Documentation
¶
Overview ¶
Package restoreactivation derives and executes the fail-closed authority for promoting an owner-verified staged restore into the live kit core runtime (Basement Full-Core or CoreLite, or the Cloud standalone core).
Index ¶
- Constants
- Variables
- func ApplicationTransferConfiguration(plan generationartifact.VerifiedPlan, selected []string) (map[string]backuplifecycle.ApplicationTransferWorkloadConfiguration, error)
- func ApplicationTransferPersistentWorkloads(policy localbackuppolicy.Policy, selected []string) ([]string, error)
- func ApplicationTransferProjection(workspace string, plan generationartifact.VerifiedPlan, ...) ([]localbackuppolicy.ApplicationRuntime, error)
- func ApplicationTransferSecretBindings(workspace string, plan generationartifact.VerifiedPlan, ...) (map[string]map[string]string, error)
- func BindApplicationControls(base Runtime, ...) error
- func ClearApplicationTransferSecrets(materials map[string]map[string][]byte)
- func DigestRetainedVolume(ctx context.Context, workspace string, authority Authority, volume Volume) (backuplifecycle.VolumeReadback, error)
- func HoldApplicationProject(ctx context.Context, workspace string, authority Authority, project string) error
- func NotStarted(stage string, err error) error
- func ReadApplicationTransferSecrets(workspace string, bindings map[string]map[string]string) (map[string]map[string][]byte, error)
- func RequireApplicationTransferConfiguration(t backuplifecycle.ApplicationTransfer, plan generationartifact.VerifiedPlan, ...) error
- func RequireApplicationTransferTargetAbsent(ctx context.Context, workspace string, policy localbackuppolicy.Policy, ...) error
- func ResultEvidence(workspace string, result Result) (string, string, error)
- func ResumeApplicationProject(ctx context.Context, workspace, project string) error
- func RuntipiAppGroupSourceSelected(canonical []byte, workload string) (bool, error)
- func StageApplicationTransfer(ctx context.Context, workspace string, authority Authority, ...) error
- func StandaloneComposeWorkloadHoldsNoBackupData(canonicalPlan []byte, workloadRef string) (bool, error)
- func TransferOperationID(id string) (string, error)
- func VerifyApplicationTransferSecretCustody(workspace string, t backuplifecycle.ApplicationTransfer, ...) error
- func VerifyResult(workspace string, result Result) error
- type ActivateInput
- type ActivationNotStartedError
- type ActivationRecoveredError
- type ApplicationRestoreUnsupportedError
- type Authority
- func ApplicationAuthorityForVolumes(workspace string, plan generationartifact.VerifiedPlan, ...) (Authority, string, bool, error)
- func BindRuntimeRecoveryGraph(graph RuntimeRecoveryGraph, restoreResult backuplifecycle.RestoreResult) (Authority, error)
- func DeriveApplicationAuthority(workspace string, plan generationartifact.VerifiedPlan, ...) (Authority, error)
- func DeriveApplicationReleaseAuthority(workspace string, plan generationartifact.VerifiedPlan, ...) (Authority, error)
- func DeriveAuthority(workspaceRoot string, plan generationartifact.VerifiedPlan, ...) (Authority, error)
- func DeriveMarketplaceServiceAuthority(workspace string, plan generationartifact.VerifiedPlan, ...) (Authority, error)
- func DeriveTransferAuthority(workspace string, plan generationartifact.VerifiedPlan, ...) (Authority, error)
- type CloudSessionStorage
- func (s *CloudSessionStorage) DigestLive(ctx context.Context, state localevidence.CloudSessionRouting) (string, error)
- func (s *CloudSessionStorage) RestoreOriginal(ctx context.Context, state localevidence.CloudSessionRouting) error
- func (s *CloudSessionStorage) Snapshot(ctx context.Context, state localevidence.CloudSessionRouting, target bool) error
- type ComposeRuntime
- type ComposeRuntimeReadiness
- type LiveVerification
- type MarketplaceRuntimeCustody
- type RecoverInput
- type RecoveryAuthorityResolver
- type Result
- type Runtime
- func NewDockerRuntime(workspace string) (Runtime, error)
- func WithAppGroupControls(base Runtime, authority Authority, ...) (Runtime, error)
- func WithAppGroupSessionControls(base Runtime, authority Authority, ...) (Runtime, error)
- func WithAppGroupVolumeBinding(base Runtime, authority Authority, ...) (Runtime, error)
- func WithApplicationBinding(base Runtime, authority Authority, ...) (Runtime, error)
- func WithMarketplaceService(base Runtime, a Authority, s localbackuppolicy.MarketplaceService, ...) (Runtime, error)
