From d973f457c45f80b261cb845e1df604412c95c78f Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Tue, 26 May 2026 17:38:46 +0200
Subject: [PATCH] chore: untrack scripts/Backup/setup-backup-container.ps1
 (operator-local)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The script applies a lifecycle policy + container creation against a live
storage account using operator-specific parameters (StorageAccountName,
ResourceGroupName). It is not portable across environments and each
operator keeps their own copy, so it does not belong in the repo.

The file is preserved on disk (git rm --cached, not -f) so the local
operator setup keeps working — only the Git tracking is dropped, plus
the matching .gitignore entry so a future `git add scripts/Backup` is
silently ignored.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .gitignore                                |  6 ++
 scripts/Backup/setup-backup-container.ps1 | 92 -----------------------
 2 files changed, 6 insertions(+), 92 deletions(-)
 delete mode 100644 scripts/Backup/setup-backup-container.ps1

diff --git a/.gitignore b/.gitignore
index b0ede67e..17991cfd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -132,3 +132,9 @@ db-backups/
 plans/REFACTOR_AGENT_V2.md
 .claude/scheduled_tasks.lock
 .claude/plans/health-script-remediation-fix.md
+
+# Operator-local Azure setup helper — applies lifecycle policy + container
+# creation against a live storage account. Not portable across environments
+# (storage account name, resource group are operator-specific) so it stays
+# out of the repo. Each operator keeps their own copy.
+scripts/Backup/setup-backup-container.ps1
diff --git a/scripts/Backup/setup-backup-container.ps1 b/scripts/Backup/setup-backup-container.ps1
deleted file mode 100644
index 0a98b63a..00000000
--- a/scripts/Backup/setup-backup-container.ps1
+++ /dev/null
@@ -1,92 +0,0 @@
-# setup-backup-container.ps1
-#
-# Idempotent setup for the critical-table backup feature (plan §PR1).
-#
-# Creates the 'critical-table-backups' container in the backend storage account
-# and applies a lifecycle rule that deletes blobs older than 90 days under the
-# 'critical-table-backups/' prefix. Run once per environment, then again any
-# time the storage account is rebuilt.
-#
-# WARNING (plan §Wave15 Azure-Hinweis): Blob Versioning and Blob Soft-Delete
-# are STORAGE-ACCOUNT settings (not container-scoped). Enabling them affects
-# every container in the account (e.g. 'diagnostics', 'offboarding-state').
-# This script does NOT enable them automatically — operator must validate the
-# blast radius separately and run the corresponding `az storage account
-# blob-service-properties update` command if desired.
-
-[CmdletBinding()]
-param(
-    [Parameter(Mandatory = $true)] [string] $StorageAccountName,
-    [Parameter(Mandatory = $true)] [string] $ResourceGroupName,
-    [string] $ContainerName = 'critical-table-backups',
-    [int]    $RetentionDays = 90
-)
-
-$ErrorActionPreference = 'Stop'
-
-Write-Host "==> Verifying Azure CLI login"
-az account show --only-show-errors > $null
-
-Write-Host "==> Ensuring container '$ContainerName' in account '$StorageAccountName'"
-az storage container create `
-    --account-name $StorageAccountName `
-    --name $ContainerName `
-    --auth-mode login `
-    --only-show-errors `
-    --fail-on-exist false | Out-Null
-
-Write-Host "==> Building lifecycle rule (delete > $RetentionDays days, prefix '$ContainerName/')"
-$policyJson = @"
-{
-  "rules": [
-    {
-      "enabled": true,
-      "name": "delete-critical-table-backups",
-      "type": "Lifecycle",
-      "definition": {
-        "actions": {
-          "baseBlob": {
-            "delete": { "daysAfterModificationGreaterThan": $RetentionDays }
-          }
-        },
-        "filters": {
-          "blobTypes": [ "blockBlob" ],
-          "prefixMatch": [ "$ContainerName/" ]
-        }
-      }
-    }
-  ]
-}
-"@
-
-$tmpFile = [System.IO.Path]::GetTempFileName()
-try {
-    Set-Content -Path $tmpFile -Value $policyJson -Encoding UTF8
-    Write-Host "==> Applying lifecycle policy to storage account '$StorageAccountName'"
-    Write-Host "    NOTE: this REPLACES the account's lifecycle policy. If other rules"
-    Write-Host "          exist (e.g. for 'deletion-manifests'), merge them in manually."
-    az storage account management-policy create `
-        --account-name $StorageAccountName `
-        --resource-group $ResourceGroupName `
-        --policy "@$tmpFile" `
-        --only-show-errors | Out-Null
-}
-finally {
-    Remove-Item -Path $tmpFile -ErrorAction SilentlyContinue
-}
-
-Write-Host ""
-Write-Host "==> Done."
-Write-Host "    Container ready: $ContainerName"
-Write-Host "    Lifecycle: delete blobs > $RetentionDays days under '$ContainerName/' prefix"
-Write-Host ""
-Write-Host "Operator follow-ups (NOT applied by this script):"
-Write-Host "  * If you also want Blob Versioning + Soft-Delete (defence-in-depth against"
-Write-Host "    operator mistakes), run separately and confirm the blast radius first:"
-Write-Host "      az storage account blob-service-properties update \\"
-Write-Host "          --account-name $StorageAccountName \\"
-Write-Host "          --resource-group $ResourceGroupName \\"
-Write-Host "          --enable-versioning true \\"
-Write-Host "          --enable-delete-retention true \\"
-Write-Host "          --delete-retention-days 14"
-Write-Host "    Both settings affect ALL containers in the account."