100 Commits

Author	SHA1	Message	Date
dillard	6ae1b2277f	Version 1.1.0: release date	2026-11-09 17:02:30 +01:00
dillard	042fdae686	Review fixes: the longest deletion delay when the location's settings cannot be read, a damaged passphrase slot does not stop the next one ... - Unreadable settings or an invalid delay on the location: 365 days, so nothing leaves the Bin sooner than on the old server - A passphrase change that still cannot reach a location is logged; removing a location clears its flag - A damaged slot (missing parts, invalid base64) is skipped and the next slot is tried - Tests: damaged settings scenario, damaged slot, upgrade test checks the migration and the time zone	2026-11-08 18:29:31 +01:00
dillard	99f1655d04	Review fixes: a missed passphrase change follows at the next backup, a key from before 1.1.0 counts as used, schedules edited in their own time zone ... - A location that a passphrase change could not reach gets it at its next backup - A key from before 1.1.0 is never replaced as an unused one - An unreadable settings file on a location is told apart from a missing one - A schedule is shown and saved in the zone it was saved in - Saving an unchanged schedule keeps its moment; --timezone needs a schedule - Schedule coverage uses the time the backup began reading its data - Tests: catch-up scenario, upgrade test restores the new file, autumn clock change	2026-11-08 17:18:13 +01:00
dillard	c5024d3ddc	Version 1.1.0: changelog, README status and roadmap	2026-11-08 13:02:28 +01:00
dillard	345b1d545e	Keep the list of backups within the page: long text wraps instead of scrolling	2026-11-08 12:28:23 +01:00
dillard	cf9cf50286	Replace a backup key that was never used by the key of existing backups ... A key made by mistake on a server that is being restored left no way back: key:import and the passphrase route refused because a key existed, and nothing removed it. As long as the key never protected anything (no location created or adopted with it, no location or run in the database), occ backup:key:import --replace-unused-key and occ backup:target:add --replace-unused-key replace it, after the new key was opened. A key that was used is never replaced, also after its location was removed. The refusal names the option, and all administrators are notified of a replacement.	2026-11-08 11:53:55 +01:00
dillard	953312bf44	Read files for a backup in pieces of 4 MiB instead of 8 KiB ... PHP reads a file 8 KiB at a time by default. On a disk where every request waits, such as a network or cloud volume, that made reading five times slower: on the test server 5 MiB/s instead of 27 MiB/s. Without PHP's read buffer every read of a blob is one request to the disk. The same for packs on a local location.	2026-11-07 12:44:57 +01:00
dillard	569077fa69	Restore without the recovery kit: the key from the location, with a passphrase ... On a server without a backup key, backup:target:add finds the backups at the location and takes their key from its config with one of the old server's passphrases. Backups then wait until a new recovery kit is confirmed. The deletion delay and the repository id are now stored on the location, sealed with the key, so the delay survives a restore without a kit and --repair-config can write a lost config again from the kit. The key page warns against creating a new key when restoring a server. New test: tests/integration/recovery-scenarios.sh, and a no-kit mode in full-restore-roundtrip.sh.	2026-11-07 12:22:38 +01:00
dillard	51a4a67bc4	Heavy background jobs of other apps pause while a backup runs ... Reserved in Nextcloud's job list, so no app is turned off and a job that is running goes on. At most 6 hours in a row, then they get an hour; Nextcloud ends a reservation by itself after 12 hours, should the end of a pause never come. On by default, with a setting to turn it off.	2026-11-07 01:56:44 +01:00
dillard	a8b5e85c9b	All folders get their original modification time back on a restore ... The backup records the time of the folders with something in them, packed in the meta record, so an older version still reads the snapshot. A restore through Nextcloud leaves a folder that was already there alone. The round trip checks what Nextcloud shows, not only the disk.	2026-11-07 01:07:09 +01:00
dillard	36f2427e9a	Tell administrators about a location without a schedule ... A notification when a schedule is turned off, then a reminder: once a week while another location is backed up, every day when none is. The round trip now also checks the text of these notifications and of the one about names, and that one location never gets two runs.	2026-11-07 00:23:28 +01:00
dillard	e58b86fc48	A schedule per location, and locations backed up one after the other ... Off, once a day or every N hours from a time, each in its own time zone. Existing locations keep the time that held for all of them. A backup that has to wait shows as queued, and its restore point has the time it really began.	2026-11-07 00:04:00 +01:00
