From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id EDD171FF0AF for ; Fri, 06 Nov 2026 18:24:23 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id A4ECB2180B; Fri, 06 Nov 2026 18:23:33 +0100 (CET) From: Christian Ebner To: pbs-devel@lists.proxmox.com Subject: [PATCH proxmox-backup v2 30/43] api: config: allow to set or delete retention timespan for sync jobs Date: Fri, 6 Nov 2026 18:22:22 +0100 Message-ID: <20261106172235.890542-31-c.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261106172235.890542-1-c.ebner@proxmox.com> References: <20261106172235.890542-1-c.ebner@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793985779008 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.453 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: VJ6XUHTGML4Z7I6HQNXIKQHVE4UHJUZM X-Message-ID-Hash: VJ6XUHTGML4Z7I6HQNXIKQHVE4UHJUZM X-MailFrom: c.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Extend the sync job config API handler to allow for a retention timespan to be configured or removed. Check for local sync targets if the configured retention setting falls within the configured limits of the datastore. Signed-off-by: Christian Ebner --- src/api2/config/sync.rs | 47 ++++++++++++++++++++++++++++++++++++----- 1 file changed, 42 insertions(+), 5 deletions(-) diff --git a/src/api2/config/sync.rs b/src/api2/config/sync.rs index 7ed624c9f..f08285ad6 100644 --- a/src/api2/config/sync.rs +++ b/src/api2/config/sync.rs @@ -7,16 +7,18 @@ use proxmox_router::{Permission, Router, RpcEnvironment, http_bail}; use proxmox_schema::{api, param_bail}; use pbs_api_types::{ - Authid, JOB_ID_SCHEMA, PRIV_DATASTORE_APPEND, PRIV_DATASTORE_AUDIT, PRIV_DATASTORE_BACKUP, - PRIV_DATASTORE_MODIFY, PRIV_DATASTORE_PRUNE, PRIV_DATASTORE_READ, PRIV_REMOTE_AUDIT, - PRIV_REMOTE_DATASTORE_APPEND, PRIV_REMOTE_DATASTORE_BACKUP, PRIV_REMOTE_DATASTORE_PRUNE, - PRIV_REMOTE_READ, PROXMOX_CONFIG_DIGEST_SCHEMA, SyncJobConfig, SyncJobConfigUpdater, + Authid, JOB_ID_SCHEMA, Operation, PRIV_DATASTORE_APPEND, PRIV_DATASTORE_AUDIT, + PRIV_DATASTORE_BACKUP, PRIV_DATASTORE_MODIFY, PRIV_DATASTORE_PRUNE, PRIV_DATASTORE_READ, + PRIV_REMOTE_AUDIT, PRIV_REMOTE_DATASTORE_APPEND, PRIV_REMOTE_DATASTORE_BACKUP, + PRIV_REMOTE_DATASTORE_PRUNE, PRIV_REMOTE_READ, PROXMOX_CONFIG_DIGEST_SCHEMA, SyncJobConfig, + SyncJobConfigUpdater, }; use pbs_config::sync; use crate::api2::admin::sync::ListSyncDirection; +use crate::tools::lookup_with; use pbs_config::CachedUserInfo; -use pbs_datastore::check_backup_owner; +use pbs_datastore::{DataStore, check_backup_owner}; pub fn check_sync_job_read_access( user_info: &CachedUserInfo, @@ -187,6 +189,28 @@ pub fn check_sync_job_modify_access( } } +// Check if the retention config for the local target datastore is within the set limits. +// Does not check remote stores. +fn check_retention_config(job: &SyncJobConfig) -> Result<(), Error> { + let Some(timespan) = &job.retention_timespan else { + return Ok(()); + }; + + let sync_direction = job.sync_direction.unwrap_or_default(); + if sync_direction == SyncDirection::Pull || job.remote.is_none() { + let target_store = if sync_direction == SyncDirection::Pull { + &job.store + } else { + &job.remote_store + }; + let datastore = DataStore::lookup_datastore(lookup_with(target_store, Operation::Lookup))?; + let timestamp = timespan.to_timestamp_from_systemtime()?; + datastore.check_max_retention(timestamp)?; + } + + Ok(()) +} + #[api( input: { properties: { @@ -308,6 +332,8 @@ pub fn create_sync_job( } } + check_retention_config(&config)?; + let (mut section_config, _digest) = sync::config()?; if section_config.sections.contains_key(&config.id) { @@ -423,6 +449,8 @@ pub enum DeletableProperty { ActiveEncryptionKey, /// Delete associated key property, AssociatedKey, + /// Delete retention-timespan property + RetentionTimespan, } #[api( @@ -590,6 +618,9 @@ fn do_update_sync_job_config( // Previous active encryption key might be added as associated below. data.associated_key = None; } + DeletableProperty::RetentionTimespan => { + data.retention_timespan = None; + } } } keep_previous_key_as_associated( @@ -747,6 +778,12 @@ fn do_update_sync_job_config( } } + if update.retention_timespan.is_some() { + data.retention_timespan = update.retention_timespan; + } + + check_retention_config(data)?; + if !check_sync_job_modify_access(user_info, auth_id, data) { bail!("permission check failed"); } -- 2.47.3