From bb907febf81a727cc524f4a3f96817b9987d109a Mon Sep 17 00:00:00 2001 From: Fabio Scotto di Santolo Date: Sun, 30 Aug 2026 23:30:16 +0200 Subject: [PATCH] Update Atlas offsite backup plan --- AGENTS.md | 9 +++++---- README.it.md | 4 ++-- README.md | 6 +++--- ansible/inventory/host_vars/atlas.yml | 2 +- 4 files changed, 11 insertions(+), 10 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 445c3c2..22b1e8d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -96,7 +96,7 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i - Atlas requires `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash` for Cockpit and, when storage is enabled, `vault_atlas_samba_password`. Never print these values. - Atlas uses NFSv4 for Linux and SMB for Windows/WSL, restricted to the configured LAN. Snapshot, - Rclone, Prometheus pull and USB backup automation are intentionally deferred. + Borg/Hetzner offsite backup, Prometheus pull and USB backup automation are intentionally deferred. ## Atlas NAS TODO - Replace every Atlas `CHANGEME` value, provide the required Vault variables and validate the first @@ -114,14 +114,15 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i services; never expose SSH, Cockpit, NFS, SMB or Syncthing through public port forwarding. - Add the least-privilege Prometheus backup flow: remote dump generation, dedicated SSH identity, pinned host key, atomic pull, verification, retention and an Atlas systemd service/timer. -- Add the encrypted Google Drive backup with Rclone Drive plus Crypt remotes, Vault-managed secrets, - snapshot-consistent sources, retries, logging, retention policy and a tested restore procedure. +- Add the encrypted offsite backup with Borg to a Hetzner Storage Box: use a dedicated SSH identity, + pin the host key, keep Borg repository credentials and encryption material in Vault, use + snapshot-consistent sources, and manage retries, logging, pruning, repository checks and restores. - Add the UUID-bound offline USB backup with versioned rsync, locking, capacity checks, verification, safe unmounting and a tested restore procedure; never trigger it for an arbitrary USB disk. - Add monitoring and alerting for pool health, scrub/resilver, SMART data, temperatures, free space and failed backup timers, plus a controlled Rocky kernel/OpenZFS update and reboot procedure. - Document and test disaster recovery: rebuild Atlas with Ansible, import the existing pool, restore - from snapshot/USB/cloud, preserve Vault and Rclone recovery material offline, and define RPO/RTO. + from snapshot/USB/Hetzner, preserve Vault and Borg recovery material offline, and define RPO/RTO. - Optionally design iCloud photo ingestion as a separate workflow after the storage and backup layers are validated; do not make it a dependency of the Atlas baseline. diff --git a/README.it.md b/README.it.md index c64ba44..23b67a5 100644 --- a/README.it.md +++ b/README.it.md @@ -224,8 +224,8 @@ password Cockpit in chiaro. Le esecuzioni successive usano `atlas_admin_username `atlas_manage_firewall` solo dopo aver verificato subnet LAN e zona firewalld attiva. Restano da implementare retention delle snapshot, topologia Syncthing, VPN, pull da Prometheus, -Rclone, backup USB, monitoraggio e test di disaster recovery. Il backlog operativo dettagliato e in -`AGENTS.md`. +backup cifrati con Borg su una Hetzner Storage Box, backup USB, monitoraggio e test di disaster +recovery. Il backlog operativo dettagliato e in `AGENTS.md`. --- diff --git a/README.md b/README.md index dece3b5..864316a 100644 --- a/README.md +++ b/README.md @@ -133,9 +133,9 @@ Cockpit password. Subsequent runs use `atlas_admin_username`. Enable `atlas_manage_storage` only after checking the existing pool and mountpoints; enable `atlas_manage_firewall` only after checking the LAN subnet and active firewalld zone. -Snapshot retention, Syncthing topology, VPN access, Prometheus pulls, Rclone, USB backup, -monitoring, and disaster-recovery tests remain follow-up work. The detailed operational backlog is -kept in `AGENTS.md`. +Snapshot retention, Syncthing topology, VPN access, Prometheus pulls, encrypted Borg backups to a +Hetzner Storage Box, USB backup, monitoring, and disaster-recovery tests remain follow-up work. The +detailed operational backlog is kept in `AGENTS.md`. ## How layering works diff --git a/ansible/inventory/host_vars/atlas.yml b/ansible/inventory/host_vars/atlas.yml index a168937..7e6caec 100644 --- a/ansible/inventory/host_vars/atlas.yml +++ b/ansible/inventory/host_vars/atlas.yml @@ -6,7 +6,7 @@ ansible_user: "{{ atlas_connection_username }}" ansible_port: 22 ansible_ssh_private_key_file: CHANGEME_ATLAS_SSH_PRIVATE_KEY_PATH -atlas_admin_username: CHANGEME_ATLAS_ADMIN +atlas_admin_username: admin atlas_connection_username: "{{ atlas_admin_username }}" atlas_admin_group: "{{ atlas_admin_username }}" atlas_admin_home: "/home/{{ atlas_admin_username }}"