tegwick
9ca741908e
Register backup-netkingdom-identity (LLDAP, privacyIDEA DB/token material/audit, KeyCape client registry archive) as a T0 backup stream: daily 03:45 UTC age-encrypted upload to one off-host provider (Storage Share), hourly on-host health check with a 25h freshness bound, RPO 24h. Activation evidence net-kingdom NK-WP-0049-T14 (2026-10-16). Record accepted residual risks G1 (single off-host provider) and G2 (on-host-only freshness detection, watchdog owed by RAPP-TELEMETRY-WP-0001-T04) until 2027-01-31, and the quarterly isolated identity restore drill (net-kingdom NK-WP-0053, first due by 2027-01-31) in BackupPolicy, RTO-RPO matrix and TestEvidence cadence. Requested by net-kingdom (hub message ef2bf2a9); founder decision e4c288d9 resolved 2026-10-23. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 696317@bnt-lap001 Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
97 lines
No EOL
5.6 KiB
Markdown
97 lines
No EOL
5.6 KiB
Markdown
# RTO / RPO Matrix
|
||
|
||
**Updated:** 2026-10-23
|
||
**Owner:** Bernd
|
||
**Scope:** Backup lanes — initial seed (DISCTL-WP-0003-T03)
|
||
**Related:** `AssetRegister.yaml` · `BackupPolicy.md` · `DataRegister.yaml`
|
||
|
||
Recovery Time Objective (RTO): maximum acceptable downtime.
|
||
Recovery Point Objective (RPO): maximum acceptable data loss (time since last good backup).
|
||
|
||
**Status legend:**
|
||
|
||
| Status | Meaning |
|
||
| --- | --- |
|
||
| `adopted` | Operator-confirmed target; policy applies |
|
||
| `draft` | Proposed from assessment; pending operator confirmation |
|
||
| `degraded` | Target adopted but current posture cannot meet it |
|
||
|
||
Global baseline (from `specs/ResilienceControlSetup.md` §3): **RPO ≤ 24h everywhere**;
|
||
**RTO ≤ 1 day** for full recovery; **RTO ≤ 4–8h** for code/content/control plane.
|
||
|
||
---
|
||
|
||
## Backup lane targets
|
||
|
||
| System | Register ID | RPO target | RTO target | Status | Evidence basis | Current posture |
|
||
| --- | --- | --- | --- | --- | --- | --- |
|
||
| Forgejo git + packages | `backup-forgejo-production` | 24h | 4h | **adopted** | Decision #7; drills 2026-07-04/07 | **operational** — daily cron; promotion gate (Nextcloud restore) open |
|
||
| `forgejo-db` CNPG | `backup-forgejo-production` | 24h (Phase 1 logical dump) | 4h | **adopted** | Decision #7; forgejo-backup pg_dump | **operational** — daily cron; promotion gate open |
|
||
| Gitea (canonical until cutover) | `backup-gitea-canonical` | 24h | 4–8h | draft | Assessment §suggested targets | **degraded** — no automated backup |
|
||
| k3s cluster state (S2) | `backup-s2-k8s-runtime` | 24h | 4–8h | draft | `railiance-backup-s2` local retention | Manual backup; on-node only |
|
||
| S1 OS config | `backup-s1-os-config` | 24h | 4–8h | draft | Manual `make backup`; no schedule | Manual backup; on-node only |
|
||
| Dev workstation custodian DB | `backup-dev-workstation` | 24h | 4h | draft | Daily cron 02:00; preflight gate | Operational — meets target if cron healthy |
|
||
| Dev workstation operator config | `backup-dev-workstation` | 24h | 4h | draft | Daily cron 02:00; preflight gate | Operational — meets target if cron healthy |
|
||
| S3 platform PostgreSQL | `backup-s3-platform` | 24h | 4h | **adopted** | Decision #7 (extends platform lane) | **degraded** — tool missing |
|
||
| `apps-pg` CNPG | `backup-apps-pg` | 24h | 4–8h | draft | `railiance-platform/docs/apps-pg.md` | **degraded** — no ScheduledBackup CR |
|
||
