Read the snapshot name using the stored hostname (closes #230)

A snapshot ID is hostname_name_timestamp, and purge took the name to be
everything between the first and the last underscore. With a hostname
such as my_host the name home came out as host_home, so
`snapshot purge --keep-latest --snapshot home` found nothing to delete
and `snapshot create --prune` purged nothing without a message. The name
is now read by removing the hostname stored with the snapshot, in the
short form the ID uses, so both may contain underscores. This was chosen
over rejecting underscores in `hostname` when the config loads, which
would also stop restores on such a host.

The purge consistency test stored a hostname that did not match its
snapshot IDs; it now matches, as it always does in production.

Model: opus-5-5

ARCHITECTURE.md

@@ -54,12 +54,10 @@ The database tracks five primary entities and their relationships:
 
 #### File (`database.File`)
 Represents a file, directory, or symlink in the backup system. Stores metadata needed for restoration:
-- Path, mtime
+- Path, source_path (for restore path stripping), mtime
 - Size, mode, ownership (uid, gid)
 - Symlink target (if applicable)
 
-It also stores `source_path`, the source directory the scan found it under, made absolute and with symlinks resolved. Restore does not read it.
-
 #### Chunk (`database.Chunk`)
 A content-addressed unit of data. Files are split into variable-size chunks using the FastCDC algorithm:
 - `ChunkHash`: SHA256 hash of chunk content (primary key)
@@ -84,11 +82,9 @@ The final storage unit uploaded to S3. Contains many compressed and encrypted ch
 Blob creation process:
 1. Chunks are accumulated (up to MaxBlobSize, typically 10GB)
 2. As each chunk is added, its uncompressed bytes are fed to a running SHA-256
-3. Concurrently, the same bytes are compressed with zstd, then encrypted with age (recipients configured in config), and written to a temporary file
+3. Concurrently, the same bytes are compressed with zstd, then encrypted with age (recipients configured in config), and streamed to storage
 4. On finalize, the blob's name is the double SHA-256 of the uncompressed contents — `hex(SHA256(SHA256(...)))` — not a hash of the compressed, encrypted bytes
-5. The finished file is uploaded to `blobs/{hash[0:2]}/{hash[2:4]}/{hash}` and then deleted
-
-A backup needs free temporary space, because each blob is written whole to a temporary file before it is uploaded (up to about `blob_size_limit`; an rclone destination that cannot stream uploads needs about twice that) and the metadata export writes copies of the local index. Temporary files go to `$TMPDIR` (default `/tmp`); with `TMPDIR` unset, SQLite writes one of those copies to `/var/tmp`.
+5. Uploaded to `blobs/{hash[0:2]}/{hash[2:4]}/{hash}`
 
 #### BlobChunk (`database.BlobChunk`)
 Maps chunks to their position within blobs:

README.md

@@ -546,7 +546,7 @@ complete annotated example also lives in
 | `s3.*` | | Legacy S3 configuration (endpoint, bucket, credentials) |
 | `exclude` | | Global exclude patterns (applied to all snapshots) |
 | `chunk_size` | `10MB` | Average chunk size for content-defined chunking |
-| `blob_size_limit` | `10GB` | Maximum blob size before splitting. Must be at least four times `chunk_size` (the largest chunk the chunker can emit), otherwise a single-chunk blob could exceed the limit. A backup needs free temporary space, because each blob is written whole to a temporary file before it is uploaded (up to about `blob_size_limit`; an rclone destination that cannot stream uploads needs about twice that) and the metadata export writes copies of the local index. Temporary files go to `$TMPDIR` (default `/tmp`); with `TMPDIR` unset, SQLite writes one of those copies to `/var/tmp` |
+| `blob_size_limit` | `10GB` | Maximum blob size before splitting. Must be at least four times `chunk_size` (the largest chunk the chunker can emit), otherwise a single-chunk blob could exceed the limit |
 | `compression_level` | `3` | zstd compression level (1-19) |
 | `hostname` | system hostname | Hostname used in snapshot IDs |
 | `index_path` | platform data dir | Local SQLite index path |
@@ -805,8 +805,7 @@ them. We provide:
   in the `Dockerfile` together.
 * `script/release` — cross-compile and publish the release artifacts
   with the pinned `goreleaser`. Refuses a `goreleaser` on `PATH` whose
-  version is not the pinned one, because a different version would build
-  a different release from the same tag.
+  version is not the pinned one, on the same reasoning as `script/lint`.
 * `script/release-snapshot` — the same build with no publishing and no
   tagging, into `./dist`
 * `script/test` — run the test suite by building the `test` phase of
@@ -916,14 +915,14 @@ It is passed to `goreleaser` as `GITEA_TOKEN`. The runner's automatic
 token is deliberately not used: it is not guaranteed to carry release
 write access.
 
-The Go toolchain that compiles the released binaries is installed by
-`script/install-go`, which downloads the version named by `go.mod`
-(currently `1.26.1`, the same version the `Dockerfile` builder stage
-pins by digest) and refuses the archive unless its sha256 matches the
-value committed in the script. `goreleaser` shells out to `go` for every
+The Go toolchain that compiles the released binaries comes from an
+`actions/setup-go` step pinned by commit sha, reading its version from
+`go.mod` (currently `1.26.1`, the same version the `Dockerfile` builder
+stage pins by digest). `goreleaser` shells out to `go` for every
 cross-compile, so without that step the release would either fail
 outright or ship binaries built by whatever unpinned toolchain the
-runner happened to carry.
+runner happened to carry — the one unpinned thing in an otherwise
+hash-pinned release path.
 
 To rehearse the whole build without publishing or tagging anything:
 

TODO.md

@@ -22,62 +22,6 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
-- 2026-10-07: Made an interrupted command exit 130 and say so
-  ([issue #267](https://git.eeqj.de/sneak/vaultik/issues/267)). Ctrl-C
-  or SIGTERM during `snapshot create`, `snapshot restore` or `snapshot
-  verify` exited 0 with no error line (`snapshot verify --json` exited
-  1, also without one), so a `--cron` run that never finished looked
-  like a success. A command stopped by either signal now exits 130 and
-  prints `interrupted before the command finished` on stderr, under
-  `--cron` and `--json` too.
-
-- 2026-10-07: Corrected documentation, help text and comments that were
-  false about the code
-  ([issue #233](https://git.eeqj.de/sneak/vaultik/issues/233)). A blob
-  is not streamed to storage. The README, `ARCHITECTURE.md` and
-  `config.example.yml` now say a backup needs free temporary space,
-  because each blob is written whole to a temporary file before it is
-  uploaded (up to about `blob_size_limit`; an rclone destination that
-  cannot stream uploads needs about twice that) and the metadata export
-  writes copies of the local index. Temporary files go to `$TMPDIR`
-  (default `/tmp`); with `TMPDIR` unset, SQLite writes one of those
-  copies to `/var/tmp`. Also corrected: the snapshot ID format, what restore
-  reads and how incomplete snapshots are removed in `docs/DATAMODEL.md`,
-  what `source_path` holds, the `index_path` and config file defaults,
-  what `snapshot remove` cleans up, how the release gets its Go
-  toolchain, and the `script/release` and `script/fmt-check` comments.
-
-- 2026-10-07: Cut the time the `internal/vaultik` and `internal/database`
-  tests take ([issue #235](https://git.eeqj.de/sneak/vaultik/issues/235)).
-  Most of the `internal/vaultik` time went to 24 tests that ran one at a
-  time only because they call `log.Initialize`; they now call it before
-  `t.Parallel()`, as the package's other tests do. `TestLargeDatasets`
-  committed each of its 1,500 inserts on its own and now makes them in
-  one transaction. `TestDedupOnlySnapshotRestores` gives its second
-  backup its own snapshot name instead of sleeping past the one-second
-  timestamp in the snapshot ID.
-
-- 2026-10-07: Made two messages say only what is true
-  ([issue #240](https://git.eeqj.de/sneak/vaultik/issues/240)). A config
-  file that others can read was warned about as containing S3
-  credentials even when it set none, as a `file://` config does. The
-  warning now says the file may contain S3 credentials only when
-  `s3.access_key_id` or `s3.secret_access_key` is set, since either may
-  come from a `${...}` reference rather than the file, and otherwise
-  says the file is readable by others. `snapshot purge` against a
-  destination store it could not list gave an error with
-  `listing remote snapshots:` in it twice; the prefix now appears once.
-
-- 2026-10-07: Made `s3.part_size` set the multipart upload part size
-  ([issue #232](https://git.eeqj.de/sneak/vaultik/issues/232)). It was
-  loaded and defaulted but never passed to the S3 client, whose uploader
-  used a fixed 10MiB part. It now reaches the uploader for `storage_url`
-  and for the `s3.*` fields, and a part size S3 refuses, below 5MiB or
-  above 5GiB, `0` included, fails at config load. A blob too large for
-  S3's limit of 10,000 parts at the configured size is uploaded in larger
-  parts. The docs gave the default as `5MB`, which the config file reads
-  as 5,000,000 bytes, below the minimum; they now say `5MiB`.
-
 - 2026-10-07: Made per-name retention work when the hostname contains `_`
   ([issue #230](https://git.eeqj.de/sneak/vaultik/issues/230)). A
   snapshot ID is `hostname_name_timestamp`, and the name was read as

config.example.yml

@@ -287,18 +287,15 @@ storage_url: "rclone://myremote/path/to/backups"
 #  #use_ssl: true
 #
 #  # Part size for multipart uploads
-#  # Minimum 5MiB, maximum 5GiB; affects memory usage during upload
-#  # A blob too large for 10,000 parts of this size gets larger parts
-#  # Supports: 10MB, 16MiB, 100MiB, etc. (5MB is below the minimum)
-#  # Default: 5MiB
-#  #part_size: 5MiB
+#  # Minimum 5MB, affects memory usage during upload
+#  # Supports: 5MB, 10M, 100MiB, etc.
+#  # Default: 5MB
+#  #part_size: 5MB
 
 # Path to local SQLite index database
 # This database tracks file state for incremental backups
-# Default: the platform data directory, e.g.
-#   macOS: ~/Library/Application Support/vaultik/index.sqlite
-#   Linux: ~/.local/share/vaultik/index.sqlite
-#index_path: /path/to/index.sqlite
+# Default: /var/lib/vaultik/index.sqlite
+#index_path: /var/lib/vaultik/index.sqlite
 
 # Average chunk size for content-defined chunking
 # Smaller chunks = better deduplication but more metadata
@@ -313,12 +310,6 @@ storage_url: "rclone://myremote/path/to/backups"
 # Chunking uses no secret (the FastCDC parameters are fixed and public). At a
 # large limit a blob holds hundreds of chunks, so individual chunk lengths are
 # not visible in its size; lowering the limit toward chunk_size exposes them.
-# A backup needs free temporary space, because each blob is written whole to
-# a temporary file before it is uploaded (up to about blob_size_limit; an
-# rclone destination that cannot stream uploads needs about twice that) and
-# the metadata export writes copies of the local index. Temporary files go to
-# $TMPDIR (default /tmp); with TMPDIR unset, SQLite writes one of those copies
-# to /var/tmp.
 # Supports: 1GB, 10G, 500MB, 1GiB, etc.
 # Default: 10GB
 #blob_size_limit: 10GB

docs/DATAMODEL.md

@@ -111,7 +111,7 @@ Maps chunks to the blobs that contain them.
 Tracks backup snapshots.
 
 **Columns:**
-- `id` (TEXT PRIMARY KEY) - Snapshot ID (format: `hostname_name_timestamp`, e.g. `server1_home_2025-06-01T12:00:00Z`: the hostname up to its first `.`, the snapshot name, and an RFC 3339 UTC timestamp)
+- `id` (TEXT PRIMARY KEY) - Snapshot ID (format: hostname-YYYYMMDD-HHMMSSZ)
 - `hostname` (TEXT) - Hostname where backup was created
 - `vaultik_version` (TEXT) - Version of Vaultik used
 - `vaultik_git_revision` (TEXT) - Git revision of Vaultik used
@@ -218,8 +218,8 @@ The `{remote-key}` directory name is a one-way hash of the human snapshot ID, so
 ### 4. Restore Process
 
 The restore process doesn't use the local database. Instead:
-1. Downloads and decrypts the snapshot's metadata database (`db.zst.age`) from S3
-2. Downloads the blobs holding the chunks of the files being restored, found through that database's `blob_chunks` table; the manifest is not read
+1. Downloads snapshot metadata from S3
+2. Downloads required blobs based on manifest
 3. Reconstructs files from decrypted and decompressed chunks
 
 ### 5. Pruning
@@ -232,8 +232,9 @@ The restore process doesn't use the local database. Instead:
 
 Before each backup:
 1. Query incomplete snapshots (where `completed_at IS NULL`)
-2. Delete each one and all its associations, without checking S3 for its metadata
-3. Clean up orphaned files, chunks, and blobs
+2. Check if metadata exists in S3
+3. If no metadata, delete snapshot and all associations
+4. Clean up orphaned files, chunks, and blobs
 
 ## Repository Pattern
 

internal/cli/app.go

@@ -206,10 +206,6 @@ func RunApp(ctx context.Context, app *fx.App) error {
 // RunOperation through cobra to Entry.
 var errReported = errors.New("operation failed")
 
-// errInterrupted marks an operation that SIGINT or SIGTERM stopped
-// before it finished. Entry shows it and returns exitCodeInterrupted.
-var errInterrupted = errors.New("interrupted before the command finished")
-
 // RunOperation runs op against the Vaultik instance inside the fx app
 // and turns a failure into a returned error rather than an os.Exit from
 // within the goroutine. An os.Exit there skipped main's deferred
@@ -224,21 +220,17 @@ var errInterrupted = errors.New("interrupted before the command finished")
 // interrupt OnStop cancels op and waits for the goroutine to return, so
 // op's cleanup (removing decrypted scratch files) runs before the
 // process exits; the wait is bounded by shutdownTimeout. report is
-// called with a failure so the caller can show it to the user before
-// it becomes errReported.
-//
-// The run counts as interrupted unless op returned, without an
-// interrupt having cancelled it, before RunWithApp returned. An
-// interrupted op is not reported, whatever it returned; RunOperation
-// returns errInterrupted instead.
+// called with a non-canceled failure so the caller can show it to the
+// user before it becomes errReported. A context cancellation is the
+// interrupt path, not a failure: it is neither reported nor counted as
+// one.
 func RunOperation(
 	ctx context.Context, opts AppOptions,
 	op func(v *vaultik.Vaultik) error, report func(err error),
 ) error {
 	var (
-		mu       sync.Mutex
-		finished bool // op returned before any interrupt cancelled it
-		failed   bool // op finished with an error
+		mu     sync.Mutex
+		failed bool
 	)
 
 	opts.Invokes = append(opts.Invokes,
@@ -249,21 +241,11 @@ func RunOperation(
 				OnStart: func(_ context.Context) error {
 					stop = v.StartOperation(func() {
 						err := op(v)
-
-						// Only stop, called from OnStop below, cancels the
-						// Vaultik context, so a live context means no
-						// interrupt cancelled op. Check the context, not
-						// err: an interrupted op need not return
-						// context.Canceled (`snapshot verify --json`
-						// returns a verification failure).
-						if v.Context().Err() == nil {
-							if err != nil {
-								report(err)
-							}
+						if err != nil && !errors.Is(err, context.Canceled) {
+							report(err)
 
 							mu.Lock()
-							finished = true
-							failed = err != nil
+							failed = true
 							mu.Unlock()
 						}
 
@@ -296,23 +278,16 @@ func RunOperation(
 		return err
 	}
 
-	// RunWithApp returns only after the app was asked to stop, either by
-	// an interrupt or by the goroutine's Shutdown call. When op finished
-	// without being cancelled, the goroutine set finished before that
-	// call. So if finished is unset here, an interrupt stopped the app,
-	// and op either returned after it was cancelled or is still running
-	// because the shutdown timed out.
+	// The goroutine sets failed before triggering the shutdown that lets
+	// RunWithApp return, so the write is in place by the time we read it.
 	mu.Lock()
 	defer mu.Unlock()
 
-	switch {
-	case !finished:
-		return errInterrupted
-	case failed:
+	if failed {
 		return errReported
-	default:
-		return nil
 	}
+
+	return nil
 }
 
 // runVaultikApp runs the standard single-operation command lifecycle

internal/cli/config.go

@@ -205,7 +205,7 @@ storage_url: ""
 #   access_key_id: YOUR_ACCESS_KEY
 #   secret_access_key: YOUR_SECRET_KEY
 #   # region: us-east-1        # Default: us-east-1
-#   # part_size: 5MiB          # Upload part size, 5MiB to 5GiB. Default: 5MiB
+#   # part_size: 5MB           # Multipart upload part size. Default: 5MB
 #   # For the s3:// form, disable TLS with ?ssl=false in the URL, not use_ssl.
 
