3e7eddc074
This commit implements comprehensive production hardening across multiple layers to prepare StemeDB for enterprise pilot deployments: ## API Layer - Add rate limiting middleware with configurable limits per endpoint - Enhance error handling with detailed context and proper HTTP status codes - Add security hardening tests for input validation and boundary conditions - Create store_helpers module for defensive storage access patterns ## Storage & WAL - Optimize group commit batching for higher throughput - Add defensive error handling in hybrid backend with proper fallbacks - Enhance WAL journal durability guarantees with fsync validation - Improve index store query performance with better caching ## Operations & Deployment - Add comprehensive operations documentation (deployment, monitoring, DR) - Create systemd units for backup, WAL archival, and verification - Add monitoring configs (Prometheus alerts, metrics exporters) - Implement backup/restore scripts with verification and S3 archival - Add DR drill automation and runbook procedures - Create load balancer configs (nginx, envoy) with health checks ## Documentation - Update CLAUDE.md with operations and troubleshooting guides - Expand roadmap with production readiness milestones - Add pilot success criteria and deployment reference architecture - Document TLS setup, monitoring integration, and incident response ## Configuration - Add .env.example with all required environment variables - Document resource sizing for different deployment scales - Add configuration examples for various deployment topologies This positions StemeDB for successful enterprise pilots with proper operational discipline, monitoring, backup/DR, and security hardening. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
39 lines
844 B
Desktop File
39 lines
844 B
Desktop File
[Unit]
|
|
Description=StemeDB Backup Verification Service
|
|
Documentation=https://github.com/yourusername/stemedb
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User=stemedb
|
|
Group=stemedb
|
|
|
|
# Environment
|
|
Environment="BACKUP_DIR=/var/backups/stemedb"
|
|
Environment="METRICS_DIR=/var/lib/node_exporter/textfile_collector"
|
|
|
|
# Execute verification on latest backup
|
|
ExecStart=/usr/local/bin/verify-backup.sh ${BACKUP_DIR}
|
|
|
|
# Timeout after 30 minutes
|
|
TimeoutStartSec=1800
|
|
|
|
# Don't restart on failure (verification failure should alert)
|
|
Restart=no
|
|
|
|
# Hardening
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ReadOnlyPaths=/var/backups/stemedb
|
|
ReadWritePaths=/var/lib/node_exporter/textfile_collector
|
|
|
|
# Logging
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=stemedb-verify-backup
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|