From 746e44fccf03b4b57f42619c90afbc13f3283df1 Mon Sep 17 00:00:00 2001
From: Kaan Yagci <kaan.yagci@makepad.fr>
Date: Thu, 13 Aug 2026 12:41:14 +0200
Subject: [PATCH] Provision Jotwink databases and encrypted backups

---
 .github/workflows/manual-deploy.yml |  34 +++++++++
 README.md                           |  77 ++++++++++++++++++-
 bootstrap/jotwink-databases.sql     |  72 ++++++++++++++++++
 compose.host.yml                    |  48 ++++++++++++
 compose.yml                         |   4 +
 config/runtrace-pg_hba.conf         |  13 +++-
 envs/canary/.env.db                 |   2 +-
 envs/production/.env.db             |  10 ++-
 envs/production/compose.yml         |  72 ++++++++++++++++++
 scripts/run-jotwink-backup-loop.sh  |  37 +++++++++
 scripts/run-jotwink-backup.sh       | 112 ++++++++++++++++++++++++++++
 scripts/test-jotwink-backup.sh      |  73 ++++++++++++++++++
 scripts/validate-jotwink-config.sh  |  55 ++++++++++++++
 scripts/verify-jotwink-restore.sh   |  66 ++++++++++++++++
 14 files changed, 668 insertions(+), 7 deletions(-)
 create mode 100644 bootstrap/jotwink-databases.sql
 create mode 100755 scripts/run-jotwink-backup-loop.sh
 create mode 100755 scripts/run-jotwink-backup.sh
 create mode 100755 scripts/test-jotwink-backup.sh
 create mode 100755 scripts/validate-jotwink-config.sh
 create mode 100755 scripts/verify-jotwink-restore.sh

diff --git a/.github/workflows/manual-deploy.yml b/.github/workflows/manual-deploy.yml
index 32befcb..39a4a9e 100644
--- a/.github/workflows/manual-deploy.yml
+++ b/.github/workflows/manual-deploy.yml
@@ -56,6 +56,8 @@ jobs:
           cp config/runtrace-pg_hba.conf "${bundle_root}/config/runtrace-pg_hba.conf"
           cp scripts/run-runtrace-backup.sh "${bundle_root}/scripts/run-runtrace-backup.sh"
           cp scripts/run-runtrace-backup-loop.sh "${bundle_root}/scripts/run-runtrace-backup-loop.sh"
+          cp scripts/run-jotwink-backup.sh "${bundle_root}/scripts/run-jotwink-backup.sh"
+          cp scripts/run-jotwink-backup-loop.sh "${bundle_root}/scripts/run-jotwink-backup-loop.sh"
           cp "envs/${{ inputs.environment }}/compose.yml" "${bundle_root}/envs/${{ inputs.environment }}/compose.yml"
           cp "envs/${{ inputs.environment }}/.env.db" "${bundle_root}/envs/${{ inputs.environment }}/.env.db"
           cat > "${bundle_root}/envs/${{ inputs.environment }}/.env.deploy" <<EOF
@@ -97,6 +99,8 @@ jobs:
           scp "${scp_opts[@]}" "${bundle_root}/config/runtrace-pg_hba.conf" "${remote_target}:${REMOTE_DIR}/config/runtrace-pg_hba.conf"
           scp "${scp_opts[@]}" "${bundle_root}/scripts/run-runtrace-backup.sh" "${remote_target}:${REMOTE_DIR}/scripts/run-runtrace-backup.sh"
           scp "${scp_opts[@]}" "${bundle_root}/scripts/run-runtrace-backup-loop.sh" "${remote_target}:${REMOTE_DIR}/scripts/run-runtrace-backup-loop.sh"
+          scp "${scp_opts[@]}" "${bundle_root}/scripts/run-jotwink-backup.sh" "${remote_target}:${REMOTE_DIR}/scripts/run-jotwink-backup.sh"
+          scp "${scp_opts[@]}" "${bundle_root}/scripts/run-jotwink-backup-loop.sh" "${remote_target}:${REMOTE_DIR}/scripts/run-jotwink-backup-loop.sh"
           scp "${scp_opts[@]}" "${bundle_root}/envs/${{ inputs.environment }}/compose.yml" "${remote_target}:${REMOTE_DIR}/envs/${{ inputs.environment }}/compose.yml"
           scp "${scp_opts[@]}" "${bundle_root}/envs/${{ inputs.environment }}/.env.db" "${remote_target}:${REMOTE_DIR}/envs/${{ inputs.environment }}/.env.db"
           scp "${scp_opts[@]}" "${bundle_root}/envs/${{ inputs.environment }}/.env.deploy" "${remote_target}:${REMOTE_DIR}/envs/${{ inputs.environment }}/.env.deploy"
@@ -118,6 +122,9 @@ jobs:
           postgres_runtrace_hba_config=$(grep '^MAKEPAD_POSTGRES_RUNTRACE_HBA_CONFIG=' "${db_env}" | tail -n 1 | cut -d= -f2-)
           runtrace_backup_path=$(grep '^MAKEPAD_POSTGRES_RUNTRACE_BACKUP_PATH=' "${db_env}" | tail -n 1 | cut -d= -f2-)
           runtrace_backup_password_file=$(grep '^MAKEPAD_POSTGRES_RUNTRACE_BACKUP_PASSWORD_FILE_HOST_PATH=' "${db_env}" | tail -n 1 | cut -d= -f2-)
+          jotwink_backup_path=$(grep '^MAKEPAD_POSTGRES_JOTWINK_BACKUP_PATH=' "${db_env}" | tail -n 1 | cut -d= -f2-)
+          jotwink_backup_password_file=$(grep '^MAKEPAD_POSTGRES_JOTWINK_BACKUP_PASSWORD_FILE_HOST_PATH=' "${db_env}" | tail -n 1 | cut -d= -f2-)
+          jotwink_backup_encryption_cert_config=$(grep '^MAKEPAD_POSTGRES_JOTWINK_BACKUP_ENCRYPTION_CERT_CONFIG=' "${db_env}" | tail -n 1 | cut -d= -f2-)
           postgres_ca_cert_file=$(grep '^MAKEPAD_POSTGRES_CA_CERT_HOST_PATH=' "${db_env}" | tail -n 1 | cut -d= -f2-)
           vif_enabled=0
           if [[ "${deploy_env}" == "production" ]]; then
@@ -138,6 +145,9 @@ jobs:
           if [[ "${deploy_env}" == "production" ]]; then
             : "${runtrace_backup_path:?MAKEPAD_POSTGRES_RUNTRACE_BACKUP_PATH is missing or empty in ${db_env}}"
             : "${runtrace_backup_password_file:?MAKEPAD_POSTGRES_RUNTRACE_BACKUP_PASSWORD_FILE_HOST_PATH is missing or empty in ${db_env}}"
+            : "${jotwink_backup_path:?MAKEPAD_POSTGRES_JOTWINK_BACKUP_PATH is missing or empty in ${db_env}}"
+            : "${jotwink_backup_password_file:?MAKEPAD_POSTGRES_JOTWINK_BACKUP_PASSWORD_FILE_HOST_PATH is missing or empty in ${db_env}}"
+            : "${jotwink_backup_encryption_cert_config:?MAKEPAD_POSTGRES_JOTWINK_BACKUP_ENCRYPTION_CERT_CONFIG is missing or empty in ${db_env}}"
             : "${postgres_ca_cert_file:?MAKEPAD_POSTGRES_CA_CERT_HOST_PATH is missing or empty in ${db_env}}"
           fi
           if [[ ! -s "${postgres_root_password_file}" ]]; then
@@ -173,6 +183,30 @@ jobs:
               echo "Runtrace backup credential must be owned by uid 70 with mode 0400." >&2
               exit 1
             fi
+            if [[ ! -d "${jotwink_backup_path}" || -L "${jotwink_backup_path}" ]]; then
+              echo "Jotwink backup path must be a pre-provisioned non-symlink directory: ${jotwink_backup_path}" >&2
+              exit 1
+            fi
+            jotwink_backup_directory_mode=$(stat -c '%a' "${jotwink_backup_path}")
+            jotwink_backup_directory_uid=$(stat -c '%u' "${jotwink_backup_path}")
+            if [[ "${jotwink_backup_directory_mode}" != "700" || "${jotwink_backup_directory_uid}" != "70" ]]; then
+              echo "Jotwink backup path must be owned by uid 70 with mode 0700: ${jotwink_backup_path}" >&2
+              exit 1
+            fi
+            if [[ ! -s "${jotwink_backup_password_file}" || -L "${jotwink_backup_password_file}" ]]; then
+              echo "Jotwink backup credential must be a non-empty, non-symlink file: ${jotwink_backup_password_file}" >&2
+              exit 1
+            fi
+            jotwink_backup_password_mode=$(stat -c '%a' "${jotwink_backup_password_file}")
+            jotwink_backup_password_uid=$(stat -c '%u' "${jotwink_backup_password_file}")
+            if [[ "${jotwink_backup_password_mode}" != "400" || "${jotwink_backup_password_uid}" != "70" ]]; then
+              echo "Jotwink backup credential must be owned by uid 70 with mode 0400." >&2
+              exit 1
+            fi
+            if ! docker config inspect "${jotwink_backup_encryption_cert_config}" >/dev/null 2>&1; then
+              echo "Jotwink backup recipient certificate config does not exist: ${jotwink_backup_encryption_cert_config}" >&2
+              exit 1
+            fi
             if [[ ! -s "${postgres_ca_cert_file}" || -L "${postgres_ca_cert_file}" ]] || ! grep -q -- '-----BEGIN CERTIFICATE-----' "${postgres_ca_cert_file}"; then
               echo "PostgreSQL CA certificate must be a non-empty, non-symlink PEM file: ${postgres_ca_cert_file}" >&2
               exit 1
diff --git a/README.md b/README.md
index edac409..26b7d6d 100644
--- a/README.md
+++ b/README.md
@@ -15,9 +15,12 @@ This repository owns the shared PostgreSQL server. Application repositories conn
 - `bootstrap/keycloak-new-instances.sql`: idempotent SQL bootstrap for the Vif, Makepad, Vestiaire, and Runtrace Keycloak databases
 - `bootstrap/keycloak-runtrace-app.sql`: targeted idempotent bootstrap for the Runtrace Keycloak database
 - `bootstrap/runtrace-app.sql`: idempotent SQL bootstrap for the Runtrace application database
+- `bootstrap/jotwink-databases.sql`: idempotent bootstrap for the isolated Jotwink application and identity databases
 - `bootstrap/openpanel-app.sql`: idempotent SQL bootstrap for the OpenPanel application database
 - `scripts/run-runtrace-backup.sh`: certificate-verified logical backup for Runtrace app and identity data
 - `scripts/verify-runtrace-restore.sh`: destructive restore verification against explicit non-production targets
+- `scripts/run-jotwink-backup.sh`: certificate-verified logical backup for Jotwink application and identity data
+- `scripts/verify-jotwink-restore.sh`: destructive Jotwink restore verification against explicit non-production targets
 
