Help us shape the future of Go! Take the 2026 Go Developer Survey

backup

package
v0.17.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 20, 2026 License: Apache-2.0 Imports: 35 Imported by: 0

Documentation

Overview

Package backup is the platform backup format and target (ADR-0203): a generation's layout and manifest on an S3-compatible store or a directory, fencing against a second writer, and a retention ladder that needs a credential which only puts and lists. ADR-0205 runs it; ADR-0206 reads what it writes.

Index

Constants

View Source
const Format = 1

Format is the platform manifest's format, a sequence apart from the KV manifest.json's (Decision 3).

View Source
const PartBytes = 8 << 20

PartBytes is the most bytes one part of a stored file holds (Decision 2); the sibling backups part theirs alike.

Variables

This section is empty.

Functions

func Abandoned

func Abandoned(ms []Manifest) map[GenRef]bool

Abandoned returns the generations on an abandoned branch: a parent timeline's generations numbered above the generation a restore loaded from it.

func ConditionRefused added in v0.11.0

func ConditionRefused(err error) bool

ConditionRefused reports a store refusing If-None-Match: S3's NotImplemented, or a 501.

func GenDir

func GenDir(class Class, n uint64, timeline string) string

GenDir is a generation's directory, gen/<class>/<n>-<timeline>/, n in 10 decimal digits.

func LifecycleRules

func LifecycleRules(r Retention) map[string]int

LifecycleRules is the expiry in days the operator sets per prefix (Decision 6): a class unused, or Verified 0, has none.

func Records

func Records(r io.Reader) func() (snapshot.Record, error)

Records reads the framing of Decision 2: io.EOF at the end, a torn record fault.Invalid.

func TargetURL

func TargetURL(cfg Config) (string, error)

TargetURL is the bucket URL Open opens for cfg's target, checked as Open checks a target: a directory's carries dir_file_mode 0700. A sibling backup on the same target (ADR-0208, ADR-0209), or funcdctl backup verify, opens its own bucket on it.

func WriteRecord added in v0.11.0

func WriteRecord(w io.Writer, r snapshot.Record) error

WriteRecord frames r as uvarint(len key) ‖ key ‖ uvarint(len value) ‖ value (Decision 2).

Types

type Class

type Class string

Class is a generation's class: a rung of the ladder or a pin outside it (Decision 6).

const (
	Hourly     Class = "hourly"
	Daily      Class = "daily"
	Weekly     Class = "weekly"
	PreUpgrade Class = "pre-upgrade"
	Verified   Class = "verified"
)

func ClassFor

func ClassFor(entries []Entry, now time.Time, r Retention) Class

ClassFor is a ladder run's class (Decision 6): weekly when weekly is kept and no complete weekly manifest is in now's ISO week (UTC); else daily when daily is kept and no complete daily or weekly one is in now's UTC day; else hourly. Pins never count.

type Config

type Config struct {
	Target, CredentialsFile, DataDir, KeyPrefix string
	SingleWriter                                bool
	Retention                                   Retention
	Logger                                      *slog.Logger
}

Config opens a Target. KeyPrefix names the config keys in errors ("" ⇒ "backup."); DataDir is the platform data directory: a directory target on its device is no independent copy, and a run spools its cut there.

type Entry

type Entry struct {
	Generation uint64
	Timeline   string
	Class      Class
	Complete   bool
	At         time.Time
}

Entry is one generation a listing shows. All but At come from the key; At is the manifest's ModTime, zero while the generation is incomplete.

func List

func List(ctx context.Context, b blob.Bucket) ([]Entry, error)

List lists gen/ once, a generation per entry, by generation then timeline then class; no lock, no probe.

type GenRef

type GenRef struct {
	Timeline   string `json:"timeline"`
	Generation uint64 `json:"generation"`
}

GenRef names a generation: expiry can return a number, so n alone does not.

type Keys

type Keys struct {
	SecretsKey   string   `json:"secretsKey,omitempty"`
	MasterSecret string   `json:"masterSecret,omitempty"`
	Recipients   []string `json:"recipients,omitempty"`
}

Keys are the envelope's key records, whose values ADR-0204 defines; absent ⇒ none recorded, and no Recipients ⇒ the stores are unsealed.

type Manifest

type Manifest struct {
	Format     int    `json:"format"`
	Generation uint64 `json:"generation"`
	// At is when the cut began (ADR-0196's form).
	At    v1alpha1.Timestamp `json:"at"`
	Funcd string             `json:"funcd"`
	// Timeline and Revision split the metastore version the cut returned.
	Timeline string `json:"timeline"`
	Revision uint64 `json:"revision"`
	// Parent is the generation a restore loaded; nil when the timeline began at a first start.
	Parent *GenRef     `json:"parent,omitempty"`
	Stores []StoreFile `json:"stores"`
	Keys
}

Manifest is a generation's manifest.yaml (Decision 3), written last: the generation exists once it does. A new field's absence means the behavior before it; a changed meaning, framing or layout bumps Format. Readers ignore unknown fields.

func ReadManifest

func ReadManifest(ctx context.Context, b blob.Bucket, e Entry) (Manifest, error)

ReadManifest reads the manifest of e; it needs a credential that reads.

type Opener

type Opener func(recipients []string) (Unseal, error)

