Document Atlas NAS backups and monitoring

Harden Atlas USB backup cleanup and document restorecon workflow
Add manual Atlas USB backup and reminder services
2026-09-27 19:03:47 +00:00 · 2026-09-25 14:06:28 +02:00 · 2026-09-25 08:02:44 +02:00 · 2026-09-24 08:55:52 +02:00 · 2026-09-23 09:01:18 +02:00 · 2026-09-22 21:21:21 +02:00
87 changed files with 5597 additions and 548 deletions
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -48,11 +48,31 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora
  - Rocky server after activation: `ansible-playbook ansible/site.yml --limit <host> --check --diff`
  - Atlas NAS: `ansible-playbook ansible/site.yml --limit atlas --check --diff`
  - Aegis IoT: `ansible-playbook ansible/site.yml --limit aegis --check --diff`
  - Aegis NFS client layer: `ansible-playbook ansible/site.yml --limit aegis --tags nfs --list-tasks`
  - Aegis host DNS: `ansible-playbook ansible/site.yml --limit aegis --tags dns --check --diff`
 - Focused checks:
  - Emacs is disabled by default; temporary Emacs check: `ansible-playbook ansible/site.yml --limit <host> --tags emacs --check --diff -e emacs_enabled=true`
  - AI coding agents: `ansible-playbook ansible/site.yml --limit <host> --tags ai_agents --check --diff`
  - Mail bootstrap: `sh -n scripts/bootstrap_mail.sh` and `shellcheck scripts/bootstrap_mail.sh`
  - Server compose render: `podman-compose -f /opt/docker/server/docker-compose.yml config` and `systemctl status podman-compose-server`
  - Atlas media stack:
    `ansible-playbook ansible/site.yml --limit atlas --tags storage,sharing,containers --check --diff`
  - Atlas network/share hardening:
    `ansible-playbook ansible/site.yml --limit atlas --tags hardening,sharing --check --diff`
  - Atlas ZFS snapshot retention and scrub timers:
    `ansible-playbook ansible/site.yml --limit atlas --tags snapshots,scrub --check --diff`
  - Atlas encrypted Borg backup:
    `ansible-playbook ansible/site.yml --limit atlas --tags packages,borg --check --diff`
  - Atlas Borg progress logging only:
    `ansible-playbook ansible/site.yml --limit atlas --tags borg_logging --check --diff`
  - Atlas manual offline USB backup and 45Drives Alerts reminder:
    `ansible-playbook ansible/site.yml --limit atlas --tags usb_backup,usb_reminder --check --diff`
  - Atlas pool, disk, capacity, temperature, and job monitoring:
    `ansible-playbook ansible/site.yml --limit atlas --tags monitoring --check --diff`
  - Atlas explicit post-restore SELinux relabeling:
    `ansible-playbook ansible/site.yml --limit atlas --tags restorecon --check -e '{"atlas_restorecon_paths":["/zpool/archive"]}'`
  - Prometheus/Aegis WireGuard gateway:
    `ansible-playbook ansible/site.yml --limit prometheus,aegis --tags wireguard --check --diff`
  - DuckDNS config only: `ansible-playbook ansible/site.yml --limit prometheus --tags duckdns --check --diff`
 ## Conventions
@@ -104,12 +124,13 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - `rocky_server` is a child of both `platform_rocky` and `server`; `prometheus` is its active target.
 - The target must already provide `server_username` with local sudo access before the profile runs.
 - The Rocky profile installs Podman and podman-compose, uses firewalld, preserves SELinux enforcement, and renders the
-  same server Compose stack with a `podman-compose-server` systemd unit. It does not start, enable, transfer data,
+  existing Nginx Proxy Manager/Gitea Compose stack with a `podman-compose-server` systemd unit. PostgreSQL and
-  update DNS, or cut over traffic; activating the stack is a manual step.
+  Navidrome are no longer part of the desired Prometheus configuration. The role does not stop or remove legacy
  containers, delete `/opt/postgres/data`, start the Compose stack, update DNS, or cut over traffic.
 - Firewalld enables SSH, Cockpit (`9090/tcp`), HTTP and HTTPS. Nginx Proxy Manager publishes `80/tcp` and
  `443/tcp`; bind its administration interface only to `127.0.0.1:81` and use `npm-tunnel` from Ikaros or Nymph.
  Nextcloud remains disabled; do not provision `/srv/nextcloud` directories.
- `scripts/migrate_prometheus_data.sh` is the separate, source-host-run migration path. It dry-runs by
+- `scripts/migrate_prometheus_data.sh` is the separate, source-host-run NPM/Gitea migration path. It dry-runs by
  default and requires explicit source-stack quiescing before copying persistent Docker data with rsync.
 - Atlas-only OpenZFS, NFS, Samba, and Syncthing stay selected through Atlas host variables and must not
  leak into `rocky_server`. Cockpit plus its Navigator and Podman extensions are selected explicitly for
@@ -119,42 +140,157 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - `atlas` is a remote Rocky Linux 9 NAS. Keep its connection, LAN, pool and mountpoint values in
  `host_vars/atlas.yml`. Bootstrap it once with `-e atlas_connection_username=<existing-admin>`;
  subsequent runs use the dedicated Atlas account.
- The pool is pre-existing: never add pool creation, disk partitioning, RAIDZ creation, rollback,
+- The pool is normally pre-existing. A one-time bootstrap may create it only when `atlas_create_pool=true`
-  or destruction to the Atlas profile.
+  is explicitly supplied and `atlas_zpool_disks` contains exactly four real `/dev/disk/by-id/...` paths.
- `atlas_manage_storage` and `atlas_manage_firewall` remain false until their placeholders are
+  Never partition, force, destroy, roll back, or modify the vdev layout of an existing pool.
-  replaced; only then may the profile manage datasets, shares and LAN-restricted firewall rules.
+- `atlas_manage_storage`, `atlas_manage_sharing`, and `atlas_manage_firewall` are enabled in Atlas host vars as
- Atlas requires `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash` for Cockpit
+  the declared steady state; set one false only for a deliberate suspension. `atlas_manage_media_stack` remains false
-  and, when storage is enabled, `vault_atlas_samba_password`. Never print these values.
+  until the future rootful Immich stack has its required Vault inputs and target validation.
- Atlas uses NFSv4 for Linux and SMB for Windows/WSL, restricted to the configured LAN. Snapshot,
+- Atlas requires `vault_atlas_admin_password_hash` for Cockpit and, while sharing is enabled,
-  Borg/Hetzner offsite backup, Prometheus pull and USB backup automation are intentionally deferred.
+  `vault_atlas_samba_password`. The future rootful media stack also requires
  `vault_atlas_immich_db_password`. Never print these values.
 - Atlas creates the complete declared hierarchy only under the verified existing or explicitly bootstrapped pool: `archive`,
  `services`, `services/data`, `services/data/navidrome`, `services/data/syncthing`, `media`, `media/music`,
  `media/photobook`, `backup`, `backup/hosts`, and `backup/hosts/prometheus`. `backup` has a `500G`
  reservation covering its descendants. `archive` is the SMB-shared raw-data namespace; container state is never beneath it.
 - The `immich` system account is fixed to UID/GID `1100`, has no login shell or `wheel` membership, and receives only
  the `video` and `render` supplementary groups. Immich's rootful Quadlets run as `1100:1100`; Server and ML receive
  `/dev/dri`, while the Photobook external library is read-only at `/external/photobook`.
 - Atlas applies persistent kernel network hardening: redirects and source routes are rejected, martians logged, reverse-path filtering remains loose for WireGuard, and IPv4 forwarding is disabled. SSH permits only the declared administrator using public-key authentication; root login, passwords, agent and remote forwarding
  are disabled, while local forwarding remains available for private administrative tunnels. Photobook is exported only to the configured Aegis IP with all access squashed to UID/GID
  `1100`. Targeted SELinux is enforced persistently; a required reboot is reported but never initiated automatically. The primary LAN interface is assigned explicitly to the managed firewalld zone, and firewall rules are applied before NFS or SMB are started; their service state and TCP listeners are then verified. SMB3 exposes `Archive` to Vault-backed authorized accounts on mandatory encrypted, signed SMB3 over TCP/445 only and admits the configured LAN without host-specific exclusions.
 - Atlas NPM and Immich share a rootful Podman network. NPM publishes HTTP/HTTPS, but its administration port remains
  bound to `127.0.0.1:81`; do not expose it directly to the LAN or Internet.
 - `profile_backend_phase1` temporarily runs rootless Navidrome and Syncthing on Atlas until Uranus replaces
  them. It binds only to Atlas' LAN IP, never `wg0`; Navidrome and the Syncthing GUI admit only Aegis as
  the source-NAT gateway, while native Syncthing ports admit the configured LAN. It initializes fresh
  state only and never migrates or deletes source application data.
 - `wireguard_overlay` manages `wg0` between Prometheus (`10.0.0.1`) and Aegis (`10.0.0.2`). It persists private
  keys only on their respective hosts, exchanges only derived public keys through Ansible, and verifies a real peer
  handshake. Prometheus opens `51820/udp`; Aegis is the LAN gateway. Its persistent IPv4 forwarding, narrowly scoped
  WireGuard-to-LAN firewalld policy, and source masquerading permit Prometheus to reach LAN services without a static
  route on the router. Prometheus includes `192.168.178.0/24` in Aegis' peer `AllowedIPs`; add the Uranus VIP there
  when it is assigned. After a firewalld reload, restore Prometheus' rootful Podman networking with
  `podman network reload --all` so the existing proxy stack retains container DNS.
 ## Atlas NAS TODO
- Replace every Atlas `CHANGEME` value, provide the required Vault variables and validate the first
+Completed validation: the existing RAIDZ2 pool and datasets, SELinux, LAN firewall, SSH, Cockpit with
-  remote bootstrap on the real Rocky Linux 9 host. Enable `atlas_manage_storage` first and
+the selected 45Drives plugins, encrypted SMB3 `Archive`, the Aegis-only NFSv4 `photobook` export, and the
-  `atlas_manage_firewall` only after confirming the pool, mountpoints, LAN subnet and firewalld zone.
+Prometheus--Aegis WireGuard gateway are operational. The gateway handshake, forwarding, source masquerading,
- Validate the complete baseline on the target: OpenZFS kmod loading, existing pool import, dataset
+and TCP reachability to Atlas were verified. Temporary Navidrome and Syncthing are available through their
-  mounts, SSH reconnect, Cockpit and all selected 45Drives plugins, NFSv4, SMB and Syncthing.
+manual NPM Proxy Hosts; Syncthing uses `/data/Org` backed by the SMB-shared Archive dataset. Aegis has also
- Finalize dataset properties and the shared UID/GID, group and POSIX ACL model; test the same files
+validated NFSv4.2 read, write, delete, and `all_squash` mapping to UID/GID `1100` end-to-end. The ZFS
-  through both NFS and SMB before considering multiprotocol access complete.
+snapshot timers are active and the first recursive hourly snapshot completed successfully; the first
- Add Ansible-managed ZFS snapshot retention and scrub timers. Use Cockpit Scheduler for visibility
+scheduled retention prune and monthly scrub remain runtime checks.
-  or manual operations, not as the only source of configuration, and never automate snapshot rollback.
+
- Manage the Syncthing star topology, device IDs, folders, folder modes, ignore rules and protected GUI
+### Priority 1 - Data protection
-  or API access for the selected clients.
+- [x] Deploy Ansible-managed recursive ZFS snapshots with 24 hourly, 30 daily, 8 weekly, and 12 monthly
- Add Tailscale or WireGuard and corresponding LAN/VPN-only firewalld rules before enabling remote
+  generations, plus a monthly scrub on the first Sunday at 03:00. The timers and first hourly snapshot were
-  services; never expose SSH, Cockpit, NFS, SMB or Syncthing through public port forwarding.
+  verified on Atlas. Still observe the first scheduled retention prune and scrub; Cockpit Scheduler is for
- Add the least-privilege Prometheus backup flow: remote dump generation, dedicated SSH identity,
+  visibility or manual operations only, and snapshot rollback is never automated.
-  pinned host key, atomic pull, verification, retention and an Atlas systemd service/timer.
+- [x] Activate and validate the encrypted offsite Borg backup to the Hetzner Storage Box. Atlas uses the
- Add the encrypted offsite backup with Borg to a Hetzner Storage Box: use a dedicated SSH identity,
+  dedicated SSH identity, pinned ED25519 host key, Vault-backed `repokey` encryption, and a locked
-  pin the host key, keep Borg repository credentials and encryption material in Vault, use
+  non-login `borg` account with no sudo or supplementary groups. The initial snapshot-consistent backup,
-  snapshot-consistent sources, and manage retries, logging, pruning, repository checks and restores.
+  Borg repository check, and temporary-directory restore completed successfully; the restored `Archive`
- Add the UUID-bound offline USB backup with versioned rsync, locking, capacity checks, verification,
+  tree matched the live data, and temporary snapshots and mounts were removed. The exported recovery key
-  safe unmounting and a tested restore procedure; never trigger it for an arbitrary USB disk.
+  was copied offline. Daily backup retries and logging, 30 daily, 8 weekly and 12 monthly archives,
- Add monitoring and alerting for pool health, scrub/resilver, SMART data, temperatures, free space and
+  compaction, and monthly repository checks are enabled. Future runs report a ZFS-based estimated
-  failed backup timers, plus a controlled Rocky kernel/OpenZFS update and reboot procedure.
+  percentage, and a post-exit helper handles host-namespace temporary snapshot cleanup. The active
- Document and test disaster recovery: rebuild Atlas with Ansible, import the existing pool, restore
+  run predates the new progress logging and still requires an observed final cleanup result.
 - [x] Populate `/zpool/archive` with the currently available data so offsite and offline backup tests run
  against a representative load.
 - [ ] Run and evaluate Borg against the populated pool: duration, repository capacity, deduplication, and
  a subsequent incremental archive must be observed before considering the offsite path fully validated.
 - [x] Add the UUID-bound offline USB backup with versioned rsync, locking, capacity checks, verification,
  safe unmounting and a tested restore procedure; never trigger it for an arbitrary USB disk. The
  LUKS/ext4 identities were read-only verified; the manual service and 45Drives Alerts reminder timer were
  deployed on Atlas. Interactive LUKS unlock is part of the manual service; only the reminder is
  scheduled for the first Saturday of each month at 10:00 Europe/Rome via the existing 45Drives
  notifier. A manual test produced an Alerts notification, not an email. The first USB attempt failed
  on a `security.selinux` xattr and was interrupted; the xattr filter is deployed and the temporary
  recursive snapshot and open LUKS mapper were cleaned up. A later run reported checksum verification
  and published the USB version, but failed while removing host-namespace ZFS snapshot mounts. Those
  exact mounts and snapshots were cleaned up. An `ExecStopPost` helper now removes only the named
  temporary snapshot after the backup process exits. A new full run checksum-verified and published a
  USB version; the service ended successfully, the mapper closed, no temporary USB snapshot remained,
  and the pool was healthy. On 2026-09-25 an independent, read-only USB restore test copied one file from
  the published `atlas/latest` version into `/var/tmp` and matched contents, owner, mode, size, mtime and
  POSIX ACL. The temporary copy and mount were removed, the mapper closed, and the pool remained healthy.
