lts-backup-cli 2.0.0__py3-none-any.whl

lts_backup_cli/services.py

@@ -0,0 +1,604 @@
+"""Use-case facades. They orchestrate adapters and never spawn processes themselves.
+
+Every service gets a Runner already scoped to the server (see runner_for): restic and
+mariadb-dump run on the web server, which reaches the SFTP storage on its own."""
+
+from __future__ import annotations
+
+import contextlib
+import fcntl
+import secrets
+import sys
+import tempfile
+from collections.abc import Iterator
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import IO, Any, Callable
+
+from . import apache, schedule, sshconfig
+from . import config as c
+from . import validation as v
+from .mariadb import NATIVE_PLUGIN, DbUser, MariaDBClient, probe_binaries
+from .restic import GIT_EXCLUDE, ResticClient, Snapshot
+from .runner import CommandError, Runner, SshRunner, pipeline
+
+Echo = Callable[[str], None]
+
+# Constant scripts: user data only ever travels as positional args ("$1") or on stdin.
+_WRITE_0600 = (
+    'umask 077 && cat > "$1.ltsbu-tmp" && chmod 600 "$1.ltsbu-tmp" && mv "$1.ltsbu-tmp" "$1"'
+)
+_READ_SSH_CONFIG = "cat ~/.ssh/config 2>/dev/null; true"
+_WRITE_SSH_CONFIG = (
+    "umask 077 && mkdir -p ~/.ssh && "
+    "{ [ ! -f ~/.ssh/config ] || cp -p ~/.ssh/config ~/.ssh/config.ltsbu-$(date +%Y%m%dT%H%M%S).bak; } && "
+    "cat > ~/.ssh/config.ltsbu-tmp && mv ~/.ssh/config.ltsbu-tmp ~/.ssh/config"
+)
+_READ_APACHE = f"cat {' '.join(apache.CONF_GLOBS)} 2>/dev/null; true"
+
+
+class ServiceError(RuntimeError):
+    pass
+
+
+def runner_for(base: Runner, server: c.ServerConfig) -> Runner:
+    return base if server.is_local else SshRunner(base, server.ssh_target)
+
+
+def restic_for(runner: Runner, server: c.ServerConfig, repo: c.RepoConfig) -> ResticClient:
+    return ResticClient(runner, server.repository(repo), server.password_path(repo))
+
+
+def mariadb_for(runner: Runner, server: c.ServerConfig) -> MariaDBClient:
+    if not server.db_login:
+        raise ServiceError(
+            f"server {server.label} has no MariaDB login; run 'ltsbu discover' to set one"
+        )
+    return MariaDBClient(runner, server.mycnf_path, probe_binaries(runner))
+
+
+def repo_tags(server: c.ServerConfig, repo: c.RepoConfig) -> list[str]:
+    return ["ltsbu", f"server:{server.label}", f"repo:{repo.name}"]
+
+
+def _stdin(text: str) -> IO[bytes]:
+    fh = tempfile.TemporaryFile()  # noqa: SIM115 - caller closes; real fd, unlinked on creation
+    fh.write(text.encode())
+    fh.seek(0)
+    return fh
+
+
+def put_secret(runner: Runner, path: str, content: str) -> None:
+    """Write a 0600 file on the runner's host; the content goes over stdin, never argv."""
+    with _stdin(content) as fh:
+        runner.run(["sh", "-c", _WRITE_0600, "sh", path], stdin=fh)
+
+
+@contextlib.contextmanager
+def backup_lock() -> Iterator[None]:
+    """One backup at a time from this admin box: overlapping timers queue instead of
+    loading the servers in parallel."""
+    path = c.cache_dir() / "backup.lock"
+    path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    with open(path, "w") as fh:
+        fcntl.flock(fh, fcntl.LOCK_EX)
+        try:
+            yield
+        finally:
+            fcntl.flock(fh, fcntl.LOCK_UN)
+
+
+# --- backup -----------------------------------------------------------------------------
+
+
+@dataclass
+class BackupService:
+    runner: Runner
+    server: c.ServerConfig
+    echo: Echo = print
+
+    def run(
+        self,
+        repo: c.RepoConfig,
+        weekly: bool = False,
+        include_git: bool = False,
+        verbose: bool = False,
+    ) -> list[str]:
+        """Back up then rotate. Returns the databases that failed (empty for file repos)."""
