Migrations into this server: inbuxa:Migration

jcoffey-dev commented

2026-10-31 02:56:18 +00:00

Owner

An administrator moves a domain into this server from inbuxa Admin, without a machine of their own to run inbuxa-migrate on. The server keeps the guide's answers as an inbuxa:Migration and runs the bundled inbuxa-migrate on them. Spec: docs/spec/features/migrations.md (MG-1 to MG-14).

Actions: preview, move, final pass, stop, the new accounts' passwords (once, as a blob), close (deletes the work directory). Destroy is refused.
sysMigrationRun: in the built-in Administrator role and granted once to existing administrator roles. A tenant administrator is refused.
The child writes as the administrator who started the migration, using a run token held in this node's memory. The token is taken only from loopback, never cached, ends with the run, and is audited as via: migration. It can't manage migrations.
The source's secret is held in memory and passed in the child's environment, which holds only it, the token and PATH. The audit log never has it.
The image carries inbuxa-migrate 27.1-rc.8 at /usr/local/bin/inbuxa-migrate, pinned by its checksums, with its licenses under /usr/share/doc/inbuxa-migrate.
A run whose node restarted, or went quiet for five minutes, is marked interrupted. An action that reaches another node is refused, naming the node, for now.

Tests:

system::migration::migration_tests with a stand-in engine: passes.
system::migration::migration_real_engine_tests, on demand, runs the real inbuxa-migrate (the 27.1-rc.8 release binary) against a Dovecot from tests/resources/migrations/dovecot-source: passes. The move creates both accounts, their passwords sign them in, their mail and folders are there, and the final pass brings over mail that arrived after the move.
Unit tests in the changed crates, cargo test --workspace --no-run, fmt, and the tools/fork checks pass.

Not yet: sealing an action over to the node a migration runs on, and the inbuxa Admin page.

An administrator moves a domain into this server from inbuxa Admin, without a machine of their own to run inbuxa-migrate on. The server keeps the guide's answers as an `inbuxa:Migration` and runs the bundled inbuxa-migrate on them. Spec: `docs/spec/features/migrations.md` (MG-1 to MG-14). - Actions: preview, move, final pass, stop, the new accounts' passwords (once, as a blob), close (deletes the work directory). Destroy is refused. - `sysMigrationRun`: in the built-in Administrator role and granted once to existing administrator roles. A tenant administrator is refused. - The child writes as the administrator who started the migration, using a run token held in this node's memory. The token is taken only from loopback, never cached, ends with the run, and is audited as `via: migration`. It can't manage migrations. - The source's secret is held in memory and passed in the child's environment, which holds only it, the token and `PATH`. The audit log never has it. - The image carries inbuxa-migrate 27.1-rc.8 at `/usr/local/bin/inbuxa-migrate`, pinned by its checksums, with its licenses under `/usr/share/doc/inbuxa-migrate`. - A run whose node restarted, or went quiet for five minutes, is marked interrupted. An action that reaches another node is refused, naming the node, for now. Tests: - `system::migration::migration_tests` with a stand-in engine: passes. - `system::migration::migration_real_engine_tests`, on demand, runs the real inbuxa-migrate (the 27.1-rc.8 release binary) against a Dovecot from `tests/resources/migrations/dovecot-source`: passes. The move creates both accounts, their passwords sign them in, their mail and folders are there, and the final pass brings over mail that arrived after the move. - Unit tests in the changed crates, `cargo test --workspace --no-run`, fmt, and the tools/fork checks pass. Not yet: sealing an action over to the node a migration runs on, and the inbuxa Admin page.

jcoffey-dev added 1 commit 2026-10-31 02:56:18 +00:00

Migrations into this server: inbuxa:Migration

ci / fork-checks (pull_request) Skipped

Details

ci / build (pull_request) Skipped

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 11m8s

Details

fdf6d9df5d

An administrator moves a domain in from inbuxa Admin. The server keeps
the guide's answers as an inbuxa:Migration and runs the bundled
inbuxa-migrate on them as a child process: preview, move, final pass,
stop, the new passwords once, close. Spec: docs/spec/features/migrations.md.

- sysMigrationRun, for administrators only; a tenant is refused.
- The child writes as the administrator who started the migration, with a
  run token held in memory, taken from loopback only and never cached, and
  audited as via: migration.
- The source's secret is held in memory and passed in the child's
  environment, which holds only it, the token and PATH.
- The image carries inbuxa-migrate 27.1-rc.8, pinned by checksum.
- Tests: system::migration with a stand-in engine, and on demand the real
  engine against a Dovecot (tests/resources/migrations/dovecot-source).

jcoffey-dev merged commit 81dd538347 into main

2026-10-31 03:07:42 +00:00

jcoffey-dev deleted branch feat/migrations

2026-10-31 03:07:43 +00:00

jcoffey-dev referenced this pull request

2026-10-31 03:54:25 +00:00

Migrations: a Management menu link; passwords to whoever takes them #276

Migrations into this server: inbuxa:Migration #275