backup: keep dated daily snapshots alongside the rolling archive

The rolling archive is overwritten every hour, so a bad wipe would be baked
into the only copy within one interval. Also upload
backups/daily/open-webui-data-<date>.tar.gz and prune to the newest
OWUI_BACKUP_DAILY_KEEP (default 7). restore.py accepts OWUI_RESTORE_ARCHIVE to
restore a pinned snapshot instead of the rolling latest.

backup.py

@@ -9,8 +9,16 @@ Covers everything a user would miss after a volume wipe:
 Deliberately EXCLUDES /data/cache (the embedding-model cache, ~1 GB, regenerates
 itself on boot).
 
+Two copies go up per run: the rolling latest at backups/open-webui-data.tar.gz
+(what restore.py reads on boot) and a dated snapshot
+backups/daily/open-webui-data-<YYYY-MM-DD>.tar.gz. The dated snapshots are what
+make a bad wipe survivable - the rolling file is overwritten every hour, so a
+corrupted dataset gets baked into it within one interval. The newest
+OWUI_BACKUP_DAILY_KEEP (default 7) dated snapshots are kept, older ones deleted.
+
 Requires the HF_TOKEN env var (Space secret). Never fails the app.
 """
+import datetime
 import gzip
 import os
 import shutil
@@ -22,8 +30,23 @@ import tempfile
 DATA_DIR = os.environ.get("OWUI_DATA_DIR", "/data")
 REPO_ID = os.environ.get("OWUI_BACKUP_REPO", "tkgray/open-webui-backups")
 ARCHIVE_IN_REPO = "backups/open-webui-data.tar.gz"
+DAILY_DIR = "backups/daily"
+DAILY_PREFIX = "open-webui-data-"
 INCLUDE_DIRS = ("vector_db", "uploads")
 
+
+def env_int(name, default):
+    raw = os.environ.get(name)
+    if raw is None:
+        return default
+    try:
+        return int(raw)
+    except (TypeError, ValueError):
+        return default
+
+
+DAILY_KEEP = env_int("OWUI_BACKUP_DAILY_KEEP", 7)
+
 DB_PATH = os.path.join(DATA_DIR, "webui.db")
 
 
@@ -81,6 +104,40 @@ def build_archive(payload_dir, archive_path):
     return archive_path
 
 
+def prune_daily(api, token):
+    """Delete dated snapshots beyond the newest DAILY_KEEP.
+
+    Filenames are ISO-dated, so a plain sort is chronological. Only ever
+    deletes under DAILY_DIR, so the rolling archive and the legacy single-file
+    backup are untouchable by this path.
+    """
+    try:
+        files = api.list_repo_files(REPO_ID, repo_type="dataset", token=token)
+    except Exception as exc:  # noqa: BLE001 - a prune failure must not fail the run
+        log(f"prune skipped, listing failed: {exc}")
+        return
+
+    dated = sorted(
+        f for f in files
+        if f.startswith(f"{DAILY_DIR}/{DAILY_PREFIX}") and f.endswith(".tar.gz")
+    )
+    stale = dated[:-DAILY_KEEP] if DAILY_KEEP > 0 else dated
+    if not stale:
+        log(f"prune: {len(dated)} dated snapshot(s) on disk, limit {DAILY_KEEP} - nothing to delete")
+        return
+
+    from huggingface_hub import CommitOperationDelete, create_commit
+
+    create_commit(
+        repo_id=REPO_ID,
+        repo_type="dataset",
+        operations=[CommitOperationDelete(path_in_repo=path) for path in stale],
+        commit_message=f"prune {len(stale)} snapshot(s) beyond {DAILY_KEEP}-day retention",
+        token=token,
+    )
+    log(f"prune: deleted {', '.join(stale)}")
+
+
 def main():
     if not os.path.isfile(DB_PATH):
         log(f"{DB_PATH} does not exist yet — skipping.")
@@ -103,18 +160,23 @@ def main():
 
         archive = os.path.join(stage, "open-webui-data.tar.gz")
         build_archive(payload, archive)
-        log(f"staged {os.path.getsize(archive)} bytes; uploading to {REPO_ID}:{ARCHIVE_IN_REPO} ...")
+        log(f"staged {os.path.getsize(archive)} bytes; uploading to {REPO_ID} ...")
 
         from huggingface_hub import HfApi
 
-        HfApi(token=token).upload_file(
-            path_or_fileobj=archive,
-            path_in_repo=ARCHIVE_IN_REPO,
-            repo_id=REPO_ID,
-            repo_type="dataset",
-            token=token,
-        )
-        log("Upload OK")
+        api = HfApi(token=token)
+        dated_in_repo = f"{DAILY_DIR}/{DAILY_PREFIX}{datetime.date.today().isoformat()}.tar.gz"
+        for path_in_repo in (ARCHIVE_IN_REPO, dated_in_repo):
+            api.upload_file(
+                path_or_fileobj=archive,
+                path_in_repo=path_in_repo,
+                repo_id=REPO_ID,
+                repo_type="dataset",
+                token=token,
+            )
+            log(f"Upload OK -> {path_in_repo}")
+
+        prune_daily(api, token)
         return 0
     except Exception as exc:  # noqa: BLE001 - never fail the app over a backup
         log(f"Upload FAILED: {exc}")

restore.py

@@ -8,6 +8,10 @@ single-file DB backup written by older versions of backup.sh.
 
 Never fails the boot: a restore error is logged and ignored, so a first boot
 with no backup yet still starts the app.
+
+Set OWUI_RESTORE_ARCHIVE to restore a pinned snapshot instead of the rolling
+latest, e.g. backups/daily/open-webui-data-2026-10-28.tar.gz (list what exists
+with HfApi().list_repo_files('tkgray/open-webui-backups', repo_type='dataset')).
 """
 import os
 import shutil
@@ -16,7 +20,7 @@ import tarfile
 
 DATA_DIR = os.environ.get("OWUI_DATA_DIR", "/data")
 REPO_ID = os.environ.get("OWUI_BACKUP_REPO", "tkgray/open-webui-backups")
-ARCHIVE_IN_REPO = "backups/open-webui-data.tar.gz"
+ARCHIVE_IN_REPO = os.environ.get("OWUI_RESTORE_ARCHIVE", "backups/open-webui-data.tar.gz")
 LEGACY_DB_IN_REPO = "backups/webui.db"
 
 DB_PATH = os.path.join(DATA_DIR, "webui.db")

start-with-backup.sh

@@ -6,7 +6,9 @@ set -eu
 # 1. Restore if db doesn't exist
 /restore.sh
 
-# 2. Start background backup loop (every hour, keeps last 24 snapshots)
+# 2. Start background backup loop: hourly rolling snapshot (overwritten each run)
+#    plus one dated snapshot per day, keeping the newest OWUI_BACKUP_DAILY_KEEP
+#    (default 7) days.
 (
     BACKUP_INTERVAL="${BACKUP_INTERVAL_SECONDS:-3600}"
     echo "[start] Backup loop started — interval: \${BACKUP_INTERVAL}s"