coulomb/disaster-control
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
disaster-control/TestEvidence/README.md
tegwick e6bf52dbc4 Complete DISCTL-WP-0002-T06 and finish resilience foundation 
Record automated Forgejo backup decrypt drill evidence, update
registers and pickup queue (item 3 in progress). Mark WP-0002
finished — 8/8 tasks done.
2026-07-07 20:57:12 +02:00

2 KiB
Raw Permalink Blame History

Test Evidence

Dated restore-drill reports proving RTO/RPO targets in RTO-RPO-Matrix.md are actually met — not just documented.

Naming convention

TestEvidence/restore-drill-YYYY-MM-DD-<system>.md

Examples: restore-drill-2026-07-04-forgejo.md

Required fields

Every evidence file must include:

Field Description
Date Drill execution date (UTC)
System What was restored (register ID or system name)
Backup artifact Filename, size, timestamp, source (manual/automated)
Target environment Isolated namespace, staging host, clean VM, etc.
Operator Who ran the drill
Result success / partial / failed
RPO achieved Actual recovery point (how stale was the backup?)
RTO achieved Wall-clock time from start to validated service
Checks performed API calls, smoke tests, representative workflow
Issues found Anything that blocked or degraded restore
Follow-up actions Workplan items, pickup queue refs, register updates
Canonical evidence Link to owner-repo evidence if drill ran elsewhere

Drill cadence

Tier Minimum cadence Owner
T1 irreplaceable source of truth Quarterly Bernd
T0 identity / trust Quarterly (cold decrypt included) Bernd
T2 runtime platforms Semi-annual Bernd

Quarterly Forgejo drill gate: re-run forgejo-restore-drill.sh from an automated Nextcloud artifact once daily backups are wired (promotion gate in BackupPolicy.md §7).

Next untested targets

Completed drills:

  • 2026-07-04 — Forgejo manual isolated restore
  • 2026-07-07 — Forgejo automated backup decrypt + validate

Next targets:

  1. Forgejo from Nextcloud only — promotion gate (BackupPolicy.md §7)
  2. S2 k3s runtime — decrypt railiance-backup-s2 on railiance01
  3. Dev workstation cold restore — password-manager key only
  4. Gitea dump — before next migration wave
  5. Secret vault cold decrypt — SOPS/age recovery material (R5)