[PATCH proxmox-backup v2 27/43] sync: push: allow to set retention timestamp for synced snapshots

[Christian Ebner <c.ebner@proxmox.com>]

Allow the push sync job to present the retention timestamp when
pushing the snapshot to the remote, if the remote supports it.

The timestamp is calculated based on the start time of the sync job
by push parameter construction.

Never propagate any retention timestamp present in the source
manifest, keeping them strictly separated.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 src/api2/push.rs   | 11 +++++++++--
 src/server/push.rs | 36 ++++++++++++++++++++++++++++++++----
 src/server/sync.rs |  1 +
 3 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/src/api2/push.rs b/src/api2/push.rs
index 8d053c00e..714971ac9 100644
--- a/src/api2/push.rs
+++ b/src/api2/push.rs
@@ -5,8 +5,9 @@ use pbs_api_types::{
     Authid, BackupNamespace, CRYPT_KEY_ID_SCHEMA, DATASTORE_SCHEMA, GROUP_FILTER_LIST_SCHEMA,
     GroupFilter, NS_MAX_DEPTH_REDUCED_SCHEMA, PRIV_DATASTORE_BACKUP, PRIV_DATASTORE_READ,
     PRIV_REMOTE_DATASTORE_APPEND, PRIV_REMOTE_DATASTORE_BACKUP, PRIV_REMOTE_DATASTORE_PRUNE,
-    REMOTE_ID_SCHEMA, REMOVE_VANISHED_BACKUPS_SCHEMA, RateLimitConfig, SYNC_ENCRYPTED_ONLY_SCHEMA,
-    SYNC_VERIFIED_ONLY_SCHEMA, SYNC_WORKER_THREADS_SCHEMA, TRANSFER_LAST_SCHEMA,
+    REMOTE_ID_SCHEMA, REMOVE_VANISHED_BACKUPS_SCHEMA, RateLimitConfig, RetentionTimespan,
+    SYNC_ENCRYPTED_ONLY_SCHEMA, SYNC_VERIFIED_ONLY_SCHEMA, SYNC_WORKER_THREADS_SCHEMA,
+    TRANSFER_LAST_SCHEMA,
 };
 use proxmox_rest_server::WorkerTask;
 use proxmox_router::{Permission, Router, RpcEnvironment};
@@ -116,6 +117,10 @@ fn check_push_privs(
                 schema: CRYPT_KEY_ID_SCHEMA,
                 optional: true,
             },
+            "retention-timespan": {
+                type: RetentionTimespan,
+                optional: true,
+            },
         },
     },
     access: {
@@ -143,6 +148,7 @@ async fn push(
     transfer_last: Option<usize>,
     worker_threads: Option<usize>,
     encryption_key: Option<String>,
+    retention_timespan: Option<RetentionTimespan>,
     rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<String, Error> {
     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
@@ -176,6 +182,7 @@ async fn push(
         transfer_last,
         worker_threads,
         encryption_key,
+        retention_timespan,
     )
     .await?;
 
diff --git a/src/server/push.rs b/src/server/push.rs
index 054ace8b4..0e14fe1c8 100644
--- a/src/server/push.rs
+++ b/src/server/push.rs
@@ -17,7 +17,7 @@ use pbs_api_types::{
     GroupListItem, MANIFEST_BLOB_NAME, NamespaceListItem, Operation, PRIV_DATASTORE_BACKUP,
     PRIV_DATASTORE_READ, PRIV_REMOTE_DATASTORE_APPEND, PRIV_REMOTE_DATASTORE_BACKUP,
     PRIV_REMOTE_DATASTORE_MODIFY, PRIV_REMOTE_DATASTORE_PRUNE, RateLimitConfig, Remote,
-    SnapshotListItem, print_store_and_ns,
+    RetentionTimespan, SnapshotListItem, print_store_and_ns,
 };
 use pbs_client::{
     BackupRepository, BackupStats, BackupWriter, BackupWriterOptions, HttpClient, IndexType,
@@ -101,6 +101,8 @@ pub(crate) struct PushParameters {
     /// Encryption key to use for pushing unencrypted backup snapshots. Does not affect
     /// already encrypted snapshots.
     crypt_config: Option<(String, Arc<CryptConfig>)>,
+    /// Retention timestamp to be set for newly pushed snapshots on sync target.
+    retain_until: Option<i64>,
 }
 
 impl PushParameters {
@@ -122,6 +124,7 @@ impl PushParameters {
         transfer_last: Option<usize>,
         worker_threads: Option<usize>,
         active_encryption_key: Option<String>,
+        retention_timespan: Option<RetentionTimespan>,
     ) -> Result<Self, Error> {
         if let Some(max_depth) = max_depth {
             ns.check_max_depth(max_depth)?;
@@ -164,6 +167,17 @@ impl PushParameters {
             bail!("Unsupported remote api version, minimum v2.2 required");
         }
 
+        let retain_until = retention_timespan
+            .map(|timespan| {
+                if api_version < ApiVersion::new(4, 2, 11) {
+                    bail!(
+                        "Unsupported 'retain-until' by remote api version, minimum v4.2.11 required"
+                    );
+                }
+                timespan.to_timestamp_from_systemtime()
+            })
+            .transpose()?;
+
         let supports_prune_delete_stats = api_version >= ApiVersion::new(3, 2, 11);
 
         let target = PushTarget {
@@ -196,6 +210,7 @@ impl PushParameters {
             transfer_last,
             worker_threads,
             crypt_config,
+            retain_until,
         })
     }
 
@@ -926,12 +941,21 @@ pub(crate) async fn push_group(
             if source_snapshots.contains(&snapshot.backup.time) {
                 continue;
             }
-            if snapshot.protected {
+            if snapshot.protected
+                || snapshot
+                    .retain_until
+                    .is_some_and(|retain_until| retain_until >= proxmox_time::epoch_i64())
+            {
+                let reason = if snapshot.protected {
+                    "protected"
+                } else {
+                    "retained"
+                };
                 log_sender
                     .log(
                         Level::INFO,
                         format!(
-                            "Kept protected snapshot {name} on remote",
+                            "Kept {reason} snapshot {name} on remote",
                             name = snapshot.backup
                         ),
                     )
@@ -1146,7 +1170,7 @@ pub(crate) async fn push_snapshot(
             debug: false,
             benchmark: false,
             no_cache: false,
-            retain_until: None,
+            retain_until: params.retain_until,
         },
     )
     .await
@@ -1452,6 +1476,10 @@ pub(crate) async fn push_snapshot(
     // Rewrite manifest for pushed snapshot, recreating manifest from source on target,
     // needs to update all relevant info for new manifest.
     target_manifest.unprotected = source_manifest.unprotected.clone();
+    // Never propagate the source retention timestamp to the target, it has been re-calculated and
+    // passed via the client when starting the backup session based on the sync job's retention
+    // timespan. Keeps source and target retentions independent.
+    target_manifest.unprotected["retain-until"].take();
     if let Some((_id, crypt_config)) = &encrypt_using_key {
         let sync_source_signature = source_manifest.signature(crypt_config)?;
         target_manifest.set_sync_source_signature(&sync_source_signature)?;
diff --git a/src/server/sync.rs b/src/server/sync.rs
index 67d02a6a1..ab6792c2d 100644
--- a/src/server/sync.rs
+++ b/src/server/sync.rs
@@ -752,6 +752,7 @@ pub fn do_sync_job(
                             sync_job.transfer_last,
                             sync_job.worker_threads,
                             sync_job.active_encryption_key,
+                            sync_job.retention_timespan,
                         )
                         .await?;
                         push_store(push_params).await?
-- 
2.47.3