1068445 - [PulseGuardian] Integrated user-backup system

Status: RESOLVED FIXED

(Webtools :: Pulse, defect, P4)

Description

[Mark Côté [:mcote]]

Since PulseGuardian handles users on Pulse, in particula rafter bug 1068438 lands and PulseGuardian users can have multiple Pulse users, it makes sense for PulseGuardian to be able to back up RabbitMQ's users and restore them.

We can use the management API to do this.  This backup should *not* be stored in the db; we're backing up encrypted passwords, so keeping the JSON directly in a file and far from the db is preferable.

Backing up users should probably be run as part of the guardian.py service, but an admin should be able to run backup (and restore) users from the command line as well.

If one or more users suddenly disappear, we should at least email admins.  We could consider automatically restoring users who disappear, though this should definitely be behind an option, defaulting to off.

Comment 2

[Mark Côté [:mcote]]

Not terribly important since automated backups using a similar process appear to be working now.

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

I'll verify that mark meant CloudAMQP's backups in comment 2, and close this if so.

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

Confirmed: there are a bunch of backups of configuration -- including users, queues, exchanges, etc. -- in the cloudamqp admin UI. I'm not sure how to restore those, but I assume support could help us with that if it became necessary. The backups are in JSON and if we needed to use them for forensic purposes that would be easy enough.