#backup

Three commands that build a full copy of production for one release — configuration from the repository, images from the registry, data from the latest backup — restore it in order, run the release's migrations against that data, and remove it without a trace.

Three commands that back up a running Docker stack — PostgreSQL, MinIO, and Elasticsearch — without downtime, restore it to any point, and keep retention safe, with exit codes that say how much a failure matters.

Release Workflow: Development to Production is the procedure every change of mine follows from my laptop to production — which steps I automated, which I deliberately left to a person, why each step sits where it does, how I diagnose a failed release, and how I recover from it.

cp -r drops owner, permissions and timestamps, producing copies that look right and fail in use. A 58-line rsync wrapper makes the destination truly equal to the source — and most of its lines are refusals, because making it equal means agreeing to delete.

A storage server that answers a connection only proves a process is listening. I check each capability separately — browser uploads via presigned URL, private buckets refusing strangers, large files through the proxy — before any application depends on it.

Its software reached the end of support, and its records must outlive it. One component rewrote data as it read it, so the migration copies rather than converts — an operation with no rollback has to be survivable, not merely careful.

One rotation reaches seven services, and a value elsewhere can look exactly like one of their credentials, so search-and-replace could break an integration nobody watches. Working from an explicit list keeps the rotation inside its blast radius and away from the keys that only decrypt.

A Business Continuity Plan stated as two numbers — an RPO of six hours and an RTO of seconds for the data — and the few small scripts behind them: full and incremental backups, one technique per data store, restore as the only test that counts, and config treated as data.