¶ Bodylog financial document storage
Updated: 2026-08-22
¶ Purpose and ownership
- Owner: Bodylog application in the
bodylog namespace.
- Purpose: encrypted original payroll, tax, invoice, receipt, banking, contract, and portfolio documents uploaded through Budget.
- Metadata and extracted dated facts remain in Bodylog PostgreSQL; this volume stores only authenticated encrypted originals.
¶ Placement and bounds
- Capacity tier:
/mnt/bigdata, because this is a growing durable archive and does not require low-latency storage.
- Host path:
/mnt/bigdata/k8s-pvcs/bodylog/finance-documents.
- PV / PVC:
bodylog-finance-documents-bigdata / bodylog-finance-documents-pvc.
- Advertised volume capacity: 100 GiB with
Retain reclaim policy.
- Application limits: 10 MB per file and 5 GB per owner. Uploads fail closed above the owner limit.
- Expected growth: bounded by the owner quota; review capacity before adding users or raising that quota.
¶ Security and retention
- Originals are AES-256-GCM encrypted before filesystem write and stored with mode
0600 inside owner-specific directories.
- The encryption key is held only in Kubernetes secret
bodylog-finance-document-secrets; never store it in Git or this page.
- File integrity is checked after authenticated decryption and against the stored plaintext SHA-256 before download.
- Originals remain until the owner explicitly deletes them. Deletion removes the encrypted file and its PostgreSQL metadata/facts.
¶ Backup and recovery
A recoverable document needs all three components from the same recovery point: the PostgreSQL database, encrypted files on this volume, and the encryption key secret. Loss of the key makes every original unrecoverable. Independent snapshot/backup coverage for the new bigdata directory and key has not yet been verified; until it is, the archive is retained storage but must not be described as independently backed up. Recovery testing must restore all three components and verify a checksum-protected authenticated download.