 - [x] Test restores independently from a ZFS snapshot, Borg, and the offline USB backup before relying on
  any backup path. The earlier Borg temporary-directory restore passed. On 2026-09-25 a separate,
  read-only ZFS snapshot test restored one file to `/var/tmp`, confirmed matching contents, ownership,
  mode, mtime and ACL, then removed its temporary copy and on-demand mount. This is a file-level smoke
  test, not full dataset recovery. An independent USB file restore passed on 2026-09-25 with matching
  content and metadata; full disaster recovery remains a separate Priority 2 task.
 - [x] Add monitoring and alerting for pool health, scrub/resilver, SMART data, temperatures, free space,
  snapshot/local-backup growth, Hetzner Storage Box quota, and failed maintenance or backup timers.
  The half-hourly Atlas health monitor and systemd final-failure hooks are deployed. A live probe
  found no issues; the service and timer succeeded, and a labelled 45Drives Alerts test notification
  was submitted. Alerts are deduplicated; email delivery is not claimed. The Storage Box quota probe
  runs `df -m` over the dedicated pinned-key SSH identity and does not open the Borg repository.
  Detailed archive size and deduplication remain part of the pending Borg evaluation.
 ### Priority 2 - NAS operability and recovery
 - [ ] Document and test disaster recovery: rebuild Atlas with Ansible, import the existing pool, restore
  from snapshot/USB/Hetzner, preserve Vault and Borg recovery material offline, and define RPO/RTO.
- Optionally design iCloud photo ingestion as a separate workflow after the storage and backup layers
+- [ ] Define a controlled Rocky kernel/OpenZFS update and reboot procedure.
-  are validated; do not make it a dependency of the Atlas baseline.
+- [ ] Add the Atlas-initiated least-privilege Prometheus backup pull: Prometheus exposes only prepared
  read-only dumps through a dedicated account and Atlas retains the private SSH key, pinned host key,
  atomic pull, verification, retention and systemd service/timer.
 - [ ] Decide whether a common SMB/NFS namespace is required. `Archive` (SMB) and `photobook` (NFS) are
  intentionally distinct today; only if a shared namespace is selected, finalize its UID/GID, group,
  and POSIX ACL model and test the same files through both protocols.
 ### Priority 3 - Service expansion
 - [ ] After data protection and recovery are validated, populate `/zpool/media/music` and validate Navidrome.
 - [ ] Design and deploy Nextcloud as another explicitly temporary Atlas service before Uranus. Give it
  separate persistent application, database, and cache storage; keep credentials in Vault; publish it only
  through NPM over the Prometheus--Aegis gateway; and define backup, upgrade, and eventual Uranus-migration
  procedures before exposing user data. Do not deploy Nextcloud before the data-protection checklist is complete.
 - [ ] Keep `atlas_manage_media_stack` disabled until the future Immich deployment has validated `/dev/dri`,
  container paths, and the required Vault database secret.
 ### Priority 4 - Optional workflows
 - [ ] After data protection is validated, move iCloudPD photo ingestion from Aegis to Atlas as a
  temporary service until Uranus is ready. Plan to store photos in `/zpool/archive/Pictures` and
  persistent application/MFA state outside `Archive`; validate permissions, SELinux, backups and
  recovery before cutover. Keep the current Aegis service and Photobook NFS export unchanged until
  the Atlas workflow is tested, then retire them explicitly if no longer needed.
 ## Cerberus Management Node (Deferred)
 `cerberus` is postponed until the office in the new house is physically set up. It is not an inventory
 host and this section is a design and implementation backlog, not authorization to provision it early.
 The planned node is a Lenovo ThinkCentre M700 Tiny with an Intel Core i3-6100T, 8 GB RAM, a 256 GB SSD,
 and native 1 Gbps Ethernet. It will connect to a multi-input KVM switch using a passive DisplayPort-to-HDMI
 cable, sharing the monitor and peripherals with Ikaros. Fedora Sericea (immutable Fedora with the Sway
 Wayland compositor) is the intended OS. Cerberus is an isolated management plane: a dedicated Toolbox
 environment will run Ansible for future `uranus` cluster provisioning. Rootless Podman will host Grafana,
 Prometheus, and Loki. The 256 GB local SSD is the hot tier retaining metrics and logs for 30 days; scheduled,
 validated exports of older historical data will use a dedicated Atlas NFS dataset as cold storage.
 ### Implementation plan
 - [ ] Confirm the office, KVM switch, passive DisplayPort-to-HDMI path, shared monitor/peripherals, and native
  1 Gbps Ethernet are physically operational before adding Cerberus to inventory.
 - [ ] Install and update Fedora Sericea with Sway; document the immutable-host lifecycle and keep host changes
  declarative rather than treating the base OS as a mutable workstation.
 - [ ] Model Cerberus as its own host with independent platform, role, desktop, network, and storage inputs;
  do not repurpose Ikaros variables or make it a Uranus cluster member.
 - [ ] Provision an isolated Toolbox-based Ansible controller with the required collections and a reproducible
  project checkout; define its least-privilege SSH access, known-host handling, and Vault workflow without
  storing secrets in the image or repository.
 - [ ] Define the explicit Uranus provisioning workflow from Cerberus, including inventory boundaries,
  validation-only runs, and separate approval for any destructive cluster operation.
 - [ ] Design rootless Podman/Quadlet services for Grafana, Prometheus, and Loki, including persistent local
  state, service ownership, LAN exposure/authentication, resource limits, updates, and backups.
 - [ ] Size and enforce a 30-day local hot-retention policy for metrics and logs on the 256 GB SSD; validate
  actual disk growth and alert before capacity exhaustion.
 - [ ] Create and validate a dedicated Atlas NFS cold-storage dataset and least-privilege export for Cerberus;
  do not use a broad existing share or couple it to unrelated Atlas application state.
 - [ ] Implement scheduled, idempotent exports of data older than 30 days to the Atlas NFS cold tier, with
  locking, capacity checks, integrity verification, retention rules, failure monitoring, and a tested restore.
 - [ ] Validate management-plane recovery: rebuild Cerberus, restore observability history from Atlas, and
  confirm that Uranus provisioning can resume without depending on unreproducible local state.
 ## Coding Agent Notes
 - Shared agent definitions and lifecycle flags live in `ai_agents` in `ansible/inventory/group_vars/all.yml`.
@@ -181,14 +317,19 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - `aegis` is a remote Fedora IoT Raspberry Pi 4 node. Bootstrap it once with
  `ansible/bootstrap/aegis.bu`; the remaining configuration is applied by `profile_aegis` over SSH.
 - Fedora IoT is immutable. Do not add it to mutable Fedora package or shared dotfile roles.
- `profile_aegis` owns rootful Podman Quadlets, persistent container state under `/var/lib`, the
+- `profile_aegis` owns the `nfs-utils` and `wireguard-tools` rpm-ostree layers and reports the required reboot
-  Podman auto-update timer, LAN-restricted firewalld rules, and SSH hardening. Keep
+  without initiating it. `wireguard_overlay` then configures Aegis as the WireGuard LAN gateway with persistent IPv4
-  `aegis_lan_subnet` and `aegis_adguard_web_port` host-specific; SSH permits only the declared
+  forwarding, a scoped inter-zone policy, and source masquerading. It also owns rootful Podman Quadlets, persistent container
  state under `/var/lib`, the Podman auto-update timer, LAN-restricted firewalld rules, and SSH hardening. Keep
  `aegis_lan_subnet`, `aegis_adguard_web_port`, and `aegis_network_connection_uuid` host-specific;
  SSH permits only the declared
  key-authenticated users, never root or password authentication. Keep Apple IDs and other
  credentials in Vault and use `no_log` for their rendering.
 - `aegis_adguard_web_port` defaults to `80`. The initial AdGuard Home wizard port `3000` is intentionally unmanaged: open and close it manually only while
  completing initial setup. Disable the local systemd-resolved stub through `profile_aegis` before
  AdGuard binds port 53; keep
-  `/etc/resolv.conf` linked to `/run/systemd/resolve/resolv.conf` so Aegis retains router-provided DNS.
+  `/etc/resolv.conf` linked to `/run/systemd/resolve/resolv.conf`. LAN clients may use AdGuard, but
  Aegis must use the independent upstream DNS declared by `aegis_host_dns_servers` so Greenboot does
  not depend on the AdGuard container during startup.
 - iCloudPD requires post-deployment interactive MFA initialization; its cookie/configuration state is
  persisted in `/var/lib/icloudpd/config`.
--- a/README.it.md
+++ b/README.it.md
@@ -95,6 +95,27 @@ Nota sullo stato attuale del playbook principale:
 - `ansible/site.yml` applica il profilo server Rocky a `prometheus` con DNF, systemd, dotfiles server e firewalld
 - `ansible/site.yml` applica il profilo NAS Rocky su `atlas` tramite SSH remoto
 ## Nodo pianificato e posticipato: Cerberus
 `cerberus` e un nodo di management **posticipato**, in attesa dell'allestimento
 fisico dell'ufficio nella nuova casa. Non e ancora presente nell'inventory e non
 esistono ruoli o playbook che lo prendano come target.
 L'hardware previsto e un Lenovo ThinkCentre M700 Tiny (Intel Core i3-6100T,
 8 GB di RAM e SSD da 256 GB) con Ethernet nativa a 1 Gbps. Condividera monitor
 e periferiche di Ikaros tramite uno switch KVM a ingressi multipli, usando un
 cavo passivo DisplayPort-HDMI per il collegamento video. Il sistema operativo
 previsto e Fedora Sericea, la variante Fedora immutabile con compositor Wayland
 Sway.
 Cerberus sara un management plane isolato: Ansible verra eseguito in un ambiente
 Toolbox dedicato per il provisioning del futuro cluster `uranus`, anziche da
 Ikaros o da un host non gestito. Lo stack di osservabilita rootless Podman
 eseguira Grafana, Prometheus e Loki. L'SSD locale sara l'hot storage, con
 metriche e log conservati per 30 giorni; esportazioni programmate trasferiranno
 i dati storici piu vecchi su un dataset Atlas montato via NFS come cold storage.
 Il piano di implementazione, con prerequisiti espliciti, e in `AGENTS.md`.
 ## Desktop
 Target operativi:
@@ -180,14 +201,25 @@ Lo stato attuale del profilo server include:
 - installazione pacchetti Rocky via DNF, EPEL e CRB
 - installazione di Podman e podman-compose
 - abilitazione dei servizi systemd dichiarati in inventory/group vars
- copia dei dotfiles server e rendering dei template server, incluso il `docker-compose.yml` dello stack servizi e dell'unit `podman-compose-server` (attivazione manuale)
+- copia dei dotfiles server e rendering del `docker-compose.yml` per Nginx Proxy Manager e Gitea,
  piu l'unita `podman-compose-server` (attivazione manuale)
 - attivazione di firewalld con SSH, Cockpit (`9090/tcp`), HTTP e HTTPS abilitati
 - Syncthing escluso dal profilo server Rocky
 Il Compose desiderato su Prometheus non include piu Navidrome ne il database PostgreSQL obsoleto.
 Navidrome e Syncthing appartengono ad Atlas; Navidrome ufficiale usa invece SQLite. Il profilo non
 arresta o rimuove automaticamente eventuali container legacy e non elimina `/opt/postgres/data`.
 Nginx Proxy Manager pubblica solo `80/tcp` e `443/tcp`; la sua interfaccia di amministrazione e
 associata a `127.0.0.1:81` ed e raggiungibile da Ikaros o Nymph con l'alias Bash `npm-tunnel`.
 Nextcloud resta disabilitato e il profilo non crea directory `/srv/nextcloud`.
 La fase 1 su Atlas non modifica questo deployment NPM ne i suoi dati persistenti. Dopo aver attivato
 WireGuard e i servizi Atlas, configurare i proxy host NPM correnti con upstream Navidrome
 `http://10.0.0.2:4533` e upstream per la GUI Syncthing `http://10.0.0.2:8384`. Solo la GUI web di
 Syncthing usa NPM; il traffico di sincronizzazione resta sulle porte native pubblicate esplicitamente solo
 sull'indirizzo WireGuard di Atlas. Configurare l'autenticazione Syncthing e una policy di accesso NPM adeguata prima di pubblicare la GUI.
 ### DuckDNS
 `profile_server` genera `~/duckdns/duck.sh` con permessi `0700`, mantenendo il percorso dello
@@ -211,8 +243,9 @@ salvare separatamente eventuali modifiche non committate senza copiare segreti.
 Dopo il provisioning Rocky, eseguire `scripts/migrate_prometheus_data.sh` **sul server Ubuntu
 sorgente**. Lo script usa rsync, e in dry-run di default; richiede `--quiesce-source --execute` per
-fermare lo stack sorgente e copiare in modo consistente i dati PostgreSQL. Non avvia container, non
+fermare lo stack sorgente e copiare in modo consistente soltanto i dati di Nginx Proxy Manager e
-cancella dati e non esegue il cutover.
+Gitea. Non sposta Navidrome o Syncthing, non avvia container, non cancella dati e non esegue il
 cutover.
 Utente del profilo server:
@@ -234,28 +267,252 @@ ansible-playbook ansible/site.yml --limit prometheus -e server_username=myuser -
 ## NAS
-`atlas` e un NAS Rocky Linux 9 raggiunto tramite SSH. Il pool ZFS esiste gia: il profilo gestisce
+`atlas` è un NAS Rocky Linux 9 raggiunto via SSH. Normalmente il pool esiste già e il profilo gestisce
-solo i dataset figli e non deve mai creare, partizionare, distruggere, fare rollback o modificare il
+solo i dataset figli. La creazione iniziale del RAIDZ2 richiede esplicitamente `atlas_create_pool=true`
-pool. I client Linux usano NFSv4, quelli Windows/WSL SMB; entrambi restano limitati alla LAN
+e quattro percorsi `/dev/disk/by-id/...` verificati in `atlas_zpool_disks`. Il ruolo non partiziona,
-configurata.
+forza, distrugge, ripristina né modifica il layout vdev di un pool esistente. I client Linux usano NFSv4,
 quelli Windows/WSL SMB; l'accesso è limitato alla LAN configurata.
