[im-tyler]

Implements decision D3 of the server-authority plan (PLAN_P3_SCREENS_2026-10-20): one backup target per server, read at run time; folderless backup commands with parsed JSON; quiesced restore.

One backup target per server (backup-target-v1)

• teploy server backup-target set --host S --bucket B [--region] [--endpoint] [--prefix] stores it at /etc/teploy/backup-target.json (0600, outside /deployments; ~/.config/teploy fallback for a non-root deploy user, said on output). Credentials arrive on stdin as two lines (access key, then secret; prompted echo-off on a terminal) and are stored age-encrypted with the server identity — identity try-order /etc/teploy/age-key then /deployments/.age-key, coordinating with W2's move. Stored creds decrypt inside the aws invocation's own shell and fail closed; ambient AWS chain only when none stored. show [--json] never emits secrets; unset removes the target.
• set rewrites teploy-generated backup cron lines (by marker) to the backup run form; hand-written commands under a teploy marker (the nucleus-backup pattern) are left alone and reported. teploy doctor gains a backup-cron check: embedded credentials = fail, legacy bucket lines = warn; raw line text never reported.

Folderless JSON commands (backup-json-v1)

• backup create|list|restore|prune|schedule|unschedule --app X --host S default to the stored target; legacy --bucket flags still override it. list --json reports parsed rows {id, kind: volumes|accessory|teploy, accessory?, size_bytes, created_at, key} plus schedules discovered from teploy cron markers (retention joined from the per-app store) — was raw aws s3 ls lines. create --json → id/kind/size/key; restore --json → the quiesced receipt. dr and accessory backup|restore|verify-backup default to the target too.

Quiesced restore

Under the app's fenced lock: stop the app's containers (and a generic accessory's), promote with the two-phase recovery discipline, start again, health-check. On failure — or an unhealthy app afterwards — the pre-restore recovery copy is kept and named. Non-TTY runs require --yes.

backup run — the cron entrypoint

Runs on the server (like autodeploy redeploy), reads target + per-app retention at run time. Cron lines are a single argument-free command; retention lives in a per-app store; failure alerting moved into the run (same alert script, same signatures). Schedule/install refuses when the server binary lacks backup run; an existing binary that has it is never reinstalled.

Events / contracts / docs

Events backup.run, backup.restore, backup_target.set (allowlist id/kind/accessory/error; the server-level set fans out to every app on the server). Contracts corpus rev 14: schemas + generated fixtures for all four new envelopes, version-handshake regenerated. CHANGELOG/README updated; backup: app-config key deferred (cron reconciliation does not fit this change — documented in CHANGELOG).

Tests

Unit tests with the ssh mock for target round-trip, stored-creds invocation, marker classification, cron rewrite (incl. hand-written lines and %-preservation), doctor check, schedule discovery, target resolution and backup run's no-target refusal. go test -race ./..., go vet ./..., gofmt clean.

🤖 Generated with Claude Code