BCE runs on a self-hosted server — no managed database service quietly backing things up. If a drive fails or a deploy goes wrong, recovery is entirely on whatever backup system exists. This one is built so that running a restore is never a leap of faith.
Every backup is independently restorable and verified, with an automatic safety snapshot and required CEO approval before anything gets overwritten.
Recovery meant hoping, not knowing
Checksummed, independent, approved
Every restore has a rollback path
The original setup had no formal backup process — recovery meant manually dumping the database and hoping nobody needed the media files. Worse, a naive "unified" backup would force restoring the database and media together even when only one had actually gone wrong, and any restore was a one-way door: if it went badly, there was nothing to roll back to.
Database and media backups stay as separate models — checksummed, compressed, and independently verified — but a RestorePoint ties them together for a given recovery operation, letting the CEO restore the database, the media, or both, independently. Before any restore runs, the system automatically creates a fresh safety backup of whatever's about to be overwritten, and the whole operation requires explicit CEO approval before it executes.
Database backups run with SHA256 checksums and compression tracking; media backups copy files with per-file verification and a log of anything that failed. Both run as Celery tasks, on a schedule or on demand.
The CEO picks which backup(s) to restore — database, media, or both are independent choices — and whether to clear existing media or merge with it.
Before touching anything, the system creates its own pre-restore backup of the current state — enabled by default — so a bad restore has something to roll back to.
A CEO has to explicitly approve the restore point before it runs. Progress is tracked step by step, and if it fails partway through, the system can roll back using the safety backup it just made.
The scary part of any restore isn't the backup — it's the moment you overwrite something you can't get back. Making the safety backup automatic instead of optional, and putting a CEO approval step in front of the button, turns "hope this works" into a recoverable decision either way.