fadenstack 0.4.4rc1__tar.gz → 0.4.5__tar.gz

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fadenstack
-Version: 0.4.4rc1
+Version: 0.4.5
 Summary: CLI installer and management tool for the Fadenstack platform
 Project-URL: Homepage, https://fadenstack.com
 Project-URL: Repository, https://github.com/fadenstack/fadenstack

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/pyproject.toml

@@ -10,7 +10,7 @@ packages = ["src/faden_cli"]
 
 [project]
 name = "fadenstack"
-version = "0.4.4rc1"
+version = "0.4.5"
 requires-python = ">=3.12,<4.0"
 description = "CLI installer and management tool for the Fadenstack platform"
 authors = [

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/src/faden_cli/__init__.py

@@ -13,4 +13,4 @@ Module activation via Docker Compose profiles.
 All secrets generated securely during init phase.
 """
 
-__version__ = "0.4.4rc1"
+__version__ = "0.4.5"

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/src/faden_cli/bundle/shared/docker-compose.yaml

@@ -474,7 +474,8 @@ services:
       # Chat attachments (chat_file_store_root). In the container layer until this release: every upgrade
       # and restore replaced the container and lost them. With FADEN_DATA_DIR set in .env the source is
       # that directory plus /chat-files on the host (a company's own storage); empty, the named volume
-      # below. `faden upgrade` copies what the old container holds into it first.
+      # below. `faden upgrade` copies what the old container holds into it first. FADEN_DATA_DIR covers this
+      # and the knowledge files only; never the database, the models or the observability data.
       - ${FADEN_DATA_DIR:-faden_chat_files}${FADEN_DATA_DIR:+/chat-files}:/data/faden/chat-files
     healthcheck:
       test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/api/health', timeout=3).read()"]
@@ -619,8 +620,10 @@ services:
       - faden_models:/srv/faden/models
       # Knowledge base uploads (rag_lite.file_store_root): written here, read by faden-backend-worker,
       # which ingests them. Each container had its own: the worker found no file, every ingest failed,
-      # and the uploads went with the container.
-      - faden_rag_lite:/data/faden/rag-lite
+      # and the uploads went with the container. With FADEN_DATA_DIR set in .env the source is that
+      # directory plus /knowledge on the host; empty, the named volume. The CLI copies the volume's files
+      # into the folder before the container is created.
+      - ${FADEN_DATA_DIR:-faden_rag_lite}${FADEN_DATA_DIR:+/knowledge}:/data/faden/rag-lite
       # Runtime monitoring — shared with the prometheus + grafana
       # services (see their mounts). The backend generates
       # prometheus/targets.json and dashboards/*.json here; grafana
@@ -717,7 +720,7 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - faden_models:/srv/faden/models
-      - faden_rag_lite:/data/faden/rag-lite
+      - ${FADEN_DATA_DIR:-faden_rag_lite}${FADEN_DATA_DIR:+/knowledge}:/data/faden/rag-lite
 
   # -----------------------------
   # frontend (React admin console)

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/src/faden_cli/commands/deploy.py

@@ -820,10 +820,11 @@ def deploy_cmd(
     # We boot Postgres alone, ALTER USER to match .env, then start
     # everything else.
     # An install from before the chat files had a volume: they go from the old gateway container into it,
-    # verified, before anything is started or replaced (syncing the password starts Postgres).
-    from faden_cli.core.backup import keep_chat_files  # noqa: PLC0415
+    # verified, before anything is started or replaced (syncing the password starts Postgres). Re-running
+    # deploy on an install that has just set --data-dir copies the files of its named volumes into the folders.
+    from faden_cli.core.backup import keep_company_files  # noqa: PLC0415
 
-    keep_chat_files(env_path)
+    keep_company_files(env_path, ctx)
     _sync_postgres_password(ctx, env_path)
     retire_fixed_logins(env_path)
 
@@ -845,6 +846,9 @@ def deploy_cmd(
         error(f"docker compose up failed (exit code {rc}).")
         sys.exit(rc)
     success("All services started.")
+    from faden_cli.core.compose import report_inactive_modules  # noqa: PLC0415
+
+    report_inactive_modules(ctx)
 
