Why
docs/operations.md says “test the restore, not the backup”, and that test has
never been run. The restore path is also the only recovery for the one thing
that cannot be rebuilt: users.db, holding every account, key, session, rule,
and approval lock. A document that has never been executed is a guess, and a
drill is the cheapest place to find out it is wrong.
Scope
- Back up a populated instance exactly as the operations page says: the
account database,
runs.db, the logs, the SSH host key, the audit log, and the ACME directory. - Restore into a fresh instance on a different host or directory, following the page step by step, and note every place it is wrong, missing, or assumes something that is not there.
- Verify after restore: sign-in with an existing key, sessions as the page describes, clones of a private and a public repository, issue and change request pages, a hosted site, CI history and attempt logs, LFS objects, artifacts, and the audit log’s oldest entries.
- Record the timings: each step, and how long the instance was unavailable.
- Fix the operations page where the drill disagreed with it, and file issues for anything an edit cannot fix.
Acceptance
- A written record of the drill: date, host, timings, and every check with its outcome.
docs/operations.mdmatches what the drill actually required, with anything that changed called out in the release note.- Every gap is fixed or has an issue.
Part of #14.