Skip to content

fix(ops): the backup recorder reaches each scope's own folder - #420

Merged
keilynrp merged 1 commit into
mainfrom
fix/backup-recorder-per-scope-prefix
Sep 30, 2026
Merged

keilynrp merged 1 commit into
mainfrom
fix/backup-recorder-per-scope-prefix

Conversation

@keilynrp

Copy link
Copy Markdown
Collaborator

Refs #370. Found while checking production for task 4.0.

Problem

Dokploy writes each backup scope under its own top-level folder:

Scope Folder
Database dumps ukip-dbukip-eqmmhw/pg/
Volume archives ukip-universal-knowledgeiintelligence-platform-danmq1_ukip-backend/static/

The recorder listed both scopes under one S3_BACKUP_PREFIX. With the probe's prefix it would have found the dumps and reported no_object for volumes on every cycle. Its tests had assumed both scopes lived under one folder.

Fix

  • S3_BACKUP_PREFIX_DATABASE and S3_BACKUP_PREFIX_VOLUME, each falling back to S3_BACKUP_PREFIX. Existing single-folder installs need no change.
  • The recorder refuses to run when a scope has no prefix at all.
  • backup_id stays relative to the prefix it was listed under, so no document carries a folder name. Manual rows were recorded as full keys, and they still match by path suffix.

Also

  • Runbook §5c: says where production keeps each scope, and gives the credential's IAM policy for exactly those two folders (ListBucket with a prefix condition, GetObject on both).
  • automate-backup-evidence task 4.0: done. Production recorded full keys, and the last manual cycle was 2026-09-22.

Checks

  • 12 recorder tests (4 new): each scope listed under its own prefix; both recorded relative to it and accepted by the real parser; a scope with no prefix refused; the shared prefix still covers both. Giving the volume scope the database prefix fails two of them.
  • Pre-push gates green; repo metrics regenerated
  • CI green

🤖 Generated with Claude Code

Checking production (#370, task 4.0) showed Dokploy writing database dumps
under the database service's folder (ukip-dbukip-eqmmhw/pg/) and volume
archives under the compose app's (…-danmq1_ukip-backend/static/). The
recorder listed both scopes under one S3_BACKUP_PREFIX, so with the probe's
prefix it would have found the dumps and reported no_object for volumes on
every cycle. Its tests had assumed both under one folder.

It now takes S3_BACKUP_PREFIX_DATABASE and S3_BACKUP_PREFIX_VOLUME, each
falling back to S3_BACKUP_PREFIX, and refuses to run with a scope that has
neither. backup_id stays relative to the prefix it was listed under, so no
document carries a folder name; manual rows, recorded as full keys, still
match by path suffix.

Tests: each scope is listed under its own prefix, both are recorded relative
to it and parse, a scope with no prefix is refused, and the shared prefix
still covers both. Giving the volume scope the database prefix fails two of
them.

The runbook's §5c says where production keeps each scope and gives the
credential's policy for exactly the two folders; task 4.0 is done with what
it found (full keys; the last manual cycle was 2026-09-22).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@keilynrp
keilynrp merged commit fe3d5c0 into main Sep 30, 2026
53 checks passed
@keilynrp
keilynrp deleted the fix/backup-recorder-per-scope-prefix branch September 30, 2026 01:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant