jcoffey-dev
28128633ef
internal/validate was written and tested and then never called: `run` ended at cutover, so the tool performed a migration and never confirmed it had carried the data across, and `report` was an error message pointing at the package that would have answered. `run` now compares the migrated instance against the snapshot preflight took and fails if an account or a domain that existed before is missing from it. The comparison runs against the service cutover has just started, which is the instance people will actually use - its real config, its real ports, under its real service manager - and costs no extra downtime; booting a second copy inside the maintenance window would. BootCheck stays as the equivalent for an instance the tool boots itself. The service is left running on a failure. By that point the store has been migrated in place, so stopping it undoes nothing, and only the operator can weigh the finding against their recovery point. A check that could not run is reported as skipped, never as a pass. Preflight only captures the "before" when it has an admin URL, and a run without one has to say it compared nothing rather than imply everything survived - which is the exact failure ARCHITECTURE.md §4.7 warns about. `report <run-id>` re-reads the recorded verdict rather than re-checking: run again next week and you would be asking how the instance looks now, not how it looked when it was migrated. §4.7 said validation ran after cutover while the only implementation booted its own copy, and listed a suite far larger than what exists. It now says which of the two happens, and which checks are real.
55 lines
1.4 KiB
Go
55 lines
1.4 KiB
Go
// SPDX-FileCopyrightText: 2026 LINUXexpert-org
|
|
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
// Command stalwart-migrate drives an in-place Stalwart Mail Server upgrade
|
|
// (0.15.5 -> latest) through preflight checks, a defense-in-depth backup,
|
|
// a checkpointed migration, and post-migration validation. Recovery from a
|
|
// failed migration is the operator's own snapshot or backup and is out of
|
|
// scope for this tool - see ARCHITECTURE.md §4.8.
|
|
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
)
|
|
|
|
func main() {
|
|
if len(os.Args) < 2 {
|
|
usage()
|
|
os.Exit(1)
|
|
}
|
|
|
|
var err error
|
|
switch os.Args[1] {
|
|
case "preflight":
|
|
err = runPreflight(os.Args[2:])
|
|
case "rehearse":
|
|
err = runRehearse(os.Args[2:])
|
|
case "run":
|
|
err = runRun(os.Args[2:])
|
|
case "status":
|
|
err = runStatus(os.Args[2:])
|
|
case "report":
|
|
err = runReport(os.Args[2:])
|
|
default:
|
|
usage()
|
|
os.Exit(1)
|
|
}
|
|
|
|
if err != nil {
|
|
fmt.Fprintln(os.Stderr, "stalwart-migrate:", err)
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
|
|
func usage() {
|
|
fmt.Fprintln(os.Stderr, `usage: stalwart-migrate <command> [flags]
|
|
|
|
commands:
|
|
preflight run read-only checks and print the migration plan
|
|
rehearse convert this instance's settings and report what will NOT carry over (read-only)
|
|
run perform the migration (needs --yes and --recovery-point-confirmed)
|
|
status show the state of an in-progress or completed run
|
|
report print the validation report for a run`)
|
|
}
|