From 559d322d10e29ea8819b44a102b0a32c77bdff74 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Mon, 10 Aug 2026 17:46:09 +0200 Subject: [PATCH] chore(consistency): renormalize lifecycle state [auto] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Updated by fix-consistency on 2026-08-10: - workplan status: ready → active --- ...WP-0002-procure-postgres-backup-storage.md | 251 ++++++++++++++++++ 1 file changed, 251 insertions(+) create mode 100644 workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md diff --git a/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md new file mode 100644 index 0000000..8a19e14 --- /dev/null +++ b/workplans/RESOURCE-WP-0002-procure-postgres-backup-storage.md @@ -0,0 +1,251 @@ +--- +id: RESOURCE-WP-0002 +type: workplan +title: "Procure and operationalize PostgreSQL backup object storage" +domain: financials +repo: resource-control +status: active +owner: codex +topic_slug: railiance +created: "2026-08-10" +updated: "2026-08-10" +state_hub_workstream_id: "921496a3-280b-4dc8-a3c0-b4ec314142f5" +--- + +# RESOURCE-WP-0002 — procure PostgreSQL backup storage + +## Goal + +Provide an off-host object-storage resource for `rapp-postgres` continuous WAL +archiving and physical base backups, and prove that it supports both full +recovery and point-in-time recovery (PITR). Record the resource, its real cost, +utilization, failure domain, contract, and exit path so fin-hub can incorporate +it into burn rate and resource-control can continuously test whether another +provider or procurement model is more attractive. + +The candidate provider baseline is: + +- **A — Host Europe** +- **B — Scaleway** +- **C — Hetzner** + +This workplan chooses on evidence. It does not presume that keeping compute and +backup at one provider is cheaper or safer. + +## Context and current evidence + +`rapp-postgres` has deployed `platform-pg` on reef-railiance at Host Europe. +Its workplan requires continuous WAL archiving, scheduled physical backups, a +30-day recovery window, and timed full/PITR restore drills. + +Host Europe's **Backup Storage** is reachable by FTP, SCP, SFTP, and rsync. It +is suitable for an encrypted secondary logical-backup copy but is not directly +usable by CloudNativePG's Barman object-store integration. Host Europe also +publishes an older Cloud Storage specification describing an S3-compatible +service; current orderability, endpoint, features, support, and price must be +confirmed rather than inferred from that document. + +Scaleway offers S3-compatible Object Storage in European regions, including a +Multi-AZ tier with usage-based storage pricing. Hetzner offers S3-compatible +Object Storage in Nuremberg, Falkenstein, and Helsinki with a monthly base +price including 1 TB storage and egress. Exact effective prices are recorded at +decision time, not copied permanently from changing marketing pages. + +Primary references: + +- Host Europe Backup Storage: + `https://www.hosteurope.de/faq/server/virtual-server/backup-storage` +- Host Europe published Cloud Storage specification: + `https://www.hosteurope.de/download/PVL/Preis_und_Leistungsverzeichnis_CloudStorage_1-0-1.pdf` +- Scaleway storage pricing: `https://www.scaleway.com/en/pricing/storage/` +- Hetzner Object Storage: + `https://www.hetzner.com/de/storage/object-storage/` +- CNPG 1.25 object-store requirements: + `https://cloudnative-pg.io/docs/1.25/appendixes/object_stores/` + +## Boundaries + +This workplan owns requirements, comparison, procurement evidence, resource +registration, cost/utilization monitoring, and proof that the purchased +resource works. + +- Human financial authority approves purchase and accepts contractual terms. +- `railiance-platform` owns provider credential custody and the approved + Kubernetes Secret/credential-broker delivery. +- `rapp-postgres` owns CNPG manifests, schedules, retention configuration, and + restore procedure. +- `fin-hub` owns budget, burn-rate, runway, and viability signals. + +No access key, secret, payment instrument, or credential-bearing endpoint may +be committed to this repository or sent through State Hub. + +## Acceptance requirements + +The selected resource must provide: + +- S3-compatible HTTPS endpoint accepted by the live CNPG/Barman version +- AWS Signature V4 and scoped access keys +- private buckets, multipart upload, list/get/put/delete operations +- versioning and lifecycle/retention controls, or a documented equivalent +- encryption in transit and at rest +- EU data location with provider and region recorded +- failure-domain analysis relative to reef-railiance +- at least 100 GiB initial usable capacity without a long commitment +- daily physical base backups and continuous WAL archive support +- target RPO no worse than five minutes and initially measured RTO +- export/delete path and credential revocation at exit +- monthly price and usage evidence attributable to `platform:audit-storage` + +Object lock is desirable, but compatibility with CNPG retention deletion must +be tested before it becomes mandatory. Same-provider placement is allowed only +with an explicit correlated-failure decision and an independent second copy. + +## T01 — Establish demand and cost model + +```task +id: RESOURCE-WP-0002-T01 +status: todo +priority: high +state_hub_task_id: "f578a9ec-dbdb-4b26-93bc-e53f7bc87ad1" +``` + +Measure the current `platform-pg` database size, daily WAL generation, expected +growth, restore-test traffic, and