dillard	193f65940b	Pin a restore point and keep a note on it ... Both live in the catalog on the location, so a new server sees them; the database holds a local copy for the lists. The retention policy leaves a pinned restore point alone and does not count it. Available on the restore page and as occ backup:pin and backup:note.	2026-11-06 23:49:50 +01:00
dillard	6540a9314a	A name a snapshot cannot hold gets a notification of its own ... Reported apart from unreadable files, with example paths and the advice to rename them, instead of advice about permissions. Start of the 1.1.0 plan in PLAN.md.	2026-11-06 23:38:40 +01:00
dillard	1736005648	Review of 1.0.3: names a snapshot cannot hold, restore-directory errors under salvage, browse speed ... - Leave out and report a file or folder whose name a snapshot cannot hold - A staging write failure stops a full restore under --salvage - Browse reuses its repository; empty folders read along with the entries - Keep leases alive while empty folders are created; exact-prefix empty folder is the target - Clean up tables that were partly created or before the transaction started - Bin: no empty message after a read error; longer pages	2026-11-06 19:44:52 +01:00
dillard	c7a651f269	Version 1.0.3: changelog, README status and roadmap	2026-11-06 19:05:54 +01:00
dillard	d96229f370	Release the locks of a killed restore when it runs again; legacy test without empty folders ... A killed restore left its leases for up to two hours, so the first backup of the recovered server was refused. A backup from before 1.0.3 records no empty folders: the test now expects that.	2026-11-06 17:34:33 +01:00
dillard	b14b16c66c	Empty folders in backup and restore, a full disk stops a restore, progress in the Bin ... - Record folders without files in the meta record of a snapshot and restore them (#27) - Errors writing to the restore directory stop the restore, also with --salvage - Resume: check the folder before skipping, clean temporaries in folders that are complete - Clean only read-ahead folders of our own; refresh the lease on skipped files - Drop tables a failed database restore created; keep --salvage from calling a restored database fresh - Retry a pack that fails to open on the storage (SMB) - Without cron, running backups take turns from the open page - Bin: read in parts with a counter and progress bar, show read errors, refresh when a run ends	2026-11-06 15:50:02 +01:00
dillard	4c973d5cd8	Docs: a full disk during a restore looks like a damaged backup, to be fixed in 1.0.3	2026-11-06 12:00:52 +01:00
dillard	50c2636926	Version 1.0.2: changelog, README status and roadmap	2026-11-06 11:03:14 +01:00
dillard	b625fe7666	A restore that stops at a file gone from the location points at --salvage; test a full restore with a damaged and a missing pack ... The DR test of 1.0.2 over SMB is done: result in PLAN, empty folders as a known issue (#27).	2026-11-06 10:27:41 +01:00
dillard	bf48d339e4	Remove the read-ahead folder of a killed restore with what it kept; changelog and DR guide: a stopped full restore goes on where it was	2026-11-05 08:35:28 +01:00
dillard	dce93aa75e	Over SMB, read index files in fewer round trips ... files_external's fopen() first stats the file and icewind's stream reads 1 MiB at a time. Open, read and close straight through the native extension's state instead: from Canada to a Hetzner Storage Box (130 ms) 0.66 instead of 1.05 s per index file, about 5 instead of 8 hours for the 27,000 index files of a 1 TB repository in backup:target:add. Anything unexpected falls back to the usual way.	2026-11-04 20:18:46 +01:00
dillard	36a30732ad	Without system cron: warning and a backup that moves on while the page is open (#13); progress of the database phase; Bin tab ... - The admin page and backup:status warn when background jobs do not run on a system cron, or the cron stopped, with a link to how to set one up. - Without a working system cron, the open admin page moves a running backup forward through /api/tick, a short step per poll. - The database phase shows the tables dumped ("db: 47/183 tables"); a backup that has not moved for 15 minutes says it is waiting for background jobs. - The trash of restore points is on a tab of its own, Bin. - New screenshots; changelog and plan for 1.0.2.	2026-11-04 04:08:20 +01:00
dillard	3694184674	Version 1.0.1: changelog, README status and roadmap	2026-11-01 12:03:19 +01:00
