# Disaster Recovery Notes

## Portal is Source of Truth

Google
-> Portal Users
-> Portal Roles
-> Gitea Provisioning
-> Gitea

## Restore Rules

Restore must NOT overwrite:

- production domains
- HTTPS configuration
- OAuth configuration

Existing .env values must remain unchanged.

## TLS State

Restore must preserve:

- /opt/appfactory/data/caddy
- /opt/appfactory/data/caddy-config

Otherwise:

- HTTPS stops working
- Google OAuth stops working
- Let's Encrypt rate limits may occur

## Google OAuth

Callback:

https://services.csbot.cz/portal/auth/google/callback

## Gitea

Registration disabled:

```ini
DISABLE_REGISTRATION = true
ENABLE_OPENID_SIGNUP = false
```

## Verification

```bash
curl -I https://services.csbot.cz
curl -I https://git.csbot.cz
curl -I https://registry.csbot.cz/v2/
```

```bash
/opt/appfactory/workspace/appfactory-tools/maintenance/preflight-check.sh
```