8 Commits

Author	SHA1	Message	Date
Alexander Renz	59a717abe7	refactor(profiles): replace large-db profile with composable LargeDBMode ... BREAKING CHANGE: Removed 'large-db' as standalone profile New Design: - Resource Profiles now purely represent VM capacity: conservative, balanced, performance, max-performance - LargeDBMode is a separate boolean toggle that modifies any profile: - Reduces ClusterParallelism and Jobs by 50% - Forces MaxLocksPerTxn = 8192 - Increases MaintenanceWorkMem TUI Changes: - 'l' key now toggles LargeDBMode ON/OFF instead of applying large-db profile - New 'Large DB Mode' setting in settings menu - Settings are persisted to .dbbackup.conf This allows any resource profile to be combined with large database optimization, giving users more flexibility on both small and large VMs.	2026-01-18 12:39:21 +01:00
Alexander Renz	9c65821250	v3.42.9: Fix all timeout bugs and deadlocks ... CRITICAL FIXES: - Encryption detection false positive (IsBackupEncrypted returned true for ALL files) - 12 cmd.Wait() deadlocks fixed with channel-based context handling - TUI timeout bugs: 60s->10min for safety checks, 15s->60s for DB listing - diagnose.go timeouts: 60s->5min for tar/pg_restore operations - Panic recovery added to parallel backup/restore goroutines - Variable shadowing fix in restore/engine.go These bugs caused pg_dump backups to fail through TUI for months.	2026-01-08 05:56:31 +01:00
Alexander Renz	b856d8b3f8	feat(tui): add Work Directory setting for large archive operations ... - Added WorkDir to Config for custom temp directory - TUI Settings: new 'Work Directory' option to set alternative temp location - Restore Preview: press 'w' to toggle work directory (uses backup dir as default) - Diagnose View: now uses configured WorkDir for cluster extraction - Config persistence: WorkDir saved to .dbbackup.conf This fixes diagnosis/restore failures when /tmp is too small for large archives. Use cases: servers with limited /tmp, 70GB+ archives needing 280GB+ extraction space.	2026-01-06 11:11:22 +01:00
A. Renz	914307ac8f	ci: add golangci-lint config and fix formatting ... - Add .golangci.yml with minimal linters (govet, ineffassign) - Run gofmt -s and goimports on all files to fix formatting - Disable fieldalignment and copylocks checks in govet	2025-12-11 17:53:28 +01:00
Renz	0cf21cd893	feat: Complete MEDIUM priority security features with testing ... - Implemented TUI auto-select for automated testing - Fixed TUI automation: autoSelectMsg handling in Update() - Auto-database selection in DatabaseSelector - Created focused test suite (test_as_postgres.sh) - Created retention policy test (test_retention.sh) - All 10 security tests passing Features validated: ✅ Backup retention policy (30 days, min backups) ✅ Rate limiting (exponential backoff) ✅ Privilege checks (root detection) ✅ Resource limit validation ✅ Path sanitization ✅ Checksum verification (SHA-256) ✅ Audit logging ✅ Secure permissions ✅ Configuration persistence ✅ TUI automation framework Test results: 10/10 passed Backup files created with .dump, .sha256, .info Retention cleanup verified (old files removed)	2025-11-25 15:25:56 +00:00
Renz	86eee44d14	security: Implement MEDIUM priority security improvements ... MEDIUM Priority Security Features: - Backup retention policy with automatic cleanup - Connection rate limiting with exponential backoff - Privilege level checks (warn if running as root) - System resource limit awareness (ulimit checks) New Security Modules (internal/security/): - retention.go: Automated backup cleanup based on age and count - ratelimit.go: Connection attempt tracking with exponential backoff - privileges.go: Root/Administrator detection and warnings - resources.go: System resource limit checking (file descriptors, memory) Retention Policy Features: - Configurable retention period in days (--retention-days) - Minimum backup count protection (--min-backups) - Automatic cleanup after successful backups - Removes old archives with .sha256 and .meta files - Reports freed disk space Rate Limiting Features: - Per-host connection tracking - Exponential backoff: 1s, 2s, 4s, 8s, 16s, 32s, max 60s - Automatic reset after successful connections - Configurable max retry attempts (--max-retries) - Prevents brute force connection attempts Privilege Checks: - Detects root/Administrator execution - Warns with security recommendations - Requires --allow-root flag to proceed - Suggests dedicated backup user creation - Platform-specific recommendations (Unix/Windows) Resource Awareness: - Checks file descriptor limits (ulimit -n) - Monitors available memory - Validates resources before backup operations - Provides recommendations for limit increases - Cross-platform support (Linux, BSD, macOS, Windows) Configuration Integration: - All features configurable via flags and .dbbackup.conf - Security section in config file - Environment variable support - Persistent settings across sessions Integration Points: - All backup operations (cluster, single, sample) - Automatic cleanup after successful backups - Rate limiting on all database connections - Privilege checks before operations - Resource validation for large backups Default Values: - Retention: 30 days, minimum 5 backups - Max retries: 3 attempts - Allow root: disabled - Resource checks: enabled Security Benefits: - Prevents disk space exhaustion from old backups - Protects against connection brute force attacks - Encourages proper privilege separation - Avoids resource exhaustion failures - Compliance-ready audit trail Testing: - All code compiles successfully - Cross-platform compatibility maintained - Ready for production deployment	2025-11-25 14:15:27 +00:00
Renz	a0e7fd71de	security: Implement HIGH priority security improvements ... HIGH Priority Security Features: - Path sanitization with filepath.Clean() for all user paths - Path traversal attack prevention in backup/restore operations - Secure config file permissions (0600 instead of 0644) - SHA-256 checksum generation for all backup archives - Checksum verification during restore operations - Comprehensive audit logging for compliance New Security Module (internal/security/): - paths.go: ValidateBackupPath() and ValidateArchivePath() - checksum.go: ChecksumFile(), VerifyChecksum(), LoadAndVerifyChecksum() - audit.go: AuditLogger with structured event tracking Integration Points: - Backup engine: Path validation, checksum generation - Restore engine: Path validation, checksum verification - All backup/restore operations: Audit logging - Configuration saves: Audit logging Security Enhancements: - .dbbackup.conf now created with 0600 permissions (owner-only) - All archive files get .sha256 checksum files - Restore warns if checksum verification fails but continues - Audit events logged for all administrative operations - User tracking via $USER/$USERNAME environment variables Compliance Features: - Audit trail for backups, restores, config changes - Structured logging with timestamps, users, actions, results - Event details include paths, sizes, durations, errors Testing: - All code compiles successfully - Cross-platform build verified - Ready for integration testing	2025-11-25 12:03:21 +00:00
Renz	e80c16bf0e	Add reliability improvements and config persistence feature ... - Implement context cleanup with sync.Once and io.Closer interface - Add regex-based error classification for robust error handling - Create ProcessManager with thread-safe process tracking - Add disk space caching with 30s TTL for performance - Implement metrics collection with structured logging - Add config persistence (.dbbackup.conf) for directory-local settings - Auto-save/auto-load configuration with --no-config and --no-save-config flags - Successfully tested with 42GB d7030 database (35K large objects, 36min backup) - All cross-platform builds working (9/10 platforms)	2025-11-19 04:43:22 +00:00