Backup and Restore Service  ·  View 06 of 26  ·  3 · Structure

Layered Architecture

Six layers, ordered so that everything above custody can be lost without losing a copy.

Editable source SVG draw.io All views
Experience Restore console server-rendered bnr CLI same API Attainment reports Grafana Control Policy compiler Git → schedules Coverage scanner unprotected report Scheduler Temporal Retention broker two-person rule Capture Version gate certified pairs Engine adapters one contract Log shippers WAL · binlog · TiDB log Object mirror bucket notifications Recovery and proof Restore orchestrator four forms Verifier depth 1–4 Isolated cluster no route out Custody Custody A Ceph RGW · Object Lock Custody B second DC Tape vault Bareos · LTO-9 WORM Record Catalogue PostgreSQL · append-only Evidence store 7-year lock Key management OpenBao Transit start capture sealed write proof Layered Architecture Application we own Security / platform Decision point Interface / broker Queue / topic Data store synchronous event / async Tier 1 log shipping runs in the engine's own process, so losing the control layer never stops it. v 1.0 · owner Platform Architecture · date 2026-09

Decisions

  • Custody sits below recovery and proof, and nothing in it depends on anything above. The layers above can be rebuilt from Git and a scan. Custody cannot be rebuilt, so it depends on nothing.
  • Tier 1 log shippers live in the capture layer but run inside the database's own processes (archive_command, binlog streamer, TiDB log task). The scheduler starts base copies, not log shipping.
  • Experience is a thin layer over one API. The console, the CLI and the manual runbook call the same operations, so a restore rehearsed in one works in the others.

Deliberate omissions

  • Identity (SPIRE, Keycloak) and observability run across every layer and are shown on views 21 and 24.
  • The disposal worker sits in the custody domain under its own identity and appears on view 13.

Own code, kept thin

  • Eight small Go services: API, policy compiler, coverage scanner, retention broker, custody copier, object mirror, verifier and disposal worker, plus the Temporal workflows. The engine tools move the bytes. The platform's code decides, records and proves.
◀  Journey — On-call SRE Recovers From a Three-Week-Old Corruption All views Container Architecture  ▶
Solution Architecture v1.0 · Platform Architecture · 2026-09 · 26 views · open source, fully on-premises06-layered-architecture