Commit `86a293b4bf`

86a293b4bfa84821f12d125778226680498883e8

parent: 8ae7a036fb

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-01 04:45 UTC

Admin: backup schedule and the recovery-point decision

Two timers now: the nightly full archive, and an hourly database-only
snapshot. Records why continuous replication was not adopted — it would
leave the repositories on the nightly archive, so a restore could produce
a database referencing commits the repository backup lacks.

Ref #28

Layout: unified · split

Admin.org +23

	@@ -186,6 +186,29 @@ Restore: extract into an empty directory, point =server.root= at it,
186	start gitbayd. Host keys are preserved, so clients keep their	186	start gitbayd. Host keys are preserved, so clients keep their
187	known_hosts entries; hooks regenerate at startup.	187	known_hosts entries; hooks regenerate at startup.
188		188
		189	** Schedule and recovery point
		190
		191	Two timers, because the two halves of the data have different exposure.
		192
		193	- =gitbay-backup.timer=, nightly. The full archive above, last 7 kept.
		194	- =gitbay-db-backup.timer=, hourly. =admin backup --db-only=, which
		195	writes the SQLite snapshot alone, last 48 kept. A few MB against the
		196	full archive's hundreds, which is what makes the frequency affordable.
		197
		198	The split follows what a loss would actually cost. Repositories are git,
		199	so a mirror or any clone is a second copy; the database is the only copy
		200	of issues, merge requests, comments and review state. So the recovery
		201	point is about an hour for the data that exists nowhere else, and a day
		202	for the data that does.
		203
		204	Continuous replication (litestream and similar) was considered and not
		205	adopted. It would take the database's recovery point to seconds, but the
		206	repositories would still be on the nightly archive, so a restore could
		207	produce a database referencing commits the repository backup does not
		208	have. Consistency between the two halves is worth more here than latency
		209	on one of them. Revisit if repository replication becomes continuous
		210	too.
		211
189	* Upgrades	212	* Upgrades
190		213
191	Replace the binary, restart the unit. Migrations apply automatically and	214	Replace the binary, restart the unit. Migrations apply automatically and

Commit 86a293b4bf

Commit `86a293b4bf`