fix: a new server takes a backup after its first scan, and restarts to load the restored settings (#6786)

A one-off end-to-end run of the :dev image (scratch Postgres, generated
FLAC files, no outbound network) found that the web restore, done the way
docs/hosting.md describes, was refused with not_empty: a new server's
startup scan fills the library before anyone signs up, and Restore counted
tracks as occupied. The command-line restore passed the same run.

- Restore now asks only that the instance has no accounts. The library the
  first scan found is replaced by the backup's (every foreign key into
  artists/albums/tracks cascades or sets null), and the restore locks the
  library tables so a running scan waits rather than adding to them.
- Settings are read once at boot by about ten services, the library folders
  among them, so after a web restore the server ran on its defaults until
  restarted. The restore endpoint now answers, then asks the process to
  restart in place (syscall.Exec of the same binary, arguments and
  environment), which needs no container restart policy. The startup scan
  of the restarted server replaces the scan the endpoint used to start.
- The restore form says Minstrel is restarting; the docs say a scanned new
  server still takes a backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/api.go

@@ -41,7 +41,7 @@ import (
 // Mount attaches /api/* handlers to r. Public endpoints (login) are outside
 // RequireUser; everything else is gated by the middleware. The events writer
 // is shared with the Subsonic mount so /rest/scrobble feeds the same store.
-func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playevents.Writer, recCfg config.RecommendationConfig, recSettings *recsettings.Service, requestSvc *requests.Service, quarantineSvc *quarantine.Service, tracksSvc *tracks.Service, playlistsSvc *playlists.Service, coverEnricher *coverart.Enricher, coverSettings *coverart.SettingsService, tagSettings *tags.SettingsService, scanner *library.Scanner, scanCfg library.RunScanConfig, dataDir string, sender mailer.Sender, bus *eventbus.Bus, playlistScheduler *playlists.Scheduler, streamSecret []byte, netSettings *netsettings.Service, reacqSettings *reacquisition.SettingsService, fpSettings *library.FingerprintSettingsService, loudSettings *library.LoudnessSettingsService, acoustIDLookup *library.AcoustIDLookupWorker, backups *backup.Service) {
+func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playevents.Writer, recCfg config.RecommendationConfig, recSettings *recsettings.Service, requestSvc *requests.Service, quarantineSvc *quarantine.Service, tracksSvc *tracks.Service, playlistsSvc *playlists.Service, coverEnricher *coverart.Enricher, coverSettings *coverart.SettingsService, tagSettings *tags.SettingsService, scanner *library.Scanner, scanCfg library.RunScanConfig, dataDir string, sender mailer.Sender, bus *eventbus.Bus, playlistScheduler *playlists.Scheduler, streamSecret []byte, netSettings *netsettings.Service, reacqSettings *reacquisition.SettingsService, fpSettings *library.FingerprintSettingsService, loudSettings *library.LoudnessSettingsService, acoustIDLookup *library.AcoustIDLookupWorker, backups *backup.Service, restart func()) {
 	rng := rand.New(rand.NewSource(rand.Int63()))
 	setupToken, err := auth.NewSetupToken()
 	if err != nil {
@@ -76,6 +76,7 @@ func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger, events *playev
 		loudnessSettings:    loudSettings,
 		acoustIDLookup:      acoustIDLookup,
 		backups:             backups,
+		restart:             restart,
 		acquisition:         acquire.NewStore(pool),
 		catalogue:           cat,
 		wanted:              wanted.New(pool, cat, logger),
@@ -439,6 +440,9 @@ type handlers struct {
 	acoustIDLookup *library.AcoustIDLookupWorker
 	// backups is the server's own backup: settings, status, test and run.
 	backups *backup.Service
+	// restart stops the server and starts it again in place, so a restored
+	// backup's settings are read at boot. Nil in tests.
+	restart func()
 	// acquisition is the configured indexers and download clients.
 	acquisition *acquire.Store
 	// catalogue is the release catalogue read from MusicBrainz, and

internal/api/auth_restore.go

@@ -1,14 +1,12 @@
 package api
 
 import (
-	"context"
 	"errors"
 	"net/http"
 
