dooplex-offsite: nightly encrypted copy of Gitea + DooPlex secrets to ep0, restore test, failure mail (R-232 b/h)

Part A plan + readings, Part E read-backs (R-861 a, R-518) in audits/dooplex-survival-2026-10-09/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/CHANGELOG.md

@@ -1,3 +1,19 @@
+## 2026-10-09 — dooplex-offsite: Gitea + DooPlex's secrets leave DooPlex nightly, encrypted (R-232 (b), (h))
+
+- New `scripts/dooplex-offsite/`: `felhom-dooplex-offsite` (daily 00:20) copies the newest complete `gitea.dump`
+  (taken FIRST), then Gitea's repositories, LFS, `app.ini`, attachments, avatars and `jwt` out of the pod (NOT the
+  27.7 GB registry), then the newest night's three GPG secrets files, writes `MANIFEST.sha256` + `REPOS`, and pushes one
+  encrypted `dooplex.pxar` to ep0 (`operator` ns, `host/dooplex-gitea`) with the hub-DB's write-only token and a NEW key.
+  Refuses (no push, no success signal) on: no complete dump / dump > 7 h; file copy failing twice; any symlink or
+  hardlink in the pod's archive; fewer repositories than the pod lists; no `app.ini`; secrets > 30 h.
+- `felhom-dooplex-offsite-restore-test` (Sun 05:30, read-only token): manifest check, repo count, `git fsck` on every
+  repository through a scratch repo with a known config (the pod's `config` files are never read by root git),
+  `pg_restore --list`, secrets present.
+- `felhom-backup-failmail@.service`: `OnFailure=` mail through R-232 (a)'s `notify_failure`; also added to both
+  hub-DB units (`scripts/hub-db-backup/*.service`).
+- 20 tests (`test_dooplex_offsite.py`; fakes for kubectl/PBS/pg_restore, real git/tar), green with GNU and BusyBox
+  tools; red-proofs for 6 checks in `audits/dooplex-survival-2026-10-09/partB/red-proof.txt`.
+
 ## 2026-10-09 — ep0-copy-gc reads ep0's real namespace answer (found on the first live dry run)
 
 - `scripts/ep0-copy-gc/felhom-ep0-copy-gc`: `proxmox-backup-client namespace list --output-format json` answers