Backup, restore and recovery boundaries
Golf’s current portable deployment uses Forgejo. A complete coordinated Forgejo/Golf restore remains unqualified. Retained volumes and earlier provider-specific backup proofs do not establish it. A qualified one-command restore for this deployment is not yet available.
Preserve the whole installation
| State | Why it is needed |
|---|---|
| Golf PostgreSQL database | Accounts, sessions, policies, jobs, receipts and encrypted credentials |
| Forgejo PostgreSQL database | Forge-owned users, repositories, collaboration and permissions |
| Forgejo Git/data and configuration volumes | Git refs/objects, attachments/LFS and native configuration/keys |
| Private object storage | Execution outputs and retained source-bound evidence |
| Encryption keyring and private configuration | Existing ciphertext cannot be read with a newly generated key |
| Image/schema/installation identities | Recovery must use a supported transition and preserve authority |
Backups need a coherent point in time. Freeze admission, drain all API/background/execution writers and stop the native writer before capturing its files. Use documented native PostgreSQL and supported forge procedures; Golf application features never write the forge’s database or repository files directly.
For Kubernetes, verify the actual storage backend and snapshot/backup behavior. A retained PVC or a successful snapshot object is not evidence that application state is complete and recoverable. External PostgreSQL operators own their database backup/restore; those procedures do not include Forgejo’s Git volumes or Golf’s encryption keys.
Restore into quarantine
- Use a fresh, isolated target and an explicitly supported source/target image and schema combination.
- Keep incoming traffic and outbound workers disabled, with all writers stopped.
- Restore both databases and native/object storage through their documented operator facilities. Do not merge schema fragments across providers or repair a live forge by editing its files.
- Preserve the installation identity and the exact key material used by stored credentials. Newly generated environment files do not reconstruct lost keys or native database passwords.
- Reconcile credential/session revocations, deleted resources, grants and pending outbound effects against current authority before reopening.
- Verify real Git history/refs, LFS/attachments, collaboration/private review state, accounts, current grants, encryption and source-bound receipts.
- Exercise new authorized reads/writes, restart and rollback before moving traffic.
The explicit privileged offline-recovery exception applies only to documented native procedures into a fresh stopped target, with writers drained and traffic quarantined. It supplies no application permission or shortcut for live database/ref manipulation.
Kubernetes upgrades are separate
The chart retains the three bundled claims on ordinary uninstall, and fences accidental Forgejo UUID/endpoint changes during upgrades. It does not coordinate snapshots or restore data. A Helm rollback changes Kubernetes manifests, not database migrations, private keys or lost Git objects.
Read the full Kubernetes guide for storage, maintenance, rollout and troubleshooting. Never force-delete an unreachable stateful writer and start another against storage that the first may still reach. Real node/storage fencing is required.
Native Cloudflare
Artifacts, D1, private R2, Secrets Store authority and retained operation identities need their own coordinated recovery and revocation procedure. Alchemy state records resource ownership; destroying/recreating the stack is not a backup. Native disaster recovery and production RPO/RTO remain unqualified.
Evidence and next acceptance
Before relying on recovery, run a fresh-target drill for the exact deployment/provider/schema, compare fixtures and private-data fidelity, measure recovery time and verify owned cleanup. Missing data or uncertain authority blocks cutover.
The product recovery contract and implementation ledger retain source-specific engineering evidence. Current Forgejo and native Cloudflare acceptance must be recorded separately before a stable product recovery claim can be made.