fix: vendor critical bootstrap charts

.gitea/workflows/deploy.yml

@@ -948,6 +948,7 @@ jobs:
           B2_ACCOUNT_ID: ${{ secrets.B2_ACCOUNT_ID }}
           B2_APPLICATION_KEY: ${{ secrets.B2_APPLICATION_KEY }}
         run: |
+          set -euo pipefail
           echo "Finding latest backup in B2..."
 
           CREDS=$(echo -n "${B2_ACCOUNT_ID}:${B2_APPLICATION_KEY}" | base64)
@@ -985,14 +986,15 @@ jobs:
           ")
 
           if [ "$LATEST" = "NONE" ]; then
-            echo "No backups found in B2. Skipping restore."
-            exit 0
+            echo "No Rancher backups found in B2; refusing to continue without restored Rancher state." >&2
+            exit 1
           fi
 
           BACKUP_FILE=$(basename "$LATEST")
           echo "Latest backup: ${BACKUP_FILE}"
 
           echo "Creating Restore CR..."
+          kubectl -n cattle-resources-system delete restore restore-from-b2 --ignore-not-found
           kubectl apply -f - <<EOF
           apiVersion: resources.cattle.io/v1
           kind: Restore
@@ -1022,7 +1024,9 @@ jobs:
             fi
             sleep 10
           done
-          echo "Restore did not complete within timeout. Continuing anyway."
+          echo "Restore did not complete within timeout." >&2
+          kubectl -n cattle-resources-system describe restore restore-from-b2 || true
+          exit 1
 
       - name: Seed observability runtime images
         run: |

.gitea/workflows/destroy.yml

@@ -23,6 +23,8 @@ env:
   TF_VAR_proxmox_api_token_id: ${{ secrets.PROXMOX_API_TOKEN_ID }}
   TF_VAR_proxmox_api_token_secret: ${{ secrets.PROXMOX_API_TOKEN_SECRET }}
   TF_VAR_proxmox_insecure: "true"
+  B2_ACCOUNT_ID: ${{ secrets.B2_ACCOUNT_ID }}
+  B2_APPLICATION_KEY: ${{ secrets.B2_APPLICATION_KEY }}
 
 jobs:
   destroy:
@@ -58,6 +60,34 @@ jobs:
             -backend-config="secret_key=${{ secrets.S3_SECRET_KEY }}" \
             -backend-config="skip_requesting_account_id=true"
 
+      - name: Verify Rancher backup exists
+        run: |
+          set -euo pipefail
+          CREDS=$(printf '%s:%s' "${B2_ACCOUNT_ID}" "${B2_APPLICATION_KEY}" | base64 -w0)
+          AUTH_RESP=$(curl -fsS -H "Authorization: Basic ${CREDS}" https://api.backblazeb2.com/b2api/v2/b2_authorize_account)
+          API_URL=$(printf '%s' "${AUTH_RESP}" | python3 -c "import json,sys; print(json.load(sys.stdin)['apiUrl'])")
+          AUTH_TOKEN=$(printf '%s' "${AUTH_RESP}" | python3 -c "import json,sys; print(json.load(sys.stdin)['authorizationToken'])")
+          BUCKET_ID=$(printf '%s' "${AUTH_RESP}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('allowed', {}).get('bucketId') or '')")
+
+          if [ -z "${BUCKET_ID}" ]; then
+            BUCKET_ID=$(curl -fsS -H "Authorization: Bearer ${AUTH_TOKEN}" \
+              "${API_URL}/b2api/v2/b2_list_buckets?accountId=${B2_ACCOUNT_ID}&bucketName=HetznerTerra" \
+              | python3 -c "import json,sys; buckets=json.load(sys.stdin).get('buckets',[]); print(buckets[0]['bucketId'] if buckets else '')")
+          fi
+
+          LATEST=$(curl -fsS -H "Authorization: Bearer ${AUTH_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "{\"bucketId\":\"${BUCKET_ID}\",\"prefix\":\"rancher-backups/\",\"maxFileCount\":100}" \
+            "${API_URL}/b2api/v2/b2_list_file_names" \
+            | python3 -c "import json,sys; files=json.load(sys.stdin).get('files', []); tars=sorted(f['fileName'] for f in files if f['fileName'].endswith('.tar.gz')); print(tars[-1] if tars else '')")
+
+          if [ -z "${LATEST}" ]; then
+            echo "No Rancher backup found in B2; refusing to destroy cluster." >&2
+            exit 1
+          fi
+
+          echo "Verified Rancher backup exists: ${LATEST}"
+
       - name: Terraform Destroy
         id: destroy
         working-directory: terraform