 # ─── OPTIONAL ────────────────────────────────────────────────────────────────

internal/cli/entry.go

@@ -15,11 +15,6 @@ import (
 // the startup banner.
 const shortCommitLen = 12
 
-// exitCodeInterrupted is the exit status of a command that SIGINT or
-// SIGTERM stopped. It is 128 plus SIGINT's number, 2, which is what a
-// shell reports for a command stopped by Ctrl-C.
-const exitCodeInterrupted = 130
-
 // Entry is the main entry point for the CLI application.
 // It prints the startup banner to stderr (unless a banner-suppressing
 // flag is present in os.Args — see bannerSuppressedInArgs), executes the
@@ -28,10 +23,9 @@ const exitCodeInterrupted = 130
 // The banner goes to stderr because stdout carries only the output the
 // user asked for, such as a completion script or a `config get` value.
 //
-// It returns the process exit code (0 on success, 130 when interrupted,
-// 1 on any other error) rather than calling os.Exit, so that main's
-// deferred profile writers run before the process ends. See run in
-// cmd/vaultik/main.go.
+// It returns the process exit code (0 on success, 1 on error) rather
+// than calling os.Exit, so that main's deferred profile writers run
+// before the process ends. See run in cmd/vaultik/main.go.
 func Entry() int {
 	emitStartupBanner(os.Args[1:], os.Stderr)
 
@@ -45,16 +39,11 @@ func Entry() int {
 		// document instead); errReported says so. Printing it again
 		// here would double the error line.
 		// Every other error — bad arguments, a config that would not
-		// load, an interrupt — reaches Entry unreported, so it is shown
-		// here.
+		// load — reaches Entry unreported, so it is shown here.
 		if !errors.Is(err, errReported) {
 			ReportErrorf("%s", err.Error())
 		}
 
-		if errors.Is(err, errInterrupted) {
-			return exitCodeInterrupted
-		}
-
 		return 1
 	}
 

internal/cli/entry_interrupt_test.go

@@ -1,203 +0,0 @@
-package cli //nolint:testpackage // shares runEntry and the argument constants
-
-import (
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"os/signal"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/adrg/xdg"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// stalledStoreConfig is hermeticConfig with an s3:// destination store
-// in place of the file:// one. The server behind it accepts any
-// credentials.
-const stalledStoreConfig = `age_recipients:
-  - age1278m9q7dp3chsh2dcy82qk27v047zywyvtxwnj4cvt0z65jw6a7q5dqhfj
-snapshots:
-  test:
-    paths:
-      - %s
-storage_url: s3://bucket?endpoint=%s&ssl=false
-s3:
-  access_key_id: key
-  secret_access_key: secret
-index_path: %s
-hostname: test-host
-`
-
-// interruptRepeat is how often interruptOnFirstRequest sends SIGINT.
-const interruptRepeat = 50 * time.Millisecond
-
-// TestEntryInterruptedRun sends SIGINT to the test process while a
-// command waits on the destination store, and checks that Entry returns
-// 130 and prints one line on stderr saying the run was interrupted. The
-// store is a local HTTP server that holds every request open, so the
-// command is always mid-operation when the signal arrives. The two
-// cases cover --cron and --json, which silence other output.
-//
-// Not parallel: it signals the process and replaces os.Args, os.Stdout,
-// os.Stderr and the xdg globals.
-//
-//nolint:paralleltest // signals the process and replaces process globals
-func TestEntryInterruptedRun(t *testing.T) {
-	for _, testCase := range []struct {
-		name string
-		args []string
-	}{
-		{
-			name: "snapshot create --cron",
-			args: []string{cmdSnapshot, cmdCreate, "--cron"},
-		},
-		{
-			name: "snapshot verify --json",
-			args: []string{cmdSnapshot, cmdVerify, someSnapshotID, flagJSON},
-		},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			endpoint, requestArrived := startStalledStore(t)
-			configPath := writeStalledStoreConfig(t, endpoint)
-			interruptOnFirstRequest(t, requestArrived)
-
-			code, _, stderr := runEntry(t,
-				append([]string{flagConfig, configPath}, testCase.args...)...)
-
-			assert.Equal(t, 130, code)
-			assert.Equal(t, 1,
-				strings.Count(stderr, errInterrupted.Error()), stderr)
-		})
-	}
-}
-
-// interruptOnFirstRequest sends SIGINT to the test process every
-// interruptRepeat, from the first request to the destination store until
-// the test ends. One signal is not enough: the command can reach the
-// store before fx has started catching signals. The test catches SIGINT
-// too, so that a signal fx is not catching does not kill the test
-// binary.
-func interruptOnFirstRequest(t *testing.T, requestArrived <-chan struct{}) {
-	t.Helper()
-
-	self, err := os.FindProcess(os.Getpid())
-	require.NoError(t, err)
-
-	caught := make(chan os.Signal, 1)
-	signal.Notify(caught, os.Interrupt)
-
-	testEnded := make(chan struct{})
-	senderDone := make(chan struct{})
-
-	// Stop catching SIGINT only after the sender has returned. The sender
-	// waits for each SIGINT it sends to arrive on caught; one still on
-	// its way after signal.Stop would kill the test binary.
-	t.Cleanup(func() {
-		close(testEnded)
-		<-senderDone
-		signal.Stop(caught)
-	})
-
-	go func() {
-		defer close(senderDone)
-
-		select {
-		case <-requestArrived:
-		case <-testEnded:
-			return
-		}
-
-		ticker := time.NewTicker(interruptRepeat)
-		defer ticker.Stop()
-
-		for {
-			// Empty caught, so that the receive below waits for this
-			// SIGINT rather than an earlier one.
-			select {
-			case <-caught:
-			default:
-			}
-
-			sendErr := self.Signal(os.Interrupt)
-			if sendErr != nil {
-				t.Errorf("sending SIGINT: %v", sendErr)
-
-				return
-			}
-
-			<-caught
-
-			select {
-			case <-testEnded:
-				return
-			case <-ticker.C:
-			}
-		}
-	}()
-}
-
-// startStalledStore starts an HTTP server that never answers: each
-// request is held until the client gives up on it or the test ends.
-// It returns the server's host:port and a channel that receives a value
-// when the first request arrives.
-func startStalledStore(t *testing.T) (string, <-chan struct{}) {
-	t.Helper()
-
-	requestArrived := make(chan struct{}, 1)
-	release := make(chan struct{})
-
-	server := httptest.NewServer(http.HandlerFunc(
-		func(_ http.ResponseWriter, r *http.Request) {
-			select {
-			case requestArrived <- struct{}{}:
-			default:
-			}
-
-			select {
-			case <-r.Context().Done():
-			case <-release:
-			}
-		}))
-
-	// Cleanups run last-registered first, so release lets any held
-	// request return before Close waits for it.
-	t.Cleanup(server.Close)
-	t.Cleanup(func() { close(release) })
-
-	return server.Listener.Addr().String(), requestArrived
-}
-
-// writeStalledStoreConfig writes a config whose destination store is the
-// server at endpoint and whose snapshot source holds one small file, so
-// that `snapshot create` has a blob to upload. Returns the config path.
-func writeStalledStoreConfig(t *testing.T, endpoint string) string {
-	t.Helper()
-
-	dir := t.TempDir()
-	configPath := filepath.Join(dir, "config.yml")
-	sourceDir := filepath.Join(dir, "source")
-
-	require.NoError(t, os.Mkdir(sourceDir, 0o750))
-	require.NoError(t, os.WriteFile(filepath.Join(sourceDir, "file.txt"),
-		[]byte("contents"), 0o600))
-
-	contents := fmt.Sprintf(stalledStoreConfig,
-		sourceDir, endpoint, filepath.Join(dir, "index.sqlite"))
-
-	require.NoError(t,
-		os.WriteFile(configPath, []byte(contents), configFileMode))
-
-	// The PID lock lives under xdg.DataHome, which xdg resolves at
-	// package init; point it at the temp dir so the test neither
-	// touches nor collides with the real one.
-	t.Setenv("XDG_DATA_HOME", filepath.Join(dir, "data"))
-	xdg.Reload()
-	t.Cleanup(xdg.Reload)
-
-	return configPath
-}

internal/cli/prune.go

@@ -22,11 +22,9 @@ scans every snapshot manifest in the destination store, builds the
 set of still-referenced blob hashes, and deletes any blob not in that
 set.
 
-Snapshot create --prune runs the same cleanup automatically; this
-command is the manual entry point for the same work (e.g. after a
-crashed backup or to reclaim storage). Snapshot remove leaves blobs in
-place; run this command afterwards to delete the ones no longer
-referenced.`,
+Snapshot create --prune and snapshot remove run the same cleanup
+automatically; this command is the manual entry point for the same
+work (e.g. after a crashed backup or to reclaim storage).`,
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			// Use unified config resolution

internal/cli/snapshot.go

@@ -66,9 +66,8 @@ func newSnapshotCreateCommand() *cobra.Command {
 If snapshot names are provided, only those snapshots are created.
 If no names are provided, all configured snapshots are created.
 
