2 # Copyright (C) 2016 Ian Kelling
4 # Licensed under the Apache License, Version 2.0 (the "License");
5 # you may not use this file except in compliance with the License.
6 # You may obtain a copy of the License at
8 # http://www.apache.org/licenses/LICENSE-2.0
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS,
12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 # See the License for the specific language governing permissions and
14 # limitations under the License.
17 # todo: if we cancel in the middle of a btrfs send, then run again
18 # immediately, the received subvolume doesn't get a Received UUID:
19 # field, and we won't mount it. Need to figure out a solution that will
23 [[ $EUID == 0 ]] ||
exec sudo
-E "${BASH_SOURCE[0]}" "$@"
25 set -e; .
/usr
/local
/lib
/bash-bear
; set +e
29 btrbk-run [OPTIONS] [run|resume|archive]
30 usually -t TARGET_HOST or -s SOURCE_HOST
32 Note, at source location, intentionally not executable, run and read
36 echo "top of script file:"
37 sed -n '1,/^[# ]*end command line/{p;b};q' "$0"
44 script_name
="${BASH_SOURCE[0]}"
45 script_name
="${script_name##*/}"
47 if $dry_run ||
$conf_only; then
48 printf "$pre dry-run: %s\n" "$*"
50 printf "$pre running: %s\n" "$*"
54 m
() { if $verbose; then printf "$pre %s\n" "$*"; fi; "$@"; }
55 e
() { printf "$pre %s\n" "$*"; }
56 die
() { printf "$pre error: %s\n" "$*" >&2; echo "$pre exiting with status 1" >&2; exit 1; }
57 mexit
() { echo "$pre exiting with status $1"; exit $1; }
59 uninstalled-file-die
() {
60 die
"uninstalled file $1. run install-my-scripts or rerun with -f"
72 if [[ $
(dig +short @
10.2.0.1 -x 10.2.0.2 2>&1 ||
:) == kd.b8.nz.
]] \
73 && ip n show
10.2.0.1 |
grep .
&>/dev
/null
; then
75 elif ping -q -c1 -w1 hal.office.fsf.org
&>/dev
/null \
76 && ip n show
192.168.0.26 |
grep .
&>/dev
/null
; then
83 exit-if-no-default-targets
() {
84 if ! $force && [[ $HOSTNAME != "$MAIL_HOST" ]]; then
85 echo "MAIL_HOST=$MAIL_HOST, nothing to do"
89 kw|kd|frodo|x2|x3|sy
) : ;;
91 die
"error: no default targets for this host, use -t"
98 if ping -q -c1 -w1 x3.office.fsf.org
&>/dev
/null
; then
99 targets
+=(x3.office.fsf.org
)
100 elif ping -q -c1 -w1 $h.b8.nz
&>/dev
/null
; then
101 # in case we took it home
103 elif ping -q -c1 -w1 ${h}w.b8.nz
&>/dev
/null
; then
106 targets
+=(x3wg.b8.nz
)
110 add-wireless-target-h
() {
111 if ping -q -c1 -w1 $h.b8.nz
&>/dev
/null
; then
113 elif ping -q -c1 -w1 ${h}w.b8.nz
&>/dev
/null
; then
114 targets
+=(${h}w.b8.nz
)
121 # q has sensitive data i dont want to backup for so long
122 cat >>/etc
/btrbk
$conf_suf.conf
<<EOF
123 snapshot_preserve $q_preserve
124 snapshot_preserve_min 2h
126 target_preserve $q_preserve
127 target_preserve_min 2h
136 if [[ -e /b
/bash_unpublished
/source-state
]]; then
137 source /b
/bash_unpublished
/source-state
140 # note q is owned by root:1000
149 dry_run
=false
# mostly for testing
151 verbose
=true
; verbose_arg
=-v
153 if [[ $INVOCATION_ID ]]; then
154 # INVOCATION_ID means running as a systemd service. we cant show progress in this case,
155 # but if we pass the arg, it will insert mbuffer into the command.
