.gitbay/wiki/Architecture/08-Operations.org

• The daemon logs with Go's log/slog default handler to stderr, which systemd sends to the journal. Retention is the journal's.
• Logged: listener start-up, schema version, worker failures (webhook, mail, push, mirror), sweeps and reaps with counts, SSH lookup errors.
• Not logged: request bodies, tokens, secrets. Mail errors are logged with addresses redacted.

Table audit_log: actor, action, JSON data, time (internal/store/audit.go). Readable by admins with audit.

Failed commands and reads are not audited. The separate events table is the product activity feed, not an audit trail.

• /healthz returns the serving commit and a database check.
• deploy/cloud-init.yaml installs an hourly heartbeat that checks the service, disk, certificate expiry and backup age, and can POST to an external monitor URL.
• admin runners reports the build queue: pending builds, claims and average and worst claim wait over 24 hours, reaped builds, and each runner key's last poll.

• Host: unattended-upgrades with automatic security updates and a 04:30 reboot (deploy/cloud-init.yaml).
• Application: govulncheck nightly in CI; a module update is a normal merge request and deploy.
• CI image: rebuilt by the operator when deploy/Containerfile.ci changes; weekly podman image prune removes old images.

• The database snapshot is taken before repositories are read, so a push during the backup leaves only unreferenced objects (cmd/gitbayd/backup.go).
• Excluded: WAL files, the hook socket, askpass scripts, generated hooks.
• gitbayd admin backup --verify checks SQLite integrity and that every repository the database names is present (backup.go). It does not check git object connectivity.
• The host's restic credentials are append-only; the key that can delete or prune snapshots is held off the host, so a compromised host cannot destroy its own history (documented: Admin wiki).
• Recovery point: about one hour for database-only data (issues, merge requests, reviews), one day for repositories.
• Recovery time: not measured. No restore onto a clean host has been recorded (#259).

Restore procedure: extract the archive into an empty directory, point server.root at it, start gitbayd; hooks regenerate and the host key is preserved.