Update Atlas offsite backup plan

AGENTS.md

@@ -96,7 +96,7 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - Atlas requires `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash` for Cockpit
   and, when storage is enabled, `vault_atlas_samba_password`. Never print these values.
 - Atlas uses NFSv4 for Linux and SMB for Windows/WSL, restricted to the configured LAN. Snapshot,
-  Rclone, Prometheus pull and USB backup automation are intentionally deferred.
+  Borg/Hetzner offsite backup, Prometheus pull and USB backup automation are intentionally deferred.
 
 ## Atlas NAS TODO
 - Replace every Atlas `CHANGEME` value, provide the required Vault variables and validate the first
@@ -114,14 +114,15 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
   services; never expose SSH, Cockpit, NFS, SMB or Syncthing through public port forwarding.
 - Add the least-privilege Prometheus backup flow: remote dump generation, dedicated SSH identity,
   pinned host key, atomic pull, verification, retention and an Atlas systemd service/timer.
-- Add the encrypted Google Drive backup with Rclone Drive plus Crypt remotes, Vault-managed secrets,
-  snapshot-consistent sources, retries, logging, retention policy and a tested restore procedure.
+- Add the encrypted offsite backup with Borg to a Hetzner Storage Box: use a dedicated SSH identity,
+  pin the host key, keep Borg repository credentials and encryption material in Vault, use
+  snapshot-consistent sources, and manage retries, logging, pruning, repository checks and restores.
 - Add the UUID-bound offline USB backup with versioned rsync, locking, capacity checks, verification,
   safe unmounting and a tested restore procedure; never trigger it for an arbitrary USB disk.
 - Add monitoring and alerting for pool health, scrub/resilver, SMART data, temperatures, free space and
   failed backup timers, plus a controlled Rocky kernel/OpenZFS update and reboot procedure.
 - Document and test disaster recovery: rebuild Atlas with Ansible, import the existing pool, restore
-  from snapshot/USB/cloud, preserve Vault and Rclone recovery material offline, and define RPO/RTO.
+  from snapshot/USB/Hetzner, preserve Vault and Borg recovery material offline, and define RPO/RTO.
 - Optionally design iCloud photo ingestion as a separate workflow after the storage and backup layers
   are validated; do not make it a dependency of the Atlas baseline.
 

README.it.md

@@ -224,8 +224,8 @@ password Cockpit in chiaro. Le esecuzioni successive usano `atlas_admin_username
 `atlas_manage_firewall` solo dopo aver verificato subnet LAN e zona firewalld attiva.
 
 Restano da implementare retention delle snapshot, topologia Syncthing, VPN, pull da Prometheus,
-Rclone, backup USB, monitoraggio e test di disaster recovery. Il backlog operativo dettagliato e in
-`AGENTS.md`.
+backup cifrati con Borg su una Hetzner Storage Box, backup USB, monitoraggio e test di disaster
+recovery. Il backlog operativo dettagliato e in `AGENTS.md`.
 
 ---
 

README.md

@@ -133,9 +133,9 @@ Cockpit password. Subsequent runs use `atlas_admin_username`. Enable
 `atlas_manage_storage` only after checking the existing pool and mountpoints; enable
 `atlas_manage_firewall` only after checking the LAN subnet and active firewalld zone.
 
-Snapshot retention, Syncthing topology, VPN access, Prometheus pulls, Rclone, USB backup,
-monitoring, and disaster-recovery tests remain follow-up work. The detailed operational backlog is
-kept in `AGENTS.md`.
+Snapshot retention, Syncthing topology, VPN access, Prometheus pulls, encrypted Borg backups to a
+Hetzner Storage Box, USB backup, monitoring, and disaster-recovery tests remain follow-up work. The
+detailed operational backlog is kept in `AGENTS.md`.
 
 ## How layering works
 

ansible/inventory/host_vars/atlas.yml

@@ -6,7 +6,7 @@ ansible_user: "{{ atlas_connection_username }}"
 ansible_port: 22
 ansible_ssh_private_key_file: CHANGEME_ATLAS_SSH_PRIVATE_KEY_PATH
 
-atlas_admin_username: CHANGEME_ATLAS_ADMIN
+atlas_admin_username: admin
 atlas_connection_username: "{{ atlas_admin_username }}"
 atlas_admin_group: "{{ atlas_admin_username }}"
 atlas_admin_home: "/home/{{ atlas_admin_username }}"