tegwick e6bf52dbc4 Complete DISCTL-WP-0002-T06 and finish resilience foundation

Record automated Forgejo backup decrypt drill evidence, update
registers and pickup queue (item 3 in progress). Mark WP-0002
finished — 8/8 tasks done.

2026-07-07 20:57:12 +02:00

3 KiB

Raw Permalink Blame History

Restore Drill: Forgejo automated backup (decrypt + validate)

Date: 2026-07-07
System: backup-forgejo-production — automated Option A artifacts
Operator: grok (Bernd workstation)
Result: success (decrypt + validate scope)
Workplan: DISCTL-WP-0002-T06

no_secret_material_recorded: true

Scope

This drill proves automated Forgejo backup artifacts are decryptable and contain coherent restore inputs. It does not deploy an isolated namespace (full restore remains covered by 2026-07-04 manual drill).

Promotion gate still requires restore from a Nextcloud artifact — this drill used the local cache copy (~/.cache/railiance/backups/forgejo/).

Backup artifacts

Field	Value
Source	`railiance-platform/tools/cmd/forgejo-backup` (automated run)
Dump artifact	`forgejo-dump-20260707T180844Z.zip.age`
DB artifact	`forgejo-db-20260707T180844Z.sql.age`
Backup timestamp	2026-07-07T18:08:44Z (`.last-success`)
Dump size (decrypted)	719,116,262 bytes (~686 MiB)
DB size (decrypted)	2,141,692 bytes (~2.0 MiB)
Encryption	age (platform backup public key)
Local cache path	`~/.cache/railiance/backups/forgejo/`

Target environment

Clean staging directory on workstation (no production services touched):

/tmp/disaster-control-drill-2026-07-07/

Procedure

Record start time (UTC).
age -d decrypt dump and DB artifacts using operational age key.
unzip -l validate dump structure.
Verify pg_dump header on SQL file.
Record elapsed time.

Validation checks

Check	Result
Dump decrypt	success
DB decrypt	success
`pg_dump` header	`PostgreSQL database dump` present
`repos/coulomb/glas-harness.git/`	present
`repos/coulomb/core-hub.git/`	present
Package blobs under `data/packages/`	present (4704 files in archive)
Elapsed (decrypt + list + header)	7 seconds

RPO / RTO measured

Metric	Target (adopted)	Achieved
RPO	24h	~47 minutes (backup 18:08Z, drill 18:55Z)
RTO (decrypt + validate)	4h	7 seconds
RTO (full isolated restore)	4h	not measured this drill

Issues found

Drill used local cache, not Nextcloud download — promotion gate item 3 still needs explicit restore-from-offsite proof.
Full isolated namespace restore not re-run (2026-07-04 manual drill still canonical for deploy path).

Follow-up actions

Action	Owner	Reference
Re-run drill downloading artifact from Nextcloud only	Bernd	`BackupPolicy.md` §7 promotion gate
Quarterly full isolated restore from automated backup	`railiance-infra`	`forgejo-restore-drill.sh`
Update pickup queue item 3 status if cron confirmed	`disaster-control`	`BackupPickupQueue.md`

Manual isolated restore: TestEvidence/restore-drill-2026-07-04-forgejo.md
Owner repo: railiance-infra/docs/forgejo-restore-drill-evidence.md

3 KiB Raw Permalink Blame History