- type RuntimeRecoveryGraph
- func DeriveHistoricalRuntimeRecoveryGraph(workspace string, plan generationartifact.HistoricalPlan, ...) (RuntimeRecoveryGraph, error)
- func DeriveRuntimeRecoveryGraph(workspaceRoot string, plan generationartifact.VerifiedPlan, ...) (RuntimeRecoveryGraph, error)
- func ParseRuntimeRecoveryGraph(data []byte) (RuntimeRecoveryGraph, error)
- func ReconcileRuntimeExecution(graph RuntimeRecoveryGraph, configurations map[string][]byte) (RuntimeRecoveryGraph, error)
- type Service
- type StageError
- type StagedRestoreRemover
- type StandaloneComposeRuntimeCustody
- func ApplicationTransferRuntimeCustody(workspace string, plan generationartifact.VerifiedPlan, ...) ([]StandaloneComposeRuntimeCustody, error)
- func DeriveHistoricalStandaloneComposeRuntimeCustody(workspace string, plan generationartifact.HistoricalPlan, ...) ([]StandaloneComposeRuntimeCustody, error)
- func DeriveStandaloneComposeRuntimeCustody(workspaceRoot string, plan generationartifact.VerifiedPlan, ...) ([]StandaloneComposeRuntimeCustody, error)
- type StandaloneComposeRuntimeFile
- type TransferAdmission
- type Volume
Constants ¶
const ( // The workload's selected adapter row does not declare backupRestore: its // data is outside the node's signed Kopia source. Shared with the backup gate. ReasonApplicationRestoreAdapterUnsupported = actionableerror.ReasonSelectedAdapterBackupRestoreUnavailable // The workload restores with the node (standalone Compose); only a // platform-managed workload (Coolify, Komodo) activates on its own. ReasonApplicationRestoreScopeUnsupported = "application_restore_scope_unsupported" // The Plan selects no such application workload. ReasonApplicationRestoreWorkloadUnselected = "application_restore_workload_unselected" // The restore staged none of the workload's volumes under its coverage. ReasonApplicationRestoreWorkloadNotStaged = "application_restore_workload_not_staged" )
Closed reasons for a workload-scoped restore the selected delivery cannot serve. Each refuses before staging verification, safety snapshot, journal or manager control, so no live volume is touched.
const ( StageStagedResult = "staged-result" StageAuthorityRevalidation = "authority-revalidation" StagePrepareMutation = "prepare-mutation" StageRuntimeInspect = "runtime-inspect" StageStagingValidate = "staging-validate" StageSafetySnapshot = "safety-snapshot" StageJournalBegin = "journal-begin" StageResultSign = "result-sign" // Steps the command takes before it hands over to Activate. StageCommandAuthority = "command-authority" StagePlanManifest = "plan-manifest" StageRestoreResult = "restore-result" StageRuntimeBind = "runtime-bind" )
Closed pre-journal activation steps. After the journal begins, a failure is tagged with the journal phase it reached instead.
const ( // RuntimeRecoveryGraphAPIVersion identifies the canonical derived runtime // graph that can later be placed in an owner-signed recovery snapshot. RuntimeRecoveryGraphAPIVersion = "stackkit.restoreactivation-runtime-recovery-graph/v1" RuntimeRecoveryGraphKind = "RuntimeRecoveryGraph" )
const (
ResultAPIVersion = "stackkit.restore-activation-result/v1"
)
Variables ¶
var ErrCoreBackupSourceAbsent = errors.New("restoreactivation: the kit core declares no local Kopia backup source")
ErrCoreBackupSourceAbsent reports a verified plan whose kit core declares no local Kopia backup source this package can restore. It fails closed: such a kit (for example the Coolify Cloud core, whose recovery is the offsite backup owner) has no staged restore, drill or activation here.
Functions ¶
func ApplicationTransferConfiguration ¶ added in v0.54.10
func ApplicationTransferConfiguration(plan generationartifact.VerifiedPlan, selected []string) (map[string]backuplifecycle.ApplicationTransferWorkloadConfiguration, error)
ApplicationTransferConfiguration projects existing compiler-owned public workload settings and effective module profile bindings. Placement, routes, Foundation identities and compiler-bound render values remain destination-local. Secret material is never a public setting and travels by exact sealed slots.
func ApplicationTransferPersistentWorkloads ¶ added in v0.54.10
func ApplicationTransferPersistentWorkloads(policy localbackuppolicy.Policy, selected []string) ([]string, error)
ApplicationTransferPersistentWorkloads never invents an empty data backup.
