jobtrackingapp/docs/operations/google-drive-backups.md

Encrypted Google Drive backups

Yes—JobTracker recovery sets can be copied to Google Drive. Use an rclone crypt remote so database, CV, attachment and key archives are encrypted before they leave the production host.

One-time production setup

1. Install rclone from the operating system's trusted package source.

2. Run rclone config as the same operating-system user used by deployment.

3. Create a Google Drive remote, for example gdrive.

4. Complete Google OAuth in your browser. Do not paste its refresh token into Git, chat or CI.

5. Create a second remote of type crypt, for example gdrive-crypt, targeting a dedicated folder such as gdrive:JobTrackerBackups.

6. Enable filename and directory-name encryption. Store the crypt password and salt in the protected production credential store/rclone configuration, not in the repository.

7. Verify the encrypted remote without uploading private application data:

   printf 'backup connectivity test\n' >/tmp/jobtracker-backup-test.txt
   rclone copy /tmp/jobtracker-backup-test.txt gdrive-crypt:jobtracker-test
   rclone ls gdrive-crypt:jobtracker-test
   rm -f /tmp/jobtracker-backup-test.txt
   rclone purge gdrive-crypt:jobtracker-test
   

8. Add this to /opt/job-tracker/shared/.env:

   BACKUP_RCLONE_REMOTE=gdrive-crypt:jobtracker
   

9. Run the Production backup workflow manually. It must create the local verified recovery set first, copy that set to Drive, and fail visibly if the off-host copy fails.

Schedule and retention

• Scheduled workflow: 00:00 and 01:00 UTC triggers with a Europe/Oslo guard; one backup runs at local 02:00 even when daylight-saving time changes.
• Recovery-point objective: 24 hours.
• Local retention: 30 days plus 12 monthly recovery sets.
• Google Drive retention: the upload is immutable. Apply a matching Drive/rclone lifecycle only after a scratch restore has proven the off-host copy.

Recovery rule

Download into a scratch directory and restore into a separate MariaDB/database-volume environment. Never rehearse by restoring over live production. Preserve the newest deletion-tombstone ledger when restoring older application data.