coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden backup credentials and add durable image inventory publication
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 01:53:24 +02:00
parent 62423fd092
commit 0349a08e1b
13 changed files with 365 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/forgejo-backup.md
View file

@ -26,6 +26,13 @@ Preflight: `forgejo-db` pod must be Ready (`make forgejo-db-status`). A full dum
with 13 org repos is ~670MiB — allow 10–20 minutes for stream + age on a typical
workstation link.
Uploads require the governed `CCR-2026-0004` OpenBao offsite lane or explicitly
provided `RAILIANCE_BACKUP_NC_TOKEN` / `RAILIANCE_BACKUP_NC_WEBDAV_URL` inputs.
There is no built-in credential fallback. Missing credentials stop execution
before any cluster dump. Local encryption dry-runs skip upload authentication.
Provider rotation and replacement upload/restore proof are tracked separately
in `RPF-WP-0029`; removing the source default does not prove revocation.
Decrypt: `~/.config/age/railiance-backup.key` (same key as other Railiance backups).
## Nextcloud layout
@ -62,4 +69,4 @@ See `railiance-infra`:
- `docs/forgejo-restore-drill-evidence.md`
Download and decrypt a dump from Nextcloud, set `BACKUP_LOCAL` to the zip path,
then run the drill script.
then run the drill script.