Backup and Restore Service  ·  View 12 of 26  ·  4 · Data

Capture Data Flow — From Source to Three Custodians

The path one Tier 1 copy takes: gated, sealed at the source, locked on write, copied twice by identities that cannot delete.

Editable source SVG draw.io All views
Source Tier 1 database 40 MB/s WAL steady Capture Version gate Engine adapter compress · encrypt Custody A Custody A lock at write Envelope manifest signed JSON Replicate Custody copier SHA-256 verified Custody B second DC Air gap Bareos weekly WORM tape vaulted offsite Record Catalogue pair certified captured event Capture Data Flow — From Source to Three Custodians External / third party Decision point Interface / broker Data store Application we own synchronous event / async Custody copy B and the tape copy are made from custody A by identities that cannot delete in either place. v 1.0 · owner Backup Platform · date 2026-09

Decisions

  • Encryption happens in the adapter, before bytes leave the source host. Custody administrators store ciphertext and never hold a key that opens it.
  • Object Lock retention is set on the bucket as a default at write time, not afterwards by a separate call. There is no window in which an artefact exists unlocked.
  • The copier reads from A, recomputes SHA-256, and only then writes to B. A copy that is not checked is a second, independent chance to store corrupted bytes.

Numbers

  • Tier 1 log: 40 MB/s steady, 200 MB/s peak, p99 shipping lag of 60 s.
  • Copier lag to B: target under 15 minutes for Tier 1. Tape: weekly full of Tier 1 and monthly of the regulatory set, about 12 TB, or one to two LTO-9 cartridges, a week.

Why tape

  • The second custodian has to fail differently from the first. Tape is different media, different software (Bareos, not Ceph), different administrators, and offline once vaulted. Nothing that can reach a Ceph cluster can reach a cartridge on a shelf.
◀  Catalogue Data Model All views Retention and Custody Lifecycle, by Tier  ▶
Solution Architecture v1.0 · Platform Architecture · 2026-09 · 26 views · open source, fully on-premises12-capture-data-flow