---
id: daily-cnpg-option-a-backup
name: Daily CNPG Option A Backup
enabled: true
owner: custodian-agent
governance: custodian
status: active
trigger:
  type: cron
  cron_expression: "30 2 * * *"
  timezone: UTC
  misfire_policy: skip
context_sources:
  - type: shell
    query: cnpg_option_a_backup
    operation: cnpg_option_a_backup
    required: true
    params:
      backup_script: /opt/railiance-platform/tools/cmd/cnpg-option-a-backup
      dry_run: false
      timeout_seconds: 7200
      # worker-writable cache
      # (CLI defaults to /tmp if HOME unwritable)
      kubeconfig_r01: /kube/config-hosteurope
      kubeconfig_core: /kube/config
      targets: r01-forgejo-db,r01-net-kingdom-pg,r01-state-hub-db
      evidence_sinks:
        - type: state-hub-progress
          event_type: cnpg_option_a_backup
          author: activity-core
    bind_to: context.backup
---

# Daily CNPG Option A Backup

Runs daily at **02:30 UTC** (RPO 24h). Invokes
`railiance-platform/tools/cmd/cnpg-option-a-backup` on the railiance01
activity-core worker to age-encrypt logical dumps and upload to Nextcloud.

**Workplan:** `RAILIANCE-WP-0016` (railiance-apps).

## Enable checklist

1. Vendor tools on railiance01 hostPath tree:
   `tools/cmd/install-cnpg-backup-vendor-tools` (age + kubectl).
2. ExternalSecret `actcore-backup-offsite` synced into `actcore-runtime-secret`
   (`NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL`, `AGE_PUBLIC_KEY`).
3. Worker mounts: `/opt/railiance-platform`, `/kube` (host kubeconfigs).
4. CoulombCore kubeconfig present at `/kube/config` for Core clusters; R01 at
   `/kube/config-hosteurope`.
5. `enabled: true` + `make sync` / schedule reconcile on railiance01.
6. Forced run succeeds; `make cnpg-backup-status` stays healthy.

**Starts disabled** until T02–T04 wiring is verified on railiance01.