move implementation to internal/ directory (#828)

internal/daemon/control.go

@@ -0,0 +1,293 @@
+package daemon
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/zrepl/zrepl/internal/daemon/job"
+	"github.com/zrepl/zrepl/internal/daemon/nethelpers"
+	"github.com/zrepl/zrepl/internal/endpoint"
+	"github.com/zrepl/zrepl/internal/logger"
+	"github.com/zrepl/zrepl/internal/util/envconst"
+	"github.com/zrepl/zrepl/internal/version"
+	"github.com/zrepl/zrepl/internal/zfs"
+	"github.com/zrepl/zrepl/internal/zfs/zfscmd"
+)
+
+type controlJob struct {
+	sockaddr *net.UnixAddr
+	jobs     *jobs
+}
+
+func newControlJob(sockpath string, jobs *jobs) (j *controlJob, err error) {
+	j = &controlJob{jobs: jobs}
+
+	j.sockaddr, err = net.ResolveUnixAddr("unix", sockpath)
+	if err != nil {
+		err = errors.Wrap(err, "cannot resolve unix address")
+		return
+	}
+
+	return
+}
+
+func (j *controlJob) Name() string { return jobNameControl }
+
+func (j *controlJob) Status() *job.Status { return &job.Status{Type: job.TypeInternal} }
+
+func (j *controlJob) OwnedDatasetSubtreeRoot() (p *zfs.DatasetPath, ok bool) { return nil, false }
+
+func (j *controlJob) SenderConfig() *endpoint.SenderConfig { return nil }
+
+var promControl struct {
+	requestBegin    *prometheus.CounterVec
+	requestFinished *prometheus.HistogramVec
+}
+
+func (j *controlJob) RegisterMetrics(registerer prometheus.Registerer) {
+	promControl.requestBegin = prometheus.NewCounterVec(prometheus.CounterOpts{
+		Namespace: "zrepl",
+		Subsystem: "control",
+		Name:      "request_begin",
+		Help:      "number of request we started to handle",
+	}, []string{"endpoint"})
+
+	promControl.requestFinished = prometheus.NewHistogramVec(prometheus.HistogramOpts{
+		Namespace: "zrepl",
+		Subsystem: "control",
+		Name:      "request_finished",
+		Help:      "time it took a request to finish",
+		Buckets:   []float64{1e-6, 10e-6, 100e-6, 500e-6, 1e-3, 10e-3, 100e-3, 200e-3, 400e-3, 800e-3, 1, 10, 20},
+	}, []string{"endpoint"})
+	registerer.MustRegister(promControl.requestBegin)
+	registerer.MustRegister(promControl.requestFinished)
+}
+
+const (
+	ControlJobEndpointPProf   string = "/debug/pprof"
+	ControlJobEndpointVersion string = "/version"
+	ControlJobEndpointStatus  string = "/status"
+	ControlJobEndpointSignal  string = "/signal"
+)
+
+func (j *controlJob) Run(ctx context.Context) {
+
+	log := job.GetLogger(ctx)
+	defer log.Info("control job finished")
+
+	l, err := nethelpers.ListenUnixPrivate(j.sockaddr)
+	if err != nil {
+		log.WithError(err).Error("error listening")
+		return
+	}
+
+	pprofServer := NewPProfServer(ctx)
+	if listen := envconst.String("ZREPL_DAEMON_AUTOSTART_PPROF_SERVER", ""); listen != "" {
+		pprofServer.Control(PprofServerControlMsg{
+			Run:               true,
+			HttpListenAddress: listen,
+		})
+	}
+
+	mux := http.NewServeMux()
+	mux.Handle(ControlJobEndpointPProf,
+		requestLogger{log: log, handler: jsonRequestResponder{log, func(decoder jsonDecoder) (interface{}, error) {
+			var msg PprofServerControlMsg
+			err := decoder(&msg)
+			if err != nil {
+				return nil, errors.Errorf("decode failed")
+			}
+			pprofServer.Control(msg)
+			return struct{}{}, nil
+		}}})
+
+	mux.Handle(ControlJobEndpointVersion,
+		requestLogger{log: log, handler: jsonResponder{log, func() (interface{}, error) {
+			return version.NewZreplVersionInformation(), nil
+		}}})
+
+	mux.Handle(ControlJobEndpointStatus,
+		// don't log requests to status endpoint, too spammy
+		jsonResponder{log, func() (interface{}, error) {
+			jobs := j.jobs.status()
+			globalZFS := zfscmd.GetReport()
+			envconstReport := envconst.GetReport()
+			s := Status{
+				Jobs: jobs,
+				Global: GlobalStatus{
+					ZFSCmds:   globalZFS,
+					Envconst:  envconstReport,
+					OsEnviron: os.Environ(),
+				}}
+			return s, nil
+		}})
+
+	mux.Handle(ControlJobEndpointSignal,
+		requestLogger{log: log, handler: jsonRequestResponder{log, func(decoder jsonDecoder) (interface{}, error) {
+			type reqT struct {
+				Name string
+				Op   string
+			}
+			var req reqT
+			if decoder(&req) != nil {
+				return nil, errors.Errorf("decode failed")
+			}
+
+			var err error
+			switch req.Op {
+			case "wakeup":
+				err = j.jobs.wakeup(req.Name)
+			case "reset":
+				err = j.jobs.reset(req.Name)
+			default:
+				err = fmt.Errorf("operation %q is invalid", req.Op)
+			}
+
+			return struct{}{}, err
+		}}})
+	server := http.Server{
+		Handler: mux,
+		// control socket is local, 1s timeout should be more than sufficient, even on a loaded system
+		WriteTimeout: envconst.Duration("ZREPL_DAEMON_CONTROL_SERVER_WRITE_TIMEOUT", 1*time.Second),
+		ReadTimeout:  envconst.Duration("ZREPL_DAEMON_CONTROL_SERVER_READ_TIMEOUT", 1*time.Second),
+	}
+
+outer:
+	for {
+
+		served := make(chan error)
+		go func() {
+			served <- server.Serve(l)
+			close(served)
+		}()
+
+		select {
+		case <-ctx.Done():
+			log.WithError(ctx.Err()).Info("context done")
+			err := server.Shutdown(context.Background())
+			if err != nil {
+				log.WithError(err).Error("cannot shutdown server")
+			}
+			break outer
+		case err = <-served:
+			if err != nil {
+				log.WithError(err).Error("error serving")
+				break outer
+			}
+		}
+
+	}
+
+}
+
+type jsonResponder struct {
+	log      Logger
+	producer func() (interface{}, error)
+}
+
+func (j jsonResponder) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	logIoErr := func(err error) {
+		if err != nil {
+			j.log.WithError(err).Error("control handler io error")
+		}
+	}
+	res, err := j.producer()
+	if err != nil {
+		j.log.WithError(err).Error("control handler error")
+		w.WriteHeader(http.StatusInternalServerError)
+		_, err = io.WriteString(w, err.Error())
+		logIoErr(err)
+		return
+	}
+	var buf bytes.Buffer
+	err = json.NewEncoder(&buf).Encode(res)
+	if err != nil {
+		j.log.WithError(err).Error("control handler json marshal error")
+		w.WriteHeader(http.StatusInternalServerError)
+		_, err = io.WriteString(w, err.Error())
+	} else {
+		_, err = io.Copy(w, &buf)
+	}
+	logIoErr(err)
+}
+
+type jsonDecoder = func(interface{}) error
+
+type jsonRequestResponder struct {
+	log      Logger
+	producer func(decoder jsonDecoder) (interface{}, error)
+}
+
+func (j jsonRequestResponder) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	logIoErr := func(err error) {
+		if err != nil {
+			j.log.WithError(err).Error("control handler io error")
+		}
+	}
+
+	var decodeError error
+	decoder := func(i interface{}) error {
+		err := json.NewDecoder(r.Body).Decode(&i)
+		decodeError = err
+		return err
+	}
+	res, producerErr := j.producer(decoder)
+
+	//If we had a decode error ignore output of producer and return error
+	if decodeError != nil {
+		w.WriteHeader(http.StatusBadRequest)
+		_, err := io.WriteString(w, decodeError.Error())
+		logIoErr(err)
+		return
+	}
+	if producerErr != nil {
+		j.log.WithError(producerErr).Error("control handler error")
+		w.WriteHeader(http.StatusInternalServerError)
+		_, err := io.WriteString(w, producerErr.Error())
+		logIoErr(err)
+		return
+	}
+
+	var buf bytes.Buffer
+	encodeErr := json.NewEncoder(&buf).Encode(res)
+	if encodeErr != nil {
+		j.log.WithError(producerErr).Error("control handler json marshal error")
+		w.WriteHeader(http.StatusInternalServerError)
+		_, err := io.WriteString(w, encodeErr.Error())
+		logIoErr(err)
+	} else {
+		_, err := io.Copy(w, &buf)
+		logIoErr(err)
+	}
+}
+
+type requestLogger struct {
+	log         logger.Logger
+	handler     http.Handler
+	handlerFunc http.HandlerFunc
+}
+
+func (l requestLogger) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	log := l.log.WithField("method", r.Method).WithField("url", r.URL)
+	log.Debug("start")
+	promControl.requestBegin.WithLabelValues(r.URL.Path).Inc()
+	defer prometheus.NewTimer(promControl.requestFinished.WithLabelValues(r.URL.Path)).ObserveDuration()
+	if l.handlerFunc != nil {
+		l.handlerFunc(w, r)
+	} else if l.handler != nil {
+		l.handler.ServeHTTP(w, r)
+	} else {
+		log.Error("no handler or handlerFunc configured")
+	}
+	log.Debug("finish")
+}

internal/daemon/daemon.go

@@ -0,0 +1,251 @@
+package daemon
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/signal"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/zrepl/zrepl/internal/daemon/logging/trace"
+	"github.com/zrepl/zrepl/internal/endpoint"
+	"github.com/zrepl/zrepl/internal/util/envconst"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/job"
+	"github.com/zrepl/zrepl/internal/daemon/job/reset"
+	"github.com/zrepl/zrepl/internal/daemon/job/wakeup"
+	"github.com/zrepl/zrepl/internal/daemon/logging"
+	"github.com/zrepl/zrepl/internal/logger"
+	"github.com/zrepl/zrepl/internal/version"
+	"github.com/zrepl/zrepl/internal/zfs/zfscmd"
+)
+
+func Run(ctx context.Context, conf *config.Config) error {
+	ctx, cancel := context.WithCancel(ctx)
+
+	defer cancel()
+	sigChan := make(chan os.Signal, 1)
+	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
+	go func() {
+		<-sigChan
+		cancel()
+	}()
+
+	outlets, err := logging.OutletsFromConfig(*conf.Global.Logging)
+	if err != nil {
+		return errors.Wrap(err, "cannot build logging from config")
+	}
+	outlets.Add(newPrometheusLogOutlet(), logger.Debug)
+
+	confJobs, err := job.JobsFromConfig(conf, config.ParseFlagsNone)
+	if err != nil {
+		return errors.Wrap(err, "cannot build jobs from config")
+	}
+
+	log := logger.NewLogger(outlets, 1*time.Second)
+	log.Info(version.NewZreplVersionInformation().String())
+
+	ctx = logging.WithLoggers(ctx, logging.SubsystemLoggersWithUniversalLogger(log))
+	trace.RegisterCallback(trace.Callback{
+		OnBegin: func(ctx context.Context) { logging.GetLogger(ctx, logging.SubsysTraceData).Debug("begin span") },
+		OnEnd: func(ctx context.Context, spanInfo trace.SpanInfo) {
+			logging.
+				GetLogger(ctx, logging.SubsysTraceData).
+				WithField("duration_s", spanInfo.EndedAt().Sub(spanInfo.StartedAt()).Seconds()).
+				Debug("finished span " + spanInfo.TaskAndSpanStack(trace.SpanStackKindAnnotation))
+		},
+	})
+
+	for _, job := range confJobs {
+		if IsInternalJobName(job.Name()) {
+			panic(fmt.Sprintf("internal job name used for config job '%s'", job.Name())) //FIXME
+		}
+	}
+
+	jobs := newJobs()
+
+	// start control socket
+	controlJob, err := newControlJob(conf.Global.Control.SockPath, jobs)
+	if err != nil {
+		panic(err) // FIXME
+	}
+	jobs.start(ctx, controlJob, true)
+
+	for i, jc := range conf.Global.Monitoring {
+		var (
+			job job.Job
+			err error
+		)
+		switch v := jc.Ret.(type) {
+		case *config.PrometheusMonitoring:
+			job, err = newPrometheusJobFromConfig(v)
+		default:
+			return errors.Errorf("unknown monitoring job #%d (type %T)", i, v)
+		}
+		if err != nil {
+			return errors.Wrapf(err, "cannot build monitoring job #%d", i)
+		}
+		jobs.start(ctx, job, true)
+	}
+
+	// register global (=non job-local) metrics
+	version.PrometheusRegister(prometheus.DefaultRegisterer)
+	zfscmd.RegisterMetrics(prometheus.DefaultRegisterer)
+	trace.RegisterMetrics(prometheus.DefaultRegisterer)
+	endpoint.RegisterMetrics(prometheus.DefaultRegisterer)
+
+	log.Info("starting daemon")
+
+	// start regular jobs
+	for _, j := range confJobs {
+		jobs.start(ctx, j, false)
+	}
+
+	select {
+	case <-jobs.wait():
+		log.Info("all jobs finished")
+	case <-ctx.Done():
+		log.WithError(ctx.Err()).Info("context finished")
+	}
+	log.Info("waiting for jobs to finish")
+	<-jobs.wait()
+	log.Info("daemon exiting")
+	return nil
+}
+
+type jobs struct {
+	wg sync.WaitGroup
+
+	// m protects all fields below it
+	m       sync.RWMutex
+	wakeups map[string]wakeup.Func // by Job.Name
+	resets  map[string]reset.Func  // by Job.Name
+	jobs    map[string]job.Job
+}
+
+func newJobs() *jobs {
+	return &jobs{
+		wakeups: make(map[string]wakeup.Func),
+		resets:  make(map[string]reset.Func),
+		jobs:    make(map[string]job.Job),
+	}
+}
+
+func (s *jobs) wait() <-chan struct{} {
+	ch := make(chan struct{})
+	go func() {
+		s.wg.Wait()
+		close(ch)
+	}()
+	return ch
+}
+
+type Status struct {
+	Jobs   map[string]*job.Status
+	Global GlobalStatus
+}
+
+type GlobalStatus struct {
+	ZFSCmds   *zfscmd.Report
+	Envconst  *envconst.Report
+	OsEnviron []string
+}
+
+func (s *jobs) status() map[string]*job.Status {
+	s.m.RLock()
+	defer s.m.RUnlock()
+
+	type res struct {
+		name   string
+		status *job.Status
+	}
+	var wg sync.WaitGroup
+	c := make(chan res, len(s.jobs))
+	for name, j := range s.jobs {
+		wg.Add(1)
+		go func(name string, j job.Job) {
+			defer wg.Done()
+			c <- res{name: name, status: j.Status()}
+		}(name, j)
+	}
+	wg.Wait()
+	close(c)
+	ret := make(map[string]*job.Status, len(s.jobs))
+	for res := range c {
+		ret[res.name] = res.status
+	}
+	return ret
+}
+
+func (s *jobs) wakeup(job string) error {
+	s.m.RLock()
+	defer s.m.RUnlock()
+
+	wu, ok := s.wakeups[job]
+	if !ok {
+		return errors.Errorf("Job %s does not exist", job)
+	}
+	return wu()
+}
+
+func (s *jobs) reset(job string) error {
+	s.m.RLock()
+	defer s.m.RUnlock()
+
+	wu, ok := s.resets[job]
+	if !ok {
+		return errors.Errorf("Job %s does not exist", job)
+	}
+	return wu()
+}
+
+const (
+	jobNamePrometheus = "_prometheus"
+	jobNameControl    = "_control"
+)
+
+func IsInternalJobName(s string) bool {
+	return strings.HasPrefix(s, "_")
+}
+
+func (s *jobs) start(ctx context.Context, j job.Job, internal bool) {
+	s.m.Lock()
+	defer s.m.Unlock()
+
+	ctx = logging.WithInjectedField(ctx, logging.JobField, j.Name())
+
+	jobName := j.Name()
+	if !internal && IsInternalJobName(jobName) {
+		panic(fmt.Sprintf("internal job name used for non-internal job %s", jobName))
+	}
+	if internal && !IsInternalJobName(jobName) {
+		panic(fmt.Sprintf("internal job does not use internal job name %s", jobName))
+	}
+	if _, ok := s.jobs[jobName]; ok {
+		panic(fmt.Sprintf("duplicate job name %s", jobName))
+	}
+
+	j.RegisterMetrics(prometheus.DefaultRegisterer)
+
+	s.jobs[jobName] = j
+	ctx = zfscmd.WithJobID(ctx, j.Name())
+	ctx, wakeup := wakeup.Context(ctx)
+	ctx, resetFunc := reset.Context(ctx)
+	s.wakeups[jobName] = wakeup
+	s.resets[jobName] = resetFunc
+
+	s.wg.Add(1)
+	go func() {
+		defer s.wg.Done()
+		job.GetLogger(ctx).Info("starting job")
+		defer job.GetLogger(ctx).Info("job exited")
+		j.Run(ctx)
+	}()
+}

internal/daemon/filters/fsmapfilter.go

@@ -0,0 +1,283 @@
+package filters
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/endpoint"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type DatasetMapFilter struct {
+	entries []datasetMapFilterEntry
+
+	// if set, only valid filter entries can be added using Add()
+	// and Map() will always return an error
+	filterMode bool
+}
+
+type datasetMapFilterEntry struct {
+	path *zfs.DatasetPath
+	// the mapping. since this datastructure acts as both mapping and filter
+	// we have to convert it to the desired rep dynamically
+	mapping      string
+	subtreeMatch bool
+}
+
+func NewDatasetMapFilter(capacity int, filterMode bool) *DatasetMapFilter {
+	return &DatasetMapFilter{
+		entries:    make([]datasetMapFilterEntry, 0, capacity),
+		filterMode: filterMode,
+	}
+}
+
+func (m *DatasetMapFilter) Add(pathPattern, mapping string) (err error) {
+
+	if m.filterMode {
+		if _, err = m.parseDatasetFilterResult(mapping); err != nil {
+			return
+		}
+	}
+
+	// assert path glob adheres to spec
+	const SUBTREE_PATTERN string = "<"
+	patternCount := strings.Count(pathPattern, SUBTREE_PATTERN)
+	switch {
+	case patternCount > 1:
+	case patternCount == 1 && !strings.HasSuffix(pathPattern, SUBTREE_PATTERN):
+		err = fmt.Errorf("pattern invalid: only one '<' at end of string allowed")
+		return
+	}
+
+	pathStr := strings.TrimSuffix(pathPattern, SUBTREE_PATTERN)
+	path, err := zfs.NewDatasetPath(pathStr)
+	if err != nil {
+		return fmt.Errorf("pattern is not a dataset path: %s", err)
+	}
+
+	entry := datasetMapFilterEntry{
+		path:         path,
+		mapping:      mapping,
+		subtreeMatch: patternCount > 0,
+	}
+	m.entries = append(m.entries, entry)
+	return
+
+}
+
+// find the most specific prefix mapping we have
+//
+// longer prefix wins over shorter prefix, direct wins over glob
+func (m DatasetMapFilter) mostSpecificPrefixMapping(path *zfs.DatasetPath) (idx int, found bool) {
+	lcp, lcp_entry_idx := -1, -1
+	direct_idx := -1
+	for e := range m.entries {
+		entry := m.entries[e]
+		ep := m.entries[e].path
+		lep := ep.Length()
+
+		switch {
+		case !entry.subtreeMatch && ep.Equal(path):
+			direct_idx = e
+			continue
+		case entry.subtreeMatch && path.HasPrefix(ep) && lep > lcp:
+			lcp = lep
+			lcp_entry_idx = e
+		default:
+			continue
+		}
+	}
+
+	if lcp_entry_idx >= 0 || direct_idx >= 0 {
+		found = true
+		switch {
+		case direct_idx >= 0:
+			idx = direct_idx
+		case lcp_entry_idx >= 0:
+			idx = lcp_entry_idx
+		}
+	}
+	return
+}
+
+// Returns target == nil if there is no mapping
+func (m DatasetMapFilter) Map(source *zfs.DatasetPath) (target *zfs.DatasetPath, err error) {
+
+	if m.filterMode {
+		err = fmt.Errorf("using a filter for mapping simply does not work")
+		return
+	}
+
+	mi, hasMapping := m.mostSpecificPrefixMapping(source)
+	if !hasMapping {
+		return nil, nil
+	}
+	me := m.entries[mi]
+
+	if me.mapping == "" {
+		// Special case treatment: 'foo/bar<' => ''
+		if !me.subtreeMatch {
+			return nil, fmt.Errorf("mapping to '' must be a subtree match")
+		}
+		// ok...
+	} else {
+		if strings.HasPrefix("!", me.mapping) {
+			// reject mapping
+			return nil, nil
+		}
+	}
+
+	target, err = zfs.NewDatasetPath(me.mapping)
+	if err != nil {
+		err = fmt.Errorf("mapping target is not a dataset path: %s", err)
+		return
+	}
+	if me.subtreeMatch {
+		// strip common prefix ('<' wildcards are no special case here)
+		extendComps := source.Copy()
+		extendComps.TrimPrefix(me.path)
+		target.Extend(extendComps)
+	}
+	return
+}
+
+func (m DatasetMapFilter) Filter(p *zfs.DatasetPath) (pass bool, err error) {
+
+	if !m.filterMode {
+		err = fmt.Errorf("using a mapping as a filter does not work")
+		return
+	}
+
+	mi, hasMapping := m.mostSpecificPrefixMapping(p)
+	if !hasMapping {
+		pass = false
+		return
+	}
+	me := m.entries[mi]
+	pass, err = m.parseDatasetFilterResult(me.mapping)
+	return
+}
+
+func (m DatasetMapFilter) UserSpecifiedDatasets() (datasets zfs.UserSpecifiedDatasetsSet) {
+	datasets = make(zfs.UserSpecifiedDatasetsSet)
+	for i := range m.entries {
+		datasets[m.entries[i].path.ToString()] = true
+	}
+	return
+}
+
+// Construct a new filter-only DatasetMapFilter from a mapping
+// The new filter allows exactly those paths that were not forbidden by the mapping.
+func (m DatasetMapFilter) InvertedFilter() (inv *DatasetMapFilter, err error) {
+
+	if m.filterMode {
+		err = errors.Errorf("can only invert mappings")
+		return
+	}
+
+	inv = &DatasetMapFilter{
+		make([]datasetMapFilterEntry, len(m.entries)),
+		true,
+	}
+
+	for i, e := range m.entries {
+		inv.entries[i].path, err = zfs.NewDatasetPath(e.mapping)
+		if err != nil {
+			err = errors.Wrapf(err, "mapping cannot be inverted: '%s' is not a dataset path", e.mapping)
+			return
+		}
+		inv.entries[i].mapping = MapFilterResultOk
+		inv.entries[i].subtreeMatch = e.subtreeMatch
+	}
+
+	return inv, nil
+}
+
+// FIXME investigate whether we can support more...
+func (m DatasetMapFilter) Invert() (endpoint.FSMap, error) {
+
+	if m.filterMode {
+		return nil, errors.Errorf("can only invert mappings")
+	}
+
+	if len(m.entries) != 1 {
+		return nil, errors.Errorf("inversion of complicated mappings is not implemented") // FIXME
+	}
+
+	e := m.entries[0]
+
+	inv := &DatasetMapFilter{
+		make([]datasetMapFilterEntry, len(m.entries)),
+		false,
+	}
+	mp, err := zfs.NewDatasetPath(e.mapping)
+	if err != nil {
+		return nil, err
+	}
+
+	inv.entries[0] = datasetMapFilterEntry{
+		path:         mp,
+		mapping:      e.path.ToString(),
+		subtreeMatch: e.subtreeMatch,
+	}
+
+	return inv, nil
+}
+
+// Creates a new DatasetMapFilter in filter mode from a mapping
+// All accepting mapping results are mapped to accepting filter results
+// All rejecting mapping results are mapped to rejecting filter results
+func (m DatasetMapFilter) AsFilter() endpoint.FSFilter {
+
+	f := &DatasetMapFilter{
+		make([]datasetMapFilterEntry, len(m.entries)),
+		true,
+	}
+
+	for i, e := range m.entries {
+		var newe datasetMapFilterEntry = e
+		if strings.HasPrefix(newe.mapping, "!") {
+			newe.mapping = MapFilterResultOmit
+		} else {
+			newe.mapping = MapFilterResultOk
+		}
+		f.entries[i] = newe
+	}
+
+	return f
+}
+
+const (
+	MapFilterResultOk   string = "ok"
+	MapFilterResultOmit string = "!"
+)
+
+// Parse a dataset filter result
+func (m DatasetMapFilter) parseDatasetFilterResult(result string) (pass bool, err error) {
+	l := strings.ToLower(result)
+	if l == MapFilterResultOk {
+		return true, nil
+	}
+	if l == MapFilterResultOmit {
+		return false, nil
+	}
+	return false, fmt.Errorf("'%s' is not a valid filter result", result)
+}
+
+func DatasetMapFilterFromConfig(in map[string]bool) (f *DatasetMapFilter, err error) {
+
+	f = NewDatasetMapFilter(len(in), true)
+	for pathPattern, accept := range in {
+		mapping := MapFilterResultOmit
+		if accept {
+			mapping = MapFilterResultOk
+		}
+		if err = f.Add(pathPattern, mapping); err != nil {
+			err = fmt.Errorf("invalid mapping entry ['%s':'%s']: %s", pathPattern, mapping, err)
+			return
+		}
+	}
+	return
+}

internal/daemon/filters/fsmapfilter_test.go

@@ -0,0 +1,89 @@
+package filters
+
+import (
+	"testing"
+
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+func TestDatasetMapFilter(t *testing.T) {
+
+	type testCase struct {
+		name      string
+		filter    map[string]string
+		checkPass map[string]bool // each entry is checked to match the filter's `pass` return value
+	}
+
+	tcs := []testCase{
+		{
+			"default_no_match",
+			map[string]string{},
+			map[string]bool{
+				"":      false,
+				"foo":   false,
+				"zroot": false,
+			},
+		},
+		{
+			"more_specific_path_has_precedence",
+			map[string]string{
+				"tank<":         "ok",
+				"tank/tmp<":     "!",
+				"tank/home/x<":  "!",
+				"tank/home/x/1": "ok",
+			},
+			map[string]bool{
+				"zroot":         false,
+				"tank":          true,
+				"tank/tmp":      false,
+				"tank/tmp/foo":  false,
+				"tank/home/x":   false,
+				"tank/home/y":   true,
+				"tank/home/x/1": true,
+				"tank/home/x/2": false,
+			},
+		},
+		{
+			"precedence_of_specific_over_subtree_wildcard_on_same_path",
+			map[string]string{
+				"tank/home/bob":  "ok",
+				"tank/home/bob<": "!",
+			},
+			map[string]bool{
+				"tank/home/bob":           true,
+				"tank/home/bob/downloads": false,
+			},
+		},
+	}
+
+	for tc := range tcs {
+		t.Run(tcs[tc].name, func(t *testing.T) {
+			c := tcs[tc]
+			f := NewDatasetMapFilter(len(c.filter), true)
+			for p, a := range c.filter {
+				err := f.Add(p, a)
+				if err != nil {
+					t.Fatalf("incorrect filter spec: %s", err)
+				}
+			}
+			for p, checkPass := range c.checkPass {
+				zp, err := zfs.NewDatasetPath(p)
+				if err != nil {
+					t.Fatalf("incorrect path spec: %s", err)
+				}
+				pass, err := f.Filter(zp)
+				if err != nil {
+					t.Fatalf("unexpected filter error: %s", err)
+				}
+				ok := pass == checkPass
+				failstr := "OK"
+				if !ok {
+					failstr = "FAIL"
+					t.Fail()
+				}
+				t.Logf("%-40q  %5v  (exp=%v act=%v)", p, failstr, checkPass, pass)
+			}
+		})
+	}
+
+}

internal/daemon/hooks/edge_string.go

@@ -0,0 +1,35 @@
+// Code generated by "stringer -type=Edge"; DO NOT EDIT.
+
+package hooks
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[Pre-1]
+	_ = x[Callback-2]
+	_ = x[Post-4]
+}
+
+const (
+	_Edge_name_0 = "PreCallback"
+	_Edge_name_1 = "Post"
+)
+
+var (
+	_Edge_index_0 = [...]uint8{0, 3, 11}
+)
+
+func (i Edge) String() string {
+	switch {
+	case 1 <= i && i <= 2:
+		i -= 1
+		return _Edge_name_0[_Edge_index_0[i]:_Edge_index_0[i+1]]
+	case i == 4:
+		return _Edge_name_1
+	default:
+		return "Edge(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+}

internal/daemon/hooks/hook_config.go

@@ -0,0 +1,52 @@
+package hooks
+
+import (
+	"fmt"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type List []Hook
+
+func HookFromConfig(in config.HookEnum) (Hook, error) {
+	switch v := in.Ret.(type) {
+	case *config.HookCommand:
+		return NewCommandHook(v)
+	case *config.HookPostgresCheckpoint:
+		return PgChkptHookFromConfig(v)
+	case *config.HookMySQLLockTables:
+		return MyLockTablesFromConfig(v)
+	default:
+		return nil, fmt.Errorf("unknown hook type %T", v)
+	}
+}
+
+func ListFromConfig(in *config.HookList) (r *List, err error) {
+	hl := make(List, len(*in))
+
+	for i, h := range *in {
+		hl[i], err = HookFromConfig(h)
+		if err != nil {
+			return nil, fmt.Errorf("create hook #%d: %s", i+1, err)
+		}
+	}
+
+	return &hl, nil
+}
+
+func (l List) CopyFilteredForFilesystem(fs *zfs.DatasetPath) (ret List, err error) {
+	ret = make(List, 0, len(l))
+
+	for _, h := range l {
+		var passFilesystem bool
+		if passFilesystem, err = h.Filesystems().Filter(fs); err != nil {
+			return nil, err
+		}
+		if passFilesystem {
+			ret = append(ret, h)
+		}
+	}
+
+	return ret, nil
+}

internal/daemon/hooks/hook_docs.go

@@ -0,0 +1,33 @@
+// Package hooks implements pre- and post snapshot hooks.
+//
+// Plan is a generic executor for ExpectStepReports before and after an activity specified in a callback.
+// It provides a reporting facility that can be polled while the plan is executing to gather progress information.
+//
+// This package also provides all supported hook type implementations and abstractions around them.
+//
+// # Use For Other Kinds Of ExpectStepReports
+//
+// This package REQUIRES REFACTORING before it can be used for other activities than snapshots, e.g. pre- and post-replication:
+//
+// The Hook interface requires a hook to provide a Filesystems() filter, which doesn't make sense for
+// all kinds of activities.
+//
+// The hook implementations should move out of this package.
+// However, there is a lot of tight coupling which to untangle isn't worth it ATM.
+//
+// # How This Package Is Used By Package Snapper
+//
+// Deserialize a config.List using ListFromConfig().
+// Then it MUST filter the list to only contain hooks for a particular filesystem using
+// hooksList.CopyFilteredForFilesystem(fs).
+//
+// Then create a CallbackHook using NewCallbackHookForFilesystem().
+//
+// Pass all of the above to NewPlan() which provides a Report() and Run() method:
+//
+// Plan.Run(ctx context.Context,dryRun bool) executes the plan and take a context as argument that should contain a logger added using hooks.WithLogger()).
+// The value of dryRun is passed through to the hooks' Run() method.
+// Command hooks make it available in the environment variable ZREPL_DRYRUN.
+//
+// Plan.Report() can be called while Plan.Run() is executing to give an overview of plan execution progress (future use in "zrepl status").
+package hooks

