Documentation
¶
Overview ¶
Package backup makes, checks and restores backups of an instance (PHASE1 step 16): every database as one consistent copy (VACUUM INTO, also while the server runs), the audit databases last, a manifest with SHA-256 per file and the head of every audit chain. A restore goes only into an empty data directory and only after every check passed.
Index ¶
Constants ¶
const ( ActionBackup = "system.backup" ActionRestore = "system.restore" )
Audit actions in the instance log.
const Format = "myownpki-backup/1"
Format names the layout of a backup directory.
const KindAuthKey store.Kind = "auth_key"
KindAuthKey marks auth.key in the manifest.
const ManifestFile = "manifest.json"
ManifestFile is written last: a directory without it is not a backup.
const Warning = "This backup holds the CA and certificate keys, encrypted with the root key. " +
"Keep the unseal passphrase and the recovery key apart from it – whoever has both can sign as your CAs."
Warning is shown at every backup (owner decision 2).
Variables ¶
var ErrRefused = errors.New("the backup is refused")
ErrRefused wraps the problems of a backup that may not be restored.
Functions ¶
This section is empty.
Types ¶
type File ¶
type File struct {
Path string `json:"path"`
Kind store.Kind `json:"kind"` // system, pki, audit; "auth_key"
Tenant string `json:"tenant,omitempty"`
SHA256 string `json:"sha256"`
Size int64 `json:"size"`
Migration int `json:"migration,omitempty"`
}
File is one file of the backup; Path is relative to the data directory.
type Log ¶
type Log struct {
Scope string `json:"scope"`
Path string `json:"path"`
Head string `json:"head"` // seq:hash
Entries int64 `json:"entries"`
LastCheckpoint *audit.CheckpointInfo `json:"last_checkpoint,omitempty"`
}
Log is the state of one audit log in the backup.
type Manifest ¶
type Manifest struct {
Format string `json:"format"`
CreatedAt string `json:"created_at"`
Version string `json:"version"`
Tenants []string `json:"tenants"`
Files []File `json:"files"`
Audit []Log `json:"audit"`
// CheckpointKey is the fingerprint of the key that signs the audit
// checkpoints – compare it with the one noted at init.
CheckpointKey string `json:"checkpoint_key"`
// AuthKey: auth.key is in the backup (it lived in the data directory).
AuthKey bool `json:"auth_key_included"`
}
Manifest describes a backup.
type Options ¶
type Options struct {
Layout store.Layout
AuthKeyFile string // config auth.key_file
Clock clock.Clock
Who keys.Who
}
Options for Create and Restore.
type Report ¶
type Report struct {
Manifest *Manifest
// Problems refuse a restore.
Problems []string
// Certificates whose name index was compared.
Certificates int
// Notes are for the operator (auth.key, migrations to apply).
Notes []string
}
Report is the result of checking a backup.
Source Files