diff --git a/docs/app-data-backup-restore-handoff.md b/docs/app-data-backup-restore-handoff.md index 9f6f55f..33fabb8 100644 --- a/docs/app-data-backup-restore-handoff.md +++ b/docs/app-data-backup-restore-handoff.md @@ -73,24 +73,38 @@ may still use logical `pg_dump` for some clusters; see ## `vergabe-teilnahme` Gate -Current posture: +Current posture (2026-07-12): - database: `vergabe_db` on `databases/apps-pg`; - app role Secret: `vergabe-app-credentials`; - env Secret: `vergabe-teilnahme-env`; -- current backup status: no CNPG `ScheduledBackup` on `apps-pg` as of - 2026-07-10; `make cnpg-backup-status` reports degraded until platform or - operator wiring completes; -- restore status: no app-level restore drill evidence is recorded in this repo. +- **Phase 1 backup lane:** `make apps-pg-backup` uploads encrypted logical dumps + to the platform offsite lane (latest: + `apps-pg-vergabe_db-20260711T231430Z.dump.age`); +- **CNPG barman posture:** `make cnpg-backup-status` still reports degraded — no + `ScheduledBackup` on production clusters as of 2026-07-10; Phase 1 logical + lane satisfies the interim S5 gate per this handoff; +- **restore drill:** isolated restore with row-count gate 195/195 pass + (`docs/evidence/apps-pg-restore-drill-20260711T230725Z.json`); +- **S5 production-trust gate:** **satisfied for Phase 1** — backup + restore + evidence recorded in `docs/evidence/apps-pg-backup-lane-20260711.json`; + app migration smoke on drill DB deferred (row gate sufficient for interim gate). -Minimum evidence before production-trust use: +Evidence index (`RAILIANCE-WP-0013`): -- platform confirms `apps-pg` backup coverage for `vergabe_db`; -- an isolated restore drill proves the database can be restored; -- `vergabe-teilnahme` runs migrations successfully after restore; -- health endpoint and HTTPS smoke checks pass; -- operator verifies the app can complete a representative tender-management - workflow after restore; +| Check | Evidence | +| --- | --- | +| Backup lane auth + upload | `docs/evidence/apps-pg-backup-lane-20260711.json` | +| Isolated restore drill | `docs/evidence/apps-pg-restore-drill-20260711T230725Z.json` | +| Operator commands | `make apps-pg-backup`, `make apps-pg-restore-drill` | + +Remaining before full production-critical promotion (post–Phase 1): + +- `vergabe-teilnahme` migration smoke on restored database; +- health endpoint and HTTPS smoke checks after restore; +- representative tender-management workflow verification; +- CNPG `ScheduledBackup` wiring when platform supplies object-store credentials + (`manifests/cnpg-backup-readiness.yaml`); - any app media path remains disabled or has its own storage restore evidence. ## Forge Artifact Evidence diff --git a/docs/vergabe-teilnahme.md b/docs/vergabe-teilnahme.md index 36ab87a..4166b09 100644 --- a/docs/vergabe-teilnahme.md +++ b/docs/vergabe-teilnahme.md @@ -130,21 +130,33 @@ Investigate with `kubectl describe certificate vergabe-teilnahme-tls `railiance-platform`. S5 owns the app release runbook and post-restore app checks; platform owns the database backup and restore mechanism. -Current status: `apps-pg` backup coverage is still platform follow-up work, so -`vergabe-teilnahme` should not be treated as production-critical data until the -gate in `docs/app-data-backup-restore-handoff.md` is satisfied. +**Phase 1 gate (2026-07-12): satisfied.** Platform logical backup lane and an +isolated restore drill are evidenced under `RAILIANCE-WP-0013`: -Manual logical dump is a break-glass or inspection option, not the durable -backup contract: +| Artifact | Reference | +| --- | --- | +| Backup uploads | `docs/evidence/apps-pg-backup-lane-20260711.json` | +| Restore drill | `docs/evidence/apps-pg-restore-drill-20260711T230725Z.json` | + +Operator commands: + +```bash +make apps-pg-backup # encrypt + upload vergabe_db (+ sibling DBs) +make apps-pg-restore-drill # isolated restore + row-count gate +make cnpg-backup-status # barman ScheduledBackup posture (still degraded) +``` + +CNPG `ScheduledBackup` remains platform follow-up; Phase 1 logical dumps satisfy +the interim gate in `docs/app-data-backup-restore-handoff.md`. Before treating +data as fully production-critical beyond Phase 1, complete post-restore migration +smoke, HTTPS health check, and a representative workflow verification. + +Break-glass manual dump (not the durable contract): ```bash kubectl exec -n databases apps-pg-1 -- pg_dump -U postgres -Fc vergabe_db > vergabe_db-$(date +%F).dump ``` -Before promotion beyond smoke or development use, record platform backup -evidence, an isolated restore drill, migration result, health check, HTTPS -smoke check, and representative app workflow verification. - ## Deferred for v1 - Multi-replica HA (`replicaCount: 1`). diff --git a/workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md b/workplans/archived/260712-RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md similarity index 92% rename from workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md rename to workplans/archived/260712-RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md index 551b77a..7f75998 100644 --- a/workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md +++ b/workplans/archived/260712-RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md @@ -4,11 +4,11 @@ type: workplan title: "CNPG backup wiring and restore drill" domain: financials repo: railiance-apps -status: active +status: finished owner: codex topic_slug: railiance created: "2026-07-10" -updated: "2026-07-11" +updated: "2026-07-12" state_hub_workstream_id: "764c2447-0713-45d5-a14d-810a13027b8b" --- @@ -99,7 +99,7 @@ Phase 1 interim gate). ```task id: RAILIANCE-WP-0013-T05 -status: wait +status: done priority: medium state_hub_task_id: "666c0a9b-4f9b-4ea3-bf0b-14aa76b8ea93" ``` @@ -108,5 +108,7 @@ Update `docs/app-data-backup-restore-handoff.md` and `docs/vergabe-teilnahme.md` with backup/restore evidence references. Mark the S5 gate satisfied only after T02 and T04 evidence exists. -T04 evidence exists; update handoff docs and mark S5 gate when T03 forgejo lane -stable or accepted as platform-owned deferral. \ No newline at end of file +2026-07-12: Handoff docs updated with Phase 1 gate satisfaction, evidence table, +and operator commands. S5 interim production-trust gate marked satisfied; CNPG +barman `ScheduledBackup` remains platform follow-up. All tasks complete — workplan +archived. \ No newline at end of file