tegwick
e6bf52dbc4
Record automated Forgejo backup decrypt drill evidence, update registers and pickup queue (item 3 in progress). Mark WP-0002 finished — 8/8 tasks done.
4 KiB
Backup Pickup Queue
Updated: 2026-07-07
Owner: Bernd (disaster-control tracks; implementation in owner repos)
Source: history/2026-07-04-forgejo-backup-strategy-assessment.md pickup queue
Review cadence: Monthly, or when a cross-repo workplan closes
When an item reaches done, update AssetRegister.yaml, DataRegister.yaml,
BackupPolicy.md, and RTO-RPO-Matrix.md to reflect the new posture.
Queue
| # | Item | Owner repo | Blocker | Status | Last checked | Evidence |
|---|---|---|---|---|---|---|
| 1 | Backup destination + retention decision | railiance-infra / T02 |
— | done | 2026-07-09 | the-custodian/docs/forgejo-production-decisions.md — Option A: Nextcloud WebDAV, 14 daily + 4 weekly, age encrypt |
| 2 | CNPG ScheduledBackup on forgejo-db |
railiance-platform |
#1 done; Phase 1 uses logical pg_dump per decision (WAL deferred) | open | 2026-07-07 | No ScheduledBackup CR found; helm/forgejo-db-cluster.yaml has storage only |
| 3 | Scheduled forgejo dump → age → upload |
railiance-platform |
Promotion gate: restore from Nextcloud artifact | in_progress | 2026-07-07 | Cron 02:15 UTC (make forgejo-backup); local cache + upload wired; decrypt drill 2026-07-07 |
| 4 | Restore tools/cmd/railiance-backup to platform |
railiance-platform |
Relocation cancelled (RAIL-PL-WP-0001-T05); needs re-implementation | open | 2026-07-07 | make backup references missing tools/cmd/railiance-backup |
| 5 | Gitea pre-cutover snapshot runbook + evidence | railiance-infra / railiance-apps |
No automated Gitea backup today | open | 2026-07-07 | Safety contract requires fresh dump before each migration wave; no runbook evidenced |
| 6 | apps-pg backup coverage |
railiance-platform |
CNPG ScheduledBackup not configured | open | 2026-07-07 | railiance-platform/docs/apps-pg.md — follow-up note; blocks app production-trust gates |
Status legend
| Status | Meaning |
|---|---|
open |
Not started or no implementation evidenced |
in_progress |
Active workplan or PR in flight |
done |
Implemented, verified, registers updated |
deferred |
Explicitly postponed with decision record |
Promotion gate (from BackupPolicy.md §7)
Tier-3 repo cutovers remain blocked until:
- Items 3 and 4 (or equivalent platform lane) deliver automated daily backups.
- 7 consecutive days of successful daily runs.
- One restore drill uses a Nextcloud artifact (not workstation
/tmp).
Current gate status: not met — item 3 in progress (cron + decrypt proven); Nextcloud-only restore drill pending; item 4 open.
Notes
Item 1 — closed 2026-07-09
Operator chose Option A: extend the existing Railiance platform backup lane
(age + Nextcloud WebDAV). Recorded in BackupPolicy.md §7 and
RTO-RPO-Matrix.md.
Item 2 — scope clarification
2026-07-09 decision explicitly defers CNPG WAL/PITR to Phase 2. Phase 1 uses
daily logical pg_dump from forgejo-db (overlaps item 3). A
ScheduledBackup CR may still be valuable later but is not the Phase 1 gate.
Item 3 — owner correction
Assessment originally assigned scheduled forgejo dump to railiance-apps.
2026-07-09 decision assigns cron, encrypt, upload, and retention to
railiance-platform. railiance-apps constraint: no backup secrets in Git.
Item 4 — re-implementation path
The old railiance-backup script still exists in railiance-cluster/tools/cmd/
(dev-workstation scope). Platform needs a new or relocated tool covering
PostgreSQL HA, Valkey, and Forgejo lane uploads. See
railiance-platform/workplans/archived/RAIL-PL-WP-0001-platform-baseline.md T05.
Review log
| Date | Reviewer | Notes |
|---|---|---|
| 2026-07-07 | grok | Queue created (DISCTL-WP-0003-T04). Item 1 done. Items 2–6 open. |
| 2026-07-07 | grok | Item 3 → in_progress: daily cron, automated decrypt drill (TestEvidence/restore-drill-2026-07-07-forgejo-automated.md). |