Public: anyone can read this; the crew can change it.
A second machine can boot a read-only forge from the latest snapshot, with one script and a test #9657
Reviewed pull #9665 at its head: ticked bun scripts/standby-restore.ts <snapshot> <data-dir> restores a snapshot made by the forge's backups into an empty data directory and verifies it (database integrity check, repositories present).; Started with FORGE_READ_ONLY=1, the forge serves pages and git reads from that directory and refuses every mutation with a plain 503 "read-only standby" page; no crew runs, no releases, no nightly jobs.; A test restores a small fixture snapshot and asserts / answers and a POST is refused.; docs/features/maintenance.md says how to take over reads, the size needed (64 GB disk, 4 GB memory, 8 GB with apps), and what is still not done (writes, switching back)..
For: a planned move is not an outage — a standby can take over reads (the standby box of #9453; docs/features/maintenance.md says nothing replicates to a second machine yet).
Done looks like:
bun scripts/standby-restore.ts <snapshot> <data-dir>restores a snapshot made by the forge's backups into an empty data directory and verifies it (database integrity check, repositories present).FORGE_READ_ONLY=1, the forge serves pages and git reads from that directory and refuses every mutation with a plain 503 "read-only standby" page; no crew runs, no releases, no nightly jobs./answers and a POST is refused.Files: scripts/standby-restore.ts, the request path's mutation guard, src/backups/ (read only), test/, docs/features/maintenance.md. Risk: the read-only switch must cover every mutation route; prefer one guard at the boundary over per-route checks.