bvandeusenandClaude Opus 5.5
b875160c40
The backup file (#5672 "Backup file: pg_dump of config + audit + alert history, the secret key and a manifest"): steward-<UTC>.tar holding a pg_dump --format=custom with metrics', check results' and Docker/Traefik/ UniFi rows left out, the secret key, and a manifest. Every table is named KEPT or EXCLUDED in steward/backup/contents.py, and a guard test fails on a new one. The image gains postgresql-client-17 (approved, System 180). The restore (#5674 "Restore: `steward restore` and a CI test that a dump brings Steward back"): pg_restore in its three sections. Between data and constraints, a kept row pointing at a left-out row gets what its foreign key's ON DELETE says (alert_events.ansible_run_id is cleared). It refuses a non-empty database unless --wipe, and puts the backup's key in /data/secret.key. Migrations run on Steward's next start. `steward` stays the server command: it is now a click group that serves when given no subcommand. The publish smoke step backs up the booted image's database, restores it into a second one, checks a marker setting came back and plugin_metrics is empty, and starts Steward on it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
45 lines
2.1 KiB
Python
45 lines
2.1 KiB
Python
"""What a backup carries. Every table Steward defines is named here as kept
|
|
or left out, and tests/core/test_backup_contents.py fails on one that is
|
|
neither, so a new table is a decision someone makes in this file.
|
|
|
|
The operator's ruling (System 180 "Backup & Restore", 2026-10-12): a backup
|
|
carries configuration, the audit log and alert history. Metrics, check
|
|
results and the Docker, Traefik and UniFi history are left out: their tables
|
|
come back with their structure and no rows, and fill again as Steward runs.
|
|
|
|
A table that is in neither list (an external plugin's) is backed up whole:
|
|
a table nobody thought about is kept, never lost.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
# Configuration, and the history the operator chose to keep.
|
|
KEPT: frozenset[str] = frozenset({
|
|
"app_settings", "users", "user_invites", "api_tokens",
|
|
"hosts", "host_agent_registrations",
|
|
"monitors",
|
|
"alert_rules", "alert_states", "maintenance_windows",
|
|
"ansible_targets", "ansible_groups", "ansible_schedules",
|
|
"dashboards", "dashboard_widgets", "dashboard_share_tokens",
|
|
"snmp_devices", "prometheus_targets",
|
|
# Names given to network clients by hand (UniFi's alias column).
|
|
"unifi_known_clients",
|
|
# History kept by the ruling.
|
|
"audit_events", "alert_events",
|
|
})
|
|
|
|
# Rows that are measurements, logs or in-flight work: left out.
|
|
EXCLUDED: frozenset[str] = frozenset({
|
|
"plugin_metrics", "plugin_metric_latest", "plugin_metrics_hourly",
|
|
"monitor_results",
|
|
"email_outbox", "password_resets",
|
|
# Run history; its logs live on disk, not in the database.
|
|
"ansible_runs",
|
|
"docker_containers", "docker_disk_usage", "docker_events", "docker_host_status",
|
|
"docker_images", "docker_logs", "docker_metrics", "docker_metrics_hourly",
|
|
"docker_swarm_nodes", "docker_swarm_services",
|
|
"traefik_access_summaries", "traefik_certs", "traefik_global_stats", "traefik_metrics",
|
|
"unifi_alarms", "unifi_client_snapshots", "unifi_devices", "unifi_dpi_snapshots",
|
|
"unifi_events", "unifi_fw_rules", "unifi_networks", "unifi_port_forwards",
|
|
"unifi_speedtest_results", "unifi_wan_stats", "unifi_wlan_stats",
|
|
})
|