-Per il primo avvio sostituire i placeholder Atlas e fornire
+Per il primo avvio servono `vault_atlas_admin_password_hash`, `vault_atlas_samba_password` e
-`vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash` e
+`vault_atlas_immich_db_password`; il primo è un hash compatibile con `/etc/shadow`, non una password
-`vault_atlas_samba_password`. Eseguire il bootstrap tramite l'amministratore esistente:
+Cockpit in chiaro. Il bootstrap usa l'amministratore preesistente:
 ```bash
 ansible-playbook ansible/site.yml --limit atlas \
  -e atlas_connection_username=<existing-admin>
 ```
-`vault_atlas_admin_password_hash` deve essere un hash compatibile con `/etc/shadow`, non una
+Le esecuzioni successive usano `atlas_admin_username`. Storage, condivisioni e firewall LAN sono
-password Cockpit in chiaro. Le esecuzioni successive usano `atlas_admin_username`. Abilitare
+abilitati; prima dell'applicazione verificare pool, mountpoint, subnet e zona firewalld. La creazione
-`atlas_manage_storage` solo dopo aver verificato pool e mountpoint esistenti; abilitare
+del pool è protetta da un gate esplicito e avviene solo se è assente. Atlas non fa più parte della VPN
-`atlas_manage_firewall` solo dopo aver verificato subnet LAN e zona firewalld attiva.
+WireGuard: la vecchia interfaccia è stata ritirata manualmente dopo la verifica del collegamento tra
 Prometheus e Aegis. Le chiavi SSH autorizzate sono in file separati sotto
 `~/.ssh/authorized_keys.d/`. `atlas_manage_media_stack` resta disabilitato finché `/dev/dri`, percorsi
 dei container e segreto del database Immich non sono validati.
-Restano da implementare retention delle snapshot, topologia Syncthing, VPN, pull da Prometheus,
+Sotto `zpool` Atlas crea `archive` (SMB), `services/data` con i dataset applicativi
-backup cifrati con Borg su una Hetzner Storage Box, backup USB, monitoraggio e test di disaster
+`services/data/navidrome` e `services/data/syncthing`, `media`, `media/music`, `media/photobook` e
-recovery. Il backlog operativo dettagliato e in `AGENTS.md`.
+`backup/hosts/prometheus`. Archivio e applicazioni usano `zstd`; media, Syncthing e backup host usano
 `lz4`. `backup` ha una riserva di `500G` che copre i discendenti. SELinux targeted è persistente;
 l'eventuale riavvio necessario viene segnalato, non eseguito. Atlas assegna l'interfaccia primaria
 alla zona firewalld gestita, rifiuta redirect e source route, registra i martian, mantiene il reverse-path
 filter loose e disabilita il forwarding IPv4. SSH consente soltanto l'amministratore dichiarato con
 chiave pubblica: root, password, agent forwarding e remote forwarding sono disabilitati, mentre il
 forwarding locale resta disponibile per i tunnel amministrativi. SMB3 espone `Archive` agli account
 autorizzati da Vault sulla LAN, solo su TCP/445 con cifratura e firma obbligatorie. NFSv4 espone
 soltanto `media/photobook` all'IP di Aegis su TCP/2049, con `all_squash` verso UID/GID `1100`.
 L'account di sistema `immich` usa UID/GID `1100`, non ha shell di login né gruppo `wheel` e riceve i
 gruppi `video` e `render`. Lo stack Immich futuro prevede Quadlet rootful per Server, ML, cache,
 PostgreSQL e NPM su una rete Podman comune. Immich gira come `1100:1100`, Server e ML ricevono
 `/dev/dri` e Photobook è montato in sola lettura su `/external/photobook`. NPM pubblica `80` e `443`;
 l'interfaccia amministrativa resta su `127.0.0.1:81`, raggiungibile via tunnel SSH.
 Atlas ospita temporaneamente Navidrome e Syncthing rootless fino alla sostituzione con Uranus. I
 servizi sono inizializzati **ex novo**, senza migrare lo stato precedente, rispettivamente sotto
 `/zpool/services/data/navidrome` e `/zpool/services/data/syncthing`; la musica in
 `/zpool/media/music` viene popolata separatamente. Sono vincolati all'indirizzo LAN di Atlas
 (`192.168.178.55`), mai a WireGuard. `wireguard_overlay` collega invece Prometheus (`10.0.0.1`)
 e Aegis (`10.0.0.2`): le chiavi private restano sui rispettivi host e Ansible scambia solo le pubbliche.
 Prometheus apre `51820/udp`; Aegis inoltra soltanto il traffico overlay→LAN dichiarato e applica
 source NAT, evitando interfacce VPN su Atlas/Uranus e route statiche sul router. Navidrome (`4533/tcp`)
 e la GUI Syncthing (`8384/tcp`) ammettono solo Aegis, mentre le porte native Syncthing sono limitate
 alla LAN. Dopo la verifica dei servizi, configurare manualmente i Proxy Host NPM verso
 `http://192.168.178.55:4533` e `http://192.168.178.55:8384`. Il peer Prometheus include la LAN
 negli `AllowedIPs`; aggiungere la VIP Uranus quando esisterà. Dopo il reload di firewalld, Ansible
 ricarica le reti Podman rootful di Prometheus per conservare DNS e connettività del proxy.
 Validare il gateway con:
 ```bash
 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
 ansible-playbook ansible/site.yml --limit prometheus,aegis --tags wireguard --check --diff
 ```
 La prima esecuzione reale WireGuard deve includere entrambi i peer. Se Aegis ha appena installato il
 layer `wireguard-tools`, riavviarlo manualmente e rieseguire senza `--check`: il ruolo attende un
 handshake effettivo.
 Gli snapshot ZFS ricorsivi coprono l'intero pool: 24 orari al minuto 05, 30 giornalieri alle 00:15,
 8 settimanali la domenica alle 01:00 e 12 mensili il primo giorno alle 02:00. La retention elimina
 solo gli snapshot con prefisso gestito `atlas-auto` e non esegue rollback. Lo scrub OpenZFS mensile è
 previsto la prima domenica alle 03:00; il timer settimanale incompatibile è disabilitato. Il primo
 snapshot orario ricorsivo è riuscito; la prima pulizia pianificata e il primo scrub schedulato
 richiedono ancora una verifica a runtime.
 ```bash
 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
 ansible-playbook ansible/site.yml --limit atlas --tags snapshots,scrub --check --diff
 ```
 Il backup Borg cifrato usa il sub-account Hetzner `u660064-sub1`, il repository relativo `./borg-data`
 e Borg remoto 1.4 su SSH porta 23. La chiave ED25519 del server è fissata; una chiave client dedicata
 appartiene all'account `borg`, bloccato e senza login, sudo o gruppi supplementari. La chiave privata
 resta in `/etc/atlas-borg`; la passphrase proviene da `vault_atlas_borg_passphrase` ed è resa in un
 file `0600`. Solo il wrapper root crea snapshot e mount; avvia il client come `borg` con il minimo
 accesso temporaneo in lettura, senza concedergli gestione ZFS o sudo.
 Il backup giornaliero parte alle 04:30 con un ritardo casuale fino a 30 minuti. Crea uno snapshot ZFS
 ricorsivo temporaneo e ricostruisce tutti i dataset sotto `/zpool` in un albero di bind mount in sola
 lettura, per inserirli in un unico archivio coerente. Il wrapper smonta ricorsivamente l'albero privato;
 un helper `ExecStopPost` mirato rimuove eventuali mount dello snapshot nel namespace host e lo snapshot
 temporaneo dopo l'uscita del processo. Borg conserva 30 archivi giornalieri, 8 settimanali e 12
 mensili, poi compatta il repository. Il controllo completo di metadati e repository si svolge il 15
 di ogni mese alle 06:00. Le operazioni usano un lock comune, journal e retry systemd limitati. Le
 nuove esecuzioni riportano al massimo una riga di avanzamento al minuto: percentuale **stimata**,
 dataset, file elaborati e byte originali/compressi/deduplicati. Il denominatore è la somma dei
 `logicalreferenced` ZFS dello snapshot, non un totale Borg: può superare il 100% e non comprende
 retention, compattazione o controlli. Le righe di progresso non riportano i nomi dei file; eventuali
 warning possono farlo. Seguire il job con `sudo journalctl -fu atlas-borg-backup.service`; modifiche
 all'helper non cambiano un'esecuzione già avviata.
 Attivazione iniziale esplicita:
 1. Inserire una passphrase unica in `secrets/vault.yml` con `ansible-vault edit`.
 2. Generare e mostrare solo la chiave pubblica con
   `ansible-playbook ansible/site.yml --limit atlas --tags borg_key`.
 3. Installarla nel sub-account Hetzner, poi applicare con
   `ansible-playbook ansible/site.yml --limit atlas --tags packages,borg`.
 4. Copiare `secrets/recovery/atlas-borg-repokey.export` su un supporto davvero offline: la copia
   locale ignorata da Git non è di per sé un backup offline.
 Il ruolo inizializza solo un repository `repokey` assente, non accetta password SSH né host key non
 fissate e non avvia manualmente il primo backup. Validazione:
 ```bash
 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
 ansible-playbook ansible/site.yml --limit atlas --tags packages,borg --check --diff
 ```
 L'attivazione iniziale è riuscita: backup e controllo del repository, restore completo in una
 directory temporanea confrontato con l'albero `Archive`, esportazione offline della chiave di recupero
 e pulizia di snapshot/mount temporanei. Il 2026-09-25 un test separato da snapshot ZFS giornaliero ha
 copiato un file di `/zpool/archive` in `/var/tmp`, verificando contenuto, proprietario, modalità,
 mtime e ACL POSIX; copia e mount temporanei sono stati rimossi senza interrompere Borg. Non è un test
 di ripristino dell'intero dataset.
 Il backup USB offline è distribuito come **servizio solo manuale** (`atlas_manage_usb_backup: true`):
 Ansible non formatta, sblocca, monta né avvia automaticamente il disco. Il disco esistente è stato
 verificato in sola lettura il 2026-09-23: UUID LUKS `577b3c43-ea37-4611-81a9-39d555cdfbd4`,
 UUID ext4 interno `758e2d2e-a427-4797-aad9-39c3a9f17c7e`, mapper `zpool-backup`. All'ispezione
 era montato in `/mnt/zpool-backup`; il servizio richiede invece che il mapper **non sia montato** prima
 dell'avvio. Se serve, `systemd-ask-password` chiede interattivamente la passphrase LUKS tramite
 l'agente di `systemctl start` e la passa direttamente a `cryptsetup`, senza salvarla, esporla negli
 argomenti o memorizzarla nella cache. Lo script monta il disco privatamente, crea uno snapshot ZFS
 ricorsivo, copia tutti i dataset in `atlas/snapshots/<timestamp>/` con `rsync --link-dest`, verifica
 con un dry-run basato sui checksum, aggiorna atomicamente `atlas/latest`, smonta e chiude LUKS. Un
 errore non sostituisce `latest` né cancella versioni complete precedenti. Borg e USB possono operare
 contemporaneamente su snapshot distinti, ma la lettura concorrente può ridurre il throughput.
 La copia USB conserva le ACL ma non gli attributi estesi generici, compreso `security.selinux`: la
 policy della destinazione deve ricreare le etichette dopo un restore. Per un percorso esplicito:
 ```bash
 ansible-playbook ansible/site.yml --limit atlas --tags restorecon \
  -e '{"atlas_restorecon_paths":["/zpool/archive"]}'
 ```
 Il task accetta solo percorsi sotto la radice del pool Atlas, esegue `restorecon -RFv` solo su quelli
 indicati ed è altrimenti inattivo; non va lanciato sull'intero pool durante i run ordinari. Le vecchie
 versioni USB non vengono eliminate automaticamente senza una retention deliberata. Il controllo di
 capacità include il trasferimento stimato e una riserva libera di 10 GiB. Dopo un backup riuscito,
 scollegare fisicamente il disco per renderlo davvero offline.
 Validare la configurazione senza avviare il backup e, separatamente, un eventuale relabel pianificato:
 ```bash
 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
 ansible-playbook ansible/site.yml --limit atlas --tags usb_backup,usb_reminder --check --diff
 ansible-playbook ansible/site.yml --limit atlas --tags restorecon --check \
  -e '{"atlas_restorecon_paths":["/zpool/archive"]}'
 ```
 Prima dell'avvio manuale smontare in sicurezza `/mnt/zpool-backup`, se ancora montato. Con il mapper
 chiuso, `sudo systemctl start atlas-usb-backup.service` chiede la passphrase e avvia il backup; né la
 password LUKS né un keyfile vanno in Ansible. Seguire con
 `sudo journalctl -fu atlas-usb-backup.service`. **Non esiste un timer di backup USB.** Soltanto
 `atlas-usb-reminder.timer` è schedulato il primo sabato del mese alle 10:00 `Europe/Rome`: invia un
 promemoria al notifier 45Drives Houston, senza avviare il backup. Un test manuale ha prodotto una
 notifica in 45Drives Alerts, **non un'email**; il log conferma l'invio della notifica, non la consegna
 di posta. Il primo evento pianificato era il 2026-10-03 alle 10:00 CEST. Controllare timer e risultato
 con `systemctl list-timers atlas-usb-reminder.timer` e in 45Drives Alerts.
 Il primo tentativo USB del 2026-09-23 fallì su `security.selinux` e, dopo l'interruzione, lasciò
 snapshot e mapper aperti. Applicato il filtro rsync, furono rimossi lo snapshot fallito, il mapper
 smontato e lo stato failed; non rimase una copia valida di quel tentativo. Un run del 2026-09-24
 pubblicò una versione verificata ma fallì nella distruzione dello snapshot a causa di mount
 `.zfs/snapshot` aperti nel namespace host. Dopo la pulizia non forzata, è stato aggiunto un helper
 `ExecStopPost` mirato e testato con uno snapshot usa-e-getta. Un run successivo del 2026-09-24 ha
 verificato i checksum, pubblicato la versione ed è terminato con successo: mapper chiuso, nessuno
 snapshot USB temporaneo e pool sano. Il 2026-09-25 un test di restore indipendente ha aperto il disco
 in sola lettura, montato ext4 con `ro,noload`, copiato un file di 5.707.945 byte da `atlas/latest` in
 una directory vuota sotto `/var/tmp` e confrontato contenuto, proprietario, modalità, dimensione,
 mtime e ACL POSIX. Il test ha rimosso copia e mount temporanei, chiuso LUKS e lasciato il pool sano
 mentre Borg continuava. È un test su file, non un esercizio completo di disaster recovery.
 Il monitoraggio Atlas è eseguito ogni 30 minuti da `atlas-health-monitor.timer`. Sonde in sola
 lettura controllano stato/errori del pool e dei vdev, scrub/resilver, SMART dei quattro dischi del
 pool e dell'NVMe di sistema, temperature dei dischi e CPU, spazio di sistema/pool/snapshot, crescita
 di `zpool/backup` e quota Hetzner tramite `df -m` via SSH con l'account `borg` e la chiave fissata.
