Jens/geointel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(release): make deployment backup and rollback immutable

Browse Source
This commit is contained in:
Jens
2026-08-30 06:00:43 +02:00
parent a0884d64c9
commit c272220277
47 changed files with 3035 additions and 430 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/README.md
+19 -9
View File
@@ -2142,11 +2142,17 @@ bash scripts/backup_release_state.sh \
```
The backup is written atomically and contains a PostgreSQL custom-format dump,
archive listing, Alembic/PostGIS metadata, critical table counts, optional
storage/model inventories and SHA-256 checksums. An empty or known-default
database password leaves the release gate failed. For an emergency backup
before rotating that password, add `--allow-insecure-password`; the manifest
still records the insecure state.
archive listing, Alembic/PostGIS metadata, critical table counts and
byte-complete SHA-256-verified storage/model snapshots. The first snapshot is a
full copy; a later deployment may hard-link only checksum-identical files from
another completed, fully verified backup with `--link-dest-backup`. It never
hard-links a live source file and never deletes an older backup. An empty or
known-default database password leaves the release gate failed. For an
emergency backup before rotating that password, add
`--allow-insecure-password`; the manifest still records the insecure state.
`backup_tool_revision` identifies the candidate source that executed the
backup; `running_image_revision` identifies the currently running old image.
Rollback is always bound to the retained immutable Docker `image_id`.
Verify without changing any database:
@@ -2190,7 +2196,7 @@ docker exec geointel python /app/scripts/audit_data_operations.py \
--output /app/storage/release-evidence/rc-current/data-operations.json
```
Preview old unreferenced derived/cache/export candidates without deletion:
Preview old unreferenced derived/cache/export candidates without mutation:
```bash
docker exec geointel python /app/scripts/cleanup_storage_artifacts.py \
@@ -2199,10 +2205,14 @@ docker exec geointel python /app/scripts/cleanup_storage_artifacts.py \
```
Apply requires a reviewed candidate count, the exact
`DELETE_STORAGE_ARTIFACTS` token and a backup no older than 24 hours with a
checksum-verified database dump and SHA-256 storage inventory. The host backup
`QUARANTINE_STORAGE_ARTIFACTS` token and a backup no older than 24 hours with a
checksum-verified database dump and byte-complete storage snapshot. The host backup
root is mounted read-only at `/app/backups`. See
`docs/DATA_OPERATIONS_RUNBOOK.md`. No cleanup is scheduled by GeoIntel.
`docs/DATA_OPERATIONS_RUNBOOK.md`. Candidates enter protected
`operator-evidence/cleanup-quarantine` storage through an interruption-safe
hard-link/unlink state machine. `restore_storage_quarantine.py` reverses that
move with the exact `RESTORE_QUARANTINED_ARTIFACTS` token and refuses to
overwrite an existing original path. No cleanup is scheduled by GeoIntel.
## RC-8 Belgium/North Sea release journeys