158 progress_arg
="--progress"
160 incremental_strict
=false
163 default_args_file
=/etc
/btrbk-run.conf
164 if [[ -s $default_args_file ]]; then
165 # shellcheck disable=SC2046 # we want word splitting
166 set -- $
(< $default_args_file) "$@"
167 # i havent used this feature yet, so warn about it
168 echo "$0: warning: default btrbk-run options set in $default_args_file (sleeping 5 seconds):"
169 cat $default_args_file
173 once_args_file
=/etc
/btrbk-run-once.conf
174 if mv -f $once_args_file $once_args_file-tmp 2> >(sed '/No such file or directory/d'); then
175 # shellcheck disable=SC2046 # we want word splitting
176 set -- $
(< $once_args_file-tmp) "$@"
177 # i havent used this feature yet, so warn about it
178 echo "$0: btrbk-run options set in $once_args_file:"
179 cat $once_args_file-tmp
180 rm -f $once_args_file-tmp
188 check_installed
=false
190 temp
=$
(getopt
-l check-installed
,fast
,pull-reexec
,help 23cefikl
:m
:npqrs
:t
:vh
"$@") || usage
1
194 # for the rare case we want to run multiple instances at the same time
197 # only creates the config file, does not run btrbk
198 -c) conf_only
=true
;;
202 # quit early, just btrbk, no extra remounting etc.
204 # avoids some default behaviors:
205 # - no skipping hosts where xprintidle haven't been idle recently
206 # - exit if we can't ssh to 1 or more hosts
207 # - still set default hosts despite MAIL_HOST status
209 # skip various checks. when we run twice in a row for
210 # switch mail-host, no need to repeat the same checks again.
212 -i) incremental_strict
=true
;;
213 # note this implies resume and -p because it is just meant to make
214 # other hosts have the same snapshots, not do any expiry or new
216 -k) kd_spread
=true
;;
217 # bytes per second, suffix k m g
218 -l) rate_limit
=$2; shift ;;
219 # Comma separated mountpoints to backup. This has defaults set below.
220 -m) IFS
=, mountpoints
=($2); unset IFS
; shift ;;
222 # preserve existing snapshots and backups
223 -p) preserve_arg
=-p ;;
224 # internal option for rerunning under newer SOURCE_HOST version.
225 --pull-reexec) pull_reexec
=true
;;
227 -q) verbose
=false
; verbose_arg
=; progress_arg
= ;;
228 # source host to receive a backup from
232 if [[ $source == *:* ]]; then
233 bbksource
="[$source]"
237 # target hosts to send to. empty is valid for just doing local
238 # snapshot. we have default hosts we will populate.
239 -t) IFS
=, targets
=($2); unset IFS
; shift ;;
241 -v) verbose
=true
; verbose_arg
=-v ;;
244 *) die
"Internal error!" ;;
253 if ! $force && { $check_installed ||
[[ ! $source ]]; } ; then
259 for f
in ${install_bin_files[@]}; do
260 if ! diff -q /a
/bin
/ds
/$f /usr
/local
/bin
/$f; then
261 uninstalled-file-die
$f
264 if ! diff -q /a
/bin
/bash-bear-trap
/bash-bear
/usr
/local
/lib
/bash-bear
; then
265 uninstalled-file-die err
267 if $check_installed; then
274 if [[ $cmd_arg && $cmd_arg != resume
]]; then
275 die
"dont pass -k without resume or empty run arg"
277 if [[ $HOSTNAME == "$MAIL_HOST" ]]; then
278 die
"something went wrong, -k not meant to be run on MAIL_HOST"
280 if [[ $HOSTNAME != kd
]]; then
281 die
"something went wrong, -k only meant to run on kd"
286 add-wireless-target-h
289 if [[ ! $cmd_arg ]]; then
294 std_preserve
="36h 14d 8w 24m"
295 q_preserve
="18h 14d 8w"
300 # This works better than the normal archive command. We have to
301 # specify the mount points, but that is what we are used to doing and
302 # we prefer it. Another difference is that archive works recursively
303 # and we don't care about that. Sometimes we may still want to run
304 # btrbk archive, but it doesn't even use the config file, so just
305 # run it directly, eg:
306 # time s btrbk -v archive /mnt/r7/amy/boot/btrbk ssh://bo/mnt/boot2/btrbk
309 std_preserve
="999h 999d 999w 999m"
310 q_preserve
="$std_preserve"
313 *) die
"untested command arg" ;;
316 if (( $# > 1 )); then
317 die
: "only 1 nonoption arg is supported"
320 if [[ -v targets
&& $source ]]; then
321 # note, this doesnt need to be the case, but
322 # we would need to think about it.
323 die
"error: -t and -s are mutually exclusive"
326 ### end options parsing
328 # remove path from earlier version of btrbk
329 rm -f /usr
/sbin
/btrbk
330 # note, this still works as intended if there is no /usr/bin/btrbk
331 if [[ /a
/opt
/btrbk
/btrbk
-nt /usr
/bin
/btrbk
]]; then
332 if [[ -e /b
/distro-functions
/src
/package-manager-abstractions
]]; then
333 .
/b
/distro-functions
/src
/package-manager-abstractions
341 # TODO: i wonder if there should be an option to send to the default
342 # targets, plus any given on the command line.
349 # set default targets
350 if [[ ! -v targets
&& ! $source ]]; then
351 exit-if-no-default-targets
354 if ! $kd_spread && [[ $HOSTNAME != x3
]]; then
357 if [[ $HOSTNAME != kd
]]; then
360 wireless_home_hosts
=(
364 for h
in ${wireless_home_hosts[@]}; do
365 if [[ $HOSTNAME != "$h" ]]; then
366 add-wireless-target-h
371 for h
in x2 x3 kw
; do
372 if [[ $HOSTNAME == "$h" ]]; then
375 if ping -q -c1 -w1 $h.office.fsf.org
&>/dev
/null
; then
376 targets
+=($h.office.fsf.org
)
384 if [[ ${mountpoints[0]} ]]; then
385 for mp
in ${mountpoints[@]}; do
386 if [[ -e /nocow
/btrfs-stale
/$mp ]]; then
387 die
"error: $mp is stale, mount-latest-subvol first"
391 # set default mountpoints
392 if [[ ${targets[0]} == tp
]]; then
398 if [[ $source ]]; then
399 source_state
="$(ssh $source 'cat /a/bin/bash_unpublished/source-state; echo source_host=$HOSTNAME')"
401 # shellcheck disable=SC2154 # assigned in the above eval.
402 if [[ $source_host == "$MAIL_HOST" ]]; then
403 prospective_mps
+=(/o
)
405 if [[ $source_host == "$HOST2" ]]; then
406 prospective_mps
+=(/a
/qr
/qd
/q
)
409 if [[ $HOSTNAME == "$MAIL_HOST" ]]; then
410 prospective_mps
+=(/o
)
412 if [[ $HOSTNAME == "$HOST2" ]]; then
413 prospective_mps
+=(/a
/qr
/qd
/q
)
416 prospective_mps
=(/a
/o
/qr
/qd
/q
)
419 # note: put q last just in case its specific retention options were to
420 # affect other config sections. I havent tested if that is the case.
424 for mp
in ${prospective_mps[@]}; do # default mountpoints to sync
425 if [[ -e /nocow
/btrfs-stale
/$mp ]]; then
426 e
"warning: $mp stale, not adding to default mountpoints"
429 if awk '{print $2}' /etc
/fstab |
grep -xF $mp &>/dev
/null
; then
435 tmp
=$
(( ${#mountpoints[@]} == 0 ))
437 die didnt get mountpoint arg and had no defaults
440 ##### end command line parsing ########
442 #### begin pre-checks #####
444 # todo: this has a timing problem, since btrbk.timer could activate the service after this check.
445 if ! $fast && [[ $source ]]; then
446 if [[ $
(ssh $source ps
--no-headers -o comm 1) == systemd
]]; then
447 status
=$
(ssh $source systemctl is-active btrbk.service
) ||
: # normally returns 3
449 inactive|failed
) : ;;
451 echo "$0: error: btrbk is running on source. exiting out of caution"
457 if ! command -v btrbk
&>/dev
/null
; then
458 die
"error: no btrbk binary found"
461 if ! $pull_reexec && [[ $source ]] && $pulla && ! $force ; then
462 ssh root@
$source btrbk-run
--check-installed ||
exit 1
465 #### end pre-checks #####
469 mkdir
-p /var
/log
/btrbk
470 # The journal doesnt go back to my oldest backups, and I've found myself
471 # wanting older logs. Not going to bother expiring old logs, since it is
472 # fine if they go back years.
