tegwick
b59b9a565c
Add RTO-RPO matrix, backup pickup queue tracker, and TestEvidence with Forgejo drill import. Mark T03, T04, T05 done.
95 lines
No EOL
4.8 KiB
Markdown
95 lines
No EOL
4.8 KiB
Markdown
# RTO / RPO Matrix
|
||
|
||
**Updated:** 2026-07-07
|
||
**Owner:** Bernd
|
||
**Scope:** Backup lanes — initial seed (DISCTL-WP-0003-T03)
|
||
**Related:** `AssetRegister.yaml` · `BackupPolicy.md` · `DataRegister.yaml`
|
||
|
||
Recovery Time Objective (RTO): maximum acceptable downtime.
|
||
Recovery Point Objective (RPO): maximum acceptable data loss (time since last good backup).
|
||
|
||
**Status legend:**
|
||
|
||
| Status | Meaning |
|
||
| --- | --- |
|
||
| `adopted` | Operator-confirmed target; policy applies |
|
||
| `draft` | Proposed from assessment; pending operator confirmation |
|
||
| `degraded` | Target adopted but current posture cannot meet it |
|
||
|
||
Global baseline (from `specs/ResilienceControlSetup.md` §3): **RPO ≤ 24h everywhere**;
|
||
**RTO ≤ 1 day** for full recovery; **RTO ≤ 4–8h** for code/content/control plane.
|
||
|
||
---
|
||
|
||
## Backup lane targets
|
||
|
||
| System | Register ID | RPO target | RTO target | Status | Evidence basis | Current posture |
|
||
| --- | --- | --- | --- | --- | --- | --- |
|
||
| Forgejo git + packages | `backup-forgejo-production` | 24h | 4h | **adopted** | Decision #7 (2026-07-09); T09 drill | **degraded** — manual dump only; automation not wired |
|
||
| `forgejo-db` CNPG | `backup-forgejo-production` | 24h (Phase 1 logical dump) | 4h | **adopted** | Decision #7 (2026-07-09) | **degraded** — no scheduled pg_dump |
|
||
| Gitea (canonical until cutover) | `backup-gitea-canonical` | 24h | 4–8h | draft | Assessment §suggested targets | **degraded** — no automated backup |
|
||
| k3s cluster state (S2) | `backup-s2-k8s-runtime` | 24h | 4–8h | draft | `railiance-backup-s2` local retention | Manual backup; on-node only |
|
||
| S1 OS config | `backup-s1-os-config` | 24h | 4–8h | draft | Manual `make backup`; no schedule | Manual backup; on-node only |
|
||
| Dev workstation custodian DB | `backup-dev-workstation` | 24h | 4h | draft | Daily cron 02:00; preflight gate | Operational — meets target if cron healthy |
|
||
| Dev workstation operator config | `backup-dev-workstation` | 24h | 4h | draft | Daily cron 02:00; preflight gate | Operational — meets target if cron healthy |
|
||
| S3 platform PostgreSQL | `backup-s3-platform` | 24h | 4h | **adopted** | Decision #7 (extends platform lane) | **degraded** — tool missing |
|
||
| `apps-pg` CNPG | `backup-apps-pg` | 24h | 4–8h | draft | `railiance-platform/docs/apps-pg.md` | **degraded** — no ScheduledBackup CR |
|
||
| Adjacent SSO/MFA stack | `backup-adjacent-sso` | 24h | 4–8h | draft | Daily CronJobs on railiance01 | Operational — scheduled daily |
|
||
|
||
---
|
||
|
||
## Measured results (restore drills)
|
||
|
||
| Date | System | RPO achieved | RTO achieved | Result | Evidence |
|
||
| --- | --- | --- | --- | --- | --- |
|
||
| 2026-07-04 | Forgejo (isolated restore) | Point-in-time of manual `forgejo dump` | ~3–5 min (isolated namespace) | success | `TestEvidence/restore-drill-2026-07-04-forgejo.md` |
|
||
|
||
No other systems have measured drill results yet. Next drills should produce
|
||
dated files under `TestEvidence/` (DISCTL-WP-0003-T05).
|
||
|
||
---
|
||
|
||
## Adopted vs operational gap
|
||
|
||
Systems marked **adopted** with **degraded** posture are policy violations until
|
||
the promotion gate in `BackupPolicy.md` §7 is met:
|
||
|
||
1. Automated daily backups succeed for 7 consecutive days.
|
||
2. One restore drill uses a Nextcloud artifact (not workstation `/tmp`).
|
||
|
||
| System | Adopted RPO/RTO | Blocker to operational |
|
||
| --- | --- | --- |
|
||
| Forgejo git + packages | 24h / 4h | No scheduled `forgejo dump` CronJob |
|
||
| `forgejo-db` CNPG | 24h / 4h | No daily pg_dump automation |
|
||
| S3 platform PostgreSQL | 24h / 4h | `railiance-backup` tool absent from platform |
|
||
|
||
---
|
||
|
||
## Draft targets pending operator confirmation
|
||
|
||
The following rows use assessment-suggested values. Confirm or adjust:
|
||
|
||
| System | Proposed RPO | Proposed RTO | Question for operator |
|
||
| --- | --- | --- | --- |
|
||
| Gitea canonical | 24h | 4–8h | Accept 24h RPO until cutover, or require mirror + hourly? |
|
||
| k3s cluster state (S2) | 24h | 4–8h | Accept manual-only S2 backup, or require daily cron + offsite? |
|
||
| S1 OS config | 24h | 4–8h | Accept manual-only, or require scheduled + offsite? |
|
||
| Dev workstation | 24h | 4h | Confirm daily cron meets RPO; any need for sub-daily? |
|
||
| `apps-pg` | 24h | 4–8h | Confirm before app production-trust gates |
|
||
| Adjacent SSO | 24h | 4–8h | Confirm daily CronJob retention and restore path |
|
||
|
||
---
|
||
|
||
## Cross-references
|
||
|
||
| Artifact | Link |
|
||
| --- | --- |
|
||
| Stream inventory | `AssetRegister.yaml` → `backup_streams` |
|
||
| Data classes | `DataRegister.yaml` → `data_classes` |
|
||
| Backup mechanisms | `BackupPolicy.md` §6–§7 |
|
||
| Forgejo adoption | `the-custodian/docs/forgejo-production-decisions.md` |
|
||
| Gap assessment | `history/2026-07-04-forgejo-backup-strategy-assessment.md` |
|
||
|
||
**Follow-up:** `ResiliencePolicy.md` (operating principle, drill cadence) remains
|
||
in `DISCTL-WP-0002-T03`. Broader non-backup systems (Bubble, Stripe, DNS) will
|
||
be added when `DISCTL-WP-0002-T02` expands the registers. |