gabriel / musehub public
docs patch infra/staging-rds-encrypt-at-rest #1 / 1
AI Agent gabriel · 2 days ago · Sep 9, 2026 · Diff

docs: record staging RDS encryption-at-rest fix

Fixed the StorageEncrypted:false gap flagged in Phase 1's hardening checklist. RDS storage encryption can't be enabled on an existing instance, so this required snapshot -> encrypted copy (via KMS) -> restore into a new instance (musehub-staging-db-v2). Verified data matched exactly before cutover (74 tables, 28 repos, 8 identities on both sides). DATABASE_URL updated in SSM, staging redeployed, verified live via /healthz and a real repo-list API query.

Old unencrypted musehub-staging-db instance retained (not deleted) through the same 2+ week safety window pattern used elsewhere in this migration -- it is no longer receiving traffic. Both staging and production RDS instances are now encrypted at rest.

sha256:c157efa528d47a47935835da16b3f7a81dfe444cedc435aa4c47123e1fe433ce sha
sha256:b50eb009cfc837b9898722d09b046f5aeb54d6e6b1b281d97317eeeeb7d54497 parent
~6 symbols
1 changed · 1061 in snapshot files
sha256:2130f9aa1de818b87a1eb694c0cd620efa8d23ae9c6b6344d87cee8b30bba173 snapshot
~6
symbols modified
1
file changed
1061
files in snapshot
0
dead code introduced
Semantic Changes 6 symbols
+ .vscode/
+ alembic/
+ alembic/versions/
+ deploy/
+ deploy/load-tests/
+ docs/
+ docs/architecture/
+ docs/guides/
+ docs/issues/
+ docs/issues/assets/
+ docs/legal/
+ docs/mists/
+ docs/production-readiness/
+ docs/reference/
+ docs/releases/
+ docs/roadmaps/
+ musehub/
+ musehub/api/
+ musehub/api/routes/
+ musehub/api/routes/api/
+ musehub/api/routes/musehub/
+ musehub/auth/
+ musehub/core/
+ musehub/crypto/
+ musehub/db/
+ musehub/debug/
+ musehub/graph/
+ musehub/maintenance/
+ musehub/mcp/
+ musehub/mcp/tools/
+ musehub/mcp/write_tools/
+ musehub/middleware/
+ musehub/models/
+ musehub/muse_cli/
+ musehub/proposals/
+ musehub/protocol/
+ musehub/security/
+ musehub/services/
+ musehub/storage/
+ musehub/templates/
+ musehub/templates/mcp/
+ musehub/templates/musehub/
+ musehub/templates/musehub/fragments/
+ musehub/templates/musehub/macros/
+ musehub/templates/musehub/opengraph/
+ musehub/templates/musehub/pages/
+ musehub/templates/musehub/partials/
+ musehub/templates/musehub/static/
+ musehub/templates/musehub/static/vendor/
+ musehub/types/
+ scripts/
+ src/
+ src/scss/
+ src/scss/components/
+ src/scss/pages/
+ src/scss/patterns/
+ src/scss/theme/
+ src/ts/
+ src/ts/pages/
+ tests/
+ tests/unit/
+ tools/
+ workflows/
~ docs/database-architecture.md .md 6 symbols modified
~ MuseHub Database Architecture — Canonical Source of Truth
~ Current state (as of 2026-09-08) — verified live, not assumed
~ table
~ Migration plan — phased, no step skipped
~ Phase 1 — Formally correct staging's secrets pipeline (small, low risk) — DONE 2026-09-08
~ Phase 4 — Documentation and ticket reconciliation — mostly DONE 2026-09-08
Files Changed
~1
1061 in snapshot
~ docs/database-architecture.md .md
← Older Oldest on infra/staging-rds-encrypt-at-rest
All commits
Newer → Latest on infra/staging-rds-encrypt-at-rest

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:c157efa528d47a47935835da16b3f7a81dfe444cedc435aa4c47123e1fe433ce --body "your comment"