bvandeusenandClaude Opus 5.5
e8b75143f1
#5823 "Check a backup: compare what it would restore with what is in place, without restoring". - steward/backup/check.py: pg_restore writes the backup's rows as COPY text with no database involved. The rows in place go out through COPY in the same form. Tables are compared on their primary keys, over the columns both sides have, and grouped by area. - Sealed values are opened with each side's own key and compared as plaintext digests, so a secret sealed twice still matches. They are never shown. A backup whose key can't open its own secrets fails the check. - What Steward records as it runs (last-seen times, a schedule's last run, backup history, scraped UniFi fields) is left out of the comparison: contents.ACTIVITY, STATE_SETTINGS and HAND_SET_ONLY. - Settings → Backups: - a Check button on each sent backup, which fetches it from the bucket (new s3.get_file); - "Check a file" to upload one, with the size limit raised before the CSRF check reads the form; - a results page. - Each backup Steward sends checks itself once written, and its history row says how that went. - New CLI command `steward check-backup FILE`. CI's image smoke step checks a real backup against its source and expects a match. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
75 lines
4.4 KiB
HTML
75 lines
4.4 KiB
HTML
{# settings/backup_check.html — a backup compared with what is in place (#5823):
|
|
the verdict, what the backup is (when, which Steward, its key), then each
|
|
area's count and the rows that differ. Nothing was changed to show it. #}
|
|
{% extends "base.html" %}
|
|
{% from "_macros.html" import crumbs %}
|
|
{% from "settings/_tabs.html" import settings_tabs %}
|
|
{% block title %}Settings — Backups — Check — Steward{% endblock %}
|
|
{% block section_tabs %}{{ settings_tabs("backups") }}{% endblock %}
|
|
{% block breadcrumb %}{{ crumbs([("Settings", "/settings/"), ("Backups", "/settings/backups/"), ("Check " ~ (name or "a backup"), "")]) }}{% endblock %}
|
|
{% block content %}
|
|
{% if error %}
|
|
<p class="page-verdict"><span class="tone-crit">{{ name or "The backup" }} couldn't be checked. {{ error }}</span></p>
|
|
{% else %}
|
|
{% set tone = "tone-crit" if not report.ok else ("tone-ok" if not report.changes else "tone-warn") %}
|
|
<p class="page-verdict"><span class="{{ tone }}">{{ report.summary() }}</span></p>
|
|
|
|
<div class="card" style="max-width:640px;margin-bottom:1.25rem;">
|
|
<dl class="kv">
|
|
<dt>File</dt><dd>{{ report.name }}</dd>
|
|
<dt>Made</dt><dd>{% if report.made_at %}{{ report.made_at|when }}{% else %}—{% endif %}
|
|
by Steward {{ report.manifest.steward_version or "—" }}</dd>
|
|
<dt>Schema</dt><dd>
|
|
{%- if report.schema == "same" %}The same as this Steward's.
|
|
{%- elif report.schema == "older" %}<span class="tone-warn">Older than this Steward's.</span> A restore would replace everything, and Steward would bring it up to date on start.
|
|
{%- else %}<span class="tone-crit">Newer than this Steward's.</span> This Steward can't restore it; update Steward first.{% endif %}</dd>
|
|
<dt>Secret key</dt><dd>
|
|
{%- if report.key_same %}The one in use here.{% else %}<span class="tone-warn">A different one.</span> A restore would put it in place, and passwords and keys stored since would need entering again.{% endif %}
|
|
{%- if report.sealed %} It opens {{ report.sealed - report.unopened }} of the backup's {{ report.sealed }} sealed value{{ "s" if report.sealed != 1 }}.{% endif %}</dd>
|
|
</dl>
|
|
</div>
|
|
|
|
<div class="card-flush" style="margin-bottom:1.25rem;">
|
|
<table class="table">
|
|
<thead><tr><th>Area</th><th>Same</th><th>Differ</th><th>Only in the backup</th><th>Only here</th></tr></thead>
|
|
<tbody>
|
|
{% for a in report.areas %}
|
|
{% set differ = a.tables|sum(attribute="differ", start=[])|length %}
|
|
{% set only_b = a.tables|sum(attribute="only_backup", start=[])|length %}
|
|
{% set only_h = a.tables|sum(attribute="only_here", start=[])|length %}
|
|
<tr>
|
|
<td>{{ a.name }}</td>
|
|
<td>{{ a.same }}</td>
|
|
<td>{% if differ %}<span class="tone-warn">{{ differ }}</span>{% else %}—{% endif %}</td>
|
|
<td>{% if only_b %}<span class="tone-warn">{{ only_b }}</span>{% else %}—{% endif %}</td>
|
|
<td>{% if only_h %}<span class="tone-warn">{{ only_h }}</span>{% else %}—{% endif %}</td>
|
|
</tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
|
|
{% for a in report.areas if a.changes or a.tables|selectattr("note")|list %}
|
|
<h2 class="section-title" style="margin:1.5rem 0 0.75rem;">{{ a.name }}</h2>
|
|
<ul class="check-list">
|
|
{% for t in a.tables %}
|
|
{% for d in t.differ %}
|
|
<li><strong>{{ d.label }}</strong> differs
|
|
{%- if d.secret %} (a sealed value; not shown).
|
|
{%- elif d.backup_value is not none or d.here_value is not none %}: the backup has <code>{{ d.backup_value if d.backup_value is not none else "nothing" }}</code>, here it is <code>{{ d.here_value if d.here_value is not none else "nothing" }}</code>.
|
|
{%- else %} in {{ d.columns|join(", ") }}.{% endif %}</li>
|
|
{% endfor %}
|
|
{% for label in t.only_backup %}<li><strong>{{ label }}</strong> is only in the backup: a restore brings it back.</li>{% endfor %}
|
|
{% for label in t.only_here %}<li><strong>{{ label }}</strong> is only here: a restore removes it.</li>{% endfor %}
|
|
{% if t.note %}<li class="tone-dim">{{ t.table }}: {{ t.note }}</li>{% endif %}
|
|
{% endfor %}
|
|
</ul>
|
|
{% endfor %}
|
|
|
|
<p class="field-hint" style="margin-top:1rem;">Left out of the comparison: what Steward records as it runs
|
|
(when an agent or monitor was last seen, a schedule's last run, the backup history), since it changes by the
|
|
minute. A restore still brings those back as they were in the backup.</p>
|
|
{% endif %}
|
|
<p style="margin-top:1rem;"><a href="/settings/backups/">Back to Backups</a></p>
|
|
{% endblock %}
|