 ## Networks
 
@@ -57,7 +60,7 @@ Use the manual GitHub Actions workflow in this repository.
 The dedicated database VM currently runs standalone Docker Compose rather than
 joining the application Swarm. On that host, deploy the same TLS and backup
 policy with `compose.host.yml` after provisioning the certificate, key, CA,
-password files, backup directory, and committed HBA policy:
+password files, both backup directories, and committed HBA policy:
 
 ```bash
 docker compose --env-file envs/production/.env.db -f compose.host.yml config
@@ -66,7 +69,10 @@ docker compose --env-file envs/production/.env.db -f compose.host.yml up -d --pu
 
 The host deployment preserves the existing host-network endpoint used by
 Keycloak while requiring TLS and SCRAM for `runtrace` and
-`keycloak_runtrace`. Other databases keep their existing SCRAM transport policy.
+`keycloak_runtrace`. Jotwink is stricter: `jotwink_app` can reach `jotwink`
+only from the application WireGuard peer `10.80.0.1`, and
+`keycloak_jotwink_app` can reach `keycloak_jotwink` only from the dedicated
+Keycloak host. Other databases keep their existing SCRAM transport policy.
 
 Required environment secrets:
 
@@ -97,7 +103,7 @@ docker config create makepad_postgres_tls_cert_v1 /secure/path/server.crt
 docker secret create makepad_postgres_tls_key_v1 /secure/path/server.key
 ```
 
-The names must match `MAKEPAD_POSTGRES_TLS_CERT_CONFIG` and `MAKEPAD_POSTGRES_TLS_KEY_SECRET` in the selected `.env.db`. Rotate by creating new versioned objects, updating those two names, and redeploying; never replace private-key material in place. Distribute only the issuing CA certificate to Runtrace and Keycloak hosts. The deployment creates the versioned `MAKEPAD_POSTGRES_RUNTRACE_HBA_CONFIG` from the committed policy when absent and rejects content drift under an existing name. The policy rejects plaintext connections to `runtrace` and `keycloak_runtrace` and requires SCRAM authentication over TLS for both; unrelated shared databases retain their current SCRAM transport policy during migration.
+The names must match `MAKEPAD_POSTGRES_TLS_CERT_CONFIG` and `MAKEPAD_POSTGRES_TLS_KEY_SECRET` in the selected `.env.db`. Rotate by creating new versioned objects, updating those two names, and redeploying; never replace private-key material in place. Distribute only the issuing CA certificate to application and Keycloak hosts. The deployment creates the versioned `MAKEPAD_POSTGRES_RUNTRACE_HBA_CONFIG` from the committed policy when absent and rejects content drift under an existing name. The policy rejects plaintext connections to `runtrace`, `keycloak_runtrace`, `jotwink`, and `keycloak_jotwink`; it also source-restricts the two Jotwink roles. Unrelated shared databases retain their current SCRAM transport policy during migration. Rotate the versioned HBA config name whenever this committed policy changes.
 
 The workflow deploys only the PostgreSQL stack. It validates the password file before deployment. If one of the configured database networks does not exist yet, it is created as an encrypted overlay on the manager before deployment.
 
@@ -127,6 +133,45 @@ scripts/verify-runtrace-restore.sh /var/lib/makepad/postgres-backups/runtrace/<t
 
 Record the timestamp, artifact checksum, duration, and operator in Runtrace backup/restore evidence. The restore verifier intentionally refuses to run without the exact non-production replacement acknowledgement and validates that both durable state schemas exist after restore.
 
