WeeklyBackup

Checklist: Backup readiness

11 items ·5 critical ·4 warn ·2 info

Why this checklist

A backup you have not restored is not a backup. The weekly check ensures backups are actually happening; the quarterly restore test ensures they actually work.

The critical items address the most common production backup failures:

Backup jobs not running. Cron failures, container drift, service unavailable.
Silent zero-size backups. The job ran but produced nothing.
Offsite copy stale. The offsite target is broken but the local backups look fine.
No restore test. The backup file is real but the procedure to restore from it has rotted.

Cadence

Daily: automated checks on job completion + size plausibility.
Weekly: this checklist, run by an operator.
Quarterly: full restore test on a non-production host.

Critical5 items

All backup jobs ran successfully in the past 24 hours.
```
systemctl status backup-app.timer
```
Offsite copy is within the last 24 hours.
```
aws s3 ls s3://my-backups/$(date +%F)/
```
Most recent restore test is within the past 90 days.
The RPO commitment is met by the backup cadence.
The RTO commitment is met by the latest restore test.

Warning4 items

Backup sizes are within 10% of the previous week’s size (no silent zero-size backup).
```
ls -la /srv/backups/$(date +%F)/
```
Backups are encrypted at rest and in transit.
Compose files are in version control with the running commit pinned.
Secrets are in a secret manager; backups of secret state are encrypted and offline.

Info2 items

Retention policy is enforced (30 daily, 12 monthly, 7 yearly).
Registry retains the previous 30 image tags for each service.