func ApplicationTransferProjection ¶ added in v0.54.10
func ApplicationTransferProjection(workspace string, plan generationartifact.VerifiedPlan, manifest generationartifact.ArtifactManifest, selected []string, policy ...localbackuppolicy.Policy) ([]localbackuppolicy.ApplicationRuntime, error)
ApplicationTransferProjection selects the complete native graph from verified generation bundles, independently of persistent backup volume membership.
func ApplicationTransferSecretBindings ¶ added in v0.54.10
func ApplicationTransferSecretBindings(workspace string, plan generationartifact.VerifiedPlan, manifest generationartifact.ArtifactManifest, selected []string) (map[string]map[string]string, error)
ApplicationTransferSecretBindings resolves CUE secret slots from verified generated bundles. It does not need an already installed application.
func BindApplicationControls ¶ added in v0.53.13
func BindApplicationControls(base Runtime, observe func(context.Context, string) (backupexec.QuiesceContainer, error), driver func(string, string, string) (backuplifecycle.RuntimeControlDriver, error)) error
func ClearApplicationTransferSecrets ¶ added in v0.54.10
func DigestRetainedVolume ¶
func DigestRetainedVolume(ctx context.Context, workspace string, authority Authority, volume Volume) (backuplifecycle.VolumeReadback, error)
DigestRetainedVolume reads the operation-bound retained copy of one volume back, read-only, as the same file-tree digest DigestVolume gives the live one.
func HoldApplicationProject ¶
func HoldApplicationProject(ctx context.Context, workspace string, authority Authority, project string) error
HoldApplicationProject stops every container of one Compose project and any copy helper still bound to the operation. It reads only Docker labels, so a rollback can hold the application whichever release last rendered it.
func NotStarted ¶ added in v0.53.10
NotStarted tags a failure that happened before the activation service ran, so no live volume was touched, with the closed step it happened at.
func ReadApplicationTransferSecrets ¶ added in v0.54.10
func RequireApplicationTransferConfiguration ¶ added in v0.54.10
func RequireApplicationTransferConfiguration(t backuplifecycle.ApplicationTransfer, plan generationartifact.VerifiedPlan, selected []string) error
func RequireApplicationTransferTargetAbsent ¶ added in v0.54.10
func RequireApplicationTransferTargetAbsent(ctx context.Context, workspace string, policy localbackuppolicy.Policy, workloads []string, closure ...[]localbackuppolicy.ApplicationRuntime) error
func ResultEvidence ¶
ResultEvidence returns the immutable owner-custody location and digest of the exact signed activation result bytes persisted by the service.
func ResumeApplicationProject ¶
ResumeApplicationProject starts the held containers of one Compose project unchanged; it is used only when a release change is abandoned before the target release was selected.
func RuntipiAppGroupSourceSelected ¶ added in v0.54.10
RuntipiAppGroupSourceSelected admits a source shape to the native group factory. It makes no support claim: actual effects require retained private source/image/helper qualification and signed current node custody.
func StageApplicationTransfer ¶ added in v0.54.10
func StageApplicationTransfer(ctx context.Context, workspace string, authority Authority, admission TransferAdmission) error
StageApplicationTransfer copies only authenticated extracted source trees into the existing isolated staging volume, retaining destination names. It mounts no live application volume and never executes archive-supplied code.
func StandaloneComposeWorkloadHoldsNoBackupData ¶ added in v0.53.15
func StandaloneComposeWorkloadHoldsNoBackupData(canonicalPlan []byte, workloadRef string) (bool, error)
StandaloneComposeWorkloadHoldsNoBackupData reports whether the verified plan delivers the application workload through standalone Compose without any backup-enabled storage. Such a workload (Remote's Guacamole, the ntfy live relay) contributes nothing to the node's signed backup source, so the backup gate admits it exactly as restore skips it. Any other or unreadable shape returns false and stays denied.
func TransferOperationID ¶ added in v0.54.10
func VerifyApplicationTransferSecretCustody ¶ added in v0.54.10
func VerifyApplicationTransferSecretCustody(workspace string, t backuplifecycle.ApplicationTransfer, bindings map[string]map[string]string) error
func VerifyResult ¶
Types ¶
type ActivateInput ¶
type ActivateInput struct {
Transfer *TransferAdmission
MarketplaceService string
WorkloadRef string
WorkspaceRoot string
OperationID string
ExpectedPlanHash string
OwnerApproved bool
Plan generationartifact.VerifiedPlan
Manifest generationartifact.ArtifactManifest
RestoreResult backuplifecycle.RestoreResult
CurrentLineage backuplifecycle.AuthorityLineage
// RevalidateCurrentAuthority reads the existing current authority while
// the shared lifecycle lock is held; cached preflight is not admission.