Opener returns the Unseal for a manifest's recipients; ADR-0204's envelope.Opener(ids) returns one.

type Retention

type Retention struct{ Hourly, Daily, Weekly, Verified int }

Retention is the ladder's lifetimes: hours, days and weeks a class is kept, and the days a gen/verified/ copy is. Daily or Weekly 0 leaves the class unused; Verified 0 sets no gen/verified/ rule (the KV, ADR-0209); ClassFor ignores Verified.

type Seal

type Seal func(dst io.Writer) (io.WriteCloser, error)

Seal wraps dst in ADR-0204's envelope; nil stores the bytes as is.

type StoreFile

type StoreFile struct {
	Name   string `json:"name"`
	Parts  int    `json:"parts"`
	Bytes  int64  `json:"bytes"`
	SHA256 string `json:"sha256"`
}

StoreFile is one store's file, in cut order: its parts, and the size and SHA-256 (hex) of the stored bytes.

type Target

type Target interface {
	// Ready takes a directory's lock and probes the target (Decision 4); Write calls it first.
	Ready(ctx context.Context) error
	// Conditional reports, after Ready's nil, whether puts carry IfNotExist: false only when the target refused it
	// and singleWriter is set.
	Conditional() bool
	List(ctx context.Context) ([]Entry, error)
	// Write cuts the stores and writes one generation; a second writer is fault.Conflict.
	Write(ctx context.Context, events, meta, runs snapshot.Source, opts WriteOptions) (Manifest, error)
	// Close releases the lock and the bucket.
	Close() error
}

Target is a backup target.

func Open

func Open(ctx context.Context, cfg Config) (Target, error)

Open checks cfg and opens its target; a bad scheme or key is fault.Invalid naming <KeyPrefix><key>.

type Unseal

type Unseal func(src io.Reader) (io.Reader, error)

Unseal opens a store file sealed by Seal; nil reads the bytes as is.

type WriteOptions

type WriteOptions struct {
	Seal   Seal
	Keys   Keys
	Parent *GenRef
	Pin    Class
}

WriteOptions configures a run: the envelope and its keys (ADR-0204), the generation a restore loaded (ADR-0206), and a pin ("" ⇒ the ladder, PreUpgrade ⇒ ADR-0207's pin).

Directories

Path Synopsis
Package blobmirror mirrors the local blob store to the platform backup target (ADR-0208 Decision 4): each run freezes the store into a hard-link image, uploads the objects whose id the current epoch lacks, then an index and a manifest, written last; nothing on the target is ever read, overwritten or deleted.
Package blobmirror mirrors the local blob store to the platform backup target (ADR-0208 Decision 4): each run freezes the store into a hard-link image, uploads the objects whose id the current epoch lacks, then an index and a manifest, written last; nothing on the target is ever read, overwritten or deleted.
Package envelope seals a backup generation to operator-held age recipients and names the keys it needs (ADR-0204 Decisions 1-3, 5): the box writes what it cannot read.
Package envelope seals a backup generation to operator-held age recipients and names the keys it needs (ADR-0204 Decisions 1-3, 5): the box writes what it cannot read.
Package escrow holds the restore key rules over the operator's escrow set (ADR-0204 Decisions 4, 5): the secrets key and the master secret a generation names, matched by content fingerprint, and the credentials a new master changes.
Package escrow holds the restore key rules over the operator's escrow set (ADR-0204 Decisions 4, 5): the secrets key and the master secret a generation names, matched by content fingerprint, and the credentials a new master changes.
Package plan turns recovery objectives into backup settings (ADR-0223): Derive maps them to keys, Apply splices the keys into a file's bytes, CheckConfig runs the daemon's loader on the result and CheckRTO bounds the recovery time.
Package plan turns recovery objectives into backup settings (ADR-0223): Derive maps them to keys, Apply splices the keys into a file's bytes, CheckConfig runs the daemon's loader on the result and CheckRTO bounds the recovery time.
Package runner runs the platform backup (ADR-0205): one run at a time, on a cadence anchored on the newest complete ladder generation; a status read from the target's listing; the funcd.backup metrics; and the rpoRisk alert on the newest verified generation.
Package runner runs the platform backup (ADR-0205): one run at a time, on a cadence anchored on the newest complete ladder generation; a status read from the target's listing; the funcd.backup metrics; and the rpoRisk alert on the newest verified generation.
Package verify checks a platform backup generation off the box and pins it under gen/verified/ (ADR-0205 Decision 6): the parts against the manifest, a full decrypt with the operator's identities, the framing and key order, and with an escrow set the keys the generation names.
Package verify checks a platform backup generation off the box and pins it under gen/verified/ (ADR-0205 Decision 6): the parts against the manifest, a full decrypt with the operator's identities, the framing and key order, and with an escrow set the keys the generation names.
Package workload is an app owner's backup (ADR-0222): the members a BackupSchedule's scope names, one full copy of them under <target>/<ns>/<backup>-<uid>/ (Decision 4) and the reads a Restore makes of it.
Package workload is an app owner's backup (ADR-0222): the members a BackupSchedule's scope names, one full copy of them under <target>/<ns>/<backup>-<uid>/ (Decision 4) and the reads a Restore makes of it.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL