backup

Author: atirikt

share/github-backup-utils/ghe-backup-settings

@@ -76,6 +76,7 @@ backup-secret() {
 
 backup-secret "management console password" "manage-password" "secrets.manage"
 backup-secret "password pepper" "password-pepper" "secrets.github.user-password-secrets"
+backup-secret "Kredz credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hmac-secret"
 
 # Backup external MySQL password if running external MySQL DB.
 if is_service_external 'mysql'; then
@@ -113,8 +114,6 @@ if ghe-ssh "$host" -- ghe-config --true app.actions.enabled; then
   backup-secret "Actions Launch action runner secret" "actions-launch-action-runner-secret" "secrets.launch.action-runner-secret"
   backup-secret "Actions Launch service cert" "actions-launch-azp-app-cert" "secrets.launch.azp-app-cert"
   backup-secret "Actions Launch service private key" "actions-launch-app-app-private-key" "secrets.launch.azp-app-private-key"
-
-  backup-secret "Kredz credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hmac-secret"
 fi
 
 if ghe-ssh "$host" -- "test -f $GHE_REMOTE_DATA_USER_DIR/common/idp.crt"; then

share/github-backup-utils/ghe-restore-actions

@@ -85,7 +85,6 @@ restore-secret "Actions Launch service private key" "actions-launch-app-app-priv
 restore-secret "Actions Launch token oauth key" "actions-oauth-s2s-signing-key" "secrets.launch.token-oauth-key"
 restore-secret "Actions Launch token oauth cert" "actions-oauth-s2s-signing-cert" "secrets.launch.token-oauth-cert"
 
-restore-secret "Kredz credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hmac-secret"
 
 # Setup the database logins.
 ghe_verbose "* Restoring database logins and users to $host ..."

share/github-backup-utils/ghe-restore-settings

@@ -40,6 +40,7 @@ restore-secret "external MySQL password" "external-mysql-password" "secrets.exte
 
 # Restore management console password hash if present.
 restore-secret "management console password" "manage-password" "secrets.manage"
+restore-secret "Kredz credz HMAC key" "kredz-credz-hmac" "secrets.kredz.credz-hmac-secret"
 
 # Restore SAML keys if present.
 if [ -f "$GHE_RESTORE_SNAPSHOT_PATH/saml-keys.tar" ]; then

test/test-ghe-backup.sh

@@ -470,6 +470,31 @@ begin_test "ghe-backup upgrades transaction backup to full if LSN chain break"
 )
 end_test
 
+begin_test "ghe-backup takes backup of Kredz settings"
+(
+  set -e
+
+  required_secrets=(
+    "secrets.kredz.credz-hmac-secret"
+  )
+
+  for secret in "${required_secrets[@]}"; do
+    ghe-ssh "$GHE_HOSTNAME" -- ghe-config "$secret" "foo"
+  done
+
+  ghe-backup
+
+  required_files=(
+    "kredz-credz-hmac"
+  )
+
+  for file in "${required_files[@]}"; do
+    [ "$(cat "$GHE_DATA_DIR/current/$file")" = "foo" ]
+  done
+
+)
+end_test
+
 begin_test "ghe-backup takes backup of Actions settings"
 (
   set -e
@@ -507,7 +532,6 @@ begin_test "ghe-backup takes backup of Actions settings"
     "secrets.launch.azp-app-cert"
     "secrets.launch.azp-app-private-key"
 
-    "secrets.kredz.credz-hmac-secret"
   )
 
   # these 5 were removed in later versions, so we extract them as best effort
@@ -551,7 +575,6 @@ begin_test "ghe-backup takes backup of Actions settings"
     "actions-launch-azp-app-cert"
     "actions-launch-app-app-private-key"
 
-    "kredz-credz-hmac"
   )
 
   # Add the one optional file we included tests for