mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-13 23:42:53 +09:00
Juan Denis
b48256fba2
A backup that was never verified is a hope, not a safety net. Closes the remaining ways the pre-upgrade safety net could silently not exist: - Every backup is verified immediately after creation: SQLite snapshots via PRAGMA integrity_check, PostgreSQL dumps via size + pg_restore TOC listing (when available). Invalid artifacts are deleted and the update halts — a malformed backup is never mistaken for a good one. - Partial artifacts from a failed backup are removed (rm on failure), so a half-written file can never be 'restored' later. - A failed IN-PLACE PostgreSQL migration now automatically restores the verified pre-upgrade dump (pg_restore --clean --if-exists) before halting; without it the half-migrated schema would stay live against the old code. If the restore itself fails, the halt message carries the exact manual pg_restore command. - backup_docker_db tries both python and python3 in the container, and now verifies the result too — the plain docker cp fallback can no longer pass off a torn copy as a backup. - Backup retention capped: default 5 (SERVERKIT_BACKUP_RETENTION overrides) across trees, .db and .dump files. Full-size DB copies pile up fast — a real 25G droplet carried 6.3G of stale backups. Tests: T10f (verification helpers accept/reject correctly), T10g (failed in-place PG migration auto-restores with the exact pg_restore args), T10h (retention prunes all three backup kinds to the configured cap).