dda-devops-build/infrastructure/backup/doc/backup_dev_notes.md

## Init Statemachine

### Inputs
1. `restic-password: ""`
2. `restic-password-to-rotate: ""`

### Manual init the restic repository for the first time

1. apply backup-and-restore pod:   
   `kubectl scale deployment backup-restore --replicas=1`
2. exec into pod and execute restore pod (press tab to get your exact pod name)   
   `kubectl exec -it backup-restore-... -- /usr/local/bin/init.sh`
3. remove backup-and-restore pod:   
   `kubectl scale deployment backup-restore --replicas=0`

### Password Rotation

1. apply backup-and-restore pod:   
   `kubectl scale deployment backup-restore --replicas=1`
2. add new password to restic repository   
    `restic key add ....`   
    => Trigger ::   
    field (1) credential current   
    filed (2) credential new
3. replace field (1) with (2) & clear (2)
4. remove old key - ???  
`restic remove ....`


```mermaid
stateDiagram-v2
    [*] --> init
    init --> backup_ready: trigger, restic-password !empty
    backup_ready --> new_password_added: restic-password !empty && restic-password-to-rotate !empty 
    new_password_added --> backup_ready: restic-password !empty && restic-password-to-rotate empty
```

### First Steps

1. Cloud Testserver hochfahren
2. Dort backup-restore deployment (leeres Secret mgl.?), neues Secret "rotation-credential-secret" als Daten
3. mounten von angelegtem Secret in Pod backup-restore
4. ba*bash*ka Skript in pod starten -> liest Secret ?leer
5. Micha cons.