RevalidateCurrentAuthority func(context.Context) (generationartifact.VerifiedPlan, backuplifecycle.AuthorityLineage, error)
// PrepareMutation acquires existing application-specific quiescence only
// after admission. Its release runs before the lifecycle lock is closed.
PrepareMutation func(context.Context) (func() error, error)
SafetySnapshotOperationID string
CreateSafetySnapshot func(context.Context, string) (backuplifecycle.SnapshotAnchor, error)
VerifyLive func(context.Context) (LiveVerification, error)
FinalizeResult func(context.Context, Result, error) error
}
type ActivationNotStartedError ¶ added in v0.42.1
type ActivationNotStartedError struct {
Cause error
}
ActivationNotStartedError reports that activation failed before its recovery journal existed, so no live volume was touched and there is nothing to recover. Callers record the requested restore as failed.
func (*ActivationNotStartedError) Error ¶ added in v0.42.1
func (err *ActivationNotStartedError) Error() string
func (*ActivationNotStartedError) Unwrap ¶ added in v0.42.1
func (err *ActivationNotStartedError) Unwrap() error
type ActivationRecoveredError ¶
ActivationRecoveredError reports that activation failed but the prior live state was restored and its signed result was persisted. Callers must record the requested restore as recovered rather than asking for an impossible second recovery of the terminal journal.
func (*ActivationRecoveredError) Error ¶
func (err *ActivationRecoveredError) Error() string
func (*ActivationRecoveredError) Unwrap ¶
func (err *ActivationRecoveredError) Unwrap() error
type ApplicationRestoreUnsupportedError ¶ added in v0.53.12
type ApplicationRestoreUnsupportedError struct {
WorkloadRef string
AdapterRef string
Reason string
}
ApplicationRestoreUnsupportedError names why `backup restore activate --workload` refused. It carries identifiers only, never data or credentials.
func (*ApplicationRestoreUnsupportedError) ActionableError ¶ added in v0.53.12
func (e *ApplicationRestoreUnsupportedError) ActionableError() actionableerror.Contract
func (*ApplicationRestoreUnsupportedError) ActionableStatus ¶ added in v0.53.12
func (e *ApplicationRestoreUnsupportedError) ActionableStatus() string
An adapter without backup/restore is a denial, like the backup gate; a node-scoped or unknown selection is a failed request.
func (*ApplicationRestoreUnsupportedError) Error ¶ added in v0.53.12
func (e *ApplicationRestoreUnsupportedError) Error() string
type Authority ¶
type Authority struct {
OperationID string `json:"operationId"`
RenderTarget string `json:"renderTarget,omitempty"`
OwnerRef string `json:"ownerRef"`
RestoreResultID string `json:"restoreResultId"`
PlanHash string `json:"planHash"`
ManifestHash string `json:"manifestHash"`
ApplyResultHash string `json:"applyResultHash"`
ManagedVolumeSetHash string `json:"managedVolumeSetHash"`
StackID string `json:"stackId"`
ComposeProject string `json:"composeProject"`
ComposePath string `json:"composePath"`
ComposeDigest string `json:"composeDigest"`
ComposeRuntimes []ComposeRuntime `json:"composeRuntimes"`
KopiaHelperImage string `json:"kopiaHelperImage"`
StagingVolume string `json:"stagingVolume"`
StagingPath string `json:"stagingPath"`
Volumes []string `json:"volumes"`
VolumeDetails []Volume `json:"volumeDetails"`
}
Authority is the immutable, plan-derived boundary for one restore activation. Volumes is the canonical sorted LiveName set used by the shared lifecycle journal; VolumeDetails carries the corresponding cutover paths.
func ApplicationAuthorityForVolumes ¶ added in v0.53.8
func ApplicationAuthorityForVolumes(workspace string, plan generationartifact.VerifiedPlan, manifest generationartifact.ArtifactManifest, result backuplifecycle.RestoreResult, operation string, volumes []string) (Authority, string, bool, error)
ApplicationAuthorityForVolumes re-resolves a narrowed recovery from the original journal's exact canonical set; no caller-selected recovery scope.
func BindRuntimeRecoveryGraph ¶
func BindRuntimeRecoveryGraph(graph RuntimeRecoveryGraph, restoreResult backuplifecycle.RestoreResult) (Authority, error)
BindRuntimeRecoveryGraph binds historical graph data to the exact staged restore result. The lifecycle owner must verify custody of both inputs before using the returned projection; this function grants no mutation permission.