 	"git.fabledsword.com/bvandeusen/minstrel/internal/apierror"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/backup"
 	"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
-	"git.fabledsword.com/bvandeusen/minstrel/internal/library"
 )
 
 // SetupTokenHeader carries the setup token on a restore upload, whose body is
@@ -19,20 +17,24 @@ type restoreResp struct {
 	// Accounts is how many accounts came back; everyone signs in with the
 	// password they had.
 	Accounts int64 `json:"accounts"`
-	// ScanStarted says the library scan that refills what the backup leaves
-	// out is under way.
-	ScanStarted bool `json:"scan_started"`
+	// Restarting says the server restarts now to load the restored settings.
+	// The scan at its start finds each music file and fills in what the
+	// backup leaves out.
+	Restarting bool `json:"restarting"`
 }
 
 // handleRestore implements POST /api/auth/restore: a new server, with no
 // accounts yet, loads a backup file sent as the request body. It asks for the
 // setup token from the server log, as creating the first account does, since
-// the backup's admins become this server's admins. Then it starts a library
-// scan, which finds each file at its path and fills in what the backup left
-// out.
+// the backup's admins become this server's admins. A library the server's
+// first scan found is replaced by the backup's.
+//
+// Then the server restarts. Settings are read once, at boot, so the restored
+// ones (the library folders among them) take effect the same way they do
+// after `minstrel restore`, and the startup scan finds each file at its path.
 //
 // 200 restored · 400 not_a_backup · 403 setup_token_invalid ·
-// 409 not_empty (accounts or a library already) · 409 newer_backup
+// 409 not_empty (accounts already) · 409 newer_backup
 func (h *handlers) handleRestore(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	q := dbq.New(h.pool)
@@ -63,7 +65,7 @@ func (h *handlers) handleRestore(w http.ResponseWriter, r *http.Request) {
 	}
 	switch err := backup.Restore(ctx, h.pool, contents); {
 	case errors.Is(err, backup.ErrNotEmpty):
-		writeErr(w, apierror.Conflict("not_empty", "this server already has accounts or a library; a backup restores into a new one"))
+		writeErr(w, apierror.Conflict("not_empty", "this server already has accounts; a backup restores into a new one"))
 		return
 	case errors.Is(err, backup.ErrNewerSchema):
 		writeErr(w, apierror.Conflict("newer_backup", "the backup was made by a newer Minstrel; update this server first"))
@@ -82,13 +84,11 @@ func (h *handlers) handleRestore(w http.ResponseWriter, r *http.Request) {
 	}
 	h.logger.Info("restored a backup", "made_at", manifest.CreatedAt, "build", manifest.Build,
 		"schema", manifest.Schema, "accounts", out.Accounts)
-	if h.scanner != nil {
-		started, _, err := library.TryStartScan(context.Background(), h.pool, h.scanner, h.coverart,
-			h.logger.With("source", "restore"), h.scanCfg)
-		if err != nil {
-			h.logger.Warn("restore: start the library scan", "err", err)
-		}
-		out.ScanStarted = started
-	}
+	out.Restarting = h.restart != nil
 	writeJSON(w, http.StatusOK, out)
+	if h.restart != nil {
+		// The server drains this request before it stops, so the answer
+		// reaches the browser first.
+		h.restart()
+	}
 }

internal/api/auth_restore_test.go

@@ -40,6 +40,8 @@ func TestRestore_ANewServerTakesABackupWithTheSetupToken(t *testing.T) {
 	}
 	h.setupToken = token
 	h.requireSetupToken = true
+	restarts := 0
+	h.restart = func() { restarts++ }
 	restore := func(setupToken string, body []byte) *httptest.ResponseRecorder {
 		req := httptest.NewRequest(http.MethodPost, "/api/auth/restore", bytes.NewReader(body))
 		req.Header.Set("Content-Type", "application/x-tar")
@@ -65,14 +67,20 @@ func TestRestore_ANewServerTakesABackupWithTheSetupToken(t *testing.T) {
 	if err := pool.QueryRow(ctx, "SELECT count(*) FROM users").Scan(&n); err != nil || n != 0 {
 		t.Fatalf("a refused restore left %d accounts (%v)", n, err)
 	}
+	if restarts != 0 {
+		t.Errorf("a refused restore restarted the server %d times", restarts)
+	}
 
