Shell Scripting: Silent Backup Failure — Exit Codes Matter

#!/usr/bin/env bash
# ALWAYS start with a shebang — it tells the OS which interpreter to use.
# Using /usr/bin/env bash is more portable than /bin/bash directly.

# ---------------------------------------------------------------------------
# BAD PRACTICE: unquoted variable — dangerous when values contain spaces
# ---------------------------------------------------------------------------
unsafe_filename="quarterly report.txt"
# This would break: ls $unsafe_filename  (shell sees 'quarterly' and 'report.txt')

# ---------------------------------------------------------------------------
# GOOD PRACTICE: always double-quote variables when using them
# ---------------------------------------------------------------------------
safe_filename="quarterly report.txt"
echo "Processing file: \"$safe_filename\""
# Output: Processing file: "quarterly report.txt"

# ---------------------------------------------------------------------------
# READONLY variables — use these for values that must never change
# ---------------------------------------------------------------------------
readonly MAX_RETRIES=3
readonly LOG_DIR="/var/log/myapp"

echo "Will retry up to $MAX_RETRIES times."
echo "Logs go to: $LOG_DIR"

# ---------------------------------------------------------------------------
# EXPORTED variables — child processes (like scripts you call) can see these
# ---------------------------------------------------------------------------
DATABASE_HOST="db.internal.example.com"
export DATABASE_HOST
# Now if this script calls another script, that script can read $DATABASE_HOST

# ---------------------------------------------------------------------------
# DEFAULT VALUES with parameter expansion — saves you from empty-variable bugs
# ---------------------------------------------------------------------------
# If $DEPLOY_ENV is unset or empty, fall back to 'staging'
DEPLOY_ENV="${DEPLOY_ENV:-staging}"
echo "Deploying to environment: $DEPLOY_ENV"

# ---------------------------------------------------------------------------
# ARITHMETIC — use $(( )) for integer math, not expr
# ---------------------------------------------------------------------------
current_version=4
next_version=$(( current_version + 1 ))
echo "Bumping version from $current_version to $next_version"

#!/usr/bin/env bash
# These three lines should be at the top of EVERY non-trivial script.
# -e : exit immediately if any command fails
# -u : treat unset variables as errors (no silent empty-string substitution)
# -o pipefail : if any command in a pipe fails, the whole pipe fails
set -euo pipefail

# ---------------------------------------------------------------------------
# A pre-deployment health check script — realistic DevOps pattern
# ---------------------------------------------------------------------------

REQUIRED_DISK_SPACE_MB=500
DEPLOY_DIR="/opt/myapp"
HEALTH_CHECK_URL="http://localhost:8080/health"

# ---------------------------------------------------------------------------
# FUNCTION: check available disk space before deploying
# ---------------------------------------------------------------------------
check_disk_space() {
    local available_mb
    # df gives disk usage; awk extracts the available column for our directory
    available_mb=$(df -m "$DEPLOY_DIR" | awk 'NR==2 {print $4}')

    if [[ "$available_mb" -lt "$REQUIRED_DISK_SPACE_MB" ]]; then
        echo "ERROR: Only ${available_mb}MB free in $DEPLOY_DIR. Need at least ${REQUIRED_DISK_SPACE_MB}MB."
        return 1  # non-zero = failure; caller can act on this
    fi

    echo "Disk check passed: ${available_mb}MB available."
    return 0
}

# ---------------------------------------------------------------------------
# FUNCTION: verify the app is responding before we call the deploy complete
# ---------------------------------------------------------------------------
wait_for_healthy() {
    local max_attempts=10
    local attempt=1
    local sleep_seconds=3

    echo "Waiting for app to become healthy at $HEALTH_CHECK_URL ..."

