Skip to content
LQMS
7. Deployment View
Initializing search
nburri/lqms
LQMS
nburri/lqms
Home
Evaluate LQMS
Evaluate LQMS
LQMS Known Limits
LQMS Security Posture
Architecture
Architecture
1. Introduction and Goals
2. Architecture Constraints
3. Context and Scope
4. Solution Strategy
5. Building Block View
6. Runtime View
7. Deployment View
7. Deployment View
Table of contents
Deployment form (as built)
Database roles — the BYPASSRLS requirement and the split-role hardening
7.1 Backup & restore
What a full backup contains and why the order matters
Schedule examples
Retention (B-3 — disposal ↔ backup interplay)
Restore runbook
Restore rehearsal (the differentiator, B-2a)
Keycloak-volume continuity (ADR-0063 dependency)
8. Crosscutting Concepts
9. Architecture Decisions
10. Quality Requirements
11. Risks and Technical Debt
12. Glossary
The arrival bundle format
Decisions (ADRs)
Decisions (ADRs)
ADR-0001: Content-Addressed Document Storage with PostgreSQL as Source of Truth
ADR-0002: Single Instance with Scope Hierarchy and Copy-on-Derive
ADR-0003: Fixed Life Cycle States with Configurable Review Processes
ADR-0004: Global Catalogs for Roles and Document Types with Per-Scope Activation
ADR-0005: Modular Monolith
ADR-0006: Three-Layer Search with In-Database Index and Pluggable LLM
ADR-0007: Angular Frontend with Server-Side-Only Enforcement
ADR-0008: Flyway Migrations and jOOQ Codegen from the Migrated Schema
ADR-0009: RLS Enforcement via a Session-Scoped Authorized Scope Set
ADR-0010: Self-Managed QMS via an Internal Mandator
ADR-0011: Authentication via OIDC SSO with Server-Side (BFF) Sessions
ADR-0012: Permission-Based Authorization and System Bootstrap
ADR-0013: User Identity Lifecycle
ADR-0014: Electronic Signatures (Part 11 / Annex 11-Capable)
ADR-0015: Document Effectivity, Periodic Review & Validity
ADR-0016: Data Retention, Disposal & Privacy (FADP / GDPR)
ADR-0017: Multi-Part Version Content
ADR-0018: Non-Functional Targets (Capacity, Availability, Security)
ADR-0019: Notifications & Tasks
ADR-0020: Internationalization (Content Language, Time Zones, Formatting)
ADR-0021: General Typed Document Relationships
ADR-0022: Read-Acknowledgement & Questionnaires
ADR-0023: Migration / Import — Current Released State
ADR-0024: Draft / In-Review Cancellation
ADR-0025: Disposal & Erasure Mechanics (Storage, Index, Backups)
ADR-0026: RLS Runtime Safety — Connection-Pool Scope Isolation
ADR-0027: RLS Boundary — Content-Plane vs Control-Plane
ADR-0028: Stateless Encrypted Token-State Cookie (no server-side session store)
ADR-0029: Document Content Model — Draft-Freeze, Content-Table RLS, Append-Only Audit
ADR-0030: Review & Life-Cycle Realization Model
ADR-0031: Released-base readability enforcement & copy-on-derive mechanics
ADR-0032: Frontend realization — Quinoa, Angular Material, i18n & E2E
ADR-0033: CSRF control for the BFF session — SameSite + JSON content-type
ADR-0034: Notification realization — in-process domain events + system-context fan-out
ADR-0035: Fan-out contract as shipped — gate semantics, count disclosure, audit protocol
ADR-0036: Repository layer — services carry rules, repositories carry jOOQ
ADR-0037: Task scheduler — in-process tick, advisory-lock election, SQL sweep
ADR-0038: Periodic-review realization — derived due date, policy-gated confirmation
ADR-0039: Sweep & periodic-review contract as shipped — grants, guards, addressing
ADR-0040: Disposal-due surfacing — closure-anchored retention, scope-level legal hold
ADR-0041: Email channel & notification i18n — notification-as-outbox, structured messages
ADR-0042: Disposal execution — document tombstoning, single-actor hard-gated destruction
ADR-0043: Disposal blob deletion is post-commit, GC-backstopped
ADR-0044: Search FTS baseline — event-indexed, RLS-scoped search_index
ADR-0045: Image Attachments as Content Parts (Rich-Content Slice R2)
ADR-0046: Four-Eyes — Submitter Excluded from Approval
ADR-0047: Four-Eyes — Submitter-Only Exclusion
ADR-0048: Document Organization — Folder Tree per Scope
ADR-0049: Content Model Round 2 — Type Categories, Template Instantiation, Trace Relations, Completeness Rules
ADR-0050: Live Frontend — SSE State Push, CodeMirror 6, Draft Presence
ADR-0051: In-Text Document Links (doc: Scheme)
ADR-0052: Addressees & Read-Acknowledgement (REQ-TRN Realization)
ADR-0053: Addressees Per Document + Process Owner (amends ADR-0052 K-1)
ADR-0054: Process Owner Is a Role (amends ADR-0053 P-3)
ADR-0055: WYSIWYG Editing Mode over Markdown (editor step R4)
ADR-0056: Visual-Editor Chrome via Milkdown Crepe (gated adoption)
ADR-0057: Content Record Is the ProseMirror Document Tree; Markdown Becomes a Derived Projection
ADR-0058: PM_DOC Is the Only Content Format (pre-production cut; amends ADR-0057 §5)
ADR-0059: Editor Engine Switches to TipTap (spike-gated; supersedes the Milkdown/Crepe choice)
ADR-0060: Backup & Restore — Scripted Ordered Backup with Automated Restore Rehearsal
ADR-0061: CSV — Generated Validation Package per Release
ADR-0062: SBOM — CycloneDX over the Production Layers, Validated Against the Artifact
ADR-0063: User Identity Binds on Subject Only (Issuer Becomes Provenance)
ADR-0064: Per-Document Workflow Role Bindings (Author / Reviewer / Releaser), Enforced
ADR-0065: Diagrams — Excalidraw as the Manual Layer, Mermaid Stays for Text-First/UML
ADR-0066: WITHDRAW — the Author Side May Reclaim a Version from Review
ADR-0067: Review Comments — Anchored, Immutable, Resolvable
ADR-0068: Confluence/Jira QMS Import — Staged, Read-Only, Repeatable
ADR-0069: Arbitrary File Attachments — Download-Only Confinement
ADR-0070: Training Questionnaires — Versioned, Auto-Scored, Release-Gated
