k1nq
d582f15681
- Implemented tests for import polling functionality, ensuring correct behavior for active and terminal import statuses. - Created tests for the login page, validating user interactions and error handling. - Added unit tests for money utility functions, covering parsing, formatting, and summation of monetary values. - Developed tests for query keys, ensuring proper scoping and invalidation roots. chore: setup testing environment and configuration - Added setup file for testing with Vitest and Testing Library. - Configured TypeScript and Vite for the frontend project. - Created Docker and Nginx configurations for local development and production environments. - Established a PostgreSQL initialization script for setting up application roles. docs: add README and environment configuration for infra - Included README for the infra directory, detailing local development setup and service descriptions. - Created an example environment configuration file for local development with placeholders for sensitive information.
2.1 KiB
2.1 KiB
Backup and Restore
Status: design/runbook. The stack is not deployed yet; no restore has been performed. Do not treat these targets as verified until a drill passes.
Scope and targets (proposed)
| Item | Method | Retention | RPO target |
|---|---|---|---|
| PostgreSQL | Provider-native PITR if available; else nightly pg_dump -Fc, encrypted at rest |
30 days | ≤ 24 h |
| Object storage (statement files) | Provider versioning/replication of the bucket | 30 days | ≤ 24 h |
| KEK / secrets | Secret-manager backup per provider policy | indefinite | ~0 (loss = data loss) |
| Redis | none — cache/queue only, rebuilt on restore | — | acceptable loss |
| Container images | registry retained per release tag | last 10 releases | — |
Statement files are envelope-encrypted (ADR 0004): restoring PostgreSQL without the matching DEK rows and the KEK makes files permanently undecryptable. KEK backup is therefore mandatory and must be tested like a restore.
Restore procedure (draft)
- Provision replacement PostgreSQL/Redis/S3 endpoints in the RF region.
- Restore the latest PostgreSQL backup into the new instance; run
alembic upgrade headto confirm schema state matches the deployed image. - Restore the object bucket from versioning/replica.
- Restore secrets: KEK,
SESSION_SECRET, DB/S3/SMTP credentials. - Deploy the last known-good image tags (API, worker, frontend proxy) with the restored endpoints configured.
- Re-apply the durable deletion ledger for entries executed after the backup timestamp (see
deletion-ledger.md): re-delete purged rows/objects and re-shred DEKs. - Smoke test:
/healthzon API, queue consumer alive, one synthetic import end-to-end, login with an invited test user. - Reopen traffic at the edge.
Restore drill
- Cadence: before beta launch, then quarterly.
- Record in this file: date, backup age, result, defects found.
- Drills performed: none yet.
A disaster test is a launch gate (plan §10): restore a backup, reapply the completed deletion ledger, and prove purged spaces/keys remain inaccessible.