vpn-configs/bench-backup.md

Bench capture backups

Capture archives from the commissioning bench sync to the backup API on the git box (port 8022). The sync job POSTs to /api/sync with the X-Backup-Key header — the key itself lives in the deploy vars in Mike's customer-deploy repo, not here (keep it that way after the audit finding).

Retention: 30 days on the box, then the offsite job picks it up. If sync starts 401ing, the key was rotated — check deploy vars first.