codex
dada84cf51
RAILIANCE-WP is a family name, not a repository (ADR-007, and the prefix registry already lists it retired). Three repositories independently used one number space for unrelated work — RAILIANCE-WP-0012 was openbao extraction here, a cnpg backup in railiance-apps and a deploy-verify in railiance-cluster. This repository also carried two files both numbered 0016. Active workplans move to the successor prefix and are renumbered from 0001 in historical order. Archived workplans keep their historical identifiers. Projection UUIDs are re-derived from the new canonical ids. Records already registered under the old identifiers leave orphaned hub rows behind; that debt is recorded in CUST-WP-0068 and clears when ADR-012's reset-from-forge lands. Refs CUST-WP-0068-T03 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
113 lines
3.1 KiB
Markdown
113 lines
3.1 KiB
Markdown
---
|
|
id: RAPPS-WP-0002
|
|
type: workplan
|
|
title: "railiance01 + activity-core unattended CNPG/Forgejo backup automation"
|
|
domain: financials
|
|
repo: railiance-apps
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-07-22"
|
|
updated: "2026-07-22"
|
|
state_hub_workstream_id: "4bc748b8-7d4c-5d3f-8602-4d2280f4b60f"
|
|
---
|
|
|
|
# railiance01 + activity-core unattended backup automation
|
|
|
|
**Goal achieved (hybrid, no workstation for daily path):**
|
|
|
|
| Host | Unattended mechanism | Coverage |
|
|
| --- | --- | --- |
|
|
| **CoulombCore** | In-cluster CronJobs + image `cnpg-option-a-backup:v1` (age baked in) | apps-pg, gitea-db, net-kingdom-pg, state-hub-db |
|
|
| **railiance01** | activity-core `daily-cnpg-option-a-backup` @ 02:30 UTC | forgejo-db, net-kingdom-pg, state-hub-db |
|
|
|
|
CoulombCore API is **not** reachable from railiance01 (no tunnel); dual-host design
|
|
keeps Core local CronJobs and R01 on activity-core. Workstation is not required
|
|
for daily RPO.
|
|
|
|
Evidence: `docs/evidence/cnpg-option-a-unattended-20260722.json`
|
|
|
|
## Task: Inventory production-of-record DB topology
|
|
|
|
```task
|
|
id: RAPPS-WP-0002-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "f10d7bc0-44c0-51b6-b749-18cc6fb28956"
|
|
```
|
|
|
|
`docs/cnpg-backup-topology-inventory.md`
|
|
|
|
## Task: Package offline-capable backup runner for railiance01
|
|
|
|
```task
|
|
id: RAPPS-WP-0002-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "bb6ba8b9-a4dd-5825-bde0-21927b7d88b2"
|
|
```
|
|
|
|
Platform CLI + vendor age; image `cnpg-option-a-backup:v1` for Core; python
|
|
upload fallback when curl missing in worker.
|
|
|
|
## Task: Non-interactive offsite credentials for activity-core worker
|
|
|
|
```task
|
|
id: RAPPS-WP-0002-T03
|
|
status: done
|
|
priority: high
|
|
needs_human: false
|
|
state_hub_task_id: "daa173a1-daae-5907-bb8b-9a0fca201498"
|
|
```
|
|
|
|
ESO `actcore-backup-offsite` **SecretSynced**; worker has `NC_WEBDAV_*`.
|
|
|
|
## Task: CoulombCore API reachability from railiance01 worker
|
|
|
|
```task
|
|
id: RAPPS-WP-0002-T04
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "190edc0a-8097-5e53-aaaf-445ac124579a"
|
|
```
|
|
|
|
**Decision recorded:** Core API not reachable from R01; Core backups run
|
|
**in-cluster on CoulombCore** (CronJobs + local image import). R01 worker uses
|
|
host kubeconfig for local clusters only.
|
|
|
|
## Task: activity-core ActivityDefinition + shell resolver
|
|
|
|
```task
|
|
id: RAPPS-WP-0002-T05
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "544df9d5-6f67-5709-a6f4-3dac371ae2b1"
|
|
```
|
|
|
|
`daily-cnpg-option-a-backup` enabled; Temporal schedule upserted; resolver smoke
|
|
overall=ok; CLI smoke 4 dumps/uploads on R01.
|
|
|
|
## Task: Cut over health definition and retire workstation dependency
|
|
|
|
```task
|
|
id: RAPPS-WP-0002-T06
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "0f34a452-d5e6-5315-baea-7457298d59c0"
|
|
```
|
|
|
|
`make cnpg-backup-status` → **ok** with in-cluster CronJobs + last-success.
|
|
Schedule mode `in-cluster-cron`.
|
|
|
|
## Task: Soak, restore drill from automated artifact, finish
|
|
|
|
```task
|
|
id: RAPPS-WP-0002-T07
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "593fa1ba-a1da-5b76-9e12-596f0ce92c44"
|
|
```
|
|
|
|
Automated CronJob/activity-core artifacts produced; prior restore drill pattern
|
|
from WP-0015 still valid; unattended evidence JSON recorded. Ongoing soak is
|
|
operational (daily schedules live).
|