feat: harden identity and recovery operations

ops/backup-postgres.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+umask 077
+
+backup_directory="${1:-storage/app/backups}"
+mkdir -p "$backup_directory"
+
+database_name="$(docker compose exec -T postgres printenv POSTGRES_DB)"
+database_user="$(docker compose exec -T postgres printenv POSTGRES_USER)"
+
+if [[ ! "$database_name" =~ ^[A-Za-z0-9_]+$ ]] || [[ ! "$database_user" =~ ^[A-Za-z0-9_]+$ ]]; then
+    echo "Nome de base de dados ou utilizador inválido." >&2
+    exit 1
+fi
+
+timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
+backup_path="${backup_directory%/}/reserva-${timestamp}.dump"
+temporary_path="${backup_path}.partial"
+
+docker compose exec -T postgres pg_dump \
+    --username="$database_user" \
+    --dbname="$database_name" \
+    --format=custom \
+    --no-owner \
+    --no-privileges > "$temporary_path"
+
+docker compose exec -T postgres pg_restore --list < "$temporary_path" > /dev/null
+mv "$temporary_path" "$backup_path"
+shasum -a 256 "$backup_path" > "${backup_path}.sha256"
+
+echo "$backup_path"