backup-manager¶

backup-manager validate [--config-dir DIR]
        Backup hierarchy is well-formed + internally consistent (was validate-backup.sh).

backup-manager list [--disabled-only] [--json] [--config-dir DIR]
        Effective policy for every deployed module (was backup-status).
        OPTED-IN is the module's backup:vm declaration; IN-PBS-JOB is read
        from the managed bucket jobs and names the bucket holding it. They
        diverge — an archived module declares but has no guest, and a module
        that declared before the backup server existed is not a member yet.
        When PBS is unreachable the column falls back to the declaration and
        is marked `?` (--json: membershipSource "declaration").

backup-manager show <module> [--json] [--config-dir DIR]
        One module's effective policy (was backup-status <module>).

backup-manager resolve <module> [--environment <env>] [--config-dir DIR]
        Cascade-resolve + print one module's policy (JSON).

backup-manager modify <module> [--enabled true|false] [--retention SPEC] [--exclude a,b]
        Write the module's .backup {enabled,retention,exclude} onto
        config/<module>.json (ATOMIC). Only the flags given are changed.

backup-manager add <module> | delete <module>
        Wire / un-wire the module into the shared PBS job (adds/removes
        "backup:vm" in .dependsOn). modify-driven .json writes; live membership
        converges on reconcile.

backup-manager reconcile [--apply] [--config-dir DIR]
        Converge resolved policies → PBS (whole-cluster; PREVIEW by default,
        --apply commits). Idempotent. Calls backup-controller add-to-job /
        apply-schedule.

backup-manager restore list <module> | restore <module> [opts] | list-all
        SPECIAL recovery verb — delegates to the foundation backup/restore.sh and
        backup-controller (snapshot listing).

backup-manager coverage <module> [--json]
        Every cluster backup job that covers the module's VM — TAPPaaS's own
        bucket jobs and any other — and how (by vmid, --all, or pool). Two
        enabled jobs is a warning: the VM is backed up twice (#554).

backup-manager placement [--json]
        Where this site's PBS lives (placementState, pbsUrl, storage name).

backup-manager placement reset [--peer NAME] [--yes] [--no-update]
        Leave an external PBS for a local one (ADR-012 §2.3, #607). Refused unless
        placementState is external and a tankc pool exists. Runs, in order:
        backup-manage.sh reset-external (the old storage entry → <name>_former,
        still restorable; placementState → shim; formerExternal recorded), writes
        the old PBS as pull peer former-<host>, update-module.sh backup (the shim
        becomes a local PBS; the nodes push there), then onboards the pull
        (prompts for a read login on the old PBS). src/placement-reset.ts.

backup-manager placement use-external <url> [--datastore D] [--namespace NS] [--fingerprint FP]
        Back up to a PBS this site already runs — on the LAN, at a satellite, a
        third party's — provisioning nothing (#456). Prompts for the credential
        the remote issues, registers it as Proxmox storage, checks its existing
        backups are listable, records placementState external + pbsUrl. Runs
        the backup module's backup-manage.sh use-external. Every later update
        fails, named, if that storage is gone or unusable.

backup-manager placement finish-reset [--yes]
        Remove the <name>_former storage entry — after the pull and a test restore
        from pull/<peer>. The old PBS is never touched.