internal/daemon/hooks/hook_exec.go

@@ -0,0 +1,292 @@
+package hooks
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+// Re-export type here so that
+// every file in package hooks doesn't
+// have to import github.com/zrepl/zrepl/zfs
+type Filter zfs.DatasetFilter
+
+type Hook interface {
+	Filesystems() Filter
+
+	// If true and the Pre edge invocation of Run fails, Post edge will not run and other Pre edges will not run.
+	ErrIsFatal() bool
+
+	// Run is invoked by HookPlan for a Pre edge.
+	// If HookReport.HadError() == false, the Post edge will be invoked, too.
+	Run(ctx context.Context, edge Edge, phase Phase, dryRun bool, extra Env, state map[interface{}]interface{}) HookReport
+
+	String() string
+}
+
+type Phase string
+
+const (
+	PhaseSnapshot = Phase("snapshot")
+	PhaseTesting  = Phase("testing")
+)
+
+func (p Phase) String() string {
+	return string(p)
+}
+
+//go:generate stringer -type=Edge
+type Edge uint
+
+const (
+	Pre = Edge(1 << iota)
+	Callback
+	Post
+)
+
+func (e Edge) StringForPhase(phase Phase) string {
+	return fmt.Sprintf("%s_%s", e.String(), phase.String())
+}
+
+//go:generate enumer -type=StepStatus -trimprefix=Step
+type StepStatus int
+
+const (
+	StepPending StepStatus = 1 << iota
+	StepExec
+	StepOk
+	StepErr
+	StepSkippedDueToFatalErr
+	StepSkippedDueToPreErr
+)
+
+type HookReport interface {
+	String() string
+	HadError() bool
+	Error() string
+}
+
+type Step struct {
+	Hook       Hook
+	Edge       Edge
+	Status     StepStatus
+	Begin, End time.Time
+	// Report may be nil
+	// FIXME cannot serialize this for client status, but contains interesting info (like what error happened)
+	Report HookReport
+	state  map[interface{}]interface{}
+}
+
+func (s Step) String() (out string) {
+	fatal := "~"
+	if s.Hook.ErrIsFatal() && s.Edge == Pre {
+		fatal = "!"
+	}
+	runTime := "..."
+	if s.Status != StepPending {
+		t := s.End.Sub(s.Begin)
+		runTime = t.Round(time.Millisecond).String()
+	}
+	return fmt.Sprintf("[%s] [%5s] %s [%s]  %s", s.Status, runTime, fatal, s.Edge, s.Hook)
+}
+
+type Plan struct {
+	mtx sync.RWMutex
+
+	steps []*Step
+	pre   []*Step // protected by mtx
+	cb    *Step
+	post  []*Step // not reversed, i.e. entry at index i corresponds to pre-edge in pre[i]
+
+	phase Phase
+	env   Env
+}
+
+func NewPlan(hooks *List, phase Phase, cb *CallbackHook, extra Env) (*Plan, error) {
+
+	var pre, post []*Step
+	// TODO sanity check unique name of hook?
+	for _, hook := range *hooks {
+		state := make(map[interface{}]interface{})
+		preE := &Step{
+			Hook:   hook,
+			Edge:   Pre,
+			Status: StepPending,
+			state:  state,
+		}
+		pre = append(pre, preE)
+		postE := &Step{
+			Hook:   hook,
+			Edge:   Post,
+			Status: StepPending,
+			state:  state,
+		}
+		post = append(post, postE)
+	}
+
+	cbE := &Step{
+		Hook:   cb,
+		Edge:   Callback,
+		Status: StepPending,
+	}
+
+	steps := make([]*Step, 0, len(pre)+len(post)+1)
+	steps = append(steps, pre...)
+	steps = append(steps, cbE)
+	for i := len(post) - 1; i >= 0; i-- {
+		steps = append(steps, post[i])
+	}
+
+	plan := &Plan{
+		phase: phase,
+		env:   extra,
+		steps: steps,
+		pre:   pre,
+		post:  post,
+		cb:    cbE,
+	}
+
+	return plan, nil
+}
+
+type PlanReport []Step
+
+func (p *Plan) Report() PlanReport {
+	p.mtx.RLock()
+	defer p.mtx.RUnlock()
+	rep := make([]Step, len(p.steps))
+	for i := range rep {
+		rep[i] = *p.steps[i]
+	}
+	return rep
+}
+
+func (r PlanReport) HadError() bool {
+	for _, e := range r {
+		if e.Status == StepErr {
+			return true
+		}
+	}
+	return false
+}
+
+func (r PlanReport) HadFatalError() bool {
+	for _, e := range r {
+		if e.Status == StepSkippedDueToFatalErr {
+			return true
+		}
+	}
+	return false
+}
+
+func (r PlanReport) String() string {
+	stepStrings := make([]string, len(r))
+	for i, e := range r {
+		stepStrings[i] = fmt.Sprintf("%02d %s", i+1, e)
+	}
+	return strings.Join(stepStrings, "\n")
+}
+
+func (p *Plan) Run(ctx context.Context, dryRun bool) {
+	p.mtx.RLock()
+	defer p.mtx.RUnlock()
+	w := func(f func()) {
+		p.mtx.RUnlock()
+		defer p.mtx.RLock()
+		p.mtx.Lock()
+		defer p.mtx.Unlock()
+		f()
+	}
+	runHook := func(s *Step, ctx context.Context, edge Edge) HookReport {
+		w(func() { s.Status = StepExec })
+		begin := time.Now()
+		r := s.Hook.Run(ctx, edge, p.phase, dryRun, p.env, s.state)
+		end := time.Now()
+		w(func() {
+			s.Report = r
+			s.Status = StepOk
+			if r.HadError() {
+				s.Status = StepErr
+			}
+			s.Begin, s.End = begin, end
+		})
+		return r
+	}
+
+	l := getLogger(ctx)
+
+	// it's a stack, execute until we reach the end of the list (last item in)
+	// or fail inbetween
+	l.Info("run pre-edges in configuration order")
+	next := 0
+	for ; next < len(p.pre); next++ {
+		e := p.pre[next]
+		l := l.WithField("hook", e.Hook)
+		r := runHook(e, ctx, Pre)
+		if r.HadError() {
+			l.WithError(r).Error("hook invocation failed for pre-edge")
+			if e.Hook.ErrIsFatal() {
+				l.Error("the hook run was aborted due to a fatal error in this hook")
+				break
+			}
+		}
+	}
+
+	hadFatalErr := next != len(p.pre)
+	if hadFatalErr {
+		l.Error("fatal error in a pre-snapshot hook invocation")
+		l.Error("no snapshot will be taken")
+		l.Error("only running post-edges for successful pre-edges")
+		w(func() {
+			p.post[next].Status = StepSkippedDueToFatalErr
+			for i := next + 1; i < len(p.pre); i++ {
+				p.pre[i].Status = StepSkippedDueToFatalErr
+				p.post[i].Status = StepSkippedDueToFatalErr
+			}
+			p.cb.Status = StepSkippedDueToFatalErr
+		})
+		return
+	}
+
+	l.Info("running callback")
+	cbR := runHook(p.cb, ctx, Callback)
+	if cbR.HadError() {
+		l.WithError(cbR).Error("callback failed")
+	}
+
+	l.Info("run post-edges for successful pre-edges in reverse configuration order")
+
+	// the constructor produces pre and post entries
+	// post is NOT reversed
+	next-- // now at index of last executed pre-edge
+	for ; next >= 0; next-- {
+		e := p.post[next]
+		l := l.WithField("hook", e.Hook)
+
+		if p.pre[next].Status != StepOk {
+			if p.pre[next].Status != StepErr {
+				panic(fmt.Sprintf("expecting a pre-edge hook report to be either Ok or Err, got %s", p.pre[next].Status))
+			}
+			l.Info("skip post-edge because pre-edge failed")
+			w(func() {
+				e.Status = StepSkippedDueToPreErr
+			})
+			continue
+		}
+
+		report := runHook(e, ctx, Post)
+
+		if report.HadError() {
+			l.WithError(report).Error("hook invocation failed for post-edge")
+			l.Error("subsequent post-edges run regardless of this post-edge failure")
+		}
+
+		// ErrIsFatal is only relevant for Pre
+
+	}
+
+}

internal/daemon/hooks/hook_logging.go

@@ -0,0 +1,91 @@
+package hooks
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"sync"
+
+	"github.com/zrepl/zrepl/internal/daemon/logging"
+	"github.com/zrepl/zrepl/internal/logger"
+	"github.com/zrepl/zrepl/internal/util/envconst"
+)
+
+type Logger = logger.Logger
+
+func GetLogger(ctx context.Context) Logger { return getLogger(ctx) }
+
+func getLogger(ctx context.Context) Logger {
+	return logging.GetLogger(ctx, logging.SubsysHooks)
+}
+
+const MAX_HOOK_LOG_SIZE_DEFAULT int = 1 << 20
+
+type logWriter struct {
+	/*
+		Mutex prevents:
+			concurrent writes to buf, scanner in Write([]byte)
+			data race on scanner vs Write([]byte)
+				and concurrent write to buf (call to buf.Reset())
+				in Close()
+
+		(Also, Close() should generally block until any Write() call completes.)
+	*/
+	mtx     *sync.Mutex
+	buf     bytes.Buffer
+	scanner *bufio.Scanner
+	logger  Logger
+	level   logger.Level
+	field   string
+}
+
+func NewLogWriter(mtx *sync.Mutex, logger Logger, level logger.Level, field string) *logWriter {
+	w := new(logWriter)
+	w.mtx = mtx
+	w.scanner = bufio.NewScanner(&w.buf)
+	w.logger = logger
+	w.level = level
+	w.field = field
+	return w
+}
+
+func (w *logWriter) log(line string) {
+	w.logger.WithField(w.field, line).Log(w.level, "hook output")
+}
+
+func (w *logWriter) logUnreadBytes() error {
+	for w.scanner.Scan() {
+		w.log(w.scanner.Text())
+	}
+	if w.buf.Cap() > envconst.Int("ZREPL_MAX_HOOK_LOG_SIZE", MAX_HOOK_LOG_SIZE_DEFAULT) {
+		w.buf.Reset()
+	}
+
+	return nil
+}
+
+func (w *logWriter) Write(in []byte) (int, error) {
+	w.mtx.Lock()
+	defer w.mtx.Unlock()
+
+	n, bufErr := w.buf.Write(in)
+	if bufErr != nil {
+		return n, bufErr
+	}
+
+	err := w.logUnreadBytes()
+	if err != nil {
+		return n, err
+	}
+	// Always reset the scanner for the next Write
+	w.scanner = bufio.NewScanner(&w.buf)
+
+	return n, nil
+}
+
+func (w *logWriter) Close() (err error) {
+	w.mtx.Lock()
+	defer w.mtx.Unlock()
+
+	return w.logUnreadBytes()
+}

internal/daemon/hooks/hook_type_callback.go

@@ -0,0 +1,65 @@
+package hooks
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/zrepl/zrepl/internal/daemon/filters"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type HookJobCallback func(ctx context.Context) error
+
+type CallbackHook struct {
+	cb            HookJobCallback
+	filter        Filter
+	displayString string
+}
+
+func NewCallbackHookForFilesystem(displayString string, fs *zfs.DatasetPath, cb HookJobCallback) *CallbackHook {
+	filter, _ := filters.DatasetMapFilterFromConfig(map[string]bool{fs.ToString(): true})
+	return NewCallbackHook(displayString, cb, filter)
+}
+
+func NewCallbackHook(displayString string, cb HookJobCallback, filter Filter) *CallbackHook {
+	return &CallbackHook{
+		cb:            cb,
+		filter:        filter,
+		displayString: displayString,
+	}
+}
+
+func (h *CallbackHook) Filesystems() Filter {
+	return h.filter
+}
+
+func (h *CallbackHook) ErrIsFatal() bool {
+	return false // callback is by definition
+}
+
+func (h *CallbackHook) String() string {
+	return h.displayString
+}
+
+type CallbackHookReport struct {
+	Name string
+	Err  error
+}
+
+func (r *CallbackHookReport) String() string {
+	if r.HadError() {
+		return r.Error()
+	}
+	return r.Name
+}
+
+func (r *CallbackHookReport) HadError() bool { return r.Err != nil }
+
+func (r *CallbackHookReport) Error() string {
+	return fmt.Sprintf("%s error: %s", r.Name, r.Err)
+}
+
+func (h *CallbackHook) Run(ctx context.Context, edge Edge, phase Phase, dryRun bool, extra Env, state map[interface{}]interface{}) HookReport {
+	err := h.cb(ctx)
+	return &CallbackHookReport{h.displayString, err}
+}

internal/daemon/hooks/hook_type_command.go

@@ -0,0 +1,199 @@
+package hooks
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"math"
+	"os"
+	"os/exec"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/filters"
+	"github.com/zrepl/zrepl/internal/logger"
+	"github.com/zrepl/zrepl/internal/util/circlog"
+	"github.com/zrepl/zrepl/internal/util/envconst"
+)
+
+type HookEnvVar string
+
+const (
+	EnvType     HookEnvVar = "ZREPL_HOOKTYPE"
+	EnvDryRun   HookEnvVar = "ZREPL_DRYRUN"
+	EnvFS       HookEnvVar = "ZREPL_FS"
+	EnvSnapshot HookEnvVar = "ZREPL_SNAPNAME"
+	EnvTimeout  HookEnvVar = "ZREPL_TIMEOUT"
+)
+
+type Env map[HookEnvVar]string
+
+func NewHookEnv(edge Edge, phase Phase, dryRun bool, timeout time.Duration, extra Env) Env {
+	r := Env{
+		EnvTimeout: fmt.Sprintf("%.f", math.Floor(timeout.Seconds())),
+	}
+
+	edgeString := edge.StringForPhase(phase)
+	r[EnvType] = strings.ToLower(edgeString)
+
+	var dryRunString string
+	if dryRun {
+		dryRunString = "true"
+	} else {
+		dryRunString = ""
+	}
+	r[EnvDryRun] = dryRunString
+
+	for k, v := range extra {
+		r[k] = v
+	}
+
+	return r
+}
+
+type CommandHook struct {
+	edge       Edge
+	filter     Filter
+	errIsFatal bool
+	command    string
+	timeout    time.Duration
+}
+
+type CommandHookReport struct {
+	Command                      string
+	Args                         []string // currently always empty
+	Env                          Env
+	Err                          error
+	CapturedStdoutStderrCombined []byte
+}
+
+func (r *CommandHookReport) String() string {
+	// Reproduces a POSIX shell-compatible command line
+	var cmdLine strings.Builder
+	sep := ""
+
+	// Make sure environment variables are always
+	// printed in the same order
+	var hookEnvKeys []HookEnvVar
+	for k := range r.Env {
+		hookEnvKeys = append(hookEnvKeys, k)
+	}
+	sort.Slice(hookEnvKeys, func(i, j int) bool { return string(hookEnvKeys[i]) < string(hookEnvKeys[j]) })
+
+	for _, k := range hookEnvKeys {
+		cmdLine.WriteString(fmt.Sprintf("%s%s='%s'", sep, k, r.Env[k]))
+		sep = " "
+	}
+
+	cmdLine.WriteString(fmt.Sprintf("%s%s", sep, r.Command))
+	for _, a := range r.Args {
+		cmdLine.WriteString(fmt.Sprintf("%s'%s'", sep, a))
+	}
+
+	var msg string
+	if r.Err == nil {
+		msg = "command hook"
+	} else {
+		msg = fmt.Sprintf("command hook failed with %q", r.Err)
+	}
+
+	return fmt.Sprintf("%s: \"%s\"", msg, cmdLine.String()) // no %q to make copy-pastable
+}
+func (r *CommandHookReport) Error() string {
+	if r.Err == nil {
+		return ""
+	}
+	return fmt.Sprintf("%s FAILED with error: %s", r.String(), r.Err)
+}
+
+func (r *CommandHookReport) HadError() bool {
+	return r.Err != nil
+}
+
+func NewCommandHook(in *config.HookCommand) (r *CommandHook, err error) {
+	r = &CommandHook{
+		errIsFatal: in.ErrIsFatal,
+		command:    in.Path,
+		timeout:    in.Timeout,
+	}
+
+	r.filter, err = filters.DatasetMapFilterFromConfig(in.Filesystems)
+	if err != nil {
+		return nil, fmt.Errorf("cannot parse filesystem filter: %s", err)
+	}
+
+	r.edge = Pre | Post
+
+	return r, nil
+}
+
+func (h *CommandHook) Filesystems() Filter {
+	return h.filter
+}
+
+func (h *CommandHook) ErrIsFatal() bool {
+	return h.errIsFatal
+}
+
+func (h *CommandHook) String() string {
+	return h.command
+}
+
+func (h *CommandHook) Run(ctx context.Context, edge Edge, phase Phase, dryRun bool, extra Env, state map[interface{}]interface{}) HookReport {
+	l := getLogger(ctx).WithField("command", h.command)
+
+	cmdCtx, cancel := context.WithTimeout(ctx, h.timeout)
+	defer cancel()
+
+	cmdExec := exec.CommandContext(cmdCtx, h.command)
+
+	hookEnv := NewHookEnv(edge, phase, dryRun, h.timeout, extra)
+	cmdEnv := os.Environ()
+	for k, v := range hookEnv {
+		cmdEnv = append(cmdEnv, fmt.Sprintf("%s=%s", k, v))
+	}
+	cmdExec.Env = cmdEnv
+
+	var scanMutex sync.Mutex
+	combinedOutput, err := circlog.NewCircularLog(envconst.Int("ZREPL_MAX_HOOK_LOG_SIZE", MAX_HOOK_LOG_SIZE_DEFAULT))
+	if err != nil {
+		return &CommandHookReport{Err: err}
+	}
+	logErrWriter := NewLogWriter(&scanMutex, l, logger.Warn, "stderr")
+	logOutWriter := NewLogWriter(&scanMutex, l, logger.Info, "stdout")
+	defer logErrWriter.Close()
+	defer logOutWriter.Close()
+
+	cmdExec.Stderr = io.MultiWriter(logErrWriter, combinedOutput)
+	cmdExec.Stdout = io.MultiWriter(logOutWriter, combinedOutput)
+
+	report := &CommandHookReport{
+		Command: h.command,
+		Env:     hookEnv,
+		// no report.Args
+	}
+
+	err = cmdExec.Start()
+	if err != nil {
+		report.Err = err
+		return report
+	}
+
+	err = cmdExec.Wait()
+	combinedOutputBytes := combinedOutput.Bytes()
+	report.CapturedStdoutStderrCombined = make([]byte, len(combinedOutputBytes))
+	copy(report.CapturedStdoutStderrCombined, combinedOutputBytes)
+	if err != nil {
+		if cmdCtx.Err() == context.DeadlineExceeded {
+			report.Err = fmt.Errorf("timed out after %s: %s", h.timeout, err)
+			return report
+		}
+		report.Err = err
+		return report
+	}
+
+	return report
+}

internal/daemon/hooks/hook_type_mysql_lock_tables.go

@@ -0,0 +1,148 @@
+package hooks
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"strings"
+
+	sqldriver "database/sql/driver"
+
+	"github.com/go-sql-driver/mysql"
+
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/filters"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+// Hook to implement the following recommmendation from MySQL docs
+// https://dev.mysql.com/doc/mysql-backup-excerpt/5.7/en/backup-methods.html
+//
+//	Making Backups Using a File System Snapshot:
+//
+//	If you are using a Veritas file system, you can make a backup like this:
+//
+//	   	From a client program, execute FLUSH TABLES WITH READ LOCK.
+//	   	From another shell, execute mount vxfs snapshot.
+//	   	From the first client, execute UNLOCK TABLES.
+//	   	Copy files from the snapshot.
+//	   	Unmount the snapshot.
+//
+//		Similar snapshot capabilities may be available in other file systems, such as LVM or ZFS.
+//
+
+type MySQLLockTables struct {
+	errIsFatal  bool
+	connector   sqldriver.Connector
+	filesystems Filter
+}
+
+type myLockTablesStateKey int
+
+const (
+	myLockTablesConnection myLockTablesStateKey = 1 + iota
+)
+
+func MyLockTablesFromConfig(in *config.HookMySQLLockTables) (*MySQLLockTables, error) {
+	conf, err := mysql.ParseDSN(in.DSN)
+	if err != nil {
+		return nil, errors.Wrap(err, "`dsn` invalid")
+	}
+	cn, err := mysql.NewConnector(conf)
+	if err != nil {
+		return nil, errors.Wrap(err, "`connect` invalid")
+	}
+
+	filesystems, err := filters.DatasetMapFilterFromConfig(in.Filesystems)
+	if err != nil {
+		return nil, errors.Wrap(err, "`filesystems` invalid")
+	}
+
+	return &MySQLLockTables{
+		in.ErrIsFatal,
+		cn,
+		filesystems,
+	}, nil
+}
+
+func (h *MySQLLockTables) ErrIsFatal() bool    { return h.errIsFatal }
+func (h *MySQLLockTables) Filesystems() Filter { return h.filesystems }
+func (h *MySQLLockTables) String() string      { return "MySQL FLUSH TABLES WITH READ LOCK" }
+
+type MyLockTablesReport struct {
+	What string
+	Err  error
+}
+
+func (r *MyLockTablesReport) HadError() bool { return r.Err != nil }
+func (r *MyLockTablesReport) Error() string  { return r.String() }
+func (r *MyLockTablesReport) String() string {
+	var s strings.Builder
+	s.WriteString(r.What)
+	if r.Err != nil {
+		fmt.Fprintf(&s, ": %s", r.Err)
+	}
+	return s.String()
+}
+
+func (h *MySQLLockTables) Run(ctx context.Context, edge Edge, phase Phase, dryRun bool, extra Env, state map[interface{}]interface{}) HookReport {
+	fs, ok := extra[EnvFS]
+	if !ok {
+		panic(extra)
+	}
+	dp, err := zfs.NewDatasetPath(fs)
+	if err != nil {
+		panic(err)
+	}
+	if pass, err := h.filesystems.Filter(dp); err != nil {
+		return &MyLockTablesReport{What: "filesystem filter", Err: err}
+	} else if !pass {
+		getLogger(ctx).Debug("filesystem does not match filter, skipping")
+		return &MyLockTablesReport{What: "filesystem filter skipped this filesystem", Err: nil}
+	}
+
+	switch edge {
+	case Pre:
+		err := h.doRunPre(ctx, dp, dryRun, state)
+		return &MyLockTablesReport{"FLUSH TABLES WITH READ LOCK", err}
+	case Post:
+		err := h.doRunPost(ctx, dp, dryRun, state)
+		return &MyLockTablesReport{"UNLOCK TABLES", err}
+	}
+	return &MyLockTablesReport{What: "skipped this edge", Err: nil}
+}
+
+func (h *MySQLLockTables) doRunPre(ctx context.Context, fs *zfs.DatasetPath, dry bool, state map[interface{}]interface{}) (err error) {
+	db := sql.OpenDB(h.connector)
+	defer func(err *error) {
+		if *err != nil {
+			db.Close()
+		}
+	}(&err)
+
+	getLogger(ctx).Debug("do FLUSH TABLES WITH READ LOCK")
+	_, err = db.ExecContext(ctx, "FLUSH TABLES WITH READ LOCK")
+	if err != nil {
+		return
+	}
+
+	state[myLockTablesConnection] = db
+
+	return nil
+}
+
+func (h *MySQLLockTables) doRunPost(ctx context.Context, fs *zfs.DatasetPath, dry bool, state map[interface{}]interface{}) error {
+
+	db := state[myLockTablesConnection].(*sql.DB)
+	defer db.Close()
+
+	getLogger(ctx).Debug("do UNLOCK TABLES")
+	_, err := db.ExecContext(ctx, "UNLOCK TABLES")
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

internal/daemon/hooks/hook_type_postgres_checkpoint.go

@@ -0,0 +1,98 @@
+package hooks
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"math"
+	"time"
+
+	"github.com/lib/pq"
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/filters"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type PgChkptHook struct {
+	errIsFatal  bool
+	connector   *pq.Connector
+	filesystems Filter
+}
+
+func PgChkptHookFromConfig(in *config.HookPostgresCheckpoint) (*PgChkptHook, error) {
+	filesystems, err := filters.DatasetMapFilterFromConfig(in.Filesystems)
+	if err != nil {
+		return nil, errors.Wrap(err, "`filesystems` invalid")
+	}
+	cn, err := pq.NewConnector(in.DSN)
+	if err != nil {
+		return nil, errors.Wrap(err, "`dsn` invalid")
+	}
+
+	return &PgChkptHook{
+		in.ErrIsFatal,
+		cn,
+		filesystems,
+	}, nil
+}
+
+func (h *PgChkptHook) ErrIsFatal() bool    { return h.errIsFatal }
+func (h *PgChkptHook) Filesystems() Filter { return h.filesystems }
+func (h *PgChkptHook) String() string      { return "postgres checkpoint" }
+
+type PgChkptHookReport struct{ Err error }
+
+func (r *PgChkptHookReport) HadError() bool { return r.Err != nil }
+func (r *PgChkptHookReport) Error() string  { return r.Err.Error() }
+func (r *PgChkptHookReport) String() string {
+	if r.Err != nil {
+		return fmt.Sprintf("postgres CHECKPOINT failed: %s", r.Err)
+	} else {
+		return "postgres CHECKPOINT completed"
+	}
+}
+
+func (h *PgChkptHook) Run(ctx context.Context, edge Edge, phase Phase, dryRun bool, extra Env, state map[interface{}]interface{}) HookReport {
+	if edge != Pre {
+		return &PgChkptHookReport{nil}
+	}
+	fs, ok := extra[EnvFS]
+	if !ok {
+		panic(extra)
+	}
+	dp, err := zfs.NewDatasetPath(fs)
+	if err != nil {
+		panic(err)
+	}
+	err = h.doRunPre(ctx, dp, dryRun)
+	return &PgChkptHookReport{err}
+}
+
+func (h *PgChkptHook) doRunPre(ctx context.Context, fs *zfs.DatasetPath, dry bool) error {
+
+	if pass, err := h.filesystems.Filter(fs); err != nil || !pass {
+		getLogger(ctx).Debug("filesystem does not match filter, skipping")
+		return err
+	}
+
+	db := sql.OpenDB(h.connector)
+	defer db.Close()
+	dl, ok := ctx.Deadline()
+	if ok {
+		timeout := uint64(math.Floor(time.Until(dl).Seconds() * 1000)) // TODO go1.13 milliseconds
+		getLogger(ctx).WithField("statement_timeout", timeout).Debug("setting statement timeout for CHECKPOINT")
+		_, err := db.ExecContext(ctx, "SET statement_timeout TO ?", timeout)
+		if err != nil {
+			return err
+		}
+	}
+	if dry {
+		getLogger(ctx).Debug("dry-run - use ping instead of CHECKPOINT")
+		return db.PingContext(ctx)
+	}
+	getLogger(ctx).Info("execute CHECKPOINT command")
+	_, err := db.ExecContext(ctx, "CHECKPOINT")
+	return err
+}

internal/daemon/hooks/hooks_test.go

@@ -0,0 +1,489 @@
+package hooks_test
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"regexp"
+	"testing"
+	"text/template"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/zrepl/zrepl/internal/daemon/logging/trace"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/hooks"
+	"github.com/zrepl/zrepl/internal/daemon/logging"
+	"github.com/zrepl/zrepl/internal/logger"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type comparisonAssertionFunc func(require.TestingT, interface{}, interface{}, ...interface{})
+type valueAssertionFunc func(require.TestingT, interface{}, ...interface{})
+
+type expectStep struct {
+	ExpectedEdge hooks.Edge
+	ExpectStatus hooks.StepStatus
+	OutputTest   valueAssertionFunc
+	ErrorTest    valueAssertionFunc
+}
+
+type testCase struct {
+	Name           string
+	Config         []string
+	IsSlow         bool
+	SuppressOutput bool
+
+	ExpectCallbackSkipped bool
+	ExpectHadFatalErr     bool
+	ExpectHadError        bool
+	ExpectStepReports     []expectStep
+}
+
+func curryLeft(f comparisonAssertionFunc, expected interface{}) valueAssertionFunc {
+	return curry(f, expected, false)
+}
+
+func curryRight(f comparisonAssertionFunc, expected interface{}) valueAssertionFunc {
+	return curry(f, expected, true)
+}
+
+func curry(f comparisonAssertionFunc, expected interface{}, right bool) (ret valueAssertionFunc) {
+	ret = func(t require.TestingT, s interface{}, v ...interface{}) {
+		var x interface{}
+		var y interface{}
+		if right {
+			x = s
+			y = expected
+		} else {
+			x = expected
+			y = s
+		}
+
+		if len(v) > 0 {
+			f(t, x, y, v)
+		} else {
+			f(t, x, y)
+		}
+	}
+	return
+}
+
+func TestHooks(t *testing.T) {
+	ctx, end := trace.WithTaskFromStack(context.Background())
+	defer end()
+
+	testFSName := "testpool/testdataset"
+	testSnapshotName := "testsnap"
+
+	tmpl, err := template.New("TestHooks").Parse(`
+jobs:
+- name: TestHooks
+  type: snap
+  filesystems: {"<": true}
+  snapshotting:
+    type: periodic
+    interval: 1m
+    prefix: zrepl_snapjob_
+    hooks:
+    {{- template "List" . }}
+  pruning:
+    keep:
+      - type: last_n
+        count: 10
+`)
+	if err != nil {
+		panic(err)
+	}
+
+	regexpTest := func(s string) valueAssertionFunc {
+		return curryLeft(require.Regexp, regexp.MustCompile(s))
+	}
+
+	containsTest := func(s string) valueAssertionFunc {
+		return curryRight(require.Contains, s)
+	}
+
+	testTable := []testCase{
+		testCase{
+			Name: "no_hooks",
+			ExpectStepReports: []expectStep{
+				{ExpectedEdge: hooks.Callback, ExpectStatus: hooks.StepOk},
+			},
+		},
+		testCase{
+			Name:           "timeout",
+			IsSlow:         true,
+			ExpectHadError: true,
+			Config:         []string{`{type: command, path: {{.WorkDir}}/test/test-timeout.sh, timeout: 2s}`},
+			ExpectStepReports: []expectStep{
+				expectStep{
+					ExpectedEdge: hooks.Pre,
+					ExpectStatus: hooks.StepErr,
+					OutputTest:   containsTest(fmt.Sprintf("TEST pre_testing %s@%s ZREPL_TIMEOUT=2", testFSName, testSnapshotName)),
+					ErrorTest:    regexpTest(`timed out after 2(.\d+)?s`),
+				},
+				expectStep{ExpectedEdge: hooks.Callback, ExpectStatus: hooks.StepOk},
+				expectStep{
+					ExpectedEdge: hooks.Post,
+					ExpectStatus: hooks.StepSkippedDueToPreErr,
+				},
+			},
+		},
+		testCase{
+			Name:           "check_env",
+			Config:         []string{`{type: command, path: {{.WorkDir}}/test/test-report-env.sh}`},
+			ExpectHadError: false,
+			ExpectStepReports: []expectStep{
+				expectStep{
+					ExpectedEdge: hooks.Pre,
+					ExpectStatus: hooks.StepOk,
+					OutputTest:   containsTest(fmt.Sprintf("TEST pre_testing %s@%s", testFSName, testSnapshotName)),
+				},
+				expectStep{ExpectedEdge: hooks.Callback, ExpectStatus: hooks.StepOk},
+				expectStep{
+					ExpectedEdge: hooks.Post,
+					ExpectStatus: hooks.StepOk,
+					OutputTest:   containsTest(fmt.Sprintf("TEST post_testing %s@%s", testFSName, testSnapshotName)),
+				},
+			},
+		},
+
+		testCase{
+			Name:                  "nonfatal_pre_error_continues",
+			ExpectCallbackSkipped: false,
+			ExpectHadError:        true,
+			Config:                []string{`{type: command, path: {{.WorkDir}}/test/test-error.sh}`},
+			ExpectStepReports: []expectStep{
+				expectStep{
+					ExpectedEdge: hooks.Pre,
+					ExpectStatus: hooks.StepErr,
+					OutputTest:   containsTest(fmt.Sprintf("TEST ERROR pre_testing %s@%s", testFSName, testSnapshotName)),
+					ErrorTest:    regexpTest("^command hook failed.*exit status 1$"),
+				},
+				expectStep{ExpectedEdge: hooks.Callback, ExpectStatus: hooks.StepOk},
+				expectStep{
+					ExpectedEdge: hooks.Post,
+					ExpectStatus: hooks.StepSkippedDueToPreErr, // post-edge is not executed for failing pre-edge
+				},
+			},
+		},
+
+		testCase{
+			Name:                  "pre_error_fatal_skips_subsequent_pre_edges_and_callback_and_its_post_edge_and_post_edges",
+			ExpectCallbackSkipped: true,
+			ExpectHadFatalErr:     true,
+			ExpectHadError:        true,
+			Config: []string{
+				`{type: command, path: {{.WorkDir}}/test/test-error.sh, err_is_fatal: true}`,
+				`{type: command, path: {{.WorkDir}}/test/test-report-env.sh}`,
+			},
+			ExpectStepReports: []expectStep{
+				expectStep{
+					ExpectedEdge: hooks.Pre,
+					ExpectStatus: hooks.StepErr,
+					OutputTest:   containsTest(fmt.Sprintf("TEST ERROR pre_testing %s@%s", testFSName, testSnapshotName)),
+					ErrorTest:    regexpTest("^command hook failed.*exit status 1$"),
+				},
+				expectStep{
+					ExpectedEdge: hooks.Pre,
+					ExpectStatus: hooks.StepSkippedDueToFatalErr,
+				},
+				expectStep{ExpectedEdge: hooks.Callback, ExpectStatus: hooks.StepSkippedDueToFatalErr},
+				expectStep{
+					ExpectedEdge: hooks.Post,
+					ExpectStatus: hooks.StepSkippedDueToFatalErr,
+				},
+				expectStep{
+					ExpectedEdge: hooks.Post,
+					ExpectStatus: hooks.StepSkippedDueToFatalErr,
+				},
+			},
+		},
+
+		testCase{
+			Name:              "post_error_fails_are_ignored_even_if_fatal",
+			ExpectHadFatalErr: false, // only occurs during Post, so it's not a fatal error
+			ExpectHadError:    true,
+			Config: []string{
+				`{type: command, path: {{.WorkDir}}/test/test-post-error.sh, err_is_fatal: true}`,
+				`{type: command, path: {{.WorkDir}}/test/test-report-env.sh}`,
+			},
+			ExpectStepReports: []expectStep{
+				expectStep{
+					// No-action run of test-post-error.sh
+					ExpectedEdge: hooks.Pre,
+					ExpectStatus: hooks.StepOk,
+					OutputTest:   require.Empty,
+				},
+				expectStep{
+					// Pre run of test-report-env.sh
+					ExpectedEdge: hooks.Pre,
+					ExpectStatus: hooks.StepOk,
+					OutputTest:   containsTest(fmt.Sprintf("TEST pre_testing %s@%s", testFSName, testSnapshotName)),
+				},
+				expectStep{ExpectedEdge: hooks.Callback, ExpectStatus: hooks.StepOk},
+				expectStep{
+					ExpectedEdge: hooks.Post,
+					ExpectStatus: hooks.StepOk,
+					OutputTest:   containsTest(fmt.Sprintf("TEST post_testing %s@%s", testFSName, testSnapshotName)),
+				},
+				expectStep{
+					ExpectedEdge: hooks.Post,
+					ExpectStatus: hooks.StepErr,
+					OutputTest:   containsTest(fmt.Sprintf("TEST ERROR post_testing %s@%s", testFSName, testSnapshotName)),
+					ErrorTest:    regexpTest("^command hook failed.*exit status 1$"),
+				},
+			},
+		},
+
+		testCase{
+			Name:   "cleanup_check_env",
+			Config: []string{`{type: command, path: {{.WorkDir}}/test/test-report-env.sh}`},
+			ExpectStepReports: []expectStep{
+				expectStep{
+					ExpectedEdge: hooks.Pre,
+					ExpectStatus: hooks.StepOk,
+					OutputTest:   containsTest(fmt.Sprintf("TEST pre_testing %s@%s", testFSName, testSnapshotName)),
+				},
+				expectStep{ExpectedEdge: hooks.Callback, ExpectStatus: hooks.StepOk},
+				expectStep{
+					ExpectedEdge: hooks.Post,
+					ExpectStatus: hooks.StepOk,
+					OutputTest:   containsTest(fmt.Sprintf("TEST post_testing %s@%s", testFSName, testSnapshotName)),
+				},
+			},
+		},
+
+		testCase{
+			Name:              "pre_error_cancels_post",
+			Config:            []string{`{type: command, path: {{.WorkDir}}/test/test-pre-error-post-ok.sh}`},
+			ExpectHadError:    true,
+			ExpectHadFatalErr: false,
+			ExpectStepReports: []expectStep{
+				expectStep{
+					ExpectedEdge: hooks.Pre,
+					ExpectStatus: hooks.StepErr,
+					OutputTest:   containsTest(fmt.Sprintf("TEST ERROR pre_testing %s@%s", testFSName, testSnapshotName)),
+					ErrorTest:    regexpTest("^command hook failed.*exit status 1$"),
+				},
+				expectStep{ExpectedEdge: hooks.Callback, ExpectStatus: hooks.StepOk},
+				expectStep{
+					ExpectedEdge: hooks.Post,
+					ExpectStatus: hooks.StepSkippedDueToPreErr,
+				},
+			},
+		},
+
+		testCase{
+			Name: "pre_error_does_not_cancel_other_posts_but_itself",
+			Config: []string{
+				`{type: command, path: {{.WorkDir}}/test/test-report-env.sh}`,
+				`{type: command, path: {{.WorkDir}}/test/test-pre-error-post-ok.sh}`,
+			},
+			ExpectHadError:    true,
+			ExpectHadFatalErr: false,
+			ExpectStepReports: []expectStep{
+				expectStep{
+					ExpectedEdge: hooks.Pre,
+					ExpectStatus: hooks.StepOk,
+					OutputTest:   containsTest(fmt.Sprintf("TEST pre_testing %s@%s", testFSName, testSnapshotName)),
+				},
+				expectStep{
+					ExpectedEdge: hooks.Pre,
+					ExpectStatus: hooks.StepErr,
+					OutputTest:   containsTest(fmt.Sprintf("TEST ERROR pre_testing %s@%s", testFSName, testSnapshotName)),
+					ErrorTest:    regexpTest("^command hook failed.*exit status 1$"),
+				},
+				expectStep{ExpectedEdge: hooks.Callback, ExpectStatus: hooks.StepOk},
+				expectStep{
+					ExpectedEdge: hooks.Post,
+					ExpectStatus: hooks.StepSkippedDueToPreErr,
+				},
+				expectStep{
+					ExpectedEdge: hooks.Post,
+					ExpectStatus: hooks.StepOk,
+					OutputTest:   containsTest(fmt.Sprintf("TEST post_testing %s@%s", testFSName, testSnapshotName)),
+				},
+			},
+		},
+
+		testCase{
+			Name:              "exceed_buffer_limit",
+			SuppressOutput:    true,
+			Config:            []string{`{type: command, path: {{.WorkDir}}/test/test-large-stdout.sh}`},
+			ExpectHadError:    false,
+			ExpectHadFatalErr: false,
+			ExpectStepReports: []expectStep{
+				expectStep{
+					ExpectedEdge: hooks.Pre,
+					ExpectStatus: hooks.StepOk,
+					OutputTest: func(t require.TestingT, s interface{}, v ...interface{}) {
+						require.Len(t, s, 1<<20)
+					},
+				},
+				expectStep{ExpectedEdge: hooks.Callback, ExpectStatus: hooks.StepOk},
+				expectStep{
+					// No-action run of above hook
+					ExpectedEdge: hooks.Post,
+					ExpectStatus: hooks.StepOk,
+					OutputTest:   require.Empty,
+				},
+			},
+		},
+
+		/*
+			Following not intended to test functionality of
+			filter package. Only to demonstrate that hook
+			filters are being applied. The following should
+			result in NO hooks running. If it does run, a
+			fatal hooks.RunReport will be returned.
+		*/
+		testCase{
+			Name: "exclude_all_filesystems",
+			Config: []string{
+				`{type: command, path: {{.WorkDir}}/test/test-error.sh, err_is_fatal: true, filesystems: {"<": false}}`,
+			},
+			ExpectStepReports: []expectStep{
+				expectStep{
+					ExpectedEdge: hooks.Callback,
+					ExpectStatus: hooks.StepOk,
+				},
+			},
+		},
+	}
+
+	parseHookConfig := func(t *testing.T, in string) *config.Config {
+		t.Helper()
+		conf, err := config.ParseConfigBytes([]byte(in))
+		require.NoError(t, err)
+		require.NotNil(t, conf)
+		return conf
+	}
+
+	fillHooks := func(tt *testCase) string {
+		// make hook path absolute
+		cwd, err := os.Getwd()
+		if err != nil {
+			panic("os.Getwd() failed")
+		}
+		var hooksTmpl string = "\n"
+		for _, l := range tt.Config {
+			hooksTmpl += fmt.Sprintf("    - %s\n", l)
+		}
+		tmpl.New("List").Parse(hooksTmpl)
+
+		var outBytes bytes.Buffer
+		data := struct {
+			WorkDir string
+		}{
+			WorkDir: cwd,
+		}
+		if err := tmpl.Execute(&outBytes, data); err != nil {
+			panic(err)
+		}
+
+		return outBytes.String()
+	}
+
+	var c *config.Config
+	fs, err := zfs.NewDatasetPath(testFSName)
+	require.NoError(t, err)
+
+	log := logger.NewTestLogger(t)
+
+	var cbReached bool
+	cb := hooks.NewCallbackHookForFilesystem("testcallback", fs, func(_ context.Context) error {
+		cbReached = true
+		return nil
+	})
+
+	hookEnvExtra := hooks.Env{
+		hooks.EnvFS:       fs.ToString(),
+		hooks.EnvSnapshot: testSnapshotName,
+	}
+
+	for _, tt := range testTable {
+		if testing.Short() && tt.IsSlow {
+			continue
+		}
+
+		t.Run(tt.Name, func(t *testing.T) {
+			c = parseHookConfig(t, fillHooks(&tt))
+			snp := c.Jobs[0].Ret.(*config.SnapJob).Snapshotting.Ret.(*config.SnapshottingPeriodic)
+			hookList, err := hooks.ListFromConfig(&snp.Hooks)
+			require.NoError(t, err)
+
+			filteredHooks, err := hookList.CopyFilteredForFilesystem(fs)
+			require.NoError(t, err)
+			plan, err := hooks.NewPlan(&filteredHooks, hooks.PhaseTesting, cb, hookEnvExtra)
+			require.NoError(t, err)
+			t.Logf("REPORT PRE EXECUTION:\n%s", plan.Report())
+
+			cbReached = false
+
+			if testing.Verbose() && !tt.SuppressOutput {
+				ctx = logging.WithLoggers(ctx, logging.SubsystemLoggersWithUniversalLogger(log))
+			}
+			plan.Run(ctx, false)
+			report := plan.Report()
+
+			t.Logf("REPORT POST EXECUTION:\n%s", report)
+
+			/*
+			 * TEST ASSERTIONS
+			 */
+
+			t.Logf("len(runReports)=%v", len(report))
+			t.Logf("len(tt.ExpectStepReports)=%v", len(tt.ExpectStepReports))
+			require.Equal(t, len(tt.ExpectStepReports), len(report), "ExpectStepReports must be same length as expected number of hook runs, excluding possible Callback")
+
+			// Check if callback ran, when required
+			if tt.ExpectCallbackSkipped {
+				require.False(t, cbReached, "callback ran but should not have run")
+			} else {
+				require.True(t, cbReached, "callback should have run but did not")
+			}
+
+			// Check if a fatal run error occurred and was expected
+			require.Equal(t, tt.ExpectHadFatalErr, report.HadFatalError(), "non-matching HadFatalError")
+			require.Equal(t, tt.ExpectHadError, report.HadError(), "non-matching HadError")
+
+			if tt.ExpectHadFatalErr {
+				require.True(t, tt.ExpectHadError, "ExpectHadFatalErr implies ExpectHadError")
+			}
+			if !tt.ExpectHadError {
+				require.False(t, tt.ExpectHadFatalErr, "!ExpectHadError implies !ExpectHadFatalErr")
+			}
+
+			// Iterate through each expected hook run
+			for i, hook := range tt.ExpectStepReports {
+				t.Logf("expecting report conforming to %v", hook)
+
+				exp, act := hook.ExpectStatus, report[i].Status
+				require.Equal(t, exp, act, "%s != %s", exp, act)
+
+				// Check for required ExpectedEdge
+				require.NotZero(t, hook.ExpectedEdge, "each hook must have an ExpectedEdge")
+				require.Equal(t, hook.ExpectedEdge, report[i].Edge,
+					"incorrect edge: expected %q, actual %q", hook.ExpectedEdge.String(), report[i].Edge.String(),
+				)
+
+				// Check for expected output
+				if hook.OutputTest != nil {
+					require.IsType(t, (*hooks.CommandHookReport)(nil), report[i].Report)
+					chr := report[i].Report.(*hooks.CommandHookReport)
+					hook.OutputTest(t, string(chr.CapturedStdoutStderrCombined))
+				}
+
+				// Check for expected errors
+				if hook.ErrorTest != nil {
+					hook.ErrorTest(t, string(report[i].Report.Error()))
+				}
+			}
+
+		})
+	}
+}