 La query remota non apre il repository Borg né il suo lock. Gli alert di crescita richiedono una
 baseline di circa 24 ore. Sono controllati anche attivazione e freschezza dei timer; hook systemd
 `OnFailure` segnalano errori di snapshot, scrub, Borg, USB, promemoria e monitoraggio. Il monitor non
 riavvia Borg; avvisa solo se un run supera 14 giorni. Soglie e percorsi stabili dei dischi sono nelle
 variabili host. Gli avvisi usano 45Drives Houston con deduplicazione; **la consegna email non è stata
 verificata**. Il controllo live del 2026-09-25 non ha trovato problemi; la notifica di prova è stata
 inviata e lo Storage Box risultava occupato al 22%. Dimensione dell'archivio Borg e deduplicazione
 dettagliata richiedono ancora la fine del backup in corso.
 ```bash
 ansible-playbook ansible/site.yml --limit atlas --tags monitoring --check --diff
 sudo /usr/local/libexec/atlas-health-monitor --dry-run
 sudo journalctl -u atlas-health-monitor.service -n 100 --no-pager
 systemctl list-timers atlas-health-monitor.timer
 ```
 `--dry-run` non invia alert e non modifica lo stato del monitor. Un controllo reale si avvia con
 `sudo systemctl start atlas-health-monitor.service`, senza avviare servizi di backup. Per una prova
 etichettata di 45Drives Alerts usare
 `sudo /usr/local/libexec/atlas-health-monitor --test-notification`.
 ### Timer systemd di Atlas
 Tutti i nove timer gestiti sono abilitati. Gli orari sono locali ad Atlas (`Europe/Rome`); Borg e
 monitoraggio aggiungono il ritardo casuale indicato. Tutti hanno `Persistent=true`: un evento perso
 viene recuperato quando il timer torna attivo.
 | Timer | Pianificazione (`OnCalendar`) | Azione |
 | --- | --- | --- |
 | `atlas-zfs-snapshot-hourly.timer` | `*-*-* *:05:00` — ogni ora al minuto 05 | Snapshot ricorsivo orario e retention |
 | `atlas-zfs-snapshot-daily.timer` | `*-*-* 00:15:00` — ogni giorno alle 00:15 | Snapshot ricorsivo giornaliero e retention |
 | `atlas-zfs-snapshot-weekly.timer` | `Sun *-*-* 01:00:00` — domenica alle 01:00 | Snapshot ricorsivo settimanale e retention |
 | `atlas-zfs-snapshot-monthly.timer` | `*-*-01 02:00:00` — primo giorno del mese alle 02:00 | Snapshot ricorsivo mensile e retention |
 | `zfs-scrub-monthly@zpool.timer` | `Sun *-*-01..07 03:00:00` — prima domenica alle 03:00 | Scrub ZFS |
 | `atlas-borg-backup.timer` | `*-*-* 04:30:00` — ogni giorno alle 04:30, più 0–30 min casuali | Backup cifrato offsite |
 | `atlas-borg-check.timer` | `*-*-15 06:00:00` — giorno 15 alle 06:00, più 0–30 min casuali | Controllo repository Borg |
 | `atlas-usb-reminder.timer` | `Sat *-*-01..07 10:00:00 Europe/Rome` — primo sabato alle 10:00 | Solo promemoria 45Drives Alerts |
 | `atlas-health-monitor.timer` | `*:0/30` — ogni mezz'ora, più 0–5 min casuali | Controlli di salute in sola lettura |
 `atlas-usb-backup.service` **non ha timer** e va avviato manualmente. Il timer del fornitore
 `zfs-scrub-weekly@zpool.timer` è disabilitato a favore dello scrub mensile. Il futuro pull del backup
 Prometheus non ha ancora un timer, perché non è implementato. Durante un backup Borg attivo,
 `systemctl list-timers` può mostrare `-` per il prossimo evento senza che il timer sia disabilitato.
 Per vedere la pianificazione corrente: `systemctl list-timers --all` su Atlas.
 Nextcloud è previsto come servizio temporaneo su Atlas prima di Uranus, ma solo dopo la validazione
 della protezione dei dati: richiede storage applicativo, database e cache separati, segreti Vault,
 pubblicazione solo tramite NPM e Aegis, procedure di backup, aggiornamento e migrazione. Non
 distribuirlo prima di completare la checklist di protezione dei dati.
 La destinazione futura per l'importazione foto iCloud è Atlas, non Aegis. Dopo la validazione dei
 backup, pianificare una migrazione esplicita di iCloudPD con foto sotto `/zpool/archive/Pictures` e
 stato applicativo/MFA fuori da `Archive`; testare permessi, SELinux, backup e restore prima del
 cutover. L'attuale iCloudPD su Aegis e l'export NFS Photobook restano configurati fino
 all'approvazione e alla verifica di questa migrazione separata. Anche il servizio Atlas sarà
 temporaneo in attesa di Uranus.
 Il pull dei backup di Prometheus, la valutazione delle dimensioni degli archivi Borg e i test completi
 di disaster recovery restano da fare. Il backlog prioritizzato è in `AGENTS.md`.
 ---
@@ -317,6 +574,8 @@ I principali ruoli attualmente presenti sono:
 | profile_workstation_dev_wsl | configurazione WSL condivisa per sviluppo |
 | profile_server            | configurazione server               |
 | profile_atlas             | configurazione NAS Rocky Linux 9    |
 | profile_backend_phase1    | Navidrome e Syncthing rootless su Atlas |
 | wireguard_overlay         | overlay WireGuard Prometheus/Atlas  |
 | dotfiles_common           | distribuzione dotfiles comuni       |
 | dotfiles                  | distribuzione configurazioni utente |
@@ -332,7 +591,9 @@ platform_void -> packages_void + services_runit
 platform_void & graphical_desktop -> profile_desktop_common + profile_desktop_sway + profile_desktop_niri + profile_desktop_host
 platform_fedora -> packages_fedora + services_systemd
 platform_rocky -> packages_rocky + services_systemd
 wireguard_overlay -> wireguard_overlay (dopo platform_rocky)
 atlas -> profile_atlas
 role_backend_phase1 -> profile_backend_phase1 (dopo atlas)
 platform_fedora & role_personal_workstation -> profile_personal_workstation
 platform_fedora & desktop_gnome -> profile_desktop_gnome
 workstation_dev_fedora -> profile_workstation_dev_common
@@ -348,7 +609,8 @@ Questo significa che, allo stato attuale:
 - `deadalus` riceve il profilo Fedora WSL tramite play dev dedicati
 - il server Rocky (`prometheus`) e gestito con pacchetti, servizi, dotfiles server e firewalld
 - il NAS Rocky (`atlas`) usa un pool ZFS gia esistente, condivisioni NFSv4/SMB limitate alla LAN e Cockpit/45Drives
- lo stack container server include `navidrome`, `postgres`, `gitea` e `nginx-proxy-manager`
+- lo stack Compose server include soltanto `gitea` e `nginx-proxy-manager`; Navidrome e Syncthing
  della fase 1 sono Quadlet rootless su Atlas
 # Dotfiles
@@ -455,6 +717,8 @@ ansible-playbook ansible/site.yml --limit <host> --start-at-task "<task name>" -
 ansible-lint ansible/roles/<role>
 yamllint ansible/path/to/file.yml
 podman-compose -f /opt/docker/server/docker-compose.yml config
 ansible-playbook ansible/site.yml --limit atlas --tags storage,sharing,containers --check --diff
 ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff
 ```
 ## Tag supportati dal playbook
@@ -471,6 +735,9 @@ Allo stato attuale `ansible/site.yml` espone questi tag:
 | --- | --- | --- |
 | `always` | pre-task sempre eseguiti, inclusi caricamento vault e validazioni preliminari | common |
 | `ai_agents` | installazione agenti AI condivisi | Fedora, WSL |
 | `atlas` | account, storage, condivisioni e container Atlas | NAS Atlas |
 | `backend_phase1` | Quadlet rootless Navidrome e Syncthing | NAS Atlas |
 | `containers` | Quadlet rootful Atlas | NAS Atlas |
 | `dotfiles` | distribuzione/configurazione dotfiles | tutti i profili |
 | `dotfiles:common` | dotfiles comuni condivisi | common, workstation, server |
 | `dotfiles:desktop` | dotfiles desktop | desktop Void, Fedora/GNOME |
@@ -484,16 +751,21 @@ Allo stato attuale `ansible/site.yml` espone questi tag:
 | `fzf` | configurazione FZF | dotfiles comuni |
 | `git` | configurazione Git e GPG desktop | Fedora/GNOME, desktop Void |
 | `gnome` | configurazione host GNOME | Fedora/GNOME desktop |
 | `immich` | account e Quadlet Immich | NAS Atlas |
 | `sway` | sessione/configurazione sway / SwayFX (Wayland) | desktop Void |
 | `niri` | sessione/configurazione Niri (Wayland) | desktop Void |
 | `npm` | installazione pacchetti npm globali | Fedora/GNOME, desktop Void, WSL |
 | `nvidia` | componenti NVIDIA desktop | desktop Void |
 | `packages` | installazione e aggiornamento pacchetti | tutti i profili |
 | `podman` | integrazione Podman Compose e Quadlet rootless | server |
 | `portal` | configurazione xdg-desktop-portal | desktop Void |
 | `services` | gestione servizi runit/systemd | tutti i profili |
 | `sharing` | condivisioni NFSv4 e SMB3 | NAS Atlas |
 | `storage` | dataset ZFS figli | NAS Atlas |
 | `theme` | configurazione del tema GTK/Qt | desktop Void |
 | `tmux` | configurazione e plugin tmux | desktop Fedora/Void, WSL |
 | `vim` | configurazione Vim | dotfiles comuni |
 | `wireguard` | overlay WireGuard Prometheus/Atlas | Prometheus, NAS Atlas |
 | `wsl` | bootstrap e configurazione WSL | WSL |
 Esempi pratici:
--- a/README.md
+++ b/README.md
@@ -67,6 +67,27 @@ The official ChatGPT desktop RPM is enabled only on `ikaros` and `nymph`. The
 playbook configures OpenAI's signed RPM repository and imports its pinned RPM
 signing key before installation; subsequent updates are handled by DNF.
 ## Deferred planned node: Cerberus
 `cerberus` is a **postponed** management-plane node, pending the physical setup
 of the office in the new house. It is not yet an inventory host and no role or
 playbook targets it.
 The planned hardware is a Lenovo ThinkCentre M700 Tiny (Intel Core i3-6100T,
 8 GB RAM, and a 256 GB SSD) with native 1 Gbps Ethernet. It will share Ikaros'
 monitor and peripherals through a multi-input KVM switch, using a passive
 DisplayPort-to-HDMI cable for its video connection. Fedora Sericea, the
 immutable Fedora variant with the Sway Wayland compositor, is the intended
 operating system.
 Cerberus will be an isolated management plane: Ansible will run from a
 dedicated Toolbox environment to provision the future `uranus` cluster, rather
 than from Ikaros or an unmanaged host. Its rootless Podman observability stack
 will run Grafana, Prometheus, and Loki. The local SSD is the hot tier and
 retains metrics and logs for 30 days; scheduled exports will place older
 historical data on an NFS-mounted Atlas dataset as the cold tier. The detailed,
 implementation-gated plan is maintained in `AGENTS.md`.
 ## Desktop profiles
 - `ikaros`: stable Fedora Workstation + GNOME desktop.
@@ -108,16 +129,23 @@ That gives it Fedora packages through DNF, Docker from the official repository,
 dotfiles and templates. The profile provisions configuration only: it does not transfer data, start
 the Compose stack, update DNS, or perform a cutover.
-The server profile installs platform-specific packages, Podman and podman-compose,
+The server profile installs platform-specific packages, Podman and podman-compose, declared systemd
-declared systemd services, the server Compose stack behind the `podman-compose-server` systemd unit, and firewalld. The Rocky server excludes
+services, and firewalld. The manually activated `podman-compose-server` unit contains the existing
-Syncthing. Rocky bind mounts use private SELinux relabeling for application data while host system
+Nginx Proxy Manager and Gitea services. The desired Compose file no longer includes Navidrome,
-files remain unchanged.
+Syncthing, or the obsolete Navidrome PostgreSQL database; their temporary Atlas deployment is managed
 by `profile_backend_phase1`. Applying the profile does not stop or remove legacy containers and does
 not delete `/opt/postgres/data`.
 Firewalld enables SSH, Cockpit (`9090/tcp`), HTTP and HTTPS. Nginx Proxy Manager publishes only
 `80/tcp` and `443/tcp`; its administration interface is bound to `127.0.0.1:81` and can be reached
 from Ikaros or Nymph with the `npm-tunnel` Bash alias. Nextcloud remains disabled and the profile
 does not provision any `/srv/nextcloud` directories.
 NPM remains managed only by `profile_server`. Its WireGuard peer is Aegis (`10.0.0.2`), which forwards
 selected requests to LAN addresses and source-NATs them so no static route is required on the router.
 Use an Atlas LAN address for any current NAS-backed upstream; when Uranus receives its VIP, add that VIP
 to Prometheus' Aegis peer `AllowedIPs` and declare the corresponding proxy target separately.
 Server identity comes from `server_username`, `server_user_group`, and `server_user_home` in `ansible/inventory/group_vars/server.yml`. `server_username` defaults to `username`, but it can be overridden, for example:
 ```bash
@@ -128,6 +156,8 @@ ansible-playbook ansible/site.yml --limit prometheus \
 ```
 The target must already provide `server_username` with local sudo access.
 Prometheus authorizes its declared SSH public keys through separate files below
 `~/.ssh/authorized_keys.d/`, while `sshd` is configured to read those files directly.
 ### DuckDNS
@@ -150,7 +180,7 @@ back in; preserve any uncommitted work separately without copying secrets.
 ### Data migration
 Provision Rocky first, then run the migration script **on the retired Ubuntu source host**. It is
-dry-run by default and requires an explicit source-stack stop before it can copy PostgreSQL data:
+dry-run by default and requires an explicit source-stack stop before it can copy application data:
 ```bash
 sudo ./scripts/migrate_prometheus_data.sh \
@@ -163,11 +193,11 @@ sudo ./scripts/migrate_prometheus_data.sh \
  --quiesce-source --execute
 ```
-The script copies Navidrome, music, Nginx Proxy Manager, PostgreSQL and Gitea data. It does not
+The script copies only Nginx Proxy Manager and Gitea data. It does not delete data, move
-delete data, move Syncthing, copy `/home/git/.ssh`, start containers, update DNS, or perform a
+Navidrome/Syncthing, copy `/home/git/.ssh`, start containers, update DNS, or perform a cutover. The
-cutover. The destination SSH host key must already be trusted and the destination account needs
+destination SSH host key must already be trusted and the destination account needs passwordless sudo
-passwordless sudo for `rsync`. It preserves ACLs but not extended attributes, so source SELinux labels
+for `rsync`. It preserves ACLs but not extended attributes, so source SELinux labels are not
-are not transferred; the Rocky Compose bind mounts apply their own `:Z` labels when containers start.
