coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RAILIANCE-WP-0015: Option A CNPG logical backup coverage healthy
Some checks failed
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Has been cancelled
Details

Browse source 
Materialize offsite Secret from OpenBao, deploy per-cluster CronJobs,
generalize multi-cluster logical backup + status health for Option A,
seed encrypted uploads and restore-drill evidence; workplan finished.
This commit is contained in:
tegwick 2026-07-22 18:00:48 +02:00
parent 374ebed349
commit 6635fdc976
11 changed files with 929 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

50
docs/evidence/cnpg-option-a-backup-20260722.json Normal file
View file

@ -0,0 +1,50 @@
{
"workplan": "RAILIANCE-WP-0015",
"lane": "option-a",
"recorded_at": "2026-07-22T16:00:00Z",
"cluster_api": "CoulombCore databases namespace",
"rpo_target_hours": 24,
"rto_target_hours": 4,
"artifacts": {
"secret": "databases/cnpg-backup-offsite",
"secret_keys": ["NC_WEBDAV_TOKEN", "NC_WEBDAV_URL", "AGE_PUBLIC_KEY"],
"cronjobs": [
"cnpg-logical-backup-apps-pg",
"cnpg-logical-backup-gitea-db",
"cnpg-logical-backup-net-kingdom-pg",
"cnpg-logical-backup-state-hub-db"
],
"status_configmap": "databases/cnpg-option-a-status",
"last_success": {
"apps-pg": "20260722T155755Z",
"gitea-db": "20260722T155755Z",
"net-kingdom-pg": "20260722T155755Z",
"state-hub-db": "20260722T155732Z"
}
},
"uploads": [
"apps-pg/apps-pg-apps_meta-20260722T155755Z.dump.age",
"apps-pg/apps-pg-core_hub-20260722T155755Z.dump.age",
"apps-pg/apps-pg-core_hub_staging-20260722T155755Z.dump.age",
"apps-pg/apps-pg-vergabe_db-20260722T155755Z.dump.age",
"gitea-db/gitea-db-gitea-20260722T155755Z.dump.age",
"net-kingdom-pg/net-kingdom-pg-interhub-20260722T155755Z.dump.age",
"net-kingdom-pg/net-kingdom-pg-privacyidea_db-20260722T155755Z.dump.age",
"state-hub-db/state-hub-db-state_hub-20260722T155732Z.dump.age"
],
"status_command": "make cnpg-backup-status",
"status_result": "ok — all tracked clusters have healthy Option A (or barman) backup coverage",
"restore_drill": {
"cluster": "apps-pg",
"database": "vergabe_db",
"source_artifact": "apps-pg-vergabe_db-20260722T155755Z.dump.age",
"evidence": "docs/evidence/apps-pg-restore-drill-20260722T155951Z.json",
"row_gate": "195/195 pass",
"rto_note": "decrypt + isolated restore completed under 5 minutes on operator workstation"
},
"notes": [
"First success wave seeded via workstation tools/cnpg-logical-backup.sh; CronJobs schedule daily 02:30–02:45 UTC.",
"AGE_PRIVATE_KEY remains OpenBao recovery escrow only — not stored in-cluster.",
"No secret values recorded in this evidence file."
]
}