4 commits

Author	SHA1	Message	Date
Adam Moussa	4d9c30fbb3	Address cross-review findings for backup verification ... - Add size guard before downloading dump in restore test (3.5 GB cap) - Use paginator for list_objects_v2 in S3 checks and restore test - Remove unnecessary overrideLogicalId on GcsTransferCredentials secret - Pass explicit { mode: "daily" } to daily EventBridge rule target - Add fallback for SSM parameter fetch in backup script - Export replica bucket ARN/name from replica stack, consume via props	2026-05-15 17:25:25 -04:00
Adam Moussa	fa51085578	Address code review findings for backup verification ... Fix 4 critical issues: - Add filter/priority/deleteMarkerReplication to S3 CRR rule (deploy would fail without) - Add stack dependency so replica deploys before main stack - Fix DB file extension matching (.sqlite3/.sql instead of .db) - Replace nonexistent `forgejo restore` command with actual restore steps in README Fix 4 moderate issues: - Add timeout=10 to Slack webhook urlopen call - Add filter='data' to tarfile.extract for PEP 706 compliance - Add explicit ValueError for unknown handler mode - Use date-scoped S3/GCS prefix instead of unbounded listing	2026-05-13 18:29:28 -04:00
Adam Moussa	d57aea19f3	Add 3-2-1 backup strategy with cross-region replication and GCS offsite ... Implements a fully compliant 3-2-1 backup architecture: - Copy 1 (live): Harden existing EBS snapshots to 30-day retention - Copy 2 (near-site): S3 cross-region replication to us-west-2 with Object Lock (governance 90d) and versioning - Copy 3 (offsite): GCS bucket in dedicated seahaven-backups GCP project with 2-year irreversible retention lock Also adds a verification Lambda that checks all 3 locations daily and runs monthly restore tests with SQLite integrity checks.	2026-05-13 18:02:50 -04:00
Adam Moussa	a500d69716	Add Forgejo CDK stack ... EC2 (t4g.small, arm64) in private subnet with VPN-only access, DLM nightly snapshots, and Route53 DNS at forgejo.seahaven.com.	2026-05-11 17:52:37 -04:00