# Restore Drill: Forgejo automated backup (decrypt + validate)

**Date:** 2026-07-07  
**System:** `backup-forgejo-production` — automated Option A artifacts  
**Operator:** grok (Bernd workstation)  
**Result:** success (decrypt + validate scope)  
**Workplan:** DISCTL-WP-0002-T06

`no_secret_material_recorded: true`

## Scope

This drill proves **automated** Forgejo backup artifacts are decryptable and
contain coherent restore inputs. It does **not** deploy an isolated namespace
(full restore remains covered by 2026-07-04 manual drill).

Promotion gate still requires restore from a **Nextcloud** artifact — this drill
used the local cache copy (`~/.cache/railiance/backups/forgejo/`).

## Backup artifacts

| Field | Value |
| --- | --- |
| Source | `railiance-platform/tools/cmd/forgejo-backup` (automated run) |
| Dump artifact | `forgejo-dump-20260707T180844Z.zip.age` |
| DB artifact | `forgejo-db-20260707T180844Z.sql.age` |
| Backup timestamp | 2026-07-07T18:08:44Z (`.last-success`) |
| Dump size (decrypted) | 719,116,262 bytes (~686 MiB) |
| DB size (decrypted) | 2,141,692 bytes (~2.0 MiB) |
| Encryption | age (platform backup public key) |
| Local cache path | `~/.cache/railiance/backups/forgejo/` |

## Target environment

Clean staging directory on workstation (no production services touched):

```text
/tmp/disaster-control-drill-2026-07-07/
```

## Procedure

1. Record start time (UTC).
2. `age -d` decrypt dump and DB artifacts using operational age key.
3. `unzip -l` validate dump structure.
4. Verify `pg_dump` header on SQL file.
5. Record elapsed time.

## Validation checks

| Check | Result |
| --- | --- |
| Dump decrypt | success |
| DB decrypt | success |
| `pg_dump` header | `PostgreSQL database dump` present |
| `repos/coulomb/glas-harness.git/` | present |
| `repos/coulomb/core-hub.git/` | present |
| Package blobs under `data/packages/` | present (4704 files in archive) |
| Elapsed (decrypt + list + header) | **7 seconds** |

## RPO / RTO measured

| Metric | Target (adopted) | Achieved |
| --- | --- | --- |
| RPO | 24h | ~47 minutes (backup 18:08Z, drill 18:55Z) |
| RTO (decrypt + validate) | 4h | **7 seconds** |
| RTO (full isolated restore) | 4h | not measured this drill |

## Issues found

- Drill used **local cache**, not Nextcloud download — promotion gate item 3
  still needs explicit restore-from-offsite proof.
- Full isolated namespace restore not re-run (2026-07-04 manual drill still
  canonical for deploy path).

## Follow-up actions

| Action | Owner | Reference |
| --- | --- | --- |
| Re-run drill downloading artifact from Nextcloud only | Bernd | `BackupPolicy.md` §7 promotion gate |
| Quarterly full isolated restore from automated backup | `railiance-infra` | `forgejo-restore-drill.sh` |
| Update pickup queue item 3 status if cron confirmed | `disaster-control` | `BackupPickupQueue.md` |

## Related evidence

- Manual isolated restore: `TestEvidence/restore-drill-2026-07-04-forgejo.md`
- Owner repo: `railiance-infra/docs/forgejo-restore-drill-evidence.md`