     # ── 6. Initial admin setup ────────────────────────────────────
     console.print("\n[bold cyan]Step 6: Initial admin setup…[/bold cyan]")

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/src/faden_cli/commands/module.py

@@ -108,6 +108,7 @@ def module_disable(modules: tuple[str, ...]) -> None:
     save_config(cfg)
     _write_env(cfg, enable=[], disable=disabled)
     console.print(
-        "\n[dim]Run [bold]faden down && faden up[/bold] to apply changes "
+        "\n[dim]Run [bold]faden up[/bold] to apply changes: it stops and removes the containers "
+        "of a disabled module and keeps its data "
         "(or [bold]faden dev up[/bold] in a dev workspace).[/dim]",
     )

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/src/faden_cli/commands/rebuild.py

@@ -130,12 +130,14 @@ def rebuild_cmd(
 
     env_path = ctx.env_file
 
-    # The gateway's chat files: from an old container into the volume it now has, verified (see core.backup).
-    # Before anything is recreated (syncing the password starts Postgres, which compose may recreate).
-    if not target_services or any("gateway" in name for name in target_services):
-        from faden_cli.core.backup import keep_chat_files  # noqa: PLC0415
-
-        keep_chat_files(env_path)
+    # The gateway's chat files: from an old container into the volume it now has, verified (see core.backup);
+    # and with FADEN_DATA_DIR set, the files of the volumes it covers into its folders (the gateway and the
+    # backend mount them). Before anything is recreated (syncing the password starts Postgres, which compose
+    # may recreate).
+    if not target_services or any("gateway" in name or "backend" in name for name in target_services):
+        from faden_cli.core.backup import keep_company_files  # noqa: PLC0415
+
+        keep_company_files(env_path, ctx)
 
     # Step 1b: Sync Postgres password if .env credentials differ from
     # what the running Postgres volume was initialised with (e.g. after

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/src/faden_cli/commands/up.py

@@ -6,7 +6,7 @@ import sys
 
 import click
 
-from faden_cli.core.compose import build_context_from_config, up as compose_up
+from faden_cli.core.compose import build_context_from_config, report_inactive_modules, up as compose_up
 from faden_cli.core.console import console, success, error
 from faden_cli.core.env_gen import write_env_file, default_env_vars
 from faden_cli.core.settings import load_config
@@ -49,6 +49,12 @@ def up_cmd(
 
     console.print("[bold cyan]Starting Fadenstack services…[/bold cyan]")
 
+    # With FADEN_DATA_DIR set in .env, the files of the named volumes it covers go into its folders first,
+    # verified: the containers about to be created mount the (possibly empty) folders (see core.backup).
+    from faden_cli.core.backup import keep_company_files  # noqa: PLC0415
+
+    keep_company_files(ctx.env_file, ctx)
+
     returncode = compose_up(
         ctx,
         detach=detach,
@@ -59,6 +65,9 @@ def up_cmd(
 
     if returncode == 0:
         success("Services started successfully.")
+        # Only when everything was started: naming services is a partial start.
+        if not services:
+            report_inactive_modules(ctx)
     else:
         error(f"docker compose up exited with code {returncode}.")
         sys.exit(returncode)

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/src/faden_cli/commands/upgrade.py

@@ -368,10 +368,11 @@ def _restart_and_check(ctx: ComposeContext, shared_dir: Path, env_path: Path, st
     # Chat attachments an older release kept inside the gateway container, which the restart below replaces:
     # copied into the volume they now have and verified, while the old container is still there. First of
     # all, before anything is replaced (syncing the password starts Postgres, which compose may recreate): if
-    # they cannot be kept, the command stops here and the old containers keep running.
-    from faden_cli.core.backup import keep_chat_files  # noqa: PLC0415
+    # they cannot be kept, the command stops here and the old containers keep running. With FADEN_DATA_DIR set,
+    # the files of the named volumes it covers are copied into its folders the same way.
+    from faden_cli.core.backup import keep_company_files  # noqa: PLC0415
 
-    keep_chat_files(env_path)
+    keep_company_files(env_path, ctx)
 
     # Sync postgres password before restarting (same as deploy)
     from faden_cli.commands.deploy import _sync_postgres_password, retire_fixed_logins  # noqa: PLC0415
@@ -404,6 +405,9 @@ def _restart_and_check(ctx: ComposeContext, shared_dir: Path, env_path: Path, st
         error(f"docker compose up failed (exit code {rc}).")
         sys.exit(rc)
     success("All services restarted.")
+    from faden_cli.core.compose import report_inactive_modules  # noqa: PLC0415
+
+    report_inactive_modules(ctx)
 
     # ClickHouse's diagnostic logs are off from this release; what they hold
     # stays until dropped (41 GB of trace_log filled one install's disk).