473 log_path
=/var
/log
/btrbk
/$
(date +%F_
%T
%:::z
).log
474 echo copying output to
$log_path
475 exec &> >(pee
cat 'ts "%F %T"|dd of='$log_path' status=none')
477 # print some non-default opts
480 if ! $conf_only; then
481 opts_show
+=(conf_only
=true
)
484 opts_show
+=(dry_run
=true
)
486 if [[ $rate_limit != no
]]; then
487 opts_show
+=("rate_limit=$rate_limit")
489 if [[ $cmd_arg != run
]]; then
490 opts_show
+=(cmd_arg
=$cmd_arg)
492 if (( $opts_show >= 1 )); then
494 for opt
in ${opts_show[@]}; do
504 if [[ -v targets
]]; then
505 echo "targets: ${targets[*]}"
508 if [[ $source ]]; then
509 echo "source: $source"
512 echo "mountpoints: ${mountpoints[*]}"
515 # pull_reexec stops us from getting into an infinite loop if there is some
516 # kind of weird problem
518 for m
in "${mountpoints[@]}"; do
519 if [[ $m == /a
]]; then
525 if ! $pull_reexec && [[ $source ]] && $pulla ; then
527 m rsync
-ra $source:/usr
/local
/bin
/{mount-latest-subvol
,check-subvol-stale
} /usr
/local
/bin
528 m rsync
-ra $source:/usr
/local
/lib
/bash-bear
/usr
/local
/lib
529 m scp
$source:/a
/bin
/distro-setup
/btrbk-run
$tmpf
530 if ! diff -q $tmpf ${BASH_SOURCE[0]}; then
531 e
"found different version on host $source. reexecing"
532 install -T $tmpf /usr
/local
/bin
/btrbk-run
533 m
/usr
/local
/bin
/btrbk-run
--pull-reexec "${orig_args[@]}"
540 # if our mountpoints are from stale snapshots,
541 # it doesn't make sense to do a backup.
542 m check-subvol-stale
${mountpoints[@]} || die
"found stale mountpoints in ${mountpoints[*]}"
544 # for an initial run, btrbk requires the dir to exist.
545 mkdir
-p /mnt
/{root
,o
}/btrbk
547 local_zone
=$
(date +%z
)
549 if [[ $source ]]; then
553 if ! zone
=$
(ssh root@
$source date +%z
); then
555 echo "$0: warning: failed to ssh to root@$source"
557 die failed to
ssh to root@
$source
560 if [[ $zone != "$local_zone" ]]; then
561 die
"error: dont confuse yourself with multiple time zones. $h has different timezone than localhost"
568 for h
in ${targets[@]}; do
569 if $fast ||
$conf_only; then
570 # Use some typical values in this case
571 root_size
=$
(( 1024 * 1024 * 2000 )) #2tb
574 elif remote_str
=$
(timeout
-s 9 6 ssh root@
$h "mkdir -p /mnt/root/btrbk /mnt/o/btrbk && date +%z && df --output=size,pcent / | tail -n1"); then
575 mapfile
-t tmp_array
<<<"$remote_str"
576 zone
="${tmp_array[0]}"
577 IFS
=" " read -r root_size percent_used
<<<"${tmp_array[1]}"
578 percent_used
=${percent_used%%%}
580 tmp
=$
(( ${#tmp_array[@]} != 2 ))
582 die
"error: didnt get 2 lines in test ssh to target $h. investigate"
584 case $percent_used in
585 [0-9]|
[1-9][0-9]) : ;;
587 die
"error: didnt get percent disk use in test ssh to target $h. investigate"
595 # we may be booted into a bootstrap fs or something
596 min_root_kb
=$
(( 1024 * 1024 * 200 )) # 200 gb
597 tmp
=$
(( root_size
< min_root_kb
))
602 tmp
=$
(( percent_used
>= 98 ))
604 die
"error: filesystem on target $h is $percent_used % full"
607 # on sy, xprintidle is resetting every 12 seconds even when not
608 # idle, i dunno why, instead we are checking if the screen is locked,
609 # which is good enough.
611 # This is a separate ssh because the command can fail and thatis ok.
