Record T02 backup Option A on WP-0005 (Nextcloud lane)

Unblocks T04/T09 implementation wording; cutover mode remains the last T02 item.

workplans/RAIL-HO-WP-0005-forgejo-production-migration.md

@@ -70,8 +70,10 @@ change is made there.
 4. ~~Actions runner model~~ **DECIDED 2026-07-03:** in-cluster long-lived runner
    Deployment with DinD sidecar on railiance01 (`ADR-004`). Interim coulombcore
    host runner retired after cutover.
-5. Backup destination and retention target for database, repositories,
-   attachments, LFS, Actions artifacts/logs, and package data.
+5. ~~Backup destination and retention~~ **DECIDED 2026-07-09 (Option A):**
+   daily age-encrypted `forgejo dump` + `pg_dump` → Nextcloud WebDAV; 14 daily +
+   4 weekly retention; RPO 24h / RTO 4h. Record:
+   `the-custodian/docs/forgejo-production-decisions.md` § Backup.
 6. Cutover mode: ~~freeze-all vs staged~~ **LEANING staged per-repo (2026-07-04)**
    based on `glas-harness` pilot; operator confirmation still needed. Freeze-all
    remains fallback for final production wave if drift risk is unacceptable.
@@ -183,10 +185,10 @@ state_hub_task_id: "f88115bf-4f99-49ef-a415-0b23750141b3"
 Decide the production choices listed in "Key Decisions to Confirm".
 
 **Partial (2026-07-09):** hostname, exposure, deployment pattern, live deploy,
-in-cluster runner model (`ADR-004`), **SMTP (IONOS, T06 done)**, and **package
-scope (Option C: OCI + npm + generic)** decided. Cutover mode **leaning** staged
-per-repo (glas-harness pilot). Remaining operator decisions: backup target,
-final cutover confirmation. See
+in-cluster runner model (`ADR-004`), **SMTP (IONOS, T06 done)**, **package scope
+(Option C)**, and **backup target (Option A: Nextcloud + age)** decided. Cutover
+mode **leaning** staged per-repo (glas-harness pilot). Remaining operator
+decision: final cutover confirmation. See
 `the-custodian/docs/forgejo-production-decisions.md`.
 
 Expected output:
@@ -196,7 +198,8 @@ Expected output:
 - SMTP provider and sender identity. ✓
 - Package registry scope. ✓ Option C (OCI + npm + generic; others as needed)
 - Actions runner isolation model.
-- Backup target, retention, encryption, and restore cadence.
+- Backup target, retention, encryption, and restore cadence. ✓ Option A
+  (Nextcloud; balanced retention; implementation T04/T09)
 - Cutover strategy and rollback window.
 
 **Done when:** implementation tasks are no longer blocked by open production
@@ -237,15 +240,17 @@ Minimum scope:
 
 - `forgejo-db` CloudNative PG cluster.
 - Database credentials via SOPS-managed Secret or approved secret flow.
-- Backup configuration for database base backups and WAL archiving.
+- Backup configuration: daily logical `pg_dump` + off-node Nextcloud target
+  (T02 Option A; WAL/S3 deferred).
 - Object storage or persistent volume plan for repositories, attachments, LFS,
   packages, Actions artifacts, and logs.
 - Restore runbook for database and blob/package data.
 
 **Partial (2026-07-04):** `forgejo-db` CNPG cluster healthy on railiance01
 (`make forgejo-db-status` → Cluster in healthy state). SOPS secret path and
-network policies in `railiance-platform`. Remaining: backup/WAL archiving to
-approved target, blob/package storage restore drill (feeds T09).
+network policies in `railiance-platform`. **Backup target decided (Option A,
+Nextcloud).** Remaining: implement scheduled `forgejo-backup` + `pg_dump` upload
+in `railiance-platform`; blob restore drill from automated artifact (T09).
 
 **Done when:** platform dependencies can be deployed and restored without the
 Forgejo app running.
@@ -435,8 +440,10 @@ Acceptance:
 post-restore API checks: health 200, `coulomb/glas-harness` and
 `coulomb/key-cape` on `main`, 3 org repos visible. Evidence:
 `docs/forgejo-restore-drill-evidence.md`. Assets: `infra/forgejo-restore-drill/`,
-`tools/forgejo-restore-drill.sh`. Remaining: scheduled CNPG/off-cluster backups,
-encryption/approved target (T02/T04), automated dump schedule.
+`tools/forgejo-restore-drill.sh`. **Target decided (T02 Option A: Nextcloud +
+age).** Remaining: daily cron (`forgejo dump` + `pg_dump`), upload, retention
+prune, 7-day success gate before tier-3 promotions; quarterly restore drill
+from Nextcloud artifact.
 
 **Done when:** a fresh backup restores to a working isolated Forgejo instance
 with repository, package, and user recovery checks passing **and** scheduled
@@ -574,8 +581,8 @@ T03 isolated probe: CANCELLED (superseded by T05 + in-production pilots)
 
 **Current focus (2026-07-07):** T08 **done**; T10 tiers 0–2.5 **complete**, tier-3
 `state-hub` cutover **in progress** (phase 5 stabilization). T09 restore drill
-**passed** but scheduled backups + backup target still open. T02 backup-target
-and cutover-mode confirmation remain operator-gated. T11 partial: `state-hub` primary
+**passed**; backup **target** decided (Option A). Scheduled automation still
+open (T04/T09). T02 cutover-mode confirmation remains operator-gated. T11 partial: `state-hub` primary
 on railiance01; ~57 State Hub repos still point at Gitea remotes.
 Do not retire coulombcore `state-hub` until phase 5 closeout and operator
 signoff (`CUST-WP-0054-T05`).