+## Jotwink Backup And Restore
+
+Jotwink has an independent backup service and health timestamp so a failed
+Jotwink dump cannot be hidden by a successful Runtrace dump. It creates
+custom-format dumps of `jotwink` and `keycloak_jotwink` every six hours,
+validates each archive, encrypts it in ephemeral tmpfs with OpenSSL CMS and
+AES-256-GCM before it reaches persistent storage, writes SHA-256 checksums, and
+retains 35 days by default. Provision its root and a public recipient
+certificate before starting `compose.host.yml`:
+
+```bash
+sudo install -d -o 70 -g 70 -m 0700 /var/lib/makepad/postgres-backups/jotwink
+sudo install -d -o root -g root -m 0755 /etc/makepad/postgres-backup
+sudo install -o root -g root -m 0444 jotwink-recipient.pem /etc/makepad/postgres-backup/jotwink-recipient.pem
+```
+
+For Swarm, create the versioned public certificate config named by
+`MAKEPAD_POSTGRES_JOTWINK_BACKUP_ENCRYPTION_CERT_CONFIG`. Keep the matching
+private key offline; it is used only during a controlled restore drill.
+
+Replicate every completed timestamp directory and `last-success.json` to an
+off-host, separately administered encrypted store. Alert before the health
+timestamp exceeds two intervals. At least quarterly, and before launch or a
+database upgrade, restore the newest artifacts into empty non-production
+databases:
+
+```bash
+export PGSERVICEFILE=/etc/makepad/postgres-restore-services.conf
+export JOTWINK_RESTORE_SERVICE=jotwink_restore_test
+export KEYCLOAK_JOTWINK_RESTORE_SERVICE=keycloak_jotwink_restore_test
+export JOTWINK_RESTORE_CONFIRM=replace-nonproduction-restore-targets
+export JOTWINK_BACKUP_DECRYPTION_CERT=/secure/jotwink-recipient.pem
+export JOTWINK_BACKUP_DECRYPTION_KEY=/secure/jotwink-recipient.key
+scripts/verify-jotwink-restore.sh /var/lib/makepad/postgres-backups/jotwink/<timestamp>
+```
+
+Record the artifact checksum, elapsed time, recovery-point age, and operator.
+The verifier checks both the app migration table and Keycloak realm table.
+
 ## Application Databases
 
 Create one database and one dedicated user per application.
@@ -146,6 +191,13 @@ Runtrace application persistence uses:
 | --- | --- | --- |
 | Runtrace app | `runtrace` | `runtrace_app` |
 
+Jotwink application and identity persistence use separate roles:
+
+| Application | Database | Role |
+| --- | --- | --- |
+| Jotwink app | `jotwink` | `jotwink_app` |
+| Jotwink Keycloak | `keycloak_jotwink` | `keycloak_jotwink_app` |
+
 OpenPanel application persistence uses:
 
 | Application | Database | Role |
@@ -162,6 +214,8 @@ Run the idempotent bootstrap with generated passwords. `POSTGRES_ADMIN_URL` must
 : "${KEYCLOAK_RUNTRACE_DB_PASSWORD:?set KEYCLOAK_RUNTRACE_DB_PASSWORD to a generated password}"
 : "${RUNTRACE_DB_PASSWORD:?set RUNTRACE_DB_PASSWORD to a generated password}"
 : "${OPENPANEL_DB_PASSWORD:?set OPENPANEL_DB_PASSWORD to a generated password}"
+: "${JOTWINK_DB_PASSWORD:?set JOTWINK_DB_PASSWORD to a generated password}"
+: "${KEYCLOAK_JOTWINK_DB_PASSWORD:?set KEYCLOAK_JOTWINK_DB_PASSWORD to a generated password}"
 
