# CNPG Option A multi-host backup

**Workplan:** RAILIANCE-WP-0016  
**CLI:** `tools/cmd/cnpg-option-a-backup`  
**Scheduler:** activity-core `daily-cnpg-option-a-backup` (railiance01)

## What it does

Logical `pg_dump -Fc` → age encrypt → Nextcloud WebDAV for production-of-record
CNPG databases on **CoulombCore** and **railiance01**. Emits JSON for
activity-core evidence sinks.

Inventory: `railiance-apps/docs/cnpg-backup-topology-inventory.md`.

## Operator commands

```bash
# One-time vendor tools (age committed; kubectl downloaded)
tools/cmd/install-cnpg-backup-vendor-tools

# Dry-run (no upload)
RAILIANCE_BACKUP_DRY_RUN=1 tools/cmd/cnpg-option-a-backup

# Live upload (env or bao OIDC)
export RAILIANCE_BACKUP_NC_TOKEN=…   # or bao login + auto-fetch
tools/cmd/cnpg-option-a-backup
```

From railiance-apps:

```bash
make cnpg-option-a-backup-dry-run
make cnpg-option-a-backup
```

## activity-core enable

1. Re-mint ESO token with backup policy:
   `OPENBAO_ACTIVITY_CORE_POLICIES="… workload-kv-read-railiance-backup-offsite-lane" \
    scripts/openbao-eso-token-apply.sh`
2. Apply `k8s/railiance/15-externalsecret-backup-offsite.yaml`
3. Ensure `/home/tegwick/railiance-platform` and `~/.kube` on railiance01 host
   (worker hostPath). Place CoulombCore kubeconfig as `~/.kube/config`.
4. Rebuild/restart worker with resolver code; sync ActivityDefinition;
   set `enabled: true` on `daily-cnpg-option-a-backup`.
5. Forced run; check State Hub progress + `make cnpg-backup-status`.

## Credentials

| Field | Where |
| --- | --- |
| `NC_WEBDAV_TOKEN` / `NC_WEBDAV_URL` | OpenBao offsite-lane → ESO → `actcore-runtime-secret` |
| `AGE_PUBLIC_KEY` | public constant / env (not private key) |
| `AGE_PRIVATE_KEY` | OpenBao only — restore drills, never on worker |

Catalog: `warden route show railiance-backup-offsite-lane`.