snapshots

// The restic repositories a server backs up to, by SSH and restic on that server: for each repository, whether
// restic reads it, and the age of its newest snapshot. A backup that failed leaves no snapshot: the age grows,
// and says it. Each repository is given by two files on the server, which restic reads itself: the file of its
// location (--repository-file) and the file of its password (--password-file). No secret leaves the server,
// none is written on a command line. restic runs with --no-lock, so that it never writes a lock in the
// repository nor waits for a backup running, and --no-cache, so that it writes no cache on the server.
need('protocol:ssh');
$repositories = variable('restic:repositories', 'multiline', array(
    'label' => 'Repositories',
    'help'  => 'One repository per line: the path, on the server, of the file that holds its location, a space, and the path of the file that holds its password, for instance /etc/restic/nas.repository /etc/restic/nas.password.',
));

per('repository', 'Repositories');
output('status', 'text', array('label' => 'Repository read', 'per' => 'repository'));
output('age', 'number', array('label' => 'Age of the newest snapshot', 'unit' => 'h', 'per' => 'repository'));

watch.expect('unreadable', 'Repository unreadable or empty', 'status', array('critical' => array('ok')));
watch.above('old', 'Newest snapshot too old', 'age', array('warning' => 30, 'critical' => 54));
watch.missing('missing', 'Repository missing', 'status', array('enabled' => false));

// A repository is named by the path of the file of its location.
$now = time.now();
$seen = array();
foreach (text.lines($repositories) as $line) {
    $files = text.words($line);
    if (list.count($files) != 2) {
        fail('misconfigured', 'Each line of the repositories must give two paths: the location file and the password file', $line);
    }
    $name = $files[0];
    if (list.has($seen, $name)) {
        continue;
    }
    $seen[$name] = true;

    // Every snapshot of the repository: [{"time": "2026-10-26T01:00:03.123456789+01:00", "hostname": "www",
    // "paths": ["/srv"], "id": "…"}]. The two paths go as arguments, each quoted apart.
    $read = ssh.run('restic snapshots --json --no-lock --no-cache',
        arguments=array('--repository-file', $files[0], '--password-file', $files[1]));

    // restic 0.17.0 and later exit 10 for a repository that does not exist, 0.17.1 and later 12 for a wrong
    // password; the older ones exit 1, and say it.
    if ($read['exit'] != 0) {
        $status = 'unreadable';
        if ($read['exit'] == 12 || text.contains($read['errors'], 'wrong password')) {
            $status = 'wrong-password';
        } elseif ($read['exit'] == 10 || text.contains($read['errors'], 'does not exist')) {
            $status = 'not-found';
        }
        value('status', $status, $name);
        continue;
    }

    $newest = '';
    foreach (json.read(text.trim($read['output'])) as $snapshot) {
        $time = time.parse(list.get($snapshot, 'time', ''), 'iso8601');
        if ($newest == '' || $time > $newest) {
            $newest = $time;
        }
    }
    if ($newest == '') {
        value('status', 'empty', $name);
        continue;
    }
    value('status', 'ok', $name);
    value('age', number.round(($now - $newest) / 3600, 1), $name);
}