+transferred; the Rocky Compose bind mounts apply their own `:Z` labels when containers start.
 ## DNS Filter
@@ -182,15 +212,26 @@ ansible/bootstrap/generate-aegis-ign.sh --write IMAGE DEVICE
 The controller manages it remotely as `pi@aegis`; unlike local desktop profiles, Aegis is
 intentionally an SSH inventory target. `profile_aegis` manages rootful Podman Quadlets for AdGuard
 Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, LAN-restricted
-firewalld rules, SSH key-only access for `pi`, and `wake-ikaros`. Set the host-local
+firewalld rules, SSH key-only access for `pi`, the `nfs-utils` and `wireguard-tools` rpm-ostree layers,
-`aegis_lan_subnet` and `aegis_adguard_web_port` values before applying it. The playbook permits
+and `wake-ikaros`. `wireguard_overlay` makes Aegis the internal endpoint and LAN gateway for Prometheus:
 it enables persistent IPv4 forwarding, installs a scoped WireGuard-to-LAN firewalld policy, and source-NATs
 forwarded tunnel traffic so the router needs no static route. A new layered package deployment requires a manual reboot; the
 role reports this condition but never reboots Aegis automatically. Set the host-local
 `aegis_lan_subnet`, `aegis_adguard_web_port`, and `aegis_network_connection_uuid` values before
 applying it. The playbook permits
 AdGuard Home HTTP on port `80`; the initial wizard port `3000` is intentionally unmanaged and must be
 opened and closed manually during initial setup. The profile disables the local systemd-resolved DNS
-stub and points `/etc/resolv.conf` to its full resolver data, freeing port 53
+stub and points `/etc/resolv.conf` to its full resolver data, freeing port 53 for AdGuard. LAN clients
-for AdGuard while retaining DNS learned from the router. Define
+may use AdGuard on Aegis, while Aegis itself uses the independent upstream DNS declared by
 `aegis_host_dns_servers`; this prevents Greenboot from depending on the AdGuard container during
 startup. Reboot Aegis after changing its NetworkManager DNS profile. Define
 `vault_aegis_icloudpd_apple_id` in Vault before applying it. iCloudPD still requires interactive MFA
 initialization after its first deployment.
 New Aegis images create the `admin` account in Butane. Before configuring a newly imaged node, run its
 first playbook execution with `-e ansible_user=admin`; the SSH hardening role then permits that same
 account. Keep the inventory on `pi` until the existing node has been replaced.
 Validate the profile before deployment:
 ```bash
@@ -198,30 +239,296 @@ ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
 ansible-playbook ansible/site.yml --limit aegis --check --diff --ask-become-pass
 ```
-## NAS
+Apply only the independent host DNS configuration, then reboot Aegis manually:
 `atlas` is a Rocky Linux 9 NAS reached through SSH. Its pool already exists: the profile only
 manages child datasets and must never create, partition, destroy, roll back, or otherwise alter the
 pool itself. Linux clients use NFSv4 and Windows/WSL clients use SMB; both are restricted to the
 configured LAN.
 For the first run, replace the Atlas placeholders and provide
 `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash`, and
 `vault_atlas_samba_password`. Bootstrap the host through its existing administrator:
 ```bash
-ansible-playbook ansible/site.yml --limit atlas \
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
-  -e atlas_connection_username=<existing-admin>
+ansible-playbook ansible/site.yml --limit aegis --tags dns --ask-become-pass
 ```
-`vault_atlas_admin_password_hash` must be an `/etc/shadow`-compatible hash, not a clear-text
+Layer the Aegis NFS and WireGuard client tools independently, then reboot Aegis manually when the role reports
-Cockpit password. Subsequent runs use `atlas_admin_username`. Enable
+that the new deployment is ready:
 `atlas_manage_storage` only after checking the existing pool and mountpoints; enable
 `atlas_manage_firewall` only after checking the LAN subnet and active firewalld zone.
-Snapshot retention, Syncthing topology, VPN access, Prometheus pulls, encrypted Borg backups to a
+```bash
-Hetzner Storage Box, USB backup, monitoring, and disaster-recovery tests remain follow-up work. The
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
-detailed operational backlog is kept in `AGENTS.md`.
+ansible-playbook ansible/site.yml --limit aegis --tags nfs --ask-become-pass
 ```
 ## NAS
 `atlas` is a Rocky Linux 9 NAS reached through SSH. Normally its pool already exists and the profile
 only manages child datasets. A one-time RAIDZ2 bootstrap is available only with explicit confirmation
 (`atlas_create_pool=true`) and exactly four verified `/dev/disk/by-id/...` paths in `atlas_zpool_disks`.
 It never partitions, forces, destroys, rolls back, or changes the vdev layout of an existing pool. Linux
 clients use NFSv4 and Windows/WSL clients use SMB; both are restricted to the configured LAN.
 For the first run, provide `vault_atlas_admin_password_hash`, `vault_atlas_samba_password`, and
 `vault_atlas_immich_db_password`. Bootstrap the host through its
 existing administrator. The explicit pool gate is safe to repeat: the role creates the RAIDZ2 pool only when
 it is absent. Atlas no longer participates in the WireGuard overlay; its old interface is retired manually only after
 Prometheus and Aegis have completed the replacement handshake.
 `vault_atlas_admin_password_hash` must be an `/etc/shadow`-compatible hash, not a clear-text
 Cockpit password. Subsequent runs use `atlas_admin_username`. Atlas declares storage, sharing, and its
 LAN firewall rules enabled. Before the first apply, check the existing pool and mountpoints, LAN subnet,
 and active firewalld zone. `atlas_manage_media_stack` remains disabled until `/dev/dri`, the container
 paths, and the Immich database secret are validated. Atlas reads its declared SSH public keys from
 separate files below `~/.ssh/authorized_keys.d/`.
 With storage management enabled, Atlas creates the complete dataset hierarchy below the existing or
 explicitly bootstrapped `zpool`: SMB-shared `archive`, private `services/data` with separate
 `services/data/navidrome` and `services/data/syncthing` application datasets, `media`, `media/music`,
 `media/photobook`, and `backup/hosts/prometheus`. Application/archive datasets use `zstd`, while media,
 Syncthing, and host-backup datasets use `lz4`; `backup` has a `500G` reservation covering its descendants.
 Atlas enforces targeted SELinux persistently and reports, without initiating, any reboot required to activate it. It assigns its primary LAN interface explicitly to the managed firewalld zone and applies persistent kernel network hardening: redirects and source routes are rejected, martians logged, reverse-path filtering remains loose for WireGuard, and IPv4 forwarding is disabled. SSH permits only the declared administrator using public-key authentication; root login, passwords,
 agent and remote forwarding are disabled, while local forwarding remains available for private administrative tunnels. SMB3 exposes `Archive` only to the configured Vault-backed
 Samba accounts on encrypted, signed SMB3 over TCP/445 only and admits the configured LAN without host-specific
 exclusions. NFSv4 exports only `media/photobook` to the configured Aegis IP over TCP/2049, using
 `all_squash` with anonymous UID/GID `1100`.
 The `immich` system account is fixed to UID/GID `1100`, has no login shell or `wheel` membership, and
 receives `video` and `render` access. The rootful Immich Server, ML, Redis-compatible cache, PostgreSQL,
 and NPM Quadlets share one Podman network. Immich runs as `1100:1100`; Server and ML receive `/dev/dri`,
 and Photobook is mounted read-only at `/external/photobook`. NPM publishes ports `80` and `443`; its
 administration interface remains restricted to `127.0.0.1:81` for SSH-tunnel access.
 Atlas temporarily hosts rootless Navidrome and Syncthing until Uranus replaces them. They bind only to
 Atlas' LAN address (`192.168.178.55`); WireGuard remains exclusively between Prometheus (`10.0.0.1`)
 and Aegis (`10.0.0.2`). Their state is initialized ex novo in `/zpool/services/data/navidrome` and
 `/zpool/services/data/syncthing`; no source application state is migrated. The music library at
 `/zpool/media/music` is populated separately.
 The separate `wireguard_overlay` role manages `wg0` between Prometheus (`10.0.0.1`) and Aegis
 (`10.0.0.2`), generating private keys once on their respective hosts and exchanging only public keys
 through Ansible. Prometheus alone opens `51820/udp`. Aegis forwards only the declared overlay-to-LAN
 traffic and source-NATs it, so Atlas and future Uranus nodes require neither a VPN interface nor a router
 static route. Atlas permits Navidrome (`4533/tcp`) and the Syncthing GUI (`8384/tcp`) only from Aegis;
 Syncthing native ports are limited to the LAN. Configure NPM manually with
 `http://192.168.178.55:4533` and `http://192.168.178.55:8384` after the services are healthy.
 Prometheus' peer includes the LAN subnet in `AllowedIPs`; add the Uranus VIP there when it exists.
 When the WireGuard zone is created, Ansible reloads firewalld and immediately reloads Prometheus'
 rootful Podman networks so the existing proxy stack retains container DNS and connectivity.
 Validate the gateway with:
 ```bash
 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
 ansible-playbook ansible/site.yml --limit prometheus,aegis --tags wireguard --check --diff
 ```
 The first real WireGuard run must include both peers. If Fedora IoT has just layered `wireguard-tools`,
 reboot Aegis manually and rerun the command without `--check`; the role then waits for a real peer
 handshake.
 Atlas declares recursive, systemd-timed ZFS snapshots for the complete pool hierarchy: 24 hourly
 snapshots at minute 05, 30 daily snapshots at 00:15, 8 weekly snapshots on Sunday at 01:00, and 12
 monthly snapshots on the first day at 02:00. The retention helper prunes only snapshots carrying its
 managed `atlas-auto` prefix and never rolls back a dataset. The OpenZFS monthly scrub timer is scheduled
 for the first Sunday at 03:00; the conflicting weekly scrub timer is disabled explicitly. The first recursive
 hourly snapshot completed successfully on Atlas; retention pruning and the first scheduled scrub still await
 live runtime evidence. Validate this layer independently with:
 ```bash
 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
 ansible-playbook ansible/site.yml --limit atlas --tags snapshots,scrub --check --diff
 ```
 Atlas also declares an encrypted Borg backup to the dedicated Hetzner Storage Box sub-account
 `u660064-sub1`. The repository is the sub-account-relative `./borg-data` path and uses the explicitly
 selected remote Borg 1.4 binary over SSH port 23. The ED25519 server key is pinned; a dedicated client
 key is generated for the locked, non-login `borg` system account, and its private half never leaves
 `/etc/atlas-borg`. The account has no sudo or supplementary groups and owns only its SSH identity,
 passphrase, cache, and Borg state. Borg receives its passphrase through a mode `0600` file rendered from
 `vault_atlas_borg_passphrase`.
 The daily backup starts at 04:30 with up to 30 minutes of randomized delay. It creates a temporary,
 recursive ZFS snapshot and reconstructs every dataset below `/zpool` as a read-only bind-mounted tree,
 so parent and child datasets enter one consistent Borg archive. The wrapper recursively unmounts its
 private source tree; a narrowly scoped `ExecStopPost` helper removes any remaining host-namespace ZFS
 snapshot mounts and the named temporary snapshot after the backup process exits. Only the root wrapper
 performs snapshot and mount operations; it launches the Borg client as `borg` with temporary read-search
 capability and no ZFS, sudo, or pool-management privileges. Borg retains 30 daily, 8 weekly, and 12
 monthly archives, then compacts the standard
 read-write repository. A full metadata and repository check runs as `borg` on the fifteenth day of each
 month at 06:00. Both operations use a common lock, journal logging, and bounded systemd retries.
 New backup runs also log the create phase and a compact progress line at most once per minute: an
 **estimated** percentage, dataset, files processed, and original/compressed/deduplicated bytes. The
 denominator is the summed ZFS `logicalreferenced` size of the backup's own recursive snapshot, not a
 Borg-reported total: the estimate can exceed 100% and does not cover retention, compaction, or checks.
 Progress lines omit individual filenames; warnings may still name affected files.
 Follow the current run with
 `sudo journalctl -fu atlas-borg-backup.service` on Atlas; changes to the helper do not alter a run
 already in progress.
 Initial activation remains explicit:
 1. Add a strong unique `vault_atlas_borg_passphrase` with `ansible-vault edit secrets/vault.yml`.
 2. Generate and display only the dedicated public key with
   `ansible-playbook ansible/site.yml --limit atlas --tags borg_key`.
 3. Install that public key in the Hetzner sub-account, then apply with
   `ansible-playbook ansible/site.yml --limit atlas --tags packages,borg`.
 4. Copy the ignored `secrets/recovery/atlas-borg-repokey.export` file to genuinely offline storage.
   The controller-side copy is not an offline backup by itself.
 The role initializes only the missing `repokey` repository and never accepts an unpinned host key or
 password authentication. It does not start the first backup manually. Validate the rendered state with:
 ```bash
 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
 ansible-playbook ansible/site.yml --limit atlas --tags packages,borg --check --diff
 ```
 Atlas runtime activation is complete: the initial backup and repository check succeeded, a full restore
 to a temporary directory was validated against the live `Archive` tree, the recovery-key export was copied
 to offline storage, and the temporary snapshot and bind mounts were cleaned up.
 On 2026-09-25 a separate ZFS restore smoke test copied a small file from an automatic daily
 `zpool/archive` snapshot to `/var/tmp`, then confirmed matching contents, ownership, mode, mtime and
 POSIX ACL. The temporary copy and on-demand snapshot mount were removed; Borg kept running. This
 does not validate a full dataset recovery.
 The offline USB backup is deployed as a manual-only service (`atlas_manage_usb_backup: true`):
 Ansible never formats, unlocks, mounts, backs up to, or schedules the disk. Atlas' existing USB disk was verified
 read-only on 2026-09-23 as LUKS UUID `577b3c43-ea37-4611-81a9-39d555cdfbd4`, containing ext4 UUID
 `758e2d2e-a427-4797-aad9-39c3a9f17c7e` through mapper `zpool-backup`. It was mounted at
 `/mnt/zpool-backup` at inspection time. The service deliberately requires the verified mapper to be
 **not mounted** before starting. When necessary, `systemd-ask-password` requests the LUKS passphrase
 through the `systemctl start` password agent; it is piped directly to `cryptsetup` without saving it,
 passing it as a command argument, or caching it. The service then mounts the disk privately, takes a recursive ZFS snapshot,
 copies every dataset to a versioned `atlas/snapshots/<timestamp>/` directory using `rsync --link-dest`,
 verifies the result with a checksum-based dry run, atomically updates `atlas/latest`, unmounts and closes
 LUKS. A failed run never replaces `latest` or removes an earlier complete version. Borg and the USB
 backup may run concurrently from separate snapshots; both reading the same pool can reduce throughput.
