7 Commits

Include renames

Author	SHA1	Message	Date
jschoubben	879bc4bca2	restic: keep a backup taken by hand past the next thinning, until a later night and keep-hand-taken-days, so the restore point taken against a risky change is still there when it is needed (novox/hq issue 453)	2026-10-11 12:28:17 +02:00
jschoubben	d649309895	restic: raise a failed backup, a failed thinning and a refused retention as the module's health (novox/hq issue 454) ... A failed night was a journal line only, so a typo in a retention setting let the repository grow until a disk filled. The night and the measuring now run as processes the node-engine judges: the night by backup_health, which is unhealthy for a module not backed up, a night that did not run, a failed thinning or a missing retention file, and waits naming the setting when one is refused; the measuring by its unit. A file lock keeps a night and the tool runtime's now and restore apart. The retention file is root's alone, so the account reads it through sudo: until now every night would have refused it as unreadable. Every machine has the file, so a missing one is refused instead of thinned by 14/8/6. backed-up says the retention in force and the last thinning per module.	2026-10-11 11:56:23 +02:00
jochen	b240085e0a	Close the review's gaps round the agent account (hq ADR 0266) ... The managed settings apply to every account's claude, so a key-helper script under the agent's home would run as the operator, and through sudo as root: the command is now carried whole in the root-owned managed settings and reads the key only as the agent. The helper reads only a regular file, bounded, without blocking, and a request it does not answer fails in time instead of holding every later one; a directory entry it answers that is not a name is refused. The guard's record is matched on its binary in the query, a half-named agent account is not taken as the operator's, the kept API key stays until the agent's home holds one, restic refuses to restore beside a directory others may write, and the agent-home check cleans a path before judging it.	2026-10-09 23:48:15 +02:00
jochen	dae7bb848d	restic: restore away from a directory another account owns ... Root writes a restore beside the live data. In a directory another account controls, such as the agent's home (hq ADR 0266), that account could put a symbolic link where root writes and have root write anywhere; such a restore now goes to the module's state.	2026-10-09 10:14:18 +02:00
jschoubben	46e3a5a6b7	restic: restore a single kept file, not only a directory ... The first restore of an arr app refused its settings file with "not a directory": restic restores a snapshot's subfolder, not a file. A file is restored with its full path into a scratch directory beside the target, moved into place, and the scratch removed.	2026-10-05 14:05:52 +02:00
jschoubben	08c7a79f79	restic: ask as root whether a directory is there ... The first run on the control node called postgres's dumps missing: the holder looked as the runtime's account, which cannot see inside a store's 0700 data directory. Every other act already runs as root; the existence checks do too now.	2026-10-05 12:31:07 +02:00
jschoubben	3a88bca21a	restic: the holder in Go ... Go is the default for new module code; the holder is one binary like the licence manager, serving the seat's verbs over the SDK and running the nights beside them. Same behaviour and tests.	2026-10-05 11:58:18 +02:00