Restore validations
Restore Validation Report
1. Identified latest PostgreSQL artifact from latest Tier-1 manifest.
Drill Metadata
- Drill id: RV-20260415T210554Z
- Date and time (UTC): 2026-04-15
- Owner approver: owner
- Executor: GitHub Copilot agent (owner-approved command execution)
- Target system: PostgreSQL (Tier-1 backup validation)
Objectives
- Target RTO: 4 hours
- Target RPO: 1 hour
- Planned scenario: restore latest PostgreSQL backup into isolated temporary database and validate restore integrity.
Backup Input
- Backup folder:
tmp/backups/tier1-20260415T210156Z - Backup artifact:
/home/repo/contabo-server-setup/tmp/backups/tier1-20260415T210156Z/postgres/postgres-20260415T210156Z.sql.gz - Manifest file:
tmp/backups/tier1-20260415T210156Z/manifest.csv - Backup timestamp (UTC): 2026-04-15T21:01:56Z
Preconditions
- Approved execution window and owner approval.
- Restore target isolated from live production traffic (temporary restore database).
- Rollback/cleanup plan prepared (drop temporary restore database).
Restore Steps Executed
- Identified latest PostgreSQL artifact from latest Tier-1 manifest.
- Created isolated temporary database
restore_validation_20260415T210554Z. - Restored backup artifact using
gzip -dc ... | psqlwithON_ERROR_STOP=1. - Validated connectivity (
SELECT 1) and non-system table count. - Dropped temporary restore database after validation.
Measurements
- Recovery start (UTC): 2026-04-15T21:05:54Z
- Recovery complete (UTC): 2026-04-15T21:09:10Z
- Measured RTO: 196 seconds (00:03:16)
- Restored backup point (UTC): 2026-04-15T21:01:56Z
- Measured RPO: 238 seconds (00:03:58)
- Target RTO met: true
- Target RPO met: true
Validation Outcome
- Result: pass
- Deviations from plan: none
- Data integrity observations:
- Connectivity query result: 1
- Non-system table count after restore: 39
Evidence References
- Restore evidence file:
/home/repo/contabo-server-setup/tmp/backups/evidence/restore-validation-20260415T210554Z.txt - Backup rollout evidence file:
/home/repo/contabo-server-setup/tmp/backups/evidence/tier1-backup-evidence-20260415T205803Z.txt
Corrective Actions
- Keep monthly restore drill cadence active for Tier-1 datasets.
- Complete offsite backup destination rollout to close same-host-only DR risk.
NetBird Access Validation Matrix
Use this matrix to capture proof that protected endpoints are accessible from NetBird clients and denied from non-NetBird sources.
Tabletop Drill Report: SSH Egress Policy Incident
Simulated event: new outbound TCP/22 block detections appear in kernel/UFW logs during normal operations, requiring containment verification, exception-control quality checks, and integrity decision framing.