# Resilience Control Plane — data register (initial seed) # DISCTL-WP-0003-T01 — data classes covered by railiance-backup lanes # Full data inventory (Bubble, Stripe exports, member data, etc.) follows in DISCTL-WP-0002-T02. schema_version: "0.1" updated: "2026-07-07" register_scope: backup_lane_data_classes data_classes: - id: data-custodian-state-hub name: Custodian State Hub database tier: T1 source_of_truth: Docker volume infra_pg_data (container infra-postgres-1) description: >- Workstreams, tasks, decisions, progress history, messages — operational memory of the custodian control plane backup_stream: backup-dev-workstation backup: pg_dump via railiance-backup recovery_method: Restore PostgreSQL from age-decrypted dump rpo: 24h rto: 4h owner: Bernd status: operational - id: data-operator-dev-config name: Operator development environment config tier: T1 source_of_truth: ~/.claude/, ~/.claude.json, ~/.gitconfig on bnt-lap001 description: >- Claude project memory, MCP registration, agent settings, git identity — not in git repos; loss slows all agent sessions backup_stream: backup-dev-workstation backup: config tar via railiance-backup recovery_method: Unpack age-decrypted tar to $HOME rpo: 24h rto: 4h owner: Bernd status: operational - id: data-s1-os-config name: S1 OS and firewall configuration state tier: T2 source_of_truth: Live /etc/ on railiance01 (Ansible-managed, may drift) description: sshd, ufw, fail2ban, hosts, hostname, installed package selections backup_stream: backup-s1-os-config backup: os-config tar + packages list via railiance-backup-s1 recovery_method: Restore files or re-apply Ansible; package list aids apt reconciliation rpo: 24h rto: 4-8h owner: Bernd status: operational gaps: - "On-node only — no off-cluster copy" - id: data-k3s-cluster-state name: k3s cluster control plane state tier: T1 source_of_truth: /var/lib/rancher/k3s/server/db/state.db (SQLite mode) description: >- Kubernetes object state for single-node k3s — deployments, services, secrets metadata, CRDs backup_stream: backup-s2-k8s-runtime backup: sqlite3 hot backup via railiance-backup-s2 recovery_method: Restore state.db or rebuild cluster from Helm values rpo: 24h rto: 4-8h owner: Bernd status: operational gaps: - "On-node only — no off-cluster copy" - "PV/PVC data not included — application data needs separate streams" - id: data-helm-release-values name: Helm release configuration tier: T2 source_of_truth: Live Helm releases on k3s description: Per-release values.yaml for all namespaces — redeploy baseline backup_stream: backup-s2-k8s-runtime backup: helm get values export via railiance-backup-s2 recovery_method: helm upgrade --install from decrypted values files rpo: 24h rto: 4-8h owner: Bernd status: operational gaps: - "On-node only — no off-cluster copy" - id: data-kubeconfig name: Cluster admin kubeconfig tier: T0 source_of_truth: /etc/rancher/k3s/k3s.yaml description: Cluster admin credentials — trust boundary asset backup_stream: backup-s2-k8s-runtime backup: file copy via railiance-backup-s2 recovery_method: Restore to /etc/rancher/k3s/ or regenerate from k3s rpo: 24h rto: 2h owner: Bernd status: operational gaps: - "On-node only — no off-cluster copy" - id: data-platform-postgresql name: Platform PostgreSQL HA databases tier: T1 source_of_truth: railiance-platform PostgreSQL HA cluster description: >- Legacy platform relational data including services not yet on CNPG — intended target of S3 railiance-backup backup_stream: backup-s3-platform backup: none recovery_method: Not operational — awaiting railiance-backup tool restoration rpo: 24h rto: 4h owner: Bernd status: missing gaps: - "railiance-platform/tools/cmd/railiance-backup absent" - id: data-forgejo-git-repos name: Forgejo git repositories and metadata tier: T1 source_of_truth: Forgejo application PVC + forgejo-db PostgreSQL description: >- All git repos, org structure, issues, PRs, webhooks — canonical forge post-cutover backup_stream: backup-forgejo-production backup: manual forgejo dump only (automated not wired) recovery_method: forgejo-restore-drill.sh path — proven 2026-07-04 rpo: 24h rto: 4h owner: Bernd status: manual_only gaps: - "No scheduled backup job" - "RPO today is point-in-time of last manual dump" - id: data-forgejo-packages name: Forgejo OCI/npm/generic packages tier: T1 source_of_truth: Forgejo package storage on application PVC description: Container images, npm packages, generic artifacts published to forgejo.coulomb.social backup_stream: backup-forgejo-production backup: included in forgejo dump (when run); not scheduled recovery_method: Restored as part of forgejo dump restore rpo: 24h rto: 4h owner: Bernd status: manual_only - id: data-forgejo-db name: forgejo-db CNPG database tier: T1 source_of_truth: CloudNativePG cluster forgejo-db (databases namespace) description: Forgejo relational metadata — users, repos index, package registry DB backup_stream: backup-forgejo-production backup: none automated (intended daily pg_dump per 2026-07-09 decision) recovery_method: psql import from dump (proven in T09 drill) rpo: 24h rto: 4h owner: Bernd status: not_wired gaps: - "No CNPG ScheduledBackup CR" - "Split-brain risk: DB-only restore misses git blobs on app PVC" - id: data-gitea-repos name: Gitea repositories and instance data tier: T1 source_of_truth: coulombcore Gitea instance (bundled PG + gitea-shared-storage PVC) description: >- Canonical source forge until Forgejo cutover — all coulomb/* repos including disaster-control backup_stream: backup-gitea-canonical backup: none automated recovery_method: gitea dump restore; manual dump required before migration waves rpo: 24h rto: 4-8h owner: Bernd status: at_risk gaps: - "No automated backup" - "Package blob backup not evidenced" - id: data-age-backup-keys name: age encryption keys for backup artifacts tier: T0 source_of_truth: >- Operational ~/.config/age/railiance-backup.key (dev lane); ~/.config/sops/age/keys.txt (S1/S2 lane) description: >- Private keys required to decrypt all age-encrypted backups — loss makes backups undecryptable backup_stream: null backup: password manager recovery copy (required); not in backup streams recovery_method: Retrieve from password manager; regenerate only with key rotation plan rpo: immediate rto: 2h owner: Bernd status: operational gaps: - "Not inventoried in AssetRegister T0 section yet — DISCTL-WP-0002-T02 follow-up" status_legend: operational: "Backup mechanism exists and has run successfully" manual_only: "Restore path exists but backup is operator-triggered only" not_wired: "Decision or design exists; automation not implemented" missing: "No working backup mechanism" at_risk: "Known gap with high exposure; no reliable recovery point"