scripts
Backup and restore scripts arrive in phase 9: a per-stack pg_dump backup with a
systemd timer on docker-1, and a restore script with a rehearsal recorded in docs/DEPLOY.md.
Export-PescoCaBundle.ps1
Run on a domain-joined PC. Exports every unexpired PESCO CA certificate from the Windows stores to one PEM bundle and copies it to docker-1 with scp (default target ~/packetstation/test/ca/pesco-ca.pem). Use -Remote for another path and -NoCopy to only write the file. It warns on SHA-1 signed certificates; see docs/DEPLOY.md.
Request-VsqlServerCertificate.ps1
Run elevated on the SQL Server host behind vsql. Requests a TLS certificate from PESCO-PSYLOCKE-CA with certreq the way SQL Server requires it (legacy Microsoft RSA SChannel Cryptographic Provider, KeySpec AT_KEYEXCHANGE, RSA 2048, SHA-256, Server Authentication, key encipherment, SANs vsql.pesco.com, vsql and the host names), installs it, validates it (private key, provider, key size, signature, dates, EKU, SANs) before anything is bound, grants only the selected instances' service accounts read on the private key, saves the instances' current bindings to a state file, binds the new thumbprint and prints or performs the restarts. -WhatIf previews every step; -CerFile continues a request that was pending; -Thumbprint binds a certificate already installed; -Rollback restores the saved bindings. Gitea issue 5 tracks the switch to VISUAL_ENCRYPT=yes.