    while [[ "$attempt" -le "$max_attempts" ]]; do
        # curl -sf: -s = silent, -f = fail on HTTP error codes (4xx/5xx)
        # We redirect output to /dev/null — we only care about the exit code
        if curl -sf "$HEALTH_CHECK_URL" > /dev/null 2>&1; then
            echo "App is healthy after $attempt attempt(s)."
            return 0
        fi

        echo "  Attempt $attempt/$max_attempts failed. Retrying in ${sleep_seconds}s..."
        sleep "$sleep_seconds"
        (( attempt++ ))
    done

    echo "ERROR: App did not become healthy after $max_attempts attempts."
    return 1
}

# ---------------------------------------------------------------------------
# MAIN — using && chains: only proceed if each step succeeds
# ---------------------------------------------------------------------------
echo "=== Pre-deployment checks ==="

# if check_disk_space fails, set -e will stop the script here
check_disk_space

echo "=== Deploying application ==="
# Simulate deployment step (replace with your real deploy command)
echo "  rsync / docker pull / helm upgrade would run here..."

echo "=== Post-deployment health check ==="
wait_for_healthy

echo "=== Deployment complete ==="

#!/usr/bin/env bash
set -euo pipefail

# ---------------------------------------------------------------------------
# A realistic log rotation and archiving script
# Shows: functions with local vars, for loops, while loops, arrays
# ---------------------------------------------------------------------------

readonly LOG_SOURCE_DIR="/var/log/myapp"
readonly ARCHIVE_DIR="/mnt/archives/myapp"
readonly MAX_LOG_AGE_DAYS=30
readonly COMPRESSION_LEVEL=9  # 1=fast/large to 9=slow/small

# ---------------------------------------------------------------------------
# FUNCTION: compress a single log file and move it to archive
# 'local' keeps these variables from leaking into the global scope
# ---------------------------------------------------------------------------
archive_log_file() {
    local source_file="$1"   # first argument passed to the function
    local dest_dir="$2"      # second argument
    local filename
    local archived_path

    # basename strips the directory path, leaving just the filename
    filename=$(basename "$source_file")
    archived_path="${dest_dir}/${filename}.gz"

    echo "  Archiving: $filename"

    # gzip -${COMPRESSION_LEVEL} compresses; we keep the original with -c and redirect
    gzip -c -"${COMPRESSION_LEVEL}" "$source_file" > "$archived_path"

    # Only remove the original AFTER we verified the compressed file exists
    if [[ -f "$archived_path" ]]; then
        rm "$source_file"
        echo "  Done: $filename -> $(basename "$archived_path")"
    else
        echo "ERROR: Compression failed for $filename. Original NOT deleted."
        return 1
    fi
}

# ---------------------------------------------------------------------------
# FUNCTION: find and archive logs older than MAX_LOG_AGE_DAYS
# ---------------------------------------------------------------------------
rotate_old_logs() {
    local log_dir="$1"
    local archive_dir="$2"
    local file_count=0

    echo "Scanning $log_dir for logs older than $MAX_LOG_AGE_DAYS days..."

    # We use an array to safely collect results from find
    # This handles filenames with spaces correctly
    local old_log_files=()
    while IFS= read -r -d '' log_file; do
        old_log_files+=("$log_file")
    done < <(find "$log_dir" -maxdepth 1 -name "*.log" -mtime +"$MAX_LOG_AGE_DAYS" -print0)
    # -print0 and read -d '' use null bytes as delimiters — safe for ANY filename

    if [[ "${#old_log_files[@]}" -eq 0 ]]; then
        echo "No logs older than $MAX_LOG_AGE_DAYS days found. Nothing to archive."
        return 0
    fi

    echo "Found ${#old_log_files[@]} file(s) to archive."
    mkdir -p "$archive_dir"  # -p: create parent dirs too, no error if already exists

    # Iterate over the array — safe even with spaces in filenames
    for log_file in "${old_log_files[@]}"; do
        archive_log_file "$log_file" "$archive_dir"
        (( file_count++ ))
    done

    echo "Archived $file_count file(s) successfully."
}

# ---------------------------------------------------------------------------
# FUNCTION: report total size of archived files — shows while loop usage
# ---------------------------------------------------------------------------
report_archive_size() {
    local archive_dir="$1"
    local total_size_kb=0
    local file_size

