railiance-apps/manifests/cnpg-backup-readiness.yaml

# CNPG backup readiness — Option A is the decided lane (RAILIANCE-WP-0015).
#
# Active manifests: manifests/cnpg-option-a-backup.yaml
#   - CronJobs per cluster (logical pg_dump → age → Nextcloud WebDAV)
#   - ServiceAccount + RBAC for pods/exec
#   - Runner ConfigMap
#
# Apply sequence:
#   1. bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read
#   2. make cnpg-backup-offsite-secret-apply   # Secret cnpg-backup-offsite (no private key)
#   3. make cnpg-option-a-apply                # CronJobs + RBAC
#   4. make cnpg-logical-backup               # optional immediate workstation run
#   5. make cnpg-backup-status
#
# Barman ObjectStore / CNPG ScheduledBackup remains deferred (Phase 2). Do not
# apply the commented stubs below unless platform provisions an S3 ObjectStore
# and explicitly re-decides away from Option A.
#
# Clusters covered (CoulombCore databases): apps-pg, gitea-db, net-kingdom-pg, state-hub-db
# Check posture: make cnpg-backup-status
---
# Deferred Phase 2 — barman ObjectStore (not active)
# apiVersion: barmancloud.cnpg.io/v1
# kind: ObjectStore
# metadata:
#   name: railiance-cnpg-backups
#   namespace: databases
#   labels:
#     app.kubernetes.io/part-of: railiance-apps
# spec:
#   configuration:
#     destinationPath: s3://REPLACE_ME/railiance-cnpg/
#     endpointURL: https://REPLACE_ME
#     s3Credentials:
#       accessKeyId:
#         name: cnpg-backup-s3
#         key: ACCESS_KEY_ID
#       secretAccessKey:
#         name: cnpg-backup-s3
#         key: SECRET_ACCESS_KEY
#     wal:
#       compression: gzip
#     data:
#       compression: gzip
#       immediateCheckpoint: true
#   retentionPolicy: 14d
---
# Deferred Phase 2 — example ScheduledBackup (not active)
# apiVersion: postgresql.cnpg.io/v1
# kind: ScheduledBackup
# metadata:
#   name: apps-pg-daily
#   namespace: databases
#   labels:
#     app.kubernetes.io/part-of: railiance-apps
# spec:
#   schedule: "0 0 2 * * *"
#   backupOwnerReference: self
#   cluster:
#     name: apps-pg
#   immediate: true