admin/felhom-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.28.0: backup re-target → felhom-pbs (offsite DR) + operator-signed decommission

Browse Source 
- BackupConfig.BackupTarget() defaults whole-guest backup to felhom-pbs (separate
  hardware = real DR), configurable via backup.local_backup_target; all NewBackupRunner
  sites route through it. PBS round-trip proven live (snapshot marker + restore-test +
  pct-restore) before the re-point.
- signedjobs DecommissionExecutor + ExecutorChain: makes IntentDecommissioned reachable
  ONLY via a verified operator signature (keyed by the watchdog's storage durable-id);
  felhom-opsign builds decommission params from -durable-id. Runner wiring moved below
  the intent-store open.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-06-12 20:26:34 +02:00
parent 9ff0410755
commit 109dd853a3
7 changed files with 293 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/config/config.go
+20 -1
View File
@@ -155,7 +155,9 @@ type EscrowConfig struct {
// an agent-internal cadence (no hub policy needed — it's self-validation); the backup
// schedule/retention/target-selection policy is hub-manifest-owned and unfed until slice 10.
type BackupConfig struct {
// LocalBackupTarget is the vzdump storage (content=backup) backups go to, e.g. "local".
// LocalBackupTarget is the vzdump storage (content=backup) backups go to. Empty → the
// offsite PBS default (see BackupTarget); set e.g. "local" or "felhom-pbs" to override.
// (Name kept for config back-compat; the default is no longer "local".)
LocalBackupTarget string `json:"local_backup_target"`
// RestoreStorage is where a restore-test's restored rootfs lands, e.g. "local-lvm".
RestoreStorage string `json:"restore_storage"`
@@ -189,6 +191,23 @@ func (b BackupConfig) BackupCadence() time.Duration {
return 24 * time.Hour
}
// defaultBackupTarget is the offsite PBS storage whole-guest backups land on by default. It is
// SEPARATE HARDWARE from the guest's own disk (a PBS datastore on the DooPlex box), so a host
// disk/hardware failure doesn't take the backups with it — that's what makes it real DR. Proven
// live: snapshot-mode vzdump to PBS still fires the `create storage snapshot` marker (early-resume
// intact) and pct-restore-from-PBS round-trips cleanly via the storage.cfg encryption key.
const defaultBackupTarget = "felhom-pbs"
// BackupTarget is the vzdump storage (content=backup) whole-guest backups go to. Defaults to the
// offsite PBS storage (see defaultBackupTarget); override via backup.local_backup_target for a
// local or other target. Kept configurable on purpose — the field is never hardcoded at a call site.
func (b BackupConfig) BackupTarget() string {
if b.LocalBackupTarget != "" {
return b.LocalBackupTarget
}
return defaultBackupTarget
}
// Default scratch VMID band + restore-test cadence.
const (
defaultScratchVMIDMin = 990000