 psql "$POSTGRES_ADMIN_URL" \
   -v keycloak_vif_app_password="$KEYCLOAK_VIF_DB_PASSWORD" \
@@ -182,6 +236,21 @@ psql "$POSTGRES_ADMIN_URL" \
 psql "$POSTGRES_ADMIN_URL" \
   -v openpanel_app_password="$OPENPANEL_DB_PASSWORD" \
   -f bootstrap/openpanel-app.sql
+
+psql "$POSTGRES_ADMIN_URL" \
+  -v jotwink_app_password="$JOTWINK_DB_PASSWORD" \
+  -v keycloak_jotwink_app_password="$KEYCLOAK_JOTWINK_DB_PASSWORD" \
+  -f bootstrap/jotwink-databases.sql
+```
+
+Jotwink application traffic follows the existing WireGuard path from
+`10.80.0.1` to the database host `10.80.0.2`. Both clients use certificate
+verification; the server certificate SAN must include the exact hostname used
+in these URLs:
+
+```text
+postgres://jotwink_app:<secret>@<db-vm-host>:5432/jotwink?sslmode=verify-full&sslrootcert=/etc/jotwink/postgres/ca.crt
+postgres://keycloak_jotwink_app:<secret>@<db-vm-host>:5432/keycloak_jotwink?sslmode=verify-full&sslrootcert=/etc/makepad/tls/postgres/ca.crt
 ```
 
 The current production Keycloak environments connect with the DB VM host:
@@ -229,4 +298,6 @@ Run the local static checks before opening a deployment PR:
 bash scripts/validate-postgres-config.sh
 bash scripts/test-runtrace-tls-policy.sh
 bash scripts/test-runtrace-backup.sh
+bash scripts/validate-jotwink-config.sh
+bash scripts/test-jotwink-backup.sh
 ```
diff --git a/bootstrap/jotwink-databases.sql b/bootstrap/jotwink-databases.sql
new file mode 100644
index 0000000..95e3cec
--- /dev/null
+++ b/bootstrap/jotwink-databases.sql
@@ -0,0 +1,72 @@
+\set ON_ERROR_STOP on
+
+-- Run this bootstrap with a PostgreSQL superuser connection. It provisions
+-- the Jotwink product and Keycloak databases without embedding credentials.
+
+\if :{?jotwink_app_password}
+\else
+  \echo 'missing required psql variable: jotwink_app_password'
+  \quit 1
+\endif
+\if :{?keycloak_jotwink_app_password}
+\else
+  \echo 'missing required psql variable: keycloak_jotwink_app_password'
+  \quit 1
+\endif
+
+SELECT CASE WHEN NULLIF(btrim(:'jotwink_app_password'), '') IS NULL THEN 'false' ELSE 'true' END AS jotwink_app_password_is_nonempty \gset
+\if :jotwink_app_password_is_nonempty
+\else
+  \echo 'empty required psql variable: jotwink_app_password'
+  \quit 1
+\endif
+SELECT CASE WHEN NULLIF(btrim(:'keycloak_jotwink_app_password'), '') IS NULL THEN 'false' ELSE 'true' END AS keycloak_jotwink_app_password_is_nonempty \gset
+\if :keycloak_jotwink_app_password_is_nonempty
+\else
+  \echo 'empty required psql variable: keycloak_jotwink_app_password'
+  \quit 1
+\endif
+
+SELECT pg_advisory_lock(hashtext('makepad-postgres'), hashtext('jotwink-databases-bootstrap'));
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'jotwink_app') THEN
+    CREATE ROLE jotwink_app LOGIN;
+  END IF;
+END;
+$$;
+ALTER ROLE jotwink_app LOGIN PASSWORD :'jotwink_app_password';
+SELECT 'CREATE DATABASE jotwink OWNER jotwink_app'
+WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'jotwink') \gexec
+SELECT 'ALTER DATABASE jotwink OWNER TO jotwink_app'
+WHERE EXISTS (
+  SELECT 1
+  FROM pg_database d
+  JOIN pg_roles r ON r.oid = d.datdba
+  WHERE d.datname = 'jotwink'
+    AND r.rolname <> 'jotwink_app'
+) \gexec
+GRANT CONNECT ON DATABASE jotwink TO jotwink_app;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'keycloak_jotwink_app') THEN
+    CREATE ROLE keycloak_jotwink_app LOGIN;
+  END IF;
+END;
+$$;
+ALTER ROLE keycloak_jotwink_app LOGIN PASSWORD :'keycloak_jotwink_app_password';
+SELECT 'CREATE DATABASE keycloak_jotwink OWNER keycloak_jotwink_app'
+WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'keycloak_jotwink') \gexec
+SELECT 'ALTER DATABASE keycloak_jotwink OWNER TO keycloak_jotwink_app'
+WHERE EXISTS (
+  SELECT 1
+  FROM pg_database d
+  JOIN pg_roles r ON r.oid = d.datdba
+  WHERE d.datname = 'keycloak_jotwink'
+    AND r.rolname <> 'keycloak_jotwink_app'
+) \gexec
+GRANT CONNECT ON DATABASE keycloak_jotwink TO keycloak_jotwink_app;
+
+SELECT pg_advisory_unlock(hashtext('makepad-postgres'), hashtext('jotwink-databases-bootstrap'));
diff --git a/compose.host.yml b/compose.host.yml
index 6ab3ba7..79f1d25 100644
--- a/compose.host.yml
+++ b/compose.host.yml
@@ -81,3 +81,51 @@ services:
       options:
         max-size: "${MAKEPAD_POSTGRES_BACKUP_LOG_MAX_SIZE:-20m}"
         max-file: "${MAKEPAD_POSTGRES_BACKUP_LOG_MAX_FILES:-5}"
+
+  jotwink_backup:
+    image: ${JOTWINK_BACKUP_IMAGE:-postgres:16-bookworm@sha256:64154d0babcb1741988719e703419af0382b19953706149f9872fbd0f438efa8}
+    user: "70:70"
+    network_mode: host
+    command:
+      - /usr/local/bin/run-jotwink-backup-loop.sh
+    environment:
+      PGHOST: 127.0.0.1
+      PGPORT: "5432"
+      PGUSER: ${POSTGRES_USER:-postgres}
+      PGSSLMODE: verify-full
+      PGSSLROOTCERT: /etc/postgresql/ca.crt
+      POSTGRES_SUPERUSER_PASSWORD_FILE: /run/secrets/postgres_backup_password
+      JOTWINK_BACKUP_ENCRYPTION_CERT: /run/config/jotwink_backup_recipient.pem
+      JOTWINK_BACKUP_ROOT: /backups
+      JOTWINK_BACKUP_INTERVAL_SECONDS: ${MAKEPAD_POSTGRES_JOTWINK_BACKUP_INTERVAL_SECONDS:-21600}
+      JOTWINK_BACKUP_RETRY_SECONDS: ${MAKEPAD_POSTGRES_JOTWINK_BACKUP_RETRY_SECONDS:-300}
+      JOTWINK_BACKUP_RETENTION_DAYS: ${MAKEPAD_POSTGRES_JOTWINK_BACKUP_RETENTION_DAYS:-35}
+    read_only: true
+    tmpfs:
+      - /tmp:mode=0700,uid=70,gid=70
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+    volumes:
+      - "${MAKEPAD_POSTGRES_JOTWINK_BACKUP_PATH:-/var/lib/makepad/postgres-backups/jotwink}:/backups"
+      - "${MAKEPAD_POSTGRES_JOTWINK_BACKUP_PASSWORD_FILE_HOST_PATH:-/etc/makepad/secrets/postgres-backup-password}:/run/secrets/postgres_backup_password:ro"
+      - "${MAKEPAD_POSTGRES_CA_CERT_HOST_PATH:-/etc/makepad/tls/postgres/ca.crt}:/etc/postgresql/ca.crt:ro"
+      - "${MAKEPAD_POSTGRES_JOTWINK_BACKUP_ENCRYPTION_CERT_HOST_PATH:-/etc/makepad/postgres-backup/jotwink-recipient.pem}:/run/config/jotwink_backup_recipient.pem:ro"
+      - "${MAKEPAD_POSTGRES_JOTWINK_BACKUP_SCRIPT_HOST_PATH:-/srv/makepad/postgres/scripts/run-jotwink-backup.sh}:/usr/local/bin/run-jotwink-backup.sh:ro"
+      - "${MAKEPAD_POSTGRES_JOTWINK_BACKUP_LOOP_SCRIPT_HOST_PATH:-/srv/makepad/postgres/scripts/run-jotwink-backup-loop.sh}:/usr/local/bin/run-jotwink-backup-loop.sh:ro"
+    healthcheck:
+      test: ["CMD", "/usr/local/bin/run-jotwink-backup-loop.sh", "healthcheck"]
+      interval: 5m
+      timeout: 10s
+      retries: 3
+      start_period: 10m
+    logging:
+      driver: json-file
+      options:
+        max-size: "${MAKEPAD_POSTGRES_BACKUP_LOG_MAX_SIZE:-20m}"
+        max-file: "${MAKEPAD_POSTGRES_BACKUP_LOG_MAX_FILES:-5}"
diff --git a/compose.yml b/compose.yml
index 2cc8077..8f71a07 100644
--- a/compose.yml
+++ b/compose.yml
@@ -54,6 +54,10 @@ configs:
     file: ./scripts/run-runtrace-backup.sh
   runtrace_backup_loop_script:
     file: ./scripts/run-runtrace-backup-loop.sh
+  jotwink_backup_script:
+    file: ./scripts/run-jotwink-backup.sh
+  jotwink_backup_loop_script:
+    file: ./scripts/run-jotwink-backup-loop.sh
 
 secrets:
   postgres_tls_key:
diff --git a/config/runtrace-pg_hba.conf b/config/runtrace-pg_hba.conf
index 55be5a8..82597e0 100644
--- a/config/runtrace-pg_hba.conf
+++ b/config/runtrace-pg_hba.conf
@@ -1,8 +1,17 @@
-# Runtrace customer data and identity traffic must use TLS. Other shared
-# databases retain their current SCRAM transport policy during migration.
+# Runtrace and Jotwink customer/identity traffic must use TLS. Jotwink is also
+# source-restricted to the application WireGuard peer and Keycloak host.
+# Other shared databases retain their current SCRAM policy during migration.
 local   all                 all                                     trust
 hostnossl runtrace          all                 all                 reject
 hostnossl keycloak_runtrace all                 all                 reject
 hostssl runtrace            all                 all                 scram-sha-256
 hostssl keycloak_runtrace   all                 all                 scram-sha-256
+hostnossl jotwink           all                 all                 reject
+hostnossl keycloak_jotwink  all                 all                 reject
+hostssl jotwink             jotwink_app         10.80.0.1/32        scram-sha-256
+hostssl keycloak_jotwink    keycloak_jotwink_app 88.99.209.165/32   scram-sha-256
+hostssl jotwink             postgres            127.0.0.1/32        scram-sha-256
+hostssl keycloak_jotwink    postgres            127.0.0.1/32        scram-sha-256
+hostssl jotwink             all                 all                 reject
+hostssl keycloak_jotwink    all                 all                 reject
 host    all                 all                 all                 scram-sha-256
diff --git a/envs/canary/.env.db b/envs/canary/.env.db
index 43296e7..475a29d 100644
--- a/envs/canary/.env.db
+++ b/envs/canary/.env.db
@@ -6,4 +6,4 @@ MAKEPAD_POSTGRES_DATA_PATH=/var/lib/makepad/postgres-canary
 MAKEPAD_POSTGRES_SUPERUSER_PASSWORD_FILE_HOST_PATH=/etc/makepad/secrets/postgres-canary-superuser-password
 MAKEPAD_POSTGRES_TLS_CERT_CONFIG=makepad_postgres_canary_tls_cert_v1
 MAKEPAD_POSTGRES_TLS_KEY_SECRET=makepad_postgres_canary_tls_key_v1
-MAKEPAD_POSTGRES_RUNTRACE_HBA_CONFIG=makepad_postgres_canary_runtrace_hba_v1
+MAKEPAD_POSTGRES_RUNTRACE_HBA_CONFIG=makepad_postgres_canary_runtrace_hba_v2
diff --git a/envs/production/.env.db b/envs/production/.env.db
index fbe71c5..da9638b 100644
--- a/envs/production/.env.db
+++ b/envs/production/.env.db
@@ -1,18 +1,26 @@
 # Production PostgreSQL settings
 POSTGRES_IMAGE=postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
+JOTWINK_BACKUP_IMAGE=postgres:16-bookworm@sha256:64154d0babcb1741988719e703419af0382b19953706149f9872fbd0f438efa8
 POSTGRES_DB=postgres
 POSTGRES_USER=postgres
 MAKEPAD_POSTGRES_DATA_PATH=/var/lib/makepad/postgres
 MAKEPAD_POSTGRES_SUPERUSER_PASSWORD_FILE_HOST_PATH=/etc/makepad/secrets/postgres-superuser-password
 MAKEPAD_POSTGRES_TLS_CERT_CONFIG=makepad_postgres_tls_cert_v1
 MAKEPAD_POSTGRES_TLS_KEY_SECRET=makepad_postgres_tls_key_v1
-MAKEPAD_POSTGRES_RUNTRACE_HBA_CONFIG=makepad_postgres_runtrace_hba_v1
+MAKEPAD_POSTGRES_RUNTRACE_HBA_CONFIG=makepad_postgres_runtrace_hba_v2
 MAKEPAD_POSTGRES_CA_CERT_HOST_PATH=/etc/makepad/tls/postgres/ca.crt
 MAKEPAD_POSTGRES_RUNTRACE_BACKUP_PATH=/var/lib/makepad/postgres-backups/runtrace
 MAKEPAD_POSTGRES_RUNTRACE_BACKUP_PASSWORD_FILE_HOST_PATH=/etc/makepad/secrets/postgres-backup-password
 MAKEPAD_POSTGRES_RUNTRACE_BACKUP_INTERVAL_SECONDS=21600
 MAKEPAD_POSTGRES_RUNTRACE_BACKUP_RETRY_SECONDS=300
 MAKEPAD_POSTGRES_RUNTRACE_BACKUP_RETENTION_DAYS=35
+MAKEPAD_POSTGRES_JOTWINK_BACKUP_PATH=/var/lib/makepad/postgres-backups/jotwink
+MAKEPAD_POSTGRES_JOTWINK_BACKUP_PASSWORD_FILE_HOST_PATH=/etc/makepad/secrets/postgres-backup-password
+MAKEPAD_POSTGRES_JOTWINK_BACKUP_ENCRYPTION_CERT_CONFIG=makepad_postgres_jotwink_backup_recipient_v1
+MAKEPAD_POSTGRES_JOTWINK_BACKUP_ENCRYPTION_CERT_HOST_PATH=/etc/makepad/postgres-backup/jotwink-recipient.pem
+MAKEPAD_POSTGRES_JOTWINK_BACKUP_INTERVAL_SECONDS=21600
+MAKEPAD_POSTGRES_JOTWINK_BACKUP_RETRY_SECONDS=300
+MAKEPAD_POSTGRES_JOTWINK_BACKUP_RETENTION_DAYS=35
 MAKEPAD_POSTGRES_BACKUP_CPU_LIMIT=1.0
 MAKEPAD_POSTGRES_BACKUP_MEMORY_LIMIT=1G
 MAKEPAD_POSTGRES_BACKUP_CPU_RESERVATION=0.1
diff --git a/envs/production/compose.yml b/envs/production/compose.yml
index 76cdbe4..27931af 100644
--- a/envs/production/compose.yml
+++ b/envs/production/compose.yml
@@ -107,6 +107,73 @@ services:
           cpus: "${MAKEPAD_POSTGRES_BACKUP_CPU_RESERVATION:-0.1}"
           memory: ${MAKEPAD_POSTGRES_BACKUP_MEMORY_RESERVATION:-128M}
 