 The USB copy preserves ACLs but not generic extended attributes; `security.selinux` is also intentionally
 excluded because the target SELinux policy must recreate labels during a restore. Do not restore data into
 service paths without relabeling. After restoring an explicit dataset path, apply its destination policy with:
 ```bash
 ansible-playbook ansible/site.yml --limit atlas --tags restorecon \
  -e '{"atlas_restorecon_paths":["/zpool/archive"]}'
 ```
 The task accepts only paths below the Atlas pool mount root, runs `restorecon -RFv` only for the paths
 provided at invocation, and is otherwise a no-op. It must not be used on the whole pool during routine runs.
 Old USB versions are not pruned automatically, to avoid deleting the only offline
 copy without an explicitly chosen retention policy; capacity checks include an estimated transfer size
 and a 10 GiB free-space reserve. The disk must be physically disconnected after a successful backup
 to make the copy offline.
 To check the USB backup and reminder configuration without starting a backup, run:
 ```bash
 ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
 ansible-playbook ansible/site.yml --limit atlas --tags usb_backup,usb_reminder --check --diff
 ```
 To validate a planned, explicit post-restore relabel operation without changing labels, run:
 ```bash
 ansible-playbook ansible/site.yml --limit atlas --tags restorecon --check \
  -e '{"atlas_restorecon_paths":["/zpool/archive"]}'
 ```
 Before the first **manual** service start, safely unmount the currently mounted
 `/mnt/zpool-backup`; never run it on an arbitrary mounted disk. Future starts
 can begin with the mapper closed: `sudo systemctl start atlas-usb-backup.service` prompts for the
 passphrase interactively and then performs the backup. Neither the LUKS password nor a key file belongs
 in Ansible. Inspect the run with
 `sudo journalctl -fu atlas-usb-backup.service`. There is intentionally no timer. Independently test a
 read-only mount and restore from `atlas/latest` into an empty temporary directory before marking the
 USB recovery path complete. Only `atlas-usb-reminder.timer` is enabled, for the first Saturday of each
 month at 10:00 Europe/Rome. Its warning notification uses the existing 45Drives Houston notifier.
 A manual test confirmed a notification in 45Drives Alerts, **not** an email. The reminder service log
 reports notification submission, not email delivery; the role does not depend on SMTP/OAuth settings.
 The reminder never starts the backup. Check its schedule with
 `systemctl list-timers atlas-usb-reminder.timer` and the result in 45Drives Alerts.
 The timer was verified active with its first scheduled run at 2026-10-03 10:00 CEST. No email
 delivery is claimed.
 The first manual USB attempt on 2026-09-23 did not complete: rsync was denied while removing
 `security.selinux` on the USB filesystem, then the interrupted service left its recursive
 `atlas-usb-20260923T185748Z-2469168` snapshot and the `zpool-backup` LUKS mapper open. The
 rsync xattr filter was deployed afterward. The incomplete USB directory was absent on inspection;
 the exact failed snapshot was removed, the verified and unmounted mapper closed, and the service
 failed state cleared. A final check found no remnant snapshot, mount, mapper, or staging directory.
 The failed attempt was not a valid backup, and no USB restore had been tested at that point.
 On 2026-09-24 a later run reported a checksum-verified, published USB version and closed the LUKS
 mapper, but the service failed while destroying its temporary ZFS snapshot: OpenZFS still had
 on-demand `.zfs/snapshot` mounts open in the host namespace. Those exact temporary snapshots were
 unmounted normally and removed; no force or rollback was used. The backup service now records its
 snapshot name and runs a narrowly scoped `ExecStopPost` cleanup after the private backup process
 exits. The cleanup helper was tested with a disposable recursive snapshot and an active snapshot
 mount. A complete run on 2026-09-24 later checksum-verified and published a new USB version; the
 service ended successfully, the LUKS mapper closed, no temporary USB snapshot remained, and the pool
 was healthy. On 2026-09-25 an independent restore test opened the configured USB disk read-only, mounted
 ext4 with `ro,noload`, restored a 5,707,945-byte file from the published `atlas/latest` version to an
 empty `/var/tmp` directory, and matched its content, owner, mode, size, mtime, and POSIX ACL against
 the USB source. The test removed its temporary copy and mount, closed the LUKS mapper, and left the
 pool healthy while Borg continued running. This is a file-level recovery smoke test, not a full dataset
 or disaster-recovery exercise.
 Atlas health monitoring runs every 30 minutes through `atlas-health-monitor.timer`. Its read-only probes
 check pool/vdev state and errors, scrub/resilver status, four pool disks and the system NVMe via SMART,
 disk and CPU temperatures, system/pool/snapshot space, local `zpool/backup` growth, and the Hetzner
 Storage Box quota via `df -m` over the dedicated `borg` account's pinned-key SSH connection. The remote
 query never opens the Borg repository or its lock. Growth alerts compare against a roughly 24-hour
 baseline and therefore begin only after enough samples exist. The monitor also checks
 maintenance/backup timer activation and freshness; systemd `OnFailure` hooks report snapshot,
 scrub, Borg, USB, reminder, and monitoring services when they enter the failed state. The ongoing
 initial Borg run is never restarted by the monitor; only a run exceeding 14 days raises a warning.
 Thresholds and stable disk paths are declared in Atlas host variables. Alerts use the existing 45Drives
 Houston notifier and repeated issues are deduplicated; **email delivery is not verified**. The
 2026-09-25 live probe found no issues and a labelled test notification was submitted. The Storage Box
 reported 22% used. Detailed Borg archive size and deduplication still require the active run to finish.
 ```bash
 ansible-playbook ansible/site.yml --limit atlas --tags monitoring --check --diff
 sudo /usr/local/libexec/atlas-health-monitor --dry-run
 sudo journalctl -u atlas-health-monitor.service -n 100 --no-pager
 systemctl list-timers atlas-health-monitor.timer
 ```
 `--dry-run` sends no alerts and does not change monitor state. A real check is
 `sudo systemctl start atlas-health-monitor.service`; do not start the backup services merely to test
 monitoring. For a labelled 45Drives Alerts delivery test, use
 `sudo /usr/local/libexec/atlas-health-monitor --test-notification`.
 ### Atlas systemd timers
 All nine managed timers below are enabled. Times are local to Atlas (`Europe/Rome`); Borg and monitoring
 add the indicated randomized delay. Every timer has `Persistent=true`, so a missed calendar run is
 scheduled after the timer becomes active again.
 | Timer | Schedule (`OnCalendar`) | Action |
 | --- | --- | --- |
 | `atlas-zfs-snapshot-hourly.timer` | `*-*-* *:05:00` — every hour at :05 | Recursive hourly snapshot and retention |
 | `atlas-zfs-snapshot-daily.timer` | `*-*-* 00:15:00` — daily at 00:15 | Recursive daily snapshot and retention |
 | `atlas-zfs-snapshot-weekly.timer` | `Sun *-*-* 01:00:00` — Sunday at 01:00 | Recursive weekly snapshot and retention |
 | `atlas-zfs-snapshot-monthly.timer` | `*-*-01 02:00:00` — first day of the month at 02:00 | Recursive monthly snapshot and retention |
 | `zfs-scrub-monthly@zpool.timer` | `Sun *-*-01..07 03:00:00` — first Sunday at 03:00 | ZFS scrub |
 | `atlas-borg-backup.timer` | `*-*-* 04:30:00` — daily at 04:30, plus 0–30 min random delay | Encrypted offsite backup |
 | `atlas-borg-check.timer` | `*-*-15 06:00:00` — 15th of the month at 06:00, plus 0–30 min random delay | Borg repository check |
 | `atlas-usb-reminder.timer` | `Sat *-*-01..07 10:00:00 Europe/Rome` — first Saturday at 10:00 | 45Drives Alerts reminder only |
 | `atlas-health-monitor.timer` | `*:0/30` — every half-hour, plus 0–5 min random delay | Read-only health checks |
 `atlas-usb-backup.service` has **no timer**: the encrypted USB backup must be started manually.
 The vendor's `zfs-scrub-weekly@zpool.timer` is intentionally disabled in favor of the monthly scrub.
 The future Prometheus backup pull has no timer yet because that workflow is not implemented. While a
 Borg backup is still running, `systemctl list-timers` may show `-` for its next trigger; this does not
 mean the timer has been disabled. Inspect the current schedule on Atlas with
 `systemctl list-timers --all`.
 A temporary Nextcloud deployment on Atlas is also planned before Uranus: it requires separately
 declared persistent application, database, and cache storage, Vault-backed credentials, NPM-only
 publishing through Aegis, and defined backup, upgrade, and eventual migration procedures. Do not deploy
 it before the data-protection checklist is complete.
 The desired future iCloud photo-ingestion host is Atlas, not Aegis. After data-protection validation,
 plan an explicit iCloudPD migration with photos under `/zpool/archive/Pictures` and application/MFA
 state outside `Archive`, then test permissions, SELinux, backups and recovery before cutting over.
 The current Aegis iCloudPD service and Atlas Photobook NFS export remain configured until that
 separate migration is approved and validated; the eventual Atlas service is temporary until Uranus.
 Prometheus backup pulls, Borg archive-size evaluation, and full disaster-recovery tests remain follow-up
 work. The prioritized operational backlog is kept in `AGENTS.md`.
 ## How layering works
@@ -308,6 +615,8 @@ ansible-playbook ansible/site.yml --limit deadalus --tags ai_agents --check --di
 | `profile_workstation_dev_wsl` | WSL development setup. |
 | `profile_server` | Server setup. |
 | `profile_atlas` | Rocky Linux 9 NAS setup. |
 | `profile_backend_phase1` | Temporary rootless Atlas Navidrome and Syncthing services. |
 | `wireguard_overlay` | Prometheus/Aegis WireGuard LAN gateway. |
 | `profile_aegis` | Fedora IoT always-on LAN node. |
 | `dotfiles_common` | Shared user dotfiles. |
@@ -320,7 +629,9 @@ platform_void & graphical_desktop -> profile_desktop_common + profile_desktop_sw
 platform_fedora -> packages_fedora + services_systemd
 platform_rocky -> packages_rocky + services_systemd
 role_aegis -> profile_aegis
 wireguard_overlay -> wireguard_overlay (after Aegis profile and platform_rocky)
 atlas -> profile_atlas
 role_backend_phase1 -> profile_backend_phase1 (after atlas)
 rocky_server -> dotfiles_common + profile_server (after platform_rocky)
 platform_fedora & role_personal_workstation -> profile_personal_workstation
 platform_fedora & desktop_gnome -> profile_desktop_gnome
@@ -389,6 +700,7 @@ ansible-playbook ansible/site.yml --limit <host> --start-at-task "<task name>" -
 ansible-lint ansible/roles/<role>
 yamllint ansible/path/to/file.yml
 podman-compose -f /opt/docker/server/docker-compose.yml config
 ansible-playbook ansible/site.yml --limit atlas --tags storage,sharing,containers --check --diff
 ```
 ## Tags
@@ -403,6 +715,9 @@ ansible-playbook ansible/site.yml --list-tags
 | --- | --- |
 | `always` | Common pre-tasks, including optional vault loading. |
 | `ai_agents` | AI coding-agent install, configuration deployment, and managed-binary removal. |
 | `atlas` | Atlas NAS account, storage, sharing, and container configuration. |
 | `backend_phase1` | Rootless Atlas Navidrome and Syncthing Quadlets. |
 | `containers` | Rootful Atlas Quadlets. |
 | `dotfiles` | User configuration across all profiles. |
 | `dotfiles:common` | Shared dotfiles. |
 | `dotfiles:desktop` | Void and Fedora/GNOME desktop dotfiles. |
@@ -411,10 +726,15 @@ ansible-playbook ansible/site.yml --list-tags
 | `dotfiles:workstation` | Personal workstation and WSL dotfiles. |
 | `emacs` | Shared Emacs setup and authoring dependencies. |
 | `gnome` | Fedora/GNOME desktop configuration. |
 | `immich` | Atlas Immich account and Quadlets. |
 | `npm` | Global npm packages. |
 | `packages` | Package installation and updates. |
 | `podman` | Podman Compose and rootless Quadlet integration. |
 | `services` | runit and systemd services. |
 | `sharing` | Atlas NFSv4 and SMB3 configuration. |
 | `storage` | Atlas child ZFS datasets. |
 | `tmux` | tmux configuration and plugins. |
 | `wireguard` | Prometheus/Aegis WireGuard LAN gateway. |
 | `wsl` | WSL bootstrap and configuration. |
 ## Bootstrapping a new machine
--- a/ansible/bootstrap/aegis.bu
+++ b/ansible/bootstrap/aegis.bu
@@ -9,12 +9,14 @@ variant: fiot
 version: 1.0.0
 passwd:
  users:
-    - name: pi
+    - name: admin
      password_hash: "$6$bNDsU0XC5BxNJS5U$ENDGpdOUPJM3wcXBgNESCQkOqqQ9gN72/xEQoJsAI6QdsaY6mD4G5DBVIv7nHwHQOP35IH1oGRl.Uy3R2iUYQ1"
      groups:
        - wheel
      ssh_authorized_keys:
        - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
        - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
        - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
 systemd:
  units:
    - name: sshd.service
--- a/ansible/inventory/group_vars/fedora.yml
+++ b/ansible/inventory/group_vars/fedora.yml
@@ -9,6 +9,7 @@ fedora_packages_base:
  - jq
  - make
  - nodejs
  - openssl
  - ripgrep
 fedora_manage_docker_repo: true
--- a/ansible/inventory/group_vars/platform_rocky.yml
+++ b/ansible/inventory/group_vars/platform_rocky.yml
@@ -5,6 +5,9 @@ platform_package_manager: dnf
 platform_service_manager: systemd
 rocky_openzfs_release_rpm: https://zfsonlinux.org/epel/zfs-release-3-0.el9.noarch.rpm
 rocky_openzfs_gpg_key_url: >-
  https://raw.githubusercontent.com/zfsonlinux/zfsonlinux.github.com/master/zfs-release/RPM-GPG-KEY-openzfs-key2
 rocky_openzfs_gpg_key_fingerprint: 7DC7 299D CF7C 7FD9 CD87 701B A599 FD5E 9DB8 4141
 rocky_syncthing_version: 2.1.3
 rocky_syncthing_archive_checksum: sha256:f929eb8e5b72a85543eeeefb2c38f34a68e0c530e70758a2905b78840c76602c
 rocky_syncthing_archive_url: >-
--- a/ansible/inventory/group_vars/rocky_server.yml
+++ b/ansible/inventory/group_vars/rocky_server.yml
@@ -40,4 +40,3 @@ server_firewalld_services:
 server_firewalld_ports: []
 server_sshd_service_name: sshd
 server_compose_selinux_mount_option: Z
 server_syncthing_enabled: false
--- a/ansible/inventory/group_vars/server.yml
+++ b/ansible/inventory/group_vars/server.yml
@@ -62,14 +62,6 @@ server_directories:
    owner: root
    group: root
    mode: "0755"
  - path: /opt/navidrome/data
    owner: "{{ server_username }}"
    group: "{{ server_user_group }}"
    mode: "0755"
  - path: /opt/music
    owner: "{{ server_username }}"
    group: "{{ server_user_group }}"
    mode: "0755"
  - path: /opt/npm/data
    owner: root
    group: root
@@ -78,32 +70,15 @@ server_directories:
    owner: root
    group: root
    mode: "0755"
  - path: /opt/postgres/data
    owner: root
    group: root
    mode: "0755"
  - path: /opt/gitea/data
    owner: root
    group: root
    mode: "0755"
 server_syncthing_enabled: true
 server_syncthing_directories:
  - path: /opt/syncthing/config
    owner: root
    group: root
    mode: "0755"
  - path: /srv/syncthing
    owner: root
    group: root
    mode: "0755"
  - path: /srv/syncthing/data
    owner: "1000"
    group: "1000"
    mode: "0755"
 server_sshd_settings:
  PermitRootLogin: "no"
 server_sshd_allow_users:
  - "{{ server_username }}"
 server_ssh_authorized_keys: []
 server_ssh_authorized_key_directory: "{{ server_user_home }}/.ssh/authorized_keys.d"
--- a/ansible/inventory/group_vars/workstation_dev_wsl.yml
+++ b/ansible/inventory/group_vars/workstation_dev_wsl.yml
@@ -3,14 +3,19 @@ enabled_services:
  - docker
 workstation_dev_wsl_packages:
  - buildah
  - helm
  # Fedora ships the kubectl client binary in the kubernetes-client package.
  - kubernetes-client
  - mise
  - pinentry-curses
  - python3-pip
  - tmux
-# Java 11 and Maven are managed by Mise on this Fedora WSL profile. Keep their
+# Java 11, Java 25 and Maven are managed by Mise on this Fedora WSL profile.
