backup-drill: selective bundle extract on decoupled restore (avoid drill-VM ENOSPC) #214

Sammanfogat

supernaut sammanfogade 1 incheckning från fix/drill-selective-extract-decoupled in i main

2026-07-23 18:33:58 +00:00

supernaut kommenterad

2026-07-23 18:22:10 +00:00

Ägare

Problem

The restore drill ENOSPC'd on the throwaway VM while unpacking the bundle when the latest off-site
archive is a legacy (pre-decoupling) one. Those archives still bundle forgejo-storage.tar.gz
(~8 GB). The on-VM restore script extracted the whole bundle (including that tarball) and then
restic restored the storage tier separately — so the bundled ~8 GB tarball is dead weight that,
together with the restic-restored copy, overflows the drill VM's root filesystem
(tar: forgejo-storage.tar.gz: Wrote only 6656 of 10240 bytes).

Transition-window only: slim (post-decoupling) archives don't contain the tarball. But left unfixed
it would fail the weekly drill for the whole 14-day retention window while legacy archives age out.

Fix

When restoring decoupled (/root/restic.env present), extract the bundle with
--exclude=forgejo-storage.tar.gz — the storage tier comes from restic, so the bundled copy is
skipped. This is the same selective-extract approach the ADR-0031 rehearsal play already uses, and a
no-op for slim archives. Follow-up to #211 / #212 / #213.

Impact

No data risk. The failed drill tore its VM down cleanly; no orphaned resources.
Restores DR-drill coverage during the transition window.

## Problem The restore drill ENOSPC'd on the throwaway VM while unpacking the bundle when the latest off-site archive is a **legacy (pre-decoupling)** one. Those archives still bundle `forgejo-storage.tar.gz` (~8 GB). The on-VM restore script extracted the **whole** bundle (including that tarball) **and** then `restic restore`d the storage tier separately — so the bundled ~8 GB tarball is dead weight that, together with the restic-restored copy, overflows the drill VM's root filesystem (`tar: forgejo-storage.tar.gz: Wrote only 6656 of 10240 bytes`). Transition-window only: slim (post-decoupling) archives don't contain the tarball. But left unfixed it would fail the weekly drill for the whole 14-day retention window while legacy archives age out. ## Fix When restoring **decoupled** (`/root/restic.env` present), extract the bundle with `--exclude=forgejo-storage.tar.gz` — the storage tier comes from restic, so the bundled copy is skipped. This is the same selective-extract approach the ADR-0031 rehearsal play already uses, and a no-op for slim archives. Follow-up to #211 / #212 / #213. ## Impact - No data risk. The failed drill tore its VM down cleanly; no orphaned resources. - Restores DR-drill coverage during the transition window.

supernaut lade till 1 incheckning

2026-07-23 18:22:10 +00:00

backup-drill: selective bundle extract on decoupled restore (skip legacy storage tarball, avoid ENOSPC)

ci / ci (pull_request) Successful in 1m23s

Detaljer

d515aa4be8