bard-backup 0.13.0 → 0.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 51001d22a2e69c99f9bb208bca62d65796d6380836e4591046d202a435352760
-  data.tar.gz: b7d759d4be19c813749b8861b974a56acbf986dcc0fcf1542e29bd6bf3816527
+  metadata.gz: d27a5d0b3ccda89bf0b15345414f6143ba1ef13e2b388545f32bbe980f36eb2f
+  data.tar.gz: 7ac24670444a407c21b9ce062feed27580da64d6f62f02326db65882a14d86b4
 SHA512:
-  metadata.gz: e04e6a895738ea48bb2d60dbbd357d33ff5941c9ad0039b30726168c35aa5f4662522cd295965cd63c6d45cbfc4251766128ce548daf8d60d37dd02f05a5db37
-  data.tar.gz: 34f4cb5549b78961a9dc29f11818b98f5f45f2f6ec0d80aa9c17ca80a4ab9a88bd98fb96889122096fdd0c9f347d0b4a900d075448ded24384555fea50f7a550
+  metadata.gz: 1adf405bb06825fe7fd2e176dc1bd4565a2200977a5dead6e2d3c92bb7415b7144a9c2f08bd6995e60afa6b0069c77428bd6e509ddbca1a470b04cfd2708f0de
+  data.tar.gz: f5870aa10fcb9df65c920c8b7516ab9f82577ad263cd5578002cec49d19c2ae223837441f1b3ec7cd71ab1df85cea5cf7fd5f46f87be62b57d41fd58edbbbee5

data/CLAUDE.md

@@ -45,19 +45,20 @@ Tests require AWS credentials at `spec/support/credentials.json`. In CI, this is
 **Entry points**:
 - `Bard::Backup.create!` accepts destination configs (or reads from `Bard::Config`) and delegates to destination strategies. Returns a `Bard::Backup` instance with timestamp/size/destinations.
 - `Bard::Backup::FileTree.create!` syncs configured data directories to S3.
-- `Bard::Backup.restore!(at:)` downloads the backup nearest `at` (or the latest when omitted), decrypts it if necessary, and loads it into the local database via `backhoe` (drop-and-create). `Bard::Backup.available` lists the available backup timestamps.
+- `Bard::Backup.restore!(at:)` downloads the backup nearest `at` (or the latest when omitted), decrypts it if necessary, and loads it into the local database via `backhoe` (drop-and-create). `Bard::Backup.available` lists the available backups (as `Bard::Backup` objects carrying timestamp and size).
 
-**Destination strategy pattern**: `Destination.build(config)` is a factory that picks the right class based on `:type`. `Destination.resolve(hashes)` is the single entry point both `Database.create!` and `Finder` use — it falls back to the configured destinations, normalizes a lone Hash/Array, and builds them. Each destination resolves its own `encryption_key` (explicit config, falling back to `Bard::Config.current.backup.encryption_key`), so callers never inject it.
+**Destination strategy pattern**: `Destination.build(config)` is a factory that picks the right class based on `:type`. `Destination.resolve(hashes)` is the single entry point both `Database.create!` and `Finder` use — it falls back to the configured destinations, normalizes a lone Hash/Array, and builds them. A destination's `encryption_key` comes from its config, which `tasks.rake` merges from the `bard_backup` Rails credentials entry; there is no other source.
 - `S3Destination` — dumps DB locally via backhoe, uploads to S3, runs `Deleter` for retention, verifies previous hour's backup
 - `UploadDestination` — dumps DB and uploads to presigned URLs (multi-threaded)
 
-**Config DSL** (loaded via `bard/plugins/backup` and `bard/plugins/encrypt`; `backup` extends `Bard::Config`, `encrypt` extends `Bard::BackupConfig`):
+**Config DSL** (loaded via `bard/plugins/backup`; `backup` extends `Bard::Config`):
 ```ruby
 backup do
   s3 "primary", path: "bucket/subfolder", region: "us-west-2"
-  encrypt true  # reads key from config/master.key
 end
 ```
+Encryption at rest is opt-in per destination via an `encryption_key` in the `bard_backup`
+credentials entry — there is no DSL toggle.
 