ADR-0071: Training Plans — Document Obligations + External Trainings & Certifications
ADR-0072: Diagrams — Self-Hosted draw.io Replaces Excalidraw
ADR-0073: Per-Scope QMS Configuration Surface
ADR-0074: PDF Export of Released Documents — Server-Side via Apache FOP over the Canonical Projection
ADR-0075: Source History Import — Continuity Without Forged Audit
ADR-0076: Periodic-review status visibility (completing MVP gap #2)
ADR-0077: Requirement Items — Keyed Blocks Inside Controlled Documents
ADR-0078: Generalized Trace Items (Traceability Model — Stage A)
ADR-0079: Risk & Risk-Control Items (Traceability Model — Stage B)
ADR-0080: Traceability Workspace — Hub, Sub-Pages, and Role-Gated Views
ADR-0081: Draft-Only Trace-Structure Changes, Server-Enforced
ADR-0082: Table-Shaped Risk Authoring over Risk Blocks
ADR-0083: The TD Dossier — a Versioned, Cross-Scope, Regulatory-Structured Deliverable
ADR-0084: Validation & Regulatory Axes (Traceability Model — Stage C)
ADR-0085: Relation-Layer Consolidation — One Trace Vocabulary, One Surface
ADR-0086: Requirement Traceability Chains — End-to-End Path View + Flat Path Export
ADR-0087: The Scope Traceability Report — One Derived Overview Artifact, Never a Controlled Document
ADR-0088: Verification Evidence Classes — Planned vs. Verified, Derived at the Read Layer
ADR-0089: Recurring Obligations — Periodic Tasks With Record Evidence, Not Calendar Series
ADR-0090: Release & Versioning Policy — Deliberate Releases, One Auditor-Facing Number
ADR-0091: Release Modes — Single-Person Record Release With a Structural Four-Eyes Floor
ADR-0092: Orphan-Blob Garbage Collection With a Quarantine Bin
ADR-0093: One Scope Context — the Toolbar Switcher Is the Only Scope Selector
ADR-0094: Calendar-Anchored Obligation Schedules (Clamped, Never Too Late)
ADR-0095: Key-Rule Governance — Free Until First Use, Then Frozen
ADR-0096: Transition Permissions — Always Visible, Deny Unless Granted
ADR-0097: A Governed Provisioning Surface — MANAGE_SCOPES
ADR-0098: Org Chart × Role System — Marriage at the Evidence Level, Never in Authorization
ADR-0099: The User Manual is an In-App Topic Reference, Not a Document
ADR-0100: LQMS Is the Living Quality Management System
ADR-0101: The Executable Validation Journey (PQ Evidence That Cannot Drift)
ADR-0102: Typed Template Variables (text | date | number — and Deliberately No Enum)
ADR-0103: npm audit Joins the Verification Gate as a Second Standing Input
ADR-0104: The Issued Dossier Is a Persisted Artifact of Record — and Clones to a New Draft
ADR-0105: Navigation Information Architecture — Group by Moment-of-Use
ADR-0106: The Client Reflection Follows Assignments, Not Only Content Reach
ADR-0107: The Audit Append Gate Follows Assignment Reach, Not Content Reach
ADR-0108: Mandator Membership — Invite-Accept, with Pre-Assigned Responsibilities
ADR-0109: Organization Founding Is Its Own Process
ADR-0110: The Audit Trail Is Not a Read Model
ADR-0111: The Imported-Person Model, and Project Portability's First Doctrines
ADR-0112: The Element-Kind Catalog — Semantics in the Model, Not Only in the Code
ADR-0113: Project Arrival Import — Records Arrive as They Are, People Arrive as They Were
ADR-0114: The Operating Model Arrives — Roles as Functions, Names as Words, People as This Instance's Decision
ADR-0115: Collaborative Draft Editing — Two Carets, One Truth, Honest Credit
ADR-0116: The System Maintenance Surface — the App Backs Itself Up, the Host Keeps One Dumb Job
ADR-0117: Role Documentation — a Link, a Finding, Per-Source Recognizers; Substitution Rejected
ADR-0118: The Offline QMS Copy — the Repo Carries the Audit Pack, Not a Second Renderer
ADR-0119: Module-Internal Package Structure — Capabilities First, Layers Second, the Root Is the Surface
ADR-0120: The Shared Kernel — the Domain-Exception Vocabulary Leaves the Authorization Module
ADR-0121: The Project Administrator Role — Per-Scope Administration With Read Access, Seeded in the Base Catalog
ADR-0122: Organization-Level Administration — the Cascade Stays, Becomes Visible, and Founds Projects
ADR-0123: Draft Save-Points — Every Save Restorable, Kept for the Life of the Version
ADR-0124: The Birth Path Completes Without Borrowing Content Clothes
ADR-0125: The Export Twin — Export Emits an Arrival Bundle
ADR-0126: Project Dissolution — the Un-Birth of an Unused Scope
ADR-0127: The Base-QMS Layers — One Library, Derived Adaptations, Local Records
ADR-0128: The GLOBAL Cascade Carries Administration, Never Content
ADR-0129: Role Identity from a GLOBAL Assignment Acts in GLOBAL Alone
ADR-0130: Break-Glass — the Project Administrator's Escalation Is a First-Class, Witnessed, Self-Expiring Act
ADR-0131: Role Substitution as Declared Adoption Edges — Emergency Cover Is Governed, Own-Name, Timed Staffing
ADR-0132: Dual-Hat Reviewer Satisfaction Is a Declared Policy Choice — the Strict Floor Stays the Default
ADR-NNNN:
