Run databases, caches and queues

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Databases, caches en queues — 8

PostgreSQL — the default open-source database

psql (with pg_dump / pg_restore) runs SQL, manages roles and makes backups.

$psql "host=db1 dbname=shop user=shop sslmode=verify-full"
$pg_dump -Fc -d shop -f shop-$(date +%F).dump
$pg_restore -d shop --clean --if-exists shop-2026-10-27.dump

Security checklist:

One role per app; scram-sha-256 and hostssl lines in pg_hba.conf.
Test restores. On Kubernetes use an operator (CloudNativePG).

10.2

MySQL / MariaDB — the web app database

mysql and mysqldump serve WordPress, WooCommerce and many PHP apps.

#mysql_secure_installation
$mysqldump --single-transaction --routines shop | gzip > shop.sql.gz
$mysql -e "SHOW GRANTS FOR 'shop'@'10.20.2.%';"

Security checklist:

Passwords in ~/.my.cnf (600), not on the command line.
No GRANT ALL ON *.* for apps; never open 3306 publicly.

10.3

Redis / Valkey — cache and sessions

redis-cli talks to the in-memory key-value store used for caches, sessions, queues and rate limits.

$redis-cli --scan --pattern 'session:*' | head
$redis-cli INFO memory | grep used_memory_human
$redis-cli ACL SETUSER shop on '>Ch4nge-me-2026' '~shop:*' '+@read' '+@write'

Security checklist:

Bind to private IPs, password or ACL users, maxmemory set; rename FLUSHALL.

10.4

MongoDB — document database

mongosh queries JSON documents; mongodump / mongorestore back up.

$mongosh "mongodb://admin@db1:27017/?authSource=admin"
$mongodump --uri "mongodb://backup@db1:27017/?authSource=admin" --gzip --archive=shop.gz --db shop

Security checklist:

security.authorization: enabled always; never bound to 0.0.0.0 on the internet.

10.5

etcd — the brain of Kubernetes

etcdctl checks health and makes snapshots of the store that holds every Kubernetes object; restore with etcdutl. A CKA task.

#etcdctl endpoint health
#etcdctl snapshot save /opt/backup/etcd-$(date +%F).db
#etcdutl snapshot restore /opt/backup/etcd-2026-10-27.db --data-dir /var/lib/etcd-restore

Security checklist:

Snapshots contain all Secrets: encrypt them and store them off the node.
Turn on encryption at rest for Secrets.

10.6

RabbitMQ — message broker

rabbitmqctl manages users, vhosts, permissions and queues of the AMQP broker that decouples services.

#rabbitmqctl list_queues -p shop name messages consumers
#rabbitmqctl delete_user guest
#rabbitmq-diagnostics check_running

10.7

Kafka — event streaming

kafka-topics and friends create topics, read and write events and show consumer lag.

$kafka-topics.sh --bootstrap-server localhost:9092 --describe --topic shop.orders
$kafka-consumer-groups.sh --bootstrap-server localhost:9092 --describe --group invoice-service

Security checklist:

TLS + SASL + ACLs; alert on consumer lag.

10.8

MinIO — S3 object storage

mc works with MinIO and any S3-compatible storage: buckets, mirrors, lifecycle, users and policies.

$mc alias set lab http://127.0.0.1:9000 admin labonly-2026
$mc mirror --overwrite /srv/backups lab/backups/web1
$mc ilm rule add --expire-days 30 lab/backups

Security checklist:

Backup users without delete rights; versioning or object lock against ransomware.

10.9

Follow the 3-2-1 backup rule

For every data service: 3 copies, on 2 kinds of storage, 1 off-site (and one offline or immutable). Then test the restore every month and write down how long it took.

Service	Backup tool	Restore test
PostgreSQL	`pg_dump` / WAL archiving	`pg_restore` into a test DB
MySQL	`mysqldump --single-transaction`	import into a test DB
MongoDB	`mongodump`	`mongorestore` into a test DB
etcd	`etcdctl snapshot save`	`etcdutl snapshot restore` on a lab cluster
Files	`tar` + `age` + `mc mirror`	restore one folder

Alle commando's in dit hoofdstuk