95 lines
4.8 KiB
Markdown
95 lines
4.8 KiB
Markdown
|
# RTO / RPO Matrix
|
|||
|
|
|
|||
|
|
**Updated:** 2026-07-07
|
|||
|
|
**Owner:** Bernd
|
|||
|
|
**Scope:** Backup lanes — initial seed (DISCTL-WP-0003-T03)
|
|||
|
|
**Related:** `AssetRegister.yaml` · `BackupPolicy.md` · `DataRegister.yaml`
|
|||
|
|
|
|||
|
|
Recovery Time Objective (RTO): maximum acceptable downtime.
|
|||
|
|
Recovery Point Objective (RPO): maximum acceptable data loss (time since last good backup).
|
|||
|
|
|
|||
|
|
**Status legend:**
|
|||
|
|
|
|||
|
|
| Status | Meaning |
|
|||
|
|
| --- | --- |
|
|||
|
|
| `adopted` | Operator-confirmed target; policy applies |
|
|||
|
|
| `draft` | Proposed from assessment; pending operator confirmation |
|
|||
|
|
| `degraded` | Target adopted but current posture cannot meet it |
|
|||
|
|
|
|||
|
|
Global baseline (from `specs/ResilienceControlSetup.md` §3): **RPO ≤ 24h everywhere**;
|
|||
|
|
**RTO ≤ 1 day** for full recovery; **RTO ≤ 4–8h** for code/content/control plane.
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Backup lane targets
|
|||
|
|
|
|||
|
|
| System | Register ID | RPO target | RTO target | Status | Evidence basis | Current posture |
|
|||
|
|
| --- | --- | --- | --- | --- | --- | --- |
|
|||
|
|
| Forgejo git + packages | `backup-forgejo-production` | 24h | 4h | **adopted** | Decision #7 (2026-07-09); T09 drill | **degraded** — manual dump only; automation not wired |
|
|||
|
|
| `forgejo-db` CNPG | `backup-forgejo-production` | 24h (Phase 1 logical dump) | 4h | **adopted** | Decision #7 (2026-07-09) | **degraded** — no scheduled pg_dump |
|
|||
|
|
| Gitea (canonical until cutover) | `backup-gitea-canonical` | 24h | 4–8h | draft | Assessment §suggested targets | **degraded** — no automated backup |
|
|||
|
|
| k3s cluster state (S2) | `backup-s2-k8s-runtime` | 24h | 4–8h | draft | `railiance-backup-s2` local retention | Manual backup; on-node only |
|
|||
|
|
| S1 OS config | `backup-s1-os-config` | 24h | 4–8h | draft | Manual `make backup`; no schedule | Manual backup; on-node only |
|
|||
|
|
| Dev workstation custodian DB | `backup-dev-workstation` | 24h | 4h | draft | Daily cron 02:00; preflight gate | Operational — meets target if cron healthy |
|
|||
|
|
| Dev workstation operator config | `backup-dev-workstation` | 24h | 4h | draft | Daily cron 02:00; preflight gate | Operational — meets target if cron healthy |
|
|||
|
|
| S3 platform PostgreSQL | `backup-s3-platform` | 24h | 4h | **adopted** | Decision #7 (extends platform lane) | **degraded** — tool missing |
|
|||
|
|
| `apps-pg` CNPG | `backup-apps-pg` | 24h | 4–8h | draft | `railiance-platform/docs/apps-pg.md` | **degraded** — no ScheduledBackup CR |
|
|||
|
|
| Adjacent SSO/MFA stack | `backup-adjacent-sso` | 24h | 4–8h | draft | Daily CronJobs on railiance01 | Operational — scheduled daily |
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Measured results (restore drills)
|
|||
|
|
|
|||
|
|
| Date | System | RPO achieved | RTO achieved | Result | Evidence |
|
|||
|
|
| --- | --- | --- | --- | --- | --- |
|
|||
|
|
| 2026-07-04 | Forgejo (isolated restore) | Point-in-time of manual `forgejo dump` | ~3–5 min (isolated namespace) | success | `TestEvidence/restore-drill-2026-07-04-forgejo.md` |
|
|||
|
|
|
|||
|
|
No other systems have measured drill results yet. Next drills should produce
|
|||
|
|
dated files under `TestEvidence/` (DISCTL-WP-0003-T05).
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Adopted vs operational gap
|
|||
|
|
|
|||
|
|
Systems marked **adopted** with **degraded** posture are policy violations until
|
|||
|
|
the promotion gate in `BackupPolicy.md` §7 is met:
|
|||
|
|
|
|||
|
|
1. Automated daily backups succeed for 7 consecutive days.
|
|||
|
|
2. One restore drill uses a Nextcloud artifact (not workstation `/tmp`).
|
|||
|
|
|
|||
|
|
| System | Adopted RPO/RTO | Blocker to operational |
|
|||
|
|
| --- | --- | --- |
|
|||
|
|
| Forgejo git + packages | 24h / 4h | No scheduled `forgejo dump` CronJob |
|
|||
|
|
| `forgejo-db` CNPG | 24h / 4h | No daily pg_dump automation |
|
|||
|
|
| S3 platform PostgreSQL | 24h / 4h | `railiance-backup` tool absent from platform |
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Draft targets pending operator confirmation
|
|||
|
|
|
|||
|
|
The following rows use assessment-suggested values. Confirm or adjust:
|
|||
|
|
|
|||
|
|
| System | Proposed RPO | Proposed RTO | Question for operator |
|
|||
|
|
| --- | --- | --- | --- |
|
|||
|
|
| Gitea canonical | 24h | 4–8h | Accept 24h RPO until cutover, or require mirror + hourly? |
|
|||
|
|
| k3s cluster state (S2) | 24h | 4–8h | Accept manual-only S2 backup, or require daily cron + offsite? |
|
|||
|
|
| S1 OS config | 24h | 4–8h | Accept manual-only, or require scheduled + offsite? |
|
|||
|
|
| Dev workstation | 24h | 4h | Confirm daily cron meets RPO; any need for sub-daily? |
|
|||
|
|
| `apps-pg` | 24h | 4–8h | Confirm before app production-trust gates |
|
|||
|
|
| Adjacent SSO | 24h | 4–8h | Confirm daily CronJob retention and restore path |
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Cross-references
|
|||
|
|
|
|||
|
|
| Artifact | Link |
|
|||
|
|
| --- | --- |
|
|||
|
|
| Stream inventory | `AssetRegister.yaml` → `backup_streams` |
|
|||
|
|
| Data classes | `DataRegister.yaml` → `data_classes` |
|
|||
|
|
| Backup mechanisms | `BackupPolicy.md` §6–§7 |
|
|||
|
|
| Forgejo adoption | `the-custodian/docs/forgejo-production-decisions.md` |
|
|||
|
|
| Gap assessment | `history/2026-07-04-forgejo-backup-strategy-assessment.md` |
|
|||
|
|
|
|||
|
|
**Follow-up:** `ResiliencePolicy.md` (operating principle, drill cadence) remains
|
|||
|
|
in `DISCTL-WP-0002-T03`. Broader non-backup systems (Bubble, Stripe, DNS) will
|
|||
|
|
be added when `DISCTL-WP-0002-T02` expands the registers.
|