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/src/faden_cli/core/backup.py

@@ -44,7 +44,12 @@ BACKUP_VOLUMES: list[str] = [
 
 #: The company data volumes docker-compose.yaml can put in a host directory instead: with FADEN_DATA_DIR set in
 #: .env, the volume is that directory plus the subdirectory named here. Mirrors the mounts in the compose file.
-DATA_DIR_VOLUMES: dict[str, str] = {"faden_chat_files": "chat-files"}
+#: This is the whole scope, settled before the first release that ships it: chat attachments and the knowledge
+#: base's files. Never in it, so that setting FADEN_DATA_DIR can never put a volume on an empty folder in a
+#: later release: the database (pg_data), the model store (faden_models) and the observability data. They get
+#: settings of their own. Adding an entry here later would make every install that set FADEN_DATA_DIR mount an
+#: empty folder, and its data would look lost.
+DATA_DIR_VOLUMES: dict[str, str] = {"faden_chat_files": "chat-files", "faden_rag_lite": "knowledge"}
 
 #: Where the gateway keeps chat attachments, and its container: files an older release left in the
 #: container layer are carried into the volume before the container is replaced.
@@ -373,12 +378,17 @@ def _volume_source(docker: str, project: str, name: str, data_dir: str) -> str |
     return _compose_volume(docker, project, name)
 
 
-class ChatFilesNotCarried(RuntimeError):
-    """The chat attachments in the old gateway container could not be copied and verified.
+class FilesNotCarried(RuntimeError):
+    """Company files could not be copied and verified. The message says what failed and what to do. Raised
+    before any container is replaced, so the files are where they were."""
+
+
+class ChatFilesNotCarried(FilesNotCarried):
+    """The chat attachments in the old gateway container could not be copied and verified."""
 
-    The message says what failed and what to do. Raised before any container is replaced, so the files are
-    where they were.
-    """
+
+class DataDirNotMoved(FilesNotCarried):
+    """The files of a named volume could not be copied into the FADEN_DATA_DIR folder and verified."""
 
 
 @dataclass
@@ -420,29 +430,37 @@ _HASH_DIRECTORY = (
 _COPY_STREAM = "tar -x --skip-old-files -f - -C /dst"
 
 
-def _parse_hashes(output: str) -> dict[str, tuple[str, int]]:
+def _parse_hashes(output: str, failure: type[FilesNotCarried] = ChatFilesNotCarried) -> dict[str, tuple[str, int]]:
     """Path (relative) → (SHA-256, size) from the lines :data:`_HASH_MEMBER` prints."""
     found: dict[str, tuple[str, int]] = {}
     for line in output.splitlines():
         parts = line.split("\t", 2)
         if len(parts) != 3 or len(parts[0]) != 64 or not parts[1].isdigit():
-            raise ChatFilesNotCarried(f"The helper container answered something unexpected: {line[:120]!r}.")
+            raise failure(f"The helper container answered something unexpected: {line[:120]!r}.")
         found[parts[2].removeprefix("./")] = (parts[0], int(parts[1]))
     return found
 
 
-def _helper(docker: str, image: str, script: str, *, mount: str | None = None, interactive: bool = False) -> list[str]:
-    """``docker run`` of the old gateway's own image, running *script* as root with *mount* on ``/dst``.
+def _helper(
+    docker: str,
+    image: str,
+    script: str,
+    *,
+    mount: str | None = None,
+    interactive: bool = False,
+    extra_mounts: tuple[str, ...] = (),
+) -> list[str]:
+    """``docker run`` of an image already on the server, running *script* as root with *mount* on ``/dst``.
 
