a3ca4b708f
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
57 lines
4.2 KiB
Markdown
57 lines
4.2 KiB
Markdown
# Backup provider coverage — 2026-09-06
|
|
|
|
Primary: Scaleway Standard Multi-AZ, nl-ams, per RESOURCE-WP-0002 and the
|
|
operator's confirmation. Independent secondary: governed Nextcloud account
|
|
Backup, 10 GiB quota. Provider selection does not establish asset coverage.
|
|
|
|
| Asset | Verified primary configuration | Secondary / remaining gap |
|
|
| --- | --- | --- |
|
|
| apps-pg | Scaleway Barman base backups + WAL, `platform-pg/apps-pg/` | Fresh isolated physical restore passed in 42.64 seconds; Nextcloud logical copy is separate |
|
|
| platform-pg | Scaleway Barman base backups + WAL, `platform-pg/` | Earlier package restore evidence; independent logical Nextcloud copy |
|
|
| platform-pg-2 | Scaleway Barman base backups + WAL, `platform-pg/platform-pg-2/` | Earlier package restore evidence; independent logical Nextcloud copy |
|
|
| forgejo-db | Scaleway Barman base backups + WAL, `platform-pg/forgejo-db/`; daily 02:35 UTC, 30-day retention | Fresh isolated physical restore passed in 45.08 seconds; full archive coverage remains separate |
|
|
| Forgejo repositories/packages/blobs | Full archive at `platform-pg/application-archives/forgejo/`; retrieved full-application recovery passed | Full secondary copy preserved; new 273 MiB essentials copy also passed isolated reduced recovery. Scheduled tier cutover remains pending. |
|
|
| net-kingdom-pg / state-hub-db | No native Barman destination observed | Do not infer protection from the shared cells' healthy backup status |
|
|
| OpenBao / S1 host configuration | Not evaluated by this database restore | Their own encrypted snapshot/host backup and recovery contracts still apply |
|
|
|
|
All three configured cells reported successful 2026-09-05 02:15 UTC backups.
|
|
The fresh apps-pg restore consumed the existing Scaleway base backup and WAL in
|
|
a unique scratch namespace, imported only the existing S3 credential fields in
|
|
captured memory, preserved expected databases and connection limits, left
|
|
production Ready and removed the namespace. This proves physical database
|
|
recovery; it does not prove application workflows, PITR targets, or Forgejo
|
|
recovery. Evidence: `docs/evidence/scaleway-primary-restore-2026-09-06.json`.
|
|
|
|
## Forgejo primary extension requirements
|
|
|
|
The existing bucket policy permits the runtime identity only under
|
|
`platform-pg/*`. Do not put unrelated archive objects in a Barman server directory
|
|
or assume a top-level `forgejo/` prefix is permitted. Before extending coverage:
|
|
|
|
1. Accept an exact independent archive prefix and storage/retention contract
|
|
with reef-storage/resource-control; distinguish it from native database WAL.
|
|
2. Use the scoped backup runtime identity, never the Scaleway bootstrap key.
|
|
Review its delivery to the scheduled archive uploader. The current approved
|
|
ExternalSecret destination is in `databases`; activity-core must not inherit
|
|
write credentials through an undocumented namespace expansion.
|
|
3. Use a streaming multipart S3 uploader for growing archives, with abort/cleanup
|
|
and immutable object naming. Verify completion and content, then recover by
|
|
GET from Scaleway into the isolated Forgejo procedure.
|
|
4. Native forgejo-db Barman coverage and isolated recovery are complete in
|
|
RPF-WP-0038-T02/T03. See `docs/evidence/forgejo-scaleway-restore-2026-09-06.json`.
|
|
5. Record provider-native retention and primary failure reporting separately
|
|
from the 10 GiB secondary budget. No retained backup deletion is implicit.
|
|
|
|
WP-0029 remains the secondary credential incident: old Bernd-share invalidation
|
|
and replacement recovery. The full primary coverage gap belongs to S3 assurance
|
|
(RPF-WP-0036-T03), with forge requirements and package/storage-owner inputs.
|
|
|
|
RPF-WP-0038-T04 tracks the remaining primary full-archive delivery and application
|
|
recovery contract. Native database recovery verified 142 repository records,
|
|
six users and 2,040 package blob records; it did not recover the blob files.
|
|
|
|
Secondary full recovery evidence is
|
|
`docs/evidence/RPF-WP-0029-secondary-restore-2026-09-06.json`. Immediate quota
|
|
after rejected-fixture cleanup still reported 5.23 GB free versus the 5.35 GB
|
|
current archive. Recheck quota before another upload and establish bounded
|
|
retention/capacity; the 10 GiB account is not an indefinite archive store.
|