 **Key classes**:
 - `S3Tree` — `Data.define`-based S3 wrapper used by both `S3Destination` and `FileTree`. Methods: `list_objects`, `put_file`, `put_body`, `get`, `delete_keys`, `mv`, `empty!`. Supports encryption via `Encryptor` and STS `session_token`.
@@ -65,7 +66,7 @@ end
 - `Encryptor` — AES-256-GCM with HKDF-derived keys and a deterministic IV (HMAC of plaintext), enabling content-addressable encryption
 - `Deleter` — implements the retention policy via `Filter` structs that check time-based granularities
 - `LocalBackhoe` / `CachedLocalBackhoe` — database dump strategies (cached variant avoids conflicts when running parallel destinations)
-- `Finder` — lists backups across destinations and selects one: by timestamp (nearest match), the latest, or the most-recent as a `Bard::Backup` (with size + destination info). Backs `Bard::Backup.available`/`.latest` and `Restore`
+- `Finder` — lists backups across destinations and selects one: by timestamp (nearest match), the latest, or the most-recent as a `Bard::Backup` (with size + destination info). `#available` returns one `Bard::Backup` per timestamp (with size) for listing. Backs `Bard::Backup.available`/`.latest` and `Restore`
 - `Restore` — downloads the backup selected by `Finder`, decrypts it via `S3Tree#get`, and loads it into the local database via backhoe (drop-and-create). Backs `Bard::Backup.restore!`
 - `BackupConfig` — the `backup do ... end` DSL surface (`bard`, `disabled`, `s3 name, **kwargs`); `create!` reads `bard_config.backup.destinations` from it
 - `Railtie` — loads `tasks.rake` which provides `bard:backup` (DB + data), `bard:backup:data` (data only), and `bard:backup:restore[at]` (restore/list) rake tasks in Rails apps

data/README.md

@@ -22,7 +22,6 @@ In a Rails app, configure destinations in `config/bard.rb` using the `Bard::Conf
 ```ruby
 backup do
   s3 "primary", path: "my-bucket/my-project", region: "us-west-2"
-  encrypt true  # optional: encrypt payloads at rest. Reads key from config/master.key.
 end
 ```
 
@@ -33,8 +32,13 @@ bard_backup:
   - name: primary
     access_key_id: ...
     secret_access_key: ...
+    encryption_key: ...  # optional: encrypts payloads at rest with AES-256-GCM
 ```
 
+Adding `encryption_key` is what turns on encryption at rest; omit it and payloads are stored
+in the clear. Changing its value makes existing backups undecryptable, so treat it as
+permanent unless you re-key deliberately.
+
 Then run via the rake tasks provided by the bundled Railtie:
 
 ```bash

data/lib/bard/backup/destination/s3_destination.rb

@@ -21,16 +21,20 @@ module Bard
         resolved_config.slice(:name, :type, :path, :region)
       end
 
+      # Credentials can supply the key, so resolve rather than reading raw config.
+      def encryption_key
+        resolved_config[:encryption_key]
+      end
+
       private
 
-      # The raw config enriched with Rails credentials (by name), defaults, the
-      # computed endpoint, and the resolved encryption key.
+      # The raw config enriched with Rails credentials (by name), defaults, and
+      # the computed endpoint.
       def resolved_config
         @resolved_config ||= begin
           credentials = RailsCredentials.find(name: config[:name])
           resolved = { type: :s3, region: "us-west-2" }.merge(credentials).merge(config)
           resolved[:endpoint] ||= "https://s3.#{resolved[:region]}.amazonaws.com"
-          resolved[:encryption_key] ||= Bard::Config.current.backup.encryption_key
           resolved
         end
       end

data/lib/bard/backup/destination.rb

@@ -11,8 +11,7 @@ module Bard
       # Normalizes destination config into built destinations: falls back to the
       # configured destinations when none are given, and accepts a lone Hash or
       # an Array. A +now+ stamps every destination with one run timestamp (an
-      # explicit per-destination +now+ still wins). Each destination resolves its
-      # own encryption key (see #encryption_key), so callers don't have to inject it.
+      # explicit per-destination +now+ still wins).
       def self.resolve(destination_hashes = nil, now: nil)
         hashes = destination_hashes || Bard::Config.current.backup.destinations
         hashes = hashes.is_a?(Hash) ? [hashes] : Array(hashes)
@@ -24,12 +23,12 @@ module Bard
         raise NotImplementedError
       end
 