retention requirement. Build low/base/high +12-month forecasts. Normalize each provider into monthly storage, ingress, +egress, operations, minimum charge, tax, support, commitment, and estimated +operator-labor cost. + +Include the cost of one monthly restore drill and one complete provider exit. +Do not compare only advertised price per GB. + +Done when the demand forecast and cost model can calculate effective monthly +cost for A, B, and C under the same scenarios. + +## T02 — Complete provider due diligence + +```task +id: RESOURCE-WP-0002-T02 +status: todo +priority: high +state_hub_task_id: "6dedb8db-c08f-4b58-90f2-32b1ea832d98" +``` + +For Host Europe, obtain current written confirmation of whether its +S3-compatible Cloud Storage can be ordered for this account, plus endpoint, +region, Signature V4, versioning, lifecycle, durability, availability, support, +current price, and cancellation terms. Treat SFTP Backup Storage as a separate +secondary-copy product. + +For Scaleway and Hetzner, collect the same facts from current primary sources. +Record data location, durability/availability statements, minimum billing, +traffic rules, API limitations, credential granularity, versioning, lifecycle, +object-lock behavior, and provider status visibility. + +Done when every acceptance requirement has evidence, `unknown`, or a blocking +answer for each provider—no blank cells and no marketing inference. + +## T03 — Select and procure the primary resource + +```task +id: RESOURCE-WP-0002-T03 +status: wait +priority: high +state_hub_task_id: "e4184350-dab2-4a0b-bee5-1a641e8a2df3" +``` + +Produce a decision record ranking the three providers on total cost, +compatibility, resilience, sovereignty, operational effort, and exit cost. +Recommend one primary and one independent secondary-copy path. + +Human financial authority approves the purchase and contractual terms. Create +the account/project/bucket with public access disabled, the narrowest practical +service identity, versioning/lifecycle settings, cost alerts, and an owner. + +Done when the decision is approved and the purchased resource has a non-secret +inventory record with provider resource ID, region, service class, contract, +renewal/cancellation dates, capacity model, owner, and cost-attribution key. + +## T04 — Establish credential custody and hand off to rapp-postgres + +```task +id: RESOURCE-WP-0002-T04 +status: wait +priority: high +state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a" +``` + +Route the scoped bucket credential to `railiance-platform` through the approved +OpenBao/credential-broker lane. Permit only the bucket/prefix operations CNPG +requires. Keep credential values out of Git, State Hub, shell history, logs, +and chat. + +Hand the non-secret endpoint, bucket/prefix, region, CA/TLS requirements, and +retention parameters to `rapp-postgres`. Verify Barman's empty-WAL-archive check +before enabling continuous archiving. + +Done when credential delivery is renewable/revocable, a negative credential +cannot access the bucket, and `rapp-postgres` can perform the storage preflight +without disclosing a value. + +## T05 — Prove backup, full restore, and PITR + +```task +id: RESOURCE-WP-0002-T05 +status: wait +priority: high +state_hub_task_id: "693953bf-f223-484b-b835-41369f5d2a02" +``` + +Enable continuous WAL archiving and daily base backups. Confirm archive health, +backup age, object growth, retention behavior, and alerts. Then: + +1. Restore the latest physical backup to a scratch CNPG cluster and compare + per-database counts/checksums. +2. Create a restore point, write a marker, record a target time, perform a + destructive change, and restore to immediately before that change. +3. Record measured RPO, full-restore RTO, PITR RTO, bytes transferred, and + provider charges. +4. Delete scratch resources only after evidence is durable. + +Done when both restores are verified and timed. A successful upload alone is +not backup acceptance. + +## T06 — Establish the independent logical-copy lane + +```task +id: RESOURCE-WP-0002-T06 +status: todo +priority: medium +state_hub_task_id: "76745e5b-a0eb-43b5-a6b7-9d19c06f6110" +``` + +Retain encrypted per-database logical dumps outside the primary object-storage +failure domain, using Host Europe Backup Storage or the existing governed +Nextcloud lane as justified by the final provider choice. Test a single-consumer +logical restore. + +Done when one primary-object-store failure or credential loss does not remove +both recovery copies, and audit-core can be restored independently through the +slower logical path. + +## T07 — Feed fin-hub and operate the optimization loop + +```task +id: RESOURCE-WP-0002-T07 +status: todo +priority: medium +state_hub_task_id: "e6c848ce-ea4b-4ac6-99da-5890de242b50" +``` + +Publish monthly actual cost, forecast, stored bytes, WAL/base-backup growth, +egress, backup success, and restore-test cost under +`platform:audit-storage`. Set thresholds for budget variance, abnormal growth, +stale backups, and unused commitment. + +Re-evaluate A/B/C at least quarterly and before renewal. A switch recommendation +must include migration traffic, overlap period, operator labor, restore proof, +contract timing, and credential revocation—not only a cheaper unit price. + +Done when fin-hub receives normalized evidence and resource-control can identify +rightsizing or provider-switch opportunities from observed utilization and +total cost.