    # while loop reading line-by-line from du output
    while IFS= read -r archive_file; do
        # du -k gives size in kilobytes
        file_size=$(du -k "$archive_file" | awk '{print $1}')
        (( total_size_kb += file_size ))
    done < <(find "$archive_dir" -name "*.gz" -type f)

    echo "Total archive size: ${total_size_kb}KB"
}

# ---------------------------------------------------------------------------
# MAIN EXECUTION
# ---------------------------------------------------------------------------
echo "=== Log Rotation Started: $(date '+%Y-%m-%d %H:%M:%S') ==="
rotate_old_logs "$LOG_SOURCE_DIR" "$ARCHIVE_DIR"
report_archive_size "$ARCHIVE_DIR"
echo "=== Log Rotation Complete ==="

#!/usr/bin/env bash
set -euo pipefail

# ---------------------------------------------------------------------------
# A production-pattern database backup script
# Demonstrates: getopts, trap for cleanup, structured argument validation
# Usage: ./database_backup.sh -e production -d myapp_db -o /backups
# ---------------------------------------------------------------------------

# ---------------------------------------------------------------------------
# CLEANUP FUNCTION — registered with trap, runs no matter how script exits
# ---------------------------------------------------------------------------
cleanup() {
    local exit_code=$?  # capture exit code BEFORE we do anything else

    if [[ -f "${temp_backup_file:-}" ]]; then
        echo "Cleaning up temporary file: $temp_backup_file"
        rm -f "$temp_backup_file"
    fi

    if [[ $exit_code -ne 0 ]]; then
        echo "BACKUP FAILED (exit code: $exit_code). Check logs above." >&2
        # In real life: send a Slack/PagerDuty alert here
    fi
}

# Register cleanup to run on: normal exit (EXIT), Ctrl+C (INT), kill signal (TERM)
trap cleanup EXIT INT TERM

# ---------------------------------------------------------------------------
# ARGUMENT PARSING with getopts
# ---------------------------------------------------------------------------
usage() {
    echo "Usage: $0 -e <environment> -d <database_name> -o <output_dir>"
    echo "  -e  Environment (staging|production)"
    echo "  -d  Database name to back up"
    echo "  -o  Output directory for backup files"
    exit 1
}

# Variables that flags will populate — give them empty defaults for set -u safety
environment=""
database_name=""
output_dir=""

# getopts loop: colon after a letter means it expects an argument (e.g. -e staging)
while getopts ":e:d:o:" option; do
    case "$option" in
        e) environment="$OPTARG" ;;   # OPTARG holds the value after the flag
        d) database_name="$OPTARG" ;;
        o) output_dir="$OPTARG" ;;
        :) echo "ERROR: -$OPTARG requires an argument." >&2; usage ;;
        ?) echo "ERROR: Unknown flag -$OPTARG." >&2; usage ;;
    esac
done

# Validate that all required arguments were provided
if [[ -z "$environment" || -z "$database_name" || -z "$output_dir" ]]; then
    echo "ERROR: All flags are required." >&2
    usage
fi

# Validate environment is one of the allowed values
if [[ "$environment" != "staging" && "$environment" != "production" ]]; then
    echo "ERROR: Environment must be 'staging' or 'production'." >&2
    exit 1
fi

# ---------------------------------------------------------------------------
# MAIN BACKUP LOGIC
# ---------------------------------------------------------------------------
timestamp=$(date '+%Y%m%d_%H%M%S')
backup_filename="${database_name}_${environment}_${timestamp}.sql"
temp_backup_file="${output_dir}/.tmp_${backup_filename}"  # hidden temp file
final_backup_file="${output_dir}/${backup_filename}.gz"

mkdir -p "$output_dir"

echo "=== Database Backup ==="
echo "  Environment : $environment"
echo "  Database    : $database_name"
echo "  Output      : $final_backup_file"
echo "Starting backup at $(date '+%H:%M:%S')..."

