216 backups encrypted on 216: pgBackRest (AES-256) + age-encrypted payment CSVs, pushed write-only to 247 with rrsync; health watches pg_stat_archiver and OFFSITE_SYNC_STATUS_FILE; 216 scripts/configs in ops/server216; plaintext pg216 pipeline removed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ops/server216/tadrisino-export-payment-events

@@ -0,0 +1,19 @@
+#!/bin/bash
+# تدریسینو: دفترِ خرید (payment_paymentevent)، سفارش‌ها و تراکنش‌ها به CSV، هر ۶ ساعت. هر فایل پیش از نوشته‌شدن روی دیسک
+# با age برای کلیدِ /etc/tadrisino-backup/age-recipient.txt رمز می‌شود؛ متنِ خوانا هیچ‌جا ذخیره نمی‌شود.
+# بازکردن: age -d -i age-identity.txt payment-events-….csv.age (کلید در RECOVERY-KEYS). ۱۴ فایلِ آخرِ هر نوع می‌ماند.
+set -euo pipefail
+OUT=/var/lib/tadrisino-backup/payment-log
+REC=/etc/tadrisino-backup/age-recipient.txt
+stamp=$(date -u +%Y%m%dT%H%M%SZ)
+q() {
+  psql -p 5440 -d zareian_mathapp -v ON_ERROR_STOP=1 -Atqc "\\copy ($1) to stdout csv header" | age -R "$REC" -o "$OUT/$2-$stamp.csv.age"
+}
+q "select id, created_at, order_id, user_id, provider, event, detail from payment_paymentevent order by id" payment-events
+q "select id, created_at, user_id, plan_id, plan_title, amount, status, provider, gateway_authority, subscription_id from payment_order order by id" orders
+q "select id, created_at, order_id, gateway, gateway_ref_id, status, paid_at from payment_transaction order by id" transactions
+chmod 640 "$OUT"/*-"$stamp".csv.age
+for kind in payment-events orders transactions; do
+  ls -1t "$OUT/$kind"-*.csv.age | tail -n +15 | xargs -r rm -f --
+done
+echo "wrote $OUT/*-$stamp.csv.age"