mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-archive: forget future-dated snapshots before each prune; fix the grants case

Browse source 
A client chooses a snapshot's time, so snapshots dated ahead could fill
--keep-last and push the real ones out of a prune. The prune now forgets
snapshots dated more than an hour after now first, and logs their ids. The
VM test forges one and checks the real snapshot stays. The bao-grants case
that read a + path as a glob now names the literal path, and two cases that
pinned 'nothing else' list the archive grants. The ciRunner stanza is back
at its original indent.
This commit is contained in:
atlas 2026-11-10 08:32:54 +01:00
commit 793d987a88
1 changed files with 87 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/2-handbook/swarm/archive.md
View file

@ -60,9 +60,14 @@ either rule keeps it:
| `deploy.archive.retention.keepLast` | `3` | the newest this many, however old |
The age rule limits what a compromised hive can do by flooding the archive with
fake snapshots: they can't push the last three days out. Set `keepWithin` to
`null` to leave that rule off. `deploy.archive.pruneSchedule` sets when the
prune runs (default `daily`).
fake snapshots: they can't push the last three days out. restic ranks snapshots
by their date, and a client chooses a snapshot's date, so a client could also
date snapshots years ahead to fill the `keepLast` slots. Before each prune the
archive host forgets every snapshot dated more than an hour ahead of its own
clock and logs `archive prune warning: <agent> has snapshots dated after now`.
A line like that means a hive or its credentials are misbehaving. Set
`keepWithin` to `null` to leave the age rule off. `deploy.archive.pruneSchedule`
sets when the prune runs (default `daily`).
Because the archive host prunes, it reads every agent's restic password from
the secret store and can decrypt every backup. Treat that host as part of the