The server backs itself up: every collection byte for byte, the media linked

A backup is a directory <stamp>-<kind> under Backups:Root (/var/lib/privapub/backups, 2770, files 0640), written as
.partial and renamed once whole: a manifest (host, build, newest migration, each collection's count, size, sha256 and
indexes, what was left out and why, the media list), each collection as gzipped canonical Extended JSON read raw, and
hard links to the files of untrashed media rows (copies where a link can't be made). On a replica set every collection
is read in one snapshot session. Never in a backup: the statistics salt, jobs, recovery codes, sessions, the
maintenance lock and the configuration's copy with its SMTP password.

One backup or restore at a time (MaintenanceLock, a heartbeat document), and the janitor purges nothing meanwhile.
BackupScheduler backs up nightly at 03:30 UTC (or at once after missing a night); rotation keeps 7 daily, 4 weekly,
3 pre-deploy and 3 pre-restore backups. CLI: admin backup [--kind] [--db-only], admin backups, admin backup verify;
these run before migrations, so the deploy's own pre-deploy backup, which replaces mongodump, is of the database as the
live build left it. EntityMaps.Warm runs once under a lock, since test hosts now boot side by side.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

PrivaPub/Infrastructure/Cli/AdminCommands.cs

@@ -24,8 +24,16 @@ namespace PrivaPub.Infrastructure.Cli
 			       PrivaPub admin smoke <persona>                 prints "<login> <password>" for the deploy's signed-in check
 			       PrivaPub admin media audit [--fix]             media files against what holds them; --fix (as www-data) trashes
 			                                                      what nothing holds and gives today's pictures their rows
+			       PrivaPub admin backup [--kind manual|pre-deploy] [--db-only]
+			                                                      backs the server up; --db-only lists the media without
+			                                                      linking them (the deploy's, which can't link www-data's files)
+			       PrivaPub admin backups                         the backups kept, newest first
+			       PrivaPub admin backup verify <id>              whether a backup's files are what its manifest says
 			""";
 
+		/// <summary>Whether a command runs before migrations: backups are of the database as it was.</summary>
+		public static bool BeforeMigrations(string[] args) => args is ["backup", ..] or ["backups"];
+
 		public static async Task<int> Run(string[] args, IServiceProvider services, TextReader input = default, TextWriter output = default)
 		{
 			input ??= Console.In;
@@ -40,12 +48,75 @@ namespace PrivaPub.Infrastructure.Cli
 					return await Smoke(services, persona, output);
 				case ["media", "audit", .. var flags] when flags.All(f => f == "--fix"):
 					return await AuditMedia(services, flags.Contains("--fix"), output);
+				case ["backup", "verify", var id]:
+					return await VerifyBackup(services, id, output);
+				case ["backup", .. var flags] when BackupFlags(flags, out var kind, out var dbOnly):
+					return await Backup(services, kind, dbOnly, output);
+				case ["backups"]:
+					return ListBackups(services, output);
 				default:
 					Console.Error.WriteLine(Usage);
 					return 2;
 			}
 		}
 
+		static readonly string[] CommandKinds = ["manual", "pre-deploy"];
+
+		static bool BackupFlags(string[] flags, out string kind, out bool dbOnly)
+		{
+			kind = "manual";
+			dbOnly = false;
+			for (var i = 0; i < flags.Length; i++)
+				switch (flags[i])
+				{
+					case "--db-only":
+						dbOnly = true;
+						break;
+					case "--kind" when i + 1 < flags.Length && CommandKinds.Contains(flags[i + 1]):
+						kind = flags[++i];
+						break;
+					default:
+						return false;
+				}
+			return true;
+		}
+
+		static async Task<int> Backup(IServiceProvider services, string kind, bool dbOnly, TextWriter output)
+		{
+			var (made, error) = await services.GetRequiredService<Backup.Backups>().Create(kind, dbOnly, CancellationToken.None);
+			if (made == default)
+			{
+				Console.Error.WriteLine(error);
+				return 1;
+			}
+			var manifest = made.Manifest;
+			output.WriteLine($"{made.Id}: {manifest.Collections.Count} collections, {manifest.Collections.Sum(c => c.Count)} documents, {made.Bytes / 1024} KiB");
+			output.WriteLine(dbOnly
+				? $"{manifest.Media.List.Count} media files listed, not linked"
+				: $"{manifest.Media.Files} media files, {manifest.Media.Bytes / 1024 / 1024} MiB, {manifest.Media.Missing} missing");
+			if (!manifest.Consistent)
+				output.WriteLine("not read at one instant: Mongo is not a replica set");
+			return 0;
+		}
+
+		static int ListBackups(IServiceProvider services, TextWriter output)
+		{
+			foreach (var backup in services.GetRequiredService<Backup.Backups>().List())
+				output.WriteLine($"{backup.Id}\t{backup.Kind}\t{backup.CreatedAt:u}\t{backup.Bytes / 1024} KiB\t{backup.Manifest?.Media.Files ?? 0} media{(backup.Manifest?.DbOnly == true ? " (listed)" : string.Empty)}");
+			return 0;
+		}
+
+		static async Task<int> VerifyBackup(IServiceProvider services, string id, TextWriter output)
+		{
+			var problems = await services.GetRequiredService<Backup.Backups>().Verify(id, CancellationToken.None);
+			foreach (var problem in problems)
+				output.WriteLine(problem);
+			if (problems.Count > 0)
+				return 1;
+			output.WriteLine($"{id}: whole");
+			return 0;
+		}
+
 		static async Task<int> AuditMedia(IServiceProvider services, bool fix, TextWriter output)
 		{
 			var report = await Domain.Media.MediaAudit.Run(services.GetRequiredService<Domain.Media.IMediaService>(), fix, CancellationToken.None);