internal/daemon/hooks/stepstatus_enumer.go

@@ -0,0 +1,76 @@
+// Code generated by "enumer -type=StepStatus -trimprefix=Step"; DO NOT EDIT.
+
+package hooks
+
+import (
+	"fmt"
+)
+
+const (
+	_StepStatusName_0 = "PendingExec"
+	_StepStatusName_1 = "Ok"
+	_StepStatusName_2 = "Err"
+	_StepStatusName_3 = "SkippedDueToFatalErr"
+	_StepStatusName_4 = "SkippedDueToPreErr"
+)
+
+var (
+	_StepStatusIndex_0 = [...]uint8{0, 7, 11}
+	_StepStatusIndex_1 = [...]uint8{0, 2}
+	_StepStatusIndex_2 = [...]uint8{0, 3}
+	_StepStatusIndex_3 = [...]uint8{0, 20}
+	_StepStatusIndex_4 = [...]uint8{0, 18}
+)
+
+func (i StepStatus) String() string {
+	switch {
+	case 1 <= i && i <= 2:
+		i -= 1
+		return _StepStatusName_0[_StepStatusIndex_0[i]:_StepStatusIndex_0[i+1]]
+	case i == 4:
+		return _StepStatusName_1
+	case i == 8:
+		return _StepStatusName_2
+	case i == 16:
+		return _StepStatusName_3
+	case i == 32:
+		return _StepStatusName_4
+	default:
+		return fmt.Sprintf("StepStatus(%d)", i)
+	}
+}
+
+var _StepStatusValues = []StepStatus{1, 2, 4, 8, 16, 32}
+
+var _StepStatusNameToValueMap = map[string]StepStatus{
+	_StepStatusName_0[0:7]:  1,
+	_StepStatusName_0[7:11]: 2,
+	_StepStatusName_1[0:2]:  4,
+	_StepStatusName_2[0:3]:  8,
+	_StepStatusName_3[0:20]: 16,
+	_StepStatusName_4[0:18]: 32,
+}
+
+// StepStatusString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func StepStatusString(s string) (StepStatus, error) {
+	if val, ok := _StepStatusNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to StepStatus values", s)
+}
+
+// StepStatusValues returns all values of the enum
+func StepStatusValues() []StepStatus {
+	return _StepStatusValues
+}
+
+// IsAStepStatus returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i StepStatus) IsAStepStatus() bool {
+	for _, v := range _StepStatusValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}

internal/daemon/hooks/test/test-error.sh

@@ -0,0 +1,5 @@
+#!/bin/sh -eu
+
+>&2 echo "TEST ERROR $ZREPL_HOOKTYPE $ZREPL_FS@$ZREPL_SNAPNAME"
+
+exit 1

internal/daemon/hooks/test/test-large-stdout.sh

@@ -0,0 +1,18 @@
+#!/bin/sh -eu
+
+# Exceed default hook log size of 1<<20 bytes by double
+# The Go test should fail if buffer size exceeds 1MB
+
+pre_testing() {
+	ln=0
+	while :; do printf '%06d: 012345678901234567890123456789012345678901234567890123456789012345678901\n' "$ln"; ln="$(($ln + 1))"; done \
+	| head -c$(( 2 << 20 ))
+}
+
+case "$ZREPL_HOOKTYPE" in
+	pre_testing)
+		"$ZREPL_HOOKTYPE";;
+	*)
+		# Not handled by this script
+		exit 0;;
+esac

internal/daemon/hooks/test/test-post-error.sh

@@ -0,0 +1,15 @@
+#!/bin/sh -eu
+
+post_testing() {
+	>&2 echo "TEST ERROR $ZREPL_HOOKTYPE $ZREPL_FS@$ZREPL_SNAPNAME"
+
+	exit 1
+}
+
+case "$ZREPL_HOOKTYPE" in
+	post_testing)
+		"$ZREPL_HOOKTYPE";;
+	*)
+		# Not handled by this script
+		exit 0;;
+esac

internal/daemon/hooks/test/test-pre-error-post-ok.sh

@@ -0,0 +1,11 @@
+#!/bin/sh -eu
+
+if [ "$ZREPL_HOOKTYPE" = "pre_testing" ]; then
+	>&2 echo "TEST ERROR $ZREPL_HOOKTYPE $ZREPL_FS@$ZREPL_SNAPNAME"
+	exit 1
+elif [ "$ZREPL_HOOKTYPE" = "post_testing" ]; then
+	echo "TEST $ZREPL_HOOKTYPE $ZREPL_FS@$ZREPL_SNAPNAME"
+else
+	printf "Unknown hook type: %s" "$ZREPL_HOOKTYPE" 
+	exit 255
+fi

internal/daemon/hooks/test/test-report-env.sh

@@ -0,0 +1,3 @@
+#!/bin/sh -eu
+
+echo "TEST $ZREPL_HOOKTYPE $ZREPL_FS@$ZREPL_SNAPNAME ${ZREPL_DRYRUN:+(dry run)}"

internal/daemon/hooks/test/test-timeout.sh

@@ -0,0 +1,5 @@
+#!/bin/sh -eu
+
+echo "TEST $ZREPL_HOOKTYPE $ZREPL_FS@$ZREPL_SNAPNAME ZREPL_TIMEOUT=$ZREPL_TIMEOUT"
+
+exec sleep $(($ZREPL_TIMEOUT + 1))

internal/daemon/job/active.go

@@ -0,0 +1,567 @@
+package job
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/zrepl/zrepl/internal/daemon/logging/trace"
+	"github.com/zrepl/zrepl/internal/util/envconst"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/job/reset"
+	"github.com/zrepl/zrepl/internal/daemon/job/wakeup"
+	"github.com/zrepl/zrepl/internal/daemon/pruner"
+	"github.com/zrepl/zrepl/internal/daemon/snapper"
+	"github.com/zrepl/zrepl/internal/endpoint"
+	"github.com/zrepl/zrepl/internal/replication"
+	"github.com/zrepl/zrepl/internal/replication/driver"
+	"github.com/zrepl/zrepl/internal/replication/logic"
+	"github.com/zrepl/zrepl/internal/replication/report"
+	"github.com/zrepl/zrepl/internal/rpc"
+	"github.com/zrepl/zrepl/internal/transport"
+	"github.com/zrepl/zrepl/internal/transport/fromconfig"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type ActiveSide struct {
+	mode      activeMode
+	name      endpoint.JobID
+	connecter transport.Connecter
+
+	replicationDriverConfig driver.Config
+
+	prunerFactory *pruner.PrunerFactory
+
+	promRepStateSecs      *prometheus.HistogramVec // labels: state
+	promPruneSecs         *prometheus.HistogramVec // labels: prune_side
+	promBytesReplicated   *prometheus.CounterVec   // labels: filesystem
+	promReplicationErrors prometheus.Gauge
+	promLastSuccessful    prometheus.Gauge
+
+	tasksMtx sync.Mutex
+	tasks    activeSideTasks
+}
+
+//go:generate enumer -type=ActiveSideState
+type ActiveSideState int
+
+const (
+	ActiveSideReplicating ActiveSideState = 1 << iota
+	ActiveSidePruneSender
+	ActiveSidePruneReceiver
+	ActiveSideDone // also errors
+)
+
+type activeSideTasks struct {
+	state ActiveSideState
+
+	// valid for state ActiveSideReplicating, ActiveSidePruneSender, ActiveSidePruneReceiver, ActiveSideDone
+	replicationReport driver.ReportFunc
+	replicationCancel context.CancelFunc
+
+	// valid for state ActiveSidePruneSender, ActiveSidePruneReceiver, ActiveSideDone
+	prunerSender, prunerReceiver *pruner.Pruner
+
+	// valid for state ActiveSidePruneReceiver, ActiveSideDone
+	prunerSenderCancel, prunerReceiverCancel context.CancelFunc
+}
+
+func (a *ActiveSide) updateTasks(u func(*activeSideTasks)) activeSideTasks {
+	a.tasksMtx.Lock()
+	defer a.tasksMtx.Unlock()
+	copy := a.tasks
+	if u == nil {
+		return copy
+	}
+	u(&copy)
+	a.tasks = copy
+	return copy
+}
+
+type activeMode interface {
+	ConnectEndpoints(ctx context.Context, connecter transport.Connecter)
+	DisconnectEndpoints()
+	SenderReceiver() (logic.Sender, logic.Receiver)
+	Type() Type
+	PlannerPolicy() logic.PlannerPolicy
+	RunPeriodic(ctx context.Context, wakeUpCommon chan<- struct{})
+	SnapperReport() *snapper.Report
+	ResetConnectBackoff()
+}
+
+type modePush struct {
+	setupMtx      sync.Mutex
+	sender        *endpoint.Sender
+	receiver      *rpc.Client
+	senderConfig  *endpoint.SenderConfig
+	plannerPolicy *logic.PlannerPolicy
+	snapper       snapper.Snapper
+}
+
+func (m *modePush) ConnectEndpoints(ctx context.Context, connecter transport.Connecter) {
+	m.setupMtx.Lock()
+	defer m.setupMtx.Unlock()
+	if m.receiver != nil || m.sender != nil {
+		panic("inconsistent use of ConnectEndpoints and DisconnectEndpoints")
+	}
+	m.sender = endpoint.NewSender(*m.senderConfig)
+	m.receiver = rpc.NewClient(connecter, rpc.GetLoggersOrPanic(ctx))
+}
+
+func (m *modePush) DisconnectEndpoints() {
+	m.setupMtx.Lock()
+	defer m.setupMtx.Unlock()
+	m.receiver.Close()
+	m.sender = nil
+	m.receiver = nil
+}
+
+func (m *modePush) SenderReceiver() (logic.Sender, logic.Receiver) {
+	m.setupMtx.Lock()
+	defer m.setupMtx.Unlock()
+	return m.sender, m.receiver
+}
+
+func (m *modePush) Type() Type { return TypePush }
+
+func (m *modePush) PlannerPolicy() logic.PlannerPolicy { return *m.plannerPolicy }
+
+func (m *modePush) RunPeriodic(ctx context.Context, wakeUpCommon chan<- struct{}) {
+	m.snapper.Run(ctx, wakeUpCommon)
+}
+
+func (m *modePush) SnapperReport() *snapper.Report {
+	r := m.snapper.Report()
+	return &r
+}
+
+func (m *modePush) ResetConnectBackoff() {
+	m.setupMtx.Lock()
+	defer m.setupMtx.Unlock()
+	if m.receiver != nil {
+		m.receiver.ResetConnectBackoff()
+	}
+}
+
+func modePushFromConfig(g *config.Global, in *config.PushJob, jobID endpoint.JobID) (*modePush, error) {
+	m := &modePush{}
+	var err error
+
+	m.senderConfig, err = buildSenderConfig(in, jobID)
+	if err != nil {
+		return nil, errors.Wrap(err, "sender config")
+	}
+
+	replicationConfig, err := logic.ReplicationConfigFromConfig(in.Replication)
+	if err != nil {
+		return nil, errors.Wrap(err, "field `replication`")
+	}
+
+	conflictResolution, err := logic.ConflictResolutionFromConfig(in.ConflictResolution)
+	if err != nil {
+		return nil, errors.Wrap(err, "field `conflict_resolution`")
+	}
+
+	m.plannerPolicy = &logic.PlannerPolicy{
+		ConflictResolution:        conflictResolution,
+		ReplicationConfig:         replicationConfig,
+		SizeEstimationConcurrency: in.Replication.Concurrency.SizeEstimates,
+	}
+	if err := m.plannerPolicy.Validate(); err != nil {
+		return nil, errors.Wrap(err, "cannot build planner policy")
+	}
+
+	if m.snapper, err = snapper.FromConfig(g, m.senderConfig.FSF, in.Snapshotting); err != nil {
+		return nil, errors.Wrap(err, "cannot build snapper")
+	}
+
+	return m, nil
+}
+
+type modePull struct {
+	setupMtx       sync.Mutex
+	receiver       *endpoint.Receiver
+	receiverConfig endpoint.ReceiverConfig
+	sender         *rpc.Client
+	plannerPolicy  *logic.PlannerPolicy
+	interval       config.PositiveDurationOrManual
+}
+
+func (m *modePull) ConnectEndpoints(ctx context.Context, connecter transport.Connecter) {
+	m.setupMtx.Lock()
+	defer m.setupMtx.Unlock()
+	if m.receiver != nil || m.sender != nil {
+		panic("inconsistent use of ConnectEndpoints and DisconnectEndpoints")
+	}
+	m.receiver = endpoint.NewReceiver(m.receiverConfig)
+	m.sender = rpc.NewClient(connecter, rpc.GetLoggersOrPanic(ctx))
+}
+
+func (m *modePull) DisconnectEndpoints() {
+	m.setupMtx.Lock()
+	defer m.setupMtx.Unlock()
+	m.sender.Close()
+	m.sender = nil
+	m.receiver = nil
+}
+
+func (m *modePull) SenderReceiver() (logic.Sender, logic.Receiver) {
+	m.setupMtx.Lock()
+	defer m.setupMtx.Unlock()
+	return m.sender, m.receiver
+}
+
+func (*modePull) Type() Type { return TypePull }
+
+func (m *modePull) PlannerPolicy() logic.PlannerPolicy { return *m.plannerPolicy }
+
+func (m *modePull) RunPeriodic(ctx context.Context, wakeUpCommon chan<- struct{}) {
+	if m.interval.Manual {
+		GetLogger(ctx).Info("manual pull configured, periodic pull disabled")
+		// "waiting for wakeups" is printed in common ActiveSide.do
+		return
+	}
+	t := time.NewTicker(m.interval.Interval)
+	defer t.Stop()
+	for {
+		select {
+		case <-t.C:
+			select {
+			case wakeUpCommon <- struct{}{}:
+			default:
+				GetLogger(ctx).
+					WithField("pull_interval", m.interval).
+					Warn("pull job took longer than pull interval")
+				wakeUpCommon <- struct{}{} // block anyways, to queue up the wakeup
+			}
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+func (m *modePull) SnapperReport() *snapper.Report {
+	return nil
+}
+
+func (m *modePull) ResetConnectBackoff() {
+	m.setupMtx.Lock()
+	defer m.setupMtx.Unlock()
+	if m.sender != nil {
+		m.sender.ResetConnectBackoff()
+	}
+}
+
+func modePullFromConfig(g *config.Global, in *config.PullJob, jobID endpoint.JobID) (m *modePull, err error) {
+	m = &modePull{}
+	m.interval = in.Interval
+
+	replicationConfig, err := logic.ReplicationConfigFromConfig(in.Replication)
+	if err != nil {
+		return nil, errors.Wrap(err, "field `replication`")
+	}
+
+	conflictResolution, err := logic.ConflictResolutionFromConfig(in.ConflictResolution)
+	if err != nil {
+		return nil, errors.Wrap(err, "field `conflict_resolution`")
+	}
+
+	m.plannerPolicy = &logic.PlannerPolicy{
+		ConflictResolution:        conflictResolution,
+		ReplicationConfig:         replicationConfig,
+		SizeEstimationConcurrency: in.Replication.Concurrency.SizeEstimates,
+	}
+	if err := m.plannerPolicy.Validate(); err != nil {
+		return nil, errors.Wrap(err, "cannot build planner policy")
+	}
+
+	m.receiverConfig, err = buildReceiverConfig(in, jobID)
+	if err != nil {
+		return nil, err
+	}
+
+	return m, nil
+}
+
+func replicationDriverConfigFromConfig(in *config.Replication) (c driver.Config, err error) {
+	c = driver.Config{
+		StepQueueConcurrency:     in.Concurrency.Steps,
+		MaxAttempts:              envconst.Int("ZREPL_REPLICATION_MAX_ATTEMPTS", 3),
+		ReconnectHardFailTimeout: envconst.Duration("ZREPL_REPLICATION_RECONNECT_HARD_FAIL_TIMEOUT", 10*time.Minute),
+	}
+	err = c.Validate()
+	return c, err
+}
+
+func activeSide(g *config.Global, in *config.ActiveJob, configJob interface{}, parseFlags config.ParseFlags) (j *ActiveSide, err error) {
+
+	j = &ActiveSide{}
+	j.name, err = endpoint.MakeJobID(in.Name)
+	if err != nil {
+		return nil, errors.Wrap(err, "invalid job name")
+	}
+
+	switch v := configJob.(type) {
+	case *config.PushJob:
+		j.mode, err = modePushFromConfig(g, v, j.name) // shadow
+	case *config.PullJob:
+		j.mode, err = modePullFromConfig(g, v, j.name) // shadow
+	default:
+		panic(fmt.Sprintf("implementation error: unknown job type %T", v))
+	}
+	if err != nil {
+		return nil, err // no wrapping required
+	}
+
+	j.promRepStateSecs = prometheus.NewHistogramVec(prometheus.HistogramOpts{
+		Namespace:   "zrepl",
+		Subsystem:   "replication",
+		Name:        "state_time",
+		Help:        "seconds spent during replication",
+		ConstLabels: prometheus.Labels{"zrepl_job": j.name.String()},
+	}, []string{"state"})
+	j.promBytesReplicated = prometheus.NewCounterVec(prometheus.CounterOpts{
+		Namespace:   "zrepl",
+		Subsystem:   "replication",
+		Name:        "bytes_replicated",
+		Help:        "number of bytes replicated from sender to receiver per filesystem",
+		ConstLabels: prometheus.Labels{"zrepl_job": j.name.String()},
+	}, []string{"filesystem"})
+	j.promReplicationErrors = prometheus.NewGauge(prometheus.GaugeOpts{
+		Namespace:   "zrepl",
+		Subsystem:   "replication",
+		Name:        "filesystem_errors",
+		Help:        "number of filesystems that failed replication in the latest replication attempt, or -1 if the job failed before enumerating the filesystems",
+		ConstLabels: prometheus.Labels{"zrepl_job": j.name.String()},
+	})
+	j.promLastSuccessful = prometheus.NewGauge(prometheus.GaugeOpts{
+		Namespace:   "zrepl",
+		Subsystem:   "replication",
+		Name:        "last_successful",
+		Help:        "timestamp of last successful replication",
+		ConstLabels: prometheus.Labels{"zrepl_job": j.name.String()},
+	})
+
+	j.connecter, err = fromconfig.ConnecterFromConfig(g, in.Connect, parseFlags)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot build client")
+	}
+
+	j.promPruneSecs = prometheus.NewHistogramVec(prometheus.HistogramOpts{
+		Namespace:   "zrepl",
+		Subsystem:   "pruning",
+		Name:        "time",
+		Help:        "seconds spent in pruner",
+		ConstLabels: prometheus.Labels{"zrepl_job": j.name.String()},
+	}, []string{"prune_side"})
+	j.prunerFactory, err = pruner.NewPrunerFactory(in.Pruning, j.promPruneSecs)
+	if err != nil {
+		return nil, err
+	}
+
+	j.replicationDriverConfig, err = replicationDriverConfigFromConfig(in.Replication)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot build replication driver config")
+	}
+
+	return j, nil
+}
+
+func (j *ActiveSide) RegisterMetrics(registerer prometheus.Registerer) {
+	registerer.MustRegister(j.promRepStateSecs)
+	registerer.MustRegister(j.promPruneSecs)
+	registerer.MustRegister(j.promBytesReplicated)
+	registerer.MustRegister(j.promReplicationErrors)
+	registerer.MustRegister(j.promLastSuccessful)
+}
+
+func (j *ActiveSide) Name() string { return j.name.String() }
+
+type ActiveSideStatus struct {
+	Replication                    *report.Report
+	PruningSender, PruningReceiver *pruner.Report
+	Snapshotting                   *snapper.Report
+}
+
+func (j *ActiveSide) Status() *Status {
+	tasks := j.updateTasks(nil)
+
+	s := &ActiveSideStatus{}
+	t := j.mode.Type()
+	if tasks.replicationReport != nil {
+		s.Replication = tasks.replicationReport()
+	}
+	if tasks.prunerSender != nil {
+		s.PruningSender = tasks.prunerSender.Report()
+	}
+	if tasks.prunerReceiver != nil {
+		s.PruningReceiver = tasks.prunerReceiver.Report()
+	}
+	s.Snapshotting = j.mode.SnapperReport()
+	return &Status{Type: t, JobSpecific: s}
+}
+
+func (j *ActiveSide) OwnedDatasetSubtreeRoot() (rfs *zfs.DatasetPath, ok bool) {
+	pull, ok := j.mode.(*modePull)
+	if !ok {
+		_ = j.mode.(*modePush) // make sure we didn't introduce a new job type
+		return nil, false
+	}
+	return pull.receiverConfig.RootWithoutClientComponent.Copy(), true
+}
+
+func (j *ActiveSide) SenderConfig() *endpoint.SenderConfig {
+	push, ok := j.mode.(*modePush)
+	if !ok {
+		_ = j.mode.(*modePull) // make sure we didn't introduce a new job type
+		return nil
+	}
+	return push.senderConfig
+}
+
+// The active side of a replication uses one end (sender or receiver)
+// directly by method invocation, without going through a transport that
+// provides a client identity.
+// However, in order to avoid the need to distinguish between direct-method-invocating
+// clients and RPC client, we use an invalid client identity as a sentinel value.
+func FakeActiveSideDirectMethodInvocationClientIdentity(jobId endpoint.JobID) string {
+	return fmt.Sprintf("<local><active><job><client><identity><job=%q>", jobId.String())
+}
+
+func (j *ActiveSide) Run(ctx context.Context) {
+	ctx, endTask := trace.WithTaskAndSpan(ctx, "active-side-job", j.Name())
+	defer endTask()
+
+	ctx = context.WithValue(ctx, endpoint.ClientIdentityKey, FakeActiveSideDirectMethodInvocationClientIdentity(j.name))
+
+	log := GetLogger(ctx)
+
+	defer log.Info("job exiting")
+
+	periodicDone := make(chan struct{})
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	periodicCtx, endTask := trace.WithTask(ctx, "periodic")
+	defer endTask()
+	go j.mode.RunPeriodic(periodicCtx, periodicDone)
+
+	invocationCount := 0
+outer:
+	for {
+		log.Info("wait for wakeups")
+		select {
+		case <-ctx.Done():
+			log.WithError(ctx.Err()).Info("context")
+			break outer
+
+		case <-wakeup.Wait(ctx):
+			j.mode.ResetConnectBackoff()
+		case <-periodicDone:
+		}
+		invocationCount++
+		invocationCtx, endSpan := trace.WithSpan(ctx, fmt.Sprintf("invocation-%d", invocationCount))
+		j.do(invocationCtx)
+		endSpan()
+	}
+}
+
+func (j *ActiveSide) do(ctx context.Context) {
+
+	j.mode.ConnectEndpoints(ctx, j.connecter)
+	defer j.mode.DisconnectEndpoints()
+
+	// allow cancellation of an invocation (this function)
+	ctx, cancelThisRun := context.WithCancel(ctx)
+	defer cancelThisRun()
+	go func() {
+		select {
+		case <-reset.Wait(ctx):
+			GetLogger(ctx).Info("reset received, cancelling current invocation")
+			cancelThisRun()
+		case <-ctx.Done():
+		}
+	}()
+
+	sender, receiver := j.mode.SenderReceiver()
+
+	{
+		select {
+		case <-ctx.Done():
+			return
+		default:
+		}
+		ctx, endSpan := trace.WithSpan(ctx, "replication")
+		ctx, repCancel := context.WithCancel(ctx)
+		var repWait driver.WaitFunc
+		j.updateTasks(func(tasks *activeSideTasks) {
+			// reset it
+			*tasks = activeSideTasks{}
+			tasks.replicationCancel = func() { repCancel(); endSpan() }
+			tasks.replicationReport, repWait = replication.Do(
+				ctx, j.replicationDriverConfig, logic.NewPlanner(j.promRepStateSecs, j.promBytesReplicated, sender, receiver, j.mode.PlannerPolicy()),
+			)
+			tasks.state = ActiveSideReplicating
+		})
+		GetLogger(ctx).Info("start replication")
+		repWait(true) // wait blocking
+		repCancel()   // always cancel to free up context resources
+
+		replicationReport := j.tasks.replicationReport()
+		var numErrors = replicationReport.GetFailedFilesystemsCountInLatestAttempt()
+		j.promReplicationErrors.Set(float64(numErrors))
+		if numErrors == 0 {
+			j.promLastSuccessful.SetToCurrentTime()
+		}
+
+		endSpan()
+	}
+
+	{
+		select {
+		case <-ctx.Done():
+			return
+		default:
+		}
+		ctx, endSpan := trace.WithSpan(ctx, "prune_sender")
+		ctx, senderCancel := context.WithCancel(ctx)
+		tasks := j.updateTasks(func(tasks *activeSideTasks) {
+			tasks.prunerSender = j.prunerFactory.BuildSenderPruner(ctx, sender, sender)
+			tasks.prunerSenderCancel = func() { senderCancel(); endSpan() }
+			tasks.state = ActiveSidePruneSender
+		})
+		GetLogger(ctx).Info("start pruning sender")
+		tasks.prunerSender.Prune()
+		GetLogger(ctx).Info("finished pruning sender")
+		senderCancel()
+		endSpan()
+	}
+	{
+		select {
+		case <-ctx.Done():
+			return
+		default:
+		}
+		ctx, endSpan := trace.WithSpan(ctx, "prune_recever")
+		ctx, receiverCancel := context.WithCancel(ctx)
+		tasks := j.updateTasks(func(tasks *activeSideTasks) {
+			tasks.prunerReceiver = j.prunerFactory.BuildReceiverPruner(ctx, receiver, sender)
+			tasks.prunerReceiverCancel = func() { receiverCancel(); endSpan() }
+			tasks.state = ActiveSidePruneReceiver
+		})
+		GetLogger(ctx).Info("start pruning receiver")
+		tasks.prunerReceiver.Prune()
+		GetLogger(ctx).Info("finished pruning receiver")
+		receiverCancel()
+		endSpan()
+	}
+
+	j.updateTasks(func(tasks *activeSideTasks) {
+		tasks.state = ActiveSideDone
+	})
+
+}

