d27e93d220
Daily SQLite backup to the NetBackup SMB share plus restore/import/export helpers. SMB credentials moved out of the scripts into ~/.smbcredentials (mode 600) and are passed to smbclient via -A instead of -U "user%pass". This keeps the password out of version control and out of the process list, where -U exposes it to any local user through ps.
75 lines
2.7 KiB
Bash
Executable File
75 lines
2.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Vaultwarden SQLite Database Restore Script
|
|
# This script restores a vaultwarden SQLite database backup to the running container.
|
|
#
|
|
# IMPORTANT: The SQLite backup is the PRIMARY backup for full instance recovery.
|
|
# It contains ALL users, their encrypted vault data, organizations, collections, etc.
|
|
# Simply replacing the database file and restarting Vaultwarden will restore everything.
|
|
#
|
|
# Usage: ./restore-sqlite.sh <backup-file.db>
|
|
# Example: ./restore-sqlite.sh vaultwarden-2026-09-19_09-03-45.db
|
|
|
|
set -euo pipefail
|
|
|
|
BACKUP_FILE="${1:-}"
|
|
VAULT_DATA="/var/lib/docker/volumes/caddy_vaultwarden_data/_data"
|
|
CONTAINER_NAME="vaultwarden"
|
|
SMB_SHARE="//192.168.123.2/NetBackup"
|
|
|
|
# SMB credentials live in an external file (mode 600), not in this script, so the
|
|
# password stays out of version control and out of the process list.
|
|
SMB_CRED_FILE="${SMB_CRED_FILE:-$HOME/.smbcredentials}"
|
|
|
|
if [ ! -r "$SMB_CRED_FILE" ]; then
|
|
echo "ERROR: SMB credentials file not readable: ${SMB_CRED_FILE}"
|
|
echo "Create it with: printf 'username = %s\\npassword = %s\\n' <user> <pass> | install -m 600 /dev/stdin ${SMB_CRED_FILE}"
|
|
exit 1
|
|
fi
|
|
|
|
if [ -z "$BACKUP_FILE" ]; then
|
|
echo "Usage: $0 <backup-file.db>"
|
|
echo "Available backups in SMB share:"
|
|
smbclient "$SMB_SHARE" -A "$SMB_CRED_FILE" -c "cd Vault; ls vaultwarden-*.db" 2>/dev/null | grep "vaultwarden-"
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -f "$BACKUP_FILE" ]; then
|
|
# Try to download from SMB
|
|
echo "Backup file not found locally. Downloading from SMB..."
|
|
smbclient "$SMB_SHARE" -A "$SMB_CRED_FILE" -c "cd Vault; get $BACKUP_FILE $BACKUP_FILE" 2>/dev/null
|
|
if [ ! -f "$BACKUP_FILE" ]; then
|
|
echo "ERROR: Could not find or download backup file: $BACKUP_FILE"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
echo "Restoring Vaultwarden database from: $BACKUP_FILE"
|
|
echo "This will replace the current database. All users will need to log in again."
|
|
read -p "Are you sure? (yes/no): " CONFIRM
|
|
if [ "$CONFIRM" != "yes" ]; then
|
|
echo "Aborted."
|
|
exit 1
|
|
fi
|
|
|
|
# Stop the container
|
|
echo "Stopping Vaultwarden container..."
|
|
docker stop "$CONTAINER_NAME"
|
|
|
|
# Backup current database (just in case)
|
|
CURRENT_DB="${VAULT_DATA}/db.sqlite3"
|
|
if [ -f "$CURRENT_DB" ]; then
|
|
sudo cp "$CURRENT_DB" "${CURRENT_DB}.pre-restore-$(date +%Y%m%d-%H%M%S)"
|
|
echo "Current database backed up."
|
|
fi
|
|
|
|
# Restore the backup
|
|
echo "Restoring database..."
|
|
sudo cp "$BACKUP_FILE" "$CURRENT_DB"
|
|
sudo chown 1000:1000 "$CURRENT_DB" # Adjust if different user runs container
|
|
|
|
# Start the container
|
|
echo "Starting Vaultwarden container..."
|
|
docker start "$CONTAINER_NAME"
|
|
|
|
echo "Restore complete! Vaultwarden should be available shortly."
|
|
echo "Users can log in with their existing master passwords." |