-    The image is on the server already (an air-gapped one pulls nothing) and is Debian with GNU tar and
-    sha256sum. Root, to read and write whatever user the files belong to.
+    The image is the old gateway's or the backend's own (an air-gapped server pulls nothing) and is Debian
+    with GNU tar and sha256sum. Root, to read and write whatever user the files belong to.
     """
     cmd = [docker, "run", "--rm"]
     if interactive:
         cmd.append("-i")
     cmd += ["--user", "0:0", "--entrypoint", "sh"]
-    if mount is not None:
-        cmd += ["-v", mount]
+    for each in (*([mount] if mount is not None else []), *extra_mounts):
+        cmd += ["-v", each]
     return [*cmd, image, "-c", script]
 
 
@@ -575,10 +593,9 @@ def carry_over_chat_files(data_dir: str = "") -> CarryResult:
 
     info("Reading the chat attachments in the old gateway container…")
     listing = _stream_from_container(docker, image, _HASH_STREAM)
-    if listing is None:
-        return CarryResult("none")  # the old container has no such directory: nothing to carry
-    source = _parse_hashes(listing)
-    if not source:
+    if listing is None or not (source := _parse_hashes(listing)):
+        # No such directory, or an empty one: said, so the line above does not end in silence.
+        info("  No chat attachments there: nothing to carry over.")
         return CarryResult("none")
     size = sum(n for _, n in source.values())
     info(f"  {len(source)} file(s), {_human_size(size)}; copying into the data volume…")
@@ -615,10 +632,178 @@ def carry_over_chat_files(data_dir: str = "") -> CarryResult:
     return CarryResult("copied", len(source), size)
 