func DeriveApplicationAuthority ¶ added in v0.53.8
func DeriveApplicationAuthority(workspace string, plan generationartifact.VerifiedPlan, manifest generationartifact.ArtifactManifest, result backuplifecycle.RestoreResult, operation, workload string) (Authority, error)
DeriveApplicationAuthority narrows a verified node restore to one selected managed workload. Names remain canonical; the existing manager custody adapter translates them at the Docker copy boundary, never in the journal.
func DeriveApplicationReleaseAuthority ¶
func DeriveApplicationReleaseAuthority(workspace string, plan generationartifact.VerifiedPlan, manifest generationartifact.ArtifactManifest, lineage backuplifecycle.AuthorityLineage, operation, workload string) (Authority, error)
DeriveApplicationReleaseAuthority narrows restore authority to one standalone Compose application and its governed persistent volumes for a scoped release change, against the current applied plan. Its rollback volumes are bound to the operation, so the release rollback rebuilds the same authority from its signed record without the plan the target release generated.
func DeriveAuthority ¶
func DeriveAuthority( workspaceRoot string, plan generationartifact.VerifiedPlan, manifest generationartifact.ArtifactManifest, restoreResult backuplifecycle.RestoreResult, operationID string, ) (Authority, error)
DeriveAuthority binds a staged, owner-verified restore to the exact kit core plan and generation manifest without consulting mutable policy defaults.
func DeriveMarketplaceServiceAuthority ¶ added in v0.53.13
func DeriveMarketplaceServiceAuthority(workspace string, plan generationartifact.VerifiedPlan, manifest generationartifact.ArtifactManifest, result backuplifecycle.RestoreResult, operation, service string) (Authority, error)
func DeriveTransferAuthority ¶ added in v0.54.10
func DeriveTransferAuthority(workspace string, plan generationartifact.VerifiedPlan, manifest generationartifact.ArtifactManifest, lineage backuplifecycle.AuthorityLineage, operation string, admission TransferAdmission) (Authority, error)
type CloudSessionStorage ¶ added in v0.53.9
type CloudSessionStorage struct {
// contains filtered or unexported fields
}
CloudSessionStorage reuses the restore runtime's isolated copy/digest primitives. Its authority is an existing signed component transaction, never a fabricated current Plan or Apply result.
func NewCloudSessionStorage ¶ added in v0.53.9
func NewCloudSessionStorage(workspace string) (*CloudSessionStorage, error)
func (*CloudSessionStorage) DigestLive ¶ added in v0.53.9
func (s *CloudSessionStorage) DigestLive(ctx context.Context, state localevidence.CloudSessionRouting) (string, error)
func (*CloudSessionStorage) RestoreOriginal ¶ added in v0.53.9
func (s *CloudSessionStorage) RestoreOriginal(ctx context.Context, state localevidence.CloudSessionRouting) error
func (*CloudSessionStorage) Snapshot ¶ added in v0.53.9
func (s *CloudSessionStorage) Snapshot(ctx context.Context, state localevidence.CloudSessionRouting, target bool) error
Snapshot copies only a quiesced TinyAuth volume to the journal-derived private original or target-retention volume and verifies every file's hash.
type ComposeRuntime ¶
type ComposeRuntime struct {
Project string `json:"project"`
Path string `json:"path"`
Digest string `json:"digest"`
EnvironmentPath string `json:"environmentPath,omitempty"`
EnvironmentDigest string `json:"environmentDigest,omitempty"`
Readiness []ComposeRuntimeReadiness `json:"readiness,omitempty"`
// StatePath and StateDigest bind the OpenTofu state of the root that
// applies this Compose project under the opentofu and terramate targets,
// so the state is restored and verified alongside the project's data.
StatePath string `json:"statePath,omitempty"`
StateDigest string `json:"stateDigest,omitempty"`
// Execution and RootConfigDigest retain the execution owning that bound
// state. Empty execution is the Compose wrapper; native-docker must restart
// existing containers rather than replace OpenTofu's resources with Compose.
