Partial Backup Directories Should Not Win the 'Newest Backup' Contest
A failed job can leave a fresh-looking directory that should never replace the last known complete recovery point.
TOPIC
Disaster Recovery
Lessons, explainers, experiments, and implementation notes.
A Backup Timer Firing Is Not Proof That the Backup Finished
Scheduling evidence and completion evidence belong to different layers of a batch job.
When a Disk Looks Slow, Inspect the Whole Read Path
When opening a file is slow, the disk is an obvious suspect. But data may cross a filesystem, mount, network gateway, and application layer before reaching the user. The symptom does not prove that storage is where the delay began.
Do Not Leave Decrypted DR Payloads Behind After Verification
A recovery drill can create a new sensitive-data exposure if decrypted database dumps remain on disk by default.
Secrets Are Part of Disaster Recovery Even When They Are Correctly Missing from Git
Separating secrets from source control creates a recovery dependency that must be documented and tested.
Off-Host Encrypted Backups Change the Failure Domain
A backup on the same disk protects against application mistakes better than it protects against host or disk loss.
RPO and RTO Turn 'We Have Backups' into an Operational Requirement
Recovery planning becomes actionable when data-loss tolerance and recovery-time tolerance are explicit.
UNKNOWN and FAIL Mean Different Things in Backup Monitoring
Protected evidence that a low-privilege checker cannot read should not be reported as healthy or corrupt.
A Backup Earns Trust Through a Restore
Knowing that a backup file exists matters, but whether the required system can be rebuilt from it is a restore question. Having a copy and having a working recovery path are two different guarantees.
Backup Freshness Is Not Backup Integrity
A newly created directory can still be incomplete or corrupt, so age alone is weak recovery evidence.
A SHA256SUMS File Turns Backup Corruption into a Detectable Failure
Checksums do not replace restore tests, but they catch silent byte changes before a disaster forces you to discover them.
A Restore Drill Is Stronger Evidence Than a Successful Backup Command
The backup process can exit zero while the recovery process is still incomplete, undocumented or impossible on another machine.
KillMode Matters When a Backup Script Spawns Child Processes
Stopping only the shell does not necessarily stop pg_dump, tar or helper processes that the shell launched.
Backup Jobs Need a Maximum Runtime
A backup that hangs forever can block future runs and create false confidence without ever producing a usable recovery point.
Rolling Back Code Is Not the Same as Rolling Back Data
Rollback usually sounds like restoring an older release. But if the new code changed the structure or meaning of data, whether the old code can still read that data is a separate question.
Least-Privilege Backup Receipts Let Operators Verify Without Reading the Backups
Operators need evidence that backups succeeded without necessarily gaining access to the protected data itself.