railiance-apps/STATE.md

# STATE — railiance-apps

**Updated:** 2026-07-22  
**Domain:** financials · **Repo:** railiance-apps

## One-line posture

**Unattended Option A CNPG backups are live without a workstation:**
CoulombCore via in-cluster CronJobs; railiance01 via activity-core schedule.

## Workplans

| ID | Status | Notes |
| --- | --- | --- |
| RAILIANCE-WP-0015 | finished | Option A tooling + first healthy status |
| RAILIANCE-WP-0016 | **finished** | Unattended hybrid path (Core CronJobs + R01 activity-core) |

## Backup architecture (current)

```
CoulombCore databases/
  CronJobs cnpg-logical-backup-*  (image cnpg-option-a-backup:v1, age in-image)
  Secret cnpg-backup-offsite
  NetworkPolicy allow-egress-cnpg-option-a-backup*
  → Nextcloud WebDAV

railiance01 activity-core/
  ActivityDefinition daily-cnpg-option-a-backup (02:30 UTC)
  ESO actcore-backup-offsite → NC_WEBDAV_*
  hostPath /opt/railiance-platform (CLI + vendor age/kubectl)
  hostPath /kube/config-hosteurope
  targets: r01-forgejo-db, r01-net-kingdom-pg, r01-state-hub-db
  → Nextcloud WebDAV
```

**Why hybrid:** R01 cannot reach CoulombCore k3s API (no tunnel). Core CronJobs
cover Core POR clusters locally.

## Verify

```bash
# CoulombCore
export KUBECONFIG=~/.kube/config
make cnpg-backup-status

# railiance01 activity
export KUBECONFIG=~/.kube/config-hosteurope
kubectl -n activity-core get externalsecret actcore-backup-offsite
# inventory should list Daily CNPG Option A Backup enabled
```

## Evidence

- `docs/evidence/cnpg-option-a-unattended-20260722.json`
- `docs/cnpg-backup-topology-inventory.md`