M48: harden demo operations and offsite recovery

2026-08-21 22:17:49 +02:00
parent a24098c583
commit 00191e9b54
28 changed files with 1136 additions and 332 deletions
@@ -33,10 +33,19 @@ sha256sum /tmp/mobilityops-source.tar.gz
 ```

 `deploy-release.sh` stages a clean, commit-named release, builds OCI-labelled immutable
-API/web images, promotes without a seed/reset, and verifies migrations, readiness,
-backups and observability. Run `python -m app.cli seed --reset` only for initial setup or
+API/web images, starts two candidate replicas per stateless service behind a stable gateway,
+and removes the previous replicas only after public readiness passes. It promotes without a
+seed/reset and leaves the database, backups and monitoring untouched during routine app
+releases. Run `python -m app.cli seed --reset` only for initial setup or
 an explicit synthetic-demo reset; it is never part of a routine deployment.

+Refresh the pinned stateful and monitoring containers explicitly after reviewing their
+version/configuration changes:
+
+```bash
+./deploy/unraid/refresh-infrastructure.sh
+```
+
 Migrations run automatically in the API entrypoint. Import and publish the MobilityOps
 workflow into the existing n8n container:

@@ -66,9 +75,22 @@ The `backup` service creates a backup immediately and then every 24 hours. Every
 checked by SHA-256 and `pg_restore --list`; at least weekly the newest dump is also restored
 into a disposable database and its migration revision and core table counts are verified.
 Backups are retained for 30 days with at least seven copies protected from pruning. Its
-healthcheck becomes unhealthy when the daily backup or eight-day restore-drill SLA is missed. Configure
-`BACKUP_SECONDARY_DESTINATION=/offsite` plus an independently mounted
-`MOBILITYOPS_BACKUP_SECONDARY_DIR` for a second copy.
+healthcheck becomes unhealthy when the daily backup or eight-day restore-drill SLA is missed.
+
+For this synthetic demo, OneDrive is the supported real off-site target. The optional worker
+uploads the newest locally verified dump and checksum, downloads both again, verifies the
+round trip, and performs a weekly restore into a disposable database. Its OAuth token remains
+in the untracked mode-0600 rclone configuration directory. Configure it once from an
+interactive server terminal (Microsoft browser authorization is required):
+
+```bash
+./deploy/unraid/configure-onedrive-backup.sh onedrive
+docker inspect --format '{{.State.Health.Status}}' mobilityops-offsite-backup-1
+```
+
+Set `RCLONE_ONEDRIVE_PATH` to change the default `FleetOps/backups` folder. Do not set
+`BACKUP_SECONDARY_DESTINATION` to another path on the same server and call that off-site;
+that legacy mount remains available only for an independently mounted filesystem.

 Create an additional on-demand backup, verify the newest backup, or execute the isolated
 restore drill: