Prepare coherent encrypted offsite backup operations and retry recovery

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a11538-05ea-7b63-b3c7-a2df5f38898d

deploy/backup/coulomb-social-backup-freshness.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Check coulomb-social paired backup age and local encrypted hash
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/bin/python3 /opt/coulomb-social-backup/paired-backup.py --check-freshness
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+

deploy/backup/coulomb-social-backup-freshness.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Hourly freshness check for coulomb-social paired backups
+
+[Timer]
+OnCalendar=hourly
+Persistent=true
+Unit=coulomb-social-backup-freshness.service
+
+[Install]
+WantedBy=timers.target

deploy/backup/coulomb-social-paired-backup.service

@@ -0,0 +1,23 @@
+[Unit]
+Description=Coherent encrypted coulomb-social database and content backup
+After=network-online.target k3s.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=root
+UMask=0077
+StateDirectory=coulomb-social-backup
+StateDirectoryMode=0700
+# Owner-delivered credential references only; values never enter this repo.
+EnvironmentFile=/etc/coulomb-social-backup/offsite.env
+ExecStart=/usr/bin/python3 /opt/coulomb-social-backup/paired-backup.py --execute
+TimeoutStartSec=30min
+TimeoutStopSec=5min
+KillMode=mixed
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/coulomb-social-backup
+ProtectHome=true
+

deploy/backup/coulomb-social-paired-backup.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Daily paired coulomb-social recovery point (target RPO 24h)
+
+[Timer]
+OnCalendar=*-*-* 03:15:00 UTC
+Persistent=true
+RandomizedDelaySec=5min
+Unit=coulomb-social-paired-backup.service
+
+[Install]
+WantedBy=timers.target