gabriel / musehub public
Open #180 production-readiness
filed by gabriel human · 37 days ago

Database follow-up: staging backups, postgres role-splitting

0 Anchors
— Blast radius
— Churn 30d
0 Proposals

Context

Split out from #157, which is now closed. #157 built and tested a real, working backup/restore pipeline for production only (dedicated R2 bucket, scoped token, daily cron, actual restore test performed against a throwaway container).

This was flagged in #157's closing comment but never given its own tracked ticket until now.

Remaining items

  • Staging has zero backups — resolved 2026-09-08, not by building the manual pipeline below. Staging turned out to have always been on managed AWS RDS (undocumented until now), which already provides native automated daily backups and 7-day point-in-time recovery. See docs/database-architecture.md. Production has since been migrated to RDS too, and its manual pipeline (deploy/backup.sh) was kept as a secondary weekly backup rather than extended to staging.
  • Postgres role-splitting — a single shared Postgres role is used for app runtime, migrations, and admin tasks on both environments. The checklist's original ask (separate app-runtime/migration/admin roles) was never done.
◎ Activity1
●
gabriel opened this issue 37 days ago
○
gabriel 36 days ago

Update 2026-09-08: the "staging has zero backups" item above is resolved, but not by building the manual pipeline described here.

During today's database migration work (see docs/database-architecture.md), staging turned out to have always been on managed AWS RDS (not self-hosted Postgres) — an undocumented fact until now. RDS already provides native automated daily backups and 7-day point-in-time recovery, and has had them since the instance was created (2026-04-05). Production has since been migrated to RDS too, as part of the same effort.

So: no manual backup pipeline is needed for staging — RDS already covers it. Production's existing manual pipeline (deploy/backup.sh, from #157) was kept as a secondary, belt-and-suspenders backup and rewritten to work against RDS (connects via DATABASE_URL now, not docker exec into a specific container), with its cron changed from daily to weekly since RDS covers day-to-day recovery.

The Postgres role-splitting item is still open and still applies to both environments.

Closing the backup item here; leaving this issue open for role-splitting only.