k1nq
d582f15681
- Implemented tests for import polling functionality, ensuring correct behavior for active and terminal import statuses. - Created tests for the login page, validating user interactions and error handling. - Added unit tests for money utility functions, covering parsing, formatting, and summation of monetary values. - Developed tests for query keys, ensuring proper scoping and invalidation roots. chore: setup testing environment and configuration - Added setup file for testing with Vitest and Testing Library. - Configured TypeScript and Vite for the frontend project. - Created Docker and Nginx configurations for local development and production environments. - Established a PostgreSQL initialization script for setting up application roles. docs: add README and environment configuration for infra - Included README for the infra directory, detailing local development setup and service descriptions. - Created an example environment configuration file for local development with placeholders for sensitive information.
39 lines
2.1 KiB
Markdown
39 lines
2.1 KiB
Markdown
# Backup and Restore
|
|
|
|
> Status: **design/runbook**. The stack is not deployed yet; no restore has been
|
|
> performed. Do not treat these targets as verified until a drill passes.
|
|
|
|
## Scope and targets (proposed)
|
|
|
|
| Item | Method | Retention | RPO target |
|
|
| --- | --- | --- | --- |
|
|
| PostgreSQL | Provider-native PITR if available; else nightly `pg_dump -Fc`, encrypted at rest | 30 days | ≤ 24 h |
|
|
| Object storage (statement files) | Provider versioning/replication of the bucket | 30 days | ≤ 24 h |
|
|
| KEK / secrets | Secret-manager backup per provider policy | indefinite | ~0 (loss = data loss) |
|
|
| Redis | none — cache/queue only, rebuilt on restore | — | acceptable loss |
|
|
| Container images | registry retained per release tag | last 10 releases | — |
|
|
|
|
Statement files are envelope-encrypted (ADR 0004): restoring PostgreSQL without
|
|
the matching DEK rows **and** the KEK makes files permanently undecryptable. KEK
|
|
backup is therefore mandatory and must be tested like a restore.
|
|
|
|
## Restore procedure (draft)
|
|
|
|
1. Provision replacement PostgreSQL/Redis/S3 endpoints in the RF region.
|
|
2. Restore the latest PostgreSQL backup into the new instance; run `alembic upgrade head` to confirm schema state matches the deployed image.
|
|
3. Restore the object bucket from versioning/replica.
|
|
4. Restore secrets: KEK, `SESSION_SECRET`, DB/S3/SMTP credentials.
|
|
5. Deploy the last known-good image tags (API, worker, frontend proxy) with the restored endpoints configured.
|
|
6. **Re-apply the durable deletion ledger** for entries executed after the backup timestamp (see `deletion-ledger.md`): re-delete purged rows/objects and re-shred DEKs.
|
|
7. Smoke test: `/healthz` on API, queue consumer alive, one synthetic import end-to-end, login with an invited test user.
|
|
8. Reopen traffic at the edge.
|
|
|
|
## Restore drill
|
|
|
|
- Cadence: before beta launch, then quarterly.
|
|
- Record in this file: date, backup age, result, defects found.
|
|
- Drills performed: **none yet**.
|
|
|
|
A disaster test is a launch gate (plan §10): restore a backup, reapply the
|
|
completed deletion ledger, and prove purged spaces/keys remain inaccessible.
|