+  jotwink_backup:
+    image: ${JOTWINK_BACKUP_IMAGE:-postgres:16-bookworm@sha256:64154d0babcb1741988719e703419af0382b19953706149f9872fbd0f438efa8}
+    user: "70:70"
+    command:
+      - /usr/local/bin/run-jotwink-backup-loop.sh
+    environment:
+      PGHOST: makepad-postgres
+      PGPORT: "5432"
+      PGUSER: ${POSTGRES_USER:-postgres}
+      PGSSLMODE: verify-full
+      PGSSLROOTCERT: /etc/postgresql/ca.crt
+      POSTGRES_SUPERUSER_PASSWORD_FILE: /run/secrets/postgres_backup_password
+      JOTWINK_BACKUP_ENCRYPTION_CERT: /run/config/jotwink_backup_recipient.pem
+      JOTWINK_BACKUP_ROOT: /backups
+      JOTWINK_BACKUP_INTERVAL_SECONDS: ${MAKEPAD_POSTGRES_JOTWINK_BACKUP_INTERVAL_SECONDS:-21600}
+      JOTWINK_BACKUP_RETRY_SECONDS: ${MAKEPAD_POSTGRES_JOTWINK_BACKUP_RETRY_SECONDS:-300}
+      JOTWINK_BACKUP_RETENTION_DAYS: ${MAKEPAD_POSTGRES_JOTWINK_BACKUP_RETENTION_DAYS:-35}
+    read_only: true
+    tmpfs:
+      - /tmp:mode=0700,uid=70,gid=70
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    healthcheck:
+      test: ["CMD", "/usr/local/bin/run-jotwink-backup-loop.sh", "healthcheck"]
+      interval: 5m
+      timeout: 10s
+      retries: 3
+      start_period: 10m
+    networks:
+      - db
+    volumes:
+      - "${MAKEPAD_POSTGRES_JOTWINK_BACKUP_PATH:?set MAKEPAD_POSTGRES_JOTWINK_BACKUP_PATH}:/backups"
+      - "${MAKEPAD_POSTGRES_JOTWINK_BACKUP_PASSWORD_FILE_HOST_PATH:?set MAKEPAD_POSTGRES_JOTWINK_BACKUP_PASSWORD_FILE_HOST_PATH}:/run/secrets/postgres_backup_password:ro"
+      - "${MAKEPAD_POSTGRES_CA_CERT_HOST_PATH:?set MAKEPAD_POSTGRES_CA_CERT_HOST_PATH}:/etc/postgresql/ca.crt:ro"
+    configs:
+      - source: jotwink_backup_script
+        target: /usr/local/bin/run-jotwink-backup.sh
+        mode: 0555
+      - source: jotwink_backup_loop_script
+        target: /usr/local/bin/run-jotwink-backup-loop.sh
+        mode: 0555
+      - source: jotwink_backup_encryption_cert
+        target: /run/config/jotwink_backup_recipient.pem
+        mode: 0444
+    logging:
+      driver: json-file
+      options:
+        max-size: "${MAKEPAD_POSTGRES_BACKUP_LOG_MAX_SIZE:-20m}"
+        max-file: "${MAKEPAD_POSTGRES_BACKUP_LOG_MAX_FILES:-5}"
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.labels.infra.makepad.postgres == true
+      restart_policy:
+        condition: on-failure
+        delay: 30s
+      resources:
+        limits:
+          cpus: "${MAKEPAD_POSTGRES_BACKUP_CPU_LIMIT:-1.0}"
+          memory: ${MAKEPAD_POSTGRES_BACKUP_MEMORY_LIMIT:-1G}
+        reservations:
+          cpus: "${MAKEPAD_POSTGRES_BACKUP_CPU_RESERVATION:-0.1}"
+          memory: ${MAKEPAD_POSTGRES_BACKUP_MEMORY_RESERVATION:-128M}
+
 networks:
   db:
     external: true
@@ -117,3 +184,8 @@ networks:
   vif:
     external: true
     name: ${MAKEPAD_POSTGRES_VIF_DB_NETWORK}
+
+configs:
+  jotwink_backup_encryption_cert:
+    external: true
+    name: ${MAKEPAD_POSTGRES_JOTWINK_BACKUP_ENCRYPTION_CERT_CONFIG}
diff --git a/scripts/run-jotwink-backup-loop.sh b/scripts/run-jotwink-backup-loop.sh
new file mode 100755
index 0000000..6930603
--- /dev/null
+++ b/scripts/run-jotwink-backup-loop.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+set -eu
+
+interval_seconds=${JOTWINK_BACKUP_INTERVAL_SECONDS:-21600}
+retry_seconds=${JOTWINK_BACKUP_RETRY_SECONDS:-300}
+backup_root=${JOTWINK_BACKUP_ROOT:-/backups}
+
+validate_timing_value() {
+  case "$2" in
+    ''|*[!0-9]*) echo "$1 must be a positive integer." >&2; exit 1 ;;
+  esac
+}
+validate_timing_value JOTWINK_BACKUP_INTERVAL_SECONDS "${interval_seconds}"
+validate_timing_value JOTWINK_BACKUP_RETRY_SECONDS "${retry_seconds}"
+if [ "${interval_seconds}" -lt 300 ] || [ "${retry_seconds}" -lt 30 ]; then
+  echo "Jotwink backup interval must be at least 300 seconds and retry delay at least 30 seconds." >&2
+  exit 1
+fi
+
+if [ "${1:-}" = "healthcheck" ]; then
+  status_file=${backup_root}/last-success.json
+  [ -s "${status_file}" ] || exit 1
+  now=$(date +%s)
+  if modified=$(stat -c %Y "${status_file}" 2>/dev/null); then :; else modified=$(stat -f %m "${status_file}"); fi
+  max_age=$((interval_seconds * 2 + retry_seconds))
+  [ $((now - modified)) -le "${max_age}" ]
+  exit
+fi
+
+while :; do
+  if /usr/local/bin/run-jotwink-backup.sh; then
+    sleep "${interval_seconds}"
+  else
+    echo "Jotwink PostgreSQL backup failed; retrying in ${retry_seconds} seconds." >&2
+    sleep "${retry_seconds}"
+  fi
+done
diff --git a/scripts/run-jotwink-backup.sh b/scripts/run-jotwink-backup.sh
new file mode 100755
index 0000000..600e22e
--- /dev/null
+++ b/scripts/run-jotwink-backup.sh
@@ -0,0 +1,112 @@
+#!/bin/sh
+set -eu
+
+umask 077
+
+backup_root=${JOTWINK_BACKUP_ROOT:-/backups}
+password_file=${POSTGRES_SUPERUSER_PASSWORD_FILE:-/run/secrets/postgres_superuser_password}
+encryption_cert=${JOTWINK_BACKUP_ENCRYPTION_CERT:-/run/config/jotwink_backup_recipient.pem}
+retention_days=${JOTWINK_BACKUP_RETENTION_DAYS:-35}
+pg_host=${PGHOST:-127.0.0.1}
+pg_port=${PGPORT:-5432}
+pg_user=${PGUSER:-postgres}
+
+case "${retention_days}" in
+  ''|*[!0-9]*) echo "JOTWINK_BACKUP_RETENTION_DAYS must be a positive integer." >&2; exit 1 ;;
+esac
+[ "${retention_days}" -ge 1 ] || { echo "JOTWINK_BACKUP_RETENTION_DAYS must be at least 1." >&2; exit 1; }
+[ -s "${password_file}" ] || { echo "PostgreSQL backup credential file is missing or empty." >&2; exit 1; }
+[ -s "${encryption_cert}" ] || { echo "Jotwink backup encryption certificate is missing or empty." >&2; exit 1; }
+command -v openssl >/dev/null 2>&1 || { echo "openssl is required to encrypt Jotwink backups." >&2; exit 1; }
+openssl x509 -in "${encryption_cert}" -noout >/dev/null 2>&1 || { echo "Jotwink backup encryption certificate is not a valid PEM X.509 certificate." >&2; exit 1; }
+
+mkdir -p "${backup_root}"
+chmod 700 "${backup_root}"
+lock_dir=${backup_root}/.jotwink-backup.lock
+if ! mkdir "${lock_dir}" 2>/dev/null; then
+  echo "Another Jotwink PostgreSQL backup is already running." >&2
+  exit 1
+fi
+
+timestamp=$(date -u +%Y%m%dT%H%M%SZ)