-The config is read from the path given by --config or VAULTIK_CONFIG;
-otherwise from the platform config directory (~/.config/vaultik/config.yml
-on Linux), then /etc/vaultik/config.yml.`,
+Config is located at /etc/vaultik/config.yml by default, but can be overridden by
+specifying a path using --config or by setting VAULTIK_CONFIG to a path.`,
 		Args: cobra.ArbitraryArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			// Pass snapshot names from args

internal/config/config.go

@@ -33,14 +33,11 @@ const secretKeyPrefix = "AGE-SECRET-KEY-"
 const (
 	defaultBlobSizeLimit    = Size(10 * 1024 * 1024 * 1024) // 10GB
 	defaultChunkSize        = Size(10 * 1024 * 1024)        // 10MB
-	defaultS3PartSize       = Size(5 * 1024 * 1024)         // 5MiB
+	defaultS3PartSize       = Size(5 * 1024 * 1024)         // 5MB
 	defaultCompressionLevel = 3
 	minChunkSize            = 1024 * 1024 // 1MB
 	minCompressionLevel     = 1
 	maxCompressionLevel     = 19
-	// S3 accepts a multipart upload part from 5MiB to 5GiB.
-	minS3PartSize = 5 * 1024 * 1024
-	maxS3PartSize = 5 * 1024 * 1024 * 1024
 )
 
 // Sentinel validation errors.
@@ -58,7 +55,6 @@ var (
 		"blob_size_limit must be at least the largest chunk the chunker can " +
 			"emit (chunk_size times the FastCDC size spread)")
 	errBadCompression   = errors.New("compression_level must be between 1 and 19")
-	errBadS3PartSize    = errors.New("s3.part_size must be between 5MiB and 5GiB")
 	errBadStorageScheme = errors.New(
 		"storage_url must start with s3://, file://, or rclone://")
 	errStorageNotConfigured = errors.New(
@@ -248,7 +244,6 @@ func Load(path string) (*Config, error) {
 		ChunkSize:        defaultChunkSize,
 		IndexPath:        filepath.Join(xdg.DataHome, appName, "index.sqlite"),
 		CompressionLevel: defaultCompressionLevel,
-		S3:               S3Config{PartSize: defaultS3PartSize},
 	}
 
 	// Convert smartconfig data to YAML then unmarshal
@@ -299,13 +294,17 @@ func Load(path string) (*Config, error) {
 		cfg.S3.Region = "us-east-1"
 	}
 
+	if cfg.S3.PartSize == 0 {
+		cfg.S3.PartSize = defaultS3PartSize
+	}
+
 	// Check config file permissions (warn if world or group readable)
 	//nolint:gosec // G703: config path is operator-supplied by design
 	info, statErr := os.Stat(path)
 	if statErr == nil {
 		mode := info.Mode().Perm()
 		if mode&0044 != 0 { // group or world readable
-			log.Warn(cfg.readableByOthersWarning(),
+			log.Warn("Config file has insecure permissions (contains S3 credentials)",
 				"path", path,
 				"mode", fmt.Sprintf("%04o", mode),
 				"recommendation", "chmod 600 "+path)
@@ -333,7 +332,6 @@ func Load(path string) (*Config, error) {
 //     (chunk_size times chunker.ChunkSizeSpread), so a single-chunk blob never
 //     exceeds the configured limit
 //   - Compression level must be between 1 and 19
-//   - S3 part size must be between 5MiB and 5GiB, the part sizes S3 accepts
 //
 // Returns an error describing the first validation failure encountered.
 func (c *Config) Validate() error {
@@ -378,11 +376,6 @@ func (c *Config) Validate() error {
 		return errBadCompression
 	}
 
-	if c.S3.PartSize.Int64() < minS3PartSize ||
-		c.S3.PartSize.Int64() > maxS3PartSize {
-		return errBadS3PartSize
-	}
-
 	return nil
 }
 
@@ -418,18 +411,6 @@ func (c *Config) setAgeSecretKey() {
 	}
 }
 
-// readableByOthersWarning is the warning Load logs when others can read
-// the config file. It says "may contain" because the S3 credentials are
-// seen only after smartconfig has replaced any ${...} reference in the
-// file with its value, so a set credential need not be in the file.
-func (c *Config) readableByOthersWarning() string {
-	if c.S3.AccessKeyID != "" || c.S3.SecretAccessKey != "" {
-		return "Config file is readable by others and may contain S3 credentials"
-	}
-
-	return "Config file is readable by others"
-}
-
 // validateStorage validates storage configuration.
 // If StorageURL is set, it takes precedence. S3 URLs require credentials.
 // File URLs don't require any S3 configuration.

internal/config/config_test.go

@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	"sneak.berlin/go/vaultik/internal/chunker"
-	"sneak.berlin/go/vaultik/internal/log"
 )
 
 const (
@@ -167,7 +166,6 @@ func TestValidateBlobSizeLimit(t *testing.T) {
 			ChunkSize:        chunkSize,
 			BlobSizeLimit:    blobLimit,
 			CompressionLevel: 3,
-			S3:               S3Config{PartSize: defaultS3PartSize},
 		}
 	}
 
@@ -223,120 +221,6 @@ func TestValidateBlobSizeLimit(t *testing.T) {
 	}
 }
 
-// TestValidateS3PartSize checks that s3.part_size is held to the part sizes
-// S3 accepts, 5MiB to 5GiB, by changing only the part size of the test
-// config. "5MB" in the config file is 5,000,000 bytes, below the minimum.
-func TestValidateS3PartSize(t *testing.T) {
-	t.Parallel()
-
-	base, err := Load(os.Getenv("VAULTIK_CONFIG"))
-	if err != nil {
-		t.Fatalf("Failed to load config: %v", err)
-	}
-
-	tests := []struct {
-		name     string
-		partSize Size
-		wantErr  bool
-	}{
-		{
-			name:     "5MB is rejected",
-			partSize: 5_000_000,
-			wantErr:  true,
-		},
-		{
-			name:     "one byte below 5MiB is rejected",
-			partSize: minS3PartSize - 1,
-			wantErr:  true,
-		},
-		{
-			name:     "5MiB is accepted",
-			partSize: minS3PartSize,
-			wantErr:  false,
-		},
-		{
-			name:     "5GiB is accepted",
-			partSize: maxS3PartSize,
-			wantErr:  false,
-		},
-		{
-			name:     "one byte above 5GiB is rejected",
-			partSize: maxS3PartSize + 1,
-			wantErr:  true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			cfg := *base
-			cfg.S3.PartSize = tt.partSize
-
-			err := cfg.Validate()
-			if tt.wantErr {
-				if !errors.Is(err, errBadS3PartSize) {
-					t.Fatalf("Validate() error = %v, want errBadS3PartSize", err)
-				}
-
-				return
-			}
-
-			if err != nil {
-				t.Fatalf("Validate() unexpected error: %v", err)
-			}
-		})
-	}
-}
-
-// TestLoadS3PartSize checks that a config file without s3.part_size loads
-// with the 5MiB default, and that an explicit 0 fails at load like any other
-// part size S3 refuses.
-func TestLoadS3PartSize(t *testing.T) {
-	t.Parallel()
-
-	const withoutPartSize = "snapshots:\n" +
-		"  test:\n" +
-		"    paths: [/tmp/vaultik-test-source]\n" +
-		"storage_url: file:///tmp/vaultik-test-storage\n"
-
-	writeConfig := func(t *testing.T, text string) string {
-		t.Helper()
-
-		path := filepath.Join(t.TempDir(), "config.yml")
-
-		err := os.WriteFile(path, []byte(text), 0o600)
-		if err != nil {
-			t.Fatalf("write config: %v", err)
-		}
-
-		return path
-	}
-
-	t.Run("absent loads as 5MiB", func(t *testing.T) {
-		t.Parallel()
-
-		cfg, err := Load(writeConfig(t, withoutPartSize))
-		if err != nil {
-			t.Fatalf("Load() unexpected error: %v", err)
-		}
-
-		if cfg.S3.PartSize != defaultS3PartSize {
-			t.Errorf("s3.part_size = %d, want %d",
-				cfg.S3.PartSize, defaultS3PartSize)
-		}
-	})
-
-	t.Run("0 is rejected", func(t *testing.T) {
-		t.Parallel()
-
-		_, err := Load(writeConfig(t, withoutPartSize+"s3:\n  part_size: 0\n"))
-		if !errors.Is(err, errBadS3PartSize) {
-			t.Fatalf("Load() error = %v, want errBadS3PartSize", err)
-		}
-	})
-}
-
 // TestValidateAgeRecipients checks that recipients are parsed at config load
 // (a bad entry fails immediately, not mid-backup) and that no invalid entry —
 // least of all a pasted secret key — is echoed in the error. An empty list
@@ -352,7 +236,6 @@ func TestValidateAgeRecipients(t *testing.T) {
 			ChunkSize:        Size(10 * 1024 * 1024),
 			BlobSizeLimit:    Size(10 * 1024 * 1024 * 1024),
 			CompressionLevel: 3,
-			S3:               S3Config{PartSize: defaultS3PartSize},
 		}
 	}
 
