tom/HealthLog
1
0 Fork 0
mirror of https://github.com/MBombeck/HealthLog.git synced 2026-11-08 20:42:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(ops): the off-host worker never prunes; the bucket lifecycle does

Browse Source 
The runbook said the worker prunes objects older than BACKUP_RETENTION_DAYS. It never calls DeleteObject; its grant is PutObject, GetObject and AbortMultipartUpload, on purpose, so a compromised worker cannot wipe the history. The sentence now says what expires objects and what the variable is for.
This commit is contained in:
Marc-André Bombeck committed 2026-09-10 00:48:31 +02:00
1 parent 91ae90836b
commit 8ad5b90f88
1 file changed
+4 -2
Download Patch File Download Diff File Expand all files Collapse all files
docs/ops/backup-restore.md
+4 -2
View File
@@ -54,8 +54,10 @@ Cloudflare R2 the **Object Read & Write** token already covers all three.
## Bucket lifecycle (recommended)
The worker prunes objects older than `BACKUP_RETENTION_DAYS`, but the
storage provider's lifecycle rule is the canonical safety net:
The worker never deletes a backup object: its grant covers PutObject,
GetObject and AbortMultipartUpload only, so a compromised worker cannot
wipe the history. Expiry is the storage provider's lifecycle rule, set to
match `BACKUP_RETENTION_DAYS`:
```
Filter: "" (all objects)