close1 0.7.1__tar.gz

close1-0.7.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Yaroslav Polyakov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

close1-0.7.1/PKG-INFO

@@ -0,0 +1,118 @@
+Metadata-Version: 2.4
+Name: close1
+Version: 0.7.1
+Summary: Simple backups from servers over SSH
+Author: Yaroslav Polyakov
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/yaroslaff/close1
+Project-URL: Repository, https://github.com/yaroslaff/close1
+Project-URL: Issues, https://github.com/yaroslaff/close1/issues
+Keywords: backup,ssh,cron,pull,sqlite,mysql
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: System :: Archiving :: Backup
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: PyYAML>=5.4
+Provides-Extra: dev
+Requires-Dist: pytest; extra == "dev"
+Dynamic: license-file
+
+# close1
+
+A simple tool for daily backups of files and databases over SSH.
+
+## Features
+- Pulls files and directories (.tar.gz/.zip) from the servers to your machine; nothing is installed on the servers.
+- Runs commands on the servers (for example, `mysqldump`, `.backup` in sqlite3, or stopping a web server for the duration of the backup and starting it again afterwards).
+- Good SSH integration: uses your key through the SSH agent (even if it is passphrase-protected). ControlMaster for speed and for reliability on lossy networks.
+- Tolerates missed cron runs (e.g. when the computer was off). You can run close1 from cron every hour and it still makes one backup per day.
+- Careful rotation: you set how many backups to keep (say, 7). Rotation removes the oldest ones, but it will not delete a 10-day-old backup if there were no newer ones. Even in the worst case you still have some backups.
+
+## Install
+
+```sh
+pipx install .        # or: pip install -e '.[dev]' in a venv
+```
+
+## Usage
+
+```sh
+close1 --check                 # SSH agent, keys, host reachability (copies nothing)
+close1                         # back up all hosts from the config
+close1 blog -f -v              # only blog, overwrite today's backup, verbose
+close1 log                     # show the log (-v: print its path first)
+```
+
+Config: `-c path`, otherwise the first one found of `$CLOSE1_CONFIG`, `~/.config/close1/close1.yml`, `/etc/close1.yml`
+(no merging). See `close1-example.yml` (short) and `close1-full-example.yml` (every option explained).
+Log: `~/.local/state/close1/close1.log` (root: `/var/log/close1.log`).
+
+## Config
+
+```yaml
+_default:
+  dest: ~/backups          # -> ~/backups/<host>/<YYYY-MM-DD>/
+  keep: 7
+
+blog:
+  pre:
+    - mysqldump blog | gzip > /tmp/blog-${DATE}.sql.gz
+  files:
+    - blog.sql.gz: /tmp/blog-${DATE}.sql.gz
+    - /var/www/blog/uploads
+    - /etc/nginx/sites-enabled
+  post:
+    - rm /tmp/blog-${DATE}.sql.gz
+
+"backup@bot:2222":
+  files:
+    - /opt/bot/config.yml
+  stdout:
+    packages.txt: dpkg -l
+```
+
+All options with explanations: [close1-full-example.yml](close1-full-example.yml).
+
+### SQLite
+
+Do not copy a live SQLite file (in WAL mode part of the data lives in `-wal`). Take a snapshot in `pre` and fetch it:
+
+```yaml
+pre:
+  - umask 077 && sqlite3 /opt/app/app.db ".backup /tmp/app-${DATE}.db" && gzip -f /tmp/app-${DATE}.db
+files:
+  - app.db.gz: /tmp/app-${DATE}.db.gz
+post:
+  - rm -f /tmp/app-${DATE}.db.gz
+```
+
+## Unreliable connections
+
+All commands to a host go through one SSH connection (ControlMaster), so a backup needs a single handshake.
+After a connection error (ssh exit code 255) close1 retries the connection check, file checks and downloads
+(`retries` times, `retry_delay` seconds apart). `pre`, `post` and `stdout` commands are not retried: after a dropped
+connection it is unknown whether they ran. If they fail, the backup fails and the next cron run starts it again.
+
+## cron and ssh-agent
+
+close1 authenticates through ssh-agent. If `SSH_AUTH_SOCK` is not set (as under cron), it looks for the socket in
+`/run/user/$UID/` (`openssh_agent`, `ssh-agent.socket`, `gcr/ssh`, `keyring/ssh`, `gnupg/S.gpg-agent.ssh`). ssh is always
+called with `BatchMode=yes` and `ForwardAgent=no`. While you are not logged in or the key is not loaded into the agent,
+the backup is skipped and retried on the next run.
+
+By default the first agent that holds any key is used. If you have several agents (e.g. ssh-agent and gnome-keyring)
+with different keys, set `ssh_key: SHA256:...` (globally or per host): close1 then uses the agent that holds this key
+and passes it to ssh as `IdentityAgent`. If the key is in no agent, the host is skipped. `close1 --check` lists all
+agents with their key fingerprints. The key comment (`user@host`) is not used for matching: it is arbitrary text.
+
+```cron
+17 * * * * $HOME/.local/bin/close1
+```
+
+Only errors go to stderr (and so to cron mail); everything else goes to the log.

