Availability & resilience

Live health

Obelisk exposes a real health endpoint at /healthz. It's what our own watchdog and any external monitor probe. We deliberately don't paint a fake live-uptime percentage here — we'd rather tell you exactly how the system is built to stay up and recover.

Serving release proof

The serving process identifies the exact code revision below. This is deploy-stamped evidence, not a hand-maintained version label.

Cross-check the same proof in /healthz response headers or the machine-readable changelog.

Recovery targets

Obelisk is engineered for fast disaster recovery rather than the cost of a permanently-running hot standby:

Lose the entire host and a clean instance restores from an off-box backup, verifies every file's hash, and takes over the address — minutes to cutover, not hours.

How availability is protected

• Daily off-box encrypted backups to Cloudflare R2. critical state (identity DB, receipts, issuance log, client and founder records) is bundled, passphrase-encrypted (PBKDF2 + AES-256-GCM) with an integrity-checked manifest, and shipped off the box. Restore verifies every file's hash and refuses a tampered or corrupt backup — it fails closed.
• Self-healing health watchdog. a timer probes /healthz every minute and auto-restarts a wedged or crashed process, so a hung instance recovers without a human in the loop.
• Host-native safeguards. automated whole-box snapshots plus delete- and rebuild-protection backstop the server against an accidental wipe, with an instant address cutover so a rebuilt box takes over without waiting on DNS.
• External monitoring. an independent uptime probe watches /healthz from outside, so a total outage is caught even if the box can't report on itself.

Verifiable transparency

Every security-relevant event in Obelisk lands in an append-only, hash-chained ledger, and each ledger's Merkle head is anchored and published — the same idea as Certificate Transparency, applied to auth. You don't have to trust that our receipts are tamper-evident; you can check:

1. Fetch /.well-known/obelisk-transparency.json and pin headAnchorHash.
2. Re-fetch any time later: entry counts must only grow and heads must chain forward. A shrinking or rewritten head is cryptographic proof of tampering.
3. The anchor store's own head is mirrored off this server, so even the box operator can't rewrite history silently.

Head bedc2795629cbb70… · 300 anchors · anchored 2026-09-15T02:56:35.080Z

Do it interactively: the verify-it-yourself widgets fetch the live head, compare it against a pin you saved, and refold any receipt's Merkle inclusion proof in your own browser.

The honest caveat

Today Obelisk runs on a single well-protected host with fast disaster recovery — a deliberate trade that keeps the service lean while still surviving a total-loss event in about fifteen minutes. A second always-on box (true zero-downtime high availability with a 99.99% SLA) is the upgrade we add when a customer's contract requires it. We'd rather tell you exactly where the line is than imply an SLA we don't yet run.