backup

package
v0.12.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 11, 2026 License: Apache-2.0 Imports: 35 Imported by: 0

Documentation

Overview

Package backup is the platform backup format and target (ADR-0203): a generation's layout and manifest on an S3-compatible store or a directory, fencing against a second writer, and a retention ladder that needs a credential which only puts and lists. ADR-0205 runs it; ADR-0206 reads what it writes.

Index

Constants

View Source
const Format = 1

Format is the platform manifest's format, a sequence apart from the KV manifest.json's (Decision 3).

View Source
const PartBytes = 8 << 20

PartBytes is the most bytes one part of a stored file holds (Decision 2); the sibling backups part theirs alike.

Variables

This section is empty.

Functions

func Abandoned

func Abandoned(ms []Manifest) map[GenRef]bool

Abandoned returns the generations on an abandoned branch: a parent timeline's generations numbered above the generation a restore loaded from it.

func ConditionRefused

func ConditionRefused(err error) bool

ConditionRefused reports a store refusing If-None-Match: S3's NotImplemented, or a 501.

func GenDir

func GenDir(class Class, n uint64, timeline string) string

GenDir is a generation's directory, gen/<class>/<n>-<timeline>/, n in 10 decimal digits.

func LifecycleRules

func LifecycleRules(r Retention) map[string]int

LifecycleRules is the expiry in days the operator sets per prefix (Decision 6): a class unused, or Verified 0, has none.

func Records

func Records(r io.Reader) func() (snapshot.Record, error)

Records reads the framing of Decision 2: io.EOF at the end, a torn record fault.Invalid.

func TargetURL

func TargetURL(cfg Config) (string, error)

TargetURL is the bucket URL Open opens for cfg's target, checked as Open checks a target: a directory's carries dir_file_mode 0700. A sibling backup on the same target (ADR-0208, ADR-0209), or funcdctl backup verify, opens its own bucket on it.

func WriteRecord

func WriteRecord(w io.Writer, r snapshot.Record) error

WriteRecord frames r as uvarint(len key) ‖ key ‖ uvarint(len value) ‖ value (Decision 2).

Types

type Class

type Class string

Class is a generation's class: a rung of the ladder or a pin outside it (Decision 6).

const (
	Hourly     Class = "hourly"
	Daily      Class = "daily"
	Weekly     Class = "weekly"
	PreUpgrade Class = "pre-upgrade"
	Verified   Class = "verified"
)

func ClassFor

func ClassFor(entries []Entry, now time.Time, r Retention) Class

ClassFor is a ladder run's class (Decision 6): weekly when weekly is kept and no complete weekly manifest is in now's ISO week (UTC); else daily when daily is kept and no complete daily or weekly one is in now's UTC day; else hourly. Pins never count.

type Config

type Config struct {
	Target, CredentialsFile, DataDir, KeyPrefix string
	SingleWriter                                bool
	Retention                                   Retention
	Logger                                      *slog.Logger
}

Config opens a Target. KeyPrefix names the config keys in errors ("" ⇒ "backup."); DataDir is the platform data directory: a directory target on its device is no independent copy, and a run spools its cut there.

type Entry

type Entry struct {
	Generation uint64
	Timeline   string
	Class      Class
	Complete   bool
	At         time.Time
}

Entry is one generation a listing shows. All but At come from the key; At is the manifest's ModTime, zero while the generation is incomplete.

func List

func List(ctx context.Context, b blob.Bucket) ([]Entry, error)

List lists gen/ once, a generation per entry, by generation then timeline then class; no lock, no probe.

type GenRef

type GenRef struct {
	Timeline   string `json:"timeline"`
	Generation uint64 `json:"generation"`
}

GenRef names a generation: expiry can return a number, so n alone does not.

type Keys

type Keys struct {
	SecretsKey   string   `json:"secretsKey,omitempty"`
	MasterSecret string   `json:"masterSecret,omitempty"`
	Recipients   []string `json:"recipients,omitempty"`
}

Keys are the envelope's key records, whose values ADR-0204 defines; absent ⇒ none recorded, and no Recipients ⇒ the stores are unsealed.

type Manifest

type Manifest struct {
	Format     int    `json:"format"`
	Generation uint64 `json:"generation"`
	// At is when the cut began (ADR-0196's form).
	At    v1alpha1.Timestamp `json:"at"`
	Funcd string             `json:"funcd"`
	// Timeline and Revision split the metastore version the cut returned.
	Timeline string `json:"timeline"`
	Revision uint64 `json:"revision"`
	// Parent is the generation a restore loaded; nil when the timeline began at a first start.
	Parent *GenRef     `json:"parent,omitempty"`
	Stores []StoreFile `json:"stores"`
	Keys
}

Manifest is a generation's manifest.yaml (Decision 3), written last: the generation exists once it does. A new field's absence means the behavior before it; a changed meaning, framing or layout bumps Format. Readers ignore unknown fields.

func ReadManifest

func ReadManifest(ctx context.Context, b blob.Bucket, e Entry) (Manifest, error)

ReadManifest reads the manifest of e; it needs a credential that reads.

type Opener

type Opener func(recipients []string) (Unseal, error)