@@ -460,125 +343,3 @@ func TestAgeSecretKeySourceName(t *testing.T) {
 		})
 	}
 }
-
-// loadReadableConfig writes configYAML to a file that others can read,
-// loads it, and returns what the logger wrote to stderr meanwhile. The
-// logger writes to the os.Stderr it finds when it is initialized, so
-// os.Stderr is pointed at a file first. Not parallel-safe: os.Stderr and
-// the logger are process-global.
-func loadReadableConfig(t *testing.T, configYAML string) string {
-	t.Helper()
-
-	dir := t.TempDir()
-	configPath := filepath.Join(dir, "config.yml")
-	stderrPath := filepath.Join(dir, "stderr")
-
-	err := os.WriteFile(configPath, []byte(configYAML), 0o600)
-	if err != nil {
-		t.Fatalf("writing config: %v", err)
-	}
-
-	//nolint:gosec // G302: the test needs a config file others can read
-	err = os.Chmod(configPath, 0o644)
-	if err != nil {
-		t.Fatalf("chmod config: %v", err)
-	}
-
-	stderrFile, err := os.Create(stderrPath) //nolint:gosec // G304: test temp path
-	if err != nil {
-		t.Fatalf("creating stderr file: %v", err)
-	}
-
-	previous := os.Stderr
-	os.Stderr = stderrFile
-
-	log.Initialize(log.Config{})
-
-	_, loadErr := Load(configPath)
-
-	os.Stderr = previous
-
-	log.Initialize(log.Config{})
-
-	_ = stderrFile.Close()
-
-	if loadErr != nil {
-		t.Fatalf("Load() error = %v", loadErr)
-	}
-
-	captured, err := os.ReadFile(stderrPath) //nolint:gosec // G304: test temp path
-	if err != nil {
-		t.Fatalf("reading stderr file: %v", err)
-	}
-
-	return string(captured)
-}
-
-// TestLoadWarnsReadableConfigWithoutS3Credentials checks that a config
-// file others can read, holding no S3 credentials, is warned about
-// without a claim that it holds them.
-//
-//nolint:paralleltest // loadReadableConfig replaces os.Stderr
-func TestLoadWarnsReadableConfigWithoutS3Credentials(t *testing.T) {
-	stderr := loadReadableConfig(t, `
-storage_url: file:///var/backups/vaultik
-snapshots:
-  home:
-    paths:
-      - /home
-`)
-
-	if !strings.Contains(stderr, "Config file is readable by others") {
-		t.Errorf("expected a warning that the file is readable by others, got %q",
-			stderr)
-	}
-
-	if strings.Contains(stderr, "S3 credentials") {
-		t.Errorf("warning names S3 credentials the file does not set: %q", stderr)
-	}
-}
-
-// TestLoadWarnsReadableConfigWithS3Credentials checks that a config file
-// others can read and that sets S3 credentials, as values or as ${ENV:...}
-// references, is warned about as one that may contain them.
-//
-//nolint:paralleltest // loadReadableConfig replaces os.Stderr
-func TestLoadWarnsReadableConfigWithS3Credentials(t *testing.T) {
-	t.Setenv("VAULTIK_TEST_ACCESS_KEY_ID", "test-access-key")
-	t.Setenv("VAULTIK_TEST_SECRET_ACCESS_KEY", "test-secret-key")
-
-	configs := map[string]string{
-		"values": `
-storage_url: s3://bucket/prefix?endpoint=s3.example.com
-s3:
-  access_key_id: test-access-key
-  secret_access_key: test-secret-key
-snapshots:
-  home:
-    paths:
-      - /home
-`,
-		"references": `
-storage_url: s3://bucket/prefix?endpoint=s3.example.com
-s3:
-  access_key_id: ${ENV:VAULTIK_TEST_ACCESS_KEY_ID}
-  secret_access_key: ${ENV:VAULTIK_TEST_SECRET_ACCESS_KEY}
-snapshots:
-  home:
-    paths:
-      - /home
-`,
-	}
-
-	for name, configYAML := range configs {
-		t.Run(name, func(t *testing.T) {
-			stderr := loadReadableConfig(t, configYAML)
-
-			if !strings.Contains(stderr,
-				"Config file is readable by others and may contain S3 credentials") {
-				t.Errorf("expected a warning naming the S3 credentials, got %q",
-					stderr)
-			}
-		})
-	}
-}

internal/database/models.go

@@ -14,7 +14,8 @@ type File struct {
 	ID   types.FileID   // UUID primary key
 	Path types.FilePath // Absolute path of the file
 
-	// SourcePath is the source directory this file came from.
+	// SourcePath is the source directory this file came from (used for
+	// restore path stripping).
 	SourcePath types.SourcePath
 	MTime      time.Time
 	Size       int64

internal/database/repository_edge_cases_test.go

@@ -3,7 +3,6 @@ package database
 
 import (
 	"context"
-	"database/sql"
 	"fmt"
 	"strings"
 	"testing"
@@ -368,7 +367,7 @@ func verifyBlobNullUploadTS(
 }
 
 // createLargeDatasetFiles creates fileCount files and adds every other
-// one to the snapshot, in one transaction as a backup writes them.
+// one to the snapshot.
 func createLargeDatasetFiles(
 	t *testing.T,
 	repos *Repositories,
@@ -377,38 +376,31 @@ func createLargeDatasetFiles(
 ) {
 	t.Helper()
 
+	ctx := context.Background()
 	start := time.Now()
 
-	err := repos.WithTx(context.Background(),
-		func(ctx context.Context, tx *sql.Tx) error {
-			for i := range fileCount {
-				file := &File{
-					Path:  types.FilePath(fmt.Sprintf("/large/file%05d.txt", i)),
-					MTime: time.Now(),
-					Size:  int64(i * 1024),
-					Mode:  0644,
-					UID:   uint32(1000 + (i % 10)),
-					GID:   uint32(1000 + (i % 10)),
-				}
+	for i := range fileCount {
+		file := &File{
+			Path:  types.FilePath(fmt.Sprintf("/large/file%05d.txt", i)),
+			MTime: time.Now(),
+			Size:  int64(i * 1024),
+			Mode:  0644,
+			UID:   uint32(1000 + (i % 10)),
+			GID:   uint32(1000 + (i % 10)),
+		}
 
-				err := repos.Files.Create(ctx, tx, file)
-				if err != nil {
-					return fmt.Errorf("creating file %d: %w", i, err)
-				}
+		err := repos.Files.Create(ctx, nil, file)
+		if err != nil {
+			t.Fatalf("failed to create file %d: %v", i, err)
+		}
 
-				// Add half to snapshot
-				if i%2 == 0 {
-					err = repos.Snapshots.AddFileByID(ctx, tx, snapshotID, file.ID)
-					if err != nil {
-						return err
-					}
-				}
+		// Add half to snapshot
+		if i%2 == 0 {
+			err = repos.Snapshots.AddFileByID(ctx, nil, snapshotID, file.ID)
+			if err != nil {
+				t.Fatal(err)
 			}
-
-			return nil
-		})
-	if err != nil {
-		t.Fatal(err)
+		}
 	}
 
 	t.Logf("Created %d files in %v", fileCount, time.Since(start))

internal/database/schema/001.sql

@@ -5,7 +5,7 @@
 CREATE TABLE IF NOT EXISTS files (
     id TEXT PRIMARY KEY,  -- UUID
     path TEXT NOT NULL UNIQUE,
-    source_path TEXT NOT NULL DEFAULT '',  -- The source directory this file came from
+    source_path TEXT NOT NULL DEFAULT '',  -- The source directory this file came from (for restore path stripping)
     mtime INTEGER NOT NULL,  -- whole seconds since the Unix epoch
     mtime_nsec INTEGER NOT NULL,  -- nanoseconds within that second, 0 to 999999999
     size INTEGER NOT NULL,

internal/s3/client.go

@@ -27,12 +27,10 @@ type Client struct {
 	bucket   string
 	prefix   string
 	endpoint string
-	partSize int64
 }
 
 // Config contains S3 client configuration.
-// All fields are required except Prefix, which defaults to an empty string,
-// and PartSize, where zero means the SDK default of 5 MiB.
+// All fields are required except Prefix, which defaults to an empty string.
 // A non-empty Prefix is joined to every key with one "/", whether or not
 // it ends with one.
 // The Endpoint field should include the protocol (http:// or https://).
@@ -43,9 +41,6 @@ type Config struct {
 	AccessKeyID     string
 	SecretAccessKey string
 	Region          string
-	// PartSize is the size in bytes of each part of a multipart upload.
-	// An upload too large for S3's limit of 10,000 parts gets larger parts.
-	PartSize int64
 }
 
