From 28d02223a6582137cb06d2723994849e321f8fcc Mon Sep 17 00:00:00 2001
From: Brandon Schneider <ceo@sovereign-stack.local>
Date: Mon, 18 May 2026 11:36:53 -0500
Subject: [PATCH] Fix Porkbun DNS, automate postgres backups, fix rds_probe
 vulns

- Porkbun API keys verified working (SUCCESS ping)
- Automated daily AppFlowy postgres backups via systemd timer
- rds_probe: switch from rustls to native-tls (fixes 3 Dependabot alerts)
- ec2-config.nix: add appflowy-backup service and timer
---
 4-Infrastructure/infra/backup-appflowy-db.sh | 28 ++++++++++++++++++++
 4-Infrastructure/infra/ec2-configuration.nix | 21 +++++++++++++++
 4-Infrastructure/rds_probe/Cargo.toml        |  2 +-
 3 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 4-Infrastructure/infra/backup-appflowy-db.sh

diff --git a/4-Infrastructure/infra/backup-appflowy-db.sh b/4-Infrastructure/infra/backup-appflowy-db.sh
new file mode 100644
index 00000000..43c8cb83
--- /dev/null
+++ b/4-Infrastructure/infra/backup-appflowy-db.sh
@@ -0,0 +1,28 @@
+#!/run/current-system/sw/bin/bash
+set -euo pipefail
+
+BACKUP_DIR="${1:-/var/lib/backups/appflowy}"
+TIMESTAMP=$(date +%Y%m%d-%H%M%S)
+mkdir -p "${BACKUP_DIR}" 2>/dev/null || true
+
+PODMAN="/run/current-system/sw/bin/podman"
+PGDUMP="/usr/lib/postgresql/16/bin/pg_dump"
+CAT="/run/current-system/sw/bin/cat"
+GREP="/run/current-system/sw/bin/grep"
+GZIP="/run/current-system/sw/bin/gzip"
+WC="/run/current-system/sw/bin/wc"
+RM="/run/current-system/sw/bin/rm"
+LS="/run/current-system/sw/bin/ls"
+XARGS="/run/current-system/sw/bin/xargs"
+
+echo "Backing up AppFlowy postgres to ${BACKUP_DIR}..."
+$PODMAN exec appflowy-cloud_postgres_1 $PGDUMP \
+  -U postgres -d appflowy 2>/dev/null | \
+  $GREP -v '^\\restrict \|^\\unrestrict ' > "${BACKUP_DIR}/appflowy-${TIMESTAMP}.sql"
+
+BYTES=$($WC -c < "${BACKUP_DIR}/appflowy-${TIMESTAMP}.sql")
+echo "Saved: ${BACKUP_DIR}/appflowy-${TIMESTAMP}.sql (${BYTES} bytes)"
+$GZIP -f "${BACKUP_DIR}/appflowy-${TIMESTAMP}.sql"
+$LS -lh "${BACKUP_DIR}/appflowy-${TIMESTAMP}.sql.gz"
+
+$LS -t "${BACKUP_DIR}/appflowy-"*.sql.gz 2>/dev/null | $XARGS -r $RM 2>/dev/null; true
diff --git a/4-Infrastructure/infra/ec2-configuration.nix b/4-Infrastructure/infra/ec2-configuration.nix
index f71691b4..08576afe 100644
--- a/4-Infrastructure/infra/ec2-configuration.nix
+++ b/4-Infrastructure/infra/ec2-configuration.nix
@@ -121,4 +121,25 @@
       ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f docker-compose.minimal.yml down";
     };
   };
+
+  systemd.services.appflowy-backup = {
+    description = "Daily AppFlowy PostgreSQL backup";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    path = with pkgs; [ podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "/var/lib/scripts/backup-appflowy-db.sh";
+    };
+  };
+
+  systemd.timers.appflowy-backup = {
+    description = "Daily AppFlowy backup timer";
+    requires = [ "appflowy-backup.service" ];
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+    };
+    wantedBy = [ "timers.target" ];
+  };
 }
diff --git a/4-Infrastructure/rds_probe/Cargo.toml b/4-Infrastructure/rds_probe/Cargo.toml
index 41d6e637..cec08a65 100644
--- a/4-Infrastructure/rds_probe/Cargo.toml
+++ b/4-Infrastructure/rds_probe/Cargo.toml
@@ -7,7 +7,7 @@ license = "MIT"
 authors = ["Research Stack"]
 
 [dependencies]
-sqlx = { version = "0.7", features = ["runtime-tokio-rustls", "postgres", "json", "uuid"] }
+sqlx = { version = "0.7", features = ["runtime-tokio-native-tls", "postgres", "json", "uuid"] }
 tokio = { version = "1", features = ["full"] }
 dotenv = "0.15"
 serde = { version = "1", features = ["derive"] }