fix(backrest): register the backup-contract hooks, don't just write them (2.1.0)

[pofallon]

Closes #159.

The gap

2.0 writes /config/hola/backup-prepare.sh and backup-finalize.sh and stops.

Backrest has no global hooks. Hook hangs off Repo and Plan only (proto/v1/config.proto), so a script on disk is never called until it is attached to a repository — and at install time there is no repository to attach it to; the operator creates one later, in the UI.

So unless the operator hand-wired two Command hooks, the broker was never invoked and every snapshot was a live-file copy. Meanwhile Hola's dashboard — which only knows this app declares provides: backup@1 — reported the accepting apps as quiesced. Both facts the operator saw were wrong in the reassuring direction.

The fix

A third service, backrest-hola-autowire, that attaches both hooks to every repository and keeps them attached. A repository created next month is wired within 30 seconds.

Through Backrest's API, not the config file. ConfigManager caches the parsed config in memory and invalidates only on its own writes, so editing config.json under a running Backrest is read back only after a restart, and the next UI save silently overwrites it. SetConfig is the same path the UI takes: modno gives optimistic concurrency (a mismatch is refused; the next pass re-reads), and GetConfig does not redact repository passwords, so a read-modify-write round-trip preserves them.

At repository level, not plan level. TasksTriggeredByEvent iterates the repo's hooks for every plan backing onto it, so one wiring covers every plan the operator ever adds.

mikefarah/yq is the image Homepage's bolt-on already uses. It carries yq (native JSON), BusyBox wget (POST with headers) and a shell — the three things this needs, digest-pinned, no custom build.

BACKREST_HOLA_AUTOWIRE=false hands the hooks back to the operator: nothing is added, nothing already present is removed. Hand-wired hooks are recognised by command path and left alone, so an operator who followed the old README sees no change.

Backrest's own login is disabled by default (config.NewDefaultConfig sets auth.disabled) and Hola gates the app at Traefik, so the call needs no credential. If an operator enables Backrest's login, the reconciler says so once and keeps trying.

Verified, not assumed

Against a real backrest:v1.14.1 with a real restic repo and a stub broker:

• hooks registered on the first pass, idempotent on the second
• a repository added afterwards wired on the next pass; quiet in between
• CONDITION_SNAPSHOT_START fired the prepare script, which POSTed /api/contracts/backup/prepare with its Bearer token, polled /status/:id until completed, and let the snapshot proceed
• CONDITION_SNAPSHOT_END fired finalize
• fail-closed holds: with the broker unreachable the prepare hook exited 1 and ON_ERROR_CANCEL cancelled the backup — snapshot start hook: task cancelled: exit status 1, no snapshot taken
• repository password survived the round-trip
• opt-out and an unreachable Backrest both stay running, no crash-loop

Clean against bin/validate-manifest.mjs and Hola's validateComposeDocument.

Still open after this

apps#153 (postiz's second Postgres has no participation) and its blocker apps#152 (the schema forbids plural participations). Separately, try-hola/hola#470 fixes the coverage recogniser that made postiz read quiesced instead of partial.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vck5KSX2CLxhohx14nb5Sh