 // nopLogger is a logger that discards all output.
@@ -95,7 +90,6 @@ func NewClient(ctx context.Context, cfg Config) (*Client, error) {
 		bucket:   cfg.Bucket,
 		prefix:   prefix,
 		endpoint: cfg.Endpoint,
-		partSize: cfg.PartSize,
 	}, nil
 }
 
@@ -129,9 +123,12 @@ func (c *Client) PutObjectWithProgress(
 ) error {
 	fullKey := c.prefix + key
 
+	// uploadPartSize is 10MB for better progress granularity.
+	const uploadPartSize = 10 * 1024 * 1024
+
 	// Create an uploader with the S3 client
 	uploader := manager.NewUploader(c.s3Client, func(u *manager.Uploader) {
-		u.PartSize = uploadPartSize(c.partSize, size)
+		u.PartSize = uploadPartSize
 	})
 
 	// Create a progress reader that tracks upload progress
@@ -152,21 +149,6 @@ func (c *Client) PutObjectWithProgress(
 	return err
 }
 
-// uploadPartSize returns the part size for an upload of size bytes: the
-// configured part size (the SDK default when zero), raised where needed so
-// the upload fits in S3's limit of 10,000 parts. The uploader cannot raise
-// it itself, because it cannot seek the progress reader to learn its size.
-func uploadPartSize(configured, size int64) int64 {
-	if configured == 0 {
-		configured = manager.DefaultUploadPartSize
-	}
-
-	maxParts := int64(manager.MaxUploadParts)
-	smallestThatFits := (size + maxParts - 1) / maxParts // rounded up
-
-	return max(configured, smallestThatFits)
-}
-
 // GetObject downloads an object from S3 with the specified key.
 // The key is automatically prefixed with the configured prefix.
 // Returns a ReadCloser containing the object data. The caller must

internal/s3/client_internal_test.go

@@ -1,55 +0,0 @@
-package s3
-
-import "testing"
-
-// TestUploadPartSize checks that an upload too large for 10,000 parts of the
-// configured size gets parts just large enough to fit in 10,000.
-func TestUploadPartSize(t *testing.T) {
-	t.Parallel()
-
-	const mib = 1024 * 1024
-
-	tests := []struct {
-		name       string
-		configured int64
-		size       int64
-		want       int64
-	}{
-		{
-			name:       "an upload that fits keeps the configured size",
-			configured: 5 * mib,
-			size:       10 * 1024 * mib,
-			want:       5 * mib,
-		},
-		{
-			name:       "exactly 10,000 parts keeps the configured size",
-			configured: 6 * mib,
-			size:       10_000 * 6 * mib,
-			want:       6 * mib,
-		},
-		{
-			name:       "one byte more than 10,000 parts adds a byte to each",
-			configured: 6 * mib,
-			size:       10_000*6*mib + 1,
-			want:       6*mib + 1,
-		},
-		{
-			name:       "zero means the SDK default of 5MiB",
-			configured: 0,
-			size:       1,
-			want:       5 * mib,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			got := uploadPartSize(tt.configured, tt.size)
-			if got != tt.want {
-				t.Errorf("uploadPartSize(%d, %d) = %d, want %d",
-					tt.configured, tt.size, got, tt.want)
-			}
-		})
-	}
-}

internal/s3/module.go

@@ -28,7 +28,6 @@ func provideClient(lc fx.Lifecycle, cfg *config.Config) (*Client, error) {
 		AccessKeyID:     cfg.S3.AccessKeyID,
 		SecretAccessKey: cfg.S3.SecretAccessKey,
 		Region:          cfg.S3.Region,
-		PartSize:        cfg.S3.PartSize.Int64(),
 	})
 	if err != nil {
 		return nil, err

internal/snapshot/scanner.go

@@ -58,8 +58,8 @@ type Scanner struct {
 	compressionLevel int
 	ageRecipient     string
 	snapshotID       string // Current snapshot being processed
-	// currentSourcePath is the source directory being scanned, stored with
-	// each file record.
+	// currentSourcePath is the source directory being scanned (used for
+	// restore path stripping).
 	currentSourcePath string
 	exclude           []string          // Glob patterns for files/directories to exclude
 	compiledExclude   []compiledPattern // Compiled glob patterns
@@ -211,6 +211,7 @@ func (s *Scanner) Scan(
 	ctx context.Context, path string, snapshotID string,
 ) (*ScanResult, error) {
 	s.snapshotID = snapshotID
+	// Store source path for file records (used during restore)
 	s.currentSourcePath = path
 	result := &ScanResult{
 		StartTime: time.Now().UTC(),
@@ -1197,8 +1198,9 @@ func (s *Scanner) checkFileInMemory(
 	}
 
 	file := &database.File{
-		ID:         fileID,
-		Path:       types.FilePath(path),
+		ID:   fileID,
+		Path: types.FilePath(path),
+		// Store source directory for restore path stripping
 		SourcePath: types.SourcePath(s.currentSourcePath),
 		MTime:      info.ModTime(),
 		Size:       info.Size(),

internal/storage/module.go

@@ -99,7 +99,6 @@ func storerFromParsedS3URL(parsed *URL, cfg *config.Config) (Storer, error) {
 		AccessKeyID:     cfg.S3.AccessKeyID,
 		SecretAccessKey: cfg.S3.SecretAccessKey,
 		Region:          region,
-		PartSize:        cfg.S3.PartSize.Int64(),
 	})
 	if err != nil {
 		return nil, fmt.Errorf("creating S3 client: %w", err)
@@ -135,7 +134,6 @@ func storerFromLegacyS3Config(cfg *config.Config) (Storer, error) {
 		AccessKeyID:     cfg.S3.AccessKeyID,
 		SecretAccessKey: cfg.S3.SecretAccessKey,
 		Region:          region,
-		PartSize:        cfg.S3.PartSize.Int64(),
 	})
 	if err != nil {
 		return nil, fmt.Errorf("creating S3 client: %w", err)

internal/storage/s3_test.go

@@ -1,14 +1,11 @@
 package storage_test
 
 import (
-	"bytes"
 	"context"
 	"errors"
-	"net/http"
 	"net/http/httptest"
 	"slices"
 	"strings"
-	"sync/atomic"
 	"testing"
 
 	"github.com/johannesboyne/gofakes3"
@@ -22,13 +19,6 @@ import (
 // s3TestBucket is the bucket created for each in-process S3 server.
 const s3TestBucket = "test-bucket"
 
-// Credentials for the tests that build a storer from a config.Config. The
-// in-process S3 server accepts any.
-const (
-	s3TestAccessKeyID     = "key"
-	s3TestSecretAccessKey = "secret"
-)
-
 // newS3Storer builds an s3:// backend backed by a fresh in-process
 // S3 server. It reuses the same in-memory S3 harness (gofakes3 + s3mem
 // over httptest) that internal/s3 and the not-found regression test use,
@@ -138,8 +128,8 @@ func TestS3URLPrefixKeyLayout(t *testing.T) {
 			storer, err := storage.NewStorer(&config.Config{
 				StorageURL: storageURL + "?endpoint=" + srv.URL,
 				S3: config.S3Config{
-					AccessKeyID:     s3TestAccessKeyID,
-					SecretAccessKey: s3TestSecretAccessKey,
+					AccessKeyID:     "key",
+					SecretAccessKey: "secret",
 				},
 			})
 			if err != nil {
@@ -181,90 +171,6 @@ func TestS3URLPrefixKeyLayout(t *testing.T) {
 	}
 }
 
