kamal-backup 0.5.0 → 0.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aa8276219db8c5d8aa820e85e0f289f87715889cb5ea18ae2c99e3e12bbfe6b9
-  data.tar.gz: 626824ed56029bf3b713676d3376ab38d571942ee3809e7cf18abbfde9c24a45
+  metadata.gz: 341913561478a45fc1dd88b376daae6977a180eba43739963c6e9055d5c064ab
+  data.tar.gz: 69a572c55cc9b33fcd0ab0a3918111cf7c3e26f3519d01de855c2fa73de08b2d
 SHA512:
-  metadata.gz: 75d362d35409c0447c29994a7bf4d23ac47d287fc88621eb46f32a56296537217cee76a28799983f45154361ecd61e4f553b609144969bed2b10016bf0ecc09c
-  data.tar.gz: e5f664a15123066441b940d945caed2335d8b50356acaa64d9ae6f49d87a7705894234e55db42ec6508aa188f727b01d4e4d4c71688ecd93b4dbf4c12d53ef5d
+  metadata.gz: af86080b3f6524990cd0df83bed996370e4cff186aaea4338e8ab9e9ddfb595313d58b96dd4f9fc0a17b758ff8869a7fd836840370bfe76b94dcad5d195b7455
+  data.tar.gz: 257939e10db7512ea4f12d0bd23d8ba472a41c6987ef974cc69c978653491b0e4b107a7e312fb34431745a5b855dae6919a58e8cdd626e8277c9276030a5a6d6

data/README.md

@@ -125,7 +125,7 @@ bundle exec kamal-backup evidence
 
 - **Scheduled backups:** the accessory runs continuously and backs up on `backup.schedule`.
 - **Database and Active Storage coverage:** database dumps plus file-backed Active Storage files from mounted volumes.
-- **Restic underneath:** encrypted, deduplicated snapshots in S3-compatible storage, a restic REST server, or a filesystem repository.
+- **Restic underneath:** encrypted, deduplicated snapshots in S3-compatible storage, over SFTP, in a restic REST server, or in a filesystem repository.
 - **Local restores:** inspect production data safely in your local Rails app.
 - **Restore drills:** restore into scratch production-side targets, run verification commands, and record the result.
 - **Security review evidence:** `kamal-backup evidence` prints redacted JSON with latest snapshots, `kamal-backup check` results, drills, retention, and tool versions.

data/lib/kamal_backup/app.rb

@@ -480,6 +480,10 @@ module KamalBackup
       config.validate_restic
       config.validate_database_backup
       config.validate_backup_paths
+      # Check writability up front. This used to be discovered only after
+      # restic had pulled the entire file snapshot, so a read-only mount cost a
+      # full download before failing — the wrong moment to learn about it.
+      config.backup_paths.each { |path| ensure_writable_restore_target(path) }
     end
 
     def validate_production_drill(file_target, database_name, sqlite_path)

data/lib/kamal_backup/databases/postgres.rb

@@ -34,6 +34,28 @@ module KamalBackup
         CommandSpec.new(argv: argv, env: current_connection)
       end
 
+      # Replace the target schema before restoring.
+      #
+      # pg_restore --clean emits DROP TABLE for each object in the dump, but
+      # PostgreSQL refuses to drop a table another table still references, and
+      # the dump's ordering cannot account for constraints that only exist in
+      # the target. Restoring over a schema Rails already created — which is
+      # every restore onto a freshly deployed host, since Kamal runs db:prepare
+      # on boot — leaves the drops failing, the CREATEs failing as "already
+      # exists", the COPYs never running, and the foreign keys rejected because
+      # the tables they point at are still empty.
+      #
+      # Dropping the schema first sidesteps the ordering problem entirely. This
+      # only runs for restore-to-current, which already means "replace this
+      # database"; scratch restores target a separate database and are
+      # untouched.
+      def restore_to_current(restic, snapshot, filename)
+        reset_current_schema
+        result = super
+        ensure_restore_reported_no_errors(result)
+        result
+      end
+
       def current_restore_command
         connection = current_connection
         database = connection.fetch('PGDATABASE')
@@ -61,6 +83,38 @@ module KamalBackup
 
       private
 
+      # pg_restore exits 0 even when individual objects fail, reporting only
+      # "errors ignored on restore: N" on stderr. A restore that half-applied
+      # and claimed success is worse than one that failed, because the damage
+      # is only discovered later, from the data.
+      def ensure_restore_reported_no_errors(result)
+        stderr = result.respond_to?(:stderr) ? result.stderr.to_s : ''
+        match = stderr.match(/errors ignored on restore:\s*(\d+)/i)
+        return if match.nil? || match[1].to_i.zero?
+
+        raise CommandError.new(
+          "pg_restore reported #{match[1]} ignored error(s); the database is only partially restored. " \
+          'Inspect the output above, resolve the cause, and restore again.',
+          command: current_restore_command,
+          stderr: stderr
+        )
+      end
+
+      def reset_current_schema
+        connection = current_connection
+        argv = ['psql', '--quiet', '--no-psqlrc', '--set', 'ON_ERROR_STOP=1', '--command', RESET_SCHEMA_SQL]
+        Command.capture(CommandSpec.new(argv: argv, env: connection), redactor: redactor)
+      rescue CommandError => e
+        raise CommandError.new(
+          "failed to reset the public schema before restoring: #{e.message}",
+          command: e.command,
+          stderr: e.stderr
+        )
+      end
+
+      RESET_SCHEMA_SQL = 'DROP SCHEMA IF EXISTS public CASCADE; CREATE SCHEMA public;'
+      private_constant :RESET_SCHEMA_SQL
+
       def validate_scratch_restore_target(target)
         raise ConfigurationError, 'scratch database must differ from the current PostgreSQL database' if current_connection.fetch('PGDATABASE') == target
 

data/lib/kamal_backup/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module KamalBackup
-  VERSION = '0.5.0'
+  VERSION = '0.5.2'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kamal-backup
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.2
 platform: ruby
 authors:
 - crmne
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-10 00:00:00.000000000 Z
+date: 2026-08-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor