Repository navigation
feat(backup): server preflight, detached runs and ranged reads for Dash setup - #72
Merged
Merged
Conversation
… why backup-target owners failed outright on any previous location it could not reach, which is all of them for a key limited to the current prefix. Each is now skipped with a warning and listed in skipped_locations. The current prefix failing stays an error, since an empty list would read as no owners. --clear asks every location first, so a refusal removes nothing anywhere, then tries them all instead of stopping at the first failure, and takes --json. backup status left Target.Error empty with no aws CLI, which a consumer showed as a bare "cannot reach". It now gives the plain cause, and a listing that fails silently names its exit status. Messages and comments no longer imply backup-target set installs aws. The aws installer installs curl when missing. Event kinds for this work are added here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A read-only report of what a server needs before backups can start. A probe that fails reads as unknown, never as fine, and an unreachable server is a report. --install-tools installs aws (setup's script, signature check included), age and python3 and nothing else, then checks each reads as fine. --upgrade-binary installs the release matching this CLI through the verified install path, since ensureFleetBinary leaves any binary with --all alone and engine fixes never reached servers. It refuses a development CLI and a downgrade. deployTeployBinaryToServer is split so a named tag can be installed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Prints an object's first bytes as stored, as base64, for proving a recovery key in a browser. At most 256 KiB, only under the server's own or previous prefixes, and it never decrypts. Credentials stay inside the stored-target shell, out of argv. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Starts the cron line's run on the server in its own session, so it survives a dropped connection, under the same flock, and looks at it for about 3 seconds. A second one reports already_running and exits 0. Results reach status and events as a normal run's do. Too old a binary is a refusal naming --upgrade-binary, never an implicit upgrade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
backup-preflight-envelope, backup-head-envelope and backup-detach-envelope, with fixtures generated from the real collectors and DTOs. CHANGELOG, README and AUDIT_OPEN entries. The stale claim that backup-target set installs aws also sits in teploy-dash, internal/server/backupstorage.go:35. That one belongs to the Dash side of this work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CLI support for Dash's simple backup setup.
server backup-preflight: read-only report per server, with consented--install-tools(aws, age, python3 only) and--upgrade-binary.backup head <key> --bytes N: ranged read through the stored target, so a browser can prove a recovery key. It never decrypts.backup run --all --detach: survives an SSH drop, under the same lock.backup-target ownersskips unreachable previous locations with a warning.--clearno longer stops partway.backup-setup-v1, contracts rev 21.Not yet run on real infrastructure: apt and the aws bundle, a real upgrade (it needs this release to exist) and a real store.
🤖 Generated with Claude Code