| Adjacent SSO/MFA stack | `backup-adjacent-sso` | 24h | 4–8h | draft | Daily CronJobs on railiance01 | Operational — scheduled daily; LLDAP/privacyIDEA now under `backup-netkingdom-identity` |
|
||
| NetKingdom identity (LLDAP, privacyIDEA, KeyCape client registry) | `backup-netkingdom-identity` | 24h | TBD (first NK-WP-0053 drill) | **adopted** (RPO) | Founder decision e4c288d9 (2026-10-23); NK-WP-0049-T14 activation; component proofs NK-WP-0049-T16/T31/T20 | Operational — daily 03:45 UTC, 25h freshness bound; G1/G2 accepted until 2027-01-31 |
|
||
|
||
---
|
||
|
||
## Measured results (restore drills)
|
||
|
||
| Date | System | RPO achieved | RTO achieved | Result | Evidence |
|
||
| --- | --- | --- | --- | --- | --- |
|
||
| 2026-07-04 | Forgejo (isolated restore, manual dump) | Point-in-time of manual `forgejo dump` | ~3–5 min (isolated namespace) | success | `TestEvidence/restore-drill-2026-07-04-forgejo.md` |
|
||
| 2026-07-07 | Forgejo (automated backup decrypt) | ~47 min (backup 18:08Z, drill 18:55Z) | 7 sec (decrypt + validate) | success | `TestEvidence/restore-drill-2026-07-07-forgejo-automated.md` |
|
||
|
||
Next drills: NetKingdom identity isolated restore (NK-WP-0053, due by 2027-01-31), S2 k8s decrypt, dev workstation cold restore, Gitea dump (see `TestEvidence/README.md`). Next drills should produce
|
||
dated files under `TestEvidence/` (DISCTL-WP-0003-T05).
|
||
|
||
---
|
||
|
||
## Adopted vs operational gap
|
||
|
||
Systems marked **adopted** with **degraded** posture are policy violations until
|
||
the promotion gate in `BackupPolicy.md` §7 is met:
|
||
|
||
1. Automated daily backups succeed for 7 consecutive days.
|
||
2. One restore drill uses a Nextcloud artifact (not workstation `/tmp`).
|
||
|
||
| System | Adopted RPO/RTO | Blocker to operational |
|
||
| --- | --- | --- |
|
||
| Forgejo git + packages | 24h / 4h | Promotion gate: 7-day success + restore from Nextcloud artifact |
|
||
| `forgejo-db` CNPG | 24h / 4h | Promotion gate (daily pg_dump via forgejo-backup is wired) |
|
||
| S3 platform PostgreSQL | 24h / 4h | `railiance-backup` tool absent for non-Forgejo platform DBs |
|
||
|
||
---
|
||
|
||
## Draft targets pending operator confirmation
|
||
|
||
The following rows use assessment-suggested values. Confirm or adjust:
|
||
|
||
| System | Proposed RPO | Proposed RTO | Question for operator |
|
||
| --- | --- | --- | --- |
|
||
| Gitea canonical | 24h | 4–8h | Accept 24h RPO until cutover, or require mirror + hourly? |
|
||
| k3s cluster state (S2) | 24h | 4–8h | Accept manual-only S2 backup, or require daily cron + offsite? |
|
||
| S1 OS config | 24h | 4–8h | Accept manual-only, or require scheduled + offsite? |
|
||
| Dev workstation | 24h | 4h | Confirm daily cron meets RPO; any need for sub-daily? |
|
||
| `apps-pg` | 24h | 4–8h | Confirm before app production-trust gates |
|
||
| Adjacent SSO | 24h | 4–8h | Confirm daily CronJob retention and restore path |
|
||
|
||
---
|
||
|
||
## Cross-references
|
||
|
||
| Artifact | Link |
|
||
| --- | --- |
|
||
| Stream inventory | `AssetRegister.yaml` → `backup_streams` |
|
||
| Data classes | `DataRegister.yaml` → `data_classes` |
|
||
| Backup mechanisms | `BackupPolicy.md` §6–§7 |
|
||
| Forgejo adoption | `the-custodian/docs/forgejo-production-decisions.md` |
|
||
| Gap assessment | `history/2026-07-04-forgejo-backup-strategy-assessment.md` |
|
||
|
||
**Follow-up:** `ResiliencePolicy.md` (operating principle, drill cadence) remains
|
||
in `DISCTL-WP-0002-T03`. Broader non-backup systems (Bubble, Stripe, DNS) will
|
||
be added when `DISCTL-WP-0002-T02` expands the registers. |