tegwick
e6bf52dbc4
Record automated Forgejo backup decrypt drill evidence, update registers and pickup queue (item 3 in progress). Mark WP-0002 finished — 8/8 tasks done.
83 lines
No EOL
4 KiB
Markdown
83 lines
No EOL
4 KiB
Markdown
# Backup Pickup Queue
|
||
|
||
**Updated:** 2026-07-07
|
||
**Owner:** Bernd (`disaster-control` tracks; implementation in owner repos)
|
||
**Source:** `history/2026-07-04-forgejo-backup-strategy-assessment.md` pickup queue
|
||
**Review cadence:** Monthly, or when a cross-repo workplan closes
|
||
|
||
When an item reaches `done`, update `AssetRegister.yaml`, `DataRegister.yaml`,
|
||
`BackupPolicy.md`, and `RTO-RPO-Matrix.md` to reflect the new posture.
|
||
|
||
---
|
||
|
||
## Queue
|
||
|
||
| # | Item | Owner repo | Blocker | Status | Last checked | Evidence |
|
||
| --- | --- | --- | --- | --- | --- | --- |
|
||
| 1 | Backup destination + retention decision | `railiance-infra` / T02 | — | **done** | 2026-07-09 | `the-custodian/docs/forgejo-production-decisions.md` — Option A: Nextcloud WebDAV, 14 daily + 4 weekly, age encrypt |
|
||
| 2 | CNPG `ScheduledBackup` on `forgejo-db` | `railiance-platform` | #1 done; Phase 1 uses logical pg_dump per decision (WAL deferred) | **open** | 2026-07-07 | No `ScheduledBackup` CR found; `helm/forgejo-db-cluster.yaml` has storage only |
|
||
| 3 | Scheduled `forgejo dump` → age → upload | `railiance-platform` | Promotion gate: restore from Nextcloud artifact | **in_progress** | 2026-07-07 | Cron 02:15 UTC (`make forgejo-backup`); local cache + upload wired; decrypt drill 2026-07-07 |
|
||
| 4 | Restore `tools/cmd/railiance-backup` to platform | `railiance-platform` | Relocation cancelled (RAIL-PL-WP-0001-T05); needs re-implementation | **open** | 2026-07-07 | `make backup` references missing `tools/cmd/railiance-backup` |
|
||
| 5 | Gitea pre-cutover snapshot runbook + evidence | `railiance-infra` / `railiance-apps` | No automated Gitea backup today | **open** | 2026-07-07 | Safety contract requires fresh dump before each migration wave; no runbook evidenced |
|
||
| 6 | `apps-pg` backup coverage | `railiance-platform` | CNPG ScheduledBackup not configured | **open** | 2026-07-07 | `railiance-platform/docs/apps-pg.md` — follow-up note; blocks app production-trust gates |
|
||
|
||
---
|
||
|
||
## Status legend
|
||
|
||
| Status | Meaning |
|
||
| --- | --- |
|
||
| `open` | Not started or no implementation evidenced |
|
||
| `in_progress` | Active workplan or PR in flight |
|
||
| `done` | Implemented, verified, registers updated |
|
||
| `deferred` | Explicitly postponed with decision record |
|
||
|
||
---
|
||
|
||
## Promotion gate (from BackupPolicy.md §7)
|
||
|
||
Tier-3 repo cutovers remain blocked until:
|
||
|
||
1. Items **3** and **4** (or equivalent platform lane) deliver automated daily backups.
|
||
2. **7 consecutive days** of successful daily runs.
|
||
3. One restore drill uses a **Nextcloud artifact** (not workstation `/tmp`).
|
||
|
||
Current gate status: **not met** — item 3 in progress (cron + decrypt proven); Nextcloud-only restore drill pending; item 4 open.
|
||
|
||
---
|
||
|
||
## Notes
|
||
|
||
### Item 1 — closed 2026-07-09
|
||
|
||
Operator chose Option A: extend the existing Railiance platform backup lane
|
||
(age + Nextcloud WebDAV). Recorded in `BackupPolicy.md` §7 and
|
||
`RTO-RPO-Matrix.md`.
|
||
|
||
### Item 2 — scope clarification
|
||
|
||
2026-07-09 decision explicitly defers CNPG WAL/PITR to Phase 2. Phase 1 uses
|
||
daily logical `pg_dump` from `forgejo-db` (overlaps item 3). A
|
||
`ScheduledBackup` CR may still be valuable later but is not the Phase 1 gate.
|
||
|
||
### Item 3 — owner correction
|
||
|
||
Assessment originally assigned scheduled `forgejo dump` to `railiance-apps`.
|
||
2026-07-09 decision assigns cron, encrypt, upload, and retention to
|
||
`railiance-platform`. `railiance-apps` constraint: no backup secrets in Git.
|
||
|
||
### Item 4 — re-implementation path
|
||
|
||
The old `railiance-backup` script still exists in `railiance-cluster/tools/cmd/`
|
||
(dev-workstation scope). Platform needs a new or relocated tool covering
|
||
PostgreSQL HA, Valkey, and Forgejo lane uploads. See
|
||
`railiance-platform/workplans/archived/RAIL-PL-WP-0001-platform-baseline.md` T05.
|
||
|
||
---
|
||
|
||
## Review log
|
||
|
||
| Date | Reviewer | Notes |
|
||
| --- | --- | --- |
|
||
| 2026-07-07 | grok | Queue created (DISCTL-WP-0003-T04). Item 1 done. Items 2–6 open. |
|
||
| 2026-07-07 | grok | Item 3 → in_progress: daily cron, automated decrypt drill (`TestEvidence/restore-drill-2026-07-07-forgejo-automated.md`). | |