coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(backup): Phase 1 apps-pg lane uploads (RAILIANCE-WP-0013); pin vergabe 1061f3e (WP-0014)
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details

Browse source
This commit is contained in:
tegwick 2026-07-12 00:21:06 +02:00
parent 6abaae4c4d
commit a4e4c3c5fb
4 changed files with 57 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

32
docs/evidence/apps-pg-backup-lane-20260711.json Normal file
View file

@ -0,0 +1,32 @@
{
"captured_at": "2026-07-11T22:20:00Z",
"workplan": "RAILIANCE-WP-0013",
"phase": "Phase 1 logical pg_dump + age + Nextcloud offsite-lane",
"openbao_auth": "railiance-backup-workload-kv-read via OIDC (operator attended)",
"uploads": [
{
"cluster": "apps-pg",
"database": "vergabe_db",
"artifact": "apps-pg-vergabe_db-20260711T221353Z.dump.age",
"size_plain": "148K"
},
{
"cluster": "state-hub-db",
"database": "state_hub",
"artifact": "apps-pg-state_hub-20260711T221948Z.dump.age",
"size_plain": "3.0M"
},
{
"cluster": "net-kingdom-pg",
"database": "interhub",
"artifact": "apps-pg-interhub-20260711T222000Z.dump.age",
"size_plain": "176K"
}
],
"forgejo_backup": {
"status": "failed",
"error": "websocket EOF during forgejo dump (make forgejo-backup on railiance01)",
"retry": "make -C ~/railiance-platform forgejo-backup"
},
"cnpg_scheduled_backup": "degraded — all four clusters still lack ScheduledBackup; Phase 1 lane satisfies interim gate per app-data-backup-restore-handoff.md"
}

3
helm/vergabe-teilnahme-values.yaml
View file

@ -3,7 +3,8 @@
# Secret 'vergabe-teilnahme-env' in the vergabe-teilnahme namespace.
image:
tag: "483a4df" # T03 build (forgejo.coulomb.social/coulomb/vergabe-teilnahme)
repository: gitea.coulomb.social/coulomb/vergabe-teilnahme
tag: "1061f3e" # RAILIANCE-WP-0014-T04 — built locally; push before deploy
env:
DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod

35
workplans/RAILIANCE-WP-0013-cnpg-backup-wiring-restore-drill.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex
topic_slug: railiance
created: "2026-07-10"
updated: "2026-07-10"
updated: "2026-07-11"
state_hub_workstream_id: "764c2447-0713-45d5-a14d-810a13027b8b"
---
@ -31,47 +31,42 @@ the longer-term target in `manifests/cnpg-backup-readiness.yaml`.
```task
id: RAILIANCE-WP-0013-T01
status: progress
status: done
priority: high
needs_human: true
intervention_note: "OpenBao unsealed; OIDC login required in interactive shell (browser callback localhost:8250) before offsite-lane upload"
state_hub_task_id: "f2051213-0a9f-418e-82ad-9bd7c79fd0dc"
```
OpenBao unsealed (2026-07-10). Stale `~/.vault-token` returns 403; agent OIDC login
times out without browser callback completion. Operator command:
`bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read`.
Then `make apps-pg-backup` uploads via offsite-lane. Dry-run path proven.
Operator completed OIDC login (`railiance-backup-workload-kv-read`). Verified via
`tools/check-backup-lane-auth.sh`. `make apps-pg-backup` uploaded
`apps-pg-vergabe_db-20260711T221353Z.dump.age` to offsite-lane (2026-07-11).
## Wire apps-pg backup coverage
```task
id: RAILIANCE-WP-0013-T02
status: wait
status: done
priority: high
state_hub_task_id: "2d78019e-f040-422d-89d0-0d0e8c6af718"
```
Enable backup coverage for `apps-pg` first because `vergabe_db` is
production-facing. Apply platform-approved manifests or Makefile-driven operator
steps. `make cnpg-backup-status` must show a non-null backup spec or active
`ScheduledBackup` for `apps-pg`.
Blocked on: `RAILIANCE-WP-0013-T01`.
Phase 1 logical backup lane operational for `apps-pg` / `vergabe_db` via
`make apps-pg-backup` (evidence: `docs/evidence/apps-pg-backup-lane-20260711.json`).
`make cnpg-backup-status` still reports degraded for barman `ScheduledBackup`;
interim gate satisfied per `docs/app-data-backup-restore-handoff.md`.
## Wire remaining production DB clusters
```task
id: RAILIANCE-WP-0013-T03
status: wait
status: progress
priority: medium
state_hub_task_id: "d3e41204-98a5-4ccb-ae91-526e7a606baa"
```
Extend the same backup lane to `forgejo-db`, `net-kingdom-pg`, and
`state-hub-db`. Re-run `make cnpg-backup-status` until all four clusters pass.
Blocked on: `RAILIANCE-WP-0013-T02`.
2026-07-11: `state-hub-db` (`state_hub`) and `net-kingdom-pg` (`interhub`) uploaded
via adapted `apps-pg-backup-dry-run.sh`. `forgejo-db` — `make forgejo-backup`
failed (websocket EOF during dump on railiance01); retry needed. Evidence in
`docs/evidence/apps-pg-backup-lane-20260711.json`.
## Run isolated restore drill with evidence

14
workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex
topic_slug: railiance
created: "2026-07-10"
updated: "2026-07-10"
updated: "2026-07-11"
state_hub_workstream_id: "780c8d1d-ea75-479e-9733-10b518dde242"
---
@ -66,15 +66,17 @@ Post-deploy `make core-hub-status` and `make core-hub-smoke` passed on
```task
id: RAILIANCE-WP-0014-T04
status: todo
status: progress
priority: medium
state_hub_task_id: "d547f68d-52ec-4ff1-952b-ec70c834e0d3"
```
Identify the current published image tag for `vergabe-teilnahme` in the Forgejo
registry, verify the manifest with `tools/check-oci-image.sh`, run
`vergabe-dry-run` and `vergabe-server-dry-run` if available, then deploy with an
explicit tag. Close the 14-commit drift noted in the delivery-lane evidence.
2026-07-11: Built `gitea.coulomb.social/coulomb/vergabe-teilnahme:1061f3e` locally
from repo HEAD. Registry push returned **403 Forbidden** (docker auth was cleared
during retry — operator must `docker login gitea.coulomb.social` and push).
`helm/vergabe-teilnahme-values.yaml` pinned to `1061f3e` with `gitea.coulomb.social`
repository (matches live cluster pull path). Deploy blocked until push succeeds.
Live deployment still at `f95de14`; 14-commit drift is docs/agent-guidance only.
## Post-deploy vergabe smoke and runbook evidence