ops: keep production imports local and backups non-root

.env.example

@@ -19,5 +19,8 @@ TEST_MODE=false
 POSTGRES_DB=cents
 POSTGRES_USER=cents
 POSTGRES_PASSWORD=change-me
+# Host uid/gid used by the backup container when writing ./backups/db.
+BACKUP_UID=1001
+BACKUP_GID=1001
 APP_TIME_ZONE=Asia/Shanghai
 EXCHANGE_RATE_API_URL=https://api.frankfurter.dev

.gitignore

@@ -1,3 +1,5 @@
+backup/
+services/api/src/import-excel.ts
 legacy-cent-app/
 node_modules/
 dist/

README.md

@@ -85,7 +85,9 @@ docker compose --env-file .env -f compose.pro.yaml exec api \
 
 ## 生产数据库备份
 
-`backup` 容器每天北京时间 `03:00` 将 PostgreSQL 备份到生产 clone 目录下的 `./backups`。备份采用 PostgreSQL custom format，并在写入后校验；超过 30 天的备份会自动删除。
+`backup` 容器每天北京时间 `03:00` 将 PostgreSQL 备份到生产 clone 目录下的 `./backups/db`。备份容器使用宿主机普通用户运行，不会以 root 保存备份文件。备份采用 PostgreSQL custom format，并在写入后校验；超过 30 天的备份会自动删除。
+
+`BACKUP_UID` 和 `BACKUP_GID` 应设置为生产宿主机运行 Cents 的普通用户 UID/GID；默认值为 `1001`。
 
 查看调度和备份日志：
 
@@ -103,5 +105,5 @@ docker compose --env-file .env -f compose.pro.yaml exec backup \
 备份文件位于宿主机：
 
 ```text
-./backups/cents-YYYYMMDD-HHMMSS.dump
+./backups/db/cents-YYYYMMDD-HHMMSS.dump
 ```

compose.pro.yaml

@@ -37,6 +37,7 @@ services:
   backup:
     image: postgres:17-alpine
     restart: unless-stopped
+    user: "${BACKUP_UID:-1001}:${BACKUP_GID:-1001}"
     environment:
       TZ: Asia/Shanghai
       PGHOST: db
@@ -45,7 +46,7 @@ services:
       PGPASSWORD: ${POSTGRES_PASSWORD}
     entrypoint: ["/usr/local/bin/cents-backup"]
     volumes:
-      - ./backups:/backups
+      - ./backups/db:/backups
       - ./deploy/postgres-backup.sh:/usr/local/bin/cents-backup:ro
     depends_on:
       db:

deploy/postgres-backup.sh

@@ -27,11 +27,13 @@ case "${1:-cron}" in
     run_backup
     ;;
   cron)
+    cron_dir=/tmp/cents-crontabs
+    mkdir -p "$cron_dir"
     printf '%s\n' \
       '0 3 * * * /usr/local/bin/cents-backup run >> /proc/1/fd/1 2>> /proc/1/fd/2' \
-      > /etc/crontabs/root
+      > "$cron_dir/$(id -u)"
     printf 'Backup scheduler started: daily at 03:00 %s, retaining 30 days\n' "${TZ:-local time}"
-    exec crond -f -l 2
+    exec crond -f -l 2 -c "$cron_dir"
     ;;
   *)
     printf 'Unknown command: %s\n' "$1" >&2

package.json

@@ -14,6 +14,7 @@
     "dev:web:tunnel": "npm run dev --workspace @cents/web -- --port 6064",
     "dev:api": "npm run dev --workspace @cents/api",
     "user:add": "npm run user:add --workspace @cents/api --",
+    "data:import": "npm run data:import --workspace @cents/api --",
     "build": "npm run build --workspaces --if-present",
     "typecheck": "npm run typecheck --workspaces --if-present",
     "lint": "npm run lint --workspaces --if-present"

services/api/package.json

@@ -8,6 +8,7 @@
     "start": "tsx src/server.ts",
     "bootstrap": "tsx src/bootstrap.ts",
     "user:add": "tsx src/add-user.ts",
+    "data:import": "tsx src/import-excel.ts",
     "password:reset": "tsx src/reset-password.ts",
     "build": "tsc --noEmit",
     "typecheck": "tsc --noEmit"