# Write to a temp file first — if this fails or is interrupted, cleanup() removes it
# Replace this with your real pg_dump / mysqldump command:
# pg_dump -h "$DB_HOST" -U "$DB_USER" "$database_name" > "$temp_backup_file"
echo "-- Simulated SQL dump for $database_name" > "$temp_backup_file"
echo "-- Environment: $environment" >> "$temp_backup_file"

# Only compress and finalise AFTER the dump succeeded
gzip -c "$temp_backup_file" > "$final_backup_file"
rm "$temp_backup_file"  # Remove temp — it's safe now, we have the compressed final

backup_size=$(du -sh "$final_backup_file" | awk '{print $1}')
echo "Backup complete. Size: $backup_size"
echo "Saved to: $final_backup_file"

#!/usr/bin/env bash
set -euo pipefail

# ---------------------------------------------------------------------------
# Demonstrates safe patterns for capturing and processing command output
# ---------------------------------------------------------------------------

readonly LOG_DIR="/var/log/app"
readonly PATTERN="ERROR"

# ---------------------------------------------------------------------------
# SAFE: process substitution with while read (variables survive outside pipe)
# ---------------------------------------------------------------------------
echo "=== Counting ERROR lines per file using process substitution ==="

# This counts occurances for each file matching pattern
total_error_count=0
while IFS= read -r file; do
    count_in_file=$(grep -c "$PATTERN" "$file" 2>/dev/null || echo 0)
    echo "  $file: $count_in_file"
    (( total_error_count += count_in_file ))
done < <(find "$LOG_DIR" -name "*.log" -type f)

echo "Total error count across all logs: $total_error_count"

# ---------------------------------------------------------------------------
# UNSAFE: pipe with while read (variables set inside pipe are lost)
# ---------------------------------------------------------------------------
echo ""
echo "=== Unsafe pipe pattern (variable not visible outside) ==="
total_via_pipe=0
find "$LOG_DIR" -name "*.log" -type f | while IFS= read -r file; do
    count=$(grep -c "$PATTERN" "$file" 2>/dev/null || echo 0)
    (( total_via_pipe += count ))
done
echo "Total via pipe (likely 0 due to subshell): $total_via_pipe"

# ---------------------------------------------------------------------------
# PROCESS SUBSTITUTION for diffing outputs
# ---------------------------------------------------------------------------
echo ""
echo "=== Diffing two command outputs ==="
echo "Listing files before and after archiving:"
diff <(find "$LOG_DIR" -name "*.log" -type f | sort) \
     <(find "$LOG_DIR" -name "*.log" -type f | sort) \
     || true

# ---------------------------------------------------------------------------
# CAPTURING MULTILINE OUTPUT into an array
# ---------------------------------------------------------------------------
echo ""
echo "=== Capturing lines into an array ==="
old_log_files=()
while IFS= read -r -d '' file; do
    old_log_files+=("$file")
done < <(find "$LOG_DIR" -name "*.log" -mtime +30 -print0)
echo "Found ${#old_log_files[@]} old log files."

// io.thecodeforge — devops tutorial

#!/bin/bash
set -euo pipefail

LOG_FILE="/var/log/deployment/processor.log"
info()  { echo "[INFO] $(date '+%F %T') $*" >> "$LOG_FILE"; }
error() { echo "[ERROR] $(date '+%F %T') $*" >&2; }
fatal() { echo "[FATAL] $(date '+%F %T') $*" >&2; exit 1; }

disk_check() {
  local usage=$(df /data | tail -1 | awk '{print $5}' | sed 's/%//')
  if (( usage > 85 )); then
    fatal "disk usage ${usage}% exceeds threshold"
  fi
  info "disk usage at ${usage}% — safe"
}

disk_check
echo "Script completed successfully"

// io.thecodeforge — devops tutorial

#!/bin/bash
set -euo pipefail

APP_DIR="/opt/app/v2.1"
CONFIG_FILE="${APP_DIR}/app.conf"