close1-0.7.1/README.md

@@ -0,0 +1,93 @@
+# close1
+
+A simple tool for daily backups of files and databases over SSH.
+
+## Features
+- Pulls files and directories (.tar.gz/.zip) from the servers to your machine; nothing is installed on the servers.
+- Runs commands on the servers (for example, `mysqldump`, `.backup` in sqlite3, or stopping a web server for the duration of the backup and starting it again afterwards).
+- Good SSH integration: uses your key through the SSH agent (even if it is passphrase-protected). ControlMaster for speed and for reliability on lossy networks.
+- Tolerates missed cron runs (e.g. when the computer was off). You can run close1 from cron every hour and it still makes one backup per day.
+- Careful rotation: you set how many backups to keep (say, 7). Rotation removes the oldest ones, but it will not delete a 10-day-old backup if there were no newer ones. Even in the worst case you still have some backups.
+
+## Install
+
+```sh
+pipx install .        # or: pip install -e '.[dev]' in a venv
+```
+
+## Usage
+
+```sh
+close1 --check                 # SSH agent, keys, host reachability (copies nothing)
+close1                         # back up all hosts from the config
+close1 blog -f -v              # only blog, overwrite today's backup, verbose
+close1 log                     # show the log (-v: print its path first)
+```
+
+Config: `-c path`, otherwise the first one found of `$CLOSE1_CONFIG`, `~/.config/close1/close1.yml`, `/etc/close1.yml`
+(no merging). See `close1-example.yml` (short) and `close1-full-example.yml` (every option explained).
+Log: `~/.local/state/close1/close1.log` (root: `/var/log/close1.log`).
+
+## Config
+
+```yaml
+_default:
+  dest: ~/backups          # -> ~/backups/<host>/<YYYY-MM-DD>/
+  keep: 7
+
+blog:
+  pre:
+    - mysqldump blog | gzip > /tmp/blog-${DATE}.sql.gz
+  files:
+    - blog.sql.gz: /tmp/blog-${DATE}.sql.gz
+    - /var/www/blog/uploads
+    - /etc/nginx/sites-enabled
+  post:
+    - rm /tmp/blog-${DATE}.sql.gz
+
+"backup@bot:2222":
+  files:
+    - /opt/bot/config.yml
+  stdout:
+    packages.txt: dpkg -l
+```
+
+All options with explanations: [close1-full-example.yml](close1-full-example.yml).
+
+### SQLite
+
+Do not copy a live SQLite file (in WAL mode part of the data lives in `-wal`). Take a snapshot in `pre` and fetch it:
+
+```yaml
+pre:
+  - umask 077 && sqlite3 /opt/app/app.db ".backup /tmp/app-${DATE}.db" && gzip -f /tmp/app-${DATE}.db
+files:
+  - app.db.gz: /tmp/app-${DATE}.db.gz
+post:
+  - rm -f /tmp/app-${DATE}.db.gz
+```
+
+## Unreliable connections
+
+All commands to a host go through one SSH connection (ControlMaster), so a backup needs a single handshake.
+After a connection error (ssh exit code 255) close1 retries the connection check, file checks and downloads
+(`retries` times, `retry_delay` seconds apart). `pre`, `post` and `stdout` commands are not retried: after a dropped
+connection it is unknown whether they ran. If they fail, the backup fails and the next cron run starts it again.
+
+## cron and ssh-agent
+
+close1 authenticates through ssh-agent. If `SSH_AUTH_SOCK` is not set (as under cron), it looks for the socket in
+`/run/user/$UID/` (`openssh_agent`, `ssh-agent.socket`, `gcr/ssh`, `keyring/ssh`, `gnupg/S.gpg-agent.ssh`). ssh is always
+called with `BatchMode=yes` and `ForwardAgent=no`. While you are not logged in or the key is not loaded into the agent,
+the backup is skipped and retried on the next run.
+
+By default the first agent that holds any key is used. If you have several agents (e.g. ssh-agent and gnome-keyring)
+with different keys, set `ssh_key: SHA256:...` (globally or per host): close1 then uses the agent that holds this key
+and passes it to ssh as `IdentityAgent`. If the key is in no agent, the host is skipped. `close1 --check` lists all
+agents with their key fingerprints. The key comment (`user@host`) is not used for matching: it is arbitrary text.
+
+```cron
+17 * * * * $HOME/.local/bin/close1
+```
+
+Only errors go to stderr (and so to cron mail); everything else goes to the log.