 
-def snapshot_volumes(backup_dir: Path, *, volumes: list[str] | None = None, data_dir: str = "") -> list[str]:
+#: The same lines for the files of a named volume, mounted read-only on /src.
+_HASH_VOLUME = _HASH_DIRECTORY.replace("/dst", "/src")
+#: Volume -> folder without ever replacing a file the folder holds. No ``pipefail`` in dash: a failed read side
+#: shows up as files missing in the check after the copy.
+_MOVE_VOLUME = "tar -c -f - -C /src . | tar -x --skip-old-files -f - -C /dst"
+
+_VOLUME_LEFT = (
+    "Nothing was replaced: the containers still run and the named volume is untouched. Fix the cause named, "
+    "then run the command again."
+)
+
+
+@dataclass
+class MoveResult:
+    """What :func:`move_into_data_dir` did for one volume: ``"moved"``, ``"present"`` (the folder already held
+    every file) or ``"none"`` (no such volume, or it is empty), and how many files and bytes were copied."""
+
+    volume: str
+    status: str
+    folder: str = ""
+    files: int = 0
+    size: int = 0
+
+
+def _helper_image(docker: str, ctx: object | None = None) -> str:
+    """An image already on the server for the helper container: the running gateway's or backend's own,
+    else the backend image the compose file names (an air-gapped server pulls nothing)."""
+    for container in (_GATEWAY_CONTAINER, "faden-backend"):
+        proc = subprocess.run(  # noqa: S603
+            [docker, "inspect", "-f", "{{.Image}}", container], capture_output=True, check=False
+        )
+        image = proc.stdout.decode("utf-8", errors="replace").strip() if proc.returncode == 0 else ""
+        if image:
+            return image
+    if ctx is not None:
+        proc = subprocess.run(  # noqa: S603
+            [*ctx.base_cmd(), "config", "--images"], capture_output=True, text=True, check=False  # type: ignore[attr-defined]
+        )
+        for line in (proc.stdout or "").splitlines():
+            if proc.returncode == 0 and "/backend:" in line.strip():
+                return line.strip()
+    raise DataDirNotMoved(
+        f"No image to copy the files with: neither {_GATEWAY_CONTAINER} nor faden-backend exists and the compose "
+        f"file names no backend image. {_VOLUME_LEFT}"
+    )
+
+
+def _hash_tree(docker: str, image: str, path: str, *, role: str) -> dict[str, tuple[str, int]]:
+    """Path → (SHA-256, size) of every file under *path* (a volume, as ``/src``, or a folder, as ``/dst``)."""
+    script, where = (_HASH_VOLUME, "src") if role == "volume" else (_HASH_DIRECTORY, "dst")
+    proc = subprocess.run(  # noqa: S603
+        _helper(docker, image, script, mount=f"{path}:/{where}:ro"), capture_output=True, check=False
+    )
+    if proc.returncode != 0:
+        detail = proc.stderr.decode("utf-8", errors="replace").strip()[:300]
+        raise DataDirNotMoved(
+            f"The files in the {role} {path} could not be read to check them "
+            f"({detail or 'the helper failed'}). {_VOLUME_LEFT}"
+        )
+    return _parse_hashes(proc.stdout.decode("utf-8", errors="replace"), DataDirNotMoved)
+
+
+def _move_volume(docker: str, image: str, name: str, volume: str, folder: str) -> MoveResult:
+    """Copy what the named *volume* holds and *folder* lacks into *folder*, then check every file's SHA-256."""
+    source = _hash_tree(docker, image, volume, role="volume")
+    if not source:
+        return MoveResult(name, "none", folder)
+    found = _hash_tree(docker, image, folder, role="folder")
+    differing = [path for path, (digest, _) in source.items() if path in found and found[path][0] != digest]
+    if differing:
+        raise DataDirNotMoved(
+            f"{len(differing)} file(s) of {name} exist in {folder} with other content than in the volume: "
+            f"{_named(differing)}. Nothing was overwritten and nothing was replaced. Compare the two copies, "
+            f"move the one you do not want out of the way, then run the command again."
+        )
+    size = sum(n for _, n in source.values())
+    if all(path in found for path in source):
+        return MoveResult(name, "present", folder)
+    info(f"  {name}: {len(source)} file(s), {_human_size(size)}; copying into {folder}…")
+    proc = subprocess.run(  # noqa: S603
+        _helper(docker, image, _MOVE_VOLUME, mount=f"{folder}:/dst", extra_mounts=(f"{volume}:/src:ro",)),
+        capture_output=True,
+        check=False,
+    )
+    if proc.returncode != 0:
+        detail = proc.stderr.decode("utf-8", errors="replace").strip()[:300]
+        raise DataDirNotMoved(
+            f"The files of {name} could not be copied into {folder} ({detail or 'the helper container failed'}). "
+            f"{_VOLUME_LEFT}"
+        )
+    after = _hash_tree(docker, image, folder, role="folder")
+    differing = [p for p, (digest, _) in source.items() if p in after and after[p][0] != digest]
+    if differing:
+        raise DataDirNotMoved(
+            f"{len(differing)} file(s) of {name} differ in {folder} after copying: {_named(differing)}. They "
+            f"changed in the volume while it was copied, or were damaged on the way. {_VOLUME_LEFT}"
+        )
+    missing = [path for path in source if path not in after]
+    if missing:
+        raise DataDirNotMoved(
+            f"{len(missing)} file(s) of {name} are not in {folder} after copying: {_named(missing)}. {_VOLUME_LEFT}"
+        )
+    return MoveResult(name, "moved", folder, len(source), size)
+
+
+def move_into_data_dir(data_dir: str, ctx: object | None = None) -> list[MoveResult]:
+    """With FADEN_DATA_DIR set: copy the files of every named volume in :data:`DATA_DIR_VOLUMES` that still
+    exists into its folder, verified, before a container that mounts the folder is created.
+
+    Switching FADEN_DATA_DIR on would otherwise put an empty folder where the volume's files are. The copy
+    never overwrites (``tar --skip-old-files``); then every file of the volume must be in the folder with the
+    same SHA-256. A file in both with other content is a conflict that stops everything before anything is
+    written. The volume is left as it was. Any failure raises :class:`DataDirNotMoved`; nothing is replaced.
+    Safe to run again: a folder that holds everything is left alone. Switching it off again copies nothing back.
+    """
+    if not data_dir:
+        return []
+    docker = _docker_bin()
+    project = _compose_project(docker) or _DEFAULT_PROJECT
+    results: list[MoveResult] = []
+    image = ""
+    for name, subdirectory in DATA_DIR_VOLUMES.items():
+        volume = _compose_volume(docker, project, name)
+        folder = f"{data_dir}/{subdirectory}"
+        if volume is None:
+            results.append(MoveResult(name, "none", folder))
+            continue
+        image = image or _helper_image(docker, ctx)
+        results.append(_move_volume(docker, image, name, volume, folder))
+    return results
+
+
+def keep_company_files(env_file: object, ctx: object | None = None) -> None:
+    """Before containers are created with this ``.env``: :func:`keep_chat_files`, then, when FADEN_DATA_DIR is
+    set, :func:`move_into_data_dir`.
+
+    The chat files go first: from an old gateway container (0.4.3 and older, no mount) straight into the
+    folder, which creates no named volume; the move after it then finds no volume for them, or one whose files
+    the folder already holds. The two never write the same file differently: both skip files that exist and
+    stop on a conflict. When anything cannot be kept, the command stops here with the reason; nothing is replaced.
+    """
+    keep_chat_files(env_file)
+    try:
+        results = move_into_data_dir(data_dir_of(env_file), ctx)
+    except FilesNotCarried as exc:
+        error(str(exc))
+        sys.exit(1)
+    for result in results:
+        if result.status == "moved":
+            success(
+                f"{result.volume} copied into {result.folder} and verified ({result.files} file(s), "
+                f"{_human_size(result.size)}). The named volume is left as it was: once you are satisfied, "
+                f"remove it with `docker volume rm`."
+            )
+
+
+def _volume_image(docker: str, ctx: object | None) -> str:
+    """The image a volume backup or restore runs in: one already on the server (``_helper_image``), so an
+    air-gapped server pulls nothing; ``alpine`` only where no Fadenstack image is there at all."""
+    try:
+        return _helper_image(docker, ctx)
+    except DataDirNotMoved:
+        return "alpine"
+
+
+def snapshot_volumes(
+    backup_dir: Path, *, volumes: list[str] | None = None, data_dir: str = "", ctx: object | None = None
+) -> list[str]:
     """Tar each named Docker volume into the backup directory.
 
