copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Add SSL mode support for database backups and enhance directory creation checks

Browse Source 
- Introduce SSL mode configuration (`ssl_mode`) for `mysqldump` to support secure database backups.
- Update database backup logic to handle SSL options (`DISABLED`, `PREFERRED`, `REQUIRED`, `VERIFY_CA`, `VERIFY_IDENTITY`).
- Improve directory creation checks in backup logic with additional error handling.
- Update `config.example.php` to include `ssl_mode` configuration.
This commit is contained in:
Jeppe Bundgaard
2026-02-02 14:24:28 +01:00
parent 08077df618
commit 4778486dac
3 changed files with 44 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config.example.php
+5 -2
View File
@@ -3,7 +3,8 @@ $CONFIG_DB = [
'host' => '', // IP address of the database server e.g. 127.0.0.1
'user' => '', // Username of the database server e.g. root
'password' => '', // Password of the database server e.g. password123
'database' => '' // Name of the database e.g. my_database
'database' => '', // Name of the database e.g. my_database
'ssl_mode' => 'DISABLED' // SSL mode for mysqldump: DISABLED, PREFERRED, REQUIRED, VERIFY_CA, VERIFY_IDENTITY
];
$DEBUG = true; // Set to true to enable debugging (Error messages will be shown, and this should never be used in production)
$USE_PROD_ECONOMIC_IN_DEBUG = true; // Set to true to use the production economic API in debug mode
@@ -49,6 +50,7 @@ if (isset($_ENV['USE_ENV']) && $_ENV['USE_ENV'] === 'true') {
'CONFIG_DB_USER' => 'user',
'CONFIG_DB_PASSWORD' => 'password',
'CONFIG_DB_DATABASE' => 'database',
'CONFIG_DB_SSL_MODE' => 'ssl_mode',
'DEBUG' => 'DEBUG',
'ENCRYPTION_KEY' => 'ENCRYPTION_KEY',
'CORS' => 'CORS',
@@ -73,7 +75,8 @@ if (isset($_ENV['USE_ENV']) && $_ENV['USE_ENV'] === 'true') {
'host' => $_ENV['CONFIG_DB_HOST'],
'user' => $_ENV['CONFIG_DB_USER'],
'password' => $_ENV['CONFIG_DB_PASSWORD'],
'database' => $_ENV['CONFIG_DB_DATABASE']
'database' => $_ENV['CONFIG_DB_DATABASE'],
'ssl_mode' => $_ENV['CONFIG_DB_SSL_MODE'] ?? 'DISABLED'
];
/**
* Set the debug configuration
services/nginx/app/classes/backup_store.php
+6
View File
@@ -134,9 +134,15 @@ class backup_store implements minio_backups_i
// Prepare the backup directories
if (!is_dir(self::local_backup_path)) {
mkdir(self::local_backup_path);
if (!is_dir(self::local_backup_path)) {
throw new Exception('Failed to create local backup path: ' . self::local_backup_path);
}
}
if (!is_dir(self::local_backup_path . 'backup_' . $backup_uuid)) {
mkdir(self::local_backup_path . 'backup_' . $backup_uuid);
if (!is_dir(self::local_backup_path . 'backup_' . $backup_uuid)) {
throw new Exception('Failed to create local backup directory: ' . self::local_backup_path . 'backup_' . $backup_uuid);
}
}
// Backup the database
services/nginx/app/classes/db.php
+33 -1
View File
@@ -13,6 +13,7 @@ class db
private string $user;
private string $password;
private string $database;
private string $ssl_mode = 'DISABLED'; // mysqldump SSL mode (e.g., DISABLED, PREFERRED, REQUIRED, VERIFY_CA, VERIFY_IDENTITY)
public function __construct(array $config)
{
@@ -20,6 +21,9 @@ class db
$this->user = $config['user'];
$this->password = $config['password'];
$this->database = $config['database'];
if (isset($config['ssl_mode']) && is_string($config['ssl_mode']) && $config['ssl_mode'] !== '') {
$this->ssl_mode = $config['ssl_mode'];
}
}
public static function getPDO(): \PDO
@@ -141,8 +145,36 @@ class db
public function backupDatabase(string $path): bool
{
// Save the database to the path
$command = "mysqldump -h {$this->host} -u {$this->user} -p{$this->password} {$this->database} > $path";
// Build a safe mysqldump command with configurable SSL (MariaDB-compatible flags)
$mode = strtoupper(trim($this->ssl_mode));
// Map ssl_mode to MariaDB client flags
// DISABLED => --skip-ssl (no TLS)
// PREFERRED => (no flag; client decides)
// REQUIRED/VERIFY_* => --ssl (enable TLS without strict verification unless CA materials provided)
$sslFlag = '';
switch ($mode) {
case 'DISABLED':
$sslFlag = '--skip-ssl';
break;
case 'PREFERRED':
$sslFlag = '';
break;
case 'REQUIRED':
case 'VERIFY_CA':
case 'VERIFY_IDENTITY':
default:
$sslFlag = '--ssl';
break;
}
$host = escapeshellarg($this->host);
$user = escapeshellarg($this->user);
$pass = escapeshellarg($this->password);
$db = escapeshellarg($this->database);
$outfile = escapeshellarg($path);
$sslPart = $sslFlag !== '' ? ($sslFlag . ' ') : '';
$command = "mysqldump {$sslPart}-h $host -u $user --password=$pass $db > $outfile 2>&1";
exec($command, $output, $return);
// Check if the command was successful
return $return === 0;
}