From 4778486dacc3145b62985c2178e8747e899f14a3 Mon Sep 17 00:00:00 2001 From: Jeppe Bundgaard Date: Mon, 2 Feb 2026 14:24:28 +0100 Subject: [PATCH] Add SSL mode support for database backups and enhance directory creation checks - Introduce SSL mode configuration (`ssl_mode`) for `mysqldump` to support secure database backups. - Update database backup logic to handle SSL options (`DISABLED`, `PREFERRED`, `REQUIRED`, `VERIFY_CA`, `VERIFY_IDENTITY`). - Improve directory creation checks in backup logic with additional error handling. - Update `config.example.php` to include `ssl_mode` configuration. --- config.example.php | 7 +++-- services/nginx/app/classes/backup_store.php | 6 ++++ services/nginx/app/classes/db.php | 34 ++++++++++++++++++++- 3 files changed, 44 insertions(+), 3 deletions(-) diff --git a/config.example.php b/config.example.php index ff598b17..8b77dae1 100644 --- a/config.example.php +++ b/config.example.php @@ -3,7 +3,8 @@ $CONFIG_DB = [ 'host' => '', // IP address of the database server e.g. 127.0.0.1 'user' => '', // Username of the database server e.g. root 'password' => '', // Password of the database server e.g. password123 - 'database' => '' // Name of the database e.g. my_database + 'database' => '', // Name of the database e.g. my_database + 'ssl_mode' => 'DISABLED' // SSL mode for mysqldump: DISABLED, PREFERRED, REQUIRED, VERIFY_CA, VERIFY_IDENTITY ]; $DEBUG = true; // Set to true to enable debugging (Error messages will be shown, and this should never be used in production) $USE_PROD_ECONOMIC_IN_DEBUG = true; // Set to true to use the production economic API in debug mode @@ -49,6 +50,7 @@ if (isset($_ENV['USE_ENV']) && $_ENV['USE_ENV'] === 'true') { 'CONFIG_DB_USER' => 'user', 'CONFIG_DB_PASSWORD' => 'password', 'CONFIG_DB_DATABASE' => 'database', + 'CONFIG_DB_SSL_MODE' => 'ssl_mode', 'DEBUG' => 'DEBUG', 'ENCRYPTION_KEY' => 'ENCRYPTION_KEY', 'CORS' => 'CORS', @@ -73,7 +75,8 @@ if (isset($_ENV['USE_ENV']) && $_ENV['USE_ENV'] === 'true') { 'host' => $_ENV['CONFIG_DB_HOST'], 'user' => $_ENV['CONFIG_DB_USER'], 'password' => $_ENV['CONFIG_DB_PASSWORD'], - 'database' => $_ENV['CONFIG_DB_DATABASE'] + 'database' => $_ENV['CONFIG_DB_DATABASE'], + 'ssl_mode' => $_ENV['CONFIG_DB_SSL_MODE'] ?? 'DISABLED' ]; /** * Set the debug configuration diff --git a/services/nginx/app/classes/backup_store.php b/services/nginx/app/classes/backup_store.php index 35df4a2d..15fd3883 100644 --- a/services/nginx/app/classes/backup_store.php +++ b/services/nginx/app/classes/backup_store.php @@ -134,9 +134,15 @@ class backup_store implements minio_backups_i // Prepare the backup directories if (!is_dir(self::local_backup_path)) { mkdir(self::local_backup_path); + if (!is_dir(self::local_backup_path)) { + throw new Exception('Failed to create local backup path: ' . self::local_backup_path); + } } if (!is_dir(self::local_backup_path . 'backup_' . $backup_uuid)) { mkdir(self::local_backup_path . 'backup_' . $backup_uuid); + if (!is_dir(self::local_backup_path . 'backup_' . $backup_uuid)) { + throw new Exception('Failed to create local backup directory: ' . self::local_backup_path . 'backup_' . $backup_uuid); + } } // Backup the database diff --git a/services/nginx/app/classes/db.php b/services/nginx/app/classes/db.php index f2187e27..0d62b6cf 100644 --- a/services/nginx/app/classes/db.php +++ b/services/nginx/app/classes/db.php @@ -13,6 +13,7 @@ class db private string $user; private string $password; private string $database; + private string $ssl_mode = 'DISABLED'; // mysqldump SSL mode (e.g., DISABLED, PREFERRED, REQUIRED, VERIFY_CA, VERIFY_IDENTITY) public function __construct(array $config) { @@ -20,6 +21,9 @@ class db $this->user = $config['user']; $this->password = $config['password']; $this->database = $config['database']; + if (isset($config['ssl_mode']) && is_string($config['ssl_mode']) && $config['ssl_mode'] !== '') { + $this->ssl_mode = $config['ssl_mode']; + } } public static function getPDO(): \PDO @@ -141,8 +145,36 @@ class db public function backupDatabase(string $path): bool { // Save the database to the path - $command = "mysqldump -h {$this->host} -u {$this->user} -p{$this->password} {$this->database} > $path"; + // Build a safe mysqldump command with configurable SSL (MariaDB-compatible flags) + $mode = strtoupper(trim($this->ssl_mode)); + // Map ssl_mode to MariaDB client flags + // DISABLED => --skip-ssl (no TLS) + // PREFERRED => (no flag; client decides) + // REQUIRED/VERIFY_* => --ssl (enable TLS without strict verification unless CA materials provided) + $sslFlag = ''; + switch ($mode) { + case 'DISABLED': + $sslFlag = '--skip-ssl'; + break; + case 'PREFERRED': + $sslFlag = ''; + break; + case 'REQUIRED': + case 'VERIFY_CA': + case 'VERIFY_IDENTITY': + default: + $sslFlag = '--ssl'; + break; + } + $host = escapeshellarg($this->host); + $user = escapeshellarg($this->user); + $pass = escapeshellarg($this->password); + $db = escapeshellarg($this->database); + $outfile = escapeshellarg($path); + $sslPart = $sslFlag !== '' ? ($sslFlag . ' ') : ''; + $command = "mysqldump {$sslPart}-h $host -u $user --password=$pass $db > $outfile 2>&1"; exec($command, $output, $return); + // Check if the command was successful return $return === 0; }