Issuer Directory — Backup and Restore — RETIRED

RETIRED PROCEDURE (SPRINT_20260722_016 AUTH-10, 2026-09-11). There is no issuer-directory deployable any more: the surface folded into Authority at AUTH-9’s window on 2026-09-08, the container was stopped, and the compose key, publish key and issuerdirectory.stella-ops.local alias were removed. Do not follow the steps below as written — there is nothing to deploy, back up or ship separately.

Backing up the issuer data now means backing up stellaops_authority, whose issuer schema holds these tables — the schema NAME is unchanged, only the database moved (D-AUTH3-1). The predecessor stellaops_platform.issuer schema is residue holding zero domain rows and is staged for the SPRINT_20260722_021 PLT-4 drop.

Kept as a record of what the standalone service required. Current dossier: ../../authority/architecture.md.

Audience: operators and on-call engineers responsible for protecting and recovering the Issuer Directory trust registry (CSAF publisher and VEX issuer metadata, signing keys, and per-tenant trust weights).

This runbook covers the supported, non-Kubernetes backup and restore procedures for Issuer Directory: PostgreSQL tooling, Docker Compose or host/service-manager operations, and approved host secret stores.

Scope: Kubernetes and Helm backup/restore instructions are retired. See Unsupported legacy paths.

Backup

  1. Record the release manifest digest, service version, database name, and backup operator.
  2. Export the database with pg_dump from the supported deployment host or database maintenance host.
  3. Store the dump in the approved encrypted backup location.
  4. Capture the dump SHA-256 and retention expiry.

Restore

  1. Stop Issuer Directory through Docker Compose or the host service manager.
  2. Restore the selected dump with PostgreSQL tooling.
  3. Start Issuer Directory and confirm startup migrations complete.
  4. Run issuer lookup and readiness health checks.
  5. Record the dump hash, restore timestamp, operator approval, and health output.

Unsupported legacy paths

Do not use Kubernetes pod exec, kubectl cp, Kubernetes Secret reapply, or Kubernetes deployment scaling for Issuer Directory backup or restore.