Backup and restore

What to protect

• hapi-postgres-data/: authoritative FHIR database.
• kong-postgres-data/: gateway configuration, consumers, and credentials.
• hapi-data/, workingdir/, and healthtag/: application data and transformer state.
• Environment files and deployment manifests: store in an encrypted secret/configuration system.
• kong-ssl/: protect the private key separately with tightly controlled access.

Do not treat a live filesystem copy of PostgreSQL data directories as a consistent database backup. Use PostgreSQL-native logical or physical backup procedures appropriate to the recovery objective.

Backup procedure

1. Record source revision, image digests, database versions, and backup time.
2. Use pg_dump/pg_dumpall or an approved PostgreSQL backup tool for both databases.
3. Back up bind-mounted application directories and encrypted configuration separately.
4. Encrypt backup media, restrict access, and verify checksums.
5. Restore into an isolated environment regularly and run installation verification.

Restore order

1. Stop application traffic and preserve the failed state for investigation.
2. Restore HAPI and Kong databases into compatible PostgreSQL versions.
3. Restore application directories, certificates, and configuration.
4. Start databases, then Kong migration/gateway, HAPI, transformer, and API.
5. Verify metadata, routes, authentication, and a non-production test patient before reopening traffic.

Document retention, recovery point objective, and recovery time objective in the hospital’s operational policy; they cannot be inferred from this repository.