Opener returns the Unseal for a manifest's recipients; ADR-0204's envelope.Opener(ids) returns one.

type Retention

type Retention struct{ Hourly, Daily, Weekly, Verified int }

Retention is the ladder's lifetimes: hours, days and weeks a class is kept, and the days a gen/verified/ copy is. Daily or Weekly 0 leaves the class unused; Verified 0 sets no gen/verified/ rule (the KV, ADR-0209); ClassFor ignores Verified.

type Seal

type Seal func(dst io.Writer) (io.WriteCloser, error)

Seal wraps dst in ADR-0204's envelope; nil stores the bytes as is.

type StoreFile

type StoreFile struct {
	Name   string `json:"name"`
	Parts  int    `json:"parts"`
	Bytes  int64  `json:"bytes"`
	SHA256 string `json:"sha256"`
}

StoreFile is one store's file, in cut order: its parts, and the size and SHA-256 (hex) of the stored bytes.

type Target

type Target interface {
	// Ready takes a directory's lock and probes the target (Decision 4); Write calls it first.
	Ready(ctx context.Context) error
	// Conditional reports, after Ready's nil, whether puts carry IfNotExist: false only when the target refused it
	// and singleWriter is set.
	Conditional() bool
	List(ctx context.Context) ([]Entry, error)
	// Write cuts the stores and writes one generation; a second writer is fault.Conflict.
	Write(ctx context.Context, events, meta, runs snapshot.Source, opts WriteOptions) (Manifest, error)
	// Close releases the lock and the bucket.
	Close() error
}

Target is a backup target.

func Open

func Open(ctx context.Context, cfg Config) (Target, error)

Open checks cfg and opens its target; a bad scheme or key is fault.Invalid naming <KeyPrefix><key>.

type Unseal

type Unseal func(src io.Reader) (io.Reader, error)

Unseal opens a store file sealed by Seal; nil reads the bytes as is.

type WriteOptions

type WriteOptions struct {
	Seal   Seal
	Keys   Keys
	Parent *GenRef
	Pin    Class
}

WriteOptions configures a run: the envelope and its keys (ADR-0204), the generation a restore loaded (ADR-0206), and a pin ("" ⇒ the ladder, PreUpgrade ⇒ ADR-0207's pin).

Directories

Path Synopsis
Package blobmirror mirrors the local blob store to the platform backup target (ADR-0208 Decision 4): each run freezes the store into a hard-link image, uploads the objects whose id the current epoch lacks, then an index and a manifest, written last; nothing on the target is ever read, overwritten or deleted.
Package blobmirror mirrors the local blob store to the platform backup target (ADR-0208 Decision 4): each run freezes the store into a hard-link image, uploads the objects whose id the current epoch lacks, then an index and a manifest, written last; nothing on the target is ever read, overwritten or deleted.
Package envelope seals a backup generation to operator-held age recipients and names the keys it needs (ADR-0204 Decisions 1-3, 5): the box writes what it cannot read.
Package envelope seals a backup generation to operator-held age recipients and names the keys it needs (ADR-0204 Decisions 1-3, 5): the box writes what it cannot read.
Package escrow holds the restore key rules over the operator's escrow set (ADR-0204 Decisions 4, 5): the secrets key and the master secret a generation names, matched by content fingerprint, and the credentials a new master changes.
Package escrow holds the restore key rules over the operator's escrow set (ADR-0204 Decisions 4, 5): the secrets key and the master secret a generation names, matched by content fingerprint, and the credentials a new master changes.
Package plan turns recovery objectives into backup settings (ADR-0223): Derive maps them to keys, Apply splices the keys into a file's bytes, CheckConfig runs the daemon's loader on the result and CheckRTO bounds the recovery time.
Package plan turns recovery objectives into backup settings (ADR-0223): Derive maps them to keys, Apply splices the keys into a file's bytes, CheckConfig runs the daemon's loader on the result and CheckRTO bounds the recovery time.
Package runner runs the platform backup (ADR-0205): one run at a time, on a cadence anchored on the newest complete ladder generation; a status read from the target's listing; the funcd.backup metrics; and the rpoRisk alert on the newest verified generation.
Package runner runs the platform backup (ADR-0205): one run at a time, on a cadence anchored on the newest complete ladder generation; a status read from the target's listing; the funcd.backup metrics; and the rpoRisk alert on the newest verified generation.
Package verify checks a platform backup generation off the box and pins it under gen/verified/ (ADR-0205 Decision 6): the parts against the manifest, a full decrypt with the operator's identities, the framing and key order, and with an escrow set the keys the generation names.
Package verify checks a platform backup generation off the box and pins it under gen/verified/ (ADR-0205 Decision 6): the parts against the manifest, a full decrypt with the operator's identities, the framing and key order, and with an escrow set the keys the generation names.
Package workload is an app owner's backup (ADR-0222): the members a BackupSchedule's scope names, one full copy of them under <target>/<ns>/<backup>-<uid>/ (Decision 4) and the reads a Restore makes of it.
Package workload is an app owner's backup (ADR-0222): the members a BackupSchedule's scope names, one full copy of them under <target>/<ns>/<backup>-<uid>/ (Decision 4) and the reads a Restore makes of it.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL