[pbs-devel] [PATCH proxmox-backup v5 27/46] datastore: create/delete protected marker file on s3 storage backend

[Christian Ebner]

Commit 8292d3d2 ("api2/admin/datastore: add get/set_protection")
introduced the protected flag for backup snapshots, considering
snapshots as protected based on the presence/absence of the
`.protected` marker file in the corresponding snapshot directory.

To allow independent recovery of a datastore backed by an S3 bucket,
also create/delete the marker file on the object store backend. For
actual checks, still rely on the marker as encountered in the local
cache store.

Signed-off-by: Christian Ebner <c.ebner at proxmox.com>
---
 pbs-datastore/src/datastore.rs | 37 +++++++++++++++++++++++++++++-----
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/pbs-datastore/src/datastore.rs b/pbs-datastore/src/datastore.rs
index 89e85dbea..e83941bfe 100644
--- a/pbs-datastore/src/datastore.rs
+++ b/pbs-datastore/src/datastore.rs
@@ -1558,12 +1558,39 @@ impl DataStore {
 
         let protected_path = backup_dir.protected_file();
         if protection {
-            std::fs::File::create(protected_path)
+            std::fs::File::create(&protected_path)
                 .map_err(|err| format_err!("could not create protection file: {}", err))?;
-        } else if let Err(err) = std::fs::remove_file(protected_path) {
-            // ignore error for non-existing file
-            if err.kind() != std::io::ErrorKind::NotFound {
-                bail!("could not remove protection file: {}", err);
+            if let DatastoreBackend::S3(s3_client) = self.backend()? {
+                let marker = backup_dir.relative_path().join(".protected");
+                let protected_marker = marker
+                    .to_str()
+                    .ok_or_else(|| format_err!("unexpected protected marker path"))?;
+                let _is_duplicate = proxmox_async::runtime::block_on(s3_client.upload_with_retry(
+                    protected_marker.into(),
+                    hyper::body::Bytes::from(""),
+                    false,
+                ))
+                .context("failed to mark snapshot as protected on s3 backend")?;
+            }
+        } else {
+            if let Err(err) = std::fs::remove_file(&protected_path) {
+                // ignore error for non-existing file
+                if err.kind() != std::io::ErrorKind::NotFound {
+                    bail!("could not remove protection file: {err}");
+                }
+            }
+            if let DatastoreBackend::S3(s3_client) = self.backend()? {
+                let marker = backup_dir.relative_path().join(".protected");
+                let protected_marker = marker
+                    .to_str()
+                    .ok_or_else(|| format_err!("unexpected protected marker path"))?;
+                if let Err(err) = proxmox_async::runtime::block_on(
+                    s3_client.delete_object(protected_marker.into()),
+                ) {
+                    std::fs::File::create(&protected_path)
+                        .map_err(|err| format_err!("could not re-create protection file: {err}"))?;
+                    return Err(err);
+                }
             }
         }
 
-- 
2.47.2