</span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" > <div class="md-nav__link md-nav__container"> <a href="../../requirements/" class="md-nav__link "> <span class="md-ellipsis"> Requirements </span> </a> <label class="md-nav__link " for="__nav_5" id="__nav_5_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_5"> <span class="md-nav__icon md-icon"></span> Requirements </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../requirements/stakeholder_requirements/" class="md-nav__link"> <span class="md-ellipsis"> Stakeholder Requirements </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/gap-analysis/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Gap Analysis </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_admin/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Administration, Permissions & Onboarding </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_api_ui/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: API & User Interface </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_audit_reporting/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Audit Trail & Regulatory Reporting </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_auth/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Authentication & Session </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_backup/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Backup & Restore </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_catalogs/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Catalogs, Roles & Users </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_data_protection/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Data Protection, Retention & Disposal </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_documents/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Documents, Versions & Storage </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_dossiers/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Technical Documentation Dossiers </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_effectivity/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Effectivity, Periodic Review & Validity </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_gspr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Regulatory Conformity (GSPR / Essential Principles) </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_i18n/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Internationalization </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Life Cycle & Reviews </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_memberships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Mandator Membership & Invitations </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_migration/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Migration & Import </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_nfr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Non-Functional </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_notifications/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Notifications & Tasks </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_obligations/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_relationships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Document Relationships </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_risk/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Risk Management (ISO 14971 Hazards & Controls) </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_sbom/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Software Bill of Materials & Supply-Chain Assurance </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_search/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Search </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_separation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Scopes, Mandators & Separation </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_signatures/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Electronic Signatures </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_training/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Read-Acknowledgement & Questionnaires </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_users/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: User Identity & Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_validation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Design Validation & the Validation Traceability Axis </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" > <div class="md-nav__link md-nav__container"> <a href="../../process/" class="md-nav__link "> <span class="md-ellipsis"> Process (IEC 62304) </span> </a> <label class="md-nav__link " for="__nav_6" id="__nav_6_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_6"> <span class="md-nav__icon md-icon"></span> Process (IEC 62304) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../process/configuration_management_plan/" class="md-nav__link"> <span class="md-ellipsis"> Configuration Management Plan </span> </a> </li> <li class="md-nav__item"> <a href="../../process/problem_resolution/" class="md-nav__link"> <span class="md-ellipsis"> Problem Resolution Process </span> </a> </li> <li class="md-nav__item"> <a href="../../process/risk_management/" class="md-nav__link"> <span class="md-ellipsis"> Risk Management </span> </a> </li> <li class="md-nav__item"> <a href="../../process/software_development_plan/" class="md-nav__link"> <span class="md-ellipsis"> Software Development Plan </span> </a> </li> <li class="md-nav__item"> <a href="../../process/verification_plan/" class="md-nav__link"> <span class="md-ellipsis"> Verification Plan </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7" > <label class="md-nav__link" for="__nav_7" id="__nav_7_label" tabindex="0"> <span class="md-ellipsis"> Operations </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_7"> <span class="md-nav__icon md-icon"></span> Operations </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../operations/genesis-installation/" class="md-nav__link"> <span class="md-ellipsis"> Genesis: Birthing an LQMS Installation with a Base Library </span> </a> </li> <li class="md-nav__item"> <a href="../../operations/deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Deployment Guide </span> </a> </li> <li