coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/docs/cnpg-option-a-backup.md
tegwick 16a93b8e5c
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
feat(backup): multi-host CNPG Option A CLI for activity-core 
Add cnpg-option-a-backup JSON runner, vendored static age, kubectl install
helper, and ESO policy path for offsite lane so railiance01 workers can
upload without workstation OIDC (RAILIANCE-WP-0016).
2026-07-22 19:50:59 +02:00

1.8 KiB
Raw Blame History

CNPG Option A multi-host backup

Workplan: RAILIANCE-WP-0016
CLI: tools/cmd/cnpg-option-a-backup
Scheduler: activity-core daily-cnpg-option-a-backup (railiance01)

What it does

Logical pg_dump -Fc → age encrypt → Nextcloud WebDAV for production-of-record CNPG databases on CoulombCore and railiance01. Emits JSON for activity-core evidence sinks.

Inventory: railiance-apps/docs/cnpg-backup-topology-inventory.md.

Operator commands

# One-time vendor tools (age committed; kubectl downloaded)
tools/cmd/install-cnpg-backup-vendor-tools

# Dry-run (no upload)
RAILIANCE_BACKUP_DRY_RUN=1 tools/cmd/cnpg-option-a-backup

# Live upload (env or bao OIDC)
export RAILIANCE_BACKUP_NC_TOKEN=…   # or bao login + auto-fetch
tools/cmd/cnpg-option-a-backup

From railiance-apps:

make cnpg-option-a-backup-dry-run
make cnpg-option-a-backup

activity-core enable

  1. Re-mint ESO token with backup policy: OPENBAO_ACTIVITY_CORE_POLICIES="… workload-kv-read-railiance-backup-offsite-lane" \ scripts/openbao-eso-token-apply.sh
  2. Apply k8s/railiance/15-externalsecret-backup-offsite.yaml
  3. Ensure /home/tegwick/railiance-platform and ~/.kube on railiance01 host (worker hostPath). Place CoulombCore kubeconfig as ~/.kube/config.
  4. Rebuild/restart worker with resolver code; sync ActivityDefinition; set enabled: true on daily-cnpg-option-a-backup.
  5. Forced run; check State Hub progress + make cnpg-backup-status.

Credentials

Field Where
NC_WEBDAV_TOKEN / NC_WEBDAV_URL OpenBao offsite-lane → ESO → actcore-runtime-secret
AGE_PUBLIC_KEY public constant / env (not private key)
AGE_PRIVATE_KEY OpenBao only — restore drills, never on worker

Catalog: warden route show railiance-backup-offsite-lane.