mixandClaude Opus 5.5
dd0fefdcb7
Owner, 2026-10-11: the private key is needed, and a backup from the panel and one from the console have to be the same. The commit that made the panel's backup work skipped a file under certs/ the panel could not open - on the test server the private key, which the certificate hook leaves to root and Postfix's group. That gave an archive with a certificate and no key, and two kinds of archive. - Params.Unprivileged is gone. Nothing is left out on account of who makes the archive; the queue is out for everyone (previous commit). - When the panel cannot read a file under certs/, backup.Check says so before the download and the panel refuses with what to do on the host: chgrp 998 certs/privkey.pem && chmod 640. backup.UnreadableCert tells that case from any other failure. - 998 is the container's selfpost group, which holds the panel and Postfix. Its id was whatever groupadd gave; the Dockerfile now fixes it at the value it has always had, because an operator addresses it by number from the host. - Guide: method 1 is the same archive as method 2, with the permission the key needs and a note for whatever renews the certificate. Help and the box follow the design commit before this one. - e2e: the restore scenario first makes the key unreadable and expects the refusal naming the file and the way out, then takes the backup and expects the key in it; nothing is put back by hand before the restart. go vet ./internal/backup/ ./internal/web/handlers/: ok go test ./internal/backup/ ./cmd/... ./internal/web/...: ok make e2e on the test server: ok Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
49 lines
3.4 KiB
HTML
49 lines
3.4 KiB
HTML
{{/* Backup (mockup backup.html): the whole instance in one archive, and one
|
|
domain brought in from another SelfPost. Two boxes, each its own form and
|
|
its own POST; a refusal of either comes back as the flash above them. The
|
|
password fields of the full backup are shown when the box is ticked (panel.js
|
|
reads data-encrypt-toggle / data-encrypt-fields); the import asks for a
|
|
password only for an encrypted file (data-import-file /
|
|
data-import-password-fields). Without scripts all of them are visible. */}}
|
|
{{define "content"}}
|
|
{{template "page_head" .Head}}
|
|
{{if .Flash}}{{template "flash" .Flash}}{{end}}
|
|
|
|
<div class="columns">
|
|
<div class="column is-6">
|
|
{{template "box_open" .Full}}
|
|
{{template "body_open"}}
|
|
<p class="mb-3"><code>data/</code> (database, DKIM keys, credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code> in one archive. The Postfix queue is left out: it cannot be copied reliably while the server is running. Restore into an empty project directory and start the <strong>same SelfPost version</strong>. The reverse-proxy vhost is not included.</p>
|
|
<form class="sp-form" method="post" action="{{.FullAction}}">
|
|
<div class="field"><label class="checkbox"><input type="checkbox" name="encrypt" value="1"{{if .Encrypt}} checked{{end}} data-encrypt-toggle> Encrypt with a password (<code>.spbk</code>)</label></div>
|
|
<div data-encrypt-fields>
|
|
<div class="sp-pair">
|
|
<div class="field"><label class="label" for="encpw">Password</label><div class="control"><input class="input" id="encpw" name="password" type="password" autocomplete="new-password" minlength="{{.PasswordMin}}" placeholder="at least {{.PasswordMin}} characters"></div></div>
|
|
<div class="field"><label class="label" for="encpw2">Repeat password</label><div class="control"><input class="input" id="encpw2" name="password_confirm" type="password" autocomplete="new-password"></div></div>
|
|
</div>
|
|
<p class="help mb-3">Keep this password: SelfPost does not store it, and the file cannot be opened without it.</p>
|
|
</div>
|
|
<button type="submit" class="button is-primary"><i class="ti ti-download"></i>Download full backup</button>
|
|
</form>
|
|
{{template "body_close"}}
|
|
{{template "box_close"}}
|
|
</div>
|
|
|
|
<div class="column is-6">
|
|
{{template "box_open" .Import}}
|
|
{{template "body_open"}}
|
|
<p class="mb-3">A domain export from another instance — plain <code>.json</code> or encrypted <code>.spde</code>. Its DKIM key and application passwords come across, so the published DNS needs no change. The export itself is made on the domain's settings page.</p>
|
|
<form class="sp-form" method="post" action="{{.ImportAction}}" enctype="multipart/form-data">
|
|
<div class="field"><label class="label" for="importfile">Domain export file</label>
|
|
<div class="control"><input class="input" id="importfile" name="file" type="file" accept=".json,.spde,application/json" required data-import-file></div></div>
|
|
<div class="field" data-import-password-fields><label class="label" for="importpw">Password</label>
|
|
<div class="control"><input class="input" id="importpw" name="import_password" type="password" autocomplete="off"></div>
|
|
<p class="help">Asked only for an encrypted <code>.spde</code> file.</p></div>
|
|
<button type="submit" class="button is-primary"><i class="ti ti-file-import"></i>Import domain</button>
|
|
</form>
|
|
{{template "body_close"}}
|
|
{{template "box_close"}}
|
|
</div>
|
|
</div>
|
|
{{end}}
|