admin
b527430ec7
The guest-level backup layer + the journaled self-restore-test (restore→boot→verify→ teardown) that closes "a backup you haven't restored isn't a backup". All benign (reuses the slice-4 classifier/gate/journal; no new destructive class/crypto). Local target only; PBS = Phase B. Restore to a NEW guest only. Backups crash-consistent. - proxmox: DestroyLXC, VzdumpOptions.Notes (notes-template), LatestBackupVolID. - reconcile: Engine.RunRestoreTest (journal Scratch entry BEFORE mutation; net link-down pre-boot; defer teardown always; benign gated destroy) + Recover extended to reap a leaked scratch guest (Scratch flag, special-cased before the UPID path; idempotent). - internal/backup: runner (vzdump + archive resolve + bulk-gap = backup!=1) + cadence scheduler (4th daemon goroutine, default 24h) + in-memory report store. - hub: Backup/RestoreTest filled; collector seams; cross-repo golden byte-identical + bidirectional key-set tests; hub handler logs a FAILED restore-test prominently. - config BackupConfig (band 990000-990009 default); --selftest=backup / restore-test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
24 lines
1.3 KiB
Go
24 lines
1.3 KiB
Go
// Package backup is the guest-level backup + self-restore-test layer (doc 03 §8, slice 6
|
|
// Phase A). It orchestrates a crash-consistent vzdump to a LOCAL target, resolves the
|
|
// produced archive, and drives the self-restore-test (restore → boot → verify → teardown)
|
|
// through the reconcile engine so it inherits the journal / per-guest serialization /
|
|
// crash-safe recovery.
|
|
//
|
|
// Everything here is BENIGN (backup, restore-to-NEW, scratch teardown): it reuses the
|
|
// slice-4 classifier/gate/journal via reconcile — no new destructive class, no new crypto.
|
|
// Restore is to a NEW guest only (no overwrite this slice). PBS / offsite / zero-knowledge
|
|
// is Phase B.
|
|
//
|
|
// Layout:
|
|
// - runner.go — BackupRunner: vzdump + archive-volid/size resolve + the bulk-volume gap;
|
|
// restore-candidate picker.
|
|
// - store.go — in-memory latest-backup-per-target + latest-restore-test, implementing
|
|
// the hub BackupReporter / RestoreTestReporter seams (point-in-time state
|
|
// the collector reads; re-populated each cadence/selftest run).
|
|
// - schedule.go — the restore-test cadence goroutine (default 24h; disabled when 0).
|
|
//
|
|
// hub does NOT import this package (the report types live in hub; this package imports hub
|
|
// for them, mirroring the slice-5 storage seam). This package may import reconcile + hub +
|
|
// proxmox (acyclic).
|
|
package backup
|