class="md-nav__item"> <a href="../../operations/server-deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Server Deployment (single Linux host, public HTTPS) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_8" > <div class="md-nav__link md-nav__container"> <a href="../../traceability/" class="md-nav__link "> <span class="md-ellipsis"> Traceability </span> </a> <label class="md-nav__link " for="__nav_8" id="__nav_8_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_8_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_8"> <span class="md-nav__icon md-icon"></span> Traceability </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../traceability/matrix/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Traceability Matrix </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_9" > <div class="md-nav__link md-nav__container"> <a href="../../validation/" class="md-nav__link "> <span class="md-ellipsis"> Validation (tool lane) </span> </a> <label class="md-nav__link " for="__nav_9" id="__nav_9_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_9_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_9"> <span class="md-nav__icon md-icon"></span> Validation (tool lane) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../validation/templates/ai-authorship-posture/" class="md-nav__link"> <span class="md-ellipsis"> AI-Authorship Posture — How LQMS Is Built, and Why the Validation Evidence Does Not Rest on It (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../../validation/templates/intended-use/" class="md-nav__link"> <span class="md-ellipsis"> Intended-Use Specification — LQMS as a QMS / Document-Control Tool (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../../validation/templates/tool-risk-assessment/" class="md-nav__link"> <span class="md-ellipsis"> Tool-Risk Assessment — LQMS as a QMS Tool (TEMPLATE) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_10" > <label class="md-nav__link" for="__nav_10" id="__nav_10_label" tabindex="0"> <span class="md-ellipsis"> Regulatory </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_10_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_10"> <span class="md-nav__icon md-icon"></span> Regulatory </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../regulatory/mdr-annex-i-skeleton/" class="md-nav__link"> <span class="md-ellipsis"> MDR Annex I — GSPR authoring skeleton (paraphrased) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_11" > <div class="md-nav__link md-nav__container"> <a href="../../user-guide/" class="md-nav__link "> <span class="md-ellipsis"> User guide </span> </a> <label class="md-nav__link " for="__nav_11" id="__nav_11_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_11_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_11"> <span class="md-nav__icon md-icon"></span> User guide </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../user-guide/tutorial/" class="md-nav__link"> <span class="md-ellipsis"> Tutorial — from zero to a released document </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/administration/" class="md-nav__link"> <span class="md-ellipsis"> Administering an LQMS Installation </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/diagrams/" class="md-nav__link"> <span class="md-ellipsis"> Diagrams </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/documents-lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Documents & the Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/exports/" class="md-nav__link"> <span class="md-ellipsis"> PDF Exports & the Audit Pack </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/obligations/" class="md-nav__link"> <span class="md-ellipsis"> Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/project-context/" class="md-nav__link"> <span class="md-ellipsis"> The Project Context & App Version </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/review-comments/" class="md-nav__link"> <span class="md-ellipsis"> Review Comments </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/activity-trail/" class="md-nav__link"> <span class="md-ellipsis"> Who did what, when — reading a project's activity </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/admin-scopes/" class="md-nav__link"> <span class="md-ellipsis"> Renaming a project, and what can never change </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/authority-view/" class="md-nav__link"> <span class="md-ellipsis"> Who holds each function here, and what may it do </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/break-glass/" class="md-nav__link"> <span class="md-ellipsis"> The permission I need is held by a role I do not hold — what now? </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/coverage-and-chains/" class="md-nav__link"> <span class="md-ellipsis"> Coverage or chains? — which requirement view answers your question </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/credentials/" class="md-nav__link"> <span class="md-ellipsis"> Your password: changing it, resetting it — and why LQMS never sees it </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/emergency-cover/" class="md-nav__link"> <span class="md-ellipsis"> Who may cover for whom here — declaring emergency cover, and reading where the glass was broken </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/key-rules/" class="md-nav__link"> <span class="md-ellipsis"> Special elements: what a project declares, and when its names freeze </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/memberships/" class="md-nav__link"> <span class="md-ellipsis"> Belonging to an organization: invitations, acceptance, and what they change </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/provisioning-birth-path/" class="md-nav__link"> <span class="md-ellipsis"> How a new organization and project are born </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/review-policies/" class="md-nav__link"> <span class="md-ellipsis"> What a review policy controls, and what an empty grant means </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/setup-wizard-lanes/" class="md-nav__link"> <span class="md-ellipsis"> The setup wizard: the lanes, and what it writes </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/staffing-and-assignments/" class="md-nav__link"> <span class="md-ellipsis"> Staffing people into roles, and the accountable holder </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/technical-dossier/" class="md-nav__link"> <span class="md-ellipsis"> How do I assemble a technical dossier? </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/trace-items/" class="md-nav__link"> <span class="md-ellipsis"> Trace Items — Requirements, Risks & Risk Controls </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/trace-links/" class="md-nav__link"> <span class="md-ellipsis"> Trace Links & the Suspect Cycle </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/traceability-workspace/" class="md-nav__link"> <span class="md-ellipsis"> The Traceability Workspace </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/training/" class="md-nav__link"> <span class="md-ellipsis"> Training & Acknowledgements </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" > <div class="md-sidebar__scrollwrap"> <div class="md-sidebar__inner"> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class="md-nav__title" for="__toc"> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix> <li class="md-nav__item"> <a href="#deployment-form-as-built" class="md-nav__link"> <span class="md-ellipsis"> Deployment form (as built) </span> </a> </li> <li class="md-nav__item"> <a href="#database-roles--the-bypassrls-requirement-and-the-split-role-hardening" class="md-nav__link"> <span class="md-ellipsis"> Database roles — the BYPASSRLS requirement and the split-role hardening </span> </a> </li> <li class="md-nav__item"> <a href="#71-backup--restore" class="md-nav__link"> <span class="md-ellipsis"> 7.1 Backup & restore </span> </a> <nav class="md-nav" aria-label="7.1 Backup & restore"> <ul class="md-nav__list"> <li class="md-nav__item"> <a href="#what-a-full-backup-contains-and-why-the-order-matters" class="md-nav__link"> <span class="md-ellipsis"> What a full backup contains and why the order matters </span> </a> </li> <li class="md-nav__item"> <a href="#schedule-examples" class="md-nav__link"> <span class="md-ellipsis"> Schedule examples </span> </a> </li> <li class="md-nav__item"> <a href="#retention-b-3--disposal--backup-interplay" class="md-nav__link"> <span class="md-ellipsis"> Retention (B-3 — disposal ↔ backup interplay) </span> </a> </li> <li class="md-nav__item"> <a href="#restore-runbook" class="md-nav__link"> <span class="md-ellipsis"> Restore runbook </span> </a> </li> <li class="md-nav__item"> <a href="#restore-rehearsal-the-differentiator-b-2a" class="md-nav__link"> <span class="md-ellipsis"> Restore rehearsal (the differentiator, B-2a) </span> </a> </li> <li class="md-nav__item"> <a href="#keycloak-volume-continuity-adr-0063-dependency" class="md-nav__link"> <span class="md-ellipsis"> Keycloak-volume continuity (ADR-0063 dependency) </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-content" data-md-component="content"> <article class="md-content__inner md-typeset"> <a href="https://github.com/nburri/lqms/edit/main/docs/architecture/07_deployment_view.md" title="Edit this page" class="md-content__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id="7-deployment-view">7. Deployment View<a class="headerlink" href="#7-deployment-view" title="Permanent link">¶</a></h1> <p>The full operator-facing guide is <a href="../../operations/deployment/">docs/operations/deployment.md</a> (every configuration key, IdP integration, the bootstrap flow, sweep tuning, upgrades); this section states the architecturally significant shape.</p> <h2 id="deployment-form-as-built">Deployment form (as built)<a class="headerlink" href="#deployment-form-as-built" title="Permanent link">¶</a></h2> <ul> <li><strong>Backend:</strong> a single OCI container image built by the multi-stage <a href="https://github.com/nburri/lqms/blob/main/deploy/Dockerfile"><code>deploy/Dockerfile</code></a>. The build stage (<code>eclipse-temurin:21-jdk-noble</code></li> <li>Node) runs <code>./gradlew :backend:api:quarkusBuild -Dquarkus.quinoa=true</code>; the <strong>runtime stage is a Quarkus JVM fast-jar on <code>eclipse-temurin:25-jre-noble</code></strong>, run as a non-root <code>lqms</code> user, listening on <code>0.0.0.0:8080</code>. A GraalVM <strong>native image is not built</strong> — the JVM fast-jar is the shipped form (TBD if native is ever pursued). jOOQ codegen needs a Docker socket the hermetic image build lacks, so pre-generated jOOQ sources are fed in via <code>-Plqms.jooq.provided</code> (deployment.md §2 — the operator regenerates them when migrations change).</li> <li><strong>Frontend:</strong> the Angular SPA is bundled same-origin into the backend jar by Quarkus Quinoa (ADR-0032) — <code>/</code> triggers OIDC login, <code>/api/*</code> is the authenticated API, static assets are public; no separate frontend deployment.</li> <li><strong>Database:</strong> PostgreSQL (the reference stack pins <strong>18</strong>), holding all state under FORCE row-level security.