Execution string `json:"execution,omitempty"`
RootConfigDigest string `json:"rootConfigDigest,omitempty"`
}
ComposeRuntime binds one local Compose project to the exact owner-custody bytes that were verified before restore mutation. The kit core runtime and every selected standalone-compose Application and native Marketplace installation are represented independently. PaaS-deployed applications and remote runtimes are outside this authority.
type ComposeRuntimeReadiness ¶
type ComposeRuntimeReadiness struct {
ComponentRef string `json:"componentRef"`
Lifecycle string `json:"lifecycle"`
HealthFailure string `json:"healthFailure"`
}
ComposeRuntimeReadiness carries the CUE-owned component health impact into restore activation. It lets activation wait for every blocking component while retaining a degraded component's healthcheck and diagnostics.
type LiveVerification ¶
type LiveVerification = backuplifecycle.RestoreVerification
type MarketplaceRuntimeCustody ¶ added in v0.53.1
type MarketplaceRuntimeCustody struct {
Document architecturev2renderer.MarketplaceCoolifyDocument
Runtime ComposeRuntime
Volumes []Volume
Files []StandaloneComposeRuntimeFile
}
MarketplaceRuntimeCustody retains the native installation selected by the verified plan. It grants no authority over applications deployed by a PaaS.
func DeriveHistoricalMarketplaceRuntimeCustody ¶ added in v0.53.4
func DeriveHistoricalMarketplaceRuntimeCustody(workspace string, plan generationartifact.HistoricalPlan, manifest generationartifact.ArtifactManifest, operation string) (*MarketplaceRuntimeCustody, error)
func DeriveMarketplaceRuntimeCustody ¶ added in v0.53.1
func DeriveMarketplaceRuntimeCustody(workspace string, plan generationartifact.VerifiedPlan, manifest generationartifact.ArtifactManifest, operationID string) (*MarketplaceRuntimeCustody, error)
type RecoverInput ¶
type RecoveryAuthorityResolver ¶
type RecoveryAuthorityResolver func( context.Context, lifecyclemutation.RestoreActivationAuthority, ) (Authority, error)
type Result ¶
type Result struct {
APIVersion string `json:"apiVersion"`
OperationID string `json:"operationId"`
RestoreResultID string `json:"restoreResultId"`
SafetySnapshotID string `json:"safetySnapshotId"`
PlanHash string `json:"planHash"`
ManagedVolumeSetHash string `json:"managedVolumeSetHash"`
Status string `json:"status"`
Verification LiveVerification `json:"verification"`
Signature localevidence.OwnerRestoreActivationSignature `json:"signature"`
}
func ReadResult ¶
ReadResult reads the canonical persisted result and verifies its local Owner signature. Callers must additionally bind it to their current Plan and operation evidence.
type Runtime ¶
type Runtime interface {
Inspect(context.Context, Authority) error
ValidateStaging(context.Context, Authority) error
Stop(context.Context, Authority) error
PrepareRollback(context.Context, Authority, Volume) error
ActivateVolume(context.Context, Authority, Volume) error
RestoreVolume(context.Context, Authority, Volume) error
Start(context.Context, Authority) error
CleanupRollback(context.Context, Authority, Volume) error
// DigestVolume reads one volume back, read-only, as a deterministic file
// tree digest: the staged restore content or the live volume.
DigestVolume(context.Context, Authority, Volume, bool) (backuplifecycle.VolumeReadback, error)
}
func NewDockerRuntime ¶
func WithAppGroupControls ¶ added in v0.54.10
func WithAppGroupControls(base Runtime, authority Authority, capture func(context.Context) ([]backuplifecycle.AppGroupControl, error), driver func(backuplifecycle.AppGroupControl) (backuplifecycle.AppGroupControlDriver, error)) (Runtime, error)
WithAppGroupControls preserves the existing copy/staging/safety/rollback runtime and replaces ONLY application power control. No Docker start/stop fallback exists. Capture must derive G0 from the current verified node graph; the concrete native driver requires separate source/image/helper qualification.
func WithAppGroupSessionControls ¶ added in v0.54.10
func WithAppGroupSessionControls(base Runtime, authority Authority, capture func(context.Context) ([]backuplifecycle.AppGroupControl, error), driver func(context.Context, *lifecyclemutation.Session, backuplifecycle.AppGroupControl) (backuplifecycle.AppGroupControlDriver, error)) (Runtime, error)
func WithAppGroupVolumeBinding ¶ added in v0.54.10
func WithAppGroupVolumeBinding(base Runtime, authority Authority, binding backupexec.ApplicationRuntimeBinding, current func(context.Context) (backupexec.ApplicationRuntimeBinding, error)) (Runtime, error)
WithAppGroupVolumeBinding reuses the existing signed source translation and Docker copy owner. Group power is deliberately unavailable here; the owning Session must wrap this runtime with WithAppGroupSessionControls.
