coulomb/disaster-control
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reconcile with same-day Forgejo backup assessment

Browse source 
Risk analysis R2 updated (one restore now evidenced), workplan cross-referenced
with the assessment's pickup queue; new T08 tracks cross-repo backup items.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-04 12:46:22 +02:00
parent 2f6f489289
commit ddea827192
2 changed files with 35 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

9
history/2026-07-04-initial-risk-analysis.md
View file

@ -5,6 +5,8 @@ Author: claude-code (session with Bernd)
Status: baseline — to be revisited after AssetRegister and first restore drill Status: baseline — to be revisited after AssetRegister and first restore drill
Source: `specs/ResilienceControlSetup.md`, `INTENT.md`, current Coulomb/Helix stack Source: `specs/ResilienceControlSetup.md`, `INTENT.md`, current Coulomb/Helix stack
(Gitea, k3s, CoulombCore, Bubble.io, Stripe, OpenRouter, DNS, secrets, Ansible) (Gitea, k3s, CoulombCore, Bubble.io, Stripe, OpenRouter, DNS, secrets, Ansible)
Companion: `2026-07-04-forgejo-backup-strategy-assessment.md` — same-day
Forgejo/Railiance deep-dive with a concrete pickup queue for this repo
## Purpose ## Purpose
@ -33,8 +35,11 @@ recovery asset, offsite encrypted backups, DNS cutover procedure, quarterly rebu
The classic silent failure: dumps run for months, first real restore reveals The classic silent failure: dumps run for months, first real restore reveals
corruption, missing volumes, undumped databases, or an unknown passphrase. corruption, missing volumes, undumped databases, or an unknown passphrase.
**L4 / I5** (it converts every other risk into a total loss). Exposure today: **L4 / I5** (it converts every other risk into a total loss). Exposure today:
critical — no restore has ever been evidenced. high — exactly one restore has been evidenced: the 2026-07-04 Forgejo isolated
**Mitigation:** the TestEvidence loop itself — monthly restore drills with dated restore drill (RAIL-HO-WP-0005-T09, evidence in `railiance-infra`). Gitea (the
canonical source forge today), CoulombCore content, databases, Bubble exports,
and the secret vault have never been restore-tested.
**Mitigation:** the TestEvidence loop itself — recurring restore drills with dated
reports measuring actual RTO/RPO. This is the highest-leverage artifact in the repo. reports measuring actual RTO/RPO. This is the highest-leverage artifact in the repo.
### R3 — Ransomware / hostile access deletes backups too ### R3 — Ransomware / hostile access deletes backups too

33
workplans/DISCTL-WP-0002-resilience-foundation.md
View file

@ -22,6 +22,11 @@ Driven by `history/2026-07-04-initial-risk-analysis.md` — priority order R2
R4/R5 (identity & secret recovery), R10 (control plane single-homed), R1 R4/R5 (identity & secret recovery), R10 (control plane single-homed), R1
(full server loss). Design source: `specs/ResilienceControlSetup.md`. (full server loss). Design source: `specs/ResilienceControlSetup.md`.
The same-day Forgejo/Railiance assessment
(`history/2026-07-04-forgejo-backup-strategy-assessment.md`) proved the Forgejo
restore path (RAIL-HO-WP-0005-T09) and handed this repo a pickup queue: its
items 7–8 are T03/T04/T06 below; its cross-repo items are tracked by T08.
## Mirror disaster-control off the primary Gitea (R10) ## Mirror disaster-control off the primary Gitea (R10)
```task ```task
@ -100,11 +105,14 @@ status: todo
priority: high priority: high
``` ```
Perform one real restore to a clean target — smallest meaningful scope (e.g. The 2026-07-04 Forgejo drill (evidence in `railiance-infra`) proved that path;
one Gitea repo from a `gitea dump`, or the secret vault decrypted from cold) — this task covers the next untested system: restore one Gitea repo/dump or
and write `TestEvidence/restore-drill-2026-MM-DD.md` with measured RTO/RPO, decrypt the secret vault from cold, onto a clean target. Write
result, issues found, and follow-up actions. This task is the exit criterion `TestEvidence/restore-drill-2026-MM-DD.md` with measured RTO/RPO, result,
for the workplan: no drill evidence, not finished. issues found, and follow-up actions; also copy or link the Forgejo drill
evidence so this repo holds the complete evidence trail. Define the recurring
drill cadence (pickup item 7). This task is the exit criterion for the
workplan: no drill evidence here, not finished.
## Incident playbooks (R3, R4, R5, R6, R7) ## Incident playbooks (R3, R4, R5, R6, R7)
@ -118,3 +126,18 @@ Write the five playbooks under `IncidentPlaybooks/`: ransomware/hostile access,
credential leak, accidental delete / data corruption, provider outage credential leak, accidental delete / data corruption, provider outage
(Bubble/Stripe/OpenRouter/DNS/email), loss of admin identity. Keep each to one (Bubble/Stripe/OpenRouter/DNS/email), loss of admin identity. Keep each to one
page of numbered steps per the spec (§6). page of numbered steps per the spec (§6).
## Track cross-repo backup pickup queue (R2, R9)
```task
id: DISCTL-WP-0002-T08
status: todo
priority: medium
```
Drive closure of the cross-repo items from the Forgejo assessment's pickup
queue (items 1–6: backup destination decision #7, CNPG ScheduledBackup,
scheduled `forgejo dump`, `railiance-backup` tool, Gitea pre-cutover snapshot,
`apps-pg` coverage). Implementation lives in `railiance-platform` /
`railiance-apps` / `railiance-infra`; this repo tracks status and records the
outcome in the registers and BackupPolicy as each item lands.