+        restic = restic_for(self.runner, self.server, repo)
+        tags = repo_tags(self.server, repo) + (["weekly"] if weekly else [])
+        failed: list[str] = []
+        if repo.kind == "db":
+            db = mariadb_for(self.runner, self.server)
+            for name in repo.databases:
+                self.echo(f"[{self.server.label}/{repo.name}] dumping {name}")
+                argv = pipeline(
+                    db.dump_argv(name),
+                    restic.stdin_backup_argv(
+                        f"{name}.sql", [*tags, f"db:{name}"], host=self.server.label
+                    ),
+                )
+                try:
+                    self.runner.run(argv)
+                except CommandError as e:  # one broken database must not skip the others
+                    self.echo(f"[{self.server.label}/{repo.name}] {name} FAILED: {e}")
+                    failed.append(name)
+        else:
+            self.echo(f"[{self.server.label}/{repo.name}] backing up {', '.join(repo.paths)}")
+            excludes = [GIT_EXCLUDE] if repo.exclude_git and not include_git else []
+            out = restic.backup(repo.paths, tags, excludes, verbose=verbose, host=self.server.label)
+            if out:
+                self.echo(out.rstrip())
+        ForgetService(self.runner, self.server).run(repo, prune=weekly)
+        return failed
+
+
+# --- restore ----------------------------------------------------------------------------
+
+
+def resolve_snapshot(restic: ResticClient, tags: list[str], snapshot: str) -> Snapshot:
+    sid = v.snapshot_id(snapshot)
+    snaps = restic.snapshots(tags=tags)
+    what = " ".join(t for t in tags if t != "ltsbu")
+    if not snaps:
+        raise ServiceError(f"no snapshots found for {what}")
+    if sid == "latest":
+        return max(snaps, key=lambda s: s.time)
+    matches = [s for s in snaps if s.id.startswith(sid)]
+    if len(matches) != 1:
+        raise ServiceError(f"snapshot {snapshot!r} matched {len(matches)} snapshots of {what}")
+    return matches[0]
+
+
+def snapshot_db(snap: Snapshot) -> str | None:
+    return next((t.split(":", 1)[1] for t in snap.tags if t.startswith("db:")), None)
+
+
+@dataclass
+class RestorePlan:
+    snapshot: Snapshot
+    target: str | None = None  # file repos: directory on the server
+    database: str | None = None  # db repos: database the dump came from
+    into: str | None = None  # db repos: database to load it into
+
+
+@dataclass
+class RestoreService:
+    runner: Runner
+    server: c.ServerConfig
+    echo: Echo = print
+
+    def plan(
+        self,
+        repo: c.RepoConfig,
+        snapshot: str = "latest",
+        target: str | None = None,
+        database: str | None = None,
+        into: str | None = None,
+    ) -> RestorePlan:
+        restic = restic_for(self.runner, self.server, repo)
+        tags = repo_tags(self.server, repo)
+        if repo.kind != "db":
+            if database or into:
+                raise ServiceError("--database/--into only apply to a database repo")
+            if not target:
+                raise ServiceError("--target is required (use --target / to restore in place)")
+            return RestorePlan(resolve_snapshot(restic, tags, snapshot), v.remote_abs_path(target))
+        if target:
+            raise ServiceError("--target does not apply to a database repo (use --into)")
+        if not database:
+            raise ServiceError(
+                f"choose --database: {', '.join(sorted(repo.databases))} (and optionally --into)"
+            )
+        db = v.db_name(database)
+        if db not in repo.databases:
+            raise ServiceError(f"database {db} is not configured in repo {repo.name}")
+        snap = resolve_snapshot(restic, [*tags, f"db:{db}"], snapshot)
+        return RestorePlan(snap, database=db, into=v.db_name(into or db))
+
+    def execute(self, repo: c.RepoConfig, plan: RestorePlan) -> None:
+        restic = restic_for(self.runner, self.server, repo)
+        snap = plan.snapshot
+        if plan.target:
+            self.echo(f"restoring {', '.join(snap.paths)} from {snap.short_id} -> {plan.target}")
+            restic.restore(snap.id, plan.target)
+            return
+        if not plan.into:
+            raise ServiceError("restore plan has neither a target nor a database")
+        db = mariadb_for(self.runner, self.server)
+        self.echo(f"loading {plan.database} from {snap.short_id} into database {plan.into}")
