# Railiance Offsite Backup Lane

Date: 2026-07-07  
Catalog: `railiance-backup-offsite-lane` (status `draft`, `resolvable: false` until verified)  
Owner: `railiance-platform` (CCR-2026-0004)

Nextcloud WebDAV upload token and URL for age-encrypted offsite backups (Option A).
Used by `railiance-backup` (workstation) and `forgejo-backup` (platform).

---

## OpenBao pointers

| Field | Value |
| --- | --- |
| Mount | `platform` |
| Path | `platform/workloads/railiance/backup/offsite-lane` |
| Fields | `NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL`, `AGE_PRIVATE_KEY` |
| Policy | `workload-kv-read-railiance-backup-offsite-lane` |
| OIDC role | `railiance-backup-workload-kv-read` (`groups=net-kingdom-admins`) |

---

## Worker checklist

1. **Login** (caller identity — ops-warden adds no credential):

   ```bash
   bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read
   ```

2. **Export for a backup run** (value streams to your shell — never paste into chat):

   ```bash
   export RAILIANCE_BACKUP_NC_TOKEN=$(
     bao kv get -field=NC_WEBDAV_TOKEN platform/workloads/railiance/backup/offsite-lane
   )
   export RAILIANCE_BACKUP_NC_WEBDAV_URL=$(
     bao kv get -field=NC_WEBDAV_URL platform/workloads/railiance/backup/offsite-lane
   )
   ```

3. **Or proxy via warden access** (after catalog promotion):

   ```bash
   warden access railiance-backup-offsite-lane --no-policy --fetch --field NC_WEBDAV_TOKEN
   ```

4. **Run backup**:

   ```bash
   # workstation custodian DB + config
   bin/railiance backup

   # Forgejo production (from railiance-platform checkout)
   tools/cmd/forgejo-backup
   ```

`AGE_PRIVATE_KEY` in the same path is recovery escrow — fetch only for restore drills.