-    Uses a temporary ``alpine`` container to read from the volume mount. The archive carries the compose
+    Uses a temporary container of an image already on the server (``_volume_image``) to read from the
+    volume mount. The archive carries the compose
     name (``minio_data.tar.gz``), so a restore finds the volume on whichever install it runs.
     Returns list of created archive filenames.
 
@@ -630,6 +815,7 @@ def snapshot_volumes(backup_dir: Path, *, volumes: list[str] | None = None, data
     project = _compose_project(docker)
     targets = volumes or list(BACKUP_VOLUMES)
     created: list[str] = []
+    image = ""
 
     for vol in targets:
         source = _volume_source(docker, project, vol, data_dir)
@@ -638,15 +824,11 @@ def snapshot_volumes(backup_dir: Path, *, volumes: list[str] | None = None, data
             continue
         archive = f"{vol}.tar.gz"
         archive_path = backup_dir / archive
+        image = image or _volume_image(docker, ctx)
         info(f"  Snapshotting volume: {vol}")
         with open_private(archive_path) as out:
             proc = subprocess.run(  # noqa: S603
-                [
-                    docker, "run", "--rm",
-                    "-v", f"{source}:/data:ro",
-                    "alpine",
-                    "tar", "czf", "-", "-C", "/data", ".",
-                ],
+                _helper(docker, image, "tar czf - -C /data .", mount=f"{source}:/data:ro"),
                 stdout=out,
                 stderr=subprocess.PIPE,
                 check=False,
@@ -661,7 +843,9 @@ def snapshot_volumes(backup_dir: Path, *, volumes: list[str] | None = None, data
     return created
 
 
-def restore_volumes(backup_dir: Path, manifest: dict, *, data_dir: str = "") -> list[str]:
+def restore_volumes(
+    backup_dir: Path, manifest: dict, *, data_dir: str = "", ctx: object | None = None
+) -> list[str]:
     """Restore volume archives from a backup.
 