func WithApplicationBinding ¶ added in v0.53.8
func WithApplicationBinding(base Runtime, authority Authority, binding backupexec.ApplicationRuntimeBinding, current func(context.Context) (backupexec.ApplicationRuntimeBinding, error)) (Runtime, error)
WithApplicationBinding delegates service control to the retained manager while reusing the native activation copy, rollback and readback machinery. The callback must re-read signed current custody, including observed mounts.
func WithMarketplaceService ¶ added in v0.53.13
func WithMarketplaceService(base Runtime, a Authority, s localbackuppolicy.MarketplaceService, observe func(context.Context) (backupexec.QuiesceContainer, error), driver backuplifecycle.RuntimeControlDriver) (Runtime, error)
Store data remains upstream-owned. This adapter supplies observation and native manager control to the existing activation/copy/rollback lifecycle.
type RuntimeRecoveryGraph ¶
type RuntimeRecoveryGraph struct {
APIVersion string `json:"apiVersion"`
Kind string `json:"kind"`
OperationID string `json:"operationId"`
RenderTarget string `json:"renderTarget,omitempty"`
PlanBinding generationartifact.PlanBinding `json:"planBinding"`
PlanHash string `json:"planHash"`
ManifestHash string `json:"manifestHash"`
ManagedVolumeSetHash string `json:"managedVolumeSetHash"`
StackID string `json:"stackId"`
ComposeProject string `json:"composeProject"`
ComposePath string `json:"composePath"`
ComposeDigest string `json:"composeDigest"`
ComposeRuntimes []ComposeRuntime `json:"composeRuntimes"`
CorePolicyArtifactID string `json:"corePolicyArtifactId"`
CorePolicyPath string `json:"corePolicyPath"`
CorePolicyDigest string `json:"corePolicyDigest"`
KopiaHelperImage string `json:"kopiaHelperImage"`
StagingVolume string `json:"stagingVolume"`
StagingRoot string `json:"stagingRoot"`
Volumes []string `json:"volumes"`
VolumeDetails []Volume `json:"volumeDetails"`
}
RuntimeRecoveryGraph is canonical derived runtime custody data from a verified plan, its generation manifest, and one operation identity. Its future signed snapshot or opaque materialization handle supplies immutable authority; this caller-mutable value is never a VerifiedPlan or mutation authorization by itself. Staging paths are deliberately absent from VolumeDetails until a real, verified RestoreResult is bound.
RenderTarget is empty for the compose generation target, which keeps the Compose graph byte-identical to graphs signed before OpenTofu targets. For the opentofu and terramate targets it names the target, every Compose runtime is the runtime Compose file its OpenTofu root writes, and every runtime carries the state of that root.
func DeriveHistoricalRuntimeRecoveryGraph ¶ added in v0.53.4
func DeriveHistoricalRuntimeRecoveryGraph(workspace string, plan generationartifact.HistoricalPlan, manifest generationartifact.ArtifactManifest, operation string) (RuntimeRecoveryGraph, error)
func DeriveRuntimeRecoveryGraph ¶
func DeriveRuntimeRecoveryGraph( workspaceRoot string, plan generationartifact.VerifiedPlan, manifest generationartifact.ArtifactManifest, operationID string, ) (RuntimeRecoveryGraph, error)
DeriveRuntimeRecoveryGraph derives the current CUE-owned runtime graph without manufacturing a restore result. The returned graph is suitable for later owner-signed custody, while parsed graph data remains non-authorizing.
func ParseRuntimeRecoveryGraph ¶
func ParseRuntimeRecoveryGraph(data []byte) (RuntimeRecoveryGraph, error)
ParseRuntimeRecoveryGraph accepts only the exact canonical JSON emitted by MarshalCanonical and never turns the result into a verified plan.
func ReconcileRuntimeExecution ¶ added in v0.52.5
func ReconcileRuntimeExecution(graph RuntimeRecoveryGraph, configurations map[string][]byte) (RuntimeRecoveryGraph, error)
ReconcileRuntimeExecution derives execution only from configuration bytes the lifecycle caller has authenticated in the same retained checkpoint as the graph's state. It does not read live files or rewrite signed history.
func (RuntimeRecoveryGraph) MarshalCanonical ¶
func (graph RuntimeRecoveryGraph) MarshalCanonical() ([]byte, error)
MarshalCanonical emits the one stable JSON representation used by signed recovery custody. It does not add CUE or runtime authorization semantics.
