E3 Backup & restore
- Area
- E — Maintenance
- Audience
- operator
- Kind
- feature
- Status
- accepted
- Maturity
- built
- Labels
- storage, updates
The feature in the specification · Read at
Requirements
Service databases MUST be quiesced or captured via the service's own backup mechanism; a live SQLite file MUST NOT be copied silently.
- locked by
- 0.3.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/backup.rscrates/lemonfiber-core/src/backup/run.rscrates/lemonfiber-core/src/archive.rscrates/lemonfiber-core/src/app/restore.rscrates/lemonfiber/src/main.rscrates/lemonfiber/src/archive.rs
- cited by
- lemonfiber@5e24ee8626lemonfiber@e9cfed0581
Backups MUST include service configuration, lemonfiber configuration, the expected-state baseline, and materialised stack files.
- locked by
- 0.3.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/backup.rscrates/lemonfiber-core/src/backup/run.rscrates/lemonfiber-core/src/archive.rscrates/lemonfiber-core/src/app/restore.rscrates/lemonfiber/src/main.rscrates/lemonfiber/src/archive.rs
- cited by
- lemonfiber@a4c7d2dccelemonfiber@e9cfed0581lemonfiber@cee47eab80lemonfiber@dc488e7a19
Backups MUST NOT include the media library.
Backups containing credentials MUST be labelled sensitive at creation and within the archive.
A backup MUST be taken automatically before updates, before adoption, and before configuration removal. The capture taken before an adoption MUST cover the existing setup's own configuration, at the host paths the survey reports, rather than lemonfiber's layout — which holds nothing worth protecting until the takeover has happened.
Restore MUST support whole-stack and single-service scope.
An archive MUST be verified and its contents listed before anything is overwritten.
- locked by
- 0.3.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/backup.rscrates/lemonfiber-core/src/backup/run.rscrates/lemonfiber-core/src/archive.rscrates/lemonfiber-core/src/app/restore.rscrates/lemonfiber/src/main.rscrates/lemonfiber/src/archive.rs
- cited by
- lemonfiber@b03a922d2blemonfiber@e9cfed0581lemonfiber@8296315166lemonfiber@24f1280a8a
A corrupt or incompatible archive MUST be refused before modification begins.
Restore from a newer lemonfiber version MUST be refused with the version gap stated.
Restore to a different data root MUST detect the path difference and offer to re-point.
- locked by
- 0.3.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/backup.rscrates/lemonfiber-core/src/backup/run.rscrates/lemonfiber-core/src/archive.rscrates/lemonfiber-core/src/app/restore.rscrates/lemonfiber/src/main.rscrates/lemonfiber/src/archive.rs
- cited by
- lemonfiber@b03a922d2blemonfiber@e9cfed0581lemonfiber@23f65efaf8
Retention MUST be bounded and MUST NOT prune the last remaining backup.
Insufficient disk space MUST be detected before capture begins.
Restore MUST report which restored credentials subsequently fail validation.
After restore, inter-service wiring MUST be reconciled by re-running seed.
A full backup of a typical configuration SHOULD complete within 60 seconds.
lemonfiber MUST NOT restore a captured tree it does not manage. An archive of an existing setup MUST record the host path each tree was taken from, so putting it back is an ordinary extraction the operator performs deliberately. Writing into a tree lemonfiber does not manage is the one step in a restore nobody can sanction on the operator's behalf.