-// TestS3UploadUsesConfiguredPartSize checks that s3.part_size reaches the
-// multipart uploader, through storage_url and through the s3.* fields. An
-// object three parts long must arrive as three parts; at the SDK's default
-// of 5 MiB it would arrive as four.
-func TestS3UploadUsesConfiguredPartSize(t *testing.T) {
-	t.Parallel()
-
-	const (
-		partSize  = 6 * 1024 * 1024
-		wantParts = 3
-	)
-
-	backend := s3mem.New()
-
-	err := backend.CreateBucket(s3TestBucket)
-	if err != nil {
-		t.Fatalf("create bucket: %v", err)
-	}
-
-	// Every part of a multipart upload is one request with a partNumber.
-	var parts atomic.Int32
-
-	fake := gofakes3.New(backend).Server()
-	srv := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			if r.URL.Query().Has("partNumber") {
-				parts.Add(1)
-			}
-
-			fake.ServeHTTP(w, r)
-		}))
-	t.Cleanup(srv.Close)
-
-	cases := []struct {
-		name string
-		cfg  *config.Config
-	}{
-		{
-			name: "storage_url",
-			cfg: &config.Config{
-				StorageURL: "s3://" + s3TestBucket + "?endpoint=" + srv.URL,
-				S3: config.S3Config{
-					AccessKeyID:     s3TestAccessKeyID,
-					SecretAccessKey: s3TestSecretAccessKey,
-					PartSize:        partSize,
-				},
-			},
-		},
-		{
-			name: "s3.endpoint",
-			cfg: &config.Config{
-				S3: config.S3Config{
-					Endpoint:        srv.URL,
-					Bucket:          s3TestBucket,
-					AccessKeyID:     s3TestAccessKeyID,
-					SecretAccessKey: s3TestSecretAccessKey,
-					PartSize:        partSize,
-				},
-			},
-		},
-	}
-
-	for _, tc := range cases {
-		parts.Store(0)
-
-		storer, err := storage.NewStorer(tc.cfg)
-		if err != nil {
-			t.Fatalf("%s: NewStorer: %v", tc.name, err)
-		}
-
-		data := bytes.NewReader(make([]byte, wantParts*partSize))
-
-		err = storer.PutWithProgress(
-			context.Background(), "blob", data, data.Size(), nil)
-		if err != nil {
-			t.Fatalf("%s: PutWithProgress: %v", tc.name, err)
-		}
-
-		if got := parts.Load(); got != wantParts {
-			t.Errorf("%s: uploaded in %d parts, want %d", tc.name, got, wantParts)
-		}
-	}
-}
-
 // listStreamKeys returns the keys ListStream yields under a prefix, and
 // fails the test on a listing error.
 func listStreamKeys(t *testing.T, s storage.Storer, prefix string) []string {

internal/types/types.go

@@ -155,8 +155,8 @@ type BlobHash string
 // FilePath represents an absolute path to a file or directory.
 type FilePath string
 
-// SourcePath is the source directory a scan found a file under, made
-// absolute and with symlinks resolved.
+// SourcePath represents the root directory from which files are backed up.
+// Used during restore to strip the source prefix from paths.
 type SourcePath string
 
 // Hostname identifies a host machine.

internal/vaultik/changed_file_restore_test.go

@@ -130,9 +130,10 @@ func assertThirdSnapshotRestores(
 // up, and that snapshot is removed. The first snapshot keeps the file row,
 // which now lists the appended content's chunks, while removal drops the
 // blob that held them.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupAfterRemovingNewestSnapshotRestoresChangedFile(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -177,9 +178,10 @@ func TestBackupAfterRemovingNewestSnapshotRestoresChangedFile(t *testing.T) {
 // The next run's prune drops that incomplete snapshot and its blob, while
 // the first snapshot keeps the file row, which now lists the appended
 // content's chunks.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupAfterInterruptedRunRestoresChangedFile(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()

internal/vaultik/fault_injection_test.go

@@ -38,9 +38,11 @@ import (
 // (https://git.eeqj.de/sneak/vaultik/issues/130) and is not re-tested
 // here; these tests target the layers above the backend.
 //
-// log.Initialize replaces the package-global logger that a running
-// backup or restore reads, so each test calls it before t.Parallel,
-// while no parallel test is running yet.
+// The tests run serially, not with t.Parallel: each calls
+// log.Initialize, which replaces the package-global logger, and a
+// backup or restore running concurrently reads that same logger. Under
+// -race the two collide. Running one at a time is the same choice
+// prune_count_test.go already makes for the same reason.
 
 const (
 	faultChunkSize   = int64(64 * 1024)
@@ -163,19 +165,17 @@ func newReaderVaultik(
 // Scenario 3: a stored blob's bytes are flipped before restore reads
 // them. Restore must fail loudly, and no file must be left on the
 // restore target holding corrupt content.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRestoreRejectsCorruptBlob(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
 	assertRestoreRejectsDamagedBlob(t, faultstore.GetCorrupt, "corrupt")
 }
 
 // Scenario 4: a stored blob is truncated before restore reads it. Same
 // contract as the corrupt case.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRestoreRejectsTruncatedBlob(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
 	assertRestoreRejectsDamagedBlob(t, faultstore.GetTruncate, "truncated")
 }
 
@@ -188,6 +188,7 @@ func assertRestoreRejectsDamagedBlob(
 	t *testing.T, fault faultstore.GetFault, name string,
 ) {
 	t.Helper()
+	log.Initialize(log.Config{})
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -231,9 +232,10 @@ func assertRestoreRejectsDamagedBlob(
 
 // Scenario 6: the backend accepts blob uploads and reports success but
 // stores nothing. verify --deep must catch it.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestDeepVerifyCatchesLyingBackend(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -283,9 +285,10 @@ func TestDeepVerifyCatchesLyingBackend(t *testing.T) {
 // Scenario 1a: a blob upload fails partway through. The interrupted run
 // must not record the blob as uploaded, must not reference it from the
 // snapshot, and must leave no blob object at the destination.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestInterruptedBlobUploadRecordsNoUploadedBlob(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -358,9 +361,10 @@ func TestInterruptedBlobUploadRecordsNoUploadedBlob(t *testing.T) {
 // chunks in a blob that was actually uploaded, so the retry re-chunks and
 // re-uploads the affected data instead of silently referencing data that
 // never reached storage.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupRetryAfterInterruptedUploadIsRestorable(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -422,9 +426,10 @@ func TestBackupRetryAfterInterruptedUploadIsRestorable(t *testing.T) {
 // covered by TestBackupCompletesOnlyAfterMetadataExport
 // (https://git.eeqj.de/sneak/vaultik/issues/177); this test exercises the
 // lower-level export path in isolation.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupSurvivesMetadataExportInterruption(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -504,9 +509,10 @@ func TestBackupSurvivesMetadataExportInterruption(t *testing.T) {
 // destination. Rerunning the backup must then prune the incomplete
 // snapshot, produce a snapshot whose destination metadata and local index
 // agree, and restore. See https://git.eeqj.de/sneak/vaultik/issues/177.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupCompletesOnlyAfterMetadataExport(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
@@ -679,9 +685,10 @@ func faultScannerFactory(
 // Scenario 5: the restore target runs out of space mid-file. Restore
 // must fail with an out-of-space error, and must not leave a truncated
 // file at the target path presenting as a complete restore.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRestoreReportsDiskFull(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	osFS := afero.NewOsFs()
 	tempDir := t.TempDir()

internal/vaultik/integration_test.go

@@ -928,17 +928,17 @@ func setupDedupBackupEnv(
 	}
 }
 
-// runDedupSnapshot creates a snapshot with the given name, scans dataDir
-// into it, completes it, and exports its metadata, returning the snapshot
-// ID and scan result.
+// runDedupSnapshot creates a "dedup" snapshot, scans dataDir into it,
+// completes it, and exports its metadata, returning the snapshot ID and
+// scan result.
 func runDedupSnapshot(
 	ctx context.Context, t *testing.T,
 	sm *snapshot.SnapshotManager, scanner *snapshot.Scanner,
-	hostname, name, dataDir, dbPath string,
+	hostname, dataDir, dbPath string,
 ) (string, *snapshot.ScanResult) {
 	t.Helper()
 
-	id, err := sm.CreateSnapshotWithName(ctx, hostname, name, "v", "g")
+	id, err := sm.CreateSnapshotWithName(ctx, hostname, "dedup", "v", "g")
 	require.NoError(t, err)
 
 	result, err := scanner.Scan(ctx, dataDir, id)
@@ -980,15 +980,16 @@ func TestDedupOnlySnapshotRestores(t *testing.T) {
 
 	// First snapshot — uploads all blobs.
 	_, r1 := runDedupSnapshot(ctx, t, sm, makeScanner(),
-		cfg.Hostname, "first", dataDir, dbPath)
+		cfg.Hostname, dataDir, dbPath)
 	require.Positive(t, r1.BlobsCreated,
 		"first snapshot should upload at least one blob")
 