</li> <li><strong>Document files:</strong> a server-filesystem content store at <code>LQMS_STORAGE_ROOT</code> (a mounted volume; <code>/app/data/content</code> by default), S3-compatible store as a future option (ADR-0001).</li> <li><strong>Authentication:</strong> an external OIDC provider — a corporate IdP or the bundled Keycloak (the reference stack pins <strong>26.4</strong>); LQMS stores no credentials (ADR-0011).</li> <li><strong>LLM (search layers 2–3):</strong> cloud-based or on-prem per mandator policy — future work (§8.7 / §8 security concepts).</li> <li><strong>Reference stack:</strong> <a href="https://github.com/nburri/lqms/blob/main/deploy/docker-compose.yml"><code>deploy/docker-compose.yml</code></a> wires app + PostgreSQL + Keycloak with named volumes (<code>lqms-db</code>, <code>lqms-kc</code>, <code>lqms-content</code>); it is a demo/colleague-feedback topology (demo secrets, single datasource), not the hardened production posture below.</li> </ul> <div class="highlight"><pre><span></span><code><a id="__codelineno-0-1" name="__codelineno-0-1" href="#__codelineno-0-1"></a>browser ──TLS──> [ reverse proxy / TLS term ] ──> LQMS app (:8080, JVM fast-jar on Temurin 25-jre) <a id="__codelineno-0-2" name="__codelineno-0-2" href="#__codelineno-0-2"></a> │ ├── PostgreSQL 18 (data + FORCE RLS) <a id="__codelineno-0-3" name="__codelineno-0-3" href="#__codelineno-0-3"></a> │ └── content store (filesystem volume) <a id="__codelineno-0-4" name="__codelineno-0-4" href="#__codelineno-0-4"></a> ──OIDC──> IdP (corporate or Keycloak) <─────┘ (discovery, JWKS, token, login redirect) </code></pre></div> <h2 id="database-roles--the-bypassrls-requirement-and-the-split-role-hardening">Database roles — the BYPASSRLS requirement and the split-role hardening<a class="headerlink" href="#database-roles--the-bypassrls-requirement-and-the-split-role-hardening" title="Permanent link">¶</a></h2> <p>Mandator/project separation is enforced in the database: every content table is <code>FORCE</code> RLS, and the cross-tenant fan-out (<code>lqms_fanout_source_event</code>, SECURITY DEFINER) can only cross scope boundaries if its <strong>owner — the role that ran the migrations — is superuser or has <code>BYPASSRLS</code></strong>. A plain owner makes the fan-out fail <em>closed for separation but silent for compliance</em> (derived tenants are never notified). The app therefore runs <code>FanoutDeploymentCheck</code> at startup and <strong>refuses to boot</strong> if the owner cannot bypass RLS (ADR-0035 §7).</p> <p>The reference stack is <strong>single-datasource</strong>: the app connects with the same BYPASSRLS migration role it migrates with, but runtime RLS is still enforced for content access — every content transaction enters the NOBYPASSRLS role via <code>SET LOCAL ROLE lqms_app</code> (<code>RlsScopeContext</code>, ADR-0026) before touching data. The <strong>hardened production posture</strong> splits this into a BYPASSRLS <code>lqms_migration</code> role (Flyway + DEFINER owner) and a separate NOBYPASSRLS <code>lqms_runtime</code> datasource, so a query that forgets its scope filter fails closed at the database. That split is staged, not yet implemented — see <a href="../../operations/deployment/#4-database-roles-and-the-bypassrls-requirement-read-this">deployment.md §4 "Two-role hardening"</a> and the accepted defense-in-depth debt in §11.</p> <p>Backup zips must be restorable on the same or a different server (see §7.1).</p> <h2 id="71-backup--restore">7.1 Backup & restore<a class="headerlink" href="#71-backup--restore" title="Permanent link">¶</a></h2> <p>Realizes <a href="../../decisions/adr-0060-backup-restore-mechanism/">ADR-0060</a> (mechanism B-1a, restore rehearsal B-2a, disposal interplay B-3) against the reference stack in <code>deploy/docker-compose.yml</code>. Regulatory anchor: ISO 13485 §4.2.4 g) (prevent loss of documents) and §4.2.5 (records stay retrievable). For a QMS that lives in LQMS the backup system <strong>is</strong> that control, so restore is <em>proven weekly</em>, not assumed.</p> <p>Three deploy-side scripts, all Bash 3.2 compatible (they run on the operator's machine; the heavy lifting happens inside containers):</p> <table> <thead> <tr> <th>Script</th> <th>Role</th> </tr> </thead> <tbody> <tr> <td><code>deploy/backup.sh</code></td> <td>Nightly full backup → one self-contained zip (REQ-BAK-001).</td> </tr> <tr> <td><code>deploy/verify-backup.sh</code></td> <td>Weekly restore rehearsal into a throwaway scratch project; writes a dated verification record.</td> </tr> <tr> <td><code>deploy/restore.sh</code></td> <td>Operator restore of an archive into a compose project, with the post-restore obligations.</td> </tr> </tbody> </table> <h3 id="what-a-full-backup-contains-and-why-the-order-matters">What a full backup contains and why the order matters<a class="headerlink" href="#what-a-full-backup-contains-and-why-the-order-matters" title="Permanent link">¶</a></h3> <p>An archive holds, in this order: <strong>content blobs first, then the database dump, then the Keycloak realm export, then a manifest</strong> (REQ-BAK-001 inventory). The ordering is the consistency mechanism (ADR-0001): blobs are immutable and SHA-256-named, so <em>blobs-first, database-second</em> makes the archive self-consistent <strong>without stopping the application</strong> — a dangling DB→blob reference can only arise in the reverse order. Every copied blob is re-hashed against its filename during the copy (REQ-BAK-004); any mismatch fails the backup loudly and doubles as bit-rot detection on the primary store. Keycloak's dev-mode H2 file locks while <code>start-dev</code> runs, so the realm export (users included, via <code>kc.sh export</code>) is the one step that briefly pauses Keycloak — the app and its data keep running (ADR-0060 D-4; the production-shaped answer is Keycloak on PostgreSQL, which dissolves this special case). <strong>No secrets go into the archive</strong> (ADR-0060 §1 item 5): DB passwords, the OIDC client secret and the Keycloak admin password are re-provisioned on restore.