-# versions pinned; update them deliberately.
+# Keep their versions pinned; update them deliberately.
 workstation_mise_java_version: temurin-11.0.31+11
 workstation_mise_java_25_version: 25.0.2
 workstation_mise_maven_version: 3.9.16
 workstation_is_wsl: true
--- a/ansible/inventory/host_vars/aegis.yml
+++ b/ansible/inventory/host_vars/aegis.yml
@@ -9,5 +9,38 @@ ansible_ssh_use_tty: false
 aegis_lan_subnet: 192.168.178.0/24
 aegis_adguard_web_port: 80
 aegis_network_connection_name: FRITZ!Box 7530 NR
 aegis_network_connection_uuid: a52fda3d-3eb6-351f-bf04-753edcb76944
 aegis_host_dns_servers:
  - 192.168.178.1
 aegis_host_dns_search_domains:
  - fritz.box
 # Aegis is the internal WireGuard endpoint and NAT gateway for the LAN.
 wireguard_overlay_enabled: true
 wireguard_address: 10.0.0.2/24
 wireguard_enable_ipv4_forwarding: true
 wireguard_reload_rootful_podman_networks: true
 wireguard_forwarding_policies:
  - name: aegis-wireguard-to-lan
    ingress_zone: wireguard
    egress_zone: public
    source: 10.0.0.0/24
    destination: "{{ aegis_lan_subnet }}"
    masquerade: true
 wireguard_peers:
  - name: prometheus
    host: prometheus
    endpoint: "{{ hostvars['prometheus']['ansible_host'] }}:{{ hostvars['prometheus']['wireguard_listen_port'] }}"
    allowed_ips:
      - 10.0.0.0/24
    persistent_keepalive: 25
 aegis_ssh_authorized_keys:
  - name: ikaros
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
  - name: nymph
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
  - name: siren
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
 aegis_icloudpd_apple_id: "{{ vault_aegis_icloudpd_apple_id | default('') }}"
--- a/ansible/inventory/host_vars/atlas.yml
+++ b/ansible/inventory/host_vars/atlas.yml
@@ -1,10 +1,10 @@
 ---
-# Replace every CHANGEME value before enabling Atlas storage management.
+# Atlas declares its intended steady state; set a feature flag false only for a deliberate suspension.
 hostname: atlas
-ansible_host: CHANGEME_ATLAS_HOST
+ansible_host: 192.168.178.55
 ansible_user: "{{ atlas_connection_username }}"
 ansible_port: 22
-ansible_ssh_private_key_file: CHANGEME_ATLAS_SSH_PRIVATE_KEY_PATH
+ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
 atlas_admin_username: admin
 atlas_connection_username: "{{ atlas_admin_username }}"
@@ -12,49 +12,191 @@ atlas_admin_group: "{{ atlas_admin_username }}"
 atlas_admin_home: "/home/{{ atlas_admin_username }}"
 atlas_admin_uid: 1000
 atlas_admin_gid: 1000
-atlas_admin_ssh_keys: "{{ vault_atlas_authorized_ssh_keys | default([]) }}"
+atlas_admin_ssh_keys:
  - name: ikaros
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
  - name: nymph
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
  - name: siren
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
 atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}"
 atlas_ssh_allow_tcp_forwarding: local
-atlas_lan_subnet: CHANGEME_LAN_SUBNET
+atlas_lan_subnet: 192.168.178.0/24
-atlas_manage_firewall: false
+atlas_aegis_ip: 192.168.178.54
 atlas_manage_firewall: true
 atlas_firewalld_zone: public
-atlas_zfs_pool: CHANGEME_ZFS_POOL
+atlas_zfs_pool: zpool
-atlas_zfs_dataset_work: work
+# Populate only for the first pool bootstrap with four real persistent disk paths.
-atlas_zfs_dataset_syncthing: syncthing
+# Confirmed empty 4 TB IronWolf data disks; the NVMe system disk is intentionally excluded.
-atlas_zfs_dataset_backup_prometheus: backup_prometheus
+atlas_zpool_disks:
-atlas_zfs_dataset_icloud_photos: icloud_photos
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1XM
-atlas_mount_root: /CHANGEME_ATLAS_MOUNT_ROOT
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A73T2
-atlas_manage_storage: false
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A6VJK
  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1LM
 atlas_create_pool: false
 atlas_zfs_dataset_archive: archive
 atlas_zfs_dataset_services: services
 atlas_zfs_dataset_app_data: services/data
 atlas_zfs_dataset_navidrome: services/data/navidrome
 atlas_zfs_dataset_syncthing: services/data/syncthing
 atlas_zfs_dataset_media: media
 atlas_zfs_dataset_music: media/music
 atlas_zfs_dataset_backup: backup
 atlas_zfs_dataset_host_backups: backup/hosts
 atlas_zfs_dataset_backup_prometheus: backup/hosts/prometheus
 atlas_zfs_backup_reservation: 500G
 atlas_zfs_dataset_photobook: media/photobook
 atlas_mount_root: /zpool
 atlas_manage_storage: true
 atlas_manage_zfs_snapshots: true
 atlas_zfs_snapshot_prefix: atlas-auto
 atlas_zfs_snapshot_policies:
  - name: hourly
    calendar: "*-*-* *:05:00"
    keep: 24
  - name: daily
    calendar: "*-*-* 00:15:00"
    keep: 30
  - name: weekly
    calendar: "Sun *-*-* 01:00:00"
    keep: 8
  - name: monthly
    calendar: "*-*-01 02:00:00"
    keep: 12
 atlas_manage_zfs_scrub: true
 atlas_zfs_scrub_calendar: "Sun *-*-01..07 03:00:00"
 atlas_manage_borg_backup: true
 atlas_borg_repository_host: u660064-sub1.your-storagebox.de
 atlas_borg_repository_user: u660064-sub1
 atlas_borg_repository_port: 23
 atlas_borg_repository_path: ./borg-data
 atlas_borg_remote_path: borg-1.4
 # Verified against Hetzner's published ED25519 fingerprint on 2026-09-17:
 # SHA256:XqONwb1S0zuj5A1CDxpOSuD2hnAArV1A3wKY7Z3sdgM
 atlas_borg_host_key: >-
  [u660064-sub1.your-storagebox.de]:23 ssh-ed25519
  AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs
 atlas_borg_backup_calendar: "*-*-* 04:30:00"
 atlas_borg_check_calendar: "*-*-15 06:00:00"
 atlas_borg_randomized_delay: 30m
 atlas_borg_keep_daily: 30
 atlas_borg_keep_weekly: 8
 atlas_borg_keep_monthly: 12
 atlas_manage_usb_backup: true
 # Read-only lsblk verification on Atlas, 2026-09-23. Never store the LUKS password here.
 atlas_usb_backup_luks_uuid: 577b3c43-ea37-4611-81a9-39d555cdfbd4
 atlas_usb_backup_fs_uuid: 758e2d2e-a427-4797-aad9-39c3a9f17c7e
 atlas_usb_backup_mapper_name: zpool-backup
 atlas_manage_usb_reminder: true
 atlas_usb_reminder_calendar: "Sat *-*-01..07 10:00:00 Europe/Rome"
 atlas_manage_monitoring: true
 # Physical pool disks and the system NVMe; the disconnected USB disk is intentionally excluded.
 atlas_monitor_smart_devices:
  - { name: pool-1, path: "{{ atlas_zpool_disks[0] }}", warning_c: 50, critical_c: 55 }
  - { name: pool-2, path: "{{ atlas_zpool_disks[1] }}", warning_c: 50, critical_c: 55 }
  - { name: pool-3, path: "{{ atlas_zpool_disks[2] }}", warning_c: 50, critical_c: 55 }
  - { name: pool-4, path: "{{ atlas_zpool_disks[3] }}", warning_c: 50, critical_c: 55 }
  - name: system-nvme
    path: /dev/disk/by-id/nvme-Patriot_M.2_P320_256GB_P320ADB26011606111
    warning_c: 70
    critical_c: 85
 atlas_monitor_timers:
  - { name: atlas-zfs-snapshot-hourly.timer, max_age_hours: 3 }
  - { name: atlas-zfs-snapshot-daily.timer, max_age_hours: 36 }
  - { name: atlas-zfs-snapshot-weekly.timer, max_age_hours: 216 }
  - { name: atlas-zfs-snapshot-monthly.timer, max_age_hours: 960 }
  - { name: zfs-scrub-monthly@zpool.timer, max_age_hours: 960 }
  - { name: atlas-borg-backup.timer, max_age_hours: 48 }
  - { name: atlas-borg-check.timer, max_age_hours: 960 }
  # The first manual USB reminder is not due until October; activation is checked, not age.
  - { name: atlas-usb-reminder.timer, max_age_hours: 0 }
 atlas_monitor_failure_units:
  - atlas-zfs-snapshot@.service
  - zfs-scrub@zpool.service
  - atlas-borg-backup.service
  - atlas-borg-check.service
  - atlas-usb-backup.service
  - atlas-usb-reminder.service
  - atlas-health-monitor.service
 atlas_monitor_remote_capacity:
  user: "{{ atlas_borg_repository_user }}"
  host: "{{ atlas_borg_repository_host }}"
  run_as: "{{ atlas_borg_username }}"
  ssh_wrapper: "{{ atlas_borg_ssh_wrapper_path }}"
  warning_percent: 80
  critical_percent: 90
  growth_warning_gib_day: 500
 atlas_manage_sharing: true
 atlas_manage_media_stack: false
 # Planned after data-protection validation: move iCloudPD photo ingestion from
 # Aegis to Atlas, with photos under /zpool/archive/Pictures and persistent
 # application/MFA state outside Archive. Do not deploy or cut over yet.
 # WireGuard is retired on Atlas. These rootless services are a temporary home
 # until Uranus replaces them.
 backend_phase1_enabled: true
 backend_phase1_start_services: true
 backend_phase1_bind_address: "{{ ansible_host }}"
 backend_phase1_firewalld_zone: "{{ atlas_firewalld_zone }}"
 backend_phase1_npm_source_ip: "{{ atlas_aegis_ip }}"
 backend_phase1_syncthing_native_subnet: "{{ atlas_lan_subnet }}"
 rocky_manage_openzfs_repo: true
-rocky_manage_syncthing_binary: true
+rocky_manage_syncthing_binary: false
 rocky_manage_podman: true
 rocky_podman_packages:
  - podman
 host_packages:
  - cockpit
  - cockpit-podman
  - cockpit-storaged
  - realmd
  - pcp
  - python3-pcp
  - cryptsetup
  - nfs-utils
  - policycoreutils
  - policycoreutils-python-utils
  - python3-libselinux
  - setroubleshoot-server
  - samba
  - samba-client
  - samba-common-tools
  - borgbackup
  - zfs
 atlas_nfs_exports:
-  - path: "{{ atlas_work_mountpoint }}"
+  - path: "{{ atlas_photobook_mountpoint }}"
-    clients: "{{ atlas_lan_subnet }}(rw,sync,no_subtree_check,root_squash)"
+    client: "{{ atlas_aegis_ip }}"
    options:
      - rw
      - sync
      - no_subtree_check
      - all_squash
      - "anonuid={{ atlas_immich_uid }}"
      - "anongid={{ atlas_immich_gid }}"
-atlas_samba_share_name: work
+atlas_samba_share_name: Archive
 atlas_samba_workgroup: WORKGROUP
-atlas_samba_valid_users:
+atlas_samba_encryption: required
-  - "{{ atlas_admin_username }}"
+# Append any pre-existing laptop Unix account here and keep its Samba password in Vault.