-      private
-
       def encryption_key
-        config[:encryption_key] || Bard::Config.current.backup.encryption_key
+        config[:encryption_key]
       end
 
+      private
+
       def now
         @now ||= config.fetch(:now, Time.now.utc)
       end

data/lib/bard/backup/file_tree.rb

@@ -15,7 +15,6 @@ module Bard
         return if data_paths.empty?
 
         encryption_key = s3_config.delete(:encryption_key)
-        encryption_key ||= bard_config&.backup&.encryption_key
 
         s3_tree = S3Tree.new(path: "#{bucket}/#{project_name}", encryption_key: encryption_key, **s3_config)
         new(s3_tree, data_paths).call

data/lib/bard/backup/finder.rb

@@ -26,6 +26,19 @@ module Bard
         all.map { |backup| backup[:timestamp] }.uniq.sort
       end
 
+      def available
+        all
+          .group_by { |backup| backup[:timestamp] }
+          .sort_by { |timestamp, _| timestamp }
+          .map do |timestamp, backups|
+            Bard::Backup.new(
+              timestamp:,
+              size: file_size(backups.first[:destination].s3_tree, backups.first[:filename]),
+              destinations: backups.map { |backup| backup[:destination].info },
+            )
+          end
+      end
+
       def find(at: nil)
         backups = all
         raise NotFound, "No backups found" if backups.empty?

data/lib/bard/backup/tasks.rake

@@ -26,9 +26,11 @@ namespace :bard do
 
       destinations = Bard::Config.current.backup.destinations
       if args[:at].to_s.strip.empty?
-        timestamps = Bard::Backup.available(destinations: destinations)
+        backups = Bard::Backup.available(destinations: destinations)
         puts "Available backups:"
-        timestamps.each { |timestamp| puts "  #{timestamp.iso8601}" }
+        backups.each do |backup|
+          puts "  #{backup.timestamp.iso8601}  #{backup.human_size}"
+        end
       else
         backup = Bard::Backup.restore!(at: args[:at], destinations: destinations)
         puts "Restored database from backup #{backup.timestamp.iso8601}."

data/lib/bard/backup/version.rb

@@ -1,6 +1,6 @@
 module Bard
   class Backup
-    VERSION = "0.13.0"
+    VERSION = "0.15.0"
   end
 end
 

data/lib/bard/backup.rb

@@ -1,6 +1,5 @@
 require "bard"
 require "bard/plugins/backup"
-require "bard/plugins/encrypt"
 require "bard/backup/database"
 require "bard/backup/file_tree"
 require "bard/backup/finder"
@@ -22,7 +21,7 @@ module Bard
     end
 
     def self.available(destinations: nil)
-      Finder.new(destinations).timestamps
+      Finder.new(destinations).available
     end
 
     def self.restore!(at:, drop_and_create: true, destinations: nil)
@@ -44,5 +43,15 @@ module Bard
         destinations: destinations
       }.compact
     end
+
+    def human_size
+      units = %w[Bytes KB MB GB TB PB EB]
+      value, unit = size.to_f, 0
+      while value >= 1024 && unit < units.size - 1
+        value /= 1024
+        unit += 1
+      end
+      format("%5.2f %s", value, units[unit])
+    end
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bard-backup
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.15.0
 platform: ruby
 authors:
 - Micah Geisel
 bindir: exe
 cert_chain: []
-date: 2026-07-09 00:00:00.000000000 Z
+date: 2026-08-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: backhoe
@@ -113,7 +113,6 @@ files:
 - lib/bard/backup/version.rb
 - lib/bard/plugins/backup.rb
 - lib/bard/plugins/backup_restore.rb
-- lib/bard/plugins/encrypt.rb
 - sig/bard/backup.rbs
 homepage: https://github.com/botandrose/bard-backup
 licenses:

data/lib/bard/plugins/encrypt.rb

@@ -1,18 +0,0 @@
-require "bard/plugins/backup"
-
-module Bard
-  class BackupConfig
-    def encrypt(value = nil)
-      if value.nil?
-        @encrypt
-      else
-        @encrypt = value
-      end
-    end
-
-    def encryption_key
-      return nil unless encrypt
-      File.read("config/master.key").strip
-    end
-  end
-end