</p> <p>The manifest records: creation timestamp, the app git SHA + build timestamp (from <code>/api/version</code>), blob count / total bytes / a hash sample, the dump and realm-export SHA-256s, the retention window, and tool versions.</p> <h3 id="schedule-examples">Schedule examples<a class="headerlink" href="#schedule-examples" title="Permanent link">¶</a></h3> <p>Nightly backup (RPO ≤ 24 h, REQ-NFR-004) and weekly rehearsal. Set <code>LQMS_BACKUP_TARGET</code> for the off-box copy (ADR-0018 — "stored separately from the primary system") and <code>LQMS_BACKUP_PING_URL</code> for the dead-man success ping (absence of the ping is the alert).</p> <p>cron (Linux host):</p> <div class="highlight"><pre><span></span><code><a id="__codelineno-1-1" name="__codelineno-1-1" href="#__codelineno-1-1"></a># nightly full backup at 02:15 — a USER crontab (lqms-ops), matching the reference installation <a id="__codelineno-1-2" name="__codelineno-1-2" href="#__codelineno-1-2"></a># (server-deployment.md §9.1). The off-box target and dead-man ping shown here are the INTENDED <a id="__codelineno-1-3" name="__codelineno-1-3" href="#__codelineno-1-3"></a># shape; on the reference installation both are still pending host-side setup (§9.1 names them). <a id="__codelineno-1-4" name="__codelineno-1-4" href="#__codelineno-1-4"></a>15 2 * * * cd /home/lqms-ops/lqms/deploy && LQMS_BACKUP_TARGET=/mnt/nas/lqms LQMS_BACKUP_PING_URL=https://hc-ping.com/<uuid> ./backup.sh >> /home/lqms-ops/lqms-backup.log 2>&1 <a id="__codelineno-1-5" name="__codelineno-1-5" href="#__codelineno-1-5"></a># weekly restore rehearsal, Sundays 03:30 (scratch project, distinct ports) — on a SEPARATE machine <a id="__codelineno-1-6" name="__codelineno-1-6" href="#__codelineno-1-6"></a># where possible (§9.3) <a id="__codelineno-1-7" name="__codelineno-1-7" href="#__codelineno-1-7"></a>30 3 * * 0 cd /home/lqms-ops/lqms/deploy && ./verify-backup.sh >> /home/lqms-ops/lqms-verify.log 2>&1 </code></pre></div> <p>launchd (macOS) — one <code>StartCalendarInterval</code> agent per script; the backup agent's <code>ProgramArguments</code> is equivalent to the cron line:</p> <div class="highlight"><pre><span></span><code><a id="__codelineno-2-1" name="__codelineno-2-1" href="#__codelineno-2-1"></a><span class="nt"><key></span>ProgramArguments<span class="nt"></key></span> <a id="__codelineno-2-2" name="__codelineno-2-2" href="#__codelineno-2-2"></a><span class="nt"><array></span> <a id="__codelineno-2-3" name="__codelineno-2-3" href="#__codelineno-2-3"></a><span class="w"> </span><span class="nt"><string></span>/bin/bash<span class="nt"></string></span> <a id="__codelineno-2-4" name="__codelineno-2-4" href="#__codelineno-2-4"></a><span class="w"> </span><span class="nt"><string></span>-lc<span class="nt"></string></span> <a id="__codelineno-2-5" name="__codelineno-2-5" href="#__codelineno-2-5"></a><span class="w"> </span><span class="nt"><string></span>cd<span class="w"> </span>/Users/you/lqms/deploy<span class="w"> </span><span class="err">&&</span><span class="w"> </span>LQMS_BACKUP_TARGET=/Volumes/backup/lqms<span class="w"> </span>./backup.sh<span class="nt"></string></span> <a id="__codelineno-2-6" name="__codelineno-2-6" href="#__codelineno-2-6"></a><span class="nt"></array></span> <a id="__codelineno-2-7" name="__codelineno-2-7" href="#__codelineno-2-7"></a><span class="nt"><key></span>StartCalendarInterval<span class="nt"></key></span> <a id="__codelineno-2-8" name="__codelineno-2-8" href="#__codelineno-2-8"></a><span class="nt"><dict><key></span>Hour<span class="nt"></key><integer></span>2<span class="nt"></integer><key></span>Minute<span class="nt"></key><integer></span>15<span class="nt"></integer></dict></span> </code></pre></div> <h3 id="retention-b-3--disposal--backup-interplay">Retention (B-3 — disposal ↔ backup interplay)<a class="headerlink" href="#retention-b-3--disposal--backup-interplay" title="Permanent link">¶</a></h3> <p>Local archives are pruned past a <strong>bounded retention window, default 35 days</strong> (<code>LQMS_BACKUP_RETENTION_DAYS</code>, REQ-DPR-011 / ADR-0025). The customer-facing statement:</p> <blockquote> <p><strong>Disposed content persists in backups for at most the retention window (35 days by default, configurable).</strong> After disposal, content lingers in existing archives only until they age out of that window. <strong>Legal holds do NOT extend backups</strong> (ADR-0040): a hold prevents disposal <em>upstream</em> in the live system; it does not preserve or lengthen the retention of archives.</p> </blockquote> <p>Pruning the <em>off-box</em> copies to the same window is the operator's responsibility on the destination (the script prunes the local copy; see <code>LQMS_BACKUP_TARGET</code>).</p> <h3 id="restore-runbook">Restore runbook<a class="headerlink" href="#restore-runbook" title="Permanent link">¶</a></h3> <ol> <li>Obtain the archive (from the off-box target if the primary host is lost) onto a host with the compose stack and a <strong>same-or-newer</strong> app image (Flyway migrates forward only — never backward).