coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/docs/forgejo-backup.md
tegwick 0055e8f3f7
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details
Establish railiance backup credentials in OpenBao (CCR-2026-0004). 
Add workload KV lane for Nextcloud WebDAV token, URL, and age recovery
escrow at platform/workloads/railiance/backup/offsite-lane. Apply read
policy and OIDC role railiance-backup-workload-kv-read; wire forgejo-backup
to load credentials from OpenBao when env is unset.
2026-07-07 17:16:30 +02:00

1.8 KiB
Raw Blame History

Forgejo backup (railiance01)

Workplan: RAIL-HO-WP-0005 T04/T09 · Decision: Option A (Nextcloud + age)

What is backed up

Artifact Source Format
Blob state forgejo dump in production pod zip → age
PostgreSQL pg_dump -Fc from CNPG forgejo-db custom dump → age

Covers git repos, packages (OCI/npm/generic), attachments, LFS, avatars, and DB metadata.

Operator commands

cd ~/railiance-platform
make forgejo-backup-dry-run    # local encrypt only, no upload
make forgejo-backup            # encrypt + upload to Nextcloud forgejo/
make forgejo-backup-status     # last success + 7-day gate hint

Requires: kubectl, age, curl, KUBECONFIG=~/.kube/config-hosteurope.

Decrypt: ~/.config/age/railiance-backup.key (same key as other Railiance backups).

Nextcloud layout

forgejo/forgejo-dump-<timestamp>.zip.age
forgejo/forgejo-db-<timestamp>.sql.age
forgejo/forgejo-dump-weekly-<timestamp>.zip.age   # Sundays only
forgejo/forgejo-db-weekly-<timestamp>.sql.age

Retention target: 14 daily + 4 weekly on Nextcloud (operator may prune old objects in the WebDAV folder; local cache keeps 7 per type).

Cron (workstation)

# Daily 02:15 UTC — Forgejo backup (RPO 24h)
15 2 * * * cd $HOME/railiance-platform && make forgejo-backup >>$HOME/.cache/railiance/backups/forgejo/cron.log 2>&1

Promotion gate (tier-3 cutover)

Do not promote further production repos until:

  1. make forgejo-backup succeeds 7 consecutive days (check success-log).
  2. One restore drill uses a Nextcloud artifact (not /tmp/forgejo-drill/).

Restore

See railiance-infra:

  • tools/forgejo-restore-drill.sh
  • docs/forgejo-restore-drill-evidence.md

Download and decrypt a dump from Nextcloud, set BACKUP_LOCAL to the zip path, then run the drill script.