+partial_dir=${backup_root}/.${timestamp}.partial
+final_dir=${backup_root}/${timestamp}
+work_dir=$(mktemp -d "${TMPDIR:-/tmp}/jotwink-backup.${timestamp}.XXXXXX")
+pgpass=${work_dir}/.pgpass
+
+cleanup() {
+  if [ -d "${partial_dir}" ]; then
+    find "${partial_dir}" -mindepth 1 -delete 2>/dev/null || true
+    rmdir "${partial_dir}" 2>/dev/null || true
+  fi
+  if [ -d "${work_dir}" ]; then
+    find "${work_dir}" -mindepth 1 -delete 2>/dev/null || true
+    rmdir "${work_dir}" 2>/dev/null || true
+  fi
+  rmdir "${lock_dir}" 2>/dev/null || true
+}
+trap cleanup EXIT HUP INT TERM
+
+[ ! -e "${final_dir}" ] && [ ! -L "${final_dir}" ] || { echo "Backup destination already exists for ${timestamp}." >&2; exit 1; }
+password=$(tr -d '\r\n' < "${password_file}")
+[ -n "${password}" ] || { echo "PostgreSQL backup credential file contains no usable value." >&2; exit 1; }
+escaped_password=$(printf '%s' "${password}" | sed 's/\\/\\\\/g; s/:/\\:/g')
+printf '%s:%s:*:%s:%s\n' "${pg_host}" "${pg_port}" "${pg_user}" "${escaped_password}" > "${pgpass}"
+unset password escaped_password
+chmod 600 "${pgpass}"
+export PGPASSFILE="${pgpass}"
+export PGSSLMODE="${PGSSLMODE:-verify-full}"
+export PGSSLROOTCERT="${PGSSLROOTCERT:-/etc/postgresql/ca.crt}"
+
+mkdir "${partial_dir}"
+for database in jotwink keycloak_jotwink; do
+  dump_path=${work_dir}/${database}.dump
+  encrypted_path=${partial_dir}/${database}.dump.cms
+  pg_dump \
+    --host="${pg_host}" \
+    --port="${pg_port}" \
+    --username="${pg_user}" \
+    --dbname="${database}" \
+    --format=custom \
+    --compress=9 \
+    --no-owner \
+    --no-acl \
+    --file="${dump_path}"
+  pg_restore --list "${dump_path}" >/dev/null
+  openssl cms \
+    -encrypt \
+    -binary \
+    -outform DER \
+    -aes-256-gcm \
+    -in "${dump_path}" \
+    -out "${encrypted_path}" \
+    "${encryption_cert}"
+  openssl cms -cmsout -inform DER -in "${encrypted_path}" -noout >/dev/null
+  find "${dump_path}" -delete
+done
+
+(
+  cd "${partial_dir}"
+  sha256sum jotwink.dump.cms keycloak_jotwink.dump.cms > SHA256SUMS
+)
+cat > "${partial_dir}/metadata.json" <<EOF
+{"createdAt":"${timestamp}","databases":["jotwink","keycloak_jotwink"],"format":"postgres-custom+openssl-cms-aes-256-gcm","transport":"verify-full"}
+EOF
+chmod 600 "${partial_dir}"/*
+mv "${partial_dir}" "${final_dir}"
+[ ! -e "${backup_root}/latest" ] || [ -L "${backup_root}/latest" ] || { echo "Backup latest marker exists but is not a symlink." >&2; exit 1; }
+ln -sfn "${timestamp}" "${backup_root}/latest"
+
+status_tmp=${backup_root}/.last-success.json.tmp
+printf '{"createdAt":"%s","backup":"%s","databases":["jotwink","keycloak_jotwink"]}\n' "${timestamp}" "${timestamp}" > "${status_tmp}"
+chmod 600 "${status_tmp}"
+mv "${status_tmp}" "${backup_root}/last-success.json"
+
+find "${backup_root}" -mindepth 1 -maxdepth 1 -type d -name '20??????T??????Z' -mtime "+${retention_days}" -exec sh -c '
+  for directory do
+    find "$directory" -mindepth 1 -delete
+    rmdir "$directory"
+  done
+' sh {} +
+
+echo "Jotwink PostgreSQL backup completed: ${final_dir}"
diff --git a/scripts/test-jotwink-backup.sh b/scripts/test-jotwink-backup.sh
new file mode 100755
index 0000000..8c054f7
--- /dev/null
+++ b/scripts/test-jotwink-backup.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+work_dir=$(mktemp -d)
+
+cleanup() {
+  find "${work_dir}" -mindepth 1 -delete 2>/dev/null || true
+  rmdir "${work_dir}" 2>/dev/null || true
+}
+trap cleanup EXIT
+
+mkdir -p "${work_dir}/bin" "${work_dir}/backups"
+printf 'validation-password\n' > "${work_dir}/password"
+chmod 600 "${work_dir}/password"
+openssl req -x509 -newkey rsa:2048 -nodes -days 1 -subj '/CN=jotwink-backup-test' \
+  -keyout "${work_dir}/recipient.key" -out "${work_dir}/recipient.pem" >/dev/null 2>&1
+
+cat > "${work_dir}/bin/pg_dump" <<'EOF'
+#!/bin/sh
+set -eu
+output=
+database=
+for argument in "$@"; do
+  case "${argument}" in
+    --file=*) output=${argument#--file=} ;;
+    --dbname=*) database=${argument#--dbname=} ;;
+  esac
+done
+[ -n "${output}" ] && [ -n "${database}" ]
+printf 'validated dump for %s\n' "${database}" > "${output}"
+EOF
+cat > "${work_dir}/bin/pg_restore" <<'EOF'
+#!/bin/sh
+set -eu
+[ "$1" = "--list" ]
+[ -s "$2" ]
+EOF
+chmod 700 "${work_dir}/bin/pg_dump" "${work_dir}/bin/pg_restore"
+
+PATH="${work_dir}/bin:${PATH}" \
+JOTWINK_BACKUP_ROOT="${work_dir}/backups" \
+POSTGRES_SUPERUSER_PASSWORD_FILE="${work_dir}/password" \
+JOTWINK_BACKUP_ENCRYPTION_CERT="${work_dir}/recipient.pem" \
+PGSSLROOTCERT="${work_dir}/unused-test-ca.crt" \
+sh "${repo_root}/scripts/run-jotwink-backup.sh"
+
+latest=$(readlink "${work_dir}/backups/latest")
+backup_dir=${work_dir}/backups/${latest}
+for expected in jotwink.dump.cms keycloak_jotwink.dump.cms SHA256SUMS metadata.json; do
+  test -s "${backup_dir}/${expected}"
+done
+(cd "${backup_dir}" && sha256sum --check SHA256SUMS >/dev/null)
+for database in jotwink keycloak_jotwink; do
+  if grep -a -q 'validated dump' "${backup_dir}/${database}.dump.cms"; then
+    echo "Plaintext leaked into the persistent backup artifact." >&2
+    exit 1
+  fi
+  openssl cms -decrypt -binary -inform DER \
+    -in "${backup_dir}/${database}.dump.cms" \
+    -recip "${work_dir}/recipient.pem" \
+    -inkey "${work_dir}/recipient.key" \
+    -out "${work_dir}/${database}.decrypted"
+  grep -q "validated dump for ${database}" "${work_dir}/${database}.decrypted"
+done
+test -s "${work_dir}/backups/last-success.json"
+
+JOTWINK_BACKUP_ROOT="${work_dir}/backups" \
+JOTWINK_BACKUP_INTERVAL_SECONDS=300 \
+JOTWINK_BACKUP_RETRY_SECONDS=30 \
+sh "${repo_root}/scripts/run-jotwink-backup-loop.sh" healthcheck
+
+echo "Jotwink PostgreSQL backup contract passed."
diff --git a/scripts/validate-jotwink-config.sh b/scripts/validate-jotwink-config.sh
new file mode 100755
index 0000000..40bf46a
--- /dev/null
+++ b/scripts/validate-jotwink-config.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+
+require_literal() {
+  local file=$1
+  local literal=$2
+  grep -Fq -- "${literal}" "${repo_root}/${file}" || {