</li> <li><code>cd deploy && ./restore.sh <archive.zip> [--project NAME] [--force]</code>. It refuses to run against a project that already has volumes unless <code>--force</code> (which wipes them). It then, in order: loads the blobs into a fresh content volume, starts PostgreSQL on a fresh volume (<code>postgres-init.sql</code> recreates the roles), <code>pg_restore</code>s the dump (ownership + grants preserved, so objects stay owned by the BYPASSRLS <code>lqms_migration</code> role per ADR-0035 §7), imports the Keycloak realm <strong>with users</strong> into a fresh Keycloak volume, and starts the app (which Flyway-migrates forward).</li> <li><strong>Mandatory RE-DISPOSAL step</strong> (regulatory — ADR-0060 §Decision 3, ADR-0025). A restore of a pre-disposal archive <strong>resurrects content that was disposed after the archive's timestamp</strong>. The disposal audit trail <em>survives</em> disposal, so it is the source of truth: compare the restored DB's disposal log against the latest known disposal log and <strong>re-execute every disposal recorded after the archive's <code>created_at</code></strong>. <code>restore.sh</code> prints this obligation on every run; it is not optional.</li> <li><strong>Re-provision secrets</strong> (they are never in the archive): PostgreSQL superuser + <code>lqms_migration</code> password, Keycloak admin password, the <code>lqms-app-secret</code> OIDC client secret (must match in compose <em>and</em> the realm), and every real user password. See <code>deploy/README.md</code> and this document's demo caveats.</li> <li>Verify end-to-end (<code>deploy/smoke.sh</code>) and reindex search if it was excluded from the dump (REQ-BAK-003 permits exclude+rebuild; the current dump includes it). Target: within RTO ≤ 1 business day (ADR-0018) — the weekly rehearsal continuously proves the mechanical part takes minutes, not days.</li> </ol> <h3 id="restore-rehearsal-the-differentiator-b-2a">Restore rehearsal (the differentiator, B-2a)<a class="headerlink" href="#restore-rehearsal-the-differentiator-b-2a" title="Permanent link">¶</a></h3> <p><code>verify-backup.sh</code> restores the <strong>newest</strong> archive into a scratch compose project (distinct project name, distinct published ports via <code>LQMS_VERIFY_APP_PORT</code> / <code>LQMS_VERIFY_KC_PORT</code>, distinct volumes) that runs <em>alongside</em> the primary stack, then verifies: the app is healthy and <code>/api/version</code> matches the manifest SHA; blob re-hash is clean over the restored store; and <strong>referential closure</strong> — every <code>content_part</code> blob reference in the restored DB resolves to a file (the corruption direction the ordering rule prevents, verified rather than trusted). The scratch project is always torn down, and a dated record line is appended to <code>deploy/backup-verification.log</code> (gitignored) and printed. That record chain is the audit answer to "when did you last prove a restore?" and is the recurring objective evidence the CSV validation package cites (ADR-0061).</p> <h3 id="keycloak-volume-continuity-adr-0063-dependency">Keycloak-volume continuity (ADR-0063 dependency)<a class="headerlink" href="#keycloak-volume-continuity-adr-0063-dependency" title="Permanent link">¶</a></h3> <p>Identities bind on the Keycloak <strong>subject</strong> (user UUID) alone, not on the issuer (ADR-0063), so a change of host/scheme/proxy keeps users' roles and documents. The one hard continuity requirement is that <strong>Keycloak's state survives</strong> — subjects are Keycloak user UUIDs, so identities live only as long as Keycloak's data does. That is exactly why the realm export (users included) rides <strong>every</strong> backup and is re-imported on <strong>every</strong> restore: losing the Keycloak state orphans every user under any key design. When Keycloak moves to a PostgreSQL backing store (ADR-0060 D-4), its state rides the same <code>pg_dump</code> and this dedicated export step disappears.</p> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> <button type="button" class="md-top md-icon" data-md-component="top" hidden> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg> Back to top </button> </main> <footer class="md-footer"> <nav class="md-footer__inner md-grid" aria-label="Footer" > <a href="../06_runtime_view/" class="md-footer__link md-footer__link--prev" aria-label="Previous: 6. Runtime View"> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </div> <div class="md-footer__title"> <span class="md-footer__direction"> Previous </span> <div class="md-ellipsis"> 6. Runtime View </div> </div> </a> <a href="../08_crosscutting_concepts/" class="md-footer__link md-footer__link--next" aria-label="Next: 8. Crosscutting Concepts"> <div class="md-footer__title"> <span class="md-footer__direction"> Next </span> <div class="md-ellipsis"> 8. Crosscutting Concepts </div> </div> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg> </div> </a> </nav> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class="md-copyright"> <div class="md-copyright__highlight"> Built from <code>v0.9.56-4-g06c7f811</code> (commit <code>06c7f811</code>, 2026-09-09) — the same Markdown the repository ships. </div> </div> </div> </div> </footer> </div> <div class="md-dialog" data-md-component="dialog"> <div class="md-dialog__inner md-typeset"></div> </div> <script id="__config" type="application/json">{"base": "../..", "features": ["navigation.instant", "navigation.tracking", "navigation.top", "navigation.footer", "navigation.indexes", "toc.follow", "search.suggest", "search.highlight", "content.code.copy", "content.action.edit"], "search": "../../assets/javascripts/workers/search.6ce7567c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src="../../assets/javascripts/bundle.83f73b43.min.js"></script> </body> </html>