p24-infra Docs

2736-art-agency-supabase-registration

2 min read

Design — Register Art Agency Supabase Project in Inventory

Issue: #2736 · Status: Design (plan + checklist) · Batch: K (#3338)

Art Agency uses a separate Supabase project (keys in secrets/art-agency.env.sops) that is not registered in any infrastructure inventory. This plan defines the registration steps and the data each step needs.

1. Gap

  • Not present in dev_r_services (Supabase compliance registry) → invisible to compliance workbook tracking and the EU AI Act deadline (2026-08-02).
  • Not listed in docs/infrastructure-overview.md §Supabase projects.
  • No rotation schedule in the secret-rotation access matrix.
  • No documented backup SLA / data-retention policy.

2. Registration checklist

2.1 Identify the project (read-only, do first)

  • Project ref (from secrets/art-agency.env.sops — key names only, e.g. ART_AGENCY_SUPABASE_URL → subdomain is the ref). Never print values.
  • Plan tier (Free / Pro) and region — determines backup capability (see §3).

2.2 dev_r_services row (secret-manager or admin-scoped session)

  • Insert/patch a row for the Art Agency Supabase project: service, category='database', compliance_workbook='yes', workbook_url=<docs link>, owner, environment='art-agency'.

2.3 docs/infrastructure-overview.md

  • Add a bullet under §Supabase projects with: project ref, region, plan, what it stores, link to secrets/art-agency.env.sops (file name only), backup posture.

2.4 Rotation schedule

  • Add Art Agency Supabase keys (ANON, SERVICE_ROLE, JWT secret — names only) to the secret-rotation access matrix with a cadence (recommend: same tier as other Supabase service keys) and owning role (secret-manager).

2.5 Backup SLA & retention

  • Document backup mechanism from §3, RPO/RTO, and data-retention policy in the overview entry (and, if it grows, a dedicated docs/art-agency-operations.md).

3. Backup posture by plan

PlanBuilt-in backupAction
Freenone / limited PITRrecommend nightly pg_dump → Wasabi p24-infra bucket via a cron following the Error Notification Standard
Prodaily automated + PITRdocument retention window; confirm it meets the compliance SLA

4. AI-system note

If the Art Agency Supabase project backs any AI-powered feature (KDP automation, generation pipelines), it must also be reflected in dev_r_ai_systems + docs/eu-ai-act-compliance.md per the CLAUDE.md compliance rule. Confirm during §2.1.

5. Ownership & out of scope

  • The actual dev_r_services write and any SOPS/rotation-matrix edits are secret-manager / admin work — this dev-issue produces the plan and checklist only.
  • No credential value is read or displayed; the doc references key names and the SOPS file name.

Design-only deliverable. Related: docs/infrastructure-overview.md, secrets/art-agency.env.sops (names only), docs/eu-ai-act-compliance.md.

Graph View