tegwick
16a93b8e5c
Add cnpg-option-a-backup JSON runner, vendored static age, kubectl install helper, and ESO policy path for offsite lane so railiance01 workers can upload without workstation OIDC (RAILIANCE-WP-0016).
56 lines
1.8 KiB
Markdown
56 lines
1.8 KiB
Markdown
# CNPG Option A multi-host backup
|
|
|
|
**Workplan:** RAILIANCE-WP-0016
|
|
**CLI:** `tools/cmd/cnpg-option-a-backup`
|
|
**Scheduler:** activity-core `daily-cnpg-option-a-backup` (railiance01)
|
|
|
|
## What it does
|
|
|
|
Logical `pg_dump -Fc` → age encrypt → Nextcloud WebDAV for production-of-record
|
|
CNPG databases on **CoulombCore** and **railiance01**. Emits JSON for
|
|
activity-core evidence sinks.
|
|
|
|
Inventory: `railiance-apps/docs/cnpg-backup-topology-inventory.md`.
|
|
|
|
## Operator commands
|
|
|
|
```bash
|
|
# One-time vendor tools (age committed; kubectl downloaded)
|
|
tools/cmd/install-cnpg-backup-vendor-tools
|
|
|
|
# Dry-run (no upload)
|
|
RAILIANCE_BACKUP_DRY_RUN=1 tools/cmd/cnpg-option-a-backup
|
|
|
|
# Live upload (env or bao OIDC)
|
|
export RAILIANCE_BACKUP_NC_TOKEN=… # or bao login + auto-fetch
|
|
tools/cmd/cnpg-option-a-backup
|
|
```
|
|
|
|
From railiance-apps:
|
|
|
|
```bash
|
|
make cnpg-option-a-backup-dry-run
|
|
make cnpg-option-a-backup
|
|
```
|
|
|
|
## activity-core enable
|
|
|
|
1. Re-mint ESO token with backup policy:
|
|
`OPENBAO_ACTIVITY_CORE_POLICIES="… workload-kv-read-railiance-backup-offsite-lane" \
|
|
scripts/openbao-eso-token-apply.sh`
|
|
2. Apply `k8s/railiance/15-externalsecret-backup-offsite.yaml`
|
|
3. Ensure `/home/tegwick/railiance-platform` and `~/.kube` on railiance01 host
|
|
(worker hostPath). Place CoulombCore kubeconfig as `~/.kube/config`.
|
|
4. Rebuild/restart worker with resolver code; sync ActivityDefinition;
|
|
set `enabled: true` on `daily-cnpg-option-a-backup`.
|
|
5. Forced run; check State Hub progress + `make cnpg-backup-status`.
|
|
|
|
## Credentials
|
|
|
|
| Field | Where |
|
|
| --- | --- |
|
|
| `NC_WEBDAV_TOKEN` / `NC_WEBDAV_URL` | OpenBao offsite-lane → ESO → `actcore-runtime-secret` |
|
|
| `AGE_PUBLIC_KEY` | public constant / env (not private key) |
|
|
| `AGE_PRIVATE_KEY` | OpenBao only — restore drills, never on worker |
|
|
|
|
Catalog: `warden route show railiance-backup-offsite-lane`.
|