internal/daemon/job/active_test.go

@@ -0,0 +1,20 @@
+package job
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/zrepl/zrepl/internal/endpoint"
+	"github.com/zrepl/zrepl/internal/transport"
+)
+
+func TestFakeActiveSideDirectMethodInvocationClientIdentityDoesNotPassValidityTest(t *testing.T) {
+	jobid, err := endpoint.MakeJobID("validjobname")
+	require.NoError(t, err)
+	clientIdentity := FakeActiveSideDirectMethodInvocationClientIdentity(jobid)
+	t.Logf("%v", clientIdentity)
+	err = transport.ValidateClientIdentity(clientIdentity)
+	assert.Error(t, err)
+}

internal/daemon/job/activesidestate_enumer.go

@@ -0,0 +1,66 @@
+// Code generated by "enumer -type=ActiveSideState"; DO NOT EDIT.
+
+package job
+
+import (
+	"fmt"
+)
+
+const (
+	_ActiveSideStateName_0 = "ActiveSideReplicatingActiveSidePruneSender"
+	_ActiveSideStateName_1 = "ActiveSidePruneReceiver"
+	_ActiveSideStateName_2 = "ActiveSideDone"
+)
+
+var (
+	_ActiveSideStateIndex_0 = [...]uint8{0, 21, 42}
+	_ActiveSideStateIndex_1 = [...]uint8{0, 23}
+	_ActiveSideStateIndex_2 = [...]uint8{0, 14}
+)
+
+func (i ActiveSideState) String() string {
+	switch {
+	case 1 <= i && i <= 2:
+		i -= 1
+		return _ActiveSideStateName_0[_ActiveSideStateIndex_0[i]:_ActiveSideStateIndex_0[i+1]]
+	case i == 4:
+		return _ActiveSideStateName_1
+	case i == 8:
+		return _ActiveSideStateName_2
+	default:
+		return fmt.Sprintf("ActiveSideState(%d)", i)
+	}
+}
+
+var _ActiveSideStateValues = []ActiveSideState{1, 2, 4, 8}
+
+var _ActiveSideStateNameToValueMap = map[string]ActiveSideState{
+	_ActiveSideStateName_0[0:21]:  1,
+	_ActiveSideStateName_0[21:42]: 2,
+	_ActiveSideStateName_1[0:23]:  4,
+	_ActiveSideStateName_2[0:14]:  8,
+}
+
+// ActiveSideStateString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func ActiveSideStateString(s string) (ActiveSideState, error) {
+	if val, ok := _ActiveSideStateNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to ActiveSideState values", s)
+}
+
+// ActiveSideStateValues returns all values of the enum
+func ActiveSideStateValues() []ActiveSideState {
+	return _ActiveSideStateValues
+}
+
+// IsAActiveSideState returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i ActiveSideState) IsAActiveSideState() bool {
+	for _, v := range _ActiveSideStateValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}

internal/daemon/job/build_jobs.go

@@ -0,0 +1,105 @@
+package job
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/util/bandwidthlimit"
+)
+
+func JobsFromConfig(c *config.Config, parseFlags config.ParseFlags) ([]Job, error) {
+	js := make([]Job, len(c.Jobs))
+	for i := range c.Jobs {
+		j, err := buildJob(c.Global, c.Jobs[i], parseFlags)
+		if err != nil {
+			return nil, err
+		}
+		if j == nil || j.Name() == "" {
+			panic(fmt.Sprintf("implementation error: job builder returned nil job type %T", c.Jobs[i].Ret))
+		}
+		js[i] = j
+	}
+
+	return js, nil
+}
+
+func buildJob(c *config.Global, in config.JobEnum, parseFlags config.ParseFlags) (j Job, err error) {
+	cannotBuildJob := func(e error, name string) (Job, error) {
+		return nil, errors.Wrapf(e, "cannot build job %q", name)
+	}
+	// FIXME prettify this
+	switch v := in.Ret.(type) {
+	case *config.SinkJob:
+		j, err = passiveSideFromConfig(c, &v.PassiveJob, v, parseFlags)
+		if err != nil {
+			return cannotBuildJob(err, v.Name)
+		}
+	case *config.SourceJob:
+		j, err = passiveSideFromConfig(c, &v.PassiveJob, v, parseFlags)
+		if err != nil {
+			return cannotBuildJob(err, v.Name)
+		}
+	case *config.SnapJob:
+		j, err = snapJobFromConfig(c, v)
+		if err != nil {
+			return cannotBuildJob(err, v.Name)
+		}
+	case *config.PushJob:
+		j, err = activeSide(c, &v.ActiveJob, v, parseFlags)
+		if err != nil {
+			return cannotBuildJob(err, v.Name)
+		}
+	case *config.PullJob:
+		j, err = activeSide(c, &v.ActiveJob, v, parseFlags)
+		if err != nil {
+			return cannotBuildJob(err, v.Name)
+		}
+	default:
+		panic(fmt.Sprintf("implementation error: unknown job type %T", v))
+	}
+	return j, nil
+
+}
+
+func validateReceivingSidesDoNotOverlap(receivingRootFSs []string) error {
+	if len(receivingRootFSs) == 0 {
+		return nil
+	}
+	rfss := make([]string, len(receivingRootFSs))
+	copy(rfss, receivingRootFSs)
+	sort.Slice(rfss, func(i, j int) bool {
+		return strings.Compare(rfss[i], rfss[j]) == -1
+	})
+	// add tailing slash because of hierarchy-simulation
+	// rootfs/ is not root of rootfs2/
+	for i := 0; i < len(rfss); i++ {
+		rfss[i] += "/"
+	}
+	// idea:
+	//   no path in rfss must be prefix of another
+	//
+	// rfss is now lexicographically sorted, which means that
+	// if i is prefix of j, i < j (in lexicographical order)
+	// thus,
+	// if any i is prefix of i+n (n >= 1), there is overlap
+	for i := 0; i < len(rfss)-1; i++ {
+		if strings.HasPrefix(rfss[i+1], rfss[i]) {
+			return fmt.Errorf("receiving jobs with overlapping root filesystems are forbidden")
+		}
+	}
+	return nil
+}
+
+func buildBandwidthLimitConfig(in *config.BandwidthLimit) (c bandwidthlimit.Config, _ error) {
+	if in.Max.ToBytes() > 0 && int64(in.Max.ToBytes()) == 0 {
+		return c, fmt.Errorf("bandwidth limit `max` is too small, must at least specify one byte")
+	}
+	return bandwidthlimit.Config{
+		Max:            int64(in.Max.ToBytes()),
+		BucketCapacity: int64(in.BucketCapacity.ToBytes()),
+	}, nil
+}

internal/daemon/job/build_jobs_sendrecvoptions.go

@@ -0,0 +1,102 @@
+package job
+
+import (
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/filters"
+	"github.com/zrepl/zrepl/internal/endpoint"
+	"github.com/zrepl/zrepl/internal/util/nodefault"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type SendingJobConfig interface {
+	GetFilesystems() config.FilesystemsFilter
+	GetSendOptions() *config.SendOptions // must not be nil
+}
+
+func buildSenderConfig(in SendingJobConfig, jobID endpoint.JobID) (*endpoint.SenderConfig, error) {
+
+	fsf, err := filters.DatasetMapFilterFromConfig(in.GetFilesystems())
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot build filesystem filter")
+	}
+	sendOpts := in.GetSendOptions()
+	bwlim, err := buildBandwidthLimitConfig(sendOpts.BandwidthLimit)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot build bandwith limit config")
+	}
+
+	sc := &endpoint.SenderConfig{
+		FSF:   fsf,
+		JobID: jobID,
+
+		Encrypt:              &nodefault.Bool{B: sendOpts.Encrypted},
+		SendRaw:              sendOpts.Raw,
+		SendProperties:       sendOpts.SendProperties,
+		SendBackupProperties: sendOpts.BackupProperties,
+		SendLargeBlocks:      sendOpts.LargeBlocks,
+		SendCompressed:       sendOpts.Compressed,
+		SendEmbeddedData:     sendOpts.EmbeddedData,
+		SendSaved:            sendOpts.Saved,
+
+		BandwidthLimit: bwlim,
+	}
+
+	if err := sc.Validate(); err != nil {
+		return nil, errors.Wrap(err, "cannot build sender config")
+	}
+
+	return sc, nil
+}
+
+type ReceivingJobConfig interface {
+	GetRootFS() string
+	GetAppendClientIdentity() bool
+	GetRecvOptions() *config.RecvOptions
+}
+
+func buildReceiverConfig(in ReceivingJobConfig, jobID endpoint.JobID) (rc endpoint.ReceiverConfig, err error) {
+	rootFs, err := zfs.NewDatasetPath(in.GetRootFS())
+	if err != nil {
+		return rc, errors.New("root_fs is not a valid zfs filesystem path")
+	}
+	if rootFs.Length() <= 0 {
+		return rc, errors.New("root_fs must not be empty") // duplicates error check of receiver
+	}
+
+	recvOpts := in.GetRecvOptions()
+
+	bwlim, err := buildBandwidthLimitConfig(recvOpts.BandwidthLimit)
+	if err != nil {
+		return rc, errors.Wrap(err, "cannot build bandwith limit config")
+	}
+
+	placeholderEncryption, err := endpoint.PlaceholderCreationEncryptionPropertyString(recvOpts.Placeholder.Encryption)
+	if err != nil {
+		options := []string{}
+		for _, v := range endpoint.PlaceholderCreationEncryptionPropertyValues() {
+			options = append(options, endpoint.PlaceholderCreationEncryptionProperty(v).String())
+		}
+		return rc, errors.Errorf("placeholder encryption value %q is invalid, must be one of %s",
+			recvOpts.Placeholder.Encryption, options)
+	}
+
+	rc = endpoint.ReceiverConfig{
+		JobID:                      jobID,
+		RootWithoutClientComponent: rootFs,
+		AppendClientIdentity:       in.GetAppendClientIdentity(),
+
+		InheritProperties:  recvOpts.Properties.Inherit,
+		OverrideProperties: recvOpts.Properties.Override,
+
+		BandwidthLimit: bwlim,
+
+		PlaceholderEncryption: placeholderEncryption,
+	}
+	if err := rc.Validate(); err != nil {
+		return rc, errors.Wrap(err, "cannot build receiver config")
+	}
+
+	return rc, nil
+}

internal/daemon/job/build_jobs_test.go

@@ -0,0 +1,318 @@
+package job
+
+import (
+	"fmt"
+	"path"
+	"path/filepath"
+	"testing"
+
+	"github.com/kr/pretty"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/zrepl/zrepl/internal/config"
+)
+
+func TestValidateReceivingSidesDoNotOverlap(t *testing.T) {
+	type testCase struct {
+		err   bool
+		input []string
+	}
+	tcs := []testCase{
+		{false, nil},
+		{false, []string{}},
+		{false, []string{""}}, // not our job to determine valid paths
+		{false, []string{"a"}},
+		{false, []string{"some/path"}},
+		{false, []string{"zroot/sink1", "zroot/sink2", "zroot/sink3"}},
+		{false, []string{"zroot/foo", "zroot/foobar"}},
+		{true, []string{"zroot/b", "zroot/b"}},
+		{true, []string{"zroot/foo", "zroot/foo/bar", "zroot/baz"}},
+		{false, []string{"a/x", "b/x"}},
+		{false, []string{"a", "b"}},
+		{true, []string{"a", "a"}},
+		{true, []string{"a/x/y", "a/x"}},
+		{true, []string{"a/x", "a/x/y"}},
+		{true, []string{"a/x", "b/x", "a/x/y"}},
+		{true, []string{"a", "a/b", "a/c", "a/b"}},
+		{true, []string{"a/b", "a/c", "a/b", "a/d", "a/c"}},
+	}
+
+	for _, tc := range tcs {
+		t.Logf("input: %v", tc.input)
+		err := validateReceivingSidesDoNotOverlap(tc.input)
+		if tc.err {
+			assert.Error(t, err)
+		} else {
+			assert.NoError(t, err)
+		}
+	}
+}
+
+func TestJobIDErrorHandling(t *testing.T) {
+	tmpl := `
+jobs:
+- name: %s
+  type: push
+  connect:
+    type: local
+    listener_name: foo
+    client_identity: bar
+  filesystems: {"<": true}
+  snapshotting:
+    type: manual
+  pruning:
+    keep_sender:
+    - type: last_n
+      count: 10
+    keep_receiver:
+    - type: last_n
+      count: 10
+`
+	fill := func(s string) string { return fmt.Sprintf(tmpl, s) }
+
+	type Case struct {
+		jobName string
+		valid   bool
+	}
+	cases := []Case{
+		{"validjobname", true},
+		{"valid with spaces", true},
+		{"invalid\twith\ttabs", false},
+		{"invalid#withdelimiter", false},
+		{"invalid@withdelimiter", false},
+		{"withnewline\\nmiddle", false},
+		{"withnewline\\n", false},
+		{"withslash/", false},
+		{"withslash/inthemiddle", false},
+		{"/", false},
+	}
+
+	for i := range cases {
+		t.Run(cases[i].jobName, func(t *testing.T) {
+			c := cases[i]
+
+			conf, err := config.ParseConfigBytes([]byte(fill(c.jobName)))
+			require.NoError(t, err, "not expecting yaml-config to know about job ids")
+			require.NotNil(t, conf)
+			jobs, err := JobsFromConfig(conf, config.ParseFlagsNone)
+
+			if c.valid {
+				assert.NoError(t, err)
+				require.Len(t, jobs, 1)
+				assert.Equal(t, c.jobName, jobs[0].Name())
+			} else {
+				t.Logf("error: %s", err)
+				assert.Error(t, err)
+				assert.Nil(t, jobs)
+			}
+
+		})
+	}
+
+}
+
+func TestSampleConfigsAreBuiltWithoutErrors(t *testing.T) {
+	paths, err := filepath.Glob("../../../internal/config/samples/*")
+	if err != nil {
+		t.Errorf("glob failed: %+v", err)
+	}
+
+	type additionalCheck struct {
+		state int
+		test  func(t *testing.T, jobs []Job)
+	}
+	additionalChecks := map[string]*additionalCheck{
+		"bandwidth_limit.yml": {test: testSampleConfig_BandwidthLimit},
+	}
+
+	for _, p := range paths {
+
+		if path.Ext(p) != ".yml" {
+			t.Logf("skipping file %s", p)
+			continue
+		}
+
+		filename := path.Base(p)
+		t.Logf("checking for presence additonal checks for file %q", filename)
+		additionalCheck := additionalChecks[filename]
+		if additionalCheck == nil {
+			t.Logf("no additional checks")
+		} else {
+			t.Logf("additional check present")
+			additionalCheck.state = 1
+		}
+
+		t.Run(p, func(t *testing.T) {
+			c, err := config.ParseConfig(p)
+			if err != nil {
+				t.Fatalf("error parsing %s:\n%+v", p, err)
+			}
+
+			t.Logf("file: %s", p)
+			t.Log(pretty.Sprint(c))
+
+			jobs, err := JobsFromConfig(c, config.ParseFlagsNoCertCheck)
+			t.Logf("jobs: %#v", jobs)
+			require.NoError(t, err)
+
+			if additionalCheck != nil {
+				additionalCheck.test(t, jobs)
+				additionalCheck.state = 2
+			}
+		})
+
+	}
+
+	for basename, c := range additionalChecks {
+		if c.state == 0 {
+			panic("univisited additional check " + basename)
+		}
+	}
+
+}
+
+func testSampleConfig_BandwidthLimit(t *testing.T, jobs []Job) {
+	require.Len(t, jobs, 3)
+
+	{
+		limitedSink, ok := jobs[0].(*PassiveSide)
+		require.True(t, ok, "%T", jobs[0])
+		limitedSinkMode, ok := limitedSink.mode.(*modeSink)
+		require.True(t, ok, "%T", limitedSink)
+
+		assert.Equal(t, int64(12345), limitedSinkMode.receiverConfig.BandwidthLimit.Max)
+		assert.Equal(t, int64(1<<17), limitedSinkMode.receiverConfig.BandwidthLimit.BucketCapacity)
+	}
+
+	{
+		limitedPush, ok := jobs[1].(*ActiveSide)
+		require.True(t, ok, "%T", jobs[1])
+		limitedPushMode, ok := limitedPush.mode.(*modePush)
+		require.True(t, ok, "%T", limitedPush)
+
+		assert.Equal(t, int64(54321), limitedPushMode.senderConfig.BandwidthLimit.Max)
+		assert.Equal(t, int64(1024), limitedPushMode.senderConfig.BandwidthLimit.BucketCapacity)
+	}
+
+	{
+		unlimitedSink, ok := jobs[2].(*PassiveSide)
+		require.True(t, ok, "%T", jobs[2])
+		unlimitedSinkMode, ok := unlimitedSink.mode.(*modeSink)
+		require.True(t, ok, "%T", unlimitedSink)
+
+		max := unlimitedSinkMode.receiverConfig.BandwidthLimit.Max
+		assert.Less(t, max, int64(0), max, "unlimited mode <=> negative value for .Max, see bandwidthlimit.Config")
+	}
+
+}
+
+func TestReplicationOptions(t *testing.T) {
+	tmpl := `
+jobs:
+- name: foo
+  type: push
+  connect:
+    type: local
+    listener_name: foo
+    client_identity: bar
+  filesystems: {"<": true}
+  %s
+  snapshotting:
+    type: manual
+  pruning:
+    keep_sender:
+    - type: last_n
+      count: 10
+    keep_receiver:
+    - type: last_n
+      count: 10
+`
+
+	type Test struct {
+		name        string
+		input       string
+		expectOk    func(t *testing.T, a *ActiveSide, m *modePush)
+		expectError bool
+	}
+
+	tests := []Test{
+		{
+			name: "defaults",
+			input: `
+  replication: {}
+`,
+			expectOk: func(t *testing.T, a *ActiveSide, m *modePush) {},
+		},
+		{
+			name: "steps_zero",
+			input: `
+  replication:
+    concurrency:
+      steps: 0
+`,
+			expectError: true,
+		},
+		{
+			name: "size_estimates_zero",
+			input: `
+  replication:
+    concurrency:
+      size_estimates: 0
+`,
+			expectError: true,
+		},
+		{
+			name: "custom_values",
+			input: `
+  replication:
+    concurrency:
+      steps: 23
+      size_estimates: 42
+`,
+			expectOk: func(t *testing.T, a *ActiveSide, m *modePush) {
+				assert.Equal(t, 23, a.replicationDriverConfig.StepQueueConcurrency)
+				assert.Equal(t, 42, m.plannerPolicy.SizeEstimationConcurrency)
+			},
+		},
+		{
+			name: "negative_values_forbidden",
+			input: `
+  replication:
+    concurrency:
+      steps: -23
+      size_estimates: -42
+`,
+			expectError: true,
+		},
+	}
+
+	fill := func(s string) string { return fmt.Sprintf(tmpl, s) }
+
+	for _, ts := range tests {
+		t.Run(ts.name, func(t *testing.T) {
+			assert.True(t, (ts.expectError) != (ts.expectOk != nil))
+
+			cstr := fill(ts.input)
+			t.Logf("testing config:\n%s", cstr)
+			c, err := config.ParseConfigBytes([]byte(cstr))
+			require.NoError(t, err)
+			jobs, err := JobsFromConfig(c, config.ParseFlagsNone)
+			if ts.expectOk != nil {
+				require.NoError(t, err)
+				require.NotNil(t, c)
+				require.NoError(t, err)
+				require.Len(t, jobs, 1)
+				a := jobs[0].(*ActiveSide)
+				m := a.mode.(*modePush)
+				ts.expectOk(t, a, m)
+			} else if ts.expectError {
+				require.Error(t, err)
+			} else {
+				t.Fatalf("test must define expectOk or expectError")
+			}
+
+		})
+	}
+
+}

internal/daemon/job/job.go

@@ -0,0 +1,108 @@
+package job
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/zrepl/zrepl/internal/daemon/logging"
+	"github.com/zrepl/zrepl/internal/endpoint"
+	"github.com/zrepl/zrepl/internal/logger"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type Logger = logger.Logger
+
+func GetLogger(ctx context.Context) Logger {
+	return logging.GetLogger(ctx, logging.SubsysJob)
+}
+
+type Job interface {
+	Name() string
+	Run(ctx context.Context)
+	Status() *Status
+	RegisterMetrics(registerer prometheus.Registerer)
+	// Jobs that return a subtree of the dataset hierarchy
+	// must return the root of that subtree as rfs and ok = true
+	OwnedDatasetSubtreeRoot() (rfs *zfs.DatasetPath, ok bool)
+	SenderConfig() *endpoint.SenderConfig
+}
+
+type Type string
+
+const (
+	TypeInternal Type = "internal"
+	TypeSnap     Type = "snap"
+	TypePush     Type = "push"
+	TypeSink     Type = "sink"
+	TypePull     Type = "pull"
+	TypeSource   Type = "source"
+)
+
+type Status struct {
+	Type        Type
+	JobSpecific interface{}
+}
+
+func (s *Status) MarshalJSON() ([]byte, error) {
+	typeJson, err := json.Marshal(s.Type)
+	if err != nil {
+		return nil, err
+	}
+	jobJSON, err := json.Marshal(s.JobSpecific)
+	if err != nil {
+		return nil, err
+	}
+	m := map[string]json.RawMessage{
+		"type":         typeJson,
+		string(s.Type): jobJSON,
+	}
+	return json.Marshal(m)
+}
+
+func (s *Status) UnmarshalJSON(in []byte) (err error) {
+	var m map[string]json.RawMessage
+	if err := json.Unmarshal(in, &m); err != nil {
+		return err
+	}
+	tJSON, ok := m["type"]
+	if !ok {
+		return fmt.Errorf("field 'type' not found")
+	}
+	if err := json.Unmarshal(tJSON, &s.Type); err != nil {
+		return err
+	}
+	key := string(s.Type)
+	jobJSON, ok := m[key]
+	if !ok {
+		return fmt.Errorf("field '%s', not found", key)
+	}
+	switch s.Type {
+	case TypeSnap:
+		var st SnapJobStatus
+		err = json.Unmarshal(jobJSON, &st)
+		s.JobSpecific = &st
+
+	case TypePull:
+		fallthrough
+	case TypePush:
+		var st ActiveSideStatus
+		err = json.Unmarshal(jobJSON, &st)
+		s.JobSpecific = &st
+
+	case TypeSource:
+		fallthrough
+	case TypeSink:
+		var st PassiveStatus
+		err = json.Unmarshal(jobJSON, &st)
+		s.JobSpecific = &st
+
+	case TypeInternal:
+		// internal jobs do not report specifics
+	default:
+		err = fmt.Errorf("unknown job type '%s'", key)
+	}
+	return err
+}

internal/daemon/job/passive.go

@@ -0,0 +1,192 @@
+package job
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/zrepl/zrepl/internal/daemon/logging/trace"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/logging"
+	"github.com/zrepl/zrepl/internal/daemon/snapper"
+	"github.com/zrepl/zrepl/internal/endpoint"
+	"github.com/zrepl/zrepl/internal/rpc"
+	"github.com/zrepl/zrepl/internal/transport"
+	"github.com/zrepl/zrepl/internal/transport/fromconfig"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type PassiveSide struct {
+	mode   passiveMode
+	name   endpoint.JobID
+	listen transport.AuthenticatedListenerFactory
+}
+
+type passiveMode interface {
+	Handler() rpc.Handler
+	RunPeriodic(ctx context.Context)
+	SnapperReport() *snapper.Report // may be nil
+	Type() Type
+}
+
+type modeSink struct {
+	receiverConfig endpoint.ReceiverConfig
+}
+
+func (m *modeSink) Type() Type { return TypeSink }
+
+func (m *modeSink) Handler() rpc.Handler {
+	return endpoint.NewReceiver(m.receiverConfig)
+}
+
+func (m *modeSink) RunPeriodic(_ context.Context)  {}
+func (m *modeSink) SnapperReport() *snapper.Report { return nil }
+
+func modeSinkFromConfig(g *config.Global, in *config.SinkJob, jobID endpoint.JobID) (m *modeSink, err error) {
+	m = &modeSink{}
+
+	m.receiverConfig, err = buildReceiverConfig(in, jobID)
+	if err != nil {
+		return nil, err
+	}
+
+	return m, nil
+}
+
+type modeSource struct {
+	senderConfig *endpoint.SenderConfig
+	snapper      snapper.Snapper
+}
+
+func modeSourceFromConfig(g *config.Global, in *config.SourceJob, jobID endpoint.JobID) (m *modeSource, err error) {
+	// FIXME exact dedup of modePush
+	m = &modeSource{}
+
+	m.senderConfig, err = buildSenderConfig(in, jobID)
+	if err != nil {
+		return nil, errors.Wrap(err, "send options")
+	}
+
+	if m.snapper, err = snapper.FromConfig(g, m.senderConfig.FSF, in.Snapshotting); err != nil {
+		return nil, errors.Wrap(err, "cannot build snapper")
+	}
+
+	return m, nil
+}
+
+func (m *modeSource) Type() Type { return TypeSource }
+
+func (m *modeSource) Handler() rpc.Handler {
+	return endpoint.NewSender(*m.senderConfig)
+}
+
+func (m *modeSource) RunPeriodic(ctx context.Context) {
+	m.snapper.Run(ctx, nil)
+}
+
+func (m *modeSource) SnapperReport() *snapper.Report {
+	r := m.snapper.Report()
+	return &r
+}
+
+func passiveSideFromConfig(g *config.Global, in *config.PassiveJob, configJob interface{}, parseFlags config.ParseFlags) (s *PassiveSide, err error) {
+
+	s = &PassiveSide{}
+
+	s.name, err = endpoint.MakeJobID(in.Name)
+	if err != nil {
+		return nil, errors.Wrap(err, "invalid job name")
+	}
+
+	switch v := configJob.(type) {
+	case *config.SinkJob:
+		s.mode, err = modeSinkFromConfig(g, v, s.name) // shadow
+	case *config.SourceJob:
+		s.mode, err = modeSourceFromConfig(g, v, s.name) // shadow
+	}
+	if err != nil {
+		return nil, err // no wrapping necessary
+	}
+
+	if s.listen, err = fromconfig.ListenerFactoryFromConfig(g, in.Serve, parseFlags); err != nil {
+		return nil, errors.Wrap(err, "cannot build listener factory")
+	}
+
+	return s, nil
+}
+
+func (j *PassiveSide) Name() string { return j.name.String() }
+
+type PassiveStatus struct {
+	Snapper *snapper.Report
+}
+
+func (s *PassiveSide) Status() *Status {
+	st := &PassiveStatus{
+		Snapper: s.mode.SnapperReport(),
+	}
+	return &Status{Type: s.mode.Type(), JobSpecific: st}
+}
+
+func (j *PassiveSide) OwnedDatasetSubtreeRoot() (rfs *zfs.DatasetPath, ok bool) {
+	sink, ok := j.mode.(*modeSink)
+	if !ok {
+		_ = j.mode.(*modeSource) // make sure we didn't introduce a new job type
+		return nil, false
+	}
+	return sink.receiverConfig.RootWithoutClientComponent.Copy(), true
+}
+
+func (j *PassiveSide) SenderConfig() *endpoint.SenderConfig {
+	source, ok := j.mode.(*modeSource)
+	if !ok {
+		_ = j.mode.(*modeSink) // make sure we didn't introduce a new job type
+		return nil
+	}
+	return source.senderConfig
+}
+
+func (*PassiveSide) RegisterMetrics(registerer prometheus.Registerer) {}
+
+func (j *PassiveSide) Run(ctx context.Context) {
+	ctx, endTask := trace.WithTaskAndSpan(ctx, "passive-side-job", j.Name())
+	defer endTask()
+	log := GetLogger(ctx)
+	defer log.Info("job exiting")
+	{
+		ctx, endTask := trace.WithTask(ctx, "periodic") // shadowing
+		defer endTask()
+		ctx, cancel := context.WithCancel(ctx)
+		defer cancel()
+		go j.mode.RunPeriodic(ctx)
+	}
+
+	handler := j.mode.Handler()
+	if handler == nil {
+		panic(fmt.Sprintf("implementation error: j.mode.Handler() returned nil: %#v", j))
+	}
+
+	ctxInterceptor := func(handlerCtx context.Context, info rpc.HandlerContextInterceptorData, handler func(ctx context.Context)) {
+		// the handlerCtx is clean => need to inherit logging and tracing config from job context
+		handlerCtx = logging.WithInherit(handlerCtx, ctx)
+		handlerCtx = trace.WithInherit(handlerCtx, ctx)
+
+		handlerCtx, endTask := trace.WithTaskAndSpan(handlerCtx, "handler", fmt.Sprintf("job=%q client=%q method=%q", j.Name(), info.ClientIdentity(), info.FullMethod()))
+		defer endTask()
+		handler(handlerCtx)
+	}
+
+	rpcLoggers := rpc.GetLoggersOrPanic(ctx) // WithSubsystemLoggers above
+	server := rpc.NewServer(handler, rpcLoggers, ctxInterceptor)
+
+	listener, err := j.listen()
+	if err != nil {
+		log.WithError(err).Error("cannot listen")
+		return
+	}
+
+	server.Serve(ctx, listener)
+}

internal/daemon/job/reset/reset.go

@@ -0,0 +1,35 @@
+package reset
+
+import (
+	"context"
+	"errors"
+)
+
+type contextKey int
+
+const contextKeyReset contextKey = iota
+
+func Wait(ctx context.Context) <-chan struct{} {
+	wc, ok := ctx.Value(contextKeyReset).(chan struct{})
+	if !ok {
+		wc = make(chan struct{})
+	}
+	return wc
+}
+
+type Func func() error
+
+var AlreadyReset = errors.New("already reset")
+
+func Context(ctx context.Context) (context.Context, Func) {
+	wc := make(chan struct{})
+	wuf := func() error {
+		select {
+		case wc <- struct{}{}:
+			return nil
+		default:
+			return AlreadyReset
+		}
+	}
+	return context.WithValue(ctx, contextKeyReset, wc), wuf
+}

internal/daemon/job/snapjob.go

@@ -0,0 +1,196 @@
+package job
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"sync"
+
+	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/zrepl/zrepl/internal/daemon/logging/trace"
+	"github.com/zrepl/zrepl/internal/util/bandwidthlimit"
+	"github.com/zrepl/zrepl/internal/util/nodefault"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/filters"
+	"github.com/zrepl/zrepl/internal/daemon/job/wakeup"
+	"github.com/zrepl/zrepl/internal/daemon/pruner"
+	"github.com/zrepl/zrepl/internal/daemon/snapper"
+	"github.com/zrepl/zrepl/internal/endpoint"
+	"github.com/zrepl/zrepl/internal/replication/logic/pdu"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type SnapJob struct {
+	name     endpoint.JobID
+	fsfilter zfs.DatasetFilter
+	snapper  snapper.Snapper
+
+	prunerFactory *pruner.LocalPrunerFactory
+
+	promPruneSecs *prometheus.HistogramVec // labels: prune_side
+
+	prunerMtx sync.Mutex
+	pruner    *pruner.Pruner
+}
+
+func (j *SnapJob) Name() string { return j.name.String() }
+
+func (j *SnapJob) Type() Type { return TypeSnap }
+
+func snapJobFromConfig(g *config.Global, in *config.SnapJob) (j *SnapJob, err error) {
+	j = &SnapJob{}
+	fsf, err := filters.DatasetMapFilterFromConfig(in.Filesystems)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot build filesystem filter")
+	}
+	j.fsfilter = fsf
+
+	if j.snapper, err = snapper.FromConfig(g, fsf, in.Snapshotting); err != nil {
+		return nil, errors.Wrap(err, "cannot build snapper")
+	}
+	j.name, err = endpoint.MakeJobID(in.Name)
+	if err != nil {
+		return nil, errors.Wrap(err, "invalid job name")
+	}
+	j.promPruneSecs = prometheus.NewHistogramVec(prometheus.HistogramOpts{
+		Namespace:   "zrepl",
+		Subsystem:   "pruning",
+		Name:        "time",
+		Help:        "seconds spent in pruner",
+		ConstLabels: prometheus.Labels{"zrepl_job": j.name.String()},
+	}, []string{"prune_side"})
+	j.prunerFactory, err = pruner.NewLocalPrunerFactory(in.Pruning, j.promPruneSecs)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot build snapjob pruning rules")
+	}
+	return j, nil
+}
+
+func (j *SnapJob) RegisterMetrics(registerer prometheus.Registerer) {
+	registerer.MustRegister(j.promPruneSecs)
+}
+
+type SnapJobStatus struct {
+	Pruning      *pruner.Report
+	Snapshotting *snapper.Report // may be nil
+}
+
+func (j *SnapJob) Status() *Status {
+	s := &SnapJobStatus{}
+	t := j.Type()
+	j.prunerMtx.Lock()
+	if j.pruner != nil {
+		s.Pruning = j.pruner.Report()
+	}
+	j.prunerMtx.Unlock()
+	r := j.snapper.Report()
+	s.Snapshotting = &r
+	return &Status{Type: t, JobSpecific: s}
+}
+
+func (j *SnapJob) OwnedDatasetSubtreeRoot() (rfs *zfs.DatasetPath, ok bool) {
+	return nil, false
+}
+
+func (j *SnapJob) SenderConfig() *endpoint.SenderConfig { return nil }
+
+func (j *SnapJob) Run(ctx context.Context) {
+	ctx, endTask := trace.WithTaskAndSpan(ctx, "snap-job", j.Name())
+	defer endTask()
+	log := GetLogger(ctx)
+
+	defer log.Info("job exiting")
+
+	periodicDone := make(chan struct{})
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	periodicCtx, endTask := trace.WithTask(ctx, "snapshotting")
+	defer endTask()
+	go j.snapper.Run(periodicCtx, periodicDone)
+
+	invocationCount := 0
+outer:
+	for {
+		log.Info("wait for wakeups")
+		select {
+		case <-ctx.Done():
+			log.WithError(ctx.Err()).Info("context")
+			break outer
+
+		case <-wakeup.Wait(ctx):
+		case <-periodicDone:
+		}
+		invocationCount++
+
+		invocationCtx, endSpan := trace.WithSpan(ctx, fmt.Sprintf("invocation-%d", invocationCount))
+		j.doPrune(invocationCtx)
+		endSpan()
+	}
+}
+
+// Adaptor that implements pruner.History around a pruner.Target.
+// The ReplicationCursor method is Get-op only and always returns
+// the filesystem's most recent version's GUID.
+//
+// TODO:
+// This is a work-around for the current package daemon/pruner
+// and package pruning.Snapshot limitation: they require the
+// `Replicated` getter method be present, but obviously,
+// a local job like SnapJob can't deliver on that.
+// But the pruner.Pruner gives up on an FS if no replication
+// cursor is present, which is why this pruner returns the
+// most recent filesystem version.
+type alwaysUpToDateReplicationCursorHistory struct {
+	// the Target passed as Target to BuildLocalPruner
+	target pruner.Target
+}
+
+var _ pruner.Sender = (*alwaysUpToDateReplicationCursorHistory)(nil)
+
+func (h alwaysUpToDateReplicationCursorHistory) ReplicationCursor(ctx context.Context, req *pdu.ReplicationCursorReq) (*pdu.ReplicationCursorRes, error) {
+	fsvReq := &pdu.ListFilesystemVersionsReq{
+		Filesystem: req.GetFilesystem(),
+	}
+	res, err := h.target.ListFilesystemVersions(ctx, fsvReq)
+	if err != nil {
+		return nil, err
+	}
+	fsvs := res.GetVersions()
+	if len(fsvs) <= 0 {
+		return &pdu.ReplicationCursorRes{Result: &pdu.ReplicationCursorRes_Notexist{Notexist: true}}, nil
+	}
+	// always return must recent version
+	sort.Slice(fsvs, func(i, j int) bool {
+		return fsvs[i].CreateTXG < fsvs[j].CreateTXG
+	})
+	mostRecent := fsvs[len(fsvs)-1]
+	return &pdu.ReplicationCursorRes{Result: &pdu.ReplicationCursorRes_Guid{Guid: mostRecent.GetGuid()}}, nil
+}
+
+func (h alwaysUpToDateReplicationCursorHistory) ListFilesystems(ctx context.Context, req *pdu.ListFilesystemReq) (*pdu.ListFilesystemRes, error) {
+	return h.target.ListFilesystems(ctx, req)
+}
+
+func (j *SnapJob) doPrune(ctx context.Context) {
+	ctx, endSpan := trace.WithSpan(ctx, "snap-job-do-prune")
+	defer endSpan()
+	log := GetLogger(ctx)
+	sender := endpoint.NewSender(endpoint.SenderConfig{
+		JobID: j.name,
+		FSF:   j.fsfilter,
+		// FIXME the following config fields are irrelevant for SnapJob
+		// because the endpoint is only used as pruner.Target.
+		// However, the implementation requires them to be set.
+		Encrypt:        &nodefault.Bool{B: true},
+		BandwidthLimit: bandwidthlimit.NoLimitConfig(),
+	})
+	j.prunerMtx.Lock()
+	j.pruner = j.prunerFactory.BuildLocalPruner(ctx, sender, alwaysUpToDateReplicationCursorHistory{sender})
+	j.prunerMtx.Unlock()
+	log.Info("start pruning")
+	j.pruner.Prune()
+	log.Info("finished pruning")
+}