+        db.create_database(plan.into)
+        self.runner.run(pipeline(restic.dump_argv(snap.id, snap.paths[0]), db.load_argv(plan.into)))
+
+
+# --- forget -----------------------------------------------------------------------------
+
+
+@dataclass
+class ForgetService:
+    runner: Runner
+    server: c.ServerConfig
+
+    def run(
+        self,
+        repo: c.RepoConfig,
+        hourly: int | None = None,
+        daily: int | None = None,
+        weekly: int | None = None,
+        monthly: int | None = None,
+        prune: bool = False,
+    ) -> str:
+        given = (hourly, daily, weekly, monthly)
+        k = repo.keep
+        keeps = (
+            given if any(x is not None for x in given) else (k.hourly, k.daily, k.weekly, k.monthly)
+        )
+        for x in keeps:
+            v.keep(x)
+        if not any(keeps):
+            raise ServiceError(
+                "refusing to forget with an empty keep policy (would remove everything)"
+            )
+        h, d, w, m = keeps
+        return restic_for(self.runner, self.server, repo).forget(
+            repo_tags(self.server, repo), hourly=h, daily=d, weekly=w, monthly=m, prune=prune
+        )
+
+
+# --- discover -------------------------------------------------------------------------------
+
+
+@dataclass
+class Discovery:
+    home: str
+    vhosts: list[apache.VHost]
+    databases: list[str] | None  # None: no working MariaDB login yet
+    skipped_databases: list[str] = field(default_factory=list)  # names ltsbu cannot handle
+
+
+@dataclass
+class DiscoverRequest:
+    server: c.ServerConfig
+    removed: list[str] = field(default_factory=list)
+    init_repositories: bool = True
+    install_timers: bool = True
+
+
+@dataclass
+class DiscoverService:
+    base: Runner
+    cfg: c.Config
+    config_path: Path
+    ssh_config_path: Path
+    units_dir: Path
+    user_units: bool
+    echo: Echo = print
+    python: str = sys.executable
+
+    def connect(self, server: c.ServerConfig) -> Runner:
+        """Write the admin box -> server ssh block (if ltsbu manages it) and check the login."""
+        if not server.is_local and not server.use_ssh_config:
+            text = sshconfig.read(self.ssh_config_path)
+            host = sshconfig.SshHost(
+                server.label,
+                server.ssh_host,
+                str(server.ssh_user),
+                server.ssh_port,
+                server.ssh_identity,
+            )
+            new = sshconfig.upsert(text, host)
+            if new != text:
+                if self.base.dry_run:
+                    self.echo(
+                        f"[dry-run] would update {self.ssh_config_path} (Host {server.ssh_target})"
+                    )
+                else:
+                    sshconfig.write(self.ssh_config_path, new)
+                    self.echo(f"updated {self.ssh_config_path} (Host {server.ssh_target})")
+        runner = runner_for(self.base, server)
+        res = runner.run(["true"], check=False, mutating=False, timeout=60)
+        if res.returncode != 0:
+            raise ServiceError(f"cannot log in to {server.ssh_target}: {res.stderr.strip()[-300:]}")
+        return runner
+
+    def probe(self, runner: Runner, server: c.ServerConfig) -> Discovery:
+        home = (
+            str(Path.home())
+            if server.is_local
+            else runner.run(["pwd"], mutating=False).stdout.strip()  # ssh starts in $HOME
+        )
+        conf = runner.run(["sh", "-c", _READ_APACHE], mutating=False).stdout
+        dbs, skipped = self.databases(runner, server)
+        return Discovery(home, apache.parse_vhosts(conf), dbs, skipped)
+
+    def databases(
+        self, runner: Runner, server: c.ServerConfig
+    ) -> tuple[list[str] | None, list[str]]:
+        if not server.db_login:
+            return None, []
+        db = mariadb_for(runner, server)
+        if not db.ping():
+            return None, []
+        ok, skipped = [], []
+        for name in db.list_databases():
+            try:
+                ok.append(v.db_name(name))
+            except v.ValidationError:
+                skipped.append(name)
+        return ok, skipped
+
+    def set_db_login(
+        self, runner: Runner, server: c.ServerConfig, user: str, password: str
+    ) -> bool:
+        """Persist the MariaDB admin login on the server (0600 my.cnf) and verify it."""