close1-0.7.1/pyproject.toml

@@ -0,0 +1,44 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "close1"
+dynamic = ["version"]
+description = "Simple backups from servers over SSH"
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Yaroslav Polyakov" }]
+keywords = ["backup", "ssh", "cron", "pull", "sqlite", "mysql"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Intended Audience :: System Administrators",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3",
+    "Topic :: System :: Archiving :: Backup",
+]
+dependencies = ["PyYAML>=5.4"]
+
+[project.urls]
+Homepage = "https://github.com/yaroslaff/close1"
+Repository = "https://github.com/yaroslaff/close1"
+Issues = "https://github.com/yaroslaff/close1/issues"
+
+[project.optional-dependencies]
+dev = ["pytest"]
+
+[project.scripts]
+close1 = "close1.cli:main"
+
+[tool.setuptools.dynamic]
+version = { attr = "close1.__version__" }
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

close1-0.7.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

close1-0.7.1/src/close1/__init__.py

@@ -0,0 +1,3 @@
+"""close1 — simple backups from servers over SSH."""
+
+__version__ = "0.7.1"

close1-0.7.1/src/close1/__main__.py

@@ -0,0 +1,3 @@
+from close1.cli import main
+
+raise SystemExit(main())

close1-0.7.1/src/close1/backup.py

@@ -0,0 +1,214 @@
+"""Backing up a single server."""
+
+from __future__ import annotations
+
+import datetime as dt
+import logging
+import posixpath
+import re
+import shutil
+from dataclasses import dataclass
+from pathlib import Path
+
+from close1.config import FileItem, HostConfig
+from close1.messages import t
+from close1.rotate import to_delete
+from close1.ssh import Remote, RemoteError, remote_path
+
+log = logging.getLogger("close1")
+
+_DATE_RE = re.compile(r"\$\{DATE\}|\$DATE\b")
+ARCHIVE_EXT = {"tar.gz": ".tar.gz", "zip": ".zip"}
+
+
+class BackupError(Exception):
+    pass
+
+
+def substitute(text: str, date: str) -> str:
+    """$DATE and ${DATE} -> 2026-12-31."""
+    return _DATE_RE.sub(date, text)
+
+
+def archive_type(name: str | None, default: str) -> str:
+    """Archive format for a directory: from the explicit name's extension, else the compress option."""
+    if name:
+        if name.endswith(".zip"):
+            return "zip"
+        if name.endswith((".tar.gz", ".tgz")):
+            return "tar.gz"
+    return default
+
+
+@dataclass
+class Plan:
+    """What to copy and under which local name."""
+
+    remote: str
+    local: str
+    archive: str | None  # None for a regular file
+
+
+def plan_files(items: list[tuple[FileItem, bool]], compress: str, reserved: set[str]) -> list[Plan]:
+    """Choose local names. items are (item, is_dir); reserved are names taken by stdout.
+
+    Explicit names are claimed first; the rest get the basename, or the full path joined with '-' on collision.
+    """
+    used = set(reserved)
+    locals_: list[str | None] = []
+    for item, is_dir in items:
+        local = None
+        if item.name:
+            local = item.name
+            archive = archive_type(item.name, compress) if is_dir else None
+            if archive and not local.endswith((".zip", ".tar.gz", ".tgz")):
+                local += ARCHIVE_EXT[archive]
+            if local in used:
+                raise BackupError(t("name_collision", path=item.remote))
+            used.add(local)
+        locals_.append(local)
+
+    plans = []
+    for (item, is_dir), local in zip(items, locals_):
+        archive = archive_type(item.name, compress) if is_dir else None
+        if local is None:
+            ext = ARCHIVE_EXT[archive] if archive else ""
+            stripped = item.remote.strip("/")
+            base = posixpath.basename(stripped) or "root"
+            full = stripped.replace("/", "-") or "root"
+            local = next((c + ext for c in (base, full) if c + ext not in used), None)
+            if local is None:
+                raise BackupError(t("name_collision", path=item.remote))
+            used.add(local)
+        plans.append(Plan(remote=item.remote, local=local, archive=archive))
+    return plans
+
+
+def remote_kind(remote: Remote, path: str) -> str:
+    q = remote_path(path)
+    out = remote.run(f"if [ -d {q} ]; then echo dir; elif [ -e {q} ]; then echo file; else echo none; fi", retry=True)
+    return out.strip()
+
+
+def _require_tool(remote: Remote, tool: str) -> None:
+    if remote.run(f"command -v {tool} >/dev/null 2>&1 && echo yes || echo no", retry=True).strip() != "yes":
+        raise BackupError(t("tool_missing", tool=tool))
+
+
+def fetch(remote: Remote, plan: Plan, target: Path) -> None:
+    q = remote_path(plan.remote)