internal/daemon/job/wakeup/wakeup.go

@@ -0,0 +1,35 @@
+package wakeup
+
+import (
+	"context"
+	"errors"
+)
+
+type contextKey int
+
+const contextKeyWakeup contextKey = iota
+
+func Wait(ctx context.Context) <-chan struct{} {
+	wc, ok := ctx.Value(contextKeyWakeup).(chan struct{})
+	if !ok {
+		wc = make(chan struct{})
+	}
+	return wc
+}
+
+type Func func() error
+
+var AlreadyWokenUp = errors.New("already woken up")
+
+func Context(ctx context.Context) (context.Context, Func) {
+	wc := make(chan struct{})
+	wuf := func() error {
+		select {
+		case wc <- struct{}{}:
+			return nil
+		default:
+			return AlreadyWokenUp
+		}
+	}
+	return context.WithValue(ctx, contextKeyWakeup, wc), wuf
+}

internal/daemon/logging/build_logging.go

@@ -0,0 +1,303 @@
+package logging
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"log/syslog"
+	"os"
+
+	"github.com/mattn/go-isatty"
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/logging/trace"
+	"github.com/zrepl/zrepl/internal/logger"
+	"github.com/zrepl/zrepl/internal/tlsconf"
+)
+
+func OutletsFromConfig(in config.LoggingOutletEnumList) (*logger.Outlets, error) {
+
+	outlets := logger.NewOutlets()
+
+	if len(in) == 0 {
+		// Default config
+		out := WriterOutlet{&HumanFormatter{}, os.Stdout}
+		outlets.Add(out, logger.Warn)
+		return outlets, nil
+	}
+
+	var syslogOutlets, stdoutOutlets int
+	for lei, le := range in {
+
+		outlet, minLevel, err := ParseOutlet(le)
+		if err != nil {
+			return nil, errors.Wrapf(err, "cannot parse outlet #%d", lei)
+		}
+		var _ logger.Outlet = WriterOutlet{}
+		var _ logger.Outlet = &SyslogOutlet{}
+		switch outlet.(type) {
+		case *SyslogOutlet:
+			syslogOutlets++
+		case WriterOutlet:
+			stdoutOutlets++
+		}
+
+		outlets.Add(outlet, minLevel)
+
+	}
+
+	if syslogOutlets > 1 {
+		return nil, errors.Errorf("can only define one 'syslog' outlet")
+	}
+	if stdoutOutlets > 1 {
+		return nil, errors.Errorf("can only define one 'stdout' outlet")
+	}
+
+	return outlets, nil
+
+}
+
+type Subsystem string
+
+const (
+	SubsysMeta         Subsystem = "meta"
+	SubsysJob          Subsystem = "job"
+	SubsysReplication  Subsystem = "repl"
+	SubsysEndpoint     Subsystem = "endpoint"
+	SubsysPruning      Subsystem = "pruning"
+	SubsysSnapshot     Subsystem = "snapshot"
+	SubsysHooks        Subsystem = "hook"
+	SubsysTransport    Subsystem = "transport"
+	SubsysTransportMux Subsystem = "transportmux"
+	SubsysRPC          Subsystem = "rpc"
+	SubsysRPCControl   Subsystem = "rpc.ctrl"
+	SubsysRPCData      Subsystem = "rpc.data"
+	SubsysZFSCmd       Subsystem = "zfs.cmd"
+	SubsysTraceData    Subsystem = "trace.data"
+	SubsysPlatformtest Subsystem = "platformtest"
+)
+
+var AllSubsystems = []Subsystem{
+	SubsysMeta,
+	SubsysJob,
+	SubsysReplication,
+	SubsysEndpoint,
+	SubsysPruning,
+	SubsysSnapshot,
+	SubsysHooks,
+	SubsysTransport,
+	SubsysTransportMux,
+	SubsysRPC,
+	SubsysRPCControl,
+	SubsysRPCData,
+	SubsysZFSCmd,
+	SubsysTraceData,
+	SubsysPlatformtest,
+}
+
+type injectedField struct {
+	field  string
+	value  interface{}
+	parent *injectedField
+}
+
+func WithInjectedField(ctx context.Context, field string, value interface{}) context.Context {
+	var parent *injectedField
+	parentI := ctx.Value(contextKeyInjectedField)
+	if parentI != nil {
+		parent = parentI.(*injectedField)
+	}
+	// TODO sanity-check `field` now
+	this := &injectedField{field, value, parent}
+	return context.WithValue(ctx, contextKeyInjectedField, this)
+}
+
+func iterInjectedFields(ctx context.Context, cb func(field string, value interface{})) {
+	injI := ctx.Value(contextKeyInjectedField)
+	if injI == nil {
+		return
+	}
+	inj := injI.(*injectedField)
+	for ; inj != nil; inj = inj.parent {
+		cb(inj.field, inj.value)
+	}
+}
+
+type SubsystemLoggers map[Subsystem]logger.Logger
+
+func SubsystemLoggersWithUniversalLogger(l logger.Logger) SubsystemLoggers {
+	loggers := make(SubsystemLoggers)
+	for _, s := range AllSubsystems {
+		loggers[s] = l
+	}
+	return loggers
+}
+
+func WithLoggers(ctx context.Context, loggers SubsystemLoggers) context.Context {
+	return context.WithValue(ctx, contextKeyLoggers, loggers)
+}
+
+func GetLoggers(ctx context.Context) SubsystemLoggers {
+	loggers, ok := ctx.Value(contextKeyLoggers).(SubsystemLoggers)
+	if !ok {
+		return nil
+	}
+	return loggers
+}
+
+func GetLogger(ctx context.Context, subsys Subsystem) logger.Logger {
+	return getLoggerImpl(ctx, subsys, true)
+}
+
+func getLoggerImpl(ctx context.Context, subsys Subsystem, panicIfEnded bool) logger.Logger {
+	loggers, ok := ctx.Value(contextKeyLoggers).(SubsystemLoggers)
+	if !ok || loggers == nil {
+		return logger.NewNullLogger()
+	}
+	l, ok := loggers[subsys]
+	if !ok {
+		return logger.NewNullLogger()
+	}
+
+	l = l.WithField(SubsysField, subsys)
+
+	l = l.WithField(SpanField, trace.GetSpanStackOrDefault(ctx, *trace.StackKindId, "NOSPAN"))
+
+	fields := make(logger.Fields)
+	iterInjectedFields(ctx, func(field string, value interface{}) {
+		fields[field] = value
+	})
+	l = l.WithFields(fields)
+
+	return l
+}
+
+func parseLogFormat(i interface{}) (f EntryFormatter, err error) {
+	var is string
+	switch j := i.(type) {
+	case string:
+		is = j
+	default:
+		return nil, errors.Errorf("invalid log format: wrong type: %T", i)
+	}
+
+	switch is {
+	case "human":
+		return &HumanFormatter{}, nil
+	case "logfmt":
+		return &LogfmtFormatter{}, nil
+	case "json":
+		return &JSONFormatter{}, nil
+	default:
+		return nil, errors.Errorf("invalid log format: '%s'", is)
+	}
+
+}
+
+func ParseOutlet(in config.LoggingOutletEnum) (o logger.Outlet, level logger.Level, err error) {
+
+	parseCommon := func(common config.LoggingOutletCommon) (logger.Level, EntryFormatter, error) {
+		if common.Level == "" || common.Format == "" {
+			return 0, nil, errors.Errorf("must specify 'level' and 'format' field")
+		}
+
+		minLevel, err := logger.ParseLevel(common.Level)
+		if err != nil {
+			return 0, nil, errors.Wrap(err, "cannot parse 'level' field")
+		}
+		formatter, err := parseLogFormat(common.Format)
+		if err != nil {
+			return 0, nil, errors.Wrap(err, "cannot parse 'formatter' field")
+		}
+		return minLevel, formatter, nil
+	}
+
+	var f EntryFormatter
+
+	switch v := in.Ret.(type) {
+	case *config.StdoutLoggingOutlet:
+		level, f, err = parseCommon(v.LoggingOutletCommon)
+		if err != nil {
+			break
+		}
+		o, err = parseStdoutOutlet(v, f)
+	case *config.TCPLoggingOutlet:
+		level, f, err = parseCommon(v.LoggingOutletCommon)
+		if err != nil {
+			break
+		}
+		o, err = parseTCPOutlet(v, f)
+	case *config.SyslogLoggingOutlet:
+		level, f, err = parseCommon(v.LoggingOutletCommon)
+		if err != nil {
+			break
+		}
+		o, err = parseSyslogOutlet(v, f)
+	default:
+		panic(v)
+	}
+	return o, level, err
+}
+
+func parseStdoutOutlet(in *config.StdoutLoggingOutlet, formatter EntryFormatter) (WriterOutlet, error) {
+	flags := MetadataAll
+	writer := os.Stdout
+	if !isatty.IsTerminal(writer.Fd()) && !in.Time {
+		flags &= ^MetadataTime
+	}
+	if isatty.IsTerminal(writer.Fd()) && !in.Color {
+		flags &= ^MetadataColor
+	}
+
+	formatter.SetMetadataFlags(flags)
+	return WriterOutlet{
+		formatter,
+		os.Stdout,
+	}, nil
+}
+
+func parseTCPOutlet(in *config.TCPLoggingOutlet, formatter EntryFormatter) (out *TCPOutlet, err error) {
+	var tlsConfig *tls.Config
+	if in.TLS != nil {
+		tlsConfig, err = func(m *config.TCPLoggingOutletTLS, host string) (*tls.Config, error) {
+			clientCert, err := tls.LoadX509KeyPair(m.Cert, m.Key)
+			if err != nil {
+				return nil, errors.Wrap(err, "cannot load client cert")
+			}
+
+			var rootCAs *x509.CertPool
+			if m.CA == "" {
+				if rootCAs, err = x509.SystemCertPool(); err != nil {
+					return nil, errors.Wrap(err, "cannot open system cert pool")
+				}
+			} else {
+				rootCAs, err = tlsconf.ParseCAFile(m.CA)
+				if err != nil {
+					return nil, errors.Wrap(err, "cannot parse CA cert")
+				}
+			}
+			if rootCAs == nil {
+				panic("invariant violated")
+			}
+
+			return tlsconf.ClientAuthClient(host, rootCAs, clientCert)
+		}(in.TLS, in.Address)
+		if err != nil {
+			return nil, errors.New("cannot not parse TLS config in field 'tls'")
+		}
+	}
+
+	formatter.SetMetadataFlags(MetadataAll)
+	return NewTCPOutlet(formatter, in.Net, in.Address, tlsConfig, in.RetryInterval), nil
+
+}
+
+func parseSyslogOutlet(in *config.SyslogLoggingOutlet, formatter EntryFormatter) (out *SyslogOutlet, err error) {
+	out = &SyslogOutlet{}
+	out.Formatter = formatter
+	out.Formatter.SetMetadataFlags(MetadataNone)
+	out.Facility = syslog.Priority(*in.Facility)
+	out.RetryInterval = in.RetryInterval
+	return out, nil
+}

internal/daemon/logging/logging_context.go

@@ -0,0 +1,24 @@
+package logging
+
+import "context"
+
+type contextKey int
+
+const (
+	contextKeyLoggers contextKey = 1 + iota
+	contextKeyInjectedField
+)
+
+var contextKeys = []contextKey{
+	contextKeyLoggers,
+	contextKeyInjectedField,
+}
+
+func WithInherit(ctx, inheritFrom context.Context) context.Context {
+	for _, k := range contextKeys {
+		if v := inheritFrom.Value(k); v != nil {
+			ctx = context.WithValue(ctx, k, v) // no shadow
+		}
+	}
+	return ctx
+}

internal/daemon/logging/logging_formatters.go

@@ -0,0 +1,221 @@
+package logging
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/fatih/color"
+	"github.com/go-logfmt/logfmt"
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/logger"
+)
+
+const (
+	FieldLevel   = "level"
+	FieldMessage = "msg"
+	FieldTime    = "time"
+)
+
+const (
+	JobField    string = "job"
+	SubsysField string = "subsystem"
+	SpanField   string = "span"
+)
+
+type MetadataFlags int64
+
+const (
+	MetadataTime MetadataFlags = 1 << iota
+	MetadataLevel
+	MetadataColor
+
+	MetadataNone MetadataFlags = 0
+	MetadataAll  MetadataFlags = ^0
+)
+
+type NoFormatter struct{}
+
+func (f NoFormatter) SetMetadataFlags(flags MetadataFlags) {}
+
+func (f NoFormatter) Format(e *logger.Entry) ([]byte, error) {
+	return []byte(e.Message), nil
+}
+
+type HumanFormatter struct {
+	metadataFlags MetadataFlags
+	ignoreFields  map[string]bool
+}
+
+const HumanFormatterDateFormat = time.RFC3339
+
+func (f *HumanFormatter) SetMetadataFlags(flags MetadataFlags) {
+	f.metadataFlags = flags
+}
+
+func (f *HumanFormatter) SetIgnoreFields(ignore []string) {
+	if ignore == nil {
+		f.ignoreFields = nil
+		return
+	}
+	f.ignoreFields = make(map[string]bool, len(ignore))
+
+	for _, field := range ignore {
+		f.ignoreFields[field] = true
+	}
+}
+
+func (f *HumanFormatter) ignored(field string) bool {
+	return f.ignoreFields != nil && f.ignoreFields[field]
+}
+
+func (f *HumanFormatter) Format(e *logger.Entry) (out []byte, err error) {
+
+	var line bytes.Buffer
+	col := color.New()
+	if f.metadataFlags&MetadataColor != 0 {
+		col = e.Color()
+	}
+
+	if f.metadataFlags&MetadataTime != 0 {
+		fmt.Fprintf(&line, "%s ", e.Time.Format(HumanFormatterDateFormat))
+	}
+	if f.metadataFlags&MetadataLevel != 0 {
+		fmt.Fprintf(&line, "[%s]", col.Sprint(e.Level.Short()))
+	}
+
+	prefixFields := []string{JobField, SubsysField, SpanField}
+	prefixed := make(map[string]bool, len(prefixFields)+2)
+	for _, field := range prefixFields {
+		val, ok := e.Fields[field]
+		if !ok {
+			continue
+		}
+		if !f.ignored(field) {
+			fmt.Fprintf(&line, "[%s]", col.Sprint(val))
+			prefixed[field] = true
+		}
+	}
+
+	if line.Len() > 0 {
+		fmt.Fprint(&line, ": ")
+	}
+	fmt.Fprint(&line, e.Message)
+
+	if len(e.Fields)-len(prefixed) > 0 {
+		for field, value := range e.Fields {
+			if prefixed[field] || f.ignored(field) {
+				continue
+			}
+			fmt.Fprintf(&line, " %s=%q", col.Sprint(field), fmt.Sprint(value))
+		}
+	}
+
+	return line.Bytes(), nil
+}
+
+type JSONFormatter struct {
+	metadataFlags MetadataFlags
+}
+
+func (f *JSONFormatter) SetMetadataFlags(flags MetadataFlags) {
+	f.metadataFlags = flags
+}
+
+func (f *JSONFormatter) Format(e *logger.Entry) ([]byte, error) {
+	data := make(logger.Fields, len(e.Fields)+3)
+	for k, v := range e.Fields {
+		switch v := v.(type) {
+		case error:
+			// Otherwise errors are ignored by `encoding/json`
+			// https://github.com/sirupsen/logrus/issues/137
+			data[k] = v.Error()
+		default:
+			_, err := json.Marshal(v)
+			if err != nil {
+				return nil, errors.Errorf("field is not JSON encodable: %s", k)
+			}
+			data[k] = v
+		}
+	}
+
+	data[FieldMessage] = e.Message
+	data[FieldTime] = e.Time.Format(time.RFC3339)
+	data[FieldLevel] = e.Level
+
+	return json.Marshal(data)
+
+}
+
+type LogfmtFormatter struct {
+	metadataFlags MetadataFlags
+}
+
+func (f *LogfmtFormatter) SetMetadataFlags(flags MetadataFlags) {
+	f.metadataFlags = flags
+}
+
+func (f *LogfmtFormatter) Format(e *logger.Entry) ([]byte, error) {
+	var buf bytes.Buffer
+	enc := logfmt.NewEncoder(&buf)
+
+	if f.metadataFlags&MetadataTime != 0 {
+		err := enc.EncodeKeyval(FieldTime, e.Time)
+		if err != nil {
+			return nil, errors.Wrap(err, "logfmt: encode time")
+		}
+	}
+	if f.metadataFlags&MetadataLevel != 0 {
+		err := enc.EncodeKeyval(FieldLevel, e.Level)
+		if err != nil {
+			return nil, errors.Wrap(err, "logfmt: encode level")
+		}
+	}
+
+	// at least try and put job and task in front
+	prefixed := make(map[string]bool, 3)
+	prefix := []string{JobField, SubsysField, SpanField}
+	for _, pf := range prefix {
+		v, ok := e.Fields[pf]
+		if !ok {
+			break
+		}
+		if err := logfmtTryEncodeKeyval(enc, pf, v); err != nil {
+			return nil, err // unlikely
+		}
+		prefixed[pf] = true
+	}
+
+	err := enc.EncodeKeyval(FieldMessage, e.Message)
+	if err != nil {
+		return nil, errors.Wrap(err, "logfmt: encode message")
+	}
+	for k, v := range e.Fields {
+		if !prefixed[k] {
+			if err := logfmtTryEncodeKeyval(enc, k, v); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	return buf.Bytes(), nil
+}
+
+func logfmtTryEncodeKeyval(enc *logfmt.Encoder, field, value interface{}) error {
+
+	err := enc.EncodeKeyval(field, value)
+	switch err {
+	case nil: // ok
+		return nil
+	case logfmt.ErrUnsupportedValueType:
+		err := enc.EncodeKeyval(field, fmt.Sprintf("<%T>", value))
+		if err != nil {
+			return errors.Wrap(err, "cannot encode unsupported value type Go type")
+		}
+		return nil
+	}
+	return errors.Wrapf(err, "cannot encode field '%s'", field)
+
+}

internal/daemon/logging/logging_outlets.go

@@ -0,0 +1,174 @@
+package logging
+
+import (
+	"bytes"
+	"context"
+	"crypto/tls"
+	"io"
+	"log/syslog"
+	"net"
+	"time"
+
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/logger"
+)
+
+type EntryFormatter interface {
+	SetMetadataFlags(flags MetadataFlags)
+	Format(e *logger.Entry) ([]byte, error)
+}
+
+type WriterOutlet struct {
+	formatter EntryFormatter
+	writer    io.Writer
+}
+
+func (h WriterOutlet) WriteEntry(entry logger.Entry) error {
+	bytes, err := h.formatter.Format(&entry)
+	if err != nil {
+		return err
+	}
+	_, err = h.writer.Write(bytes)
+	if err != nil {
+		return err
+	}
+	_, err = h.writer.Write([]byte("\n"))
+	return err
+}
+
+type TCPOutlet struct {
+	formatter EntryFormatter
+	// Specifies how much time must pass between a connection error and a reconnection attempt
+	// Log entries written to the outlet during this time interval are silently dropped.
+	connect   func(ctx context.Context) (net.Conn, error)
+	entryChan chan *bytes.Buffer
+}
+
+func NewTCPOutlet(formatter EntryFormatter, network, address string, tlsConfig *tls.Config, retryInterval time.Duration) *TCPOutlet {
+
+	connect := func(ctx context.Context) (conn net.Conn, err error) {
+		deadl, ok := ctx.Deadline()
+		if !ok {
+			deadl = time.Time{}
+		}
+		dialer := net.Dialer{
+			Deadline: deadl,
+		}
+		if tlsConfig != nil {
+			conn, err = tls.DialWithDialer(&dialer, network, address, tlsConfig)
+		} else {
+			conn, err = dialer.DialContext(ctx, network, address)
+		}
+		return
+	}
+
+	entryChan := make(chan *bytes.Buffer, 1) // allow one message in flight while previous is in io.Copy()
+
+	o := &TCPOutlet{
+		formatter: formatter,
+		connect:   connect,
+		entryChan: entryChan,
+	}
+
+	go o.outLoop(retryInterval)
+
+	return o
+}
+
+// FIXME: use this method
+func (h *TCPOutlet) Close() {
+	close(h.entryChan)
+}
+
+func (h *TCPOutlet) outLoop(retryInterval time.Duration) {
+
+	var retry time.Time
+	var conn net.Conn
+	for msg := range h.entryChan {
+		var err error
+		for conn == nil {
+			time.Sleep(time.Until(retry))
+			ctx, cancel := context.WithDeadline(context.TODO(), time.Now().Add(retryInterval))
+			conn, err = h.connect(ctx)
+			cancel()
+			if err != nil {
+				retry = time.Now().Add(retryInterval)
+				conn = nil
+			}
+		}
+		err = conn.SetWriteDeadline(time.Now().Add(retryInterval))
+		if err == nil {
+			_, err = io.Copy(conn, msg)
+		}
+		if err != nil {
+			retry = time.Now().Add(retryInterval)
+			conn.Close()
+			conn = nil
+		}
+	}
+}
+
+func (h *TCPOutlet) WriteEntry(e logger.Entry) error {
+
+	ebytes, err := h.formatter.Format(&e)
+	if err != nil {
+		return err
+	}
+
+	buf := new(bytes.Buffer)
+	buf.Write(ebytes)
+	buf.WriteString("\n")
+
+	select {
+	case h.entryChan <- buf:
+		return nil
+	default:
+		return errors.New("connection broken or not fast enough")
+	}
+}
+
+type SyslogOutlet struct {
+	Formatter          EntryFormatter
+	RetryInterval      time.Duration
+	Facility           syslog.Priority
+	writer             *syslog.Writer
+	lastConnectAttempt time.Time
+}
+
+func (o *SyslogOutlet) WriteEntry(entry logger.Entry) error {
+
+	bytes, err := o.Formatter.Format(&entry)
+	if err != nil {
+		return err
+	}
+
+	s := string(bytes)
+
+	if o.writer == nil {
+		now := time.Now()
+		if now.Sub(o.lastConnectAttempt) < o.RetryInterval {
+			return nil // not an error toward logger
+		}
+		o.writer, err = syslog.New(o.Facility, "zrepl")
+		o.lastConnectAttempt = time.Now()
+		if err != nil {
+			o.writer = nil
+			return err
+		}
+	}
+
+	switch entry.Level {
+	case logger.Debug:
+		return o.writer.Debug(s)
+	case logger.Info:
+		return o.writer.Info(s)
+	case logger.Warn:
+		return o.writer.Warning(s)
+	case logger.Error:
+		return o.writer.Err(s)
+	default:
+		return o.writer.Err(s) // write as error as reaching this case is in fact an error
+	}
+
+}

internal/daemon/logging/trace/trace.go

@@ -0,0 +1,422 @@
+// package trace provides activity tracing via ctx through Tasks and Spans
+//
+// # Basic Concepts
+//
+// Tracing can be used to identify where a piece of code spends its time.
+//
+// The Go standard library provides package runtime/trace which is useful to identify CPU bottlenecks or
+// to understand what happens inside the Go runtime.
+// However, it is not ideal for application level tracing, in particular if those traces should be understandable
+// to tech-savvy users (albeit not developers).
+//
+// This package provides the concept of Tasks and Spans to express what activity is happening within an application:
+// - Neither task nor span is really tangible but instead contained within the context.Context tree
+// - Tasks represent concurrent activity (i.e. goroutines).
+// - Spans represent a semantic stack trace within a task.
+// As a consequence, whenever a context is propagated across goroutine boundary, you need to create a child task:
+//
+//	go func(ctx context.Context) {
+//	  ctx, endTask = WithTask(ctx, "what-happens-inside-the-child-task")
+//	  defer endTask()
+//	  // ...
+//	}(ctx)
+//
+// Within the task, you can open up a hierarchy of spans.
+// In contrast to tasks, which have can multiple concurrently running child tasks,
+// spans must nest and not cross the goroutine boundary.
+//
+//	ctx, endSpan = WithSpan(ctx, "copy-dir")
+//	defer endSpan()
+//	for _, f := range dir.Files() {
+//	  func() {
+//	    ctx, endSpan := WithSpan(ctx, fmt.Sprintf("copy-file %q", f))
+//	    defer endspan()
+//	    b, _ := ioutil.ReadFile(f)
+//	    _ = ioutil.WriteFile(f + ".copy", b, 0600)
+//	  }()
+//	}
+//
+// In combination:
+//
+//	ctx, endTask = WithTask(ctx, "copy-dirs")
+//	defer endTask()
+//	for i := range dirs {
+//	  go func(dir string) {
+//	    ctx, endTask := WithTask(ctx, "copy-dir")
+//	    defer endTask()
+//	    for _, f := range filesIn(dir) {
+//	      func() {
+//	        ctx, endSpan := WithSpan(ctx, fmt.Sprintf("copy-file %q", f))
+//	        defer endspan()
+//	        b, _ := ioutil.ReadFile(f)
+//	        _ = ioutil.WriteFile(f + ".copy", b, 0600)
+//	      }()
+//	    }
+//	  }()
+//	}
+//
+// Note that a span ends at the time you call endSpan - not before and not after that.
+// If you violate the stack-like nesting of spans by forgetting an endSpan() invocation,
+// the out-of-order endSpan() will panic.
+//
+// A similar rule applies to the endTask closure returned by WithTask:
+// If a task has live child tasks at the time you call endTask(), the call will panic.
+//
+// Recovering from endSpan() or endTask() panics will corrupt the trace stack and lead to corrupt tracefile output.
+//
+// # Best Practices For Naming Tasks And Spans
+//
+// Tasks should always have string constants as names, and must not contain the `#` character. WHy?
+// First, the visualization by chrome://tracing draws a horizontal bar for each task in the trace.
+// Also, the package appends `#NUM` for each concurrently running instance of a task name.
+// Note that the `#NUM` suffix will be reused if a task has ended, in order to avoid an
+// infinite number of horizontal bars in the visualization.
+//
+// # Chrome-compatible Tracefile Support
+//
+// The activity trace generated by usage of WithTask and WithSpan can be rendered to a JSON output file
+// that can be loaded into chrome://tracing .
+// Apart from function GetSpanStackOrDefault, this is the main benefit of this package.
+//
+// First, there is a convenience environment variable 'ZREPL_ACTIVITY_TRACE' that can be set to an output path.
+// From process start onward, a trace is written to that path.
+//
+// More consumers can attach to the activity trace through the ChrometraceClientWebsocketHandler websocket handler.
+//
+// If a write error is encountered with any consumer (including the env-var based one), the consumer is closed and
+// will not receive further trace output.
+package trace
+
+import (
+	"context"
+	"fmt"
+	"os"
+	runtimedebug "runtime/debug"
+	"strings"
+	"time"
+
+	"github.com/kr/pretty"
+	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/zrepl/zrepl/internal/util/chainlock"
+)
+
+var metrics struct {
+	activeTasks prometheus.Gauge
+}
+var taskNamer *uniqueConcurrentTaskNamer = newUniqueTaskNamer()
+
+func init() {
+	metrics.activeTasks = prometheus.NewGauge(prometheus.GaugeOpts{
+		Namespace: "zrepl",
+		Subsystem: "trace",
+		Name:      "active_tasks",
+		Help:      "number of active (tracing-level) tasks in the daemon",
+	})
+}
+
+func RegisterMetrics(r prometheus.Registerer) {
+	r.MustRegister(metrics.activeTasks)
+}
+
+type traceNode struct {
+	// NOTE: members with prefix debug are only valid if the package variable debugEnabled is true.
+
+	id                 string
+	annotation         string
+	parentTask         *traceNode
+	debugCreationStack string // debug: stack trace of when the traceNode was created
+
+	mtx chainlock.L
+
+	activeChildTasks      int32               // only for task nodes, insignificant for span nodes
+	debugActiveChildTasks map[*traceNode]bool // debug: set of active child tasks
+	parentSpan            *traceNode
+	activeChildSpan       *traceNode // nil if task or span doesn't have an active child span
+
+	startedAt time.Time
+	endedAt   time.Time
+}
+
+func (s *traceNode) StartedAt() time.Time { return s.startedAt }
+func (s *traceNode) EndedAt() time.Time   { return s.endedAt }
+
+// caller must hold mtx
+func (s *traceNode) debugString() string {
+	if !debugEnabled {
+		return "<debugEnabled=false>"
+	}
+	return pretty.Sprint(s)
+}
+
+// Returned from WithTask or WithSpan.
+// Must be called once the task or span ends.
+// See package-level docs for nesting rules.
+// Wrong call order / forgetting to call it will result in panics.
+type DoneFunc func()
+
+var ErrTaskStillHasActiveChildTasks = fmt.Errorf("end task: task still has active child tasks")
+
+// Start a new root task or create a child task of an existing task.
+//
+// This is required when starting a new goroutine and
+// passing an existing task context to it.
+//
+// taskName should be a constantand must not contain '#'
+//
+// The implementation ensures that,
+// if multiple tasks with the same name exist simultaneously,
+// a unique suffix is appended to uniquely identify the task opened with this function.
+func WithTask(ctx context.Context, taskName string) (context.Context, DoneFunc) {
+
+	var parentTask *traceNode
+	nodeI := ctx.Value(contextKeyTraceNode)
+	if nodeI != nil {
+		node := nodeI.(*traceNode)
+		if node.parentSpan != nil {
+			parentTask = node.parentTask
+		} else {
+			parentTask = node
+		}
+	}
+	// find the first ancestor that hasn't ended yet (nil if need be)
+	if parentTask != nil {
+		parentTask.mtx.Lock()
+	}
+	for parentTask != nil && !parentTask.endedAt.IsZero() {
+		thisParent := parentTask
+		parentTask = parentTask.parentTask
+		// lock parent first such that it isn't modified by other callers to thisParent
+		if parentTask != nil {
+			parentTask.mtx.Lock()
+		}
+		thisParent.mtx.Unlock()
+	}
+	// invariant: either parentTask != nil and we hold the lock on parentTask, or parentTask is nil
+
+	taskName, taskNameDone := taskNamer.UniqueConcurrentTaskName(taskName)
+
+	this := &traceNode{
+		id:               genID(),
+		annotation:       taskName,
+		parentTask:       parentTask,
+		activeChildTasks: 0,
+		parentSpan:       nil,
+		activeChildSpan:  nil,
+
+		startedAt: time.Now(),
+		endedAt:   time.Time{},
+	}
+
+	if debugEnabled {
+		this.debugCreationStack = string(runtimedebug.Stack())
+		this.debugActiveChildTasks = map[*traceNode]bool{}
+	}
+
+	if parentTask != nil {
+		this.parentTask.activeChildTasks++
+		if debugEnabled {
+			this.parentTask.debugActiveChildTasks[this] = true
+		}
+		parentTask.mtx.Unlock()
+	}
+
+	ctx = context.WithValue(ctx, contextKeyTraceNode, this)
+
+	chrometraceBeginTask(this)
+
+	metrics.activeTasks.Inc()
+
+	endTaskFunc := func() {
+
+		// only hold locks while manipulating the tree
+		// (trace writer might block too long and unlike spans, tasks are updated concurrently)
+		alreadyEnded := func() (alreadyEnded bool) {
+			if this.parentTask != nil {
+				defer this.parentTask.mtx.Lock().Unlock()
+			}
+			defer this.mtx.Lock().Unlock()
+
+			if this.activeChildTasks != 0 {
+				if debugEnabled {
+					// the debugString can be quite long and panic won't print it completely
+					fmt.Fprintf(os.Stderr, "going to panic due to activeChildTasks:\n%s\n", this.debugString())
+				}
+				panic(errors.WithMessagef(ErrTaskStillHasActiveChildTasks, "end task: %v active child tasks (run daemon with env var %s=1 for more details)\n", this.activeChildTasks, debugEnabledEnvVar))
+			}
+
+			// support idempotent task ends
+			if !this.endedAt.IsZero() {
+				return true
+			}
+			this.endedAt = time.Now()
+
+			if this.parentTask != nil {
+				this.parentTask.activeChildTasks--
+				if debugEnabled {
+					delete(this.parentTask.debugActiveChildTasks, this)
+				}
+				if this.parentTask.activeChildTasks < 0 {
+					if debugEnabled {
+						// the debugString can be quite long and panic won't print it completely
+						fmt.Fprintf(os.Stderr, "going to panic due to activeChildTasks < 0:\n%s\n", this.parentTask.debugString())
+					}
+					panic(fmt.Sprintf("impl error: parent task with negative activeChildTasks count: %v", this.parentTask.activeChildTasks))
+				}
+			}
+			return false
+		}()
+		if alreadyEnded {
+			return
+		}
+
+		chrometraceEndTask(this)
+
+		metrics.activeTasks.Dec()
+
+		taskNameDone()
+	}
+
+	return ctx, endTaskFunc
+}
+
+var ErrAlreadyActiveChildSpan = fmt.Errorf("create child span: span already has an active child span")
+var ErrSpanStillHasActiveChildSpan = fmt.Errorf("end span: span still has active child spans")
+
+// Start a new span.
+// Important: ctx must have an active task (see WithTask)
+func WithSpan(ctx context.Context, annotation string) (context.Context, DoneFunc) {
+	var parentSpan, parentTask *traceNode
+	nodeI := ctx.Value(contextKeyTraceNode)
+	if nodeI != nil {
+		parentSpan = nodeI.(*traceNode)
+		if parentSpan.parentSpan == nil {
+			parentTask = parentSpan
+		} else {
+			parentTask = parentSpan.parentTask
+		}
+	} else {
+		panic("must be called from within a task")
+	}
+
+	this := &traceNode{
+		id:              genID(),
+		annotation:      annotation,
+		parentTask:      parentTask,
+		parentSpan:      parentSpan,
+		activeChildSpan: nil,
+
+		startedAt: time.Now(),
+		endedAt:   time.Time{},
+	}
+
+	if debugEnabled {
+		this.debugCreationStack = string(runtimedebug.Stack())
+	}
+
+	parentSpan.mtx.HoldWhile(func() {
+		if parentSpan.activeChildSpan != nil {
+			panic(ErrAlreadyActiveChildSpan)
+		}
+		parentSpan.activeChildSpan = this
+	})
+
+	ctx = context.WithValue(ctx, contextKeyTraceNode, this)
+	chrometraceBeginSpan(this)
+	callbackEndSpan := callbackBeginSpan(ctx)
+
+	endTaskFunc := func() {
+
+		defer parentSpan.mtx.Lock().Unlock()
+		if parentSpan.activeChildSpan != this && this.endedAt.IsZero() {
+			panic("impl error: activeChildSpan should not change while != nil because there can only be one")
+		}
+
+		defer this.mtx.Lock().Unlock()
+		if this.activeChildSpan != nil {
+			panic(ErrSpanStillHasActiveChildSpan)
+		}
+
+		if !this.endedAt.IsZero() {
+			return // support idempotent span ends
+		}
+
+		parentSpan.activeChildSpan = nil
+		this.endedAt = time.Now()
+
+		chrometraceEndSpan(this)
+		callbackEndSpan(this)
+	}
+
+	return ctx, endTaskFunc
+}
+
+type StackKind struct {
+	symbolizeTask func(t *traceNode) string
+	symbolizeSpan func(s *traceNode) string
+}
+
+var (
+	StackKindId = &StackKind{
+		symbolizeTask: func(t *traceNode) string { return t.id },
+		symbolizeSpan: func(s *traceNode) string { return s.id },
+	}
+	SpanStackKindCombined = &StackKind{
+		symbolizeTask: func(t *traceNode) string { return fmt.Sprintf("(%s %q)", t.id, t.annotation) },
+		symbolizeSpan: func(s *traceNode) string { return fmt.Sprintf("(%s %q)", s.id, s.annotation) },
+	}
+	SpanStackKindAnnotation = &StackKind{
+		symbolizeTask: func(t *traceNode) string { return t.annotation },
+		symbolizeSpan: func(s *traceNode) string { return s.annotation },
+	}
+)
+
+func (n *traceNode) task() *traceNode {
+	task := n.parentTask
+	if n.parentSpan == nil {
+		task = n
+	}
+	return task
+}
+
+func (n *traceNode) TaskName() string {
+	task := n.task()
+	return task.annotation
+}
+
+func (this *traceNode) TaskAndSpanStack(kind *StackKind) (spanIdStack string) {
+	task := this.task()
+
+	var spansInTask []*traceNode
+	for s := this; s != nil; s = s.parentSpan {
+		spansInTask = append(spansInTask, s)
+	}
+
+	var tasks []*traceNode
+	for t := task; t != nil; t = t.parentTask {
+		tasks = append(tasks, t)
+	}
+
+	var taskIdsRev []string
+	for i := len(tasks) - 1; i >= 0; i-- {
+		taskIdsRev = append(taskIdsRev, kind.symbolizeTask(tasks[i]))
+	}
+
+	var spanIdsRev []string
+	for i := len(spansInTask) - 1; i >= 0; i-- {
+		spanIdsRev = append(spanIdsRev, kind.symbolizeSpan(spansInTask[i]))
+	}
+
+	taskStack := strings.Join(taskIdsRev, "$")
+	return fmt.Sprintf("%s$%s", taskStack, strings.Join(spanIdsRev, "."))
+}
+
+func GetSpanStackOrDefault(ctx context.Context, kind StackKind, def string) string {
+	if nI := ctx.Value(contextKeyTraceNode); nI != nil {
+		n := nI.(*traceNode)
+		return n.TaskAndSpanStack(StackKindId)
+	} else {
+		return def
+	}
+}

