generated from coulomb/repo-seed
tegwick
d12fdb6112
Points at CCR-2026-0004 OpenBao path; playbook documents bao login and fetch shapes for railiance-backup and forgejo-backup tooling.
59 lines
1.7 KiB
Markdown
59 lines
1.7 KiB
Markdown
# Railiance Offsite Backup Lane
|
|
|
|
Date: 2026-07-07
|
|
Catalog: `railiance-backup-offsite-lane` (status `draft`, `resolvable: false` until verified)
|
|
Owner: `railiance-platform` (CCR-2026-0004)
|
|
|
|
Nextcloud WebDAV upload token and URL for age-encrypted offsite backups (Option A).
|
|
Used by `railiance-backup` (workstation) and `forgejo-backup` (platform).
|
|
|
|
---
|
|
|
|
## OpenBao pointers
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| Mount | `platform` |
|
|
| Path | `platform/workloads/railiance/backup/offsite-lane` |
|
|
| Fields | `NC_WEBDAV_TOKEN`, `NC_WEBDAV_URL`, `AGE_PRIVATE_KEY` |
|
|
| Policy | `workload-kv-read-railiance-backup-offsite-lane` |
|
|
| OIDC role | `railiance-backup-workload-kv-read` (`groups=net-kingdom-admins`) |
|
|
|
|
---
|
|
|
|
## Worker checklist
|
|
|
|
1. **Login** (caller identity — ops-warden adds no credential):
|
|
|
|
```bash
|
|
bao login -method=oidc -path=netkingdom role=railiance-backup-workload-kv-read
|
|
```
|
|
|
|
2. **Export for a backup run** (value streams to your shell — never paste into chat):
|
|
|
|
```bash
|
|
export RAILIANCE_BACKUP_NC_TOKEN=$(
|
|
bao kv get -field=NC_WEBDAV_TOKEN platform/workloads/railiance/backup/offsite-lane
|
|
)
|
|
export RAILIANCE_BACKUP_NC_WEBDAV_URL=$(
|
|
bao kv get -field=NC_WEBDAV_URL platform/workloads/railiance/backup/offsite-lane
|
|
)
|
|
```
|
|
|
|
3. **Or proxy via warden access** (after catalog promotion):
|
|
|
|
```bash
|
|
warden access railiance-backup-offsite-lane --no-policy --fetch --field NC_WEBDAV_TOKEN
|
|
```
|
|
|
|
4. **Run backup**:
|
|
|
|
```bash
|
|
# workstation custodian DB + config
|
|
bin/railiance backup
|
|
|
|
# Forgejo production (from railiance-platform checkout)
|
|
tools/cmd/forgejo-backup
|
|
```
|
|
|
|
`AGE_PRIVATE_KEY` in the same path is recovery escrow — fetch only for restore drills. |