+    if plan.archive == "tar.gz":
+        cmd = f"tar -C {q} -czf - ."
+    elif plan.archive == "zip":
+        cmd = f"cd {q} && zip -qr - ."
+    else:
+        cmd = f"cat -- {q}"
+    with open(target, "wb") as f:
+        remote.run(cmd, stdout=f, retry=True)
+
+
+class HostBackup:
+    def __init__(self, host: HostConfig, agent_sock: str | None, force: bool = False,
+                 today: dt.date | None = None):
+        self.host = host
+        self.force = force
+        self.today = today or dt.date.today()
+        self.date = self.today.isoformat()
+        self.remote = Remote(host, agent_sock)
+        self.host_dir = host.dest / host.name
+        self.final = self.host_dir / self.date
+        self.partial = self.host_dir / f"{self.date}.partial"
+
+    def run(self) -> bool:
+        """True if the backup was made or is not needed, False on error."""
+        name = self.host.section
+        if self.final.exists() and not self.force:
+            log.info(t("already_done", name=name, date=self.date))
+            return True
+        if self.host.ssh_key and not self.remote.agent_sock:
+            log.warning(t("key_not_found", name=name, fp=self.host.ssh_key))
+            return True  # not an error: the key may be loaded later
+        with self.remote:
+            try:
+                self.remote.check()
+            except RemoteError as e:
+                log.warning(t("unreachable", name=name, error=e.stderr or e.code))
+                return True  # not an error: retry on the next run
+
+            try:
+                self._backup()
+            except (RemoteError, BackupError, OSError) as e:
+                log.error(t("failed", name=name, error=e))
+                return False
+        log.info(t("done", name=name, path=self.final))
+        self._rotate()
+        return True
+
+    def _run_stage(self, stage: str, commands: list[str]) -> None:
+        for cmd in commands:
+            cmd = substitute(cmd, self.date)
+            log.info(t("run_cmd", name=self.host.section, stage=stage, cmd=cmd))
+            out = self.remote.run(cmd)
+            if out.strip():
+                log.debug(out.rstrip())
+
+    def _backup(self) -> None:
+        h = self.host
+        if self.partial.exists():
+            shutil.rmtree(self.partial)
+        self.partial.mkdir(parents=True)
+        log.info(t("start", name=h.section, path=self.final))
+
+        try:
+            self._run_stage("pre", h.pre)
+            self._copy_files()
+            for local, cmd in h.stdout.items():
+                cmd = substitute(cmd, self.date)
+                log.info(t("run_cmd", name=h.section, stage="stdout", cmd=f"{cmd} > {local}"))
+                with open(self.partial / local, "wb") as f:
+                    self.remote.run(cmd, stdout=f)
+        except BaseException:
+            # run post even on failure, e.g. to turn maintenance mode off
+            try:
+                self._run_stage("post", h.post)
+            except RemoteError as e:
+                log.error(t("failed", name=h.section, error=e))
+            raise
+        self._run_stage("post", h.post)
+
+        if self.final.exists():
+            old = self.host_dir / f"{self.date}.old"
+            if old.exists():
+                shutil.rmtree(old)
+            self.final.rename(old)
+            self.partial.rename(self.final)
+            shutil.rmtree(old)
+        else:
+            self.partial.rename(self.final)
+
+    def _copy_files(self) -> None:
+        h = self.host
+        items = []
+        for item in h.files:
+            path = substitute(item.remote, self.date)
+            kind = remote_kind(self.remote, path)
+            if kind == "none":
+                raise BackupError(t("remote_missing", path=path))
+            items.append((FileItem(remote=path, name=item.name), kind == "dir"))
+
+        tools = {"tar" if a == "tar.gz" else "zip"
+                 for a in (archive_type(i.name, h.compress) for i, d in items if d)}
+        for tool in sorted(tools):
+            _require_tool(self.remote, tool)
+
+        for plan in plan_files(items, h.compress, set(h.stdout)):
+            log.info(t("copy", name=h.section, remote=plan.remote, local=plan.local))
+            fetch(self.remote, plan, self.partial / plan.local)
+
+    def _rotate(self) -> None:
+        for p in self.host_dir.glob("*.partial"):
+            if p.is_dir():
+                shutil.rmtree(p)
+        for p in to_delete(self.host_dir, self.host.keep):
+            log.info(t("rotate_delete", name=self.host.section, path=p))
+            shutil.rmtree(p)

