railiance-platform/docs/forgejo-backup.md

Forgejo backup (railiance01)

Workplan: RAIL-HO-WP-0005 T04/T09 · Decision: Option A (Nextcloud + age)

What is backed up

Artifact	Source	Format
Blob state	forgejo dump in production pod	zip → age
PostgreSQL	pg_dump -Fc from CNPG forgejo-db	custom dump → age

Covers git repos, packages (OCI/npm/generic), attachments, LFS, avatars, and DB metadata.

Operator commands

cd ~/railiance-platform
make forgejo-backup-dry-run    # local encrypt only, no upload
make forgejo-backup            # encrypt + upload to Nextcloud forgejo/
make forgejo-backup-status     # last success + 7-day gate hint

Requires: kubectl, age, curl, KUBECONFIG=~/.kube/config-hosteurope.

Preflight: forgejo-db pod must be Ready (make forgejo-db-status). A full dump with 13 org repos is ~670MiB — allow 10–20 minutes for stream + age on a typical workstation link.

Uploads require the governed CCR-2026-0004 OpenBao offsite lane or explicitly provided RAILIANCE_BACKUP_NC_TOKEN / RAILIANCE_BACKUP_NC_WEBDAV_URL inputs. There is no built-in credential fallback. Missing credentials stop execution before any cluster dump. Local encryption dry-runs skip upload authentication. Provider rotation and replacement upload/restore proof are tracked separately in RPF-WP-0029; removing the source default does not prove revocation. The concrete owner procedure is docs/backup-credential-recovery.md. Upload credentials and credential-bearing URLs are passed to curl through stdin, and backend errors never print those values. Redirects are refused.

Decrypt: ~/.config/age/railiance-backup.key (same key as other Railiance backups).

Nextcloud layout

forgejo/forgejo-dump-<timestamp>.zip.age
forgejo/forgejo-db-<timestamp>.sql.age
forgejo/forgejo-dump-weekly-<timestamp>.zip.age   # Sundays only
forgejo/forgejo-db-weekly-<timestamp>.sql.age

Retention target: 14 daily + 4 weekly on Nextcloud (operator may prune old objects in the WebDAV folder; local cache keeps 7 per type).

Cron (workstation)

# Daily 02:15 UTC — Forgejo backup (RPO 24h)
15 2 * * * cd $HOME/railiance-platform && make forgejo-backup >>$HOME/.cache/railiance/backups/forgejo/cron.log 2>&1

Promotion gate (tier-3 cutover)

Do not promote further production repos until:

1. make forgejo-backup succeeds 7 consecutive days (check success-log).
2. One restore drill uses a Nextcloud artifact (not /tmp/forgejo-drill/).

Restore

See railiance-infra:

• tools/forgejo-restore-drill.sh
• docs/forgejo-restore-drill-evidence.md

Download and decrypt a dump from Nextcloud, set BACKUP_LOCAL to the zip path, then run the drill script.