func (RuntimeRecoveryGraph) Validate ¶
func (graph RuntimeRecoveryGraph) Validate() error
Validate checks the closed, portable shape and internal bindings of a graph. It validates graph data only; it does not re-resolve CUE or authorize a mutation.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
func NewService ¶
func NewService(runtime Runtime, resolver RecoveryAuthorityResolver) (*Service, error)
type StageError ¶ added in v0.53.10
StageError names the closed activation step at which activation failed, so a caller can report it without exposing the cause text. Error returns the cause unchanged.
func (*StageError) Error ¶ added in v0.53.10
func (err *StageError) Error() string
func (*StageError) Unwrap ¶ added in v0.53.10
func (err *StageError) Unwrap() error
type StagedRestoreRemover ¶ added in v0.46.5
type StagedRestoreRemover interface {
RemoveStagedRestore(ctx context.Context, graph RuntimeRecoveryGraph, stagingPath string) error
}
StagedRestoreRemover removes one operation's staged restore tree from the governed staging volume. It is implemented by the Docker runtime and is used by the Advanced restore drill, which must leave no staged data behind and must never mount or modify a live application volume, and after a committed restore activation, whose staged data is then the live state.
type StandaloneComposeRuntimeCustody ¶
type StandaloneComposeRuntimeCustody struct {
Project string
Runtime ComposeRuntime
Bundle StandaloneComposeRuntimeFile
Compose StandaloneComposeRuntimeFile
Environment StandaloneComposeRuntimeFile
ConfigFiles []StandaloneComposeRuntimeFile
}
StandaloneComposeRuntimeCustody contains the generated runtime files that must travel with one standalone Compose application. Its contents are derived from the same CUE-owned runtime graph used by restore activation.
func ApplicationTransferRuntimeCustody ¶ added in v0.54.10
func ApplicationTransferRuntimeCustody(workspace string, plan generationartifact.VerifiedPlan, manifest generationartifact.ArtifactManifest, selected []string) ([]StandaloneComposeRuntimeCustody, error)
ApplicationTransferRuntimeCustody binds even stateless companions to their exact persisted Compose/config/environment custody using the existing binder.
func DeriveHistoricalStandaloneComposeRuntimeCustody ¶ added in v0.53.4
func DeriveHistoricalStandaloneComposeRuntimeCustody(workspace string, plan generationartifact.HistoricalPlan, manifest generationartifact.ArtifactManifest, operation string) ([]StandaloneComposeRuntimeCustody, error)
func DeriveStandaloneComposeRuntimeCustody ¶
func DeriveStandaloneComposeRuntimeCustody( workspaceRoot string, plan generationartifact.VerifiedPlan, manifest generationartifact.ArtifactManifest, operationID string, ) ([]StandaloneComposeRuntimeCustody, error)
DeriveStandaloneComposeRuntimeCustody reads and verifies the exact owner-local standalone Compose runtime files selected by a verified plan. It shares restore activation's CUE/runtime binding and is intended for inclusion in another owner-signed recovery closure.
type StandaloneComposeRuntimeFile ¶
StandaloneComposeRuntimeFile is one owner-local runtime file that belongs to a selected standalone Compose application. The bytes are returned only to the caller that is building an owner-signed recovery closure.
type TransferAdmission ¶ added in v0.54.10
type TransferAdmission struct {
RuntimeStartOrder []string
Staged backuplifecycle.EmergencyRestoreResult
SourceOwner string
SourceFingerprint string
TransferID string
DestinationPolicy localbackuppolicy.Policy
}
TransferAdmission is explicit destination-local trust. Source public-key material inside the encrypted archive cannot supply its own trust anchor.
type Volume ¶
type Volume struct {
MarketplaceService string `json:"marketplaceService,omitempty"`
MarketplaceComponent string `json:"marketplaceComponent,omitempty"`
ComponentRef string `json:"componentRef"`
LogicalName string `json:"logicalName"`
ComposeProject string `json:"composeProject"`
LiveName string `json:"liveName"`
StagingPath string `json:"stagingPath"`
RollbackName string `json:"rollbackName"`
}
Volume is one exact persistent backup volume selected by the kit core runtime. LogicalName comes from the component graph; LiveName is the Compose-qualified Docker volume name. RollbackName is deterministic for the activation operation and never caller supplied.
Source Files
¶
- app_group_runtime.go
- app_group_volume_binding.go
- application_authority.go
- application_capability.go
- application_controls.go
- application_release.go
- application_runtime.go
- application_transfer.go
- application_transfer_projection.go
- application_transfer_secrets.go
- authority.go
- cloud_session_storage.go
- docker.go
- historical_projection.go
- marketplace.go
- marketplace_service_runtime.go
- recovery_graph.go
- runtipi_source.go
- service.go
- staging_removal.go
- types.go