Repositories
A repository is storage the operator registers for backups to be written to. A chunk repository keeps deduplicated, compressed backups in an S3 bucket, a Ceph pool or a filesystem, encrypted unless a plan opts out. An rbd tier, the instant tier, also keeps recent backups as Ceph images, which restores of new volumes and servers are cloned from where this site serves it; every other restore reads the repository copy. A vault offers a repository to projects. Protection policies place their backups on repositories, plans follow policies, and every backup lives in a repository. This group also covers repository health and usage, the keys of each dedup domain, and the backup workers that move the data.
📄️ List backup workers
The data workers at this site that carry out backups and restores, with their version, capacity, running jobs, last heartbeat and whether they are alive. A worker that cannot reach a repository is sent no work for it.
📄️ List repositories
Operator only: needs a system-scoped token.
📄️ Register a repository
Registers storage that backups are written to. A chunk repository keeps deduplicated backups through the `s3`, `rados` or `posix` driver. An rbd tier keeps recent backups as Ceph images that restores of new volumes and servers are cloned from. Access keys are sealed and never returned. Object lock is available on `s3` only, and the chunk size is fixed for life. Warnings in the answer name what the service cannot check for itself.
📄️ Show repository health
What the last check of each repository at this site found, and the overall verdict.
📄️ Deregister a repository
Removes the registration and leaves the stored data where it is. Refused while a plan is placed on the repository, or while it still holds data under object lock.
📄️ Show a repository
Operator only: needs a system-scoped token.
📄️ Change a repository
Changes the endpoint, region, credentials, reachable sites or object lock. Credentials are replaced as a pair. What decides where data lives, such as the bucket, pool or chunk size, cannot change. Once an object lock's grace period has passed, its mode and granularity are fixed, and its minimum and maximum retention can only rise. A change that would leave a policy or vault unable to keep its terms is refused.
📄️ List a repository's domain keys
Each dedup domain in the repository with its key's fingerprint, never the key itself. Comparing fingerprints confirms another cloud holds the same key before a restore there needs it. A key this cloud cannot unwrap is reported as unreadable, with the reason.
📄️ Export a domain key
Wraps one dedup domain's key under a passphrase, so another cloud can import it and read the backups. Every export is audited. The passphrase is never stored or returned. Send it separately from the envelope.
📄️ Import a domain key
Installs a key exported from another cloud, wrapped under this cloud's own key manager. The repository is this cloud's registration of the storage the key belongs to, whatever either cloud named it. Before anything is kept, the key is checked against that storage: it must open what the dedup domain already holds there, or, in a domain holding nothing yet, the domain's key marker must name the repository and cloud the envelope was exported from. A domain keeps one key for life: importing the same key again changes nothing, and a different one is refused.
📄️ Show a repository's usage
Physical size, what each project references, the saving that deduplication across projects brings, data held under lock and when it is released, and the state of cleanup. A figure with no measurement yet is listed under `unavailable` with the reason.