jschoubben
aec2ed3c24
The controller grants a read only from the owner's announcement (ADR 0495 clause 3). gitea announced `bound` unreadable, so mesh-provisioner bound no forge account; disk-load announced `readings` unreadable, refused to restic, nfs-server and mounts; restic announced `good` unreadable, which the self-check reads. Nothing in the catalogue compared readers with announcements since the gate's manifest check went (clause 5). Quick fix: mark those three states readable. Thorough fix: also checks/readable, which reads every owner's Go and TypeScript announcement and refuses any `reads` of a state it does not announce readable, so the next owner to announce cannot repeat it. Chose thorough: the same kind hit three owners at once. Reads of other repositories' owners (mesh-controller.lease, mesh-grants.accounts) are not judged here.
restic
The machine's backups as the node-backup seat (novox/hq ADR 0214, to-be 43, ADR 0233): one restic
repository on the machine, one restore point per module a night, thinned by the machine's settings.
Against mistakes, not disasters: nothing leaves the machine.
How restore points are kept
- A night's restore point is tagged with its module alone and thinned by
keep-daily,keep-weeklyandkeep-monthly(14, 8 and 6 by default). - A restore point taken by hand (
node-backup.now, asked by a person, or by the mesh before a module moves) is taggedhandas well. The thinning keeps that tag (--keep-tag hand), so the next night never takes it (novox/hq issue 453). It is let go, by its id, only when both hold: it is older thankeep-hand-taken-days(7 by default), and a later night of its module was recorded as good. A partial night, where restic wrote a restore point but could not read every file, does not count. - A module that left the machine gets no later night, so its restore points taken by hand are kept for good. That is a choice: deleting a module's last restore point is a person's act, and until then it costs only space.
A repository another restic holds (a listing of the restore points, say, while a delivery plan backs up
the machine's modules before their moves) is waited for: the thinning asks restic to retry the lock for up to
ten minutes (--retry-lock, novox/hq issue 620), and fails only after that. A failed thinning keeps every
restore point, and the module's health stays unhealthy until a thinning succeeds: the next night's, or one
after node-backup.now.
node-backup.backed-up lists each module's restore points taken by hand under handTaken: when
each was taken, the time it is kept at least until, whether it still waits for a later good night,
and a sentence saying so.
Files it does not know
Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
${dir:state}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).${dir:repository}: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).