251 lines
9.8 KiB
Markdown
251 lines
9.8 KiB
Markdown
---
|
|
id: RESOURCE-WP-0002
|
|
type: workplan
|
|
title: "Procure and operationalize PostgreSQL backup object storage"
|
|
domain: financials
|
|
repo: resource-control
|
|
status: active
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-10"
|
|
updated: "2026-08-10"
|
|
state_hub_workstream_id: "921496a3-280b-4dc8-a3c0-b4ec314142f5"
|
|
---
|
|
|
|
# RESOURCE-WP-0002 — procure PostgreSQL backup storage
|
|
|
|
## Goal
|
|
|
|
Provide an off-host object-storage resource for `rapp-postgres` continuous WAL
|
|
archiving and physical base backups, and prove that it supports both full
|
|
recovery and point-in-time recovery (PITR). Record the resource, its real cost,
|
|
utilization, failure domain, contract, and exit path so fin-hub can incorporate
|
|
it into burn rate and resource-control can continuously test whether another
|
|
provider or procurement model is more attractive.
|
|
|
|
The candidate provider baseline is:
|
|
|
|
- **A — Host Europe**
|
|
- **B — Scaleway**
|
|
- **C — Hetzner**
|
|
|
|
This workplan chooses on evidence. It does not presume that keeping compute and
|
|
backup at one provider is cheaper or safer.
|
|
|
|
## Context and current evidence
|
|
|
|
`rapp-postgres` has deployed `platform-pg` on reef-railiance at Host Europe.
|
|
Its workplan requires continuous WAL archiving, scheduled physical backups, a
|
|
30-day recovery window, and timed full/PITR restore drills.
|
|
|
|
Host Europe's **Backup Storage** is reachable by FTP, SCP, SFTP, and rsync. It
|
|
is suitable for an encrypted secondary logical-backup copy but is not directly
|
|
usable by CloudNativePG's Barman object-store integration. Host Europe also
|
|
publishes an older Cloud Storage specification describing an S3-compatible
|
|
service; current orderability, endpoint, features, support, and price must be
|
|
confirmed rather than inferred from that document.
|
|
|
|
Scaleway offers S3-compatible Object Storage in European regions, including a
|
|
Multi-AZ tier with usage-based storage pricing. Hetzner offers S3-compatible
|
|
Object Storage in Nuremberg, Falkenstein, and Helsinki with a monthly base
|
|
price including 1 TB storage and egress. Exact effective prices are recorded at
|
|
decision time, not copied permanently from changing marketing pages.
|
|
|
|
Primary references:
|
|
|
|
- Host Europe Backup Storage:
|
|
`https://www.hosteurope.de/faq/server/virtual-server/backup-storage`
|
|
- Host Europe published Cloud Storage specification:
|
|
`https://www.hosteurope.de/download/PVL/Preis_und_Leistungsverzeichnis_CloudStorage_1-0-1.pdf`
|
|
- Scaleway storage pricing: `https://www.scaleway.com/en/pricing/storage/`
|
|
- Hetzner Object Storage:
|
|
`https://www.hetzner.com/de/storage/object-storage/`
|
|
- CNPG 1.25 object-store requirements:
|
|
`https://cloudnative-pg.io/docs/1.25/appendixes/object_stores/`
|
|
|
|
## Boundaries
|
|
|
|
This workplan owns requirements, comparison, procurement evidence, resource
|
|
registration, cost/utilization monitoring, and proof that the purchased
|
|
resource works.
|
|
|
|
- Human financial authority approves purchase and accepts contractual terms.
|
|
- `railiance-platform` owns provider credential custody and the approved
|
|
Kubernetes Secret/credential-broker delivery.
|
|
- `rapp-postgres` owns CNPG manifests, schedules, retention configuration, and
|
|
restore procedure.
|
|
- `fin-hub` owns budget, burn-rate, runway, and viability signals.
|
|
|
|
No access key, secret, payment instrument, or credential-bearing endpoint may
|
|
be committed to this repository or sent through State Hub.
|
|
|
|
## Acceptance requirements
|
|
|
|
The selected resource must provide:
|
|
|
|
- S3-compatible HTTPS endpoint accepted by the live CNPG/Barman version
|
|
- AWS Signature V4 and scoped access keys
|
|
- private buckets, multipart upload, list/get/put/delete operations
|
|
- versioning and lifecycle/retention controls, or a documented equivalent
|
|
- encryption in transit and at rest
|
|
- EU data location with provider and region recorded
|
|
- failure-domain analysis relative to reef-railiance
|
|
- at least 100 GiB initial usable capacity without a long commitment
|
|
- daily physical base backups and continuous WAL archive support
|
|
- target RPO no worse than five minutes and initially measured RTO
|
|
- export/delete path and credential revocation at exit
|
|
- monthly price and usage evidence attributable to `platform:audit-storage`
|
|
|
|
Object lock is desirable, but compatibility with CNPG retention deletion must
|
|
be tested before it becomes mandatory. Same-provider placement is allowed only
|
|
with an explicit correlated-failure decision and an independent second copy.
|
|
|
|
## T01 — Establish demand and cost model
|
|
|
|
```task
|
|
id: RESOURCE-WP-0002-T01
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "f578a9ec-dbdb-4b26-93bc-e53f7bc87ad1"
|
|
```
|
|
|
|
Measure the current `platform-pg` database size, daily WAL generation, expected
|
|
growth, restore-test traffic, and retention requirement. Build low/base/high
|
|
12-month forecasts. Normalize each provider into monthly storage, ingress,
|
|
egress, operations, minimum charge, tax, support, commitment, and estimated
|
|
operator-labor cost.
|
|
|
|
Include the cost of one monthly restore drill and one complete provider exit.
