5567fa979e
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
76 lines
4.6 KiB
Markdown
76 lines
4.6 KiB
Markdown
# Backup problem follow-up — 2026-09-06
|
|
|
|
The attended-login failures were caused by missing Linux browser launchers on
|
|
this WSL host. The installed Bao browser dependency tries `xdg-open`,
|
|
`x-www-browser` and `www-browser`; none was installed. The unauthenticated OIDC
|
|
routing probe returned the expected Keycloak host and localhost callback.
|
|
Implemented a narrowly validated, repository-scoped Windows browser bridge
|
|
and retained Warden's contained credential session. The replacement login
|
|
reached the silent owner command and began the real secondary archive transfer.
|
|
The 5,353,024,293-byte encrypted archive uploaded with HTTP 201, downloaded
|
|
with HTTP 200 and matched the source ciphertext hash. Decryption matched the
|
|
validated source archive hash. Warden exited 0 after its contained session,
|
|
including its self-revocation/cleanup path. The isolated application recovery
|
|
is recorded separately below.
|
|
|
|
Forgejo's native PostgreSQL backup is now active on the primary Scaleway bucket
|
|
at `platform-pg/forgejo-db/`, using the existing CCR-2026-0012 backup identity.
|
|
No IAM expansion or new credential delivery was needed. A resource-version
|
|
guarded patch changed only the live backup field; source manifests include
|
|
HTTPS/DNS egress, daily 02:35 UTC base backup, WAL archiving and 30-day retention.
|
|
The fresh backup completed with production Ready and continuous archiving.
|
|
|
|
An isolated Scaleway recovery became ready in 45.08 seconds and preserved
|
|
142 repository records, six users and 2,040 package blob records. Production
|
|
remained Ready and the scratch namespace was removed. These are database
|
|
records, not recovered repository/package files. WP-0038-T01/T02/T03 are done.
|
|
T04 retains the separate full-archive primary delivery and application recovery
|
|
contract; WP-0029 retains the secondary incident and predecessor invalidation.
|
|
|
|
Evidence:
|
|
|
|
- `docs/evidence/forgejo-scaleway-activation-2026-09-06.json`
|
|
- `docs/evidence/forgejo-scaleway-restore-2026-09-06.json`
|
|
|
|
All 204 repository tests passed after the browser fix and generalized primary
|
|
restore helper. The live primary recovery additionally verified that helper
|
|
against the new Forgejo Barman destination.
|
|
|
|
The first two isolated application attempts stopped in database import; both
|
|
removed their temporary resources. The first did not record a precise failure
|
|
cause. Increasing the timeout and importing the 97 MB INSERT-based SQL dump
|
|
in one transaction did not resolve the second attempt's psql connection exit
|
|
(code 2). Inspection of the pinned PostgreSQL image confirmed its initialization
|
|
server listens only on a Unix socket and then shuts down. The old socket-based
|
|
readiness probe could accept that temporary server. Changed readiness to the
|
|
final TCP listener, then retained trusted local-socket import inside the
|
|
disposable container. The helper now records fixed failure categories without
|
|
printing SQL, application rows or captured diagnostics.
|
|
|
|
The corrected full application recovery PASSED from the actual Nextcloud
|
|
download. Forgejo started healthy with 142 repository records, six users and
|
|
2,040 package blob records. Public repositories coulomb/key-cape and
|
|
coulomb/adaptive-pricing both cloned over the isolated HTTP endpoint and passed
|
|
`git fsck --full`. Every one of the 2,040 stored package blobs matched its
|
|
database SHA-256 digest. Disposable containers, network and extracted staging
|
|
were removed. This verifies startup, sampled Git delivery and all blob bytes;
|
|
it does not claim every package installation workflow, runner recovery, or
|
|
production failover. All 207 repository tests passed.
|
|
|
|
Evidence: `docs/evidence/RPF-WP-0029-secondary-transfer-2026-09-06.json` and
|
|
`docs/evidence/RPF-WP-0029-secondary-restore-2026-09-06.json`.
|
|
|
|
WP-0029-T02 now retains only the old Bernd-owned share invalidation/custody
|
|
receipt. Its replacement full-application recovery requirement is satisfied.
|
|
The exposed recovery-key history remains; upload-account replacement does not
|
|
clear it. Primary full-archive delivery remains WP-0038-T04.
|
|
|
|
The exact rejected September 4 drill copy was conditionally deleted by its
|
|
size and strong ETag after replacement recovery (HTTP 204). Warden exited 0.
|
|
The temporary fetched plaintext ZIP was removed; good encrypted backups were
|
|
preserved. Immediate Nextcloud quota metadata still reported 5,234,716,518
|
|
bytes free, less than this 5,353,024,293-byte artifact. Do not infer freed quota
|
|
from DELETE or promise another full upload will fit. Recheck provider quota and
|
|
agree archive retention/capacity within the existing owner contract. No retained
|
|
good backup or personal-account share was deleted.
|
|
Evidence: `docs/evidence/RPF-WP-0029-rejected-fixture-cleanup-2026-09-06.json`.
|