     Returns list of volume names that were restored.
@@ -670,6 +854,7 @@ def restore_volumes(backup_dir: Path, manifest: dict, *, data_dir: str = "") ->
     project = _compose_project(docker)
     archives = manifest.get("volumes", [])
     restored: list[str] = []
+    image = ""
 
     for archive in archives:
         archive_path = backup_dir / archive
@@ -693,17 +878,16 @@ def restore_volumes(backup_dir: Path, manifest: dict, *, data_dir: str = "") ->
         if target is None:
             warning(f"  No volume {vol} in this install; {archive} not restored")
             continue
+        image = image or _volume_image(docker, ctx)
         info(f"  Restoring volume: {vol}")
         # The archive goes in on the container's input: the backup is its owner's only, which a container's
         # root may not be (user namespaces), and a mount of it is not needed.
         with archive_path.open("rb") as archive_in:
             proc = subprocess.run(  # noqa: S603
-                [
-                    docker, "run", "--rm", "-i",
-                    "-v", f"{target}:/data",
-                    "alpine",
-                    "sh", "-c", "find /data -mindepth 1 -delete && tar xzf - -C /data",
-                ],
+                _helper(
+                    docker, image, "find /data -mindepth 1 -delete && tar xzf - -C /data",
+                    mount=f"{target}:/data", interactive=True,
+                ),
                 stdin=archive_in,
                 capture_output=True,
                 check=False,
@@ -983,7 +1167,7 @@ def create_backup(
     # 4. Snapshot volumes
     if include_volumes and not db_only:
         console.print("\n[bold cyan]Snapshotting Docker volumes…[/bold cyan]")
-        result.volumes = snapshot_volumes(backup_dir, data_dir=data_dir_of(ctx.env_file))
+        result.volumes = snapshot_volumes(backup_dir, data_dir=data_dir_of(ctx.env_file), ctx=ctx)
 
     # 5. Collect migration heads
     console.print("\n[bold cyan]Collecting migration heads…[/bold cyan]")
@@ -1055,7 +1239,7 @@ def restore_backup(
     # 4. Restore volumes
     if not db_only and manifest.get("volumes"):
         console.print("\n[bold cyan]Restoring Docker volumes…[/bold cyan]")
-        result.volumes_restored = restore_volumes(backup_dir, manifest, data_dir=data_dir_of(ctx.env_file))
+        result.volumes_restored = restore_volumes(backup_dir, manifest, data_dir=data_dir_of(ctx.env_file), ctx=ctx)
 
     # 5. The certificate material, so the machines still trust this server
     if not db_only and manifest.get("tls_material") and ctx.project_dir:

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/src/faden_cli/core/compose.py

@@ -19,7 +19,7 @@ import sys
 from dataclasses import dataclass, field
 from pathlib import Path
 
-from faden_cli.core.console import console, error
+from faden_cli.core.console import console, error, info, warning
 
 
 # ── GPU detection ─────────────────────────────────────────────────
@@ -242,6 +242,62 @@ def service_names(ctx: ComposeContext) -> list[str]:
     return [line.strip() for line in (result.stdout or "").splitlines() if line.strip()]
 
