jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix(manage): backup restore fails fast on a missing or wrong snapshot #226

Merged
jfraeys merged 2 commits from jfraeys/fix/restore-validate-snapshot-first into main 2026-10-16 15:06:33 -04:00
Conversation 0 Commits 2 Files changed 3 +109
jfraeys commented 2026-10-16 14:06:07 -04:00
Owner
Copy link

A restore without --snapshot used 'latest', which is often the Vaultwarden-only snapshot; the remote host only discovered it restored nothing after loading the repository (over a minute). restore_pick_snapshot checks locally, before any remote step: the snapshot exists, covers the service paths (all three for --service all), and prints the pinned id; otherwise it fails at once and names the newest snapshot that covers them. Dry runs use it too. No local restic: 'latest' is refused.

Checked: test-restore-snapshot.sh (10 cases, in lint.yml); dry runs against the real repository: an unknown id fails immediately naming f3e5d939; without --snapshot it currently resolves to f3e5d939 because that is the newest snapshot; the failing 'latest' path is covered by the unit tests only, since 'latest' cannot be made a vaultwarden snapshot on demand.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

A restore without --snapshot used 'latest', which is often the Vaultwarden-only snapshot; the remote host only discovered it restored nothing after loading the repository (over a minute). restore_pick_snapshot checks locally, before any remote step: the snapshot exists, covers the service paths (all three for --service all), and prints the pinned id; otherwise it fails at once and names the newest snapshot that covers them. Dry runs use it too. No local restic: 'latest' is refused. Checked: test-restore-snapshot.sh (10 cases, in lint.yml); dry runs against the real repository: an unknown id fails immediately naming f3e5d939; without --snapshot it currently resolves to f3e5d939 because that is the newest snapshot; the failing 'latest' path is covered by the unit tests only, since 'latest' cannot be made a vaultwarden snapshot on demand. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
fix(manage): backup restore validates the snapshot before any remote work
All checks were successful
Lint / lint (pull_request) Successful in 2m37s
Details
Secret scan / scan (pull_request) Successful in 13s
Details
3588e792d1
 
Without --snapshot, 'latest' is often the 6-hourly Vaultwarden-only snapshot (paths under /tmp). The remote host loaded
the repository and only then restored nothing, a minute or more into the run. restore_pick_snapshot now resolves and
checks the snapshot locally first (exists; covers the service paths, all three for --service all), pins 'latest' to its
id, and on failure names the newest snapshot that does cover them. Dry run takes the same path. Without a local restic,
'latest' is refused. Tests: test-restore-snapshot.sh (in lint.yml).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
Merge main into jfraeys/fix/restore-validate-snapshot-first (lint.yml: keep both new test steps)
All checks were successful
Lint / lint (pull_request) Successful in 1m54s
Details
Secret scan / scan (pull_request) Successful in 14s
Details
8288018c81
 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!226
No description provided.