-	// Second snapshot — same data, every chunk dedups. Its own name gives
-	// it a different snapshot ID without waiting for the one-second
-	// timestamp in the ID to tick over.
+	// Second snapshot — same data, every chunk dedups. Sleep past the
+	// second-precision timestamp so the snapshot IDs differ.
+	time.Sleep(1100 * time.Millisecond)
+
 	id2, r2 := runDedupSnapshot(ctx, t, sm, makeScanner(),
-		cfg.Hostname, "second", dataDir, dbPath)
+		cfg.Hostname, dataDir, dbPath)
 	require.Equal(t, 0, r2.BlobsCreated,
 		"second snapshot should upload zero new blobs (fully dedup'd)")
 

internal/vaultik/missing_destination_test.go

@@ -6,7 +6,6 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 
 	"github.com/spf13/afero"
@@ -78,9 +77,10 @@ func backUpThenUnplug(
 // TestFirstBackupCreatesDestinationDirectory checks that a first backup
 // to a destination directory that does not exist yet creates it, and
 // that the destination can be listed afterwards.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestFirstBackupCreatesDestinationDirectory(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	ctx := context.Background()
 	storeDir := filepath.Join(t.TempDir(), "volume", "backup")
@@ -95,9 +95,10 @@ func TestFirstBackupCreatesDestinationDirectory(t *testing.T) {
 // TestListSnapshotsWarnsWhenDestinationMissing checks that snapshot list
 // warns and shows the local index alone, without reporting the local
 // snapshot as missing from the destination.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestListSnapshotsWarnsWhenDestinationMissing(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	ctx := context.Background()
 	v, repos, out := backUpThenUnplug(ctx, t)
@@ -114,9 +115,10 @@ func TestListSnapshotsWarnsWhenDestinationMissing(t *testing.T) {
 // TestRemoveSnapshotWarnsWhenDestinationMissing checks that snapshot
 // remove warns that the metadata could not be removed from the
 // destination, instead of reporting that it was.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRemoveSnapshotWarnsWhenDestinationMissing(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	ctx := context.Background()
 	v, repos, out := backUpThenUnplug(ctx, t)
@@ -135,9 +137,10 @@ func TestRemoveSnapshotWarnsWhenDestinationMissing(t *testing.T) {
 // TestPruneKeepsLocalRecordsWhenDestinationMissing checks that prune
 // fails on a destination it cannot list and deletes no local snapshot
 // record.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestPruneKeepsLocalRecordsWhenDestinationMissing(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	ctx := context.Background()
 	v, repos, _ := backUpThenUnplug(ctx, t)
@@ -150,22 +153,3 @@ func TestPruneKeepsLocalRecordsWhenDestinationMissing(t *testing.T) {
 	require.NoError(t, err)
 	assert.Len(t, snapshots, 1, "prune must delete no local snapshot record")
 }
-
-// TestPurgeSaysListingFailedOnceWhenDestinationMissing checks that
-// snapshot purge fails on a destination it cannot list, with an error
-// that says "listing remote snapshots" once.
-func TestPurgeSaysListingFailedOnceWhenDestinationMissing(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
-	ctx := context.Background()
-	v, _, _ := backUpThenUnplug(ctx, t)
-
-	err := v.PurgeSnapshotsWithOptions(&vaultik.SnapshotPurgeOptions{
-		KeepLatest: true,
-		Force:      true,
-	})
-	require.ErrorIs(t, err, fs.ErrNotExist)
-	assert.Equal(t, 1, strings.Count(err.Error(), "listing remote snapshots"),
-		err.Error())
-}

internal/vaultik/prune_count_test.go

@@ -14,9 +14,10 @@ import (
 // the discarded-error bug: getTableCount for a table its query cannot
 // resolve must not silently become 0. A count that could not be read is
 // reported as unknown, which a reader can tell apart from an empty table.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestTableCountForReportSurfacesReadFailure(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	ctx := context.Background()
 

internal/vaultik/restore_interrupt_test.go

@@ -164,9 +164,10 @@ func scratchEntries(t *testing.T, dir string) []string {
 // restore while a blob download is in progress. The download fails only
 // because of the cancel, so Restore must return context.Canceled without
 // reporting the file that needs the blob as failed.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRestoreSkipErrorsCancelDuringBlobDownload(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()

internal/vaultik/restore_skip_errors_test.go

@@ -45,10 +45,9 @@ type missingBlobBackup struct {
 // after one blob of a two-blob snapshot was deleted. Every file stored in
 // that blob must be reported as failed and left absent, every other file
 // must be restored intact, and Restore must still return an error.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRestoreSkipErrorsSkipsFilesOfMissingBlob(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
 	ctx := context.Background()
 	backup := backupThenDeleteOneBlob(ctx, t)
 
@@ -86,10 +85,9 @@ func TestRestoreSkipErrorsSkipsFilesOfMissingBlob(t *testing.T) {
 
 // TestRestoreMissingBlobAbortsWithoutSkipErrors checks that a deleted blob
 // still ends the restore with an error when SkipErrors is not set.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestRestoreMissingBlobAbortsWithoutSkipErrors(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
 	ctx := context.Background()
 	backup := backupThenDeleteOneBlob(ctx, t)
 
@@ -109,6 +107,7 @@ func backupThenDeleteOneBlob(
 	ctx context.Context, t *testing.T,
 ) *missingBlobBackup {
 	t.Helper()
+	log.Initialize(log.Config{})
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()

internal/vaultik/same_second_rewrite_test.go

@@ -18,9 +18,10 @@ import (
 // A file rewritten with its size unchanged and a new mtime in the same
 // second as the mtime the index holds must still be backed up. See
 // https://git.eeqj.de/sneak/vaultik/issues/226.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupOfSameSecondRewriteRestoresNewContent(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()

internal/vaultik/snapshot.go

@@ -1052,7 +1052,7 @@ func (v *Vaultik) syncWithRemote() error {
 	// every local snapshot record (issue #160).
 	remoteKeys, err := v.listAllRemoteSnapshotKeys()
 	if err != nil {
-		return err
+		return fmt.Errorf("listing remote snapshots: %w", err)
 	}
 
 	remoteKeySet := make(map[string]bool, len(remoteKeys))

internal/vaultik/snapshot_summary_test.go

@@ -54,6 +54,8 @@ type summaryEnv struct {
 func newSummaryEnv(t *testing.T) *summaryEnv {
 	t.Helper()
 
+	log.Initialize(log.Config{})
+
 	fs := afero.NewOsFs()
 	tempDir := t.TempDir()
 	srcDir := filepath.Join(tempDir, "src")
@@ -191,10 +193,9 @@ func (e *summaryEnv) dataLine(total, backedUp int64) string {
 // A first backup stores copy.bin's chunks while backing up a.bin, so
 // copy.bin's chunks are deduplicated within the run. Each file and byte
 // is still counted once.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestSnapshotSummaryFirstRun(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
 	env := newSummaryEnv(t)
 
 	summary := env.backUp(t, "first", false)
@@ -218,10 +219,9 @@ func TestSnapshotSummaryFirstRun(t *testing.T) {
 // An incremental backup where a.bin's mtime changed but its content did
 // not: a.bin is backed up again and every one of its chunks is already
 // stored.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestSnapshotSummaryIncrementalRunWithDeduplicatedChunks(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
 	env := newSummaryEnv(t)
 
 	env.backUp(t, "first", false)
@@ -251,10 +251,9 @@ func TestSnapshotSummaryIncrementalRunWithDeduplicatedChunks(t *testing.T) {
 // Under --cron the progress reporter is off; the upload figures must
 // still reach the summary and the snapshots row. The snapshot has two
 // paths, each backed up by its own scan.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestSnapshotSummaryCronRunRecordsUploads(t *testing.T) {
-	log.Initialize(log.Config{})
-	t.Parallel()
-
 	env := newSummaryEnv(t)
 
 	summary := env.backUp(t, "split", true)

internal/vaultik/two_path_snapshot_test.go

@@ -18,9 +18,10 @@ import (
 // A backup without --cron runs the progress reporter while one scanner
 // scans each path of the snapshot in turn. See
 // https://git.eeqj.de/sneak/vaultik/issues/253.
+//
+//nolint:paralleltest // installs the global logger via log.Initialize
 func TestBackupWithoutCronOfTwoPathSnapshotRestoresBothPaths(t *testing.T) {
 	log.Initialize(log.Config{})
-	t.Parallel()
 
 	const snapshotName = "data"
 

script/fmt-check

@@ -1,9 +1,6 @@
 #!/bin/sh
-# script/fmt-check: check formatting (read-only). Fails instead of
-# writing. It checks every Go file outside .tool, which is more than
-# script/fmt formats: `go fmt ./...` skips `testdata` directories and
-# files and directories whose names start with `.` or `_`. Fix a file
-# only this reports with `gofmt -w`.
+# script/fmt-check: check formatting (read-only). Same scope as
+# script/fmt, but fails instead of writing.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

script/release

@@ -21,9 +21,10 @@ goreleaser_version() {
         head -n 1
 }
 
-# Resolve the goreleaser to run. A binary on PATH is accepted only when
-# it is exactly the pinned version, because a differently versioned tool
-# would produce a differently built release from the same tag. Anything else
+# Resolve the goreleaser to run, on the same rule script/lint uses for
+# golangci-lint: a binary on PATH is accepted only when it is exactly
+# the pinned version, because a differently versioned tool would
+# produce a differently built release from the same tag. Anything else
 # comes from .tool/bin, and a missing one is a loud failure naming the
 # script that installs it rather than a silent fallback.
 resolve_goreleaser() {

test/config.yaml

@@ -19,7 +19,7 @@ s3:
   secret_access_key: test-secret-key
   region: us-east-1
   use_ssl: true
-  part_size: 5242880  # 5MiB
+  part_size: 5242880  # 5MB
 index_path: /tmp/vaultik-test.sqlite
 chunk_size: 10MB
 blob_size_limit: 10GB