Rollback was the one phase gating everything else: `run` without --dry-run
refused because this tool could not undo a cutover it had committed to.
That reason is now gone, and the refusal has narrowed to the fact that
there is no real cutover to undo yet.
internal/rollback implements ARCHITECTURE.md 4.8 as eight checkpointed
steps under PhaseRollback: verify-backup, stop-service,
preserve-failed-state, restore-data, restore-binary,
restore-service-config, start-service, verify-rollback.
Three things depart from what 4.8 specified, each for a reason:
- The backup is re-verified against its manifest *before* the service is
stopped, which the design didn't call out. Finding a corrupt backup is
survivable while the failed instance is still up, and unsurvivable once
its data directory has been moved aside.
- BuildPlan is separate from Run, so every reason to refuse (closed
rollback window, FoundationDB, no recorded backup, unknown deployment
kind, missing database credentials) is found before anything is touched.
The CLI prints that resolved plan and acts only with --yes.
- The restore is re-verified against the same manifest after writing. A
restore that put back truncated bytes and reported success would be
worse than one that failed outright.
Nothing from the failed attempt is deleted: the half-migrated data
directory and the displaced binary are moved to .failed-<run-id> names, so
a retry after the underlying issue is fixed still has both the evidence and
the artifacts. Afterwards a reduced validation suite runs against the
*restored* instance (version, reachability, directory counts) rather than
assuming the restore worked.
internal/service is a new package holding the systemd/Docker control this
needs. It's separate rather than living inside internal/rollback because
cutover will need the identical operations, and because the commands that
can take mail delivery down belong in one auditable place - the same
reasoning that makes stalwartapi the only thing speaking JMAP.
preflight.DeploymentKind is now a type alias for service.Kind so detection
and control can't drift apart. Its Active() reads `systemctl is-active`'s
output rather than its exit status: systemctl exits non-zero for every
non-active state, so exit-status logic would make "inactive" - the answer a
rollback most needs - look like a failure to read the state at all.
Also fixes a pre-existing bug in `status`: Go's flag package stops parsing
at the first positional argument, so `status <run-id> --state-dir X` looked
the run up in the default directory and reported it missing. `rollback`
would have inherited the same footgun on a command whose flags decide what
gets overwritten.
Still open: `confirm` cannot set RollbackWindowClosed. Rollback honours the
flag and refuses when it's set, but closing the window is the point of no
return for the backups this restores from, so it should land with the
retention policy 6 describes rather than before it.
Verified end to end against a fake systemd deployment: half-migrated data
restored to its original contents, failed state preserved, old binary
reinstalled and reporting 0.15.5, unit restarted, and a re-run of the
completed rollback inert.
The old README was wrong in both directions. It called the project
"architected, not yet implemented" while ~6,000 lines of tested code
exist across backup, preflight, checkpointing, validation and recovery;
and it listed six subcommands as a flat menu when three of them return
"not implemented yet" and a fourth refuses unless given --dry-run.
Replaced with a per-command and per-package status table, each entry
checked against the binary rather than the design doc: rollback, confirm
and report were run to confirm they error out, and the package line
counts come from the tree.
Records why `run` refuses without --dry-run -- internal/rollback is a
doc.go and nothing else, and committing to a migration with no working
rollback would break the one guarantee the tool exists to make. That
refusal is correct behaviour today, not a defect to be filed.
Corrects a claim in my own first draft: preflight is not purely
read-only. Its checks against the Stalwart install are, but it records
the run as a checkpoint first, so it fails without write access to
/var/lib/stalwart-migrator -- a compile-time constant with no flag or
env override. Found by running it.
Rename module github.com/johnellis/stalwart-migrator ->
github.com/LINUXexpert-org/stalwart-migrator to match the repository
location, so the module resolves under `go get`.
The initial commit's .gitignore listed the compiled binary as a bare
`stalwart-migrate` pattern, which Git matches at any depth -- so it also
excluded the cmd/stalwart-migrate/ source directory, and the initial
commit shipped without the CLI entrypoint. Anchor the pattern to the
repo root as /stalwart-migrate and add the four missing files.
go build, go vet, and go test ./... all pass.
In-place upgrade tool for Stalwart Mail Server (0.15.5 -> latest) with
checkpointed rollback and post-migration validation. Design stage; see
ARCHITECTURE.md.
jcoffey-dev