feat: railway postgres pitr — point-in-time recovery management - #1052
Merged
Conversation
8 tasks
paulocsanz
force-pushed
the
pcs/pg-mgmt-05-cluster-scale
branch
from
August 7, 2026 21:01
f497f21 to
895fd32
Compare
paulocsanz
force-pushed
the
pcs/pg-mgmt-06-pitr
branch
from
August 7, 2026 21:01
b710d39 to
bbf6371
Compare
paulocsanz
force-pushed
the
pcs/pg-mgmt-05-cluster-scale
branch
from
August 7, 2026 21:08
895fd32 to
2715c45
Compare
paulocsanz
force-pushed
the
pcs/pg-mgmt-06-pitr
branch
from
August 7, 2026 21:08
bbf6371 to
b423bb6
Compare
paulocsanz
force-pushed
the
pcs/pg-mgmt-05-cluster-scale
branch
from
August 7, 2026 21:18
2715c45 to
c415692
Compare
paulocsanz
force-pushed
the
pcs/pg-mgmt-06-pitr
branch
from
August 7, 2026 21:18
b423bb6 to
76556c1
Compare
paulocsanz
force-pushed
the
pcs/pg-mgmt-06-pitr
branch
from
August 7, 2026 21:39
76556c1 to
fdffce2
Compare
CLI parity for the PITR dashboard surface: status (config state, guardrail blockers, plus a best-effort SSH probe of pgbackrest coverage and pg_stat_archiver health with the sticky-failure gate), enable/disable (template overlay on standalone; the rolling enable/disable workflow on an HA cluster, followed via its progress record -- matched by workflow id so a stale record can't fake completion -- with a 30-minute deadline and FAILED surfacing the workflow's own error), progress/cancel/clear for the HA workflow, restore --at into a new service, backup list/create/delete/lock/ restore (delete loops the public per-id mutation), and schedule set/list including set --none to clear. Volume-instance ids resolve through environment volumeInstances -- the config's volumeMounts key is the VOLUME id, which backup mutations reject. Every environment-config fetch is decrypted: production masks all variable values otherwise. Part 6/9 of the railway postgres pitr/ha/pgbouncer stack.
paulocsanz
force-pushed
the
pcs/pg-mgmt-06-pitr
branch
from
August 7, 2026 22:46
fdffce2 to
1f6fb8d
Compare
replicaServiceIds/wipeServiceIds are Internal-subgraph-only in backboard and absent from the public /graphql/v2 schema, so document validation rejected the mutation on every call. The CLI always sent None for both.
This reverts commit 33054e9.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 6/9 of the railway postgres pitr/ha/pgbouncer stack (split out of #1032 for reviewability — see that PR for the full context, live-prod e2e evidence, and the test-postgres-cli harness). Each PR is based on the previous one and is independently green (cargo test/clippy/fmt).
CLI parity for the PITR dashboard surface: status (config state, guardrail
blockers, plus a best-effort SSH probe of pgbackrest coverage and
pg_stat_archiver health with the sticky-failure gate), enable/disable
(template overlay on standalone; the rolling enable/disable workflow on an
HA cluster, followed via its progress record — matched by workflow id so a
stale record can't fake completion — with a 30-minute deadline and FAILED
surfacing the workflow's own error), progress/cancel/clear for the HA
workflow, restore --at into a new service, backup list/create/delete/lock/
restore (delete loops the public per-id mutation), and schedule set/list
including set --none to clear.
Volume-instance ids resolve through environment volumeInstances — the
config's volumeMounts key is the VOLUME id, which backup mutations reject.
Every environment-config fetch is decrypted: production masks all variable
values otherwise.
Part 6/9 of the railway postgres pitr/ha/pgbouncer stack.