Docs / Reference

Site recovery & backups

The public site must be rebuildable from company-controlled source and backups alone. Archive.org is an emergency reference for spot-checking lost copy — never the recovery plan.

What must survive independently of production

Asset	Source of truth
Site source	This Next.js app (routes, components, styles) lives in the primary Git remote, not just a deploy target's checkout.
Content & copy	Page copy is committed in-repo (no CMS with sole custody of text). Any future CMS content is exported and backed up on a schedule.
Static assets	Logo, images, and fonts under `public/`, versioned alongside the code that references them.
DNS & nameserver config	Zone records managed as version-controlled infrastructure where the provider supports it (see the DNS change runbook), otherwise exported and stored after every change.
Build & deploy config	Build command, output directory, and environment variables recorded in-repo (`README.md`, `next.config.mjs`) rather than only in the hosting provider's dashboard.
Domain & TLS registration	Registrar and certificate-issuer account ownership documented outside the repo, with recovery contacts kept current.

Why not archive.org

Crawls are irregular, may miss recent pages, and never capture non-public config, build steps, or DNS records.
It has no guaranteed retention and is outside company control — it can be blocked, rate-limited, or simply not have crawled a given page.
It only preserves rendered HTML, not the source needed to actually rebuild and redeploy the site.
Treat it strictly as a last-resort reference for reconstructing wording after loss — not as a substitute for the controlled copies above.

Recovery drill

Periodically clone the repo to a clean machine, run npm install && npm run build, and confirm the site builds without pulling anything from the live production environment.
Confirm DNS records, TLS issuance, and deploy configuration can be reconstructed from the stored copies alone.
Record the drill date and outcome; treat a failed drill as a gap to close before the next production DNS or hosting change.

Control:Public site must be rebuildable from company-controlled source and backups without relying on the live production environment.

← Disaster recovery & failover Secrets: leak prevention & rotation →

What must survive independently of production

Asset	Source of truth
Site source	This Next.js app (routes, components, styles) lives in the primary Git remote, not just a deploy target's checkout.
Content & copy	Page copy is committed in-repo (no CMS with sole custody of text). Any future CMS content is exported and backed up on a schedule.
Static assets	Logo, images, and fonts under `public/`, versioned alongside the code that references them.
DNS & nameserver config	Zone records managed as version-controlled infrastructure where the provider supports it (see the DNS change runbook), otherwise exported and stored after every change.
Build & deploy config	Build command, output directory, and environment variables recorded in-repo (`README.md`, `next.config.mjs`) rather than only in the hosting provider's dashboard.
Domain & TLS registration	Registrar and certificate-issuer account ownership documented outside the repo, with recovery contacts kept current.

Why not archive.org

Crawls are irregular, may miss recent pages, and never capture non-public config, build steps, or DNS records.

It has no guaranteed retention and is outside company control — it can be blocked, rate-limited, or simply not have crawled a given page.

It only preserves rendered HTML, not the source needed to actually rebuild and redeploy the site.

Treat it strictly as a last-resort reference for reconstructing wording after loss — not as a substitute for the controlled copies above.

Recovery drill

Periodically clone the repo to a clean machine, run npm install && npm run build, and confirm the site builds without pulling anything from the live production environment.

Confirm DNS records, TLS issuance, and deploy configuration can be reconstructed from the stored copies alone.

Record the drill date and outcome; treat a failed drill as a gap to close before the next production DNS or hosting change.

Control:Public site must be rebuildable from company-controlled source and backups without relying on the live production environment.