614 if lock_info
=$
(timeout
-s 9 6 ssh $h DISPLAY
=:0 xscreensaver-command
-time); then
615 if [[ $lock_info != *non-blanked
* ]]; then
622 # Ignore this host. i sometimes use a non-main machine for
623 # testing or web browsing, knowing that everything will be wiped
624 # by the next backup, but I dont want it to happen as Im using
626 e
"warning: $h: seems to be actively in use, skipping for now"
631 if [[ $zone != "$local_zone" ]]; then
632 die
"error: dont confuse yourself with multiple time zones. $h has different timezone than localhost"
635 if [[ ! ${sshable[*]} ]] || { $force && [[ ${sshfail[*]} ]]; }; then
636 die
"failed to ssh to hosts: ${sshfail[*]}"
638 if [[ ${sshfail[*]} ]]; then
640 e
"error: failed to ssh to ${sshfail[*]} but continuing with other hosts"
642 targets
=(${sshable[@]})
647 cat >/etc
/btrbk
$conf_suf.conf
<<EOF
648 ssh_identity /q/root/h
649 #ssh_identity /root/.ssh/home
651 # Just a guess that local7 is a good facility to pick.
652 # It's a bit odd that the transaction log has to be logged to
653 # a file or syslog, while other output is sent to std out.
654 # The man does not mention a way for them to be together, but
655 # I dunno if setting a log level like warn might also output
657 transaction_syslog local7
660 #stream_compress zstd
662 # so we only run one at a time
663 lockfile /var/lock/btrbk$conf_suf.lock
665 # default format of short does not accomidate hourly preservation setting
666 timestamp_format long-iso
668 # only make a snapshot if things have changed
669 snapshot_create onchange
670 # I could make this different from target_preserve,
671 # if one disk had less space.
672 # for now, keeping them equal.
673 snapshot_preserve $std_preserve
674 snapshot_preserve_min 6h
676 # so, total backups = ~58
677 target_preserve $std_preserve
678 target_preserve_min 6h
680 # it seems very likely that not doing this could result in clone source not found
681 # errors, for example when expiry happens differently on different hosts,
682 # also, as btrbk does by default, if a failed send happens, on the next run it
683 # will warn about a stray subvolume, but then create a backup of a newer subvol
684 # and use an older subvol as the parent.
685 incremental_prefs sao:1
687 # if something fails and it's not obvious, try doing
688 # btrbk -l debug -v dryrun
690 rate_limit $rate_limit
693 if $incremental_strict; then
694 cat >>/etc
/btrbk
$conf_suf.conf
<<EOF
701 mp_count
=${#mountpoints[@]}
702 for (( i
=0; i
< mp_count
- 1 ; i
++ )); do
703 if [[ ${mountpoints[i]} == /q
]]; then
704 unset "mountpoints[i]"
713 declare -A source_snaps
715 for m
in ${mountpoints[@]}; do
726 snap_list_cmds
+=("echo $vol/btrbk/$sub.*;")
728 if [[ $source ]]; then
729 tmp_a
=($vol/btrbk
/$sub.
*)
730 tg_snaps
+=("${tmp_a[*]}")
731 cat >>/etc
/btrbk
$conf_suf.conf
<<EOF
732 volume ssh://$bbksource$vol
736 cat >>/etc
/btrbk
$conf_suf.conf
<<EOF
737 target send-receive $vol/btrbk
739 else # we have targets
740 for snap
in "$vol/btrbk/$sub."*; do
741 source_snaps
[$snap]=t
744 cat >>/etc
/btrbk
$conf_suf.conf
<<EOF
749 for tg
in ${targets[@]}; do
751 if [[ $tg == *:* ]]; then
754 cat >>/etc
/btrbk
$conf_suf.conf
<<EOF
755 target send-receive ssh://$tg$vol/btrbk
761 # Delete any subvols on the receiving host that don't exist on the
762 # sending host. Otherwise, the receiving host could have snapshots that
763 # aren't on the sending side, and thus become odd leaf subvols, and then
764 # btrbk could try to use them when we sync back, creating a weird tree
765 # instead of linear parent/child relationship. Maybe this could lead to
766 # a missing source subvol error, so lets avoid it.
