admin
766500dfc3
Spike-proven that backup/restore-to-PBS reuse Phase A unchanged; the only new code is the verify capability, a small PBS-API client, and PBSSnapshot reporting. - internal/pbs: fingerprint-pinned, token-authed PBS-API client (Verify/Snapshots/ TaskStatus, node-from-UPID; secret read from /etc/pve/priv/storage/<id>.pw at runtime, never logged) + the verify maintenance loop (own cadence, default 6h, NOT gated/journaled, like the watchdog) + SnapshotStore. - hub: PBSSnapshot filled (namespace/type/id/time/size/owner/protected/encrypted/ verify_state/verify_upid); PBSReporter collector seam; cross-repo golden + bidirectional key-set tests; hub handler parses pbs_snapshots + logs a failed-verify WARN. - backup: report the ACTUAL vzdump mode (parsed from the task log; PVE may downgrade snapshot->stop). proxmox.Storage.Username. config PBSVerifyCadence/secret-dir. --selftest=pbs-verify. Backup/restore-to-PBS unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
24 lines
1.5 KiB
Go
24 lines
1.5 KiB
Go
// Package pbs is the agent's PBS (Proxmox Backup Server) API client + the verify
|
|
// maintenance loop (doc 03 §8, slice 6 Phase B).
|
|
//
|
|
// PBS is a SEPARATE server (its own host:8007, its own API + token auth), distinct from the
|
|
// PVE proxmox.Client — so this is the agent's SECOND privileged external surface and gets the
|
|
// same slice-1 discipline: TLS fingerprint-pinned to the PBS leaf cert, token auth, typed,
|
|
// context-aware, NO shell.
|
|
//
|
|
// The spike (felhom.eu/documentation/tests/phase5-pbs-spike-findings.md) proved that
|
|
// backup-to-PBS and restore-from-PBS reuse Phase A UNCHANGED (PBS is just a storage target +
|
|
// a volid). The only genuinely new code here is:
|
|
// - client.go — the PBS-API client: Verify, Snapshots, TaskStatus (node from the UPID).
|
|
// - report.go — Snapshot → hub.PBSSnapshot mapping + a SnapshotStore implementing the hub
|
|
// PBSReporter seam (the collector reads it; hub does not import pbs).
|
|
// - verify.go — the verify maintenance loop on its OWN cadence (the cheap, frequent,
|
|
// ciphertext-level integrity check — needs NO encryption key, unlike the
|
|
// full self-restore-test). It is a reporting/maintenance task like the
|
|
// slice-5 watchdog: it does NOT go through the reconcile gate/journal.
|
|
//
|
|
// The encryption key is never needed here (verify is ciphertext-level), and the token secret
|
|
// is read at runtime from /etc/pve/priv/storage/<id>.pw — referenced by location, never
|
|
// logged or committed (zero-knowledge holds; the PBS server has no client key — spike B6).
|
|
package pbs
|