 	w := restore(token.Value(), file.Bytes())
 	if w.Code != http.StatusOK {
 		t.Fatalf("restore: status = %d body = %s", w.Code, w.Body.String())
 	}
 	var out restoreResp
-	if err := json.NewDecoder(w.Body).Decode(&out); err != nil || out.Accounts != 1 {
-		t.Errorf("restore answered %+v (%v), want one account", out, err)
+	if err := json.NewDecoder(w.Body).Decode(&out); err != nil || out.Accounts != 1 || !out.Restarting {
+		t.Errorf("restore answered %+v (%v), want one account and a restart", out, err)
+	}
+	if restarts != 1 {
+		t.Errorf("the restore restarted the server %d times, want once so the restored settings load", restarts)
 	}
 	var admin bool
 	if err := pool.QueryRow(ctx, "SELECT is_admin FROM users WHERE username = $1",
@@ -84,4 +92,7 @@ func TestRestore_ANewServerTakesABackupWithTheSetupToken(t *testing.T) {
 		!strings.Contains(w.Body.String(), "not_empty") {
 		t.Errorf("a second restore: status = %d body = %s, want 409 not_empty", w.Code, w.Body.String())
 	}
+	if restarts != 1 {
+		t.Errorf("a refused second restore restarted the server (%d restarts)", restarts)
+	}
 }

internal/backup/backup_test.go

@@ -189,7 +189,16 @@ func TestARestoredInstanceHoldsWhatTheBackupHeld_Integration(t *testing.T) {
 		t.Fatalf("restore from a newer schema: err = %v, want ErrNewerSchema", err)
 	}
 
-	mustExec(t, pool, "TRUNCATE users, artists, library_changes CASCADE")
+	// A new server scans its music before anyone signs up, so it already has
+	// a library, here with a track the backup doesn't know. It still takes
+	// the backup: the backup's library replaces what the scan found, which the
+	// next scan finds again under the backup's ids.
+	mustExec(t, pool, "TRUNCATE users CASCADE")
+	scannedArtist := mustID(t, pool, `INSERT INTO artists (name, sort_name) VALUES ('Scanned', 'scanned') RETURNING id::text`)
+	scannedAlbum := mustID(t, pool, `INSERT INTO albums (title, sort_title, artist_id) VALUES ('Scanned', 'scanned', $1) RETURNING id::text`, scannedArtist)
+	scanned := mustID(t, pool, `INSERT INTO tracks (title, album_id, artist_id, duration_ms, file_path, file_size, file_format)
+		VALUES ('Scanned', $1, $2, 1000, '/music/b.flac', 10, 'flac') RETURNING id::text`, scannedAlbum, scannedArtist)
+	mustExec(t, pool, `INSERT INTO library_changes (entity_type, entity_id, op) VALUES ('track', $1, 'upsert')`, scanned)
 	if err := backup.Restore(ctx, pool, first); err != nil {
 		t.Fatalf("restore: %v", err)
 	}

internal/backup/restore.go

@@ -13,9 +13,8 @@ import (
 )
 
 var (
-	// ErrNotEmpty is a restore into an instance that already has accounts or
-	// a library.
-	ErrNotEmpty = errors.New("backup: this Minstrel already has accounts or a library; a backup restores into an empty one")
+	// ErrNotEmpty is a restore into an instance that already has accounts.
+	ErrNotEmpty = errors.New("backup: this Minstrel already has accounts; a backup restores into a new one")
 
