Phase 9: full backup/restore + domain export/import (spec 7.5, 11.6)

Full server backup (spec 7.5.A): internal/backup produces a tar.gz of all of
/data — a consistent SQLite snapshot via VACUUM INTO, DKIM keys, sasldb2 and a
version manifest; TLS certs (tls/) and the Postfix queue are excluded. Two equal
paths: the panel button (POST /backup, no-store) and the selfpost-backup CLI via
docker exec (spec 11.6). CheckRestore runs before store.Open: a manifest version
mismatch refuses to boot with the image tag to use; a match consumes the
manifest so it only guards the first post-restore boot. Restore is not a
separate branch — Postfix/OpenDKIM regenerate from the restored SQLite as on any
start.

Domain export/import (spec 7.5.B): DomainExport carries the DKIM private key and
each application's working password. SASL secrets are read from sasldb2 via
db_dump (the userPassword property is plaintext) and, on import, re-keyed under
the local realm with saslpasswd2 — so credentials keep working on an instance
with a different hostname, with no DKIM DNS change. Import validates and rolls
back atomically on any failure. db-util (db_dump) is now an explicit image dep.

Verified on the server (selfpost:p9): gofmt/vet/test green; container e2e for
cross-realm domain export/import (SMTP AUTH 235 under the new realm), CLI and
panel backups, same-version restore, and version-mismatch refusal.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cmd/panel/httpserver.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"codeberg.org/mix/selfpost/internal/app"
+	"codeberg.org/mix/selfpost/internal/buildinfo"
 	"codeberg.org/mix/selfpost/internal/domain"
 	"codeberg.org/mix/selfpost/internal/postfix"
 	"codeberg.org/mix/selfpost/internal/store"
@@ -28,6 +29,9 @@ func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
 		Hostname:     cfg.hostname,
 		CookieSecure: cfg.cookieSecure,
 		MailLogPath:  cfg.mailLog,
+		DataDir:      cfg.dataDir,
+		DBPath:       cfg.dbPath,
+		Version:      buildinfo.Version,
 	}, cfg.setupTokenPath)
 	if err != nil {
 		return err

cmd/panel/main.go

@@ -19,6 +19,7 @@ import (
 	"sync"
 	"syscall"
 
+	"codeberg.org/mix/selfpost/internal/backup"
 	"codeberg.org/mix/selfpost/internal/buildinfo"
 	"codeberg.org/mix/selfpost/internal/logtail"
 	"codeberg.org/mix/selfpost/internal/store"
@@ -51,6 +52,7 @@ type config struct {
 
 	dataDir        string
 	dbPath         string
+	manifestPath   string
 	setupTokenPath string
 	hostname       string
 	cookieSecure   bool
@@ -75,6 +77,7 @@ func loadConfig() config {
 
 		dataDir:        dataDir,
 		dbPath:         envDefault("SELFPOST_DB_PATH", filepath.Join(dataDir, "selfpost.db")),
+		manifestPath:   filepath.Join(dataDir, backup.ManifestName),
 		setupTokenPath: envDefault("SELFPOST_SETUP_TOKEN_FILE", filepath.Join(dataDir, "setup-token")),
 		hostname:       os.Getenv("SELFPOST_HOSTNAME"),
 		// Secure cookies by default (spec 7.6.6); PANEL_COOKIE_SECURE=false is a
@@ -140,6 +143,14 @@ func run() error {
 
 	log.Printf("starting selfpost panel %s", buildinfo.Version)
 
+	// Restore version guard (spec 7.5.A): if a backup was extracted into /data,
+	// its manifest version must match this binary before we touch the database,
+	// so schema/format skew between versions cannot corrupt the restored state.
+	// A match consumes the manifest; its absence is the normal (non-restore) case.
+	if err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version); err != nil {
+		return err
+	}
+
 	// One database handle shared by every role. The store serialises writes
 	// (MaxOpenConns(1)), so the HTTP panel, the journal-milter and the tailer
 	// can all use it without stepping on each other under WAL.

cmd/selfpost-backup/main.go

@@ -1,20 +1,29 @@
-// Command selfpost-backup produces (and helps restore) the full persistent-state
-// archive from inside the container, invoked via `docker exec` for scripted/cron
-// backups — the CLI equivalent of the panel's backup button (spec 7.5.A, 11.6).
+// Command selfpost-backup produces the full persistent-state archive from inside
+// the container, invoked via `docker exec` for scripted/cron backups — the CLI
+// equivalent of the panel's backup button (spec 7.5.A, 11.6).
 //
-// This is the Phase 0 skeleton: it only reports its version. The actual archive
-// logic lands in Phase 9.
+// By default the gzip-compressed tar is written to stdout, so the usual form is:
+//
+//	docker exec <container> selfpost-backup > selfpost-backup.tar.gz
+//
+// Use -o to write to a file instead. The resulting archive contains DKIM private
+// keys, the admin password hash and SASL credentials — treat it as a secret
+// (spec 7.5.A).
 package main
 
 import (
 	"flag"
 	"fmt"
+	"os"
+	"path/filepath"
 
+	"codeberg.org/mix/selfpost/internal/backup"
 	"codeberg.org/mix/selfpost/internal/buildinfo"
 )
 
 func main() {
 	showVersion := flag.Bool("version", false, "print version and exit")
+	out := flag.String("o", "", "write the archive to this file instead of stdout")
 	flag.Parse()
 
 	if *showVersion {
@@ -22,5 +31,43 @@ func main() {
 		return
 	}
 
-	fmt.Printf("selfpost-backup %s (skeleton)\n", buildinfo.Version)
+	if err := run(*out); err != nil {
+		fmt.Fprintf(os.Stderr, "selfpost-backup: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func run(outPath string) error {
+	dataDir := envDefault("SELFPOST_DATA_DIR", "/data")
+	dbPath := envDefault("SELFPOST_DB_PATH", filepath.Join(dataDir, "selfpost.db"))
+
+	w := os.Stdout
+	if outPath != "" {
+		// Backups are secret; create them owner-only.
+		f, err := os.OpenFile(outPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)
+		if err != nil {
+			return err
+		}
+		defer f.Close()
+		w = f
+	}
+
+	if err := backup.Create(w, backup.Params{
+		DataDir: dataDir,
+		DBPath:  dbPath,
+		Version: buildinfo.Version,
+	}); err != nil {
+		return err
+	}
+	if outPath != "" {
+		fmt.Fprintf(os.Stderr, "selfpost-backup: wrote %s (SelfPost %s)\n", outPath, buildinfo.Version)
+	}
+	return nil
+}
+
+func envDefault(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
 }