资源备份流程整理

src/main/resources/application.yml

@@ -194,6 +194,41 @@ tms:
     output-dir: ${TMS_BACKUP_OUTPUT_DIR:/home/tms/tmp/resource-backup-packages}
     # 轻量恢复 apply 脚本启停 TMS 时使用的脚本路径。
     tms-script-path: ${TMS_BACKUP_TMS_SCRIPT_PATH:/home/tms/scripts/tms.sh}
+    # 轻量恢复停服务命令。未配置时 apply 脚本会回退到 tms-script-path stop。
+    # command 支持现场脚本路径或完整 shell 命令；required=false 表示失败只记录 warning。
+    restore-stop-commands:
+      - code: STANDARD_NGINX
+        command: ${TMS_BACKUP_RESTORE_STOP_STANDARD_NGINX_COMMAND:${tms.init.executor.standard-nginx-stop-command}}
+        required: ${TMS_BACKUP_RESTORE_STOP_STANDARD_NGINX_REQUIRED:false}
+        product-types:
+          - ENTERPRISE
+          - INDIRECT
+      - code: STANDARD_APPS
+        command: ${TMS_BACKUP_RESTORE_STOP_STANDARD_APPS_COMMAND:${tms.init.executor.standard-app-stop-command}}
+        required: ${TMS_BACKUP_RESTORE_STOP_STANDARD_APPS_REQUIRED:false}
+        product-types:
+          - ENTERPRISE
+          - INDIRECT
+      - code: TMS
+        command: ${TMS_BACKUP_RESTORE_STOP_TMS_COMMAND:${tms.backup.tms-script-path} stop}
+        required: ${TMS_BACKUP_RESTORE_STOP_TMS_REQUIRED:false}
+    # 轻量恢复启动服务命令。标准/间参默认启动 TMS、CMSP/CMTP 和 nginx。
+    restore-start-commands:
+      - code: TMS
+        command: ${TMS_BACKUP_RESTORE_START_TMS_COMMAND:${tms.backup.tms-script-path} start}
+        required: ${TMS_BACKUP_RESTORE_START_TMS_REQUIRED:true}
+      - code: STANDARD_APPS
+        command: ${TMS_BACKUP_RESTORE_START_STANDARD_APPS_COMMAND:${tms.init.executor.standard-app-start-command}}
+        required: ${TMS_BACKUP_RESTORE_START_STANDARD_APPS_REQUIRED:true}
+        product-types:
+          - ENTERPRISE
+          - INDIRECT
+      - code: STANDARD_NGINX
+        command: ${TMS_BACKUP_RESTORE_START_STANDARD_NGINX_COMMAND:${tms.init.executor.standard-nginx-start-command}}
+        required: ${TMS_BACKUP_RESTORE_START_STANDARD_NGINX_REQUIRED:true}
+        product-types:
+          - ENTERPRISE
+          - INDIRECT
     # 轻量恢复 apply 脚本路径；Java 完成验签/解密/展开后调用该脚本执行覆盖、SQL、MQ replay。
     restore-apply-script-path: ${TMS_BACKUP_RESTORE_APPLY_SCRIPT_PATH:/home/tms/bin/resource-restore/apply-resource-backup.sh}
     # 文件恢复白名单根路径；manifest 中 FILE 恢复路径必须落在这些目录下。
@@ -202,6 +237,61 @@ tms:
       - ${TMS_BACKUP_ALLOWED_RESTORE_ROOT_CMEP4I:/home/cmep4i}
       - ${TMS_BACKUP_ALLOWED_RESTORE_ROOT_CMEP4D:/home/cmep4d}
       - ${TMS_BACKUP_ALLOWED_RESTORE_ROOT_WORK:/home/tms/tmp/resource-restore}
+    # 现场可追加或覆盖直接复制恢复的文件类资源。
+    # mode=FILE 表示单文件，mode=DIR 表示目录递归，mode=GLOB 表示按通配符匹配同一目录下的一批文件。
+    # restore-path 对 FILE 是目标文件路径，对 DIR/GLOB 是目标目录；目标仍必须落在 allowed-restore-roots 下。
+    file-resources:
+      - code: TMS_CONFIG
+        mode: DIR
+        path: ${TMS_BACKUP_TMS_CONFIG_PATH:${tms.init.executor.tms-config-dir}}
+        restore-path: ${TMS_BACKUP_TMS_CONFIG_RESTORE_PATH:${tms.init.executor.tms-config-dir}}
+        required: ${TMS_BACKUP_TMS_CONFIG_REQUIRED:true}
+      - code: CP_CONFIG
+        mode: FILE
+        path: ${TMS_BACKUP_STANDARD_CP_CONFIG_PATH:${tms.init.executor.standard-cpconfig-path}}
+        restore-path: ${TMS_BACKUP_STANDARD_CP_CONFIG_RESTORE_PATH:${tms.init.executor.standard-cpconfig-path}}
+        product-types:
+          - ENTERPRISE
+          - INDIRECT
+        required: ${TMS_BACKUP_STANDARD_CP_CONFIG_REQUIRED:true}
+      - code: CP_CONFIG
+        mode: FILE
+        path: ${TMS_BACKUP_DIRECT_CP_CONFIG_PATH:${tms.init.executor.direct-cpconfig-target-path}}
+        restore-path: ${TMS_BACKUP_DIRECT_CP_CONFIG_RESTORE_PATH:${tms.init.executor.direct-cpconfig-target-path}}