+        runner.run(["mkdir", "-p", "-m", "700", server.secrets_dir])
+        put_secret(runner, server.mycnf_path, c.mycnf_text(user, password))
+        server.db_login = True
+        server.db_login = mariadb_for(runner, server).ping()
+        return server.db_login
+
+    def apply(self, req: DiscoverRequest) -> None:
+        server = req.server
+        server.validate()
+        for repo in server.repos.values():
+            repo.validate()
+            if problems := repo.kind_problems():
+                raise ServiceError(f"repo {repo.name}: {repo.kind} repo {'; '.join(problems)}")
+            if repo.kind == "db" and not server.db_login:
+                raise ServiceError(f"repo {repo.name}: no working MariaDB login on {server.label}")
+        if self.base.dry_run:
+            self.echo(f"[dry-run] would save server {server.label} to {self.config_path}")
+            for name in sorted(server.repos):
+                self.echo(f"[dry-run] would set up {server.repository(server.repos[name])}")
+            for name in req.removed:
+                self.echo(f"[dry-run] would remove repo {name} (restic data is kept)")
+            return
+        runner = runner_for(self.base, server)
+        runner.run(["mkdir", "-p", "-m", "700", server.secrets_dir])
+        self._storage_route(runner, server)
+        for repo in sorted(server.repos.values(), key=lambda r: r.name):
+            local = Path(repo.password_file)
+            if not local.is_file():
+                c.write_secret(local, secrets.token_urlsafe(32) + "\n")
+            put_secret(runner, server.password_path(repo), local.read_text())
+            if req.init_repositories:
+                restic = restic_for(runner, server, repo)
+                if restic.is_initialized():
+                    self.echo(f"repository {server.repository(repo)} already initialised")
+                else:
+                    restic.init()
+                    self.echo(f"initialised {server.repository(repo)}")
+        for name in req.removed:
+            server.repos.pop(name, None)
+            schedule.uninstall(self.base, server.label, name, self.units_dir, self.user_units)
+            self.echo(f"removed repo {name} and its timers (restic data is kept)")
+        self.cfg.servers[server.label] = server
+        c.save(self.cfg, self.config_path)
+        self.echo(f"saved server {server.label} to {self.config_path}")
+        if req.install_timers:
+            for repo in server.repos.values():
+                units = schedule.render_units(
+                    server.label, repo.name, repo.schedule, self.python, str(self.config_path)
+                )
+                schedule.install(self.base, units, self.units_dir, self.user_units)
+                self.echo(f"timers enabled for {server.label}/{repo.name}")
+
+    def _storage_route(self, runner: Runner, server: c.ServerConfig) -> None:
+        """Managed block in the SERVER's ~/.ssh/config: how its restic reaches the storage."""
+        st = server.storage
+        text = runner.run(["sh", "-c", _READ_SSH_CONFIG], mutating=False).stdout
+        host = sshconfig.SshHost(
+            sshconfig.storage_label(server.label), st.host, st.user, st.port, st.identity
+        )
+        new = sshconfig.upsert(text, host)
+        if new != text:
+            with _stdin(new) as fh:
+                runner.run(["sh", "-c", _WRITE_SSH_CONFIG], stdin=fh)
+            self.echo(
+                f"updated ~/.ssh/config on {server.label} (Host {sshconfig.storage_alias(server.label)})"
+            )
+
+
+# --- credentials (move servers, their secrets and site DB users between admin boxes) ------
+
+BUNDLE_FORMAT = "ltsbu-credentials/2"
+_CONNECTION_FIELDS = (
+    "ssh_host", "ssh_user", "use_ssh_config", "ssh_port", "ssh_identity",
+    "secrets_dir", "storage", "db_login",
+)  # fmt: skip
+
+
+def credentials_bundle(
+    base: Runner, cfg: c.Config, labels: list[str], db_users: bool = True
+) -> tuple[str, list[str]]:
+    """TOML bundle with config, restic passwords, admin SSH keys and the site DB users.
