Backup schedule
| Task | Frequency |
|---|---|
| Encrypted database and source code backup | Nightly, keeping 14 copies |
| Transaction log (WAL) | Hourly |
| Push encrypted copy to private storage | After every backup, with a size check |
| Push to off-site storage | Nightly, with a size cap so no extra charges arise |
| Restore drill | Every Sunday |
Backups must prove themselves
Every run checks the file size at the destination. The restore drill rebuilds the database from a copy, counts tables and indexes, tests the trigger that blocks ledger edits, and raises an alert immediately on failure. The drill once caught a function that did not state its schema explicitly, and one false failure caused by counting too early; both have been fixed.
Restore
Restore into a new database and then rename it; never overwrite the one that is running.