URBM/internal/restic/restic.go

package restic

import (
	"bufio"
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"log/slog"
	"os"
	"os/exec"
	"path/filepath"
	"strings"

	"github.com/backupper-unraid/backupper/internal/model"
)

type SecretGetter interface{ Get(string) (string, error) }

type Runner struct {
	Binary     string
	RuntimeDir string
	Secrets    SecretGetter
	Log        *slog.Logger
}

type Summary struct {
	MessageType string `json:"message_type"`
	SnapshotID  string `json:"snapshot_id"`
	DataAdded   int64  `json:"data_added"`
	FilesNew    int64  `json:"files_new"`
}

func (r *Runner) Init(ctx context.Context, repo model.Repository) error {
	return r.run(ctx, repo, []string{"init"}, nil, nil)
}

func (r *Runner) Backup(ctx context.Context, repo model.Repository, job model.Job, sources []string) (Summary, error) {
	args := []string{"backup", "--json", "--compression", job.Compression}
	for _, tag := range append([]string{"backupper", "job:" + job.ID}, job.Tags...) {
		args = append(args, "--tag", tag)
	}
	for _, exclude := range job.Excludes {
		args = append(args, "--exclude", exclude)
	}
	args = append(args, sources...)
	var summary Summary
	err := r.run(ctx, repo, args, func(line []byte) {
		var candidate Summary
		if json.Unmarshal(line, &candidate) == nil && candidate.MessageType == "summary" {
			summary = candidate
		}
	}, nil)
	return summary, err
}

func (r *Runner) Forget(ctx context.Context, repo model.Repository, job model.Job) error {
	args := []string{"forget", "--tag", "job:" + job.ID, "--keep-daily", fmt.Sprint(job.Retention.Daily), "--keep-weekly", fmt.Sprint(job.Retention.Weekly), "--keep-monthly", fmt.Sprint(job.Retention.Monthly)}
	return r.run(ctx, repo, args, nil, nil)
}

func (r *Runner) Check(ctx context.Context, repo model.Repository) error {
	return r.run(ctx, repo, []string{"check"}, nil, nil)
}
func (r *Runner) Prune(ctx context.Context, repo model.Repository) error {
	return r.run(ctx, repo, []string{"prune"}, nil, nil)
}

func (r *Runner) Snapshots(ctx context.Context, repo model.Repository) ([]model.Snapshot, error) {
	var output []byte
	err := r.run(ctx, repo, []string{"snapshots", "--json"}, nil, &output)
	if err != nil {
		return nil, err
	}
	var snapshots []model.Snapshot
	if err := json.Unmarshal(output, &snapshots); err != nil {
		return nil, fmt.Errorf("decode snapshots: %w", err)
	}
	return snapshots, nil
}

func (r *Runner) List(ctx context.Context, repo model.Repository, snapshot, path string) ([]map[string]any, error) {
	args := []string{"ls", snapshot, "--json"}
	if path != "" {
		args = append(args, path)
	}
	var output []byte
	if err := r.run(ctx, repo, args, nil, &output); err != nil {
		return nil, err
	}
	items := []map[string]any{}
	scanner := bufio.NewScanner(strings.NewReader(string(output)))
	for scanner.Scan() {
		var item map[string]any
		if json.Unmarshal(scanner.Bytes(), &item) == nil && item["struct_type"] == "node" {
			items = append(items, item)
		}
		if len(items) >= 5000 {
			break
		}
	}
	return items, scanner.Err()
}

func (r *Runner) Restore(ctx context.Context, repo model.Repository, task model.RestoreTask) error {
	args := []string{"restore", task.SnapshotID, "--target", task.Target}
	for _, include := range task.Includes {
		args = append(args, "--include", include)
	}
	return r.run(ctx, repo, args, nil, nil)
}

