ops-warden/wiki/playbooks/railiance-backup-offsite-lane.md

Railiance Offsite Backup Lane

Date: 2026-07-07
Catalog: railiance-backup-offsite-lane (status draft, resolvable: false until verified)
Owner: railiance-platform (CCR-2026-0004)

Nextcloud WebDAV upload token and URL for age-encrypted offsite backups (Option A). Used by railiance-backup (workstation) and forgejo-backup (platform).

---

OpenBao pointers

Field	Value
Mount	platform
Path	platform/workloads/railiance/backup/offsite-lane
Fields	NC_WEBDAV_TOKEN, NC_WEBDAV_URL, AGE_PRIVATE_KEY
Policy	workload-kv-read-railiance-backup-offsite-lane
OIDC role	railiance-backup-workload-kv-read (groups=net-kingdom-admins)

---

Worker checklist

1. Login (caller identity — ops-warden adds no credential):

   bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read
   

2. Export for a backup run (value streams to your shell — never paste into chat):

   export RAILIANCE_BACKUP_NC_TOKEN=$(
     bao kv get -field=NC_WEBDAV_TOKEN platform/workloads/railiance/backup/offsite-lane
   )
   export RAILIANCE_BACKUP_NC_WEBDAV_URL=$(
     bao kv get -field=NC_WEBDAV_URL platform/workloads/railiance/backup/offsite-lane
   )
   

3. Or proxy via warden access (after catalog promotion):

   warden access railiance-backup-offsite-lane --no-policy --fetch --field NC_WEBDAV_TOKEN
   

4. Run backup:

   # workstation custodian DB + config
   bin/railiance backup
   
   # Forgejo production (from railiance-platform checkout)
   tools/cmd/forgejo-backup
   

AGE_PRIVATE_KEY in the same path is recovery escrow — fetch only for restore drills.