Continuous backup of the node's store to an object store, and its restore into an empty data_dir at boot. Off unless backup.enabled.

Every backup.interval_ms this process asks the store for a checkpoint (Ankusa.Store.checkpoint/2: memtables flushed, files hard-linked) and uploads it through the :backup scope of Ankusa.BlobStore (the backup.blob_store, else the segment store, under storage.key_prefix):

• backup/sst/<name> — every .sst and .blob file. RocksDB never rewrites one, so each is uploaded once and shared by every backup that lists it.
• backup/<id>/<name> — every other file (MANIFEST-*, CURRENT, OPTIONS-*, the WAL), per backup.
• backup/<id>/manifest.json — every file with its key, size and sha256, the store's format version and intake offset, and (with backup.signing_key) an HMAC-SHA256 signature over all of it; written after all the files.
• backup/LATEST — the id, written last. A backup is the one LATEST names; anything an interrupted attempt left is ignored, then deleted.

With backup.secondary every one of those objects is written to a second object store as well (another region or provider), one target after the other: the attempt succeeds only when both hold the new backup, a failed secondary is retried with the backoff below, and each target is purged right after its own success so a down secondary never makes the primary grow. Each object-store call is bounded by backup.timeout_ms.

After each successful upload, backups beyond backup.keep and every shared file no kept backup lists are deleted. A failed attempt is logged and retried after the interval doubled per consecutive failure (jittered, capped at a minute), like the compactor.

One store per prefix: the first backup gives the store an id (the m:store_id row, so every checkpoint and every restore carries it) and every manifest records it. When LATEST names another store's backup, the attempt fails with {:foreign_backup, theirs, ours} — nothing uploaded, nothing purged — because two stores on one prefix would delete each other's backups as stale. Two live nodes can also share one id (an old host back beside the replacement that restored its backup): once this process has written a backup, LATEST naming one it did not write fails the attempt with {:prefix_shared, latest}, so one of the two stops.

Restore

At boot, Ankusa.Store calls restore/3 when its directory holds no database: the LATEST backup is downloaded, its manifest checked (the signature against every backup.signing_key, the store format against what this release supports), every file checked against its size and sha256, CURRENT written last (a restore that fails part-way leaves no database, and the next boot starts it over). With signing keys configured a manifest that is unsigned or signed by no configured key is refused ({:manifest_invalid, id, :unsigned | :bad_signature}); a backup of a newer store format than this release writes is refused ({:store_format_newer, found, supported}), the same guard the store's own open applies. When the primary cannot give a backup (unreachable, invalid, failing a check, or empty) and a secondary is configured, the secondary is tried the same way. No backup anywhere starts an empty store; a backup location that cannot be read refuses the boot instead. reconcile_archive/1 then squares the new store with the segments in the bucket. A restore (or a fresh start) leaves a RESTORE-IN-PROGRESS marker in the directory until that reconcile has succeeded, so a node that dies in between reconciles on its next boot (reconcile_pending?/1) rather than booting as an existing store.

The manifest is signed, LATEST is not: whoever can write the bucket cannot inject content a restore accepts, but can still point LATEST at an older backup this node signed.

Verify

verify/2 reads LATEST back from an object store without writing anything: the manifest (signature included) and every file it lists, one at a time, against their size and sha256. With backup.verify_interval_ms this process runs it for every target on that interval and emits [:ankusa, :backup, :verify]; a failure is the counter ankusa_backup_verify_failed_total.

Stopping

A clean stop (:normal, :shutdown) takes one last backup before the process exits, bounded by backup.final_timeout_ms, so the recovery point of a node that is drained and stopped is the stop, not the last periodic backup. The supervisor is told to wait that long (child_spec/1). The store closes after this process, and the edge and dispatch before it.

Recovery point and freshness

The recovery point is the last backup: hooks acked after it are lost with the host, except for the archive copies reconcile_archive/1 finds. age_ms/1 is what Ankusa.Health compares to backup.max_age_ms.

Emits [:ankusa, :backup, :stop] per attempt, [:ankusa, :backup, :state] (age_seconds since the last successful backup) after it, and [:ankusa, :backup, :verify] per verified target.