internal/daemon/logging/trace/trace_callback.go

@@ -0,0 +1,54 @@
+package trace
+
+import (
+	"context"
+	"time"
+
+	"github.com/zrepl/zrepl/internal/util/chainlock"
+)
+
+type SpanInfo interface {
+	StartedAt() time.Time
+	EndedAt() time.Time
+	TaskAndSpanStack(kind *StackKind) string
+}
+
+type Callback struct {
+	OnBegin func(ctx context.Context)
+	OnEnd   func(ctx context.Context, spanInfo SpanInfo)
+}
+
+var callbacks struct {
+	mtx chainlock.L
+	cs  []Callback
+}
+
+func RegisterCallback(c Callback) {
+	callbacks.mtx.HoldWhile(func() {
+		callbacks.cs = append(callbacks.cs, c)
+	})
+}
+
+func callbackBeginSpan(ctx context.Context) func(SpanInfo) {
+	// capture the current state of callbacks into a local variable
+	// this is safe because the slice is append-only and immutable
+
+	// (it is important that a callback registered _after_ callbackBeginSpin is called does not get called on OnEnd)
+
+	var cbs []Callback
+	callbacks.mtx.HoldWhile(func() {
+		cbs = callbacks.cs
+	})
+	for _, cb := range cbs {
+		if cb.OnBegin != nil {
+			cb.OnBegin(ctx)
+		}
+	}
+	return func(spanInfo SpanInfo) {
+		for _, cb := range cbs {
+			if cb.OnEnd != nil {
+				cb.OnEnd(ctx, spanInfo)
+			}
+		}
+	}
+}

internal/daemon/logging/trace/trace_chrometrace.go

@@ -0,0 +1,230 @@
+package trace
+
+// The functions in this file are concerned with the generation
+// of trace files based on the information from WithTask and WithSpan.
+//
+// The emitted trace files are open-ended array of JSON objects
+// that follow the Chrome trace file format:
+//   https://docs.google.com/document/d/1CvAClvFfyA5R-PhYUmn5OOQtYMH4h6I0nSsKchNAySU/preview
+//
+// The emitted JSON can be loaded into Chrome's chrome://tracing view.
+//
+// The trace file can be written to a file whose path is specified in an env file,
+// and be written to web sockets established on ChrometraceHttpHandler
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"sync"
+	"sync/atomic"
+
+	"golang.org/x/net/websocket"
+
+	"github.com/zrepl/zrepl/internal/util/envconst"
+)
+
+var chrometracePID string
+
+func init() {
+	var err error
+	chrometracePID, err = os.Hostname()
+	if err != nil {
+		panic(err)
+	}
+	chrometracePID = fmt.Sprintf("%q", chrometracePID)
+}
+
+type chrometraceEvent struct {
+	Cat                       string   `json:"cat,omitempty"`
+	Name                      string   `json:"name"`
+	Stack                     []string `json:"stack,omitempty"`
+	Phase                     string   `json:"ph"`
+	TimestampUnixMicroseconds int64    `json:"ts"`
+	DurationMicroseconds      int64    `json:"dur,omitempty"`
+	Pid                       string   `json:"pid"`
+	Tid                       string   `json:"tid"`
+	Id                        string   `json:"id,omitempty"`
+}
+
+func chrometraceBeginSpan(s *traceNode) {
+	taskName := s.TaskName()
+	chrometraceWrite(chrometraceEvent{
+		Name:                      s.annotation,
+		Phase:                     "B",
+		TimestampUnixMicroseconds: s.startedAt.UnixNano() / 1000,
+		Pid:                       chrometracePID,
+		Tid:                       taskName,
+	})
+}
+
+func chrometraceEndSpan(s *traceNode) {
+	taskName := s.TaskName()
+	chrometraceWrite(chrometraceEvent{
+		Name:                      s.annotation,
+		Phase:                     "E",
+		TimestampUnixMicroseconds: s.endedAt.UnixNano() / 1000,
+		Pid:                       chrometracePID,
+		Tid:                       taskName,
+	})
+}
+
+var chrometraceFlowId uint64
+
+func chrometraceBeginTask(s *traceNode) {
+	chrometraceBeginSpan(s)
+
+	if s.parentTask == nil {
+		return
+	}
+	// beginning of a task that has a parent
+	// => use flow events to link parent and child
+
+	flowId := atomic.AddUint64(&chrometraceFlowId, 1)
+	flowIdStr := fmt.Sprintf("%x", flowId)
+
+	parentTask := s.parentTask.TaskName()
+	chrometraceWrite(chrometraceEvent{
+		Cat:                       "task", // seems to be necessary, otherwise the GUI shows some `indexOf` JS error
+		Name:                      "child-task",
+		Phase:                     "s",
+		TimestampUnixMicroseconds: s.startedAt.UnixNano() / 1000, // yes, the child's timestamp (=> from-point of the flow line is at right x-position of parent's bar)
+		Pid:                       chrometracePID,
+		Tid:                       parentTask,
+		Id:                        flowIdStr,
+	})
+
+	childTask := s.TaskName()
+	if parentTask == childTask {
+		panic(parentTask)
+	}
+	chrometraceWrite(chrometraceEvent{
+		Cat:                       "task", // seems to be necessary, otherwise the GUI shows some `indexOf` JS error
+		Name:                      "child-task",
+		Phase:                     "f",
+		TimestampUnixMicroseconds: s.startedAt.UnixNano() / 1000,
+		Pid:                       chrometracePID,
+		Tid:                       childTask,
+		Id:                        flowIdStr,
+	})
+}
+
+func chrometraceEndTask(s *traceNode) {
+	chrometraceEndSpan(s)
+}
+
+type chrometraceConsumerRegistration struct {
+	w io.Writer
+	// errored must have capacity 1, the writer thread will send to it non-blocking, then close it
+	errored chan error
+}
+
+var chrometraceConsumers struct {
+	register  chan chrometraceConsumerRegistration
+	consumers map[chrometraceConsumerRegistration]bool
+	write     chan []byte
+}
+
+func init() {
+	chrometraceConsumers.register = make(chan chrometraceConsumerRegistration)
+	chrometraceConsumers.consumers = make(map[chrometraceConsumerRegistration]bool)
+	chrometraceConsumers.write = make(chan []byte)
+	go func() {
+		kickConsumer := func(c chrometraceConsumerRegistration, err error) {
+			debug("chrometrace kicking consumer %#v after error %v", c, err)
+			select {
+			case c.errored <- err:
+			default:
+			}
+			close(c.errored)
+			delete(chrometraceConsumers.consumers, c)
+		}
+		for {
+			select {
+			case reg := <-chrometraceConsumers.register:
+				debug("registered chrometrace consumer %#v", reg)
+				chrometraceConsumers.consumers[reg] = true
+				n, err := reg.w.Write([]byte("[\n"))
+				if err != nil {
+					kickConsumer(reg, err)
+				} else if n != 2 {
+					kickConsumer(reg, fmt.Errorf("short write: %v", n))
+				}
+				// successfully registered
+
+			case buf := <-chrometraceConsumers.write:
+				debug("chrometrace write request: %s", string(buf))
+				var r bytes.Reader
+				for c := range chrometraceConsumers.consumers {
+					r.Reset(buf)
+					n, err := io.Copy(c.w, &r)
+					debug("chrometrace wrote n=%v bytes to consumer %#v", n, c)
+					if err != nil {
+						kickConsumer(c, err)
+					}
+				}
+			}
+		}
+	}()
+}
+
+func chrometraceWrite(i interface{}) {
+	var buf bytes.Buffer
+	err := json.NewEncoder(&buf).Encode(i)
+	if err != nil {
+		panic(err)
+	}
+	buf.WriteString(",")
+	chrometraceConsumers.write <- buf.Bytes()
+}
+
+func ChrometraceClientWebsocketHandler(conn *websocket.Conn) {
+	defer conn.Close()
+
+	var wg sync.WaitGroup
+	defer wg.Wait()
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		r := bufio.NewReader(conn)
+		_, _, _ = r.ReadLine() // ignore errors
+		conn.Close()
+	}()
+
+	errored := make(chan error, 1)
+	chrometraceConsumers.register <- chrometraceConsumerRegistration{
+		w:       conn,
+		errored: errored,
+	}
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		<-errored
+		conn.Close()
+	}()
+}
+
+var chrometraceFileConsumerPath = envconst.String("ZREPL_ACTIVITY_TRACE", "")
+
+func init() {
+	if chrometraceFileConsumerPath != "" {
+		var err error
+		f, err := os.Create(chrometraceFileConsumerPath)
+		if err != nil {
+			panic(err)
+		}
+		errored := make(chan error, 1)
+		chrometraceConsumers.register <- chrometraceConsumerRegistration{
+			w:       f,
+			errored: errored,
+		}
+		go func() {
+			<-errored
+			f.Close()
+		}()
+	}
+}

internal/daemon/logging/trace/trace_context.go

@@ -0,0 +1,27 @@
+package trace
+
+import "context"
+
+type contextKey int
+
+const (
+	contextKeyTraceNode contextKey = 1 + iota
+)
+
+var contextKeys = []contextKey{
+	contextKeyTraceNode,
+}
+
+// WithInherit inherits the task hierarchy from inheritFrom into ctx.
+// The returned context is a child of ctx, but its task and span are those of inheritFrom.
+//
+// Note that in most use cases, callers most likely want to call WithTask since it will most likely
+// be in some sort of connection handler context.
+func WithInherit(ctx, inheritFrom context.Context) context.Context {
+	for _, k := range contextKeys {
+		if v := inheritFrom.Value(k); v != nil {
+			ctx = context.WithValue(ctx, k, v) // no shadow
+		}
+	}
+	return ctx
+}

internal/daemon/logging/trace/trace_convenience.go

@@ -0,0 +1,76 @@
+package trace
+
+import (
+	"context"
+	"fmt"
+	"runtime"
+	"strings"
+	"sync"
+)
+
+// use like this:
+//
+//	defer WithSpanFromStackUpdateCtx(&existingCtx)()
+func WithSpanFromStackUpdateCtx(ctx *context.Context) DoneFunc {
+	childSpanCtx, end := WithSpan(*ctx, getMyCallerOrPanic())
+	*ctx = childSpanCtx
+	return end
+}
+
+// derive task name from call stack (caller's name)
+func WithTaskFromStack(ctx context.Context) (context.Context, DoneFunc) {
+	return WithTask(ctx, getMyCallerOrPanic())
+}
+
+// derive task name from call stack (caller's name) and update *ctx
+// to point to be the child task ctx
+func WithTaskFromStackUpdateCtx(ctx *context.Context) DoneFunc {
+	child, end := WithTask(*ctx, getMyCallerOrPanic())
+	*ctx = child
+	return end
+}
+
+// create a task and a span within it in one call
+func WithTaskAndSpan(ctx context.Context, task string, span string) (context.Context, DoneFunc) {
+	ctx, endTask := WithTask(ctx, task)
+	ctx, endSpan := WithSpan(ctx, fmt.Sprintf("%s %s", task, span))
+	return ctx, func() {
+		endSpan()
+		endTask()
+	}
+}
+
+// create a span during which several child tasks are spawned using the `add` function
+//
+// IMPORTANT FOR USERS: Caller must ensure that the capturing behavior is correct, the Go linter doesn't catch this.
+func WithTaskGroup(ctx context.Context, taskGroup string) (_ context.Context, add func(f func(context.Context)), waitEnd DoneFunc) {
+	var wg sync.WaitGroup
+	ctx, endSpan := WithSpan(ctx, taskGroup)
+	add = func(f func(context.Context)) {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			ctx, endTask := WithTask(ctx, taskGroup)
+			defer endTask()
+			f(ctx)
+		}()
+	}
+	waitEnd = func() {
+		wg.Wait()
+		endSpan()
+	}
+	return ctx, add, waitEnd
+}
+
+func getMyCallerOrPanic() string {
+	pc, _, _, ok := runtime.Caller(2)
+	if !ok {
+		panic("cannot get caller")
+	}
+	details := runtime.FuncForPC(pc)
+	if ok && details != nil {
+		const prefix = "github.com/zrepl/zrepl"
+		return strings.TrimPrefix(strings.TrimPrefix(details.Name(), prefix), "/")
+	}
+	return ""
+}

internal/daemon/logging/trace/trace_convenience_test.go

@@ -0,0 +1,62 @@
+package trace
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetCallerOrPanic(t *testing.T) {
+	withStackFromCtxMock := func() string {
+		return getMyCallerOrPanic()
+	}
+	ret := withStackFromCtxMock()
+	// zrepl prefix is stripped
+	assert.Equal(t, "internal/daemon/logging/trace.TestGetCallerOrPanic", ret)
+}
+
+func TestWithTaskGroupRunTasksConcurrently(t *testing.T) {
+
+	// spawn a task group where each task waits for the other to start
+	// => without concurrency, they would hang
+
+	rootCtx, endRoot := WithTaskFromStack(context.Background())
+	defer endRoot()
+
+	_, add, waitEnd := WithTaskGroup(rootCtx, "test-task-group")
+
+	schedulerTimeout := 2 * time.Second
+	timeout := time.After(schedulerTimeout)
+	var hadTimeout uint32
+	started0, started1 := make(chan struct{}), make(chan struct{})
+	for i := 0; i < 2; i++ {
+		i := i // capture by copy
+		add(func(ctx context.Context) {
+			switch i {
+			case 0:
+				close(started0)
+				select {
+				case <-started1:
+				case <-timeout:
+					atomic.AddUint32(&hadTimeout, 1)
+				}
+			case 1:
+				close(started1)
+				select {
+				case <-started0:
+				case <-timeout:
+					atomic.AddUint32(&hadTimeout, 1)
+				}
+			default:
+				panic("unreachable")
+			}
+		})
+	}
+
+	waitEnd()
+	assert.Zero(t, hadTimeout, "either bad impl or scheduler timeout (which is %v)", schedulerTimeout)
+
+}

internal/daemon/logging/trace/trace_debug.go

@@ -0,0 +1,19 @@
+package trace
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/zrepl/zrepl/internal/util/envconst"
+)
+
+const debugEnabledEnvVar = "ZREPL_TRACE_DEBUG_ENABLED"
+
+var debugEnabled = envconst.Bool(debugEnabledEnvVar, false)
+
+func debug(format string, args ...interface{}) {
+	if !debugEnabled {
+		return
+	}
+	fmt.Fprintf(os.Stderr, format+"\n", args...)
+}

internal/daemon/logging/trace/trace_genID.go

@@ -0,0 +1,35 @@
+package trace
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"strings"
+
+	"github.com/zrepl/zrepl/internal/util/envconst"
+)
+
+var genIdNumBytes = envconst.Int("ZREPL_TRACE_ID_NUM_BYTES", 3)
+
+func init() {
+	if genIdNumBytes < 1 {
+		panic("trace node id byte length must be at least 1")
+	}
+}
+
+func genID() string {
+	var out strings.Builder
+	enc := base64.NewEncoder(base64.RawStdEncoding, &out)
+	buf := make([]byte, genIdNumBytes)
+	_, err := rand.Read(buf)
+	if err != nil {
+		panic(err)
+	}
+	n, err := enc.Write(buf[:])
+	if err != nil || n != len(buf) {
+		panic(err)
+	}
+	if err := enc.Close(); err != nil {
+		panic(err)
+	}
+	return out.String()
+}

internal/daemon/logging/trace/trace_test.go

@@ -0,0 +1,205 @@
+package trace
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/gitchander/permutation"
+	"github.com/pkg/errors"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRegularSpanUsage(t *testing.T) {
+	root, endRoot := WithTask(context.Background(), "root")
+	defer endRoot()
+
+	s1, endS1 := WithSpan(root, "parent")
+	s2, endS2 := WithSpan(s1, "child")
+	_, endS3 := WithSpan(s2, "grand-child")
+	require.NotPanics(t, func() { endS3() })
+	require.NotPanics(t, func() { endS2() })
+
+	// reuse
+	_, endS4 := WithSpan(s1, "child-2")
+	require.NotPanics(t, func() { endS4() })
+
+	// close parent
+	require.NotPanics(t, func() { endS1() })
+}
+
+func TestMultipleActiveChildSpansNotAllowed(t *testing.T) {
+	root, endRoot := WithTask(context.Background(), "root")
+	defer endRoot()
+
+	s1, _ := WithSpan(root, "s1")
+	_, endS2 := WithSpan(s1, "s1-child1")
+
+	require.PanicsWithValue(t, ErrAlreadyActiveChildSpan, func() {
+		_, _ = WithSpan(s1, "s1-child2")
+	})
+
+	endS2()
+
+	require.NotPanics(t, func() {
+		_, _ = WithSpan(s1, "s1-child2")
+	})
+}
+
+func TestForkingChildSpansNotAllowed(t *testing.T) {
+	root, endRoot := WithTask(context.Background(), "root")
+	defer endRoot()
+
+	s1, _ := WithSpan(root, "s1")
+	sc, endSC := WithSpan(s1, "s1-child")
+	_, _ = WithSpan(sc, "s1-child-child")
+
+	require.PanicsWithValue(t, ErrSpanStillHasActiveChildSpan, func() {
+		endSC()
+	})
+}
+
+func TestRegularTaskUsage(t *testing.T) {
+	// assert concurrent activities on different tasks can end in any order
+	closeOrder := []int{0, 1, 2}
+	closeOrders := permutation.New(permutation.IntSlice(closeOrder))
+	for closeOrders.Next() {
+		t.Run(fmt.Sprintf("%v", closeOrder), func(t *testing.T) {
+			root, endRoot := WithTask(context.Background(), "root")
+			defer endRoot()
+
+			c1, endC1 := WithTask(root, "c1")
+			defer endC1()
+			c2, endC2 := WithTask(root, "c2")
+			defer endC2()
+
+			// begin 3 concurrent activities
+			_, endAR := WithSpan(root, "aR")
+			_, endAC1 := WithSpan(c1, "aC1")
+			_, endAC2 := WithSpan(c2, "aC2")
+
+			endFuncs := []DoneFunc{endAR, endAC1, endAC2}
+			for _, i := range closeOrder {
+				require.NotPanics(t, func() {
+					endFuncs[i]()
+				}, "%v", i)
+			}
+		})
+	}
+}
+
+func TestTaskEndWithActiveChildTaskNotAllowed(t *testing.T) {
+	root, _ := WithTask(context.Background(), "root")
+	c, endC := WithTask(root, "child")
+	_, _ = WithTask(c, "grand-child")
+	func() {
+		defer func() {
+			r := recover()
+			require.NotNil(t, r)
+			err, ok := r.(error)
+			require.True(t, ok)
+			require.Equal(t, ErrTaskStillHasActiveChildTasks, errors.Cause(err))
+		}()
+		endC()
+	}()
+
+}
+
+func TestIdempotentEndTask(t *testing.T) {
+	_, end := WithTask(context.Background(), "root")
+	end()
+	require.NotPanics(t, func() { end() })
+}
+
+func TestSpansPanicIfNoParentTask(t *testing.T) {
+	require.Panics(t, func() { WithSpan(context.Background(), "taskless-span") })
+}
+
+func TestIdempotentEndSpan(t *testing.T) {
+	root, _ := WithTask(context.Background(), "root")
+	_, end := WithSpan(root, "span")
+	end()
+	require.NotPanics(t, func() { end() })
+}
+
+func logAndGetTraceNode(t *testing.T, descr string, ctx context.Context) *traceNode {
+	n, ok := ctx.Value(contextKeyTraceNode).(*traceNode)
+	require.True(t, ok)
+	t.Logf("% 20s %p %#v", descr, n, n)
+	return n
+}
+
+func TestWhiteboxHierachy(t *testing.T) {
+	root, e1 := WithTask(context.Background(), "root")
+	rootN := logAndGetTraceNode(t, "root", root)
+	assert.Nil(t, rootN.parentTask)
+	assert.Nil(t, rootN.parentSpan)
+
+	child, e2 := WithSpan(root, "child")
+	childN := logAndGetTraceNode(t, "child", child)
+	assert.Equal(t, rootN, childN.parentTask)
+	assert.Equal(t, rootN, childN.parentSpan)
+
+	grandchild, e3 := WithSpan(child, "grandchild")
+	grandchildN := logAndGetTraceNode(t, "grandchild", grandchild)
+	assert.Equal(t, rootN, grandchildN.parentTask)
+	assert.Equal(t, childN, grandchildN.parentSpan)
+
+	gcTask, e4 := WithTask(grandchild, "grandchild-task")
+	gcTaskN := logAndGetTraceNode(t, "grandchild-task", gcTask)
+	assert.Equal(t, rootN, gcTaskN.parentTask)
+	assert.Nil(t, gcTaskN.parentSpan)
+
+	// it is allowed that a child task outlives the _span_ in which it was created
+	// (albeit not its parent task)
+	e3()
+	e2()
+	gcTaskSpan, e5 := WithSpan(gcTask, "granschild-task-span")
+	gcTaskSpanN := logAndGetTraceNode(t, "granschild-task-span", gcTaskSpan)
+	assert.Equal(t, gcTaskN, gcTaskSpanN.parentTask)
+	assert.Equal(t, gcTaskN, gcTaskSpanN.parentSpan)
+	e5()
+
+	e4()
+	e1()
+}
+
+func TestOrphanTasksBecomeNewRootWhenAllAncestorsAreDead(t *testing.T) {
+	parent, e1 := WithTask(context.Background(), "parent")
+	_ = logAndGetTraceNode(t, "parent-task", parent)
+	e1()
+
+	var child context.Context
+	var e2 DoneFunc
+	require.NotPanics(t, func() {
+		child, e2 = WithTask(parent, "child")
+	})
+	childN := logAndGetTraceNode(t, "child-task", child)
+	assert.Nil(t, childN.parentTask)
+
+	grandchild, _ := WithTask(child, "grandchild")
+	grandchildN := logAndGetTraceNode(t, "grandchild-task", grandchild)
+	assert.Equal(t, childN, grandchildN.parentTask)
+
+	require.Panics(t, func() { e2() }, "if the parent was alive at creation of child task, wrong termination order remains a panicable offense though")
+}
+
+func TestOrphanTaskBecomesChildToNearestLiveAncestor(t *testing.T) {
+	parent, e1 := WithTask(context.Background(), "parent")
+	parentN := logAndGetTraceNode(t, "parent-task", parent)
+
+	child, e2 := WithTask(parent, "child")
+	childN := logAndGetTraceNode(t, "child-task", child)
+	assert.Equal(t, parentN, childN.parentTask)
+	e2()
+
+	grandchild, e3 := WithTask(child, "grandchild")
+	grandchildN := logAndGetTraceNode(t, "grandchild-task", grandchild)
+	assert.Equal(t, parentN, grandchildN.parentTask) // child is already dead
+
+	require.NotPanics(t, func() {
+		e3()
+		e1()
+	})
+}

internal/daemon/logging/trace/trace_unique_concurrent_task_namer.go

@@ -0,0 +1,53 @@
+package trace
+
+import (
+	"fmt"
+	"strings"
+	"sync"
+
+	"github.com/bits-and-blooms/bitset"
+)
+
+type uniqueConcurrentTaskNamer struct {
+	mtx    sync.Mutex
+	active map[string]*bitset.BitSet
+}
+
+// bitvecLengthGauge may be nil
+func newUniqueTaskNamer() *uniqueConcurrentTaskNamer {
+	return &uniqueConcurrentTaskNamer{
+		active: make(map[string]*bitset.BitSet),
+	}
+}
+
+// appends `#%d` to `name` such that until `done` is called,
+// it is guaranteed that `#%d` is not returned a second time for the same `name`
+func (namer *uniqueConcurrentTaskNamer) UniqueConcurrentTaskName(name string) (uniqueName string, done func()) {
+	if strings.Contains(name, "#") {
+		panic(name)
+	}
+	namer.mtx.Lock()
+	act, ok := namer.active[name]
+	if !ok {
+		act = bitset.New(64) // FIXME magic const
+		namer.active[name] = act
+	}
+	id, ok := act.NextClear(0)
+	if !ok {
+		// if !ok, all bits are 1 and act.Len() returns the next bit
+		id = act.Len()
+		// FIXME unbounded growth without reclamation
+	}
+	act.Set(id)
+	namer.mtx.Unlock()
+
+	return fmt.Sprintf("%s#%d", name, id), func() {
+		namer.mtx.Lock()
+		defer namer.mtx.Unlock()
+		act, ok := namer.active[name]
+		if !ok {
+			panic("must be initialized upon entry")
+		}
+		act.Clear(id)
+	}
+}

internal/daemon/logging/trace/trace_unique_concurrent_task_namer_test.go

@@ -0,0 +1,58 @@
+package trace
+
+import (
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/bits-and-blooms/bitset"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBitsetFeaturesForUniqueConcurrentTaskNamer(t *testing.T) {
+	var b bitset.BitSet
+	require.Equal(t, uint(0), b.Len())
+	require.Equal(t, uint(0), b.Count())
+
+	b.Set(0)
+	require.Equal(t, uint(1), b.Len())
+	require.Equal(t, uint(1), b.Count())
+
+	b.Set(8)
+	require.Equal(t, uint(9), b.Len())
+	require.Equal(t, uint(2), b.Count())
+
+	b.Set(1)
+	require.Equal(t, uint(9), b.Len())
+	require.Equal(t, uint(3), b.Count())
+}
+
+func TestUniqueConcurrentTaskNamer(t *testing.T) {
+	namer := newUniqueTaskNamer()
+
+	var wg sync.WaitGroup
+
+	const N = 8128
+	const Q = 23
+
+	var fails uint32
+	var m sync.Map
+	wg.Add(N)
+	for i := 0; i < N; i++ {
+		go func(i int) {
+			defer wg.Done()
+			name := fmt.Sprintf("%d", i/Q)
+			uniqueName, done := namer.UniqueConcurrentTaskName(name)
+			act, _ := m.LoadOrStore(uniqueName, i)
+			if act.(int) != i {
+				atomic.AddUint32(&fails, 1)
+			}
+			m.Delete(uniqueName)
+			done()
+		}(i)
+	}
+	wg.Wait()
+
+	require.Equal(t, uint32(0), fails)
+}

internal/daemon/main.go

@@ -0,0 +1,18 @@
+package daemon
+
+import (
+	"context"
+
+	"github.com/zrepl/zrepl/internal/cli"
+	"github.com/zrepl/zrepl/internal/logger"
+)
+
+type Logger = logger.Logger
+
+var DaemonCmd = &cli.Subcommand{
+	Use:   "daemon",
+	Short: "run the zrepl daemon",
+	Run: func(ctx context.Context, subcommand *cli.Subcommand, args []string) error {
+		return Run(ctx, subcommand.Config())
+	},
+}

internal/daemon/nethelpers/helpers.go

@@ -0,0 +1,50 @@
+package nethelpers
+
+import (
+	"net"
+	"os"
+	"path/filepath"
+
+	"github.com/pkg/errors"
+)
+
+func PreparePrivateSockpath(sockpath string) error {
+	sockdir := filepath.Dir(sockpath)
+	sdstat, err := os.Stat(sockdir)
+	if err != nil {
+		return errors.Wrapf(err, "cannot stat(2) '%s'", sockdir)
+	}
+	if !sdstat.IsDir() {
+		return errors.Errorf("not a directory: %s", sockdir)
+	}
+	p := sdstat.Mode().Perm()
+	if p&0007 != 0 {
+		return errors.Errorf("socket directory must not be world-accessible: %s (permissions are %#o)", sockdir, p)
+	}
+
+	// Maybe things have not been cleaned up before
+	s, err := os.Stat(sockpath)
+	if os.IsNotExist(err) {
+		return nil
+	}
+	if err != nil {
+		return errors.Wrapf(err, "cannot stat(2) '%s'", sockpath)
+	}
+	if s.Mode()&os.ModeSocket == 0 {
+		return errors.Errorf("unexpected file type at path '%s'", sockpath)
+	}
+	err = os.Remove(sockpath)
+	if err != nil {
+		return errors.Wrapf(err, "cannot remove presumably stale socket '%s'", sockpath)
+	}
+	return nil
+}
+
+func ListenUnixPrivate(sockaddr *net.UnixAddr) (*net.UnixListener, error) {
+
+	if err := PreparePrivateSockpath(sockaddr.Name); err != nil {
+		return nil, err
+	}
+
+	return net.ListenUnix("unix", sockaddr)
+}

