railiance-platform/docs/backup-storage-tiers.md

# Backup storage tiers and capacity — 2026-09-06

Design from the user's request to keep Nextcloud essentials-only. This records
capacity and implementation acceptance; it does not change live exclusions,
retention or delete existing good backups.

## Measured capacity

The verified encrypted Forgejo archive is 5,353,024,293 bytes (5.35 GB / 4.99 GiB).
The documented 14 daily + 4 weekly policy requires 96.35 GB / 89.74 GiB for these
18 archives alone, excluding separate SQL dumps, new-upload overlap, object
versions, native PostgreSQL base backups/WAL and all other platform services.
Allow roughly 125–150 GB for this Forgejo full-archive policy with upload overlap
and growth. This is a planning allowance, not measured whole-platform demand or
a provider allocation request. Measure native backup inventory and WAL growth
before setting the platform-wide budget.

Live filesystem allocation (not compressed archive contribution):

| Content | Size | Secondary treatment |
| --- | ---: | --- |
| Git repositories and history | 480 MiB | Keep all repositories, including private repositories and wikis |
| Package blobs | 4.45 GiB | Full copy on primary; independently protect selected essential, non-rebuildable/bootstrap artifacts |
| Last SQL dump | 93 MiB before compression | Keep database metadata; one consistent logical export per generation |
| Generated repository archives | 339 MiB | Regenerate; exclude |
| Actions logs | 45 MiB | Exclude unless a separate audit retention requirement applies |
| Attachments, avatars and configuration | Below 1 MiB currently | Keep; encrypt configuration and preserve custody boundaries |
| LFS / Actions artifacts | No LFS directory observed; Actions artifacts currently negligible | Keep unique LFS and irreplaceable artifacts when present; absence is not permission to discard future data |

Evidence: `evidence/backup-capacity-assessment-2026-09-06.json`.
Package rebuildability has NOT been audited. Storage category alone does not
make an artifact disposable. The live installed Forgejo dump CLI supports
selective exclusions; see the [official command documentation](https://forgejo.org/docs/latest/admin/command-line/).

## Intended division

Scaleway: authoritative full application archives plus native database backups
and WAL. Preserve repository/package/attachment/LFS coverage and prove retrieval
and combined application recovery under WP-0038-T04 before reducing the secondary
archive scope. Different archive and Barman prefixes remain required.

Nextcloud: an independently recoverable essentials copy. Retain source/history,
issues/PRs/users/settings in the database, unique attachments/LFS/custom files,
and an encrypted recovery manifest. Retain necessary deployment definitions,
small essential platform logical exports and protected OpenBao snapshot material
under their owning contracts. Keep the decryption/unseal custody independently
available; do not put the only recovery key inside its own encrypted backup.

Exclude regenerable indexes, archive caches, temporary files and unneeded build
logs. Bulk package/OCI content remains on the full primary. Selectively retain
or independently mirror exact bootstrap images and irreplaceable release assets;
prove their availability without the production Forgejo registry or Scaleway.
The manifest must state omissions, artifact digests and rebuild/restore steps.
A secondary-only restore may recover source and collaboration while package
service remains unavailable; test and document that degraded behavior explicitly.

## Candidate 10 GiB Nextcloud budget

Target at most 600 MiB per compressed encrypted Forgejo essentials generation.
Repositories plus SQL currently total about 573 MiB before compression, but this
is an estimate: a real essentials capture and restore must establish actual size.

- Seven daily + two weekly distinct recovery points: at most 5.27 GiB.
- One incoming generation while the previous good copy remains: 0.59 GiB.
- Other service essentials and selective bootstrap material: 2 GiB provisional.
- Headroom for growth and provider accounting: 2 GiB.

Total: approximately 9.86 GiB. The other-service/bootstrap allocation is unmeasured;
if it does not fit, shorten retention or adjust the allocation explicitly. Do not
silently exclude unique data to meet the target. A weekly label may reference
an existing retained generation instead of uploading Sunday's bytes twice.

The current uploader is create-only. Retention requires a separate bounded owner
executor; do not give workload jobs the Backup account password or general delete
access. Verify the new object and recovery manifest before retiring old points.
Use exact managed names, concurrency control and conditional deletion; account
for trash/version retention and recheck actual free bytes. Stop before upload
when overlap/headroom cannot be met. Never delete the last verified recovery point.

## Implementation acceptance in WP-0038-T04

1. Complete primary full-archive delivery and recovery with explicit storage and
   credential-delivery ownership.
2. Audit package/bootstrap dependencies and measure other service essentials.
3. Capture an explicit essentials profile and inventory, preserving unique data;
   retain the full backup path and record included/excluded categories.
4. Restore with primary storage unavailable; verify Git, issues/users, unique
   attachments and declared package limitations/bootstrap availability.
5. Implement the separate bounded retention executor and space preflight. Demonstrate
   upload overlap, failed-upload preservation and safe expiration within 10 GiB.
6. Switch scheduled secondary delivery only after these gates pass. Preserve the
   current good full Nextcloud copy until a verified replacement permits retirement.