing is destroyed"
+[ -f .env ] && cp -a .env ".env.pre-restore-${ts}"
+if [ -d data/samba ] && [ -n "$(ls -A data/samba 2>/dev/null || true)" ]; then
+    mv data/samba "data/samba.pre-restore-${ts}"
+    echo "   data/samba -> data/samba.pre-restore-${ts}"
+fi
+mkdir -p data/samba
+
+echo ">> rewriting identity in .env (AD_HOSTNAME=${NEW_HOST}, AD_IP=${NEW_IP})"
+cp -a .env .env.tmp
+sed -i "s/^AD_HOSTNAME=.*/AD_HOSTNAME=${NEW_HOST}/; s/^AD_IP=.*/AD_IP=${NEW_IP}/" .env.tmp
+mv .env.tmp .env
+
+echo ">> restoring into the fresh tree (one-shot container; does not start the DC)"
+docker run --rm \
+    --name "ad-restore-${ts}" \
+    --cap-drop ALL \
+    --cap-add SYS_ADMIN --cap-add CHOWN --cap-add FOWNER --cap-add DAC_OVERRIDE \
+    --cap-add SETUID --cap-add SETGID --cap-add NET_BIND_SERVICE \
+    -v "$PWD/$(dirname "$BACKUP"):/restore:ro" \
+    -v "$PWD/data/samba:/var/lib/samba" \
+    -v "$PWD/conf:/etc/samba" \
+    -v /etc/localtime:/etc/localtime:ro \
+    --env-file .env \
+    -e "AD_RESTORE_FROM=/restore/$(basename "$BACKUP")" \
+    -e AD_RESTORE_CONFIRM=yes \
+    "${AD_RESTORE_IMAGE:-local/samba-ad-dc:4.22-debian13}" || {
+        echo "!! restore failed - roll back with: cp .env.pre-restore-${ts} .env" >&2
+        exit 1
+    }
+
+echo ">> starting the restored DC"
+docker compose up -d ad-dc
+
+echo ">> waiting for health (max 200s)"
+h=none
+for _ in $(seq 1 50); do
+    h="$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' "$cid" 2>/dev/null || echo none)"
+    [ "$h" = healthy ] && break
+    sleep 4
+done
+echo "   health: $h"
+
+AD_CONTAINER="$cid" ./scripts/verify.sh || {
+    echo "verification failed. Roll back:"
+    echo "  docker compose down"
+    echo "  cp .env.pre-restore-${ts} .env"
+    echo "  rm -rf data/samba && mv data/samba.pre-restore-${ts} data/samba"
+    exit 1
+}
+
+cat <<EOF
+
+Restored as ${NEW_HOST}.${AD_DNS_DOMAIN} (${NEW_IP}).
+Remaining manual steps:
+  1. DHCP/DNS: hand clients the new DC address (${NEW_IP}) - option 006.
+  2. If the old DC object (${src_dc:-unknown}) is still in the directory and will never
+     come back, remove its stale computer/DNS objects so clients stop trying to reach it:
+       docker exec -it $cid samba-tool dns serverdelete 127.0.0.1 <old-fqdn> -U administrator
+       docker exec -it $cid ldbdel -H /var/lib/samba/private/sam.ldb "<old computer DN>"   # careful
+  3. Take a fresh backup immediately: make backup
+EOF