fffee646

By: ananjiani <ananjiani@noreply.codeberg.org>

fix(erebor): renew OpenBao backup token before nightly snapshot (#313)

Nightly OpenBao Raft snapshots on erebor have 403'd since ~2026-05-05.

## Cause
`openbao-backup.service` uses an imperative periodic token in `/var/lib/openbao/backup-env`. The token was never renewed, so it died after its 768h period. `lookup-self` is 403 and no `backup`-policy token remained in the accessor list. OpenBao itself is healthy (unsealed). The terraform `backup` policy (`read` on `sys/storage/raft/snapshot`) is sufficient — a throwaway token with that policy took a snapshot.

Restic offsite kept succeeding against the last good local snaps (April 4–May 5), so B2 looked healthy while the Raft copies were four months stale.

## Already done on the host
- Minted a new 768h periodic token (`display_name=erebor-openbao-backup`, policies `backup`+`default`) into `backup-env` (root:root 0600).
- Ran `openbao-backup.service` successfully: `openbao-20260906-120123.snap` (200747 bytes).
- Ran `restic-backups-openbao-offsite.service` successfully; newest restic snapshot is 196 KiB at 12:02 (was stuck at 3.991 MiB of old snaps).
- Failed unit is cleared.

## This PR
Renew the token on every backup run so a 32-day period cannot silently expire again.

Skipped: moving the token into terraform/AppRole (add if we want fully declarative token issuance).
Co-authored-by: Ammar Nanjiani <ammar.nanjiani@gmail.com>
Reviewed-on: https://codeberg.org/ananjiani/infra/pulls/313

Total

1h06m01s

Timeline