dillard	a11e6c7254	1.0.1: label for "Back up now", retention explained in the trash, occ times in the schedule's zone, single-file restore to a directory, leftovers of a stopped restore removed ... - Admin page: an optional label (at most 100 characters) for a backup started with "Back up now"; an (i) by "removed by retention policy" in the trash that explains what it means and until when the restore point can be brought back. backup:trash says the same below its list. - backup:status, backup:list, backup:trash and backup:browse show times in the zone of the daily schedule and name it, instead of the server's UTC. - backup:restore --to-directory of a file restored nothing: the path got a "/" appended. - A restore removes "<name>.ngb-restore-<hex>" temporaries that a stopped restore left in the folders it writes to. - Roadmap: the cron warning (#13), reading ahead from S3/SMB and --salvage move to 1.0.2.	2026-10-30 19:32:53 +01:00
dillard	6f1a37f4f4	Changelog: release candidate headings carry their app version, so the app store no longer shows all of them under 1.0.0	2026-10-29 13:07:25 +01:00
dillard	5cde57bc1b	Changelog: 1.0.0 says what the app is instead of release bookkeeping; rc.6 drops its outdated outlook	2026-10-29 12:42:44 +01:00
dillard	3eec2e9554	Full restore on SQLite: take the write lock first, so another writer is waited for instead of "database is locked" ... SQLite in WAL mode starts a transaction as a reader; a write from another process between our first read and our first write makes our first write fail at once, whatever the busy timeout. The SQLite full-restore test now runs a second writer alongside the restore.	2026-10-29 03:06:05 +01:00
dillard	cdf0b70e25	Changelog: the admin page's single-line key field as the cause of #24; PLAN 1.0.1: #24, database locked at the start of a full restore on SQLite	2026-10-29 02:40:03 +01:00
dillard	66615c2a88	Merge branch 'main' into polish ... # Conflicts: # CHANGELOG.md	2026-10-29 02:27:01 +01:00
dillard	a0c4abb60a	Version 1.0.0: same code as 1.0.0-rc.6; changelog, README status	2026-10-29 01:32:12 +01:00
dillard	4847ce293d	SFTP: restore the line breaks of an OpenSSH private key before use (#24) ... Nextcloud 35 reads keys with phpseclib 3, which refuses an OpenSSH-format key whose line breaks were lost ("Unable to read key"); phpseclib 2 on Nextcloud 34 read it. The key is fixed when used, so stored locations work again without re-entering it.	2026-10-28 01:41:58 +01:00
dillard	95e3dfcf6d	User restore by user id, backup:user:list (#22) ... backup:user:restore <location> <uid> only said "is not a recorded user export": the argument is the manifest path, which only backup:user:backup printed once. backup:user:list shows the exports again; a bare user id works when that user has exactly one export, otherwise the error lists them. The export is resolved before the replace confirmation. Fixes #22	2026-10-27 00:10:59 +01:00
dillard	3a0f882a38	1.0.0-rc.6: changelog, SMB disaster recovery result in the README, 1.0.1 items (salvage mode, leftover restore files, single-file restore)	2026-10-24 00:40:51 +02:00
dillard	343389b98b	Changelog: the second read covers the database phase too	2026-10-22 19:48:22 +02:00
dillard	67cc350b8c	Daily backup time in the administrator's time zone (#19); a time saved before is converted once so it shows as it ran	2026-10-22 16:38:54 +02:00
dillard	fd12c586b6	Roadmap: restore mode for hosted Nextcloud, read-ahead for S3 and SMB; changelog for rc6	2026-10-22 13:07:09 +02:00
dillard	2eabdf44d5	README and store description: background jobs must run on system cron, with how to set it up; rc5 date	2026-10-22 01:03:52 +02:00
dillard	7ed53ad0eb	Full restore: after an error maintenance mode stays on, with the one line to switch it off and run again; maintenance that was on before stays on	2026-10-22 00:36:58 +02:00
dillard	bdcb4f0cae	Full restore runs in maintenance mode, switched off again at the end (also after an error)	2026-10-22 00:31:34 +02:00
dillard	9bc4e4a4ab	Never create a repository where backup data lies but no config could be read	2026-10-21 22:25:48 +02:00
dillard	9b6bd7d2ab	Release 1.0.0-rc.5 (app version 0.9.11)	2026-10-21 13:10:03 +02:00
dillard	ac57e31c93	Full restore onto PostgreSQL: counters of restored tables go after their data when the backup records none (MySQL, SQLite); test MariaDB onto PostgreSQL	2026-10-20 23:04:53 +02:00
dillard	c37b26ea38	Full restore: an empty listing never empties the index; read a failed pack once more; recognise and replace SFTP connections a Storage Box dropped quietly; version 0.9.11	2026-10-19 21:53:05 +02:00
dillard	583592f69b	Release 1.0.0-rc.4 (app version 0.9.10)	2026-10-19 10:34:01 +02:00
dillard	c95f552cc6	Read ahead over SFTP: one connection with 32 requests in flight by default, more with restore_sftp_connections; a Storage Box gets slower with parallel readers	2026-10-19 07:46:12 +02:00
dillard	6121f684e9	Full restore: say to run occ upgrade before rerunning a restore that stopped after the database; remove empty spool folders of a stopped restore	2026-10-19 05:34:54 +02:00
dillard	88b719879d	Release candidate 4 (app version 0.9.10): full restore over SFTP reads ahead; SFTP leg in the full-restore test	2026-10-19 03:51:21 +02:00
dillard	b789d17636	Screenshot URLs per release tag, so the app store fetches new images	2026-10-18 23:47:32 +02:00