# scripts

Backup and restore scripts arrive in phase 9: a per-stack `pg_dump` backup with a
systemd timer on docker-1, and a restore script with a rehearsal recorded in docs/DEPLOY.md.

## Export-PescoCaBundle.ps1

Run on a domain-joined PC. Exports every unexpired PESCO CA certificate from the Windows stores to one PEM bundle and copies it to docker-1 with scp (default target `~/packetstation/test/ca/pesco-ca.pem`). Use `-Remote` for another path and `-NoCopy` to only write the file. It warns on SHA-1 signed certificates; see docs/DEPLOY.md.

## Request-VsqlServerCertificate.ps1

Run elevated on the SQL Server host behind vsql. Requests a TLS certificate from PESCO-PSYLOCKE-CA with certreq the way SQL Server requires it (legacy Microsoft RSA SChannel Cryptographic Provider, KeySpec AT_KEYEXCHANGE, RSA 2048, SHA-256, Server Authentication, key encipherment, SANs vsql.pesco.com, vsql and the host names), installs it, validates it (private key, provider, key size, signature, dates, EKU, SANs) before anything is bound, grants only the selected instances' service accounts read on the private key, saves the instances' current bindings to a state file, binds the new thumbprint and prints or performs the restarts. `-WhatIf` previews every step; `-CerFile` continues a request that was pending; `-Thumbprint` binds a certificate already installed; `-Rollback` restores the saved bindings. Gitea issue 5 tracks the switch to `VISUAL_ENCRYPT=yes`.