establish a static site restore procedure

This procedure was just tested live with status.torproject.org by
@lavamind.

howto/static-component.md

@@ -199,6 +199,64 @@ TODO: add a disaster recovery.
 <!-- rebuild from scratch? not necessarily those procedures (e.g. see -->
 <!-- "Installation" below but some pointers. -->
 
+### Restoring a site from backups
+
+The first thing you need to decide is where you want to restore from. Typically you want to restore the site from the **source** server. If you do not know where the source server is, you can find it in `tor-puppet.git`, in the `modules/roles/files/static-components.yaml`.
+
+Then head to the Bacula director to perform the restore:
+
+    ssh bacula-director-01
+
+And run the [restore procedure](https://gitlab.torproject.org/tpo/tpa/team/-/wikis/howto/backup#restore-files). Enter the bacula console:
+
+    # bconsole
+
+Then the procedure, in this case we're restoring from static-gitlab-shim:
+
+    restore
+    5 # (restores latest backup from a host)
+    77 # (picks static-gitlab-shim from the list)
+    mark /srv/static-gitlab-shim/status.torproject.org
+    done
+    yes
+
+Then wait for the backup to complete. You can check the progress by
+typing `mess` to dump all messages (warning: that floods your console)
+or `status director`. When the backup is done, you can type `quit`.
+
+It will be directly on the host, in `/var/tmp/bacula-restores`. You
+can change that path to restore in-place in the last step, by typing
+`mod` instead of `yes`. The rest of the guide assumes the restored
+files are in `/var/tmp/bacula-restores/`.
+
+Now go on the source server:
+
+    ssh static-gitlab-shim.torproject.org
+
+If you haven't restored in place, you should move the current site aside, if present:
+
+    mv /srv/static-gitlab-shim/status.torproject.org /srv/static-gitlab-shim/status.torproject.org.orig
+
+Check the permissions are correct on the restored directory:
+
+    ls -l /var/tmp/bacula-restores/srv/static-gitlab-shim/status.torproject.org/ /srv/static-gitlab-shim/status.torproject.org.orig/
+
+Typically, you will want to give the files to the shim:
+
+    chown -R static-gitlab-shim:static-gitlab-shim /srv/static-gitlab-shim/status.torproject.org/
+
+Then rsync the site in place:
+
+    rsync -a /var/tmp/bacula-restores/srv/static-gitlab-shim/status.torproject.org/ /srv/static-gitlab-shim/status.torproject.org/
+
+We rsync the site in case whatever happened to destroy the site will happen again. This will give us a fresh copy of the backup in `/var/tmp`.
+
+Once that is completed, you need to trigger a static component update:
+
+    static-update-component status.torproject.org
+
+The site is now restored.
+
 # Reference
 
 ## Installation

service/blog.md

@@ -265,8 +265,10 @@ See [howto/static-component#logs-and-metrics](https://gitlab.torproject.org/tpo/
 
 ## Backups
 
-Backups of this website exist both in the Bacula backups of the GitLab server (as
-artifacts) and backups of the `static-gitlab-shim.torproject.org` server.
+Backups of this website exist both in the Bacula backups of the GitLab
+server (as artifacts) and backups of the
+`static-gitlab-shim.torproject.org` server. See the [static components
+disaster recovery procedures](howto/static-component#disaster-recovery) for how to restore a site.
 
 ## Other documentation