steve
c8ead66f08
Cohesive batch from a smoke-test session against a real rest-server.
Themed bullets:
* Agent runs as root, sandboxed via systemd. CapabilityBoundingSet
drops to CAP_DAC_READ_SEARCH + restore caps; ProtectSystem=strict
with ReadWritePaths confined to /etc + /var/lib/restic-manager;
NoNewPrivileges blocks escalation. Install script no longer
creates a service user. spec.md §4.2 / §14.1 / §14.3 explain the
rationale (matches UrBackup / Veeam / Bareos defaults; trying to
back up "everything" as an unprivileged user creates silent skips
on /home, /root, /var/lib/* with no upside vs the threat model
the agent already implies).
* Init-repo end-to-end. New JobKind="init" wired through agent
runner, restic.Env.RunInit, server dispatcher, and a UI button
(red "Initialise repo" in the run-now panel). hosts.repo_initialised_at
flips on init success, on backup success, or on a non-empty
snapshots.report. The "Run now" / "Init" / "Retry" branching now
drives both the dashboard host row and the host-detail panel.
Migrations 0004 (column), 0005 (jobs.kind CHECK widened — using
the safe create-new-then-rename pattern; first version corrupted
job_logs.job_id FK), 0006 (cleans up job_logs FK on already-
affected DBs).
* rest-server creds embedded at exec time only. restic.Env gains
RepoUsername; mergeRestCreds() builds the user:pass@-prefixed URL
inside envSlice() and never assigns it back to the struct, so
nothing slog-able ever sees the cleartext form. RedactURL helper
for any future surface that needs to log a URL safely. Both
helpers tested.
* Add-host UX. Repo password is now optional — server mints a
24-byte URL-safe random one and surfaces it once, alongside an
htpasswd snippet ("echo PASS | htpasswd -B -i ... USERNAME") so
the operator pastes one command on the rest-server host and one
on the endpoint. Result page also links the install snippet at
/install/install.sh (was /install.sh — 404'd before) and pipes
to bash (not sh — script uses set -o pipefail and other
bashisms; on Debian/Ubuntu sh is dash).
* Late-subscriber race in JobHub. A fast-failing job could finish
(DB write + Broadcast) before the browser's HX-Redirect → page
load → WS-connect path completed, so the JS sat forever waiting
on a job.finished that already passed. JobHub split into
Register + Send + Run; handleJobStream now subscribes first,
re-fetches the job, and sends a synthetic job.finished if the
state is already terminal.
* HTMX error visibility. New toast partial listens to
htmx:responseError and surfaces the response body as a
bottom-right toast — every server-side validation error now
becomes visible without per-handler JS wiring. Also handles
custom rm:toast events for future server-pushed notifications
via the HX-Trigger header. Themed via existing CSS vars.
* Dashboard rows are now whole-row clickable to host detail
(CSS card-link pattern: absolute-positioned anchor + .row-action
z-index restoration so the action button stays clickable).
"View →" on a running job links to /jobs/<id> rather than
/hosts/<id> since the row click already covers the host page.
* "Run first" / "Run first backup" → "Run now" everywhere for
consistency.
* runbook (docs/e2e-smoke.md) updated — live-log streaming step
now reflects P1-26; mentions the browser-driven Run-now flow.
* _diag/dump-creds — moved out of cmd/ so go build doesn't pick
it up; .gitignore now excludes /_diag/ entirely.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
34 lines
1.2 KiB
SQL
34 lines
1.2 KiB
SQL
-- 0006_fix_job_logs_fk.sql
|
|
--
|
|
-- Migration 0005 rebuilt the jobs table via the unsafe pattern of
|
|
-- renaming the original to jobs_old before dropping it. SQLite (with
|
|
-- legacy_alter_table=OFF, the modern default) propagated that rename
|
|
-- into the FK declaration of job_logs.job_id, which is now pointing
|
|
-- at jobs_old — a table that no longer exists. INSERTs into job_logs
|
|
-- fail with "no such table: main.jobs_old (1)".
|
|
--
|
|
-- Rebuild job_logs using the safe pattern: create job_logs_new with
|
|
-- a clean FK to jobs, copy rows, drop the broken job_logs, rename
|
|
-- job_logs_new to job_logs. Renaming job_logs_new is safe because
|
|
-- nothing references it.
|
|
|
|
PRAGMA foreign_keys = OFF;
|
|
|
|
CREATE TABLE job_logs_new (
|
|
job_id TEXT NOT NULL REFERENCES jobs(id) ON DELETE CASCADE,
|
|
seq INTEGER NOT NULL,
|
|
ts TEXT NOT NULL,
|
|
stream TEXT NOT NULL CHECK (stream IN ('stdout','stderr','event')),
|
|
payload TEXT NOT NULL,
|
|
PRIMARY KEY (job_id, seq)
|
|
);
|
|
|
|
INSERT INTO job_logs_new (job_id, seq, ts, stream, payload)
|
|
SELECT job_id, seq, ts, stream, payload FROM job_logs;
|
|
|
|
DROP TABLE job_logs;
|
|
|
|
ALTER TABLE job_logs_new RENAME TO job_logs;
|
|
|
|
PRAGMA foreign_keys = ON;
|