coulomb/disaster-control
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DISCTL-WP-0004: adopt the NetKingdom identity backup lane
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Register backup-netkingdom-identity (LLDAP, privacyIDEA DB/token
material/audit, KeyCape client registry archive) as a T0 backup stream:
daily 03:45 UTC age-encrypted upload to one off-host provider (Storage
Share), hourly on-host health check with a 25h freshness bound, RPO 24h.
Activation evidence net-kingdom NK-WP-0049-T14 (2026-10-16).

Record accepted residual risks G1 (single off-host provider) and G2
(on-host-only freshness detection, watchdog owed by
RAPP-TELEMETRY-WP-0001-T04) until 2027-01-31, and the quarterly
isolated identity restore drill (net-kingdom NK-WP-0053, first due by
2027-01-31) in BackupPolicy, RTO-RPO matrix and TestEvidence cadence.

Requested by net-kingdom (hub message ef2bf2a9); founder decision
e4c288d9 resolved 2026-10-23.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
This commit is contained in:
tegwick 2026-10-23 06:56:59 +02:00
parent 9f437a5a06
commit 9ca741908e
6 changed files with 210 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

13
BackupPolicy.md
View file

@ -1,7 +1,7 @@
# Backup Policy
**Status:** adopted (initial)
**Updated:** 2026-07-07
**Updated:** 2026-10-23
**Owner:** Bernd
**Scope:** Coulomb Social / Helix Forge — Railiance backup lanes
**Register:** `AssetRegister.yaml` (stream inventory) · `DataRegister.yaml` (data classes)
@ -47,6 +47,7 @@ Target model (per `specs/ResilienceControlSetup.md` §4):
| S3 platform | — | — | — | Tool missing |
| Forgejo production | ✗ (prod + drill /tmp only) | partial | intended | Automation not wired |
| Gitea canonical | ✗ | ✗ | ✗ | Manual pre-cutover only |
| NetKingdom identity | ✓ (prod + on-host + Storage Share) | ✓ (disk + cloud) | ✓ (single provider) | Operational since 2026-10-16 (NK-WP-0049-T14); single off-host provider accepted until 2027-01-31 (G1) |
---
@ -133,10 +134,11 @@ Canonical inventory: `AssetRegister.yaml`. Summary:
| `backup-s3-platform` | `railiance-backup` | TBD | Nextcloud (intended) | **missing** |
| `backup-forgejo-production` | `forgejo dump` + `pg_dump` | Daily (intended) | Nextcloud (adopted) | **not_wired** |
| `backup-gitea-canonical` | `gitea dump` / mirror | Pre-cutover manual | None automated | **at_risk** |
| `backup-netkingdom-identity` | net-kingdom identity profile (LLDAP, privacyIDEA DB/token material/audit, KeyCape client registry archive) | Daily 03:45 UTC (+≤5 min jitter) | Storage Share (single off-host provider), age | operational |
**Related streams** (tracked, not yet full policy coverage):
- `backup-adjacent-sso` — daily CronJobs (`privacyidea-backup`, `authelia-backup`, `lldap-backup`) on railiance01
- `backup-adjacent-sso` — daily CronJobs (`privacyidea-backup`, `authelia-backup`, `lldap-backup`) on railiance01; LLDAP and privacyIDEA are governed as `backup-netkingdom-identity` since 2026-10-23 (DISCTL-WP-0004)
- `backup-apps-pg` — CNPG `apps-pg`; no ScheduledBackup CR
**Not in git backups:** Git repos are protected by push-to-Gitea remotes. Preflight
@ -221,6 +223,8 @@ that host. Mitigation: wire offsite upload for S1/S2 (tracked in pickup queue).
| M-4 | Preflight gate | Before infra change | `bin/railiance preflight` exits 0 | Bernd |
| M-5 | Restore drill | Quarterly per T1 stream | Dated evidence in `TestEvidence/` | Bernd |
| M-6 | Register review | Monthly | `AssetRegister.yaml` statuses updated; gaps unchanged or closed | Bernd |
| M-7 | NetKingdom identity lane freshness | Hourly (on-host) | Latest identity backup < 25h old; on-host only until outside-node watchdog (RAPP-TELEMETRY-WP-0001-T04) lands (G2) | net-kingdom |
| M-8 | NetKingdom identity restore drill | Quarterly; first by 2027-01-31 | Isolated restore per `net-kingdom/docs/identity-restore-drill.md` (NK-WP-0053); evidence under `net-kingdom/docs/evidence/<date>-identity-restore-drill/`, linked from `TestEvidence/` | net-kingdom |
### Preflight gate (mandatory before infrastructure work)
@ -269,6 +273,8 @@ RPO measured, issues, follow-up actions.
| `apps-pg` no ScheduledBackup | App data unprotected | CNPG ScheduledBackup CR | `railiance-platform` |
| No immutable weekly offline copy | R3 residual risk | Add offline/append-only copy (Phase 2) | TBD |
| Cold decrypt not evidenced | R5 residual risk | Quarterly cold decrypt drill (M-3 extended) | `disaster-control` |
| Identity lane single off-host provider (G1) | Identity backups lost if Storage Share fails or is compromised | **Accepted until 2027-01-31** (decision e4c288d9); review in DISCTL-WP-0004-T04 | `railiance-platform` / `net-kingdom` |
| Identity lane on-host-only freshness detection (G2) | Silent backup failure if railiance01 itself is down | **Accepted until 2027-01-31**; outside-node watchdog owed by RAPP-TELEMETRY-WP-0001-T04 | `rapp-telemetry` |
Track closure in `BackupPickupQueue.md` (DISCTL-WP-0003-T04).
@ -283,4 +289,5 @@ Track closure in `BackupPickupQueue.md` (DISCTL-WP-0003-T04).
- `history/2026-07-04-initial-risk-analysis.md` — R3, R9 risk context
- `railiance-cluster/docs/backup-restore.md` — dev lane operational procedures
- `the-custodian/docs/forgejo-production-decisions.md` — Option A adoption
- `railiance-infra/docs/forgejo-restore-drill-evidence.md` — T09 restore proof
- `railiance-infra/docs/forgejo-restore-drill-evidence.md` — T09 restore proof
- `net-kingdom/docs/identity-restore-drill.md` — quarterly isolated identity restore drill (NK-WP-0053)