admin
bdcbd50b42
gates / gates (push) Successful in 13s
R-486 (P1): removing an app with its backups KEPT keeps its Tier-2 record, so the second-drive restore is no longer refused over an intact mirror. R-484: postgis/pgvector/timescaledb images are Postgres (logical dumps). R-485: the backup card sizes the recovery unit and the mirror(s). R-480: a held update's sentence leaves the card once the hold is lifted. R-477: the update's off-site lookup is one snapshots call, no stats. R-478: a copy older than this install's deploy does not count. R-474: "delete backups" deletes the unit, the mirror(s) and the prefs. Tests and red-proofs per row; evidence in felhom.eu documentation/audits/v0240-2026-09-13/ and nightly-2026-09-13-adventurelog/.
83 lines
3.9 KiB
Go
83 lines
3.9 KiB
Go
package appbackup
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"sort"
|
|
"strings"
|
|
|
|
"gopkg.in/yaml.v3"
|
|
)
|
|
|
|
// R-47 — naming the database SERVICE, not just the running container.
|
|
//
|
|
// A dump replay must never race the application's own schema management. Proven live on 2026-07-19
|
|
// (DIAG-immich-restore-round2-2026-07-19, H4): the reconstitution started the whole stack before
|
|
// replaying, immich-server rebuilt `clip_index` two seconds before the dump's own CREATE INDEX, and
|
|
// the replay aborted `already exists` under ON_ERROR_STOP=1 — leaving a half-applied schema that the
|
|
// app itself then reported as drift. The fix is to bring up ONLY the database service(s) for the
|
|
// replay, which requires knowing their compose SERVICE names (docker `up -d <svc>` takes service
|
|
// names, not container names).
|
|
//
|
|
// The symmetry that makes this safe: a `.sql` dump can only exist because DiscoverDatabases matched
|
|
// the running container's image string, and the compose `image:` value IS that image string. So the
|
|
// same predicate — dbTypeForImage — decides both "is there a dump" and "which service holds it".
|
|
|
|
// dbTypeForImage maps a container/compose image reference to the database engine the backup code
|
|
// supports, or ok=false for anything else (redis/valkey/app images — never started in the DB-only
|
|
// phase). Extracted from DiscoverDatabases so the discovery heuristic and the compose heuristic can
|
|
// never drift apart; behaviour is byte-equivalent to the inline form it replaced.
|
|
func dbTypeForImage(image string) (DBType, bool) {
|
|
img := strings.ToLower(image)
|
|
switch {
|
|
// R-484 (v0.240.0): derived Postgres images whose name does not carry "postgres". Measured on
|
|
// demo-hp 2026-09-13: adventurelog's `postgis/postgis:16-3.5-alpine` was "not a database", so
|
|
// the app got no logical dump anywhere. Same pg_dump, same PG* credentials.
|
|
case strings.Contains(img, "postgres"), strings.Contains(img, "postgis"), strings.Contains(img, "pgvector"), strings.Contains(img, "timescaledb"):
|
|
return DBTypePostgres, true
|
|
case strings.Contains(img, "mariadb"), strings.Contains(img, "mysql"):
|
|
return DBTypeMariaDB, true
|
|
}
|
|
return DBType(""), false
|
|
}
|
|
|
|
// composeServicesDoc is the minimal view of a compose file needed here: the `services:` MAP and each
|
|
// service's `image:`. Deliberately a real YAML parse and not a line scan — a top-level `volumes:`
|
|
// block (immich's `immich_ml_cache:`) has exactly the shape a naive scan misreads as a service, and
|
|
// starting a phantom service, or missing the real one, both land in the wrong branch.
|
|
type composeServicesDoc struct {
|
|
Services map[string]struct {
|
|
Image string `yaml:"image"`
|
|
} `yaml:"services"`
|
|
}
|
|
|
|
// DBServiceNames returns the sorted compose SERVICE names in composePath whose `image:` identifies a
|
|
// supported database engine — the exact argument list for `docker compose up -d <svc>...`.
|
|
//
|
|
// A file with no (or an empty) `services:` key returns (nil, nil): an app with no identifiable DB
|
|
// service is a legitimate, common case and the caller decides what it means. An unreadable or
|
|
// unparseable file returns an error, because "cannot tell" must never silently read as "no database"
|
|
// — the callers turn that into a refusal when a dump exists.
|
|
//
|
|
// Image values are matched literally. Catalog templates pin their images literally (enforced since
|
|
// Campaign 7), so an interpolated `${...}` image simply does not match and lands in the caller's
|
|
// fail-closed branch by design, rather than being guessed at.
|
|
func DBServiceNames(composePath string) ([]string, error) {
|
|
data, err := os.ReadFile(composePath)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("reading compose file: %w", err)
|
|
}
|
|
var doc composeServicesDoc
|
|
if err := yaml.Unmarshal(data, &doc); err != nil {
|
|
return nil, fmt.Errorf("parsing compose file %s: %w", composePath, err)
|
|
}
|
|
var names []string
|
|
for name, svc := range doc.Services {
|
|
if _, ok := dbTypeForImage(svc.Image); ok {
|
|
names = append(names, name)
|
|
}
|
|
}
|
|
sort.Strings(names)
|
|
return names, nil
|
|
}
|