Backup and Restore Service  ·  View 01 of 26  ·  1 · Context and scope

System Context

What the platform reads from, who depends on it, and the three things it relies on that it deliberately does not control.

Editable source SVG draw.io All views
Protected estate · 120 datastores Transactional databases PostgreSQL · MySQL · TiDB Datasets and volumes ClickHouse · K8s PVs · IaC Object buckets Ceph RGW · 1.3 PB People Data owner On-call SRE Custody officer Platform dependencies Identity SPIRE · Keycloak Git + Argo CD policy as code Inventory NetBox · K8s API Backup and Restore Service capture · custody · proof Outside the platform, by design Custody clusters separate admin domain Key management OpenBao WORM tape vault third site Dead-man monitor Healthchecks base + log nightly change feed owns tier restores approves holds SVIDs policies discovery write-once keys weekly heartbeat Backup and Restore Service — System Context External / third party Person or role Security / platform Data store event / async batch synchronous v 1.0 · owner Platform Architecture · date 2026-09

Decisions

  • Custody clusters, the tape vault and the dead-man monitor are drawn outside the boundary on purpose. Each exists to keep working when this platform is wrong, compromised or down, and would lose that value if the platform administered it.
  • The estate is read, never written, during capture. The only paths that write to a datastore are restores, and each of them is separately authorised (views 14 and 17).
  • High availability and replication stay with the protected systems. A replica copies a bad migration in milliseconds, so the platform never counts one as a backup.

Assumptions

  • About 120 datastores across 40 services: 14 PostgreSQL, 4 MySQL, 3 TiDB, 6 ClickHouse datasets, 30 Kubernetes volumes, 25 Ceph RGW buckets and 12 configuration sources. About 1.4 PB in total, 40 TB of it transactional.
  • Two data centres run production. A third site holds tape and one key-management voter. NetBox and the Kubernetes API are the inventory of record.
  • SPIRE, Keycloak, Git with Argo CD and the shared Prometheus and Alertmanager stack already exist and are run by other teams.

Out of scope

  • Regional failover and replication of live systems, archival for analytics, and data export for portability.
  • Endpoint and SaaS backup. The estate is what runs in the two data centres.
All views High-Level Architecture  ▶
Solution Architecture v1.0 · Platform Architecture · 2026-09 · 26 views · open source, fully on-premises01-system-context