Move backup to /volume2/NetBackup (DSM shared folder, kts_bak read/write) and
change the design from a --delete mirror to an additive, date-stamped archive:
per-run pg_dump snapshots for the DBs and per-run full tar.gz snapshots for
audio, each kept for 7 generations, transferred over encrypted SSH with
post-transfer SHA256 verification (success only when byte-identical). This
removes the --delete risk (source-side deletion no longer wipes the backup),
enables restore-to-a-date, and is verified by an actual restore from the NAS
into isolated DBs (0 errors, quota/ledger and audio associations consistent).
Moved the backup out of the NAS home dir to /volume1/NetBackup/kaotings per
request. Synology restricts rsync-over-SSH to registered shared folders and
scp/sftp yields root-owned files that the backup account cannot rotate, so the
backup now uses tar over SSH (kts_bak-owned, rotatable, encrypted, key auth).
Document the transport rationale and the DSM shared-folder upgrade path for
incremental rsync.
Offsite backup to the Synology NAS (103.40.14.100:52200) is now configured:
pg_dump of business+CMS DBs (keep 7 per series) plus rsync of the audio dir,
encrypted over SSH with key auth, on a daily 03:00 systemd timer. Document the
destination, transport, script, timer, and restore-from-NAS procedure; mark the
backup-location item resolved (retention/threshold/owner still pending).
Record the task/quota exception matrix (isolated fault injection) results,
the admin quota concurrency fix, the isolated restore drill (business/CMS/audio,
with the pre-existing missing-audio finding), upstream security launch blocker,
and remaining minor items. Each item marked pass / fail / awaiting-external with
test version and evidence. Do not mark reliability/launch-blocking items complete.
Admin quota adjustment now takes the per-user advisory lock and a FOR UPDATE
row lock on the quota account before projecting the balance, so the check
covers both used and reserved amounts and stays transactionally consistent
with task freeze and settlement. Settlement and lease-recovery paths also
lock the quota row explicitly.
Add the isolated Phase 5 exception-matrix harness (fault injection against a
dedicated DB + fake upstream) covering last-quota contention, concurrent
admin reduce, freeze/reduce stress, bad/oversized/timeout upstream, storage
failure, cross-period settlement and queued/running restart recovery.
Add test-only deps, provisioning helper (secrets via env) and test README.
