Record T02 backup decision: Option A (Nextcloud + age)

Daily forgejo dump and pg_dump, age-encrypted upload to Nextcloud WebDAV,
balanced retention (14 daily + 4 weekly), RPO 24h / RTO 4h.

docs/forgejo-production-decisions.md

@@ -16,7 +16,7 @@ Operator input: 2026-07-03
 | 4 | SMTP / password reset | **IONOS** SMTP; sender `forgejo@coulomb.social`; OpenBao/ESO mailer on railiance01 | **done** (2026-07-08) | `smtp.ionos.de:587` + `smtp+starttls`; T06 verified |
 | 5 | Package registry scope | **Multi-ecosystem (Option C):** OCI + **npm** + generic; PyPI/Go/Maven/Helm as inventory proves need | **decided** (2026-07-08) | OCI live; npm is launch requirement — see § Package scope |
 | 6 | Actions runner model | **In-cluster** on railiance01: `forgejo-runner` Deployment + DinD (`railiance01-build-01`) | **done** (2026-07-03) | Runner 2/2 Ready; coulombcore host runner disabled; `image-build` probe pushed OCI image via org secrets |
-| 7 | Backup target + retention | TBD | open | — |
+| 7 | Backup target + retention | **Option A:** age-encrypted `forgejo dump` + `pg_dump` → **Nextcloud** WebDAV | **decided** (2026-07-09) | See § Backup; T04/T09 implementation |
 | 8 | Cutover mode | TBD (staged per-repo vs freeze-all) | open | — |
 
 ## Hostname decision detail
@@ -52,9 +52,9 @@ remains canonical for git remotes until migration drills pass.
 - Runners and image-build CI are proven; first repo migration pilot
   (`glas-harness`) documents git/SSH/CI routing in
   `docs/forgejo-repo-migration-pilot-glas-harness.md`.
-- Remaining blockers for production cutover: backup target (T02), cutover mode
+- Remaining blockers for production cutover: **scheduled backup automation**
-  confirmation (T02), npm/package hardening (T07), and production repo migration
+  (T04/T09 per Option A), cutover mode confirmation (T02), npm/package
-  (`RAIL-HO-WP-0005-T11`).
+  hardening (T07), and production repo migration (`RAIL-HO-WP-0005-T11`).
 
 ## SMTP decision (IONOS) — 2026-07-07
 
@@ -117,10 +117,54 @@ a big-bang enable-everything default.
 | npm | `https://forgejo.coulomb.social/api/packages/coulomb/npm/` (configure scope in T07) |
 | Generic | per-repo generic package API |
 
+## Backup decision (Option A) — 2026-07-09
+
+**Operator choice:** Extend the existing **Railiance platform backup lane** —
+age-encrypted artifacts uploaded to **Nextcloud WebDAV** (same pattern as
+`railiance-platform` `make backup` / coulombcore `railiance-backup`).
+
+| Component | Method | Schedule |
+| --- | --- | --- |
+| **Forgejo blob state** | `forgejo dump` zip (repos, packages incl. OCI/npm/generic, attachments, LFS, avatars) | Daily |
+| **PostgreSQL** | `pg_dump` from CNPG `forgejo-db` (logical; no WAL/PITR in Phase 1) | Daily |
+| **Encryption** | age (platform backup public key) before upload | per artifact |
+| **Destination** | Nextcloud WebDAV file drop (off-node) | upload after each run |
+| **Restore proof** | Re-run `tools/forgejo-restore-drill.sh` from automated backup quarterly | manual gate |
+
+**Retention (balanced profile):**
+
+| Artifact | Keep |
+| --- | --- |
+| Daily dumps | 14 rotations |
+| Weekly dumps | 4 rotations (promote Sunday daily or explicit weekly job) |
+| Local cache (if any) | 7 copies per type (match existing `railiance-backup` prune) |
+
+**RPO / RTO targets:**
+
+| Metric | Target |
+| --- | --- |
+| **RPO** | 24 hours (daily schedule) |
+| **RTO** | 4 hours (operator response + restore drill path + validation) |
+
+**Implementation owners:**
+
+- `railiance-platform` — `make forgejo-backup` (or extend `make backup`): cron
+  schedule, age encrypt, Nextcloud upload, retention prune.
+- `railiance-infra` — restore runbook + quarterly drill evidence (`T09`).
+- `railiance-apps` — no backup secrets in Git; dump runs against live pod.
+
+**Explicitly not in scope (Phase 1):** CNPG WAL archiving to S3/MinIO; on-node-only
+backups without Nextcloud upload. Revisit if dump size or RPO requirements outgrow
+daily logical backup.
+
+**Promotion gate:** No further tier-3 repo cutovers until automated daily backups
+have succeeded **7 consecutive days** and one restore drill uses a Nextcloud
+artifact (not workstation `/tmp`).
+
 ## Open decisions (need operator input)
 
 1. ~~SMTP provider~~ — **done** (IONOS + T06 verified 2026-07-08)
 2. ~~Package types~~ — **done: Option C** (OCI + npm + generic; others as needed)
 3. ~~Actions runner~~ — **done** (in-cluster, ADR-004)
-4. Backup destination and restore cadence
+4. ~~Backup destination~~ — **done: Option A** (Nextcloud + age; balanced retention)
 5. Cutover: staged project-by-project vs single freeze window