coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record verified Backup account activation and consumer refresh
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 20:50:26 +02:00
parent b6d648bfbe
commit cb6396caab
7 changed files with 160 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

33
docs/backup-credential-recovery.md
View file

@ -65,3 +65,36 @@ requires HTTPS and rejects non-success responses. The Python backend streams
the artifact, refuses redirects and suppresses credential-bearing exception
text. These source changes are preparation; no provider rotation, upload or
restore is claimed by their tests.
## Dedicated Backup account (2026-09-05)
The operator-provisioned account is `Backup` on `nx4069.your-storageshare.de`.
Its credentials remain in OpenBao KVv2 `operators/nextcloud/backup`, fields
`BACKUP_USERNAME` and `BACKUP_PASSWORD` (API `operators/data/nextcloud/backup`).
The UI's `secrets/` prefix is not a separate KV mount.
Future uploads use the account's `/railiance-backups` folder through a dedicated
create-only share. Only its derived `NC_WEBDAV_TOKEN` and `NC_WEBDAV_URL` enter
the existing workload lane and activity-core ExternalSecret; the account password
is not a production credential. Recovery download and cleanup use operator
account authority. Preserve `AGE_PRIVATE_KEY` and all unrelated KV fields with CAS.
The server-reported quota is **10 GiB (10,737,418,240 bytes)**. This is a hard
capacity limit shared by the account's files. Retention counts such as 14 daily
and four weekly backups do not guarantee they fit. Check quota before large
uploads; a quota rejection is a failed backup. Pruning retained backups requires
an explicit retention decision and operator authority; upload jobs cannot delete.
Existing Bernd-owned backups remain in their original location and require their
existing recovery access. This cutover neither migrates them nor revokes Bernd's
personal account or old share.
`scripts/migrate_nextcloud_backup_account.py` performs the attended account,
quota, create-only share, encrypted fixture recovery and CAS checks. Run it only
through `warden access openbao-platform-admin-login --exec -- ...`, with a fresh
private receipt path and `--confirm 'MIGRATE TO Backup'`. The helper is silent;
receipts contain only status and metadata. Review a failed receipt before retrying:
a failure can leave the dedicated folder/share or an identified test fixture, and
a cleanup failure after CAS can occur after credentials have already changed.
Refresh `actcore-backup-offsite`, verify delivery by contained comparison, and
restart its three environment consumers (`actcore-api`, `actcore-event-router`,
`actcore-worker`). Record their readiness and loaded-value comparisons.