close1-0.7.1/src/close1/cli.py

@@ -0,0 +1,168 @@
+"""close1 command line."""
+
+from __future__ import annotations
+
+import argparse
+import fcntl
+import logging
+import os
+import shutil
+import sys
+from pathlib import Path
+
+from close1 import __version__
+from close1.backup import HostBackup
+from close1.config import Config, ConfigError, config_search_paths, find_config, is_root, load_config
+from close1.messages import t
+from close1.ssh import Remote, RemoteError, find_agent, list_agents
+
+log = logging.getLogger("close1")
+
+
+def default_log_path() -> Path:
+    if is_root():
+        return Path("/var/log/close1.log")
+    base = os.environ.get("XDG_STATE_HOME") or "~/.local/state"
+    return Path(base).expanduser() / "close1" / "close1.log"
+
+
+def setup_logging(log_path: Path, verbose: bool) -> None:
+    log.setLevel(logging.DEBUG)
+    log_path.parent.mkdir(parents=True, exist_ok=True)
+    fh = logging.FileHandler(log_path, encoding="utf-8")
+    fh.setLevel(logging.DEBUG if verbose else logging.INFO)
+    fh.setFormatter(logging.Formatter("%(asctime)s %(levelname)s %(message)s"))
+    log.addHandler(fh)
+
+    # Under cron (no tty) only errors go to stderr, so cron mails only on real problems.
+    sh = logging.StreamHandler(sys.stderr)
+    if verbose:
+        sh.setLevel(logging.DEBUG)
+    else:
+        sh.setLevel(logging.WARNING if sys.stderr.isatty() else logging.ERROR)
+    sh.setFormatter(logging.Formatter("%(levelname)s %(message)s"))
+    log.addHandler(sh)
+
+
+def build_parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(prog="close1", description="Back up files from servers over SSH")
+    p.add_argument("hosts", nargs="*", metavar="HOST", help="config sections to back up (default: all), or 'log' to show the log")
+    p.add_argument("-c", "--config", type=Path, help="config file (default: first of $CLOSE1_CONFIG, ~/.config/close1/close1.yml, /etc/close1.yml)")
+    p.add_argument("-f", "--force", action="store_true", help="overwrite today's backup")
+    p.add_argument("-v", "--verbose", action="store_true", help="verbose output")
+    p.add_argument("--check", action="store_true", help="check the SSH agent and host reachability, copy nothing")
+    p.add_argument("--version", action="version", version=f"close1 {__version__}")
+    return p
+
+
+def select_hosts(cfg: Config, names: list[str]):
+    if not names:
+        return cfg.hosts
+    by_name = {h.section: h for h in cfg.hosts}
+    missing = [n for n in names if n not in by_name]
+    if missing:
+        raise ConfigError(t("unknown_host", name=", ".join(missing)))
+    return [by_name[n] for n in names]
+
+
+def check(cfg: Config, hosts, sock: str | None, log_path: Path) -> int:
+    print(t("check_header", version=__version__, config=cfg.path, log=log_path))
+    agents = list_agents(cfg.ssh_auth_sock)
+    for agent_sock, keys in agents:
+        print(t("agent_found", sock=agent_sock, count=len(keys)))
+        for k in keys:
+            print("  " + k)
+    if not agents:
+        print(t("agent_not_found"))
+    rc = 0