+        product-types:
+          - DIRECT
+        required: ${TMS_BACKUP_DIRECT_CP_CONFIG_REQUIRED:true}
+      - code: RECEIVER_LICENSE
+        mode: FILE
+        path: ${TMS_BACKUP_STANDARD_RECEIVER_LICENSE_PATH:${tms.init.executor.standard-receiver-license-target-path}}
+        restore-path: ${TMS_BACKUP_STANDARD_RECEIVER_LICENSE_RESTORE_PATH:${tms.init.executor.standard-receiver-license-target-path}}
+        product-types:
+          - ENTERPRISE
+          - INDIRECT
+        required: ${TMS_BACKUP_STANDARD_RECEIVER_LICENSE_REQUIRED:true}
+      - code: RECEIVER_LICENSE
+        mode: FILE
+        path: ${TMS_BACKUP_DIRECT_RECEIVER_LICENSE_PATH:${tms.init.executor.direct-receiver-license-target-path}}
+        restore-path: ${TMS_BACKUP_DIRECT_RECEIVER_LICENSE_RESTORE_PATH:${tms.init.executor.direct-receiver-license-target-path}}
+        product-types:
+          - DIRECT
+        required: ${TMS_BACKUP_DIRECT_RECEIVER_LICENSE_REQUIRED:true}
+      - code: STANDARD_CMSP_APP_CONFIG
+        mode: GLOB
+        path: ${TMS_BACKUP_STANDARD_CMSP_APP_CONFIG_PATH:${tms.init.executor.standard-home-dir}/cmsp/application-prd*.properties}
+        restore-path: ${TMS_BACKUP_STANDARD_CMSP_APP_CONFIG_RESTORE_PATH:${tms.init.executor.standard-home-dir}/cmsp}
+        product-types:
+          - ENTERPRISE
+          - INDIRECT
+        required: ${TMS_BACKUP_STANDARD_CMSP_APP_CONFIG_REQUIRED:true}
+      - code: STANDARD_CMTP_APP_CONFIG
+        mode: GLOB
+        path: ${TMS_BACKUP_STANDARD_CMTP_APP_CONFIG_PATH:${tms.init.executor.standard-home-dir}/cmtp/application-prd*.properties}
+        restore-path: ${TMS_BACKUP_STANDARD_CMTP_APP_CONFIG_RESTORE_PATH:${tms.init.executor.standard-home-dir}/cmtp}
+        product-types:
+          - ENTERPRISE
+          - INDIRECT
+        required: ${TMS_BACKUP_STANDARD_CMTP_APP_CONFIG_REQUIRED:true}
     # 导出 TMS 库时使用的 mysqldump 命令；现场可按实际安装路径覆盖。
     mysqldump-path: ${TMS_BACKUP_MYSQLDUMP_PATH:mysqldump}
     # 恢复 TMS 库时使用的 mysql 客户端命令。
@@ -212,6 +302,13 @@ tms:
     mq-replay-script-path: ${TMS_BACKUP_MQ_REPLAY_SCRIPT_PATH:/home/tms/bin/resource-restore/replay-mq.sh}
     # 备份 TMS 库名；为空时默认从 spring.datasource.url 中解析。
     tms-database-name: ${TMS_BACKUP_TMS_DATABASE_NAME:}
+    # TMS 库备份排除表。默认不备份角色、授权、会话和审计表，避免恢复时覆盖新机器安全状态。
+    tms-db-excluded-tables:
+      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_ROLE_ACCOUNT:tms_role_account}
+      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_ROLE_UKEY:tms_role_ukey_binding}
+      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_AUTH_FULL:tms_auth_full_account}
+      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_AUTH_SESSION:tms_auth_session}
+      - ${TMS_BACKUP_TMS_DB_EXCLUDED_TABLE_AUTH_CHALLENGE:tms_auth_challenge}
     # 备份/恢复标准收发器业务库名；第一版默认使用 CMEP。
     cmep-database-name: ${TMS_BACKUP_CMEP_DATABASE_NAME:CMEP}
     # 恢复完成后的最小健康检查地址。
@@ -229,9 +326,9 @@ tms:
     internal-token: ${TMS_INTERNAL_TOKEN:change-me-internal-token}
     internal-auth:
       # 是否启用 /api/** 的内部登录鉴权；开发联调时可临时关闭。
-      enabled: ${TMS_SECURITY_INTERNAL_AUTH_ENABLED:true}
+      enabled: ${TMS_SECURITY_INTERNAL_AUTH_ENABLED:false}
       # 关闭内部鉴权后，注入请求上下文的调试角色。
-      debug-role-code: ${TMS_SECURITY_INTERNAL_AUTH_DEBUG_ROLE_CODE:KEY_ADMIN}
+      debug-role-code: ${TMS_SECURITY_INTERNAL_AUTH_DEBUG_ROLE_CODE:OPS_ADMIN}
       # 关闭内部鉴权后，注入请求上下文的调试认证等级。
       debug-auth-level: ${TMS_SECURITY_INTERNAL_AUTH_DEBUG_AUTH_LEVEL:FULL}
       # 关闭内部鉴权后，注入请求上下文的调试 session token。

