5 commits

Author	SHA1	Message	Date
Adam Moussa	fa51085578	Address code review findings for backup verification ... Fix 4 critical issues: - Add filter/priority/deleteMarkerReplication to S3 CRR rule (deploy would fail without) - Add stack dependency so replica deploys before main stack - Fix DB file extension matching (.sqlite3/.sql instead of .db) - Replace nonexistent `forgejo restore` command with actual restore steps in README Fix 4 moderate issues: - Add timeout=10 to Slack webhook urlopen call - Add filter='data' to tarfile.extract for PEP 706 compliance - Add explicit ValueError for unknown handler mode - Use date-scoped S3/GCS prefix instead of unbounded listing	2026-05-13 18:29:28 -04:00
Adam Moussa	d57aea19f3	Add 3-2-1 backup strategy with cross-region replication and GCS offsite ... Implements a fully compliant 3-2-1 backup architecture: - Copy 1 (live): Harden existing EBS snapshots to 30-day retention - Copy 2 (near-site): S3 cross-region replication to us-west-2 with Object Lock (governance 90d) and versioning - Copy 3 (offsite): GCS bucket in dedicated seahaven-backups GCP project with 2-year irreversible retention lock Also adds a verification Lambda that checks all 3 locations daily and runs monthly restore tests with SQLite integrity checks.	2026-05-13 18:02:50 -04:00
Adam Moussa	6ccfc1c506	Update README with backup, autodiscovery, and token management docs (#1) ... Add documentation for S3 backups with Glacier lifecycle, hourly autodiscovery of new GitHub org repos, daily PAT token refresh, PAT rotation procedure, and Secrets Manager secret inventory.	2026-05-11 19:03:42 -04:00
Adam Moussa	0a4119880e	Update README for ALB-backed HTTPS setup	2026-05-11 18:13:54 -04:00
Adam Moussa	a500d69716	Add Forgejo CDK stack ... EC2 (t4g.small, arm64) in private subnet with VPN-only access, DLM nightly snapshots, and Route53 DNS at forgejo.seahaven.com.	2026-05-11 17:52:37 -04:00