3e7eddc074
This commit implements comprehensive production hardening across multiple layers to prepare StemeDB for enterprise pilot deployments: ## API Layer - Add rate limiting middleware with configurable limits per endpoint - Enhance error handling with detailed context and proper HTTP status codes - Add security hardening tests for input validation and boundary conditions - Create store_helpers module for defensive storage access patterns ## Storage & WAL - Optimize group commit batching for higher throughput - Add defensive error handling in hybrid backend with proper fallbacks - Enhance WAL journal durability guarantees with fsync validation - Improve index store query performance with better caching ## Operations & Deployment - Add comprehensive operations documentation (deployment, monitoring, DR) - Create systemd units for backup, WAL archival, and verification - Add monitoring configs (Prometheus alerts, metrics exporters) - Implement backup/restore scripts with verification and S3 archival - Add DR drill automation and runbook procedures - Create load balancer configs (nginx, envoy) with health checks ## Documentation - Update CLAUDE.md with operations and troubleshooting guides - Expand roadmap with production readiness milestones - Add pilot success criteria and deployment reference architecture - Document TLS setup, monitoring integration, and incident response ## Configuration - Add .env.example with all required environment variables - Document resource sizing for different deployment scales - Add configuration examples for various deployment topologies This positions StemeDB for successful enterprise pilots with proper operational discipline, monitoring, backup/DR, and security hardening. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
51 lines
1.2 KiB
Desktop File
51 lines
1.2 KiB
Desktop File
[Unit]
|
|
Description=StemeDB Backup Service
|
|
Documentation=https://github.com/yourusername/stemedb
|
|
After=network.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User=stemedb
|
|
Group=stemedb
|
|
|
|
# Environment file for S3 credentials and configuration
|
|
EnvironmentFile=-/etc/default/stemedb-backup
|
|
|
|
# Default environment variables
|
|
Environment="STEMEDB_WAL_DIR=/var/lib/stemedb/wal"
|
|
Environment="STEMEDB_DB_DIR=/var/lib/stemedb/db"
|
|
Environment="BACKUP_OUTPUT_DIR=/var/backups/stemedb"
|
|
Environment="BACKUP_RETENTION=30d"
|
|
|
|
# Execute backup with retention and S3 upload
|
|
ExecStart=/usr/local/bin/backup-stemedb.sh \
|
|
--output ${BACKUP_OUTPUT_DIR} \
|
|
--keep-last ${BACKUP_RETENTION} \
|
|
--upload-s3
|
|
|
|
# Timeout after 1 hour (for large backups)
|
|
TimeoutStartSec=3600
|
|
|
|
# Restart on failure (network issues, transient errors)
|
|
Restart=on-failure
|
|
RestartSec=5min
|
|
# Maximum 3 retries
|
|
StartLimitBurst=3
|
|
StartLimitIntervalSec=1h
|
|
|
|
# Hardening
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ReadWritePaths=/var/backups/stemedb /var/lib/stemedb
|
|
|
|
# Logging
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=stemedb-backup
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|