src/main/resources/db/migration/V1__tms_schema_full.sql

@@ -115,26 +115,6 @@ CREATE TABLE IF NOT EXISTS tms_resource_restore_task (
     KEY idx_tms_resource_restore_task_status (status),
     KEY idx_tms_resource_restore_task_create_time (create_time)
 );
-
-CREATE TABLE IF NOT EXISTS tms_resource_task_step (
-    id BIGINT PRIMARY KEY,
-    task_id VARCHAR(64) NOT NULL,
-    task_type VARCHAR(32) NOT NULL COMMENT 'RESOURCE_BACKUP / RESOURCE_RESTORE',
-    step_no INT NOT NULL,
-    step_code VARCHAR(64) NOT NULL,
-    status VARCHAR(32) NOT NULL,
-    message VARCHAR(512) NULL,
-    log_path VARCHAR(1024) NULL,
-    exit_code INT NULL,
-    create_time DATETIME(3) NOT NULL,
-    update_time DATETIME(3) NOT NULL,
-    start_time DATETIME(3) NULL,
-    finish_time DATETIME(3) NULL,
-    UNIQUE KEY uk_tms_resource_task_step_task_no (task_id, step_no),
-    KEY idx_tms_resource_task_step_task_id (task_id),
-    KEY idx_tms_resource_task_step_task_type (task_type)
-);
-
 -- -----------------------------------------------------------------------------
 -- 认证与设备基础表
 -- -----------------------------------------------------------------------------

src/main/resources/db/migration/V6__add_resource_backup_restore_tables.sql

@@ -62,22 +62,3 @@ CREATE TABLE IF NOT EXISTS tms_resource_restore_task (
     KEY idx_tms_resource_restore_task_status (status),
     KEY idx_tms_resource_restore_task_create_time (create_time)
 );
-
-CREATE TABLE IF NOT EXISTS tms_resource_task_step (
-    id BIGINT PRIMARY KEY,
-    task_id VARCHAR(64) NOT NULL,
-    task_type VARCHAR(32) NOT NULL COMMENT 'RESOURCE_BACKUP / RESOURCE_RESTORE',
-    step_no INT NOT NULL,
-    step_code VARCHAR(64) NOT NULL,
-    status VARCHAR(32) NOT NULL,
-    message VARCHAR(512) NULL,
-    log_path VARCHAR(1024) NULL,
-    exit_code INT NULL,
-    create_time DATETIME(3) NOT NULL,
-    update_time DATETIME(3) NOT NULL,
-    start_time DATETIME(3) NULL,
-    finish_time DATETIME(3) NULL,
-    UNIQUE KEY uk_tms_resource_task_step_task_no (task_id, step_no),
-    KEY idx_tms_resource_task_step_task_id (task_id),
-    KEY idx_tms_resource_task_step_task_type (task_type)
-);