+    for h in hosts:
+        host_sock = sock
+        if h.ssh_key:
+            host_sock = find_agent(cfg.ssh_auth_sock, h.ssh_key)[0]
+            if not host_sock:
+                print(t("check_fail", name=h.section, error=t("check_key_missing", fp=h.ssh_key)))
+                rc = 1
+                continue
+            print(t("check_agent", name=h.section, sock=host_sock))
+        try:
+            with Remote(h, host_sock) as remote:
+                remote.check()
+            print(t("check_ok", name=h.section))
+        except RemoteError as e:
+            print(t("check_fail", name=h.section, error=e.stderr or e.code))
+            rc = 1
+    return rc
+
+
+def show_log(log_path: Path, verbose: bool) -> int:
+    """close1 log: print the log file (with -v, first a '# path' line)."""
+    if verbose:
+        print(f"# {log_path}", flush=True)
+    try:
+        with open(log_path, "rb") as f:
+            shutil.copyfileobj(f, sys.stdout.buffer)
+        sys.stdout.flush()
+    except FileNotFoundError:
+        print(t("log_missing", path=log_path), file=sys.stderr)
+        return 1
+    except BrokenPipeError:  # e.g. close1 log | head
+        sys.stderr.close()
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    log_cmd = args.hosts == ["log"]
+    if log_cmd:
+        args.hosts = []
+
+    if args.config:
+        cfg_path = args.config
+        if not cfg_path.is_file():
+            print(t("config_not_found", path=cfg_path), file=sys.stderr)
+            return 2
+    else:
+        cfg_path = find_config()
+        if cfg_path is None:
+            paths = "\n".join(f"  {p}" for p in config_search_paths())
+            print(t("config_not_found_search", paths=paths), file=sys.stderr)
+            return 2
+    try:
+        cfg = load_config(cfg_path)
+        hosts = select_hosts(cfg, args.hosts)
+    except ConfigError as e:
+        print(t("config_error", path=cfg_path, error=e), file=sys.stderr)
+        return 2
+
+    log_path = Path(cfg.log).expanduser() if cfg.log else default_log_path()
+    if log_cmd:
+        return show_log(log_path, args.verbose)
+    setup_logging(log_path, args.verbose)
+    log.debug(t("log_file", version=__version__, config=cfg_path, path=log_path))
+
+    sock, keys = find_agent(cfg.ssh_auth_sock)
+    if args.check:
+        return check(cfg, hosts, sock, log_path)
+
+    lock_path = log_path.with_suffix(".lock")
+    with open(lock_path, "w") as lock:
+        try:
+            fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            log.info(t("already_running", path=lock_path))
+            return 0
+
+        if sock:
+            log.debug(t("agent_found", sock=sock, count=len(keys)))
+        else:
+            log.warning(t("agent_not_found"))
+
+        ok = True
+        for h in hosts:
+            host_sock = find_agent(cfg.ssh_auth_sock, h.ssh_key)[0] if h.ssh_key else sock
+            ok = HostBackup(h, host_sock, force=args.force).run() and ok
+    return 0 if ok else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())