# idempotent user creation
if ! id "appuser" &>/dev/null; then
  useradd --system --shell /sbin/nologin appuser
fi

# idempotent directory creation
mkdir -p "$APP_DIR"

# copy only if target doesn't exist
if [ ! -f "$CONFIG_FILE" ]; then
  cp /tmp/configs/app.conf "$CONFIG_FILE"
  chown appuser:appuser "$CONFIG_FILE"
fi

# start service only if not running
if ! systemctl is-active --quiet app-service; then
  systemctl start app-service
fi

// io.thecodeforge — devops tutorial

#!/bin/bash
set -euo pipefail

# read secret from vault at runtime, never hardcode
readonly SECRET_FILE="/etc/secrets/api_key"
if [ ! -r "$SECRET_FILE" ]; then
  echo "FATAL: cannot read secret file" >&2
  exit 1
fi

# use 'read' to avoid leaking into process table
read -r API_KEY < "$SECRET_FILE"

# disable tracing for this block
set +x
response=$(curl -s -H "Authorization: Bearer $API_KEY" \
  https://api.production.example.com/v2/health)
set -x

# immediately destroy the secret from memory
unset API_KEY

# handle response without echoing secrets
echo "API health check returned: $(echo "$response" | jq -r '.status')"

// io.thecodeforge — devops tutorial
// Catch every failure before it becomes a 2 AM call

script:
  - set -Eeuo pipefail
  - trap 'echo "[FATAL] at line $LINENO"; kill -0 $PID 2>/dev/null && strace -p $PID -o /tmp/strace.log &' ERR
  - trap 'echo "[CLEANUP] removing temp files"; rm -rf /tmp/deploy_*' EXIT
  - |
    deploy_app() {
      local DEPLOY_ID="deploy_$$_$(date +%s)"
      mkdir -p "/tmp/$DEPLOY_ID"
      rsync -avz ./bin/ user@server:/app/ || exit 127
      # Intentional fail below
      /usr/bin/no_such_binary
    }
  - deploy_app
  - echo "Deploy succeeded"

// io.thecodeforge — devops tutorial
// Atomic lock + state check = safe replay

vars:
  lock_dir: "/tmp/deploy.lock"
  state_file: "/var/deploy/state"
  desired_sha: "a1b2c3d4"

tasks:
  - name: Aquire atomic lock
    shell: |
      if ! mkdir "{{ lock_dir }}" 2>/dev/null; then
        echo "Lock held by PID $(cat {{ lock_dir }}/pid)"
        exit 1
      fi
      echo $$ > "{{ lock_dir }}/pid"

  - name: Check if already deployed
    shell: |
      if [[ -f "{{ state_file }}" && "$(cat {{ state_file }})" == "{{ desired_sha }}" ]]; then
        echo "Already at {{ desired_sha }}, skipping"
        exit 0
      fi

  - name: Deploy new version
    shell: |
      rsync -a --delete ./dist/ user@server:/app/
      echo "{{ desired_sha }}" > "{{ state_file }}"
      echo "Deployed {{ desired_sha }}"

  - name: Release lock
    shell: rm -rf "{{ lock_dir }}"

// io.thecodeforge — devops tutorial
// 25 lines max
script: |
  #!/bin/bash
  set -x  # prints expanded commands
  mydir="/path with spaces"
  ls $mydir  # becomes: ls '/path' 'with' 'spaces'
  ls "$mydir"  # becomes: ls '/path with spaces'
output: |
  + mydir='/path with spaces'
  + ls /path with spaces  # error: two args
  ls: cannot access '/path': No such file or directory
  ls: cannot access 'with': No such file or directory

// io.thecodeforge — devops tutorial
// 25 lines max
script: |
  #!/bin/bash
  diff <(echo "hello") <(echo "hello world")
  # expands to: diff /dev/fd/3 /dev/fd/4
output: |
  1c1
  < hello
  ---
  > hello world