+    Returns (bundle, warnings)."""
+    import tomli_w
+
+    subset = c.Config(servers={lbl: cfg.server(lbl) for lbl in labels})
+    data: dict[str, Any] = {"format": BUNDLE_FORMAT, **c.to_dict(subset)}
+    warnings: list[str] = []
+    for lbl in labels:
+        server = cfg.servers[lbl]
+        out = data["servers"][lbl]
+        if server.ssh_identity and Path(server.ssh_identity).is_file():
+            out["ssh_private_key"] = Path(server.ssh_identity).read_text()
+        for name, repo in server.repos.items():
+            pw = Path(repo.password_file)
+            if not pw.is_file():
+                raise ServiceError(f"server {lbl} repo {name}: password file missing: {pw}")
+            out["repos"][name]["restic_password"] = pw.read_text().strip()
+            if not (db_users and repo.kind == "db"):
+                continue
+            if not server.db_login:
+                raise ServiceError(
+                    f"server {lbl}: no MariaDB login; cannot read database users (use --no-db-users)"
+                )
+            mdb = mariadb_for(runner_for(base, server), server)
+            per_db: dict[str, list[dict[str, Any]]] = {}
+            for db in repo.databases:
+                users = []
+                for u in mdb.db_users(db):
+                    try:
+                        if u.plugin != NATIVE_PLUGIN:
+                            raise v.ValidationError(f"plugin {u.plugin}")
+                        _validate_user(u)
+                    except v.ValidationError as e:
+                        warnings.append(
+                            f"server {lbl} db {db}: skipping user {u.user}@{u.host} ({e})"
+                        )
+                        continue
+                    users.append(
+                        {"user": u.user, "host": u.host, "password_hash": u.password_hash,
+                         "privileges": u.privileges}
+                    )  # fmt: skip
+                if users:
+                    per_db[db] = users
+            if per_db:
+                out["repos"][name]["db_users"] = per_db
+    return tomli_w.dumps(data), warnings
+
+
+def _validate_user(u: DbUser) -> None:
+    v.db_user(u.user)
+    v.db_host(u.host)
+    v.password_hash(u.password_hash)
+    v.privileges(u.privileges)
+
+
+def _parse_users(where: str, raw: Any) -> dict[str, list[DbUser]]:
+    if not isinstance(raw, dict):
+        raise ServiceError(f"{where}: db_users must be a table of databases")
+    out: dict[str, list[DbUser]] = {}
+    for db, items in raw.items():
+        v.db_name(db)
+        if not isinstance(items, list):
+            raise ServiceError(f"{where}: db_users.{db} must be a list")
+        users = []
+        for item in items:
+            if not isinstance(item, dict) or set(item) != {
+                "user",
+                "host",
+                "password_hash",
+                "privileges",
+            }:
+                raise ServiceError(f"{where}: malformed db_users entry")
+            u = DbUser(
+                item["user"], item["host"], NATIVE_PLUGIN, item["password_hash"], item["privileges"]
+            )
+            _validate_user(u)
+            users.append(u)
+        out[db] = users
+    return out
+
+
+@dataclass
+class CredentialsImportService:
+    base: Runner
+    cfg: c.Config
+    config_path: Path
+    ssh_config_path: Path
+    echo: Echo = print
+
+    def apply(
+        self,
+        text: str,
+        source: str,
+        force: bool = False,
+        write_ssh: bool = True,
+        db_users: bool = True,
+    ) -> list[str]:
+        """Merge a bundle into this admin box. Everything is validated before anything is
+        written. A server that already exists here keeps its local connection settings
+        (they are per admin box), so a DR flow can re-point a server with 'discover' first.
+        Returns warnings."""