 	// ErrNewerSchema is a backup written by a newer Minstrel than this one.
 	ErrNewerSchema = errors.New("backup: the backup was written by a newer version of Minstrel; upgrade this one first")
@@ -30,10 +29,12 @@ const batchRows = 500
 // Restore loads a backup into an empty instance, in one transaction: either
 // all of it lands or none of it does.
 //
-// The instance must have no accounts and no tracks. Its other rows in the
-// tables the backup holds are replaced, which is what a fresh instance's
-// seeded settings need. A table the backup doesn't hold, because it was
-// written before that table existed, keeps what the instance has.
+// The instance must have no accounts. Its rows in the tables the backup holds
+// are replaced: a fresh instance's seeded settings, and the library its
+// startup scan found before anyone signed up, which the scan after the
+// restore finds again under the backup's ids. A table the backup doesn't
+// hold, because it was written before that table existed, keeps what the
+// instance has.
 //
 // A row's columns are those the backup and the table both have: an older
 // backup's rows take the defaults of columns added since, and a column dropped
@@ -52,15 +53,15 @@ func Restore(ctx context.Context, pool *pgxpool.Pool, c Contents) error {
 	if c.Schema > schema {
 		return ErrNewerSchema
 	}
-	// Taken before the emptiness check, so a first account or a scan starting
-	// at the same moment waits for the restore, then finds the data.
-	if _, err := tx.Exec(ctx, "LOCK TABLE users, tracks IN EXCLUSIVE MODE"); err != nil {
+	// Taken before the emptiness check, so a first account made at the same
+	// moment waits for the restore, then finds the data. A scan still running
+	// waits too, rather than adding to the library while it is replaced.
+	if _, err := tx.Exec(ctx, "LOCK TABLE users, artists, albums, tracks IN EXCLUSIVE MODE"); err != nil {
 		return fmt.Errorf("backup: lock: %w", err)
 	}
 	var occupied bool
-	if err := tx.QueryRow(ctx,
-		"SELECT EXISTS (SELECT 1 FROM users) OR EXISTS (SELECT 1 FROM tracks)").Scan(&occupied); err != nil {
-		return fmt.Errorf("backup: check the instance is empty: %w", err)
+	if err := tx.QueryRow(ctx, "SELECT EXISTS (SELECT 1 FROM users)").Scan(&occupied); err != nil {
+		return fmt.Errorf("backup: check the instance is new: %w", err)
 	}
 	if occupied {
 		return ErrNotEmpty

internal/server/server.go

@@ -104,6 +104,9 @@ type Server struct {
 	// leave it nil leave the cookie path intact and reject all signed
 	// tokens (HMAC of empty key matches nothing a client could mint).
 	StreamSecret []byte
+	// Restart asks the process to stop and start again in place. A web
+	// restore calls it so the restored settings are read at boot.
+	Restart func()
 }
 
 func New(logger *slog.Logger, pool *pgxpool.Pool, scanner ScanTrigger, subCfg subsonic.Config, eventsCfg config.EventsConfig, recCfg config.RecommendationConfig, dataDir string, brandingCfg config.BrandingConfig, coverEnricher *coverart.Enricher, coverSettings *coverart.SettingsService, libraryScanner *library.Scanner, scanCfg library.RunScanConfig) *Server {
@@ -208,7 +211,7 @@ func (s *Server) Router() http.Handler {
 		if backups == nil {
 			backups = backup.NewService(s.Pool, s.Logger, buildinfo.Version)
 		}
-		api.Mount(r, s.Pool, s.Logger, writer, s.RecommendationCfg, recSettings, requestSvc, quarantineSvc, tracksSvc, playlistsSvc, s.CoverEnricher, s.CoverSettings, s.TagSettings, s.LibraryScanner, s.ScanCfg, s.DataDir, smtpSender, bus, s.PlaylistScheduler, s.StreamSecret, netSettings, reacqSettings, fpSettings, loudSettings, acoustIDLookup, backups)
+		api.Mount(r, s.Pool, s.Logger, writer, s.RecommendationCfg, recSettings, requestSvc, quarantineSvc, tracksSvc, playlistsSvc, s.CoverEnricher, s.CoverSettings, s.TagSettings, s.LibraryScanner, s.ScanCfg, s.DataDir, smtpSender, bus, s.PlaylistScheduler, s.StreamSecret, netSettings, reacqSettings, fpSettings, loudSettings, acoustIDLookup, backups, s.Restart)
 		// /api/admin/scan is the only admin route owned by the server package
 		// (it needs the Scanner). Register it as a single inline-middleware
 		// route — using r.Route("/api/admin", ...) here would create a second