+    echo "Missing Jotwink contract in ${file}: ${literal}" >&2
+    exit 1
+  }
+}
+
+for literal in \
+  "jotwink_app_password" \
+  "keycloak_jotwink_app_password" \
+  "CREATE DATABASE jotwink OWNER jotwink_app" \
+  "CREATE DATABASE keycloak_jotwink OWNER keycloak_jotwink_app" \
+  "pg_advisory_lock" \
+  "pg_advisory_unlock"; do
+  require_literal bootstrap/jotwink-databases.sql "${literal}"
+done
+
+require_literal config/runtrace-pg_hba.conf "hostnossl jotwink"
+require_literal config/runtrace-pg_hba.conf "hostnossl keycloak_jotwink"
+require_literal config/runtrace-pg_hba.conf "hostssl jotwink             jotwink_app         10.80.0.1/32"
+require_literal config/runtrace-pg_hba.conf "hostssl keycloak_jotwink    keycloak_jotwink_app 88.99.209.165/32"
+require_literal compose.host.yml "jotwink_backup:"
+require_literal compose.host.yml "JOTWINK_BACKUP_INTERVAL_SECONDS"
+require_literal compose.host.yml "JOTWINK_BACKUP_ENCRYPTION_CERT"
+require_literal compose.host.yml "no-new-privileges:true"
+require_literal compose.yml "jotwink_backup_script:"
+require_literal compose.yml "jotwink_backup_loop_script:"
+require_literal envs/production/compose.yml "jotwink_backup:"
+require_literal envs/production/compose.yml "JOTWINK_BACKUP_INTERVAL_SECONDS"
+require_literal envs/production/compose.yml "jotwink_backup_encryption_cert:"
+require_literal .github/workflows/manual-deploy.yml "cp scripts/run-jotwink-backup.sh"
+require_literal .github/workflows/manual-deploy.yml "cp scripts/run-jotwink-backup-loop.sh"
+require_literal .github/workflows/manual-deploy.yml "jotwink_backup_directory_mode"
+require_literal .github/workflows/manual-deploy.yml "jotwink_backup_password_mode"
+require_literal .github/workflows/manual-deploy.yml "jotwink_backup_encryption_cert_config"
+require_literal envs/production/.env.db "MAKEPAD_POSTGRES_JOTWINK_BACKUP_INTERVAL_SECONDS=21600"
+require_literal envs/production/.env.db "MAKEPAD_POSTGRES_JOTWINK_BACKUP_ENCRYPTION_CERT_CONFIG="
+require_literal scripts/verify-jotwink-restore.sh "replace-nonproduction-restore-targets"
+require_literal scripts/verify-jotwink-restore.sh "--single-transaction"
+require_literal scripts/run-jotwink-backup.sh "-aes-256-gcm"
+require_literal scripts/run-jotwink-backup.sh "mktemp -d"
+
+if grep -Eq 'postgres://(jotwink_app|keycloak_jotwink_app):[^[:space:]]*sslmode=disable' "${repo_root}/README.md"; then
+  echo "README must not document plaintext-capable Jotwink database URLs." >&2
+  exit 1
+fi
+
+echo "Jotwink PostgreSQL configuration is valid."
diff --git a/scripts/verify-jotwink-restore.sh b/scripts/verify-jotwink-restore.sh
new file mode 100755
index 0000000..d081c0c
--- /dev/null
+++ b/scripts/verify-jotwink-restore.sh
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+backup_dir=${1:?Usage: verify-jotwink-restore.sh <backup-directory>}
+: "${PGSERVICEFILE:?PGSERVICEFILE must identify a root-owned libpq service file}"
+: "${JOTWINK_RESTORE_SERVICE:?JOTWINK_RESTORE_SERVICE must name an empty non-production database}"
+: "${KEYCLOAK_JOTWINK_RESTORE_SERVICE:?KEYCLOAK_JOTWINK_RESTORE_SERVICE must name an empty non-production database}"
+: "${JOTWINK_RESTORE_CONFIRM:?set JOTWINK_RESTORE_CONFIRM=replace-nonproduction-restore-targets}"
+: "${JOTWINK_BACKUP_DECRYPTION_CERT:?JOTWINK_BACKUP_DECRYPTION_CERT must identify the recipient certificate}"
+: "${JOTWINK_BACKUP_DECRYPTION_KEY:?JOTWINK_BACKUP_DECRYPTION_KEY must identify the offline private key}"
+
+[[ "${JOTWINK_RESTORE_CONFIRM}" == "replace-nonproduction-restore-targets" ]] || { echo "Restore verification requires explicit non-production replacement confirmation." >&2; exit 1; }
+[[ -f "${PGSERVICEFILE}" && ! -L "${PGSERVICEFILE}" ]] || { echo "PGSERVICEFILE must be a regular, non-symlink file." >&2; exit 1; }
+[[ -d "${backup_dir}" && ! -L "${backup_dir}" ]] || { echo "Backup directory must be a regular directory and not a symlink." >&2; exit 1; }
+[[ -f "${JOTWINK_BACKUP_DECRYPTION_CERT}" && ! -L "${JOTWINK_BACKUP_DECRYPTION_CERT}" ]] || { echo "Backup recipient certificate must be a regular, non-symlink file." >&2; exit 1; }
+[[ -f "${JOTWINK_BACKUP_DECRYPTION_KEY}" && ! -L "${JOTWINK_BACKUP_DECRYPTION_KEY}" ]] || { echo "Backup private key must be a regular, non-symlink file." >&2; exit 1; }
+
+for required in jotwink.dump.cms keycloak_jotwink.dump.cms SHA256SUMS metadata.json; do
+  [[ -s "${backup_dir}/${required}" ]] || { echo "Backup artifact is missing or empty: ${required}" >&2; exit 1; }
+done
+(cd "${backup_dir}" && sha256sum --check SHA256SUMS)
+
+work_dir=$(mktemp -d)
+cleanup() {
+  find "${work_dir}" -mindepth 1 -delete 2>/dev/null || true
+  rmdir "${work_dir}" 2>/dev/null || true
+}
+trap cleanup EXIT HUP INT TERM
+
+for database in jotwink keycloak_jotwink; do
+  openssl cms \
+    -decrypt \
+    -binary \
+    -inform DER \
+    -in "${backup_dir}/${database}.dump.cms" \
+    -recip "${JOTWINK_BACKUP_DECRYPTION_CERT}" \
+    -inkey "${JOTWINK_BACKUP_DECRYPTION_KEY}" \
+    -out "${work_dir}/${database}.dump"
+  pg_restore --list "${work_dir}/${database}.dump" >/dev/null
+done
+
+restore_dump() {
+  pg_restore \
+    --dbname="service=$1" \
+    --clean \
+    --if-exists \
+    --no-owner \
+    --no-acl \
+    --exit-on-error \
+    --single-transaction \
+    "$2"
+}
+
+restore_dump "${JOTWINK_RESTORE_SERVICE}" "${work_dir}/jotwink.dump"
+restore_dump "${KEYCLOAK_JOTWINK_RESTORE_SERVICE}" "${work_dir}/keycloak_jotwink.dump"
+
+jotwink_schema=$(psql "service=${JOTWINK_RESTORE_SERVICE}" -v ON_ERROR_STOP=1 -Atc \
+  "SELECT to_regclass('public.schema_migrations') IS NOT NULL;")
+keycloak_schema=$(psql "service=${KEYCLOAK_JOTWINK_RESTORE_SERVICE}" -v ON_ERROR_STOP=1 -Atc \
+  "SELECT to_regclass('public.realm') IS NOT NULL;")
+if [[ "${jotwink_schema}" != "t" || "${keycloak_schema}" != "t" ]]; then
+  echo "Restored databases are missing the Jotwink or Keycloak durable schema." >&2
+  exit 1
+fi
+
+echo "Jotwink and Keycloak restore verification completed against non-production targets."