+        data = c.parse_toml(text, source)
+        if data.pop("format", None) != BUNDLE_FORMAT:
+            raise ServiceError(
+                f"{source}: not an ltsbu credentials bundle (expected format {BUNDLE_FORMAT})"
+            )
+        keys: dict[str, str] = {}
+        passwords: dict[tuple[str, str], str] = {}
+        users: dict[tuple[str, str], dict[str, list[DbUser]]] = {}
+        for lbl, raw in data.get("servers", {}).items():
+            if "ssh_private_key" in raw:
+                keys[lbl] = raw.pop("ssh_private_key")
+            for name, r in raw.get("repos", {}).items():
+                if "restic_password" in r:
+                    passwords[(lbl, name)] = r.pop("restic_password")
+                if "db_users" in r:
+                    users[(lbl, name)] = _parse_users(
+                        f"server {lbl} repo {name}", r.pop("db_users")
+                    )
+        incoming = c.from_dict(data, source)
+        if not incoming.servers:
+            raise ServiceError(f"{source}: bundle contains no servers")
+        clash = sorted(set(incoming.servers) & set(self.cfg.servers))
+        if clash and not force:
+            raise ServiceError(
+                f"servers already configured: {', '.join(clash)} (use --force to replace)"
+            )
+        for lbl, server in incoming.servers.items():
+            v.label(lbl)
+            local = self.cfg.servers.get(lbl)
+            if local:
+                for f in _CONNECTION_FIELDS:
+                    setattr(server, f, getattr(local, f))
+                keys.pop(lbl, None)
+            elif lbl in keys:
+                server.ssh_identity = str(Path.home() / ".ssh" / f"ltsbu_{lbl}")
+            for name, repo in server.repos.items():
+                if (lbl, name) in passwords:  # re-home: source machine paths mean nothing here
+                    repo.password_file = str(c.config_dir() / "servers" / lbl / f"{name}.pass")
+                repo.validate()
+            server.validate()
+        for (lbl, name), per_db in users.items():
+            repo = incoming.servers[lbl].repos[name]
+            if repo.kind != "db" or not set(per_db) <= set(repo.databases):
+                raise ServiceError(
+                    f"server {lbl} repo {name}: db_users for databases not in the repo"
+                )
+        labels = sorted(incoming.servers)
+        replay = users if db_users else {}
+        if self.base.dry_run:
+            self.echo(f"[dry-run] would import {', '.join(labels)} into {self.config_path}")
+            for (lbl, _), per_db in sorted(replay.items()):
+                for db, us in per_db.items():
+                    for u in us:
+                        self.echo(
+                            f"[dry-run] would create/update database user {u.user}@{u.host} on {lbl}/{db}"
+                        )
+            return []
+        for (lbl, name), pw in passwords.items():
+            c.write_secret(Path(incoming.servers[lbl].repos[name].password_file), pw + "\n")
+        for lbl, key in keys.items():
+            c.write_secret(Path(str(incoming.servers[lbl].ssh_identity)), key)
+        self.cfg.servers.update(incoming.servers)
+        c.save(self.cfg, self.config_path)
+        self.echo(f"imported {', '.join(labels)} into {self.config_path}")
+        if write_ssh:
+            text_ssh = sshconfig.read(self.ssh_config_path)
+            for s in incoming.servers.values():
+                if not s.is_local and not s.use_ssh_config:
+                    host = sshconfig.SshHost(
+                        s.label, s.ssh_host, str(s.ssh_user), s.ssh_port, s.ssh_identity
+                    )
+                    text_ssh = sshconfig.upsert(text_ssh, host)
+            sshconfig.write(self.ssh_config_path, text_ssh)
+            self.echo(f"updated {self.ssh_config_path}")
+        warnings: list[str] = []
+        for (lbl, _), per_db in sorted(replay.items()):
+            server = self.cfg.servers[lbl]
+            try:
+                mdb = mariadb_for(runner_for(self.base, server), server)
+                for db, us in per_db.items():
+                    mdb.apply_users(db, us)
+                    for u in us:
+                        self.echo(f"database user {u.user}@{u.host} ready on {lbl}/{db}")
+            except (ServiceError, CommandError) as e:
+                warnings.append(
+                    f"server {lbl}: database users not created ({e}); "
+                    f"run 'ltsbu discover' for {lbl}, then import again with --force"
+                )
+        prefixes = tuple(f"server {lbl}" for lbl in labels)
+        return warnings + [p for p in c.lint(self.cfg) if p.startswith(prefixes)]