internal/daemon/pprof.go

@@ -0,0 +1,94 @@
+package daemon
+
+import (
+	"net/http"
+	// FIXME: importing this package has the side-effect of poisoning the http.DefaultServeMux
+	// FIXME: with the /debug/pprof endpoints
+	"context"
+	"net"
+	"net/http/pprof"
+
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"golang.org/x/net/websocket"
+
+	"github.com/zrepl/zrepl/internal/daemon/job"
+	"github.com/zrepl/zrepl/internal/daemon/logging/trace"
+)
+
+type pprofServer struct {
+	cc       chan PprofServerControlMsg
+	listener net.Listener
+}
+
+type PprofServerControlMsg struct {
+	// Whether the server should listen for requests on the given address
+	Run bool
+	// Must be set if Run is true, undefined otherwise
+	HttpListenAddress string
+}
+
+func NewPProfServer(ctx context.Context) *pprofServer {
+
+	s := &pprofServer{
+		cc: make(chan PprofServerControlMsg),
+	}
+
+	go s.controlLoop(ctx)
+	return s
+}
+
+func (s *pprofServer) controlLoop(ctx context.Context) {
+outer:
+	for {
+
+		var msg PprofServerControlMsg
+		select {
+		case <-ctx.Done():
+			if s.listener != nil {
+				s.listener.Close()
+			}
+			break outer
+		case msg = <-s.cc:
+			// proceed
+		}
+
+		var err error
+		if msg.Run && s.listener == nil {
+
+			s.listener, err = net.Listen("tcp", msg.HttpListenAddress)
+			if err != nil {
+				s.listener = nil
+				continue
+			}
+
+			// FIXME: because net/http/pprof does not provide a mux,
+			mux := http.NewServeMux()
+			mux.Handle("/debug/pprof/", http.HandlerFunc(pprof.Index))
+			mux.Handle("/debug/pprof/cmdline", http.HandlerFunc(pprof.Cmdline))
+			mux.Handle("/debug/pprof/profile", http.HandlerFunc(pprof.Profile))
+			mux.Handle("/debug/pprof/symbol", http.HandlerFunc(pprof.Symbol))
+			mux.Handle("/debug/pprof/trace", http.HandlerFunc(pprof.Trace))
+			mux.Handle("/metrics", promhttp.Handler())
+			mux.Handle("/debug/zrepl/activity-trace", websocket.Handler(trace.ChrometraceClientWebsocketHandler))
+			go func() {
+				err := http.Serve(s.listener, mux)
+				if ctx.Err() != nil {
+					return
+				} else if err != nil {
+					job.GetLogger(ctx).WithError(err).Error("pprof server serve error")
+				}
+			}()
+			continue
+		}
+
+		if !msg.Run && s.listener != nil {
+			s.listener.Close()
+			s.listener = nil
+			continue
+		}
+	}
+}
+
+func (s *pprofServer) Control(msg PprofServerControlMsg) {
+	s.cc <- msg
+}

internal/daemon/prometheus.go

@@ -0,0 +1,105 @@
+package daemon
+
+import (
+	"context"
+	"net"
+	"net/http"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/job"
+	"github.com/zrepl/zrepl/internal/daemon/logging"
+	"github.com/zrepl/zrepl/internal/endpoint"
+	"github.com/zrepl/zrepl/internal/logger"
+	"github.com/zrepl/zrepl/internal/rpc/dataconn/frameconn"
+	"github.com/zrepl/zrepl/internal/util/tcpsock"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type prometheusJob struct {
+	listen   string
+	freeBind bool
+}
+
+func newPrometheusJobFromConfig(in *config.PrometheusMonitoring) (*prometheusJob, error) {
+	if _, _, err := net.SplitHostPort(in.Listen); err != nil {
+		return nil, err
+	}
+	return &prometheusJob{in.Listen, in.ListenFreeBind}, nil
+}
+
+var prom struct {
+	taskLogEntries *prometheus.CounterVec
+}
+
+func init() {
+	prom.taskLogEntries = prometheus.NewCounterVec(prometheus.CounterOpts{
+		Namespace: "zrepl",
+		Subsystem: "daemon",
+		Name:      "log_entries",
+		Help:      "number of log entries per job task and level",
+	}, []string{"zrepl_job", "level"})
+	prometheus.MustRegister(prom.taskLogEntries)
+}
+
+func (j *prometheusJob) Name() string { return jobNamePrometheus }
+
+func (j *prometheusJob) Status() *job.Status { return &job.Status{Type: job.TypeInternal} }
+
+func (j *prometheusJob) OwnedDatasetSubtreeRoot() (p *zfs.DatasetPath, ok bool) { return nil, false }
+
+func (j *prometheusJob) SenderConfig() *endpoint.SenderConfig { return nil }
+
+func (j *prometheusJob) RegisterMetrics(registerer prometheus.Registerer) {}
+
+func (j *prometheusJob) Run(ctx context.Context) {
+
+	if err := zfs.PrometheusRegister(prometheus.DefaultRegisterer); err != nil {
+		panic(err)
+	}
+
+	if err := frameconn.PrometheusRegister(prometheus.DefaultRegisterer); err != nil {
+		panic(err)
+	}
+
+	log := job.GetLogger(ctx)
+
+	l, err := tcpsock.Listen(j.listen, j.freeBind)
+	if err != nil {
+		log.WithError(err).Error("cannot listen")
+		return
+	}
+	go func() {
+		<-ctx.Done()
+		l.Close()
+	}()
+
+	mux := http.NewServeMux()
+	mux.Handle("/metrics", promhttp.Handler())
+
+	err = http.Serve(l, mux)
+	if err != nil && ctx.Err() == nil {
+		log.WithError(err).Error("error while serving")
+	}
+
+}
+
+type prometheusJobOutlet struct {
+}
+
+var _ logger.Outlet = prometheusJobOutlet{}
+
+func newPrometheusLogOutlet() prometheusJobOutlet {
+	return prometheusJobOutlet{}
+}
+
+func (o prometheusJobOutlet) WriteEntry(entry logger.Entry) error {
+	jobFieldVal, ok := entry.Fields[logging.JobField].(string)
+	if !ok {
+		jobFieldVal = "_nojobid"
+	}
+	prom.taskLogEntries.WithLabelValues(jobFieldVal, entry.Level.String()).Inc()
+	return nil
+}

internal/daemon/pruner/pruner.go

@@ -0,0 +1,594 @@
+package pruner
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/logging"
+	"github.com/zrepl/zrepl/internal/logger"
+	"github.com/zrepl/zrepl/internal/pruning"
+	"github.com/zrepl/zrepl/internal/replication/logic/pdu"
+	"github.com/zrepl/zrepl/internal/util/envconst"
+)
+
+// The sender in the replication setup.
+// The pruner uses the Sender to determine which of the Target's filesystems need to be pruned.
+// Also, it asks the Sender about the replication cursor of each filesystem
+// to enable the 'not_replicated' pruning rule.
+//
+// Try to keep it compatible with github.com/zrepl/zrepl/endpoint.Endpoint
+type Sender interface {
+	ReplicationCursor(ctx context.Context, req *pdu.ReplicationCursorReq) (*pdu.ReplicationCursorRes, error)
+	ListFilesystems(ctx context.Context, req *pdu.ListFilesystemReq) (*pdu.ListFilesystemRes, error)
+}
+
+// The pruning target, i.e., on which snapshots are destroyed.
+// This can be a replication sender or receiver.
+//
+// Try to keep it compatible with github.com/zrepl/zrepl/endpoint.Endpoint
+type Target interface {
+	ListFilesystems(ctx context.Context, req *pdu.ListFilesystemReq) (*pdu.ListFilesystemRes, error)
+	ListFilesystemVersions(ctx context.Context, req *pdu.ListFilesystemVersionsReq) (*pdu.ListFilesystemVersionsRes, error)
+	DestroySnapshots(ctx context.Context, req *pdu.DestroySnapshotsReq) (*pdu.DestroySnapshotsRes, error)
+}
+
+type Logger = logger.Logger
+
+type contextKey int
+
+const (
+	contextKeyPruneSide contextKey = 1 + iota
+)
+
+func GetLogger(ctx context.Context) Logger {
+	pruneSide := ctx.Value(contextKeyPruneSide).(string)
+	return logging.GetLogger(ctx, logging.SubsysPruning).WithField("prune_side", pruneSide)
+}
+
+type args struct {
+	ctx                            context.Context
+	target                         Target
+	sender                         Sender
+	rules                          []pruning.KeepRule
+	retryWait                      time.Duration
+	considerSnapAtCursorReplicated bool
+	promPruneSecs                  prometheus.Observer
+}
+
+type Pruner struct {
+	args args
+
+	mtx sync.RWMutex
+
+	state State
+
+	// State PlanErr
+	err error
+
+	// State Exec
+	execQueue *execQueue
+}
+
+type PrunerFactory struct {
+	senderRules                    []pruning.KeepRule
+	receiverRules                  []pruning.KeepRule
+	retryWait                      time.Duration
+	considerSnapAtCursorReplicated bool
+	promPruneSecs                  *prometheus.HistogramVec
+}
+
+type LocalPrunerFactory struct {
+	keepRules     []pruning.KeepRule
+	retryWait     time.Duration
+	promPruneSecs *prometheus.HistogramVec
+}
+
+func NewLocalPrunerFactory(in config.PruningLocal, promPruneSecs *prometheus.HistogramVec) (*LocalPrunerFactory, error) {
+	rules, err := pruning.RulesFromConfig(in.Keep)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot build pruning rules")
+	}
+	for _, r := range in.Keep {
+		if _, ok := r.Ret.(*config.PruneKeepNotReplicated); ok {
+			// rule NotReplicated  for a local pruner doesn't make sense
+			// because no replication happens with that job type
+			return nil, fmt.Errorf("single-site pruner cannot support `not_replicated` keep rule")
+		}
+	}
+	f := &LocalPrunerFactory{
+		keepRules:     rules,
+		retryWait:     envconst.Duration("ZREPL_PRUNER_RETRY_INTERVAL", 10*time.Second),
+		promPruneSecs: promPruneSecs,
+	}
+	return f, nil
+}
+
+func NewPrunerFactory(in config.PruningSenderReceiver, promPruneSecs *prometheus.HistogramVec) (*PrunerFactory, error) {
+	keepRulesReceiver, err := pruning.RulesFromConfig(in.KeepReceiver)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot build receiver pruning rules")
+	}
+
+	keepRulesSender, err := pruning.RulesFromConfig(in.KeepSender)
+	if err != nil {
+		return nil, errors.Wrap(err, "cannot build sender pruning rules")
+	}
+
+	considerSnapAtCursorReplicated := false
+	for _, r := range in.KeepSender {
+		knr, ok := r.Ret.(*config.PruneKeepNotReplicated)
+		if !ok {
+			continue
+		}
+		considerSnapAtCursorReplicated = considerSnapAtCursorReplicated || !knr.KeepSnapshotAtCursor
+	}
+	f := &PrunerFactory{
+		senderRules:                    keepRulesSender,
+		receiverRules:                  keepRulesReceiver,
+		retryWait:                      envconst.Duration("ZREPL_PRUNER_RETRY_INTERVAL", 10*time.Second),
+		considerSnapAtCursorReplicated: considerSnapAtCursorReplicated,
+		promPruneSecs:                  promPruneSecs,
+	}
+	return f, nil
+}
+
+func (f *PrunerFactory) BuildSenderPruner(ctx context.Context, target Target, sender Sender) *Pruner {
+	p := &Pruner{
+		args: args{
+			context.WithValue(ctx, contextKeyPruneSide, "sender"),
+			target,
+			sender,
+			f.senderRules,
+			f.retryWait,
+			f.considerSnapAtCursorReplicated,
+			f.promPruneSecs.WithLabelValues("sender"),
+		},
+		state: Plan,
+	}
+	return p
+}
+
+func (f *PrunerFactory) BuildReceiverPruner(ctx context.Context, target Target, sender Sender) *Pruner {
+	p := &Pruner{
+		args: args{
+			context.WithValue(ctx, contextKeyPruneSide, "receiver"),
+			target,
+			sender,
+			f.receiverRules,
+			f.retryWait,
+			false, // senseless here anyways
+			f.promPruneSecs.WithLabelValues("receiver"),
+		},
+		state: Plan,
+	}
+	return p
+}
+
+func (f *LocalPrunerFactory) BuildLocalPruner(ctx context.Context, target Target, history Sender) *Pruner {
+	p := &Pruner{
+		args: args{
+			context.WithValue(ctx, contextKeyPruneSide, "local"),
+			target,
+			history,
+			f.keepRules,
+			f.retryWait,
+			false, // considerSnapAtCursorReplicated is not relevant for local pruning
+			f.promPruneSecs.WithLabelValues("local"),
+		},
+		state: Plan,
+	}
+	return p
+}
+
+//go:generate enumer -type=State
+type State int
+
+const (
+	Plan State = 1 << iota
+	PlanErr
+	Exec
+	ExecErr
+	Done
+)
+
+// Returns true in case the State is a terminal state(PlanErr, ExecErr, Done)
+func (s State) IsTerminal() bool {
+	switch s {
+	case PlanErr, ExecErr, Done:
+		return true
+	default:
+		return false
+	}
+}
+
+type updater func(func(*Pruner))
+
+func (p *Pruner) Prune() {
+	p.prune(p.args)
+}
+
+func (p *Pruner) prune(args args) {
+	u := func(f func(*Pruner)) {
+		p.mtx.Lock()
+		defer p.mtx.Unlock()
+		f(p)
+	}
+	// TODO support automatic retries
+	// It is advisable to merge this code with package replication/driver before
+	// That will likely require re-modelling struct fs like replication/driver.attempt,
+	// including figuring out how to resume a plan after being interrupted by network errors
+	// The non-retrying code in this package should move straight to replication/logic.
+	doOneAttempt(&args, u)
+}
+
+type Report struct {
+	State              string
+	Error              string
+	Pending, Completed []FSReport
+}
+
+type FSReport struct {
+	Filesystem                string
+	SnapshotList, DestroyList []SnapshotReport
+	SkipReason                FSSkipReason
+	LastError                 string
+}
+
+type SnapshotReport struct {
+	Name       string
+	Replicated bool
+	Date       time.Time
+}
+
+func (p *Pruner) Report() *Report {
+	p.mtx.Lock()
+	defer p.mtx.Unlock()
+
+	r := Report{State: p.state.String()}
+
+	if p.err != nil {
+		r.Error = p.err.Error()
+	}
+
+	if p.execQueue != nil {
+		r.Pending, r.Completed = p.execQueue.Report()
+	}
+
+	return &r
+}
+
+func (p *Pruner) State() State {
+	p.mtx.Lock()
+	defer p.mtx.Unlock()
+	return p.state
+}
+
+type fs struct {
+	path string
+
+	// permanent error during planning
+	planErr        error
+	planErrContext string
+
+	// if != "", the fs was skipped for planning and the field
+	// contains the reason
+	skipReason FSSkipReason
+
+	// snapshots presented by target
+	// (type snapshot)
+	snaps []pruning.Snapshot
+	// destroy list returned by pruning.PruneSnapshots(snaps)
+	// (type snapshot)
+	destroyList []pruning.Snapshot
+
+	mtx sync.RWMutex
+
+	// only during Exec state, also used by execQueue
+	execErrLast error
+}
+
+type FSSkipReason string
+
+const (
+	NotSkipped                   = ""
+	SkipPlaceholder              = "filesystem is placeholder"
+	SkipNoCorrespondenceOnSender = "filesystem has no correspondence on sender"
+)
+
+func (r FSSkipReason) NotSkipped() bool {
+	return r == NotSkipped
+}
+
+func (f *fs) Report() FSReport {
+	f.mtx.Lock()
+	defer f.mtx.Unlock()
+
+	r := FSReport{}
+	r.Filesystem = f.path
+	r.SkipReason = f.skipReason
+	if !r.SkipReason.NotSkipped() {
+		return r
+	}
+
+	if f.planErr != nil {
+		r.LastError = f.planErr.Error()
+	} else if f.execErrLast != nil {
+		r.LastError = f.execErrLast.Error()
+	}
+
+	r.SnapshotList = make([]SnapshotReport, len(f.snaps))
+	for i, snap := range f.snaps {
+		r.SnapshotList[i] = snap.(snapshot).Report()
+	}
+
+	r.DestroyList = make([]SnapshotReport, len(f.destroyList))
+	for i, snap := range f.destroyList {
+		r.DestroyList[i] = snap.(snapshot).Report()
+	}
+
+	return r
+}
+
+type snapshot struct {
+	replicated bool
+	date       time.Time
+	fsv        *pdu.FilesystemVersion
+}
+
+func (s snapshot) Report() SnapshotReport {
+	return SnapshotReport{
+		Name:       s.Name(),
+		Replicated: s.Replicated(),
+		Date:       s.Date(),
+	}
+}
+
+var _ pruning.Snapshot = snapshot{}
+
+func (s snapshot) Name() string { return s.fsv.Name }
+
+func (s snapshot) Replicated() bool { return s.replicated }
+
+func (s snapshot) Date() time.Time { return s.date }
+
+func doOneAttempt(a *args, u updater) {
+
+	ctx, target, sender := a.ctx, a.target, a.sender
+
+	sfssres, err := sender.ListFilesystems(ctx, &pdu.ListFilesystemReq{})
+	if err != nil {
+		u(func(p *Pruner) {
+			p.state = PlanErr
+			p.err = err
+		})
+		return
+	}
+	sfss := make(map[string]*pdu.Filesystem)
+	for _, sfs := range sfssres.GetFilesystems() {
+		sfss[sfs.GetPath()] = sfs
+	}
+
+	tfssres, err := target.ListFilesystems(ctx, &pdu.ListFilesystemReq{})
+	if err != nil {
+		u(func(p *Pruner) {
+			p.state = PlanErr
+			p.err = err
+		})
+		return
+	}
+	tfss := tfssres.GetFilesystems()
+
+	pfss := make([]*fs, len(tfss))
+tfss_loop:
+	for i, tfs := range tfss {
+
+		l := GetLogger(ctx).WithField("fs", tfs.Path)
+		l.Debug("plan filesystem")
+
+		pfs := &fs{
+			path: tfs.Path,
+		}
+		pfss[i] = pfs
+
+		if tfs.GetIsPlaceholder() {
+			pfs.skipReason = SkipPlaceholder
+			l.WithField("skip_reason", pfs.skipReason).Debug("skipping filesystem")
+			continue
+		} else if sfs := sfss[tfs.GetPath()]; sfs == nil {
+			pfs.skipReason = SkipNoCorrespondenceOnSender
+			l.WithField("skip_reason", pfs.skipReason).WithField("sfs", sfs.GetPath()).Debug("skipping filesystem")
+			continue
+		}
+
+		pfsPlanErrAndLog := func(err error, message string) {
+			t := fmt.Sprintf("%T", err)
+			pfs.planErr = err
+			pfs.planErrContext = message
+			l.WithField("orig_err_type", t).WithError(err).Error(fmt.Sprintf("%s: plan error, skipping filesystem", message))
+		}
+
+		tfsvsres, err := target.ListFilesystemVersions(ctx, &pdu.ListFilesystemVersionsReq{Filesystem: tfs.Path})
+		if err != nil {
+			pfsPlanErrAndLog(err, "cannot list filesystem versions")
+			continue tfss_loop
+		}
+		tfsvs := tfsvsres.GetVersions()
+		// no progress here since we could run in a live-lock (must have used target AND receiver before progress)
+
+		pfs.snaps = make([]pruning.Snapshot, 0, len(tfsvs))
+
+		rcReq := &pdu.ReplicationCursorReq{
+			Filesystem: tfs.Path,
+		}
+		rc, err := sender.ReplicationCursor(ctx, rcReq)
+		if err != nil {
+			pfsPlanErrAndLog(err, "cannot get replication cursor bookmark")
+			continue tfss_loop
+		}
+		if rc.GetNotexist() {
+			err := errors.New("replication cursor bookmark does not exist (one successful replication is required before pruning works)")
+			pfsPlanErrAndLog(err, "")
+			continue tfss_loop
+		}
+
+		// scan from older to newer, all snapshots older than cursor are interpreted as replicated
+		sort.Slice(tfsvs, func(i, j int) bool {
+			return tfsvs[i].CreateTXG < tfsvs[j].CreateTXG
+		})
+
+		haveCursorSnapshot := false
+		for _, tfsv := range tfsvs {
+			if tfsv.Type != pdu.FilesystemVersion_Snapshot {
+				continue
+			}
+			if tfsv.Guid == rc.GetGuid() {
+				haveCursorSnapshot = true
+			}
+		}
+		preCursor := haveCursorSnapshot
+		for _, tfsv := range tfsvs {
+			if tfsv.Type != pdu.FilesystemVersion_Snapshot {
+				continue
+			}
+			creation, err := tfsv.CreationAsTime()
+			if err != nil {
+				err := fmt.Errorf("%s: %s", tfsv.RelName(), err)
+				pfsPlanErrAndLog(err, "fs version with invalid creation date")
+				continue tfss_loop
+			}
+			// note that we cannot use CreateTXG because target and receiver could be on different pools
+			atCursor := tfsv.Guid == rc.GetGuid()
+			preCursor = preCursor && !atCursor
+			pfs.snaps = append(pfs.snaps, snapshot{
+				replicated: preCursor || (a.considerSnapAtCursorReplicated && atCursor),
+				date:       creation,
+				fsv:        tfsv,
+			})
+		}
+		if preCursor {
+			pfsPlanErrAndLog(fmt.Errorf("prune target has no snapshot that corresponds to sender replication cursor bookmark"), "")
+			continue tfss_loop
+		}
+
+		// Apply prune rules
+		pfs.destroyList = pruning.PruneSnapshots(pfs.snaps, a.rules)
+	}
+
+	u(func(pruner *Pruner) {
+		pruner.execQueue = newExecQueue(len(pfss))
+		for _, pfs := range pfss {
+			pruner.execQueue.Put(pfs, nil, false)
+		}
+		pruner.state = Exec
+	})
+
+	for {
+		var pfs *fs
+		u(func(pruner *Pruner) {
+			pfs = pruner.execQueue.Pop()
+		})
+		if pfs == nil {
+			break
+		}
+		doOneAttemptExec(a, u, pfs)
+	}
+
+	var rep *Report
+	{
+		// must not hold lock for report
+		var pruner *Pruner
+		u(func(p *Pruner) {
+			pruner = p
+		})
+		rep = pruner.Report()
+	}
+	u(func(p *Pruner) {
+		if len(rep.Pending) > 0 {
+			panic("queue should not have pending items at this point")
+		}
+		hadErr := false
+		for _, fsr := range rep.Completed {
+			hadErr = hadErr || fsr.SkipReason.NotSkipped() && fsr.LastError != ""
+		}
+		if hadErr {
+			p.state = ExecErr
+		} else {
+			p.state = Done
+		}
+	})
+
+}
+
+// attempts to exec pfs, puts it back into the queue with the result
+func doOneAttemptExec(a *args, u updater, pfs *fs) {
+
+	destroyList := make([]*pdu.FilesystemVersion, len(pfs.destroyList))
+	for i := range destroyList {
+		destroyList[i] = pfs.destroyList[i].(snapshot).fsv
+		GetLogger(a.ctx).
+			WithField("fs", pfs.path).
+			WithField("destroy_snap", destroyList[i].Name).
+			Debug("policy destroys snapshot")
+	}
+	req := pdu.DestroySnapshotsReq{
+		Filesystem: pfs.path,
+		Snapshots:  destroyList,
+	}
+	GetLogger(a.ctx).WithField("fs", pfs.path).Debug("destroying snapshots")
+	res, err := a.target.DestroySnapshots(a.ctx, &req)
+	if err != nil {
+		u(func(pruner *Pruner) {
+			pruner.execQueue.Put(pfs, err, false)
+		})
+		return
+	}
+	// check if all snapshots were destroyed
+	destroyResults := make(map[string]*pdu.DestroySnapshotRes)
+	for _, fsres := range res.Results {
+		destroyResults[fsres.Snapshot.Name] = fsres
+	}
+	err = nil
+	destroyFails := make([]*pdu.DestroySnapshotRes, 0)
+	for _, reqDestroy := range destroyList {
+		res, ok := destroyResults[reqDestroy.Name]
+		if !ok {
+			err = fmt.Errorf("missing destroy-result for %s", reqDestroy.RelName())
+			break
+		} else if res.Error != "" {
+			destroyFails = append(destroyFails, res)
+		}
+	}
+	if err == nil && len(destroyFails) > 0 {
+		names := make([]string, len(destroyFails))
+		pairs := make([]string, len(destroyFails))
+		allSame := true
+		lastMsg := destroyFails[0].Error
+		for i := 0; i < len(destroyFails); i++ {
+			allSame = allSame && destroyFails[i].Error == lastMsg
+			relname := destroyFails[i].Snapshot.RelName()
+			names[i] = relname
+			pairs[i] = fmt.Sprintf("(%s: %s)", relname, destroyFails[i].Error)
+		}
+		if allSame {
+			err = fmt.Errorf("destroys failed %s: %s",
+				strings.Join(names, ", "), lastMsg)
+		} else {
+			err = fmt.Errorf("destroys failed: %s", strings.Join(pairs, ", "))
+		}
+	}
+	u(func(pruner *Pruner) {
+		pruner.execQueue.Put(pfs, err, err == nil)
+	})
+	if err != nil {
+		GetLogger(a.ctx).WithError(err).Error("target could not destroy snapshots")
+		return
+	}
+}

internal/daemon/pruner/pruner_queue.go

@@ -0,0 +1,82 @@
+package pruner
+
+import (
+	"sort"
+	"strings"
+	"sync"
+)
+
+type execQueue struct {
+	mtx                sync.Mutex
+	pending, completed []*fs
+}
+
+func newExecQueue(cap int) *execQueue {
+	q := execQueue{
+		pending:   make([]*fs, 0, cap),
+		completed: make([]*fs, 0, cap),
+	}
+	return &q
+}
+
+func (q *execQueue) Report() (pending, completed []FSReport) {
+	q.mtx.Lock()
+	defer q.mtx.Unlock()
+
+	pending = make([]FSReport, len(q.pending))
+	for i, fs := range q.pending {
+		pending[i] = fs.Report()
+	}
+	completed = make([]FSReport, len(q.completed))
+	for i, fs := range q.completed {
+		completed[i] = fs.Report()
+	}
+
+	return pending, completed
+}
+
+func (q *execQueue) HasCompletedFSWithErrors() bool {
+	q.mtx.Lock()
+	defer q.mtx.Unlock()
+	for _, fs := range q.completed {
+		if fs.execErrLast != nil {
+			return true
+		}
+	}
+	return false
+}
+
+func (q *execQueue) Pop() *fs {
+	if len(q.pending) == 0 {
+		return nil
+	}
+	fs := q.pending[0]
+	q.pending = q.pending[1:]
+	return fs
+}
+
+func (q *execQueue) Put(fs *fs, err error, done bool) {
+	fs.mtx.Lock()
+	fs.execErrLast = err
+	if done || err != nil {
+		fs.mtx.Unlock()
+		q.mtx.Lock()
+		q.completed = append(q.completed, fs)
+		q.mtx.Unlock()
+		return
+	}
+	fs.mtx.Unlock()
+
+	q.mtx.Lock()
+	// inefficient priority q
+	q.pending = append(q.pending, fs)
+	sort.SliceStable(q.pending, func(i, j int) bool {
+		q.pending[i].mtx.Lock()
+		defer q.pending[i].mtx.Unlock()
+		q.pending[j].mtx.Lock()
+		defer q.pending[j].mtx.Unlock()
+		return strings.Compare(q.pending[i].path, q.pending[j].path) == -1
+	})
+	q.mtx.Unlock()
+
+}

internal/daemon/pruner/state_enumer.go

@@ -0,0 +1,71 @@
+// Code generated by "enumer -type=State"; DO NOT EDIT.
+
+package pruner
+
+import (
+	"fmt"
+)
+
+const (
+	_StateName_0 = "PlanPlanErr"
+	_StateName_1 = "Exec"
+	_StateName_2 = "ExecErr"
+	_StateName_3 = "Done"
+)
+
+var (
+	_StateIndex_0 = [...]uint8{0, 4, 11}
+	_StateIndex_1 = [...]uint8{0, 4}
+	_StateIndex_2 = [...]uint8{0, 7}
+	_StateIndex_3 = [...]uint8{0, 4}
+)
+
+func (i State) String() string {
+	switch {
+	case 1 <= i && i <= 2:
+		i -= 1
+		return _StateName_0[_StateIndex_0[i]:_StateIndex_0[i+1]]
+	case i == 4:
+		return _StateName_1
+	case i == 8:
+		return _StateName_2
+	case i == 16:
+		return _StateName_3
+	default:
+		return fmt.Sprintf("State(%d)", i)
+	}
+}
+
+var _StateValues = []State{1, 2, 4, 8, 16}
+
+var _StateNameToValueMap = map[string]State{
+	_StateName_0[0:4]:  1,
+	_StateName_0[4:11]: 2,
+	_StateName_1[0:4]:  4,
+	_StateName_2[0:7]:  8,
+	_StateName_3[0:4]:  16,
+}
+
+// StateString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func StateString(s string) (State, error) {
+	if val, ok := _StateNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to State values", s)
+}
+
+// StateValues returns all values of the enum
+func StateValues() []State {
+	return _StateValues
+}
+
+// IsAState returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i State) IsAState() bool {
+	for _, v := range _StateValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}

internal/daemon/snapper/cron.go

@@ -0,0 +1,158 @@
+package snapper
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/hooks"
+	"github.com/zrepl/zrepl/internal/daemon/snapper/snapname"
+	"github.com/zrepl/zrepl/internal/util/suspendresumesafetimer"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+func cronFromConfig(fsf zfs.DatasetFilter, in config.SnapshottingCron) (*Cron, error) {
+
+	hooksList, err := hooks.ListFromConfig(&in.Hooks)
+	if err != nil {
+		return nil, errors.Wrap(err, "hook config error")
+	}
+
+	formatter, err := snapname.New(in.Prefix, in.TimestampFormat, in.TimestampLocation)
+	if err != nil {
+		return nil, errors.Wrap(err, "build snapshot name formatter")
+	}
+
+	planArgs := planArgs{
+		formatter: formatter,
+		hooks:     hooksList,
+	}
+	return &Cron{config: in, fsf: fsf, planArgs: planArgs}, nil
+}
+
+type Cron struct {
+	config   config.SnapshottingCron
+	fsf      zfs.DatasetFilter
+	planArgs planArgs
+
+	mtx sync.RWMutex
+
+	running                 bool
+	wakeupTime              time.Time // zero value means uninit
+	lastError               error
+	lastPlan                *plan
+	wakeupWhileRunningCount int
+}
+
+func (s *Cron) Run(ctx context.Context, snapshotsTaken chan<- struct{}) {
+
+	for {
+		now := time.Now()
+		s.mtx.Lock()
+		s.wakeupTime = s.config.Cron.Schedule.Next(now)
+		s.mtx.Unlock()
+
+		ctxDone := suspendresumesafetimer.SleepUntil(ctx, s.wakeupTime)
+		if ctxDone != nil {
+			return
+		}
+
+		getLogger(ctx).Debug("cron timer fired")
+		s.mtx.Lock()
+		if s.running {
+			getLogger(ctx).Warn("snapshotting triggered according to cron rules but previous snapshotting is not done; not taking a snapshot this time")
+			s.wakeupWhileRunningCount++
+			s.mtx.Unlock()
+			continue
+		}
+		s.lastError = nil
+		s.lastPlan = nil
+		s.wakeupWhileRunningCount = 0
+		s.running = true
+		s.mtx.Unlock()
+		go func() {
+			err := s.do(ctx)
+			s.mtx.Lock()
+			s.lastError = err
+			s.running = false
+			s.mtx.Unlock()
+
+			select {
+			case snapshotsTaken <- struct{}{}:
+			default:
+				if snapshotsTaken != nil {
+					getLogger(ctx).Warn("callback channel is full, discarding snapshot update event")
+				}
+			}
+		}()
+	}
+
+}
+
+func (s *Cron) do(ctx context.Context) error {
+	fss, err := zfs.ZFSListMapping(ctx, s.fsf)
+	if err != nil {
+		return errors.Wrap(err, "cannot list filesystems")
+	}
+	p := makePlan(s.planArgs, fss)
+
+	s.mtx.Lock()
+	s.lastPlan = p
+	s.lastError = nil
+	s.mtx.Unlock()
+
+	ok := p.execute(ctx, false)
+	if !ok {
+		return errors.New("one or more snapshots could not be created, check logs for details")
+	} else {
+		return nil
+	}
+}
+
+type CronState string
+
+const (
+	CronStateRunning CronState = "running"
+	CronStateWaiting CronState = "waiting"
+)
+
+type CronReport struct {
+	State      CronState
+	WakeupTime time.Time
+	Errors     []string
+	Progress   []*ReportFilesystem
+}
+
+func (s *Cron) Report() Report {
+
+	s.mtx.Lock()
+	defer s.mtx.Unlock()
+
+	r := CronReport{}
+
+	r.WakeupTime = s.wakeupTime
+
+	if s.running {
+		r.State = CronStateRunning
+	} else {
+		r.State = CronStateWaiting
+	}
+
+	if s.lastError != nil {
+		r.Errors = append(r.Errors, s.lastError.Error())
+	}
+	if s.wakeupWhileRunningCount > 0 {
+		r.Errors = append(r.Errors, fmt.Sprintf("cron frequency is too high; snapshots were not taken %d times", s.wakeupWhileRunningCount))
+	}
+
+	r.Progress = nil
+	if s.lastPlan != nil {
+		r.Progress = s.lastPlan.report()
+	}
+
+	return Report{Type: TypeCron, Cron: &r}
+}

internal/daemon/snapper/cron_test.go

@@ -0,0 +1,68 @@
+package snapper
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/zrepl/yaml-config"
+
+	"github.com/zrepl/zrepl/internal/config"
+)
+
+func TestCronLibraryWorks(t *testing.T) {
+
+	type testCase struct {
+		spec   string
+		in     time.Time
+		expect time.Time
+	}
+	dhm := func(day, hour, minutes int) time.Time {
+		return time.Date(2022, 7, day, hour, minutes, 0, 0, time.UTC)
+	}
+	hm := func(hour, minutes int) time.Time {
+		return dhm(23, hour, minutes)
+	}
+
+	tcs := []testCase{
+		{"0-10 * * * *", dhm(17, 1, 10), dhm(17, 2, 0)},
+		{"0-10 * * * *", dhm(17, 23, 10), dhm(18, 0, 0)},
+		{"0-10 * * * *", hm(1, 9), hm(1, 10)},
+		{"0-10 * * * *", hm(1, 9), hm(1, 10)},
+
+		{"1,3,5 * * * *", hm(1, 1), hm(1, 3)},
+		{"1,3,5 * * * *", hm(1, 2), hm(1, 3)},
+		{"1,3,5 * * * *", hm(1, 3), hm(1, 5)},
+		{"1,3,5 * * * *", hm(1, 5), hm(2, 1)},
+
+		{"* 0-5,8,12 * * *", hm(0, 0), hm(0, 1)},
+		{"* 0-5,8,12 * * *", hm(4, 59), hm(5, 0)},
+		{"* 0-5,8,12 * * *", hm(5, 0), hm(5, 1)},
+		{"* 0-5,8,12 * * *", hm(5, 59), hm(8, 0)},
+		{"* 0-5,8,12 * * *", hm(8, 59), hm(12, 0)},
+
+		// https://github.com/zrepl/zrepl/pull/614#issuecomment-1188358989
+		{"53 17,18,19 * * *", dhm(23, 17, 52), dhm(23, 17, 53)},
+		{"53 17,18,19 * * *", dhm(23, 17, 53), dhm(23, 18, 53)},
+		{"53 17,18,19 * * *", dhm(23, 18, 53), dhm(23, 19, 53)},
+		{"53 17,18,19 * * *", dhm(23, 19, 53), dhm(24 /* ! */, 17, 53)},
+	}
+
+	for i, tc := range tcs {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			var s struct {
+				Cron config.CronSpec `yaml:"cron"`
+			}
+			inp := fmt.Sprintf("cron: %q", tc.spec)
+			fmt.Println("spec is ", inp)
+			err := yaml.UnmarshalStrict([]byte(inp), &s)
+			require.NoError(t, err)
+
+			actual := s.Cron.Schedule.Next(tc.in)
+			assert.Equal(t, tc.expect, actual)
+		})
+	}
+
+}

