Files
felhom-controller/controller/internal/backup/tier2_capture.go
T
admin 2958946517 v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces
${IMPORT_PATH} = <system namespace root>/userdata/import — ONE drop-zone per box,
on the system drive, injected at BOTH compose-env builders with NO per-drive
fallback (unresolvable leaves it unset so compose fails loudly rather than
quietly building a second, dead drop-zone).

Third BindRoot (RootImport) + Import list in BackupSpec, extended through
ValidateBackupSpec/ClassifyBinds. Load-bearing: a stale `userdata: import/<app>`
entry against the moved bind would be a WHOLE-BLOCK reject, taking the app's
mandatory hdd classification with it.

Exhaustive-root audit: resolveAbs/structuralGuard/ComputeCaptureSet/
ComputeFabBuckets now take importRoot explicitly (an import bind resolved
against hddPath would name a directory on the wrong drive); unresolvable is
refused loudly into Skipped. GetImportRoot added to both provider interfaces.

Catalog-derived skeleton: UserdataSkeleton() -> UserdataSkeletonCarry() +
BuildUserdataSkeleton(), SORTED. The carry-list makes zero-removals true by
construction (`documents` is in no catalog app but on both boxes) and is the
fresh-box floor. The sort is not tidiness: the naive map-order derivation
measured 20 distinct outputs from 20 identical runs, which with fbNeedsRecreate
is a fleet-wide FileBrowser restart loop.

One authoritative compose parser: ParseComposeUserdataMounts now delegates to
ParseComposeClassifiableBinds. Import root excluded from per-app migration.

Surfaces: FileBrowser /srv/beolvasas source; app-page "Hova tegyem a fajlokat?"
with PathEscape deep links (never QueryEscape) and class-driven copy;
data_paths: annotation with the Fork-3 asymmetry; system-owned beolvasas SMB
share refused server-side at handler AND store, button omitted in template.

Caught on the way: the sharing template's row struct was function-local, so
adding {{if .System}} would have 500'd every share row. ShareRow is now
package-level and the render test uses the handler's own type.

Tests 915 -> 949, all green. MinAgent unchanged.
2026-07-26 08:12:57 +02:00

93 lines
4.1 KiB
Go

package backup
import (
"fmt"
"os"
"path/filepath"
"strings"
"gitea.dooplex.hu/admin/felhom-controller/internal/appbackup"
)
// Tier-2 SECONDARY capture-set resolution (Task 3b, architecture §2/§8). The analog of
// offboxCaptureSet, differing only in tier (TierSecondary = mandatory + optional, vs offsite's
// mandatory-only) and surfacing target (the app's cross-drive status warning). SP-3.4's loud-gap
// discipline is identical: a structurally-refused or on-disk-missing MANDATORY path is detected here
// and surfaced in BOTH the English log and the Hungarian per-app warning — never a silent gap.
// tier2Leg is one source→dest mirror leg. DestRel is the v2-layout relpath ("hdd/<rel>" |
// "userdata/<rel>"), slash-form, joined under backups/secondary/<stack>/ by the engine.
type tier2Leg struct {
Src string // absolute source dir
DestRel string // v2 relpath under destBase (slash-form)
Class appbackup.BindClass // mandatory | optional (legacy legs are mandatory-equivalent)
}
// tier2DestRel maps a classified bind's (Root, RelPath) to its v2 dest relpath (slash-form).
// RootHDD → hdd/<rel>; RootUserdata → userdata/<rel>; rel=="" → the base itself.
func tier2DestRel(root appbackup.BindRoot, rel string) string {
base := "hdd"
if root == appbackup.RootUserdata {
base = "userdata"
}
return filepath.ToSlash(filepath.Join(base, rel))
}
// tier2CaptureSet computes an app's tier-2 secondary mirror legs + Hungarian gap warnings, resolved
// against nsRoot (== the app's HDD_PATH, Model A). Classified apps yield the TierSecondary set
// (mandatory + optional), per-bind, into the v2 layout. Legacy / no-block / no-provider apps yield the
// resolver appdata dir(s) as mandatory-equivalent legs — the SAME capture set as v0.134.x (the SQ5
// footprint promise), mapped into the same v2 layout so restore has ONE reader. Missing/refused
// mandatory paths are stat-filtered + surfaced loudly (§7-H).
func (m *Manager) tier2CaptureSet(stack, nsRoot string) (legs []tier2Leg, warns []string) {
// Classified path.
if m.stackProvider != nil {
if binds, has := m.stackProvider.GetStackClassifiedBinds(stack); has {
cs := appbackup.ComputeCaptureSet(binds, has, appbackup.TierSecondary, nsRoot, m.stackProvider.GetImportRoot())
var gaps []string
for _, sk := range cs.Skipped {
if sk.Class == appbackup.ClassMandatory {
m.logger.Printf("[ERROR] [backup] Tier 2 %s: mandatory path refused by a structural guard (%s): %s/%s — NOT in the secondary copy",
stack, sk.Reason, sk.Root, sk.RelPath)
gaps = append(gaps, sk.RelPath)
}
}
for _, p := range cs.Paths {
if _, err := os.Stat(p.Abs); err != nil {
if p.Class == appbackup.ClassMandatory {
m.logger.Printf("[WARN] [backup] Tier 2 %s: mandatory data path missing on disk, skipped: %s", stack, p.Abs)
gaps = append(gaps, p.RelPath)
}
continue // optional-missing is silent (not a gap)
}
legs = append(legs, tier2Leg{Src: p.Abs, DestRel: tier2DestRel(p.Root, p.RelPath), Class: p.Class})
}
if len(gaps) > 0 {
warns = append(warns, fmt.Sprintf("Figyelmeztetés: a(z) %s alkalmazás egyes adatmappái nem kerültek a másodlagos mentésbe: %s.",
stack, strings.Join(gaps, ", ")))
}
return legs, warns
}
}
// Legacy path: the resolver appdata dir(s) → hdd/appdata/<name> legs (mandatory-equivalent for SSD
// purposes — the resolver set IS the app's state). N>1 dirs now succeed (one leg each; the v0.131.0
// errTier2MultiDir refusal is lifted structurally). Preserve the F-S2 declared-but-absent WARN.
declared := m.tier2AppDataBindsPresent(stack, nsRoot)
for _, name := range m.appDataDirNames(stack, nsRoot) {
src := AppDataDir(nsRoot, name)
if _, err := os.Stat(src); err != nil {
if declared {
m.logger.Printf("[WARN] [backup] Tier 2 %s: compose declares appdata dir %q but it is absent at %s — leg skipped",
stack, name, src)
}
continue
}
legs = append(legs, tier2Leg{
Src: src,
DestRel: filepath.ToSlash(filepath.Join("hdd", "appdata", name)),
Class: appbackup.ClassMandatory,
})
}
return legs, warns
}