|
|
Do not compare only advertised price per GB.
|
|
|
|
Done when the demand forecast and cost model can calculate effective monthly
|
|
cost for A, B, and C under the same scenarios.
|
|
|
|
## T02 — Complete provider due diligence
|
|
|
|
```task
|
|
id: RESOURCE-WP-0002-T02
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "6dedb8db-c08f-4b58-90f2-32b1ea832d98"
|
|
```
|
|
|
|
For Host Europe, obtain current written confirmation of whether its
|
|
S3-compatible Cloud Storage can be ordered for this account, plus endpoint,
|
|
region, Signature V4, versioning, lifecycle, durability, availability, support,
|
|
current price, and cancellation terms. Treat SFTP Backup Storage as a separate
|
|
secondary-copy product.
|
|
|
|
For Scaleway and Hetzner, collect the same facts from current primary sources.
|
|
Record data location, durability/availability statements, minimum billing,
|
|
traffic rules, API limitations, credential granularity, versioning, lifecycle,
|
|
object-lock behavior, and provider status visibility.
|
|
|
|
Done when every acceptance requirement has evidence, `unknown`, or a blocking
|
|
answer for each provider—no blank cells and no marketing inference.
|
|
|
|
## T03 — Select and procure the primary resource
|
|
|
|
```task
|
|
id: RESOURCE-WP-0002-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "e4184350-dab2-4a0b-bee5-1a641e8a2df3"
|
|
```
|
|
|
|
Produce a decision record ranking the three providers on total cost,
|
|
compatibility, resilience, sovereignty, operational effort, and exit cost.
|
|
Recommend one primary and one independent secondary-copy path.
|
|
|
|
Human financial authority approves the purchase and contractual terms. Create
|
|
the account/project/bucket with public access disabled, the narrowest practical
|
|
service identity, versioning/lifecycle settings, cost alerts, and an owner.
|
|
|
|
Done when the decision is approved and the purchased resource has a non-secret
|
|
inventory record with provider resource ID, region, service class, contract,
|
|
renewal/cancellation dates, capacity model, owner, and cost-attribution key.
|
|
|
|
## T04 — Establish credential custody and hand off to rapp-postgres
|
|
|
|
```task
|
|
id: RESOURCE-WP-0002-T04
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "a2dc370a-b5e7-44b1-b46a-f3b84815b14a"
|
|
```
|
|
|
|
Route the scoped bucket credential to `railiance-platform` through the approved
|
|
OpenBao/credential-broker lane. Permit only the bucket/prefix operations CNPG
|
|
requires. Keep credential values out of Git, State Hub, shell history, logs,
|
|
and chat.
|
|
|
|
Hand the non-secret endpoint, bucket/prefix, region, CA/TLS requirements, and
|
|
retention parameters to `rapp-postgres`. Verify Barman's empty-WAL-archive check
|
|
before enabling continuous archiving.
|
|
|
|
Done when credential delivery is renewable/revocable, a negative credential
|
|
cannot access the bucket, and `rapp-postgres` can perform the storage preflight
|
|
without disclosing a value.
|
|
|
|
## T05 — Prove backup, full restore, and PITR
|
|
|
|
```task
|
|
id: RESOURCE-WP-0002-T05
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "693953bf-f223-484b-b835-41369f5d2a02"
|
|
```
|
|
|
|
Enable continuous WAL archiving and daily base backups. Confirm archive health,
|
|
backup age, object growth, retention behavior, and alerts. Then:
|
|
|
|
1. Restore the latest physical backup to a scratch CNPG cluster and compare
|
|
per-database counts/checksums.
|
|
2. Create a restore point, write a marker, record a target time, perform a
|
|
destructive change, and restore to immediately before that change.
|
|
3. Record measured RPO, full-restore RTO, PITR RTO, bytes transferred, and
|
|
provider charges.
|
|
4. Delete scratch resources only after evidence is durable.
|
|
|
|
Done when both restores are verified and timed. A successful upload alone is
|
|
not backup acceptance.
|
|
|
|
## T06 — Establish the independent logical-copy lane
|
|
|
|
```task
|
|
id: RESOURCE-WP-0002-T06
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "76745e5b-a0eb-43b5-a6b7-9d19c06f6110"
|
|
```
|
|
|
|
Retain encrypted per-database logical dumps outside the primary object-storage
|
|
failure domain, using Host Europe Backup Storage or the existing governed
|
|
Nextcloud lane as justified by the final provider choice. Test a single-consumer
|
|
logical restore.
|
|
|
|
Done when one primary-object-store failure or credential loss does not remove
|
|
both recovery copies, and audit-core can be restored independently through the
|
|
slower logical path.
|
|
|
|
## T07 — Feed fin-hub and operate the optimization loop
|
|
|
|
```task
|
|
id: RESOURCE-WP-0002-T07
|
|
status: todo
|
|
priority: medium
|
|
state_hub_task_id: "e6c848ce-ea4b-4ac6-99da-5890de242b50"
|
|
```
|
|
|
|
Publish monthly actual cost, forecast, stored bytes, WAL/base-backup growth,
|
|
egress, backup success, and restore-test cost under
|
|
`platform:audit-storage`. Set thresholds for budget variance, abnormal growth,
|
|
stale backups, and unused commitment.
|
|
|
|
Re-evaluate A/B/C at least quarterly and before renewal. A switch recommendation
|
|
must include migration traffic, overlap period, operator labor, restore proof,
|
|
contract timing, and credential revocation—not only a cheaper unit price.
|
|
|
|
Done when fin-hub receives normalized evidence and resource-control can identify
|
|
rightsizing or provider-switch opportunities from observed utilization and
|
|
total cost.
|