Read NC_WEBDAV_TOKEN/NC_WEBDAV_URL from the environment or the governed
OpenBao lane (platform/workloads/railiance/backup/offsite-lane), as
railiance-cluster's copy has since 2026-07-07; refuse without credentials.
The removed value is the RPF-WP-0029 predecessor share token, attested
unshared 2026-09-15 (ORGREF-WP-0002-T03).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
Provider Secret gate cleared; full reconcile passed with fixture smoke
(health=ok, latency 2.084s). Harden the smoke against NetworkPolicy
allowlist propagation by retrying up to 6x with a 5s warm-up inside the
smoke pod — the netpol added 2026-06-19 rejected the pod's immediate
first request before its IP propagated.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
k3s runs in SQLite mode (no --cluster-init). Replace etcd-snapshot
with sqlite3 .backup for a WAL-aware hot copy of state.db.
Update restore guide to match. Cron installed under root crontab.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- `make backup` now invokes `sudo tools/cmd/railiance-backup-s2` directly
- Move `mkdir -p` in railiance-backup-s2 to after the root check so the
script emits a clear error instead of a raw permission-denied failure
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
tools/cmd/railiance-backup-s2:
- k3s etcd snapshot (age-encrypted)
- Helm release values for all namespaces (age-encrypted)
- kubeconfig /etc/rancher/k3s/k3s.yaml (age-encrypted)
- output: /opt/backup/railiance/cluster/, keep last 7, .last-backup stamp
- requires root, no network dependency
tools/cmd/railiance-restore-s2:
- lists available backups with sizes
- prints step-by-step restore instructions for each artifact type
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
cloudinit/user-data.yaml and tools/cmd/railiance-plan-host relocated
to railiance-infra per ADR-003. Tombstone stubs left in place.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Update all operational references to reflect the new repo name per
ADR-003 (OAS S2 Cluster Runtime). Historical text in docs preserved.
Gitea remote URL updated locally (Gitea repo rename is a manual step).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
