Phase 5 Backup Rollout Execution Bundle

PurposeCopy Anchor Link

Provide one approval-ready execution path for installing the Tier-1 backup timer and capturing first-run evidence.

ScopeCopy Anchor Link

• Stack area: runtime/stacks/infrastructure/databases
• Artifacts used:
  • operations/backups/db-backup.sh
  • operations/systemd/tier1-db-backup/install.sh
  • operations/diagnostics/collect-tier1-backup-evidence.sh
  • operations/systemd/tier1-db-backup/tier1-db-backup.service
  • operations/systemd/tier1-db-backup/tier1-db-backup.timer
  • docs/operations/templates/restore-validation-template.mdx
  • docs/operations/templates/production-change-record-template.mdx

Approval GateCopy Anchor Link

• Required approver: owner
• Approval rule: explicit owner approval or owner manual execution
• This bundle does not require docker compose commands.

PreconditionsCopy Anchor Link

• Owner approval captured in change record.
• VPS repository path confirmed (/opt/docs default, or override such as /home/repo/contabo-server-setup).
• Database containers are healthy before backup run.
• Sufficient free disk space is available in backup target path.

Execution StepsCopy Anchor Link

0) Resolve repository rootCopy Anchor Link

if [ -d /opt/docs/runtime/stacks/infrastructure/databases ]; then
  export REPO_ROOT=/opt/docs
else
  export REPO_ROOT=/home/repo/contabo-server-setup
fi

1) Create change record instanceCopy Anchor Link

• Open docs/operations/change-records/cr-2026-04-15-tier1-backup-timer-rollout.mdx.
• Fill approval timestamp, executor, and maintenance window.

2) Dry-run backup helperCopy Anchor Link

cd "${REPO_ROOT}"
sudo operations/backups/db-backup.sh run --dry-run

Expected outcome:

• Lists planned backup artifacts for enabled engines.
• No backup files written.

3) Dry-run systemd unit install previewCopy Anchor Link

cd "${REPO_ROOT}"
sudo operations/systemd/tier1-db-backup/install.sh --dry-run

Expected outcome:

• Shows generated service/timer definitions.
• Does not install units.

4) Install and enable weekly timerCopy Anchor Link

cd "${REPO_ROOT}"
sudo operations/systemd/tier1-db-backup/install.sh --repo-root "${REPO_ROOT}"

Expected outcome:

• Unit files installed under /etc/systemd/system/.
• Timer enabled and active with weekly schedule (Sun *-*-* 03:00:00).

5) Trigger first manual backup runCopy Anchor Link

cd "${REPO_ROOT}"
sudo operations/backups/db-backup.sh run --keep-last-backups 3

Expected outcome:

• Backup folder created under tmp/backups/tier1-<timestamp>.
• manifest.csv includes checksums and sizes.

6) Verify timer and latest backup evidenceCopy Anchor Link

sudo systemctl status tier1-db-backup.timer --no-pager
sudo systemctl list-timers tier1-db-backup.timer --all --no-pager
ls -lah "${REPO_ROOT}/tmp/backups" | grep tier1-

cd "${REPO_ROOT}"
sudo operations/diagnostics/collect-tier1-backup-evidence.sh

Expected outcome:

• Timer is active and next run scheduled.
• Latest backup folder is present.

Evidence CaptureCopy Anchor Link

Capture and attach to the change record:

• systemctl status tier1-db-backup.timer
• systemctl list-timers tier1-db-backup.timer --all
• backup folder path and manifest path
• one sample checksum row from manifest.csv
• output file path from collect-tier1-backup-evidence.sh
• any warnings or non-zero exits

RollbackCopy Anchor Link

If scheduling must be rolled back:

sudo systemctl disable --now tier1-db-backup.timer
sudo rm -f /etc/systemd/system/tier1-db-backup.timer /etc/systemd/system/tier1-db-backup.service
sudo systemctl daemon-reload

Rollback does not delete existing backup files.

Post-Execution UpdatesCopy Anchor Link

• Update docs/state/next-steps.mdx for:
  • backup automation implementation evidence
  • timer installation evidence
• Update docs/state/already-implemented.mdx only after server execution is confirmed complete.