By: ananjiani <ananjiani@noreply.codeberg.org>
fix(erebor): renew OpenBao backup token before nightly snapshot (#313) Nightly OpenBao Raft snapshots on erebor have 403'd since ~2026-05-05. ## Cause `openbao-backup.service` uses an imperative periodic token in `/var/lib/openbao/backup-env`. The token was never renewed, so it died after its 768h period. `lookup-self` is 403 and no `backup`-policy token remained in the accessor list. OpenBao itself is healthy (unsealed). The terraform `backup` policy (`read` on `sys/storage/raft/snapshot`) is sufficient — a throwaway token with that policy took a snapshot. Restic offsite kept succeeding against the last good local snaps (April 4–May 5), so B2 looked healthy while the Raft copies were four months stale. ## Already done on the host - Minted a new 768h periodic token (`display_name=erebor-openbao-backup`, policies `backup`+`default`) into `backup-env` (root:root 0600). - Ran `openbao-backup.service` successfully: `openbao-20260906-120123.snap` (200747 bytes). - Ran `restic-backups-openbao-offsite.service` successfully; newest restic snapshot is 196 KiB at 12:02 (was stuck at 3.991 MiB of old snaps). - Failed unit is cleared. ## This PR Renew the token on every backup run so a 32-day period cannot silently expire again. Skipped: moving the token into terraform/AppRole (add if we want fully declarative token issuance). Co-authored-by: Ammar Nanjiani <ammar.nanjiani@gmail.com> Reviewed-on: https://codeberg.org/ananjiani/infra/pulls/313