 
+def stop_inactive_modules(ctx: ComposeContext) -> list[tuple[str, list[str]]]:
+    """Stop and remove the containers of modules that are switched off.
+
+    ``compose up`` only starts the services of active profiles; it never stops
+    those of a profile that was switched off, so ``module disable`` left them
+    running. Only services whose profiles are all module profiles and none of
+    them active are touched (core services have no profile). Volumes stay.
+    Returns ``(module, container names)`` for each module it cleaned up.
+    """
+    from dataclasses import replace  # noqa: PLC0415
+
+    from faden_cli.core.registry import MODULES  # noqa: PLC0415
+
+    # "*" makes compose see every profile, so the services of inactive ones are listed too.
+    everything = replace(ctx, profiles=["*"])
+    config = _run(everything.base_cmd() + ["config", "--format", "json"], capture=True)
+    if config.returncode != 0:
+        return []
+    try:
+        spec = json.loads(config.stdout or "{}")
+    except ValueError:
+        return []
+    by_profile = {m.profile: name for name, m in MODULES.items()}
+    active = set(ctx.profiles)
+    owner: dict[str, str] = {}
+    for service, body in (spec.get("services") or {}).items():
+        profiles = set(body.get("profiles") or []) if isinstance(body, dict) else set()
+        if profiles and profiles <= set(by_profile) and not profiles & active:
+            owner[service] = by_profile[sorted(profiles)[0]]
+    if not owner:
+        return []
+    present = {row.service: row.name for row in ps(everything) if row.service in owner}
+    if not present:
+        return []
+    names = sorted(present)
+    failed = stop(everything, services=names)
+    failed = failed or _run(everything.base_cmd() + ["rm", "-f", *names], stream=True).returncode
+    if failed:
+        # Not fatal for the command that called it: the active services run. Said, so it is not missed.
+        containers = ", ".join(sorted(present.values()))
+        warning(f"The containers of switched-off modules could not be stopped and removed: {containers}. "
+                f"Run `faden up` again, or remove them with `docker rm -f {' '.join(sorted(present.values()))}`.")
+        return []
+    cleaned: dict[str, list[str]] = {}
+    for service, container in sorted(present.items()):
+        cleaned.setdefault(owner[service], []).append(container or service)
+    return sorted(cleaned.items())
+
+
+def report_inactive_modules(ctx: ComposeContext) -> None:
+    """Run :func:`stop_inactive_modules` and print one line per module it stopped."""
+    for module, containers in stop_inactive_modules(ctx):
+        label = module.upper() if len(module) <= 3 else module.capitalize()
+        info(f"{label} is switched off: stopped and removed {', '.join(containers)} (their data is kept).")
+
+
 def down(
     ctx: ComposeContext,
     *,

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/src/faden_cli/core/env_gen.py

@@ -69,8 +69,9 @@ SECRET_KEYS: frozenset[str] = frozenset({
 #: fallbacks). Rotation of every container's Docker log: the largest file and how many are kept per container,
 #: so 50m x 5 is at most 250 MB each. FADEN_REDIS_MAXMEMORY: the most memory Redis uses; at it Redis refuses
 #: writes (noeviction) rather than the host running out (see the redis service in the compose file).
-#: FADEN_DATA_DIR: empty keeps the company data (chat attachments) in
-#: Docker named volumes; a directory puts it there instead (Help: Installing, Where the data is kept).
+#: FADEN_DATA_DIR: empty keeps the company data (chat attachments and knowledge files, nothing else: see
+#: ``DATA_DIR_VOLUMES``) in Docker named volumes; a directory puts it there instead (Help: Installing, Where the
+#: data is kept).
 DEPLOY_SETTINGS: dict[str, str] = {
     "FADEN_LOG_MAX_SIZE": "50m",
     "FADEN_LOG_MAX_FILE": "5",

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/src/faden_cli/core/release_feed.py

@@ -33,6 +33,10 @@ FEED_URL = "https://fadenstack.com/updates/v1/index.json"
 #: ships here in a release before anything is signed with it.
 TRUSTED_KEYS: dict[str, str] = {
     "fadenstack-2026-10": "F87bn6AH1s5Lrw0bUKebHzxWO23vv8A6Hh9/+cxHjyo=",
+    # The backup key: its private half is kept offline and signs nothing while the key above is usable. A key
+    # an install trusts can only come with a release, so without it a lost or leaked signing key would leave
+    # every install unable to trust a feed again until someone upgraded it by hand.
+    "fadenstack-backup-2026-10": "4X1SvMFK7tO+04Ua+y0w7TC/GaW43tlqzr3vUoxFVWU=",
 }
 
 #: Least to most urgent. "none": nothing newer.

{fadenstack-0.4.4rc1 → fadenstack-0.4.5}/tests/conftest.py

@@ -27,6 +27,7 @@ from faden_cli.core import backup
 def never_touch_real_processes(monkeypatch: pytest.MonkeyPatch) -> None:
     # The upgrade, deploy and rebuild steps that carry chat files out of the gateway container: none here.
     monkeypatch.setattr(backup, "keep_chat_files", lambda *_a, **_k: None)
+    monkeypatch.setattr(backup, "keep_company_files", lambda *_a, **_k: None)
 
     # Nothing to find...
     monkeypatch.setattr(dev_up.psutil, "process_iter", lambda *_a, **_k: [])