thermograph

Author	SHA1	Message	Date
Emi Griffith	e91b49a000	Merge remote-tracking branch 'origin/dev' into feature/storage-backups-merged All checks were successful PR build (required check) / changes (pull_request) Successful in 6s Details secrets-guard / encrypted (pull_request) Successful in 7s Details PR build (required check) / build-backend (pull_request) Has been skipped Details shell-lint / shellcheck (pull_request) Successful in 7s Details PR build (required check) / build-frontend (pull_request) Has been skipped Details PR build (required check) / validate-observability (pull_request) Has been skipped Details PR build (required check) / gate (pull_request) Successful in 2s Details # Conflicts: # infra/deploy/secrets/beta.yaml # infra/deploy/secrets/prod.yaml	2026-07-24 13:07:10 -07:00
emi	d9537798c6	Vault the ERA5 lake bucket credentials (prod) (#16 ) All checks were successful secrets-guard / encrypted (push) Successful in 7s Details	2026-07-23 21:27:32 +00:00
Emi Griffith	6086b40fe6	Add off-box encrypted backups to Contabo Object Storage All checks were successful secrets-guard / encrypted (pull_request) Successful in 7s Details PR build (required check) / changes (pull_request) Successful in 8s Details PR build (required check) / build-backend (pull_request) Has been skipped Details PR build (required check) / build-frontend (pull_request) Has been skipped Details PR build (required check) / validate-observability (pull_request) Has been skipped Details PR build (required check) / gate (pull_request) Successful in 3s Details Prod DB dumps and Forgejo (db + data volume) are now copied off-box to the era5-thermograph S3 bucket, age-encrypted to the vault recipient so the host age key at /etc/thermograph/age.key decrypts them for restore. Nothing plaintext leaves the box; no local intermediate (streamed via age \| rclone rcat). ops-cron: the prod pg_dump job gains an off-box push; a new forgejo-backup job dumps Forgejo's Postgres + tars its data volume on beta (the git host had NO backup at all). 30-day off-box retention on both. S3 creds are Forgejo Actions secrets (S3_ENDPOINT/BUCKET/ACCESS_KEY/SECRET_KEY), mirrored into the SOPS vault (prod.yaml/beta.yaml) for host-side use. Contabo needs path-style addressing. Adds deploy/backup/README.md with the DR restore runbook.	2026-07-23 13:42:09 -07:00
Emi Griffith	ae1d9bb534	Subtree-merge thermograph-infra (origin/main) into infra/ git-subtree-dir: infra git-subtree-mainline: `d6df04eab2` git-subtree-split: `99b4b3f78d`	2026-07-22 22:01:11 -07:00

4 commits