768 get-orphan-tg-snaps
() {
770 for (( i
=0; i
< ${#mountpoints[@]}; i
++ )); do
771 orphan_start_count
=${#orphan_tg_snaps[@]}
773 for tg_snap
in ${tg_snaps[$i]}; do
774 tg_snap_count
=$
(( tg_snap_count
+ 1 ))
775 if [[ ! ${source_snaps[$tg_snap]} ]]; then
776 orphan_tg_snaps
+=("$tg_snap")
779 orphan_mp_count
=$
(( ${#orphan_tg_snaps[@]} - orphan_start_count
))
781 tmp
=$
(( tg_snap_count
> 1 && tg_snap_count
== orphan_mp_count
))
783 die
"something went wrong checking orphans on $tg: for mountpoint ${mountpoints[$i]}, $orphan_mp_count"
788 if [[ $source ]]; then
789 for snap
in $
(ssh root@
$source "shopt -s nullglob; ${snap_list_cmds[*]}"); do
790 source_snaps
[$snap]=t
793 tmp
=$
(( ${#orphan_tg_snaps[*]} >= 1 ))
795 d btrfs sub del
${orphan_tg_snaps[*]}
797 else # we have targets
798 for tg
in ${targets[@]}; do
799 tmp_str
=$
(ssh root@
$tg "shopt -s nullglob; ${snap_list_cmds[*]}")
800 mapfile
-t tg_snaps
<<<"$tmp_str"
802 tmp
=$
(( ${#orphan_tg_snaps[*]} >= 1 ))
804 d
ssh root@
$tg "btrfs sub del ${orphan_tg_snaps[*]}"
809 # todo: umount first to ensure we don't have any errors
810 # todo: do some kill fuser stuff to make umount more reliable
820 m btrbk
-c /etc
/btrbk
$conf_suf.conf
-v -n $cmd_arg
823 # -q and just using the syslog option seemed nice,
824 # but it doesn't show when a send has a parent and when it doesn't.
825 m btrbk
-c /etc
/btrbk
$conf_suf.conf
$preserve_arg $verbose_arg $progress_arg $cmd_arg
831 # todo: tp not valid anymore.
832 # if we have it, sync to systems which don't
833 if mountpoint
$rsync_mountpoint >/dev
/null
; then
834 for tg
in ${targets[@]}; do
837 dirs=(/p
/c
/machine_specific
/tp
)
838 for x
in /p
/c
/machine_specific
/*.hosts
; do
839 if grep -qxF $tg $x; then
843 m rsync
-aSAXPH --specials --devices --delete --relative ${dirs[@]} root@
$tg:/
850 for mp
in "${mountpoints[@]}"; do
851 subvols
+=("${mp##*/}")
853 if [[ $source ]]; then
854 m mount-latest-subvol
"${subvols[@]}"
856 for tg
in ${targets[@]}; do
857 m
/a
/exe
/mount-latest-remote
"$tg" "${subvols[@]}" || ret
=$?
861 # todo, we get hostnames earlier, reuse that.
862 if [[ $ret == 0 ]]; then
863 for tg
in ${targets[@]}; do
864 h
=$
(ssh $tg hostname
)
865 if [[ $h == kd
&& $HOSTNAME == x3
&& $HOSTNAME == "$MAIL_HOST" ]]; then
866 m
ssh root@
$tg 'btrbk-spread-wrap &>/dev/null </dev/null &'
868 rsync
--mkpath -a -f"- */" -f"+ *" /var
/log
/btrbk
/ root@
$tg:/var
/log
/btrbk
/$tg
869 ssh root@
$tg /usr
/local
/bin
/mail-backup-clean
871 if [[ $source ]]; then
872 rsync
--mkpath -a -f"- */" -f"+ *" $source:/var
/log
/btrbk
/ /var
/log
/btrbk
/$source
878 # todo: move variable data we don't care about backing up
879 # to /nocow and symlink it.
882 # background on btrbk timezones. with short/long, timestamps use local time.
883 # for long, if your local time moves backwards, by moving timezones or
884 # for an hour when daylight savings changes it, you will temporarily get
885 # a more aggressive retention policy for the overlapping period, and
886 # vice versa for the opposite timezone move. The alternative is using
887 # long-iso, which puts timezone info into the timestamp, which means
888 # that instead of shifting time, you shift the start of day/week/month
889 # which is used for retention to your new local time, which means for
890 # example, if you moved forward by 8 hours, the daily/weekly/monthly
891 # retention will be 8 hours more aggressive since midnight is at a new
892 # time, unless you fake the timzeone using the TZ env variable.
893 # However, in the short term, there will be no inconsistencies.
894 # I don't see any problem with shifting when the day starts for
895 # retention, so I'm using long-iso.
897 # note to create a long-iso timestamp: date +%Y%m%dT%H%M%S%z