func (r *Runner) run(ctx context.Context, repo model.Repository, args []string, onLine func([]byte), capture *[]byte) error {
	password, err := r.Secrets.Get(repo.PasswordRef)
	if err != nil {
		return fmt.Errorf("authentication: load repository password: %w", err)
	}
	secretDir := filepath.Join(r.RuntimeDir, "secrets")
	if err := os.MkdirAll(secretDir, 0700); err != nil {
		return err
	}
	f, err := os.CreateTemp(secretDir, "restic-password-*")
	if err != nil {
		return err
	}
	passwordPath := f.Name()
	defer os.Remove(passwordPath)
	if err := f.Chmod(0600); err != nil {
		f.Close()
		return err
	}
	if _, err := io.WriteString(f, password); err != nil {
		f.Close()
		return err
	}
	if err := f.Close(); err != nil {
		return err
	}

	globalArgs := []string{"-r", repositoryLocation(repo)}
	credentialPath := ""
	if repo.Type == model.RepositorySFTP && repo.CredentialRef != "" {
		privateKey, err := r.Secrets.Get(repo.CredentialRef)
		if err != nil {
			return fmt.Errorf("authentication: load SFTP private key: %w", err)
		}
		keyFile, err := os.CreateTemp(secretDir, "sftp-key-*")
		if err != nil {
			return err
		}
		credentialPath = keyFile.Name()
		defer os.Remove(credentialPath)
		if err := keyFile.Chmod(0600); err != nil {
			keyFile.Close()
			return err
		}
		if _, err := io.WriteString(keyFile, privateKey); err != nil {
			keyFile.Close()
			return err
		}
		if err := keyFile.Close(); err != nil {
			return err
		}
		knownHosts := repo.Options["knownHostsPath"]
		command := "ssh -i " + credentialPath + " -o IdentitiesOnly=yes -o UserKnownHostsFile=" + knownHosts + " -o StrictHostKeyChecking=yes"
		globalArgs = append(globalArgs, "-o", "sftp.command="+command)
	}
	fullArgs := append(globalArgs, args...)
	cmd := exec.CommandContext(ctx, r.Binary, fullArgs...)
	cmd.Env = []string{"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "HOME=/root", "RESTIC_PASSWORD_FILE=" + passwordPath}
	stdout, err := cmd.StdoutPipe()
	if err != nil {
		return err
	}
	stderr, err := cmd.StderrPipe()
	if err != nil {
		return err
	}
	if err := cmd.Start(); err != nil {
		return classify(err)
	}
	var captured []byte
	done := make(chan struct{})
	go func() {
		scanner := bufio.NewScanner(stdout)
		scanner.Buffer(make([]byte, 64*1024), 2*1024*1024)
		for scanner.Scan() {
			line := append([]byte(nil), scanner.Bytes()...)
			if capture != nil {
				captured = append(captured, line...)
				captured = append(captured, '\n')
			}
			if onLine != nil {
				onLine(line)
			}
		}
		close(done)
	}()
	errBytes, _ := io.ReadAll(io.LimitReader(stderr, 1024*1024))
	err = cmd.Wait()
	<-done
	if capture != nil {
		*capture = captured
	}
	if err != nil {
		message := redact(string(errBytes), repo)
		if errors.Is(ctx.Err(), context.Canceled) {
			return fmt.Errorf("cancelled: %w", ctx.Err())
		}
		return fmt.Errorf("restic: %s: %w", strings.TrimSpace(message), err)
	}
	return nil
}

func repositoryLocation(repo model.Repository) string {
	if repo.Type == model.RepositorySFTP && !strings.HasPrefix(repo.Location, "sftp:") {
		return "sftp:" + repo.Location
	}
	return repo.Location
}

func redact(value string, repo model.Repository) string {
	value = strings.ReplaceAll(value, repo.Location, "[repository]")
	return value
}

func classify(err error) error {
	if errors.Is(err, exec.ErrNotFound) {
		return fmt.Errorf("environment: restic binary not found: %w", err)
	}
	return err
}