internal/daemon/snapper/impl.go

@@ -0,0 +1,251 @@
+package snapper
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/zrepl/zrepl/internal/daemon/hooks"
+	"github.com/zrepl/zrepl/internal/daemon/logging"
+	"github.com/zrepl/zrepl/internal/daemon/snapper/snapname"
+	"github.com/zrepl/zrepl/internal/util/chainlock"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type planArgs struct {
+	formatter *snapname.Formatter
+	hooks     *hooks.List
+}
+
+type plan struct {
+	mtx   chainlock.L
+	args  planArgs
+	snaps map[*zfs.DatasetPath]*snapProgress
+}
+
+func makePlan(args planArgs, fss []*zfs.DatasetPath) *plan {
+	snaps := make(map[*zfs.DatasetPath]*snapProgress, len(fss))
+	for _, fs := range fss {
+		snaps[fs] = &snapProgress{state: SnapPending}
+	}
+	return &plan{snaps: snaps, args: args}
+}
+
+//go:generate stringer -type=SnapState
+type SnapState uint
+
+const (
+	SnapPending SnapState = 1 << iota
+	SnapStarted
+	SnapDone
+	SnapError
+)
+
+// All fields protected by Snapper.mtx
+type snapProgress struct {
+	state SnapState
+
+	// SnapStarted, SnapDone, SnapError
+	name     string
+	startAt  time.Time
+	hookPlan *hooks.Plan
+
+	// SnapDone
+	doneAt time.Time
+
+	// SnapErr TODO disambiguate state
+	runResults hooks.PlanReport
+}
+
+func (plan *plan) execute(ctx context.Context, dryRun bool) (ok bool) {
+
+	hookMatchCount := make(map[hooks.Hook]int, len(*plan.args.hooks))
+	for _, h := range *plan.args.hooks {
+		hookMatchCount[h] = 0
+	}
+
+	anyFsHadErr := false
+	// TODO channel programs -> allow a little jitter?
+	for fs, progress := range plan.snaps {
+		snapname := plan.args.formatter.Format(time.Now())
+
+		ctx := logging.WithInjectedField(ctx, "fs", fs.ToString())
+		ctx = logging.WithInjectedField(ctx, "snap", snapname)
+
+		hookEnvExtra := hooks.Env{
+			hooks.EnvFS:       fs.ToString(),
+			hooks.EnvSnapshot: snapname,
+		}
+
+		jobCallback := hooks.NewCallbackHookForFilesystem("snapshot", fs, func(ctx context.Context) (err error) {
+			l := getLogger(ctx)
+			l.Debug("create snapshot")
+			err = zfs.ZFSSnapshot(ctx, fs, snapname, false) // TODO propagate context to ZFSSnapshot
+			if err != nil {
+				l.WithError(err).Error("cannot create snapshot")
+			}
+			return
+		})
+
+		fsHadErr := false
+		var hookPlanReport hooks.PlanReport
+		var hookPlan *hooks.Plan
+		{
+			filteredHooks, err := plan.args.hooks.CopyFilteredForFilesystem(fs)
+			if err != nil {
+				getLogger(ctx).WithError(err).Error("unexpected filter error")
+				fsHadErr = true
+				goto updateFSState
+			}
+			// account for running hooks
+			for _, h := range filteredHooks {
+				hookMatchCount[h] = hookMatchCount[h] + 1
+			}
+
+			var planErr error
+			hookPlan, planErr = hooks.NewPlan(&filteredHooks, hooks.PhaseSnapshot, jobCallback, hookEnvExtra)
+			if planErr != nil {
+				fsHadErr = true
+				getLogger(ctx).WithError(planErr).Error("cannot create job hook plan")
+				goto updateFSState
+			}
+		}
+
+		plan.mtx.HoldWhile(func() {
+			progress.name = snapname
+			progress.startAt = time.Now()
+			progress.hookPlan = hookPlan
+			progress.state = SnapStarted
+		})
+
+		{
+			getLogger(ctx).WithField("report", hookPlan.Report().String()).Debug("begin run job plan")
+			hookPlan.Run(ctx, dryRun)
+			hookPlanReport = hookPlan.Report()
+			fsHadErr = hookPlanReport.HadError() // not just fatal errors
+			if fsHadErr {
+				getLogger(ctx).WithField("report", hookPlanReport.String()).Error("end run job plan with error")
+			} else {
+				getLogger(ctx).WithField("report", hookPlanReport.String()).Info("end run job plan successful")
+			}
+		}
+
+	updateFSState:
+		anyFsHadErr = anyFsHadErr || fsHadErr
+		plan.mtx.HoldWhile(func() {
+			progress.doneAt = time.Now()
+			progress.state = SnapDone
+			if fsHadErr {
+				progress.state = SnapError
+			}
+			progress.runResults = hookPlanReport
+		})
+	}
+
+	for h, mc := range hookMatchCount {
+		if mc == 0 {
+			hookIdx := -1
+			for idx, ah := range *plan.args.hooks {
+				if ah == h {
+					hookIdx = idx
+					break
+				}
+			}
+			getLogger(ctx).WithField("hook", h.String()).WithField("hook_number", hookIdx+1).Warn("hook did not match any snapshotted filesystems")
+		}
+	}
+
+	return !anyFsHadErr
+}
+
+type ReportFilesystem struct {
+	Path  string
+	State SnapState
+
+	// Valid in SnapStarted and later
+	SnapName      string
+	StartAt       time.Time
+	Hooks         string
+	HooksHadError bool
+
+	// Valid in SnapDone | SnapError
+	DoneAt time.Time
+}
+
+func (plan *plan) report() []*ReportFilesystem {
+	plan.mtx.Lock()
+	defer plan.mtx.Unlock()
+
+	pReps := make([]*ReportFilesystem, 0, len(plan.snaps))
+	for fs, p := range plan.snaps {
+		var hooksStr string
+		var hooksHadError bool
+		if p.hookPlan != nil {
+			hooksStr, hooksHadError = p.report()
+		}
+		pReps = append(pReps, &ReportFilesystem{
+			Path:          fs.ToString(),
+			State:         p.state,
+			SnapName:      p.name,
+			StartAt:       p.startAt,
+			DoneAt:        p.doneAt,
+			Hooks:         hooksStr,
+			HooksHadError: hooksHadError,
+		})
+	}
+
+	sort.Slice(pReps, func(i, j int) bool {
+		return strings.Compare(pReps[i].Path, pReps[j].Path) == -1
+	})
+
+	return pReps
+}
+
+func (p *snapProgress) report() (hooksStr string, hooksHadError bool) {
+	hr := p.hookPlan.Report()
+	// FIXME: technically this belongs into client
+	// but we can't serialize hooks.Step ATM
+	rightPad := func(str string, length int, pad string) string {
+		if len(str) > length {
+			return str[:length]
+		}
+		return str + strings.Repeat(pad, length-len(str))
+	}
+	hooksHadError = hr.HadError()
+	rows := make([][]string, len(hr))
+	const numCols = 4
+	lens := make([]int, numCols)
+	for i, e := range hr {
+		rows[i] = make([]string, numCols)
+		rows[i][0] = fmt.Sprintf("%d", i+1)
+		rows[i][1] = e.Status.String()
+		runTime := "..."
+		if e.Status != hooks.StepPending {
+			runTime = e.End.Sub(e.Begin).Round(time.Millisecond).String()
+		}
+		rows[i][2] = runTime
+		rows[i][3] = ""
+		if e.Report != nil {
+			rows[i][3] = e.Report.String()
+		}
+		for j, col := range lens {
+			if len(rows[i][j]) > col {
+				lens[j] = len(rows[i][j])
+			}
+		}
+	}
+	rowsFlat := make([]string, len(hr))
+	for i, r := range rows {
+		colsPadded := make([]string, len(r))
+		for j, c := range r[:len(r)-1] {
+			colsPadded[j] = rightPad(c, lens[j], " ")
+		}
+		colsPadded[len(r)-1] = r[len(r)-1]
+		rowsFlat[i] = strings.Join(colsPadded, " ")
+	}
+	hooksStr = strings.Join(rowsFlat, "\n")
+
+	return hooksStr, hooksHadError
+}

internal/daemon/snapper/manual.go

@@ -0,0 +1,15 @@
+package snapper
+
+import (
+	"context"
+)
+
+type manual struct{}
+
+func (s *manual) Run(ctx context.Context, wakeUpCommon chan<- struct{}) {
+	// nothing to do
+}
+
+func (s *manual) Report() Report {
+	return Report{Type: TypeManual, Manual: &struct{}{}}
+}

internal/daemon/snapper/periodic.go

@@ -0,0 +1,399 @@
+package snapper
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"sync"
+	"time"
+
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/daemon/logging/trace"
+	"github.com/zrepl/zrepl/internal/daemon/snapper/snapname"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/daemon/hooks"
+	"github.com/zrepl/zrepl/internal/daemon/logging"
+	"github.com/zrepl/zrepl/internal/util/envconst"
+	"github.com/zrepl/zrepl/internal/util/suspendresumesafetimer"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+func periodicFromConfig(g *config.Global, fsf zfs.DatasetFilter, in *config.SnapshottingPeriodic) (*Periodic, error) {
+	if in.Prefix == "" {
+		return nil, errors.New("prefix must not be empty")
+	}
+	if in.Interval.Duration() <= 0 {
+		return nil, errors.New("interval must be positive")
+	}
+
+	hookList, err := hooks.ListFromConfig(&in.Hooks)
+	if err != nil {
+		return nil, errors.Wrap(err, "hook config error")
+	}
+
+	formatter, err := snapname.New(in.Prefix, in.TimestampFormat, in.TimestampLocation)
+	if err != nil {
+		return nil, errors.Wrap(err, "build snapshot name formatter")
+	}
+
+	args := periodicArgs{
+		interval: in.Interval.Duration(),
+		fsf:      fsf,
+		planArgs: planArgs{
+			formatter: formatter,
+			hooks:     hookList,
+		},
+		// ctx and log is set in Run()
+	}
+
+	return &Periodic{state: SyncUp, args: args}, nil
+}
+
+type periodicArgs struct {
+	ctx            context.Context
+	interval       time.Duration
+	fsf            zfs.DatasetFilter
+	planArgs       planArgs
+	snapshotsTaken chan<- struct{}
+	dryRun         bool
+}
+
+type Periodic struct {
+	args periodicArgs
+
+	mtx   sync.Mutex
+	state State
+
+	// set in state Plan, used in Waiting
+	lastInvocation time.Time
+
+	// valid for state Snapshotting
+	plan *plan
+
+	// valid for state SyncUp and Waiting
+	sleepUntil time.Time
+
+	// valid for state Err
+	err error
+}
+
+//go:generate stringer -type=State
+type State uint
+
+const (
+	SyncUp State = 1 << iota
+	SyncUpErrWait
+	Planning
+	Snapshotting
+	Waiting
+	ErrorWait
+	Stopped
+)
+
+func (s State) sf() state {
+	m := map[State]state{
+		SyncUp:        periodicStateSyncUp,
+		SyncUpErrWait: periodicStateWait,
+		Planning:      periodicStatePlan,
+		Snapshotting:  periodicStateSnapshot,
+		Waiting:       periodicStateWait,
+		ErrorWait:     periodicStateWait,
+		Stopped:       nil,
+	}
+	return m[s]
+}
+
+type updater func(u func(*Periodic)) State
+type state func(a periodicArgs, u updater) state
+
+func (s *Periodic) Run(ctx context.Context, snapshotsTaken chan<- struct{}) {
+	defer trace.WithSpanFromStackUpdateCtx(&ctx)()
+	getLogger(ctx).Debug("start")
+	defer getLogger(ctx).Debug("stop")
+
+	s.args.snapshotsTaken = snapshotsTaken
+	s.args.ctx = ctx
+	s.args.dryRun = false // for future expansion
+
+	u := func(u func(*Periodic)) State {
+		s.mtx.Lock()
+		defer s.mtx.Unlock()
+		if u != nil {
+			u(s)
+		}
+		return s.state
+	}
+
+	var st state = periodicStateSyncUp
+
+	for st != nil {
+		pre := u(nil)
+		st = st(s.args, u)
+		post := u(nil)
+		getLogger(ctx).
+			WithField("transition", fmt.Sprintf("%s=>%s", pre, post)).
+			Debug("state transition")
+
+	}
+
+}
+
+func onErr(err error, u updater) state {
+	return u(func(s *Periodic) {
+		s.err = err
+		preState := s.state
+		switch s.state {
+		case SyncUp:
+			s.state = SyncUpErrWait
+		case Planning:
+			fallthrough
+		case Snapshotting:
+			s.state = ErrorWait
+		}
+		getLogger(s.args.ctx).WithError(err).WithField("pre_state", preState).WithField("post_state", s.state).Error("snapshotting error")
+	}).sf()
+}
+
+func onMainCtxDone(ctx context.Context, u updater) state {
+	return u(func(s *Periodic) {
+		s.err = ctx.Err()
+		s.state = Stopped
+	}).sf()
+}
+
+func periodicStateSyncUp(a periodicArgs, u updater) state {
+	u(func(snapper *Periodic) {
+		snapper.lastInvocation = time.Now()
+	})
+	fss, err := listFSes(a.ctx, a.fsf)
+	if err != nil {
+		return onErr(err, u)
+	}
+	syncPoint, err := findSyncPoint(a.ctx, fss, a.planArgs.formatter.Prefix(), a.interval)
+	if err != nil {
+		return onErr(err, u)
+	}
+	u(func(s *Periodic) {
+		s.sleepUntil = syncPoint
+	})
+	ctxDone := suspendresumesafetimer.SleepUntil(a.ctx, syncPoint)
+	if ctxDone != nil {
+		return onMainCtxDone(a.ctx, u)
+	}
+	return u(func(s *Periodic) {
+		s.state = Planning
+	}).sf()
+}
+
+func periodicStatePlan(a periodicArgs, u updater) state {
+	u(func(snapper *Periodic) {
+		snapper.lastInvocation = time.Now()
+	})
+	fss, err := listFSes(a.ctx, a.fsf)
+	if err != nil {
+		return onErr(err, u)
+	}
+	p := makePlan(a.planArgs, fss)
+	return u(func(s *Periodic) {
+		s.state = Snapshotting
+		s.plan = p
+		s.err = nil
+	}).sf()
+}
+
+func periodicStateSnapshot(a periodicArgs, u updater) state {
+
+	var plan *plan
+	u(func(snapper *Periodic) {
+		plan = snapper.plan
+	})
+
+	ok := plan.execute(a.ctx, false)
+
+	select {
+	case a.snapshotsTaken <- struct{}{}:
+	default:
+		if a.snapshotsTaken != nil {
+			getLogger(a.ctx).Warn("callback channel is full, discarding snapshot update event")
+		}
+	}
+
+	return u(func(snapper *Periodic) {
+		if !ok {
+			snapper.state = ErrorWait
+			snapper.err = errors.New("one or more snapshots could not be created, check logs for details")
+		} else {
+			snapper.state = Waiting
+			snapper.err = nil
+		}
+	}).sf()
+}
+
+func periodicStateWait(a periodicArgs, u updater) state {
+	var sleepUntil time.Time
+	u(func(snapper *Periodic) {
+		lastTick := snapper.lastInvocation
+		snapper.sleepUntil = lastTick.Add(a.interval)
+		sleepUntil = snapper.sleepUntil
+		log := getLogger(a.ctx).WithField("sleep_until", sleepUntil).WithField("duration", a.interval)
+		logFunc := log.Debug
+		if snapper.state == ErrorWait || snapper.state == SyncUpErrWait {
+			logFunc = log.Error
+		}
+		logFunc("enter wait-state after error")
+	})
+
+	ctxDone := suspendresumesafetimer.SleepUntil(a.ctx, sleepUntil)
+	if ctxDone != nil {
+		return onMainCtxDone(a.ctx, u)
+	}
+	return u(func(snapper *Periodic) {
+		snapper.state = Planning
+	}).sf()
+}
+
+func listFSes(ctx context.Context, mf zfs.DatasetFilter) (fss []*zfs.DatasetPath, err error) {
+	return zfs.ZFSListMapping(ctx, mf)
+}
+
+var syncUpWarnNoSnapshotUntilSyncupMinDuration = envconst.Duration("ZREPL_SNAPPER_SYNCUP_WARN_MIN_DURATION", 1*time.Second)
+
+// see docs/snapshotting.rst
+func findSyncPoint(ctx context.Context, fss []*zfs.DatasetPath, prefix string, interval time.Duration) (syncPoint time.Time, err error) {
+
+	const (
+		prioHasVersions int = iota
+		prioNoVersions
+	)
+
+	type snapTime struct {
+		ds   *zfs.DatasetPath
+		prio int // lower is higher
+		time time.Time
+	}
+
+	if len(fss) == 0 {
+		return time.Now(), nil
+	}
+
+	snaptimes := make([]snapTime, 0, len(fss))
+	hardErrs := 0
+
+	now := time.Now()
+
+	getLogger(ctx).Debug("examine filesystem state to find sync point")
+	for _, d := range fss {
+		ctx := logging.WithInjectedField(ctx, "fs", d.ToString())
+		syncPoint, err := findSyncPointFSNextOptimalSnapshotTime(ctx, now, interval, prefix, d)
+		if err == findSyncPointFSNoFilesystemVersionsErr {
+			snaptimes = append(snaptimes, snapTime{
+				ds:   d,
+				prio: prioNoVersions,
+				time: now,
+			})
+		} else if err != nil {
+			hardErrs++
+			getLogger(ctx).WithError(err).Error("cannot determine optimal sync point for this filesystem")
+		} else {
+			getLogger(ctx).WithField("syncPoint", syncPoint).Debug("found optimal sync point for this filesystem")
+			snaptimes = append(snaptimes, snapTime{
+				ds:   d,
+				prio: prioHasVersions,
+				time: syncPoint,
+			})
+		}
+	}
+
+	if hardErrs == len(fss) {
+		return time.Time{}, fmt.Errorf("hard errors in determining sync point for every matching filesystem")
+	}
+
+	if len(snaptimes) == 0 {
+		panic("implementation error: loop must either inc hardErrs or add result to snaptimes")
+	}
+
+	// sort ascending by (prio,time)
+	// => those filesystems with versions win over those without any
+	sort.Slice(snaptimes, func(i, j int) bool {
+		if snaptimes[i].prio == snaptimes[j].prio {
+			return snaptimes[i].time.Before(snaptimes[j].time)
+		}
+		return snaptimes[i].prio < snaptimes[j].prio
+	})
+
+	winnerSyncPoint := snaptimes[0].time
+	l := getLogger(ctx).WithField("syncPoint", winnerSyncPoint.String())
+	l.Info("determined sync point")
+	if winnerSyncPoint.Sub(now) > syncUpWarnNoSnapshotUntilSyncupMinDuration {
+		for _, st := range snaptimes {
+			if st.prio == prioNoVersions {
+				l.WithField("fs", st.ds.ToString()).Warn("filesystem will not be snapshotted until sync point")
+			}
+		}
+	}
+
+	return snaptimes[0].time, nil
+
+}
+
+var findSyncPointFSNoFilesystemVersionsErr = fmt.Errorf("no filesystem versions")
+
+func findSyncPointFSNextOptimalSnapshotTime(ctx context.Context, now time.Time, interval time.Duration, prefix string, d *zfs.DatasetPath) (time.Time, error) {
+
+	fsvs, err := zfs.ZFSListFilesystemVersions(ctx, d, zfs.ListFilesystemVersionsOptions{
+		Types:           zfs.Snapshots,
+		ShortnamePrefix: prefix,
+	})
+	if err != nil {
+		return time.Time{}, errors.Wrap(err, "list filesystem versions")
+	}
+	if len(fsvs) <= 0 {
+		return time.Time{}, findSyncPointFSNoFilesystemVersionsErr
+	}
+
+	// Sort versions by creation
+	sort.SliceStable(fsvs, func(i, j int) bool {
+		return fsvs[i].CreateTXG < fsvs[j].CreateTXG
+	})
+
+	latest := fsvs[len(fsvs)-1]
+	getLogger(ctx).WithField("creation", latest.Creation).Debug("found latest snapshot")
+
+	since := now.Sub(latest.Creation)
+	if since < 0 {
+		return time.Time{}, fmt.Errorf("snapshot %q is from the future: creation=%q now=%q", latest.ToAbsPath(d), latest.Creation, now)
+	}
+
+	return latest.Creation.Add(interval), nil
+}
+
+type PeriodicReport struct {
+	State State
+	// valid in state SyncUp and Waiting
+	SleepUntil time.Time
+	// valid in state Err
+	Error string
+	// valid in state Snapshotting
+	Progress []*ReportFilesystem
+}
+
+func (s *Periodic) Report() Report {
+	s.mtx.Lock()
+	defer s.mtx.Unlock()
+
+	var progress []*ReportFilesystem = nil
+	if s.plan != nil {
+		progress = s.plan.report()
+	}
+
+	r := &PeriodicReport{
+		State:      s.state,
+		SleepUntil: s.sleepUntil,
+		Error:      errOrEmptyString(s.err),
+		Progress:   progress,
+	}
+
+	return Report{Type: TypePeriodic, Periodic: r}
+}

internal/daemon/snapper/snapname/snapname.go

@@ -0,0 +1,52 @@
+package snapname
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/pkg/errors"
+
+	"github.com/zrepl/zrepl/internal/daemon/snapper/snapname/timestamp"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type Formatter struct {
+	prefix    string
+	timestamp *timestamp.Formatter
+}
+
+func New(prefix, tsFormat, tsLocation string) (*Formatter, error) {
+	timestamp, err := timestamp.New(tsFormat, tsLocation)
+	if err != nil {
+		return nil, errors.Wrap(err, "build timestamp formatter")
+	}
+	formatter := &Formatter{
+		prefix:    prefix,
+		timestamp: timestamp,
+	}
+	// Best-effort check to detect whether the result would be an invalid name.
+	// Test two dates that in most places have will have different time zone offsets due to DST.
+	check := func(t time.Time) error {
+		testFormat := formatter.Format(t)
+		if err := zfs.ComponentNamecheck(testFormat); err != nil {
+			// testFormat last, can be quite long
+			return fmt.Errorf("`invalid snapshot name would result from `prefix+$timestamp`: %s: %q", err, testFormat)
+		}
+		return nil
+	}
+	if err := check(time.Date(2020, 6, 1, 0, 0, 0, 0, time.UTC)); err != nil {
+		return nil, err
+	}
+	if err := check(time.Date(2020, 12, 1, 0, 0, 0, 0, time.UTC)); err != nil {
+		return nil, err
+	}
+	return formatter, nil
+}
+
+func (f *Formatter) Format(now time.Time) string {
+	return f.prefix + f.timestamp.Format(now)
+}
+
+func (f *Formatter) Prefix() string {
+	return f.prefix
+}

internal/daemon/snapper/snapname/timestamp/timestamp.go

@@ -0,0 +1,93 @@
+package timestamp
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+)
+
+type Formatter struct {
+	format   func(time.Time) string
+	location *time.Location
+}
+
+func New(formatString string, locationString string) (*Formatter, error) {
+	location, err := time.LoadLocation(locationString) // no shadow
+	if err != nil {
+		return nil, errors.Wrapf(err, "load location from string %q", locationString)
+	}
+	makeFormatFunc := func(formatString string) (func(time.Time) string, error) {
+		// NB: we use zfs.EntityNamecheck in higher-level code to filter out all invalid characters.
+		// This check here is specifically so that we know for sure that the `+`=>`_` replacement
+		// that we do in the returned func replaces exactly the timezone offset `+` and not some other `+`.
+		if strings.Contains(formatString, "+") {
+			return nil, fmt.Errorf("character '+' is not allowed in ZFS snapshot names and has special handling")
+		}
+		return func(t time.Time) string {
+			res := t.Format(formatString)
+			// if the formatString contains a time zone specifier
+			// and the location would result in a positive offset to UTC
+			// then the result of t.Format would contain a '+' sign.
+			if isLocationPositiveOffsetToUTC(location) {
+				// the only source of `+` can be the positive time zone offset because we disallowed `+` as a character in the format string
+				res = strings.Replace(res, "+", "_", 1)
+			}
+			if strings.Contains(res, "+") {
+				panic(fmt.Sprintf("format produced a string containing illegal character '+' that wasn't the expected case of positive time zone offset: format=%q location=%q unix=%q result=%q", formatString, location, t.Unix(), res))
+			}
+			return res
+		}, nil
+	}
+	var formatFunc func(time.Time) string
+	mustUseUtcError := func() error {
+		return fmt.Errorf("format string requires UTC location")
+	}
+	switch strings.ToLower(formatString) {
+	case "dense":
+		if location != time.UTC {
+			err = mustUseUtcError()
+		} else {
+			formatFunc, err = makeFormatFunc("20060102_150405_000")
+		}
+	case "human":
+		if location != time.UTC {
+			err = mustUseUtcError()
+		} else {
+			formatFunc, err = makeFormatFunc("2006-01-02_15:04:05")
+		}
+	case "iso-8601":
+		formatFunc, err = makeFormatFunc("2006-01-02T15:04:05.000Z0700")
+	case "unix-seconds":
+		if location != time.UTC {
+			// Technically not required because unix time is by definition in UTC
+			// but let's make that clear to confused users...
+			err = mustUseUtcError()
+		} else {
+			formatFunc = func(t time.Time) string {
+				return strconv.FormatInt(t.Unix(), 10)
+			}
+		}
+	default:
+		formatFunc, err = makeFormatFunc(formatString)
+	}
+	if err != nil {
+		return nil, errors.Wrapf(err, "invalid format string %q or location %q", formatString, locationString)
+	}
+	return &Formatter{
+		format:   formatFunc,
+		location: location,
+	}, nil
+}
+
+func isLocationPositiveOffsetToUTC(location *time.Location) bool {
+	_, offsetSeconds := time.Now().In(location).Zone()
+	return offsetSeconds > 0
+}
+
+func (f *Formatter) Format(t time.Time) string {
+	t = t.In(f.location)
+	return f.format(t)
+}

internal/daemon/snapper/snapname/timestamp/timestamp_test.go

@@ -0,0 +1,84 @@
+package timestamp
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var utc, _ = time.LoadLocation("UTC")
+var berlin, _ = time.LoadLocation("Europe/Berlin")
+var nyc, _ = time.LoadLocation("America/New_York")
+
+func TestAssumptionsAboutTimePackage(t *testing.T) {
+	now := time.Now()
+	assert.Equal(t, now.In(utc).Unix(), now.In(berlin).Unix(), "unix timestamp is always in UTC")
+}
+
+func TestLegacyIso8601Format(t *testing.T) {
+	// Before we allowed users to specify the location of the time to be formatted,
+	// we always used UTC.
+	// At the time, the `iso-8601` format used the following format string
+	// "2006-01-02T15:04:05.000Z"
+	// That format string's `Z` was never identified by the Go time package as a time zone specifier.
+	// The correct way would have been
+	// "2006-01-02T15:04:05.000Z07"
+	// "2006-01-02T15:04:05.000Z0700"
+	// "2006-01-02T15:04:05.000Z070000"
+	// or any variation of how the minute / second offsets are displayed.
+	// However, because of the forced location UTC, it didn't matter, because both format strings
+	// evaluate to the same time string.
+	//
+	// This test is here to ensure that the legacy behavior is preserved for users who don't specify a non-UTC location
+	// (UTC location is the default location at this time)
+
+	oldFormatString := "2006-01-02T15:04:05.000Z"
+	now := time.Now()
+	oldOutput := now.In(utc).Format(oldFormatString)
+
+	currentImpl, err := New("iso-8601", "UTC")
+	require.NoError(t, err)
+	currentOutput := currentImpl.Format(now)
+
+	assert.Equal(t, oldOutput, currentOutput, "legacy behavior of iso-8601 format is preserved")
+}
+
+func TestIso8601PrintsTimeZoneOffset(t *testing.T) {
+	f, err := New("iso-8601", "Europe/Berlin")
+	require.NoError(t, err)
+	out := f.Format(time.Date(2024, 5, 14, 21, 16, 23, 0, time.UTC))
+	require.Equal(t, "2024-05-14T23:16:23.000_0200", out, "time zone offset is printed")
+}
+
+func TestBuiltinFormatsErrorOnNonUtcLocation(t *testing.T) {
+	var err error
+
+	expectMsg := `^.*: format string requires UTC location$`
+
+	_, err = New("dense", "Europe/Berlin")
+	require.Regexp(t, expectMsg, err)
+
+	_, err = New("human", "Europe/Berlin")
+	require.Regexp(t, expectMsg, err)
+
+	_, err = New("unix-seconds", "Europe/Berlin")
+	require.Regexp(t, expectMsg, err)
+
+	_, err = New("iso-8601", "Europe/Berlin")
+	require.NoError(t, err, "iso-8601 prints time zone, so non-UTC locations are allowed, see test TestIso8601PrintsTimeZoneOffset")
+}
+
+func TestPositiveUtcOffsetDetection(t *testing.T) {
+	assert.True(t, isLocationPositiveOffsetToUTC(berlin), "Berlin is UTC+1/UTC+2")
+	assert.False(t, isLocationPositiveOffsetToUTC(utc), "UTC is UTC+0")
+	assert.False(t, isLocationPositiveOffsetToUTC(nyc), "New York is UTC-5/UTC-4")
+}
+
+func TestFormatCanReplacePlusWithUnderscore(t *testing.T) {
+	f, err := New("2006-01-02_15:04:05-07:00:00", "Europe/Berlin")
+	require.NoError(t, err)
+	out := f.Format(time.Date(2024, 5, 14, 21, 16, 23, 0, time.UTC))
+	require.Equal(t, "2024-05-14_23:16:23_02:00:00", out, "+ is replaced with _ so we can use the string in ZFS snapshots")
+}

internal/daemon/snapper/snapper.go

@@ -0,0 +1,42 @@
+package snapper
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/zrepl/zrepl/internal/config"
+	"github.com/zrepl/zrepl/internal/zfs"
+)
+
+type Type string
+
+const (
+	TypePeriodic Type = "periodic"
+	TypeCron     Type = "cron"
+	TypeManual   Type = "manual"
+)
+
+type Snapper interface {
+	Run(ctx context.Context, snapshotsTaken chan<- struct{})
+	Report() Report
+}
+
+type Report struct {
+	Type     Type
+	Periodic *PeriodicReport
+	Cron     *CronReport
+	Manual   *struct{}
+}
+
+func FromConfig(g *config.Global, fsf zfs.DatasetFilter, in config.SnapshottingEnum) (Snapper, error) {
+	switch v := in.Ret.(type) {
+	case *config.SnapshottingPeriodic:
+		return periodicFromConfig(g, fsf, v)
+	case *config.SnapshottingCron:
+		return cronFromConfig(fsf, *v)
+	case *config.SnapshottingManual:
+		return &manual{}, nil
+	default:
+		return nil, fmt.Errorf("unknown snapshotting type %T", v)
+	}
+}

internal/daemon/snapper/snapstate_string.go

@@ -0,0 +1,39 @@
+// Code generated by "stringer -type=SnapState"; DO NOT EDIT.
+
+package snapper
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[SnapPending-1]
+	_ = x[SnapStarted-2]
+	_ = x[SnapDone-4]
+	_ = x[SnapError-8]
+}
+
+const (
+	_SnapState_name_0 = "SnapPendingSnapStarted"
+	_SnapState_name_1 = "SnapDone"
+	_SnapState_name_2 = "SnapError"
+)
+
+var (
+	_SnapState_index_0 = [...]uint8{0, 11, 22}
+)
+
+func (i SnapState) String() string {
+	switch {
+	case 1 <= i && i <= 2:
+		i -= 1
+		return _SnapState_name_0[_SnapState_index_0[i]:_SnapState_index_0[i+1]]
+	case i == 4:
+		return _SnapState_name_1
+	case i == 8:
+		return _SnapState_name_2
+	default:
+		return "SnapState(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+}

internal/daemon/snapper/state_string.go

@@ -0,0 +1,51 @@
+// Code generated by "stringer -type=State"; DO NOT EDIT.
+
+package snapper
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[SyncUp-1]
+	_ = x[SyncUpErrWait-2]
+	_ = x[Planning-4]
+	_ = x[Snapshotting-8]
+	_ = x[Waiting-16]
+	_ = x[ErrorWait-32]
+	_ = x[Stopped-64]
+}
+
+const (
+	_State_name_0 = "SyncUpSyncUpErrWait"
+	_State_name_1 = "Planning"
+	_State_name_2 = "Snapshotting"
+	_State_name_3 = "Waiting"
+	_State_name_4 = "ErrorWait"
+	_State_name_5 = "Stopped"
+)
+
+var (
+	_State_index_0 = [...]uint8{0, 6, 19}
+)
+
+func (i State) String() string {
+	switch {
+	case 1 <= i && i <= 2:
+		i -= 1
+		return _State_name_0[_State_index_0[i]:_State_index_0[i+1]]
+	case i == 4:
+		return _State_name_1
+	case i == 8:
+		return _State_name_2
+	case i == 16:
+		return _State_name_3
+	case i == 32:
+		return _State_name_4
+	case i == 64:
+		return _State_name_5
+	default:
+		return "State(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+}

internal/daemon/snapper/util.go

@@ -0,0 +1,21 @@
+package snapper
+
+import (
+	"context"
+
+	"github.com/zrepl/zrepl/internal/daemon/logging"
+	"github.com/zrepl/zrepl/internal/logger"
+)
+
+type Logger = logger.Logger
+
+func getLogger(ctx context.Context) Logger {
+	return logging.GetLogger(ctx, logging.SubsysSnapshot)
+}
+
+func errOrEmptyString(e error) string {
+	if e != nil {
+		return e.Error()
+	}
+	return ""
+}