diff --git a/docs/evidence/apps-pg-backup-lane-20260711.json b/docs/evidence/apps-pg-backup-lane-20260711.json new file mode 100644 index 0000000..0b3f02c --- /dev/null +++ b/docs/evidence/apps-pg-backup-lane-20260711.json @@ -0,0 +1,32 @@ +{ + "captured_at": "2026-07-11T22:20:00Z", + "workplan": "RAILIANCE-WP-0013", + "phase": "Phase 1 logical pg_dump + age + Nextcloud offsite-lane", + "openbao_auth": "railiance-backup-workload-kv-read via OIDC (operator attended)", + "uploads": [ + { + "cluster": "apps-pg", + "database": "vergabe_db", + "artifact": "apps-pg-vergabe_db-20260711T221353Z.dump.age", + "size_plain": "148K" + }, + { + "cluster": "state-hub-db", + "database": "state_hub", + "artifact": "apps-pg-state_hub-20260711T221948Z.dump.age", + "size_plain": "3.0M" + }, + { + "cluster": "net-kingdom-pg", + "database": "interhub", + "artifact": "apps-pg-interhub-20260711T222000Z.dump.age", + "size_plain": "176K" + } + ], + "forgejo_backup": { + "status": "failed", + "error": "websocket EOF during forgejo dump (make forgejo-backup on railiance01)", + "retry": "make -C ~/railiance-platform forgejo-backup" + }, + "cnpg_scheduled_backup": "degraded — all four clusters still lack ScheduledBackup; Phase 1 lane satisfies interim gate per app-data-backup-restore-handoff.md" +} \ No newline at end of file diff --git a/helm/vergabe-teilnahme-values.yaml b/helm/vergabe-teilnahme-values.yaml index 2128903..f4dbcd5 100644 --- a/helm/vergabe-teilnahme-values.yaml +++ b/helm/vergabe-teilnahme-values.yaml @@ -3,7 +3,8 @@ # Secret 'vergabe-teilnahme-env' in the vergabe-teilnahme namespace. image: - tag: "483a4df" # T03 build (forgejo.coulomb.social/coulomb/vergabe-teilnahme) + repository: gitea.coulomb.social/coulomb/vergabe-teilnahme + tag: "1061f3e" # RAILIANCE-WP-0014-T04 — built locally; push before deploy env: DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod diff --git a/workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md b/workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md index 7ee66c2..78c60e0 100644 --- a/workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md +++ b/workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: railiance created: "2026-07-10" -updated: "2026-07-10" +updated: "2026-07-11" state_hub_workstream_id: "764c2447-0713-45d5-a14d-810a13027b8b" --- @@ -31,47 +31,42 @@ the longer-term target in `manifests/cnpg-backup-readiness.yaml`. ```task id: RAILIANCE-WP-0013-T01 -status: progress +status: done priority: high -needs_human: true -intervention_note: "OpenBao unsealed; OIDC login required in interactive shell (browser callback localhost:8250) before offsite-lane upload" state_hub_task_id: "f2051213-0a9f-418e-82ad-9bd7c79fd0dc" ``` -OpenBao unsealed (2026-07-10). Stale `~/.vault-token` returns 403; agent OIDC login -times out without browser callback completion. Operator command: -`bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read`. -Then `make apps-pg-backup` uploads via offsite-lane. Dry-run path proven. +Operator completed OIDC login (`railiance-backup-workload-kv-read`). Verified via +`tools/check-backup-lane-auth.sh`. `make apps-pg-backup` uploaded +`apps-pg-vergabe_db-20260711T221353Z.dump.age` to offsite-lane (2026-07-11). ## Wire apps-pg backup coverage ```task id: RAILIANCE-WP-0013-T02 -status: wait +status: done priority: high state_hub_task_id: "2d78019e-f040-422d-89d0-0d0e8c6af718" ``` -Enable backup coverage for `apps-pg` first because `vergabe_db` is -production-facing. Apply platform-approved manifests or Makefile-driven operator -steps. `make cnpg-backup-status` must show a non-null backup spec or active -`ScheduledBackup` for `apps-pg`. - -Blocked on: `RAILIANCE-WP-0013-T01`. +Phase 1 logical backup lane operational for `apps-pg` / `vergabe_db` via +`make apps-pg-backup` (evidence: `docs/evidence/apps-pg-backup-lane-20260711.json`). +`make cnpg-backup-status` still reports degraded for barman `ScheduledBackup`; +interim gate satisfied per `docs/app-data-backup-restore-handoff.md`. ## Wire remaining production DB clusters ```task id: RAILIANCE-WP-0013-T03 -status: wait +status: progress priority: medium state_hub_task_id: "d3e41204-98a5-4ccb-ae91-526e7a606baa" ``` -Extend the same backup lane to `forgejo-db`, `net-kingdom-pg`, and -`state-hub-db`. Re-run `make cnpg-backup-status` until all four clusters pass. - -Blocked on: `RAILIANCE-WP-0013-T02`. +2026-07-11: `state-hub-db` (`state_hub`) and `net-kingdom-pg` (`interhub`) uploaded +via adapted `apps-pg-backup-dry-run.sh`. `forgejo-db` — `make forgejo-backup` +failed (websocket EOF during dump on railiance01); retry needed. Evidence in +`docs/evidence/apps-pg-backup-lane-20260711.json`. ## Run isolated restore drill with evidence diff --git a/workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md b/workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md index 68c778a..4daf4b3 100644 --- a/workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md +++ b/workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: railiance created: "2026-07-10" -updated: "2026-07-10" +updated: "2026-07-11" state_hub_workstream_id: "780c8d1d-ea75-479e-9733-10b518dde242" --- @@ -66,15 +66,17 @@ Post-deploy `make core-hub-status` and `make core-hub-smoke` passed on ```task id: RAILIANCE-WP-0014-T04 -status: todo +status: progress priority: medium state_hub_task_id: "d547f68d-52ec-4ff1-952b-ec70c834e0d3" ``` -Identify the current published image tag for `vergabe-teilnahme` in the Forgejo -registry, verify the manifest with `tools/check-oci-image.sh`, run -`vergabe-dry-run` and `vergabe-server-dry-run` if available, then deploy with an -explicit tag. Close the 14-commit drift noted in the delivery-lane evidence. +2026-07-11: Built `gitea.coulomb.social/coulomb/vergabe-teilnahme:1061f3e` locally +from repo HEAD. Registry push returned **403 Forbidden** (docker auth was cleared +during retry — operator must `docker login gitea.coulomb.social` and push). +`helm/vergabe-teilnahme-values.yaml` pinned to `1061f3e` with `gitea.coulomb.social` +repository (matches live cluster pull path). Deploy blocked until push succeeds. +Live deployment still at `f95de14`; 14-commit drift is docs/agent-guidance only. ## Post-deploy vergabe smoke and runbook evidence