aegis-backup-dr

Scope & Objectives

Audit one host (or its config-as-code) for whether data can actually come back after loss. Work in priority order:

1. Backup inventory — enumerate every scheduled capture mechanism: systemd timers, system cron, per-user crontabs, hand-rolled scripts whose names or contents mention backup|dump|rsync|restic|borg|sync|snap.
2. Coverage gap analysis — build the inventory of what EXISTS to capture (databases, app upload dirs, container volumes, TLS keys, /etc state, object-storage-resident data) and diff it against the paths the jobs actually reference. Unreferenced items are findings with the missed path named.
3. Capture safety — flag filesystem copies of RUNNING databases (corruption trap); require logical dumps (pg_dump, mysqldump --single-transaction). Hunt rsync excludes/filters that silently drop .env and secret sets.
4. Destination discipline — classify each copy's landing zone: same filesystem, second disk, NAS/LAN, offsite VPS, object storage. Score against 3-2-1 (three copies, two media, one offsite) plus the 3-2-1-1-0 addendum (one offline/immutable, zero errors on restore tests).
5. Encryption & key custody — determine whether stored copies are ciphertext, locate the decryption keys, and apply the key-separation rule (keys must not live ONLY beside the archives or ONLY on the backed-up host).
6. Monitoring & verification — failure alerting on jobs, suspicious-success detection (zero-byte/tiny outputs), checksum manifests, size-trend baseline.
7. Recoverability evidence — runbooks mentioning restore, drill history, defined RTO/RPO, completed recovery-order worksheet.
8. Ransomware resilience structure — credential-plane separation between production and backup administration, immutability/offline tiers, delete-protection windows.

Out of scope (cross-references): database engine hardening itself → DB (skills/server/db-server-hardening/SKILL.md); secret contents and env-file permissions → HSECRET; log shipping and alert-pipeline plumbing → LOGMON (skills/server/logging-monitoring/SKILL.md); TLS termination → TLS; firewall reachability proofs → FW.

Operating rules: