jschoubben
3cce15fa81
mesh/merge-gate head 3cce15fa811e merged into trunk 835bf22b7d40 — pass: builds restic → ace, g14, novox, shanks; no bus step; every machine composes with …
mesh/repo-check head 3cce15fa811e merged into trunk 835bf22b7d40 — pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (go), merge-…
mesh/delivery delivered
mesh/check failed: unit: modules/gitea.test: [gitea] where the poll of merges last looked from could not be read, so none is kept — no runtime | 3cce1…
A restic outside the night's lock, such as a listing while a delivery plan backs up data modules before their moves, held the lock 246 ms before the thinning asked for it, and the thinning failed at once, raising an urgent condition for a timing collision. restic's --retry-lock now waits up to ten minutes on both of the thinning's forgets; past that it fails with restic's words as before.
37 lines
2.2 KiB
Markdown
37 lines
2.2 KiB
Markdown
# restic
|
|
|
|
The machine's backups as the `node-backup` seat (novox/hq ADR 0214, to-be 43, ADR 0233): one restic
|
|
repository on the machine, one restore point per module a night, thinned by the machine's settings.
|
|
Against mistakes, not disasters: nothing leaves the machine.
|
|
|
|
## How restore points are kept
|
|
|
|
- **A night's restore point** is tagged with its module alone and thinned by `keep-daily`,
|
|
`keep-weekly` and `keep-monthly` (14, 8 and 6 by default).
|
|
- **A restore point taken by hand** (`node-backup.now`, asked by a person, or by the mesh before a
|
|
module moves) is tagged `hand` as well. The thinning keeps that tag (`--keep-tag hand`), so the
|
|
next night never takes it (novox/hq issue 453). It is let go, by its id, only when both hold:
|
|
it is older than `keep-hand-taken-days` (7 by default), and a later night of its module was
|
|
recorded as good. A partial night, where restic wrote a restore point but could not read every
|
|
file, does not count.
|
|
- **A module that left the machine** gets no later night, so its restore points taken by hand are
|
|
kept for good. That is a choice: deleting a module's last restore point is a person's act, and
|
|
until then it costs only space.
|
|
|
|
**A repository another restic holds** (a listing of the restore points, say, while a delivery plan backs up
|
|
the machine's modules before their moves) is waited for: the thinning asks restic to retry the lock for up to
|
|
ten minutes (`--retry-lock`, novox/hq issue 620), and fails only after that. A failed thinning keeps every
|
|
restore point, and the module's health stays unhealthy until a thinning succeeds: the next night's, or one
|
|
after `node-backup.now`.
|
|
|
|
`node-backup.backed-up` lists each module's restore points taken by hand under `handTaken`: when
|
|
each was taken, the time it is kept at least until, whether it still waits for a later good night,
|
|
and a sentence saying so.
|
|
|
|
## Files it does not know
|
|
|
|
Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
|
|
|
|
- `${dir:state}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
|
|
- `${dir:repository}`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
|