-atlas_samba_password: "{{ vault_atlas_samba_password | default('') }}"
+atlas_samba_accounts:
  - username: "{{ atlas_admin_username }}"
    password: "{{ vault_atlas_samba_password | default('') }}"
 atlas_samba_valid_users: "{{ atlas_samba_accounts | map(attribute='username') | list }}"
 atlas_immich_db_password: "{{ vault_atlas_immich_db_password | default('') }}"
 atlas_firewalld_rich_rules:
-  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="ssh" accept'
+  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="22" protocol="tcp" accept'
-  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="cockpit" accept'
+  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="9090" protocol="tcp" accept'
-  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="2049" protocol="tcp" accept'
+  - 'rule family="ipv4" source address="{{ atlas_aegis_ip }}" port port="2049" protocol="tcp" accept'
-  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="samba" accept'
+  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="445" protocol="tcp" accept'
 host_enabled_services:
  - sshd
  - cockpit.socket
-  - nfs-server
+  - pmlogger.service
  - smb
  - zfs.target
--- a/ansible/inventory/host_vars/prometheus.yml
+++ b/ansible/inventory/host_vars/prometheus.yml
@@ -7,11 +7,37 @@ ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
 server_username: rocky
 server_duckdns_domain: fscotto
 server_ssh_authorized_keys:
  - name: ikaros
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
  - name: nymph
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
  - name: siren
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
 wireguard_overlay_enabled: true
 wireguard_address: 10.0.0.1/24
 wireguard_listen_port: 51820
 wireguard_enable_ipv4_forwarding: true
 wireguard_reload_rootful_podman_networks: true
 wireguard_peers:
  - name: aegis
    host: aegis
    # TODO: Aggiungere VIP di Uranus in futuro
    allowed_ips:
      - 10.0.0.2/32
      - 192.168.178.0/24
 host_packages:
  - cockpit
  - cockpit-navigator
  - cockpit-podman
  - cockpit-storaged
  - realmd
  - pcp
  - python3-pcp
  - setroubleshoot-server
 host_enabled_services:
  - cockpit.socket
  - pmlogger.service
--- a/ansible/inventory/hosts.yml
+++ b/ansible/inventory/hosts.yml
@@ -95,3 +95,12 @@ all:
    rocky_server:
      hosts:
        prometheus:
    wireguard_overlay:
      hosts:
        prometheus:
        aegis:
    role_backend_phase1:
      hosts:
        atlas:
--- a/ansible/roles/packages_rocky/tasks/main.yml
+++ b/ansible/roles/packages_rocky/tasks/main.yml
@@ -27,6 +27,14 @@
    name: epel-release
    state: present
 - name: Import official OpenZFS EL9+ signing key
  tags: [packages, storage]
  ansible.builtin.rpm_key:
    state: present
    key: "{{ rocky_openzfs_gpg_key_url }}"
    fingerprint: "{{ rocky_openzfs_gpg_key_fingerprint }}"
  when: rocky_manage_openzfs_repo | bool
 - name: Install official OpenZFS repository package
  tags: [packages, storage]
  ansible.builtin.dnf:
--- a/ansible/roles/profile_aegis/defaults/main.yml
+++ b/ansible/roles/profile_aegis/defaults/main.yml
@@ -1,5 +1,12 @@
 ---
 aegis_hostname: aegis
 aegis_layered_packages:
  - nfs-utils
  - wireguard-tools
 aegis_network_connection_name: ""
 aegis_network_connection_uuid: ""
 aegis_host_dns_servers: []
 aegis_host_dns_search_domains: []
 aegis_adguard_image: docker.io/adguard/adguardhome:latest
 aegis_icloudpd_image: docker.io/boredazfcuk/icloudpd:latest
 aegis_icloudpd_folder_structure: '{:%Y/%m/%d}'
@@ -12,5 +19,6 @@ aegis_lan_subnet: CHANGEME_LAN_SUBNET
 aegis_firewalld_zone: public
 aegis_adguard_web_port: 80
 aegis_ssh_allowed_users:
-  - pi
+  - "{{ ansible_user }}"
 aegis_ssh_user_home: "/var/home/{{ ansible_user }}"
 aegis_ssh_authorized_keys: []
--- a/ansible/roles/profile_aegis/tasks/main.yml
+++ b/ansible/roles/profile_aegis/tasks/main.yml
@@ -1,4 +1,18 @@
 ---
 - name: Manage Aegis layered packages
  tags: [aegis, packages, nfs, wireguard]
  community.general.rpm_ostree_pkg:
    name: "{{ aegis_layered_packages }}"
    state: present
  register: aegis_layered_packages_result
  when: aegis_layered_packages | length > 0
 - name: Report reboot required for Aegis layered packages
  tags: [aegis, packages, nfs, wireguard]
  ansible.builtin.debug:
    msg: Reboot Aegis to activate the newly layered packages, then rerun the playbook.
  when: aegis_layered_packages_result.needs_reboot | default(false)
 - name: Require Aegis iCloudPD Apple ID
  tags: [aegis, icloudpd]
  ansible.builtin.assert:
@@ -8,15 +22,86 @@
  no_log: true
 - name: Require completed Aegis network placeholders
-  tags: [aegis, firewall, services]
+  tags: [aegis, dns, firewall, network, services]
  ansible.builtin.assert:
    that:
      - aegis_lan_subnet != 'CHANGEME_LAN_SUBNET'
      - aegis_firewalld_zone | length > 0
      - aegis_adguard_web_port | int > 0
      - aegis_adguard_web_port | int < 65536
      - aegis_network_connection_name | length > 0
      - aegis_network_connection_uuid | length > 0
      - aegis_host_dns_servers | length > 0
      - ansible_facts["default_ipv4"]["address"] not in aegis_host_dns_servers
      - aegis_ssh_allowed_users | length > 0
-    fail_msg: Define the Aegis LAN subnet, firewalld zone, AdGuard web port, and SSH users.
+    fail_msg: >-
      Define the Aegis LAN subnet, firewalld zone, AdGuard web port, independent host DNS,
      NetworkManager connection, and SSH users. Aegis must not use its own address as upstream DNS.
 - name: Verify the declared Aegis NetworkManager connection exists
  tags: [aegis, dns, network, services]
  ansible.builtin.command:
    argv:
      - nmcli
      - --get-values
      - connection.id
      - connection
      - show
      - uuid
      - "{{ aegis_network_connection_uuid }}"
  register: aegis_network_connection
  changed_when: false
  failed_when: >-
    aegis_network_connection.rc != 0
    or aegis_network_connection.stdout != aegis_network_connection_name
 - name: Read the current Aegis host DNS configuration
  tags: [aegis, dns, network, services]
  ansible.builtin.command:
    argv:
      - nmcli
      - --get-values
      - ipv4.ignore-auto-dns,ipv4.dns,ipv4.dns-search,ipv6.ignore-auto-dns
      - connection
      - show
      - uuid
      - "{{ aegis_network_connection_uuid }}"
  register: aegis_host_dns_current
  changed_when: false
 - name: Configure independent upstream DNS for the Aegis host
  tags: [aegis, dns, network, services]
  ansible.builtin.command:
    argv:
      - nmcli
      - connection
      - modify
      - uuid
      - "{{ aegis_network_connection_uuid }}"
      - ipv4.ignore-auto-dns
      - "yes"
      - ipv4.dns
      - "{{ aegis_host_dns_servers | join(',') }}"
      - ipv4.dns-search
      - "{{ aegis_host_dns_search_domains | join(',') }}"
      - ipv6.ignore-auto-dns
      - "yes"
  register: aegis_host_dns_profile
  when: >-
    aegis_host_dns_current.stdout_lines !=
    [
      'yes',
      aegis_host_dns_servers | join(','),
      aegis_host_dns_search_domains | join(','),
      'yes'
    ]
  changed_when: true
 - name: Report Aegis reboot required for host DNS changes
  tags: [aegis, dns, network, services]
  ansible.builtin.debug:
    msg: Reboot Aegis to activate its independent upstream DNS before testing another OS update.
  when: aegis_host_dns_profile.changed | default(false)
 - name: Set Aegis hostname
  tags: [aegis, services]
@@ -165,6 +250,29 @@
    path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys"
  register: aegis_authorized_keys
 - name: Ensure Aegis SSH authorized key fragments directory exists
  tags: [aegis, ssh, services]
  ansible.builtin.file:
    path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d"
    state: directory
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    mode: "0700"
  when: aegis_ssh_authorized_keys | length > 0
 - name: Manage Aegis SSH authorized key fragments
  tags: [aegis, ssh, services]
  ansible.builtin.copy:
    content: "{{ item.key }}\n"
    dest: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d/{{ item.name }}"
    owner: "{{ ansible_user }}"
    group: "{{ ansible_user }}"
    mode: "0600"
  loop: "{{ aegis_ssh_authorized_keys }}"
  loop_control:
    label: "{{ item.name }}"
  when: aegis_ssh_authorized_keys | length > 0
 - name: Find Aegis SSH authorized key fragments
  tags: [aegis, ssh, services]
  ansible.builtin.find:
@@ -178,7 +286,8 @@
  ansible.builtin.assert:
    that:
      - >-
-        (aegis_authorized_keys.stat.exists and aegis_authorized_keys.stat.size | int > 0)
+        (aegis_ssh_authorized_keys | length > 0)
        or (aegis_authorized_keys.stat.exists and aegis_authorized_keys.stat.size | int > 0)
        or aegis_authorized_key_fragments.matched | int > 0
    fail_msg: Add a public key for the Ansible SSH user before disabling password authentication.
--- a/ansible/roles/profile_atlas/defaults/main.yml
+++ b/ansible/roles/profile_atlas/defaults/main.yml
@@ -1,29 +1,147 @@
 ---
 atlas_manage_storage: false
 atlas_manage_sharing: false
 # Destructive first-boot action; normally false once the pool exists.
 atlas_create_pool: false
 atlas_zpool_disks: []
 atlas_admin_username: CHANGEME_ATLAS_ADMIN
 atlas_admin_group: "{{ atlas_admin_username }}"
 atlas_admin_home: "/home/{{ atlas_admin_username }}"
 atlas_admin_uid: 1000
 atlas_admin_gid: 1000
 atlas_admin_ssh_keys: []
 atlas_admin_ssh_key_directory: "{{ atlas_admin_home }}/.ssh/authorized_keys.d"
 atlas_admin_password_hash: "!"
 # Local forwarding permits an administrator to tunnel a private service without allowing remote forwards.
 atlas_ssh_allow_tcp_forwarding: local
 atlas_immich_username: immich
 atlas_immich_group: immich
 atlas_immich_uid: 1100
 atlas_immich_gid: 1100
 atlas_immich_supplementary_groups:
  - video
  - render
 atlas_lan_subnet: CHANGEME_LAN_SUBNET
 atlas_aegis_ip: CHANGEME_AEGIS_IP
 atlas_manage_firewall: false
 atlas_firewalld_zone: public
 atlas_hardening_sysctls:
  net.ipv4.conf.all.accept_redirects: "0"
  net.ipv4.conf.default.accept_redirects: "0"
  net.ipv4.conf.all.send_redirects: "0"
  net.ipv4.conf.default.send_redirects: "0"
  net.ipv4.conf.all.accept_source_route: "0"
  net.ipv4.conf.default.accept_source_route: "0"
  net.ipv4.conf.all.log_martians: "1"
  net.ipv4.conf.default.log_martians: "1"
  net.ipv4.conf.all.rp_filter: "2"
  net.ipv4.conf.default.rp_filter: "2"
  net.ipv4.tcp_syncookies: "1"
  net.ipv4.icmp_echo_ignore_broadcasts: "1"
  net.ipv4.icmp_ignore_bogus_error_responses: "1"
  net.ipv4.ip_forward: "0"
  net.ipv6.conf.all.accept_redirects: "0"
  net.ipv6.conf.default.accept_redirects: "0"
  net.ipv6.conf.all.accept_source_route: "0"
  net.ipv6.conf.default.accept_source_route: "0"
 atlas_zfs_pool: CHANGEME_ZFS_POOL
-atlas_zfs_dataset_work: work
+atlas_zfs_dataset_archive: archive
-atlas_zfs_dataset_syncthing: syncthing
+atlas_zfs_dataset_services: services
-atlas_zfs_dataset_backup_prometheus: backup_prometheus
+atlas_zfs_dataset_app_data: services/data
-atlas_zfs_dataset_icloud_photos: icloud_photos
+atlas_zfs_dataset_navidrome: services/data/navidrome
 atlas_zfs_dataset_syncthing: services/data/syncthing
 atlas_zfs_dataset_media: media
 atlas_zfs_dataset_music: media/music
 atlas_zfs_dataset_backup: backup
 atlas_zfs_dataset_host_backups: backup/hosts
 atlas_zfs_dataset_backup_prometheus: backup/hosts/prometheus
 atlas_zfs_backup_reservation: 500G
 atlas_zfs_dataset_photobook: media/photobook
 atlas_mount_root: /CHANGEME_ATLAS_MOUNT_ROOT
-atlas_work_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_work }}"
+atlas_manage_zfs_snapshots: false
 atlas_zfs_snapshot_prefix: atlas-auto
 atlas_zfs_snapshot_policies: []
 atlas_manage_zfs_scrub: false
 atlas_zfs_scrub_calendar: ""
 atlas_manage_borg_backup: false
 atlas_borg_username: borg
 atlas_borg_group: borg
 atlas_borg_home: /var/lib/atlas-borg
 atlas_borg_repository_host: CHANGEME_BORG_HOST
 atlas_borg_repository_user: CHANGEME_BORG_USER
 atlas_borg_repository_port: 23
 atlas_borg_repository_path: ./borg-data
 atlas_borg_remote_path: borg-1.4
 atlas_borg_host_key: ""
 atlas_borg_ssh_private_key_path: /etc/atlas-borg/id_ed25519
 atlas_borg_known_hosts_path: /etc/atlas-borg/known_hosts
 atlas_borg_passphrase_path: /etc/atlas-borg/passphrase
 atlas_borg_ssh_wrapper_path: /usr/local/libexec/atlas-borg-ssh
 atlas_borg_passphrase: "{{ vault_atlas_borg_passphrase | default('') }}"
 atlas_borg_encryption_mode: repokey
 atlas_borg_archive_prefix: atlas
 atlas_borg_snapshot_prefix: atlas-borg
 atlas_borg_compression: auto,zstd,3
 atlas_borg_backup_calendar: ""
 atlas_borg_check_calendar: ""
 atlas_borg_randomized_delay: 30m
 atlas_borg_keep_daily: 30
 atlas_borg_keep_weekly: 8
 atlas_borg_keep_monthly: 12
 atlas_borg_config_dir: /var/lib/atlas-borg
 atlas_borg_cache_dir: /var/cache/atlas-borg
 atlas_borg_lock_path: /var/lib/atlas-borg/backup.lock
 atlas_borg_recovery_export_path: "{{ playbook_dir }}/../secrets/recovery/atlas-borg-repokey.export"
 # Manual-only offline backup. No USB device is formatted or mounted by Ansible.
 atlas_manage_usb_backup: false
 atlas_usb_backup_luks_uuid: ""
 atlas_usb_backup_fs_uuid: ""
 atlas_usb_backup_mapper_name: atlas-usb-backup
 atlas_usb_backup_min_free_bytes: 10737418240
 atlas_usb_backup_snapshot_prefix: atlas-usb
 atlas_manage_usb_reminder: false
 atlas_usb_reminder_calendar: ""
 atlas_usb_reminder_notifier: /opt/45drives/houston/houston-notify
 # Read-only health probes and 45Drives Alerts; disabled outside Atlas host vars.
 atlas_manage_monitoring: false
 atlas_monitor_calendar: "*:0/30"
 atlas_monitor_notifier: "{{ atlas_usb_reminder_notifier }}"
 atlas_monitor_smart_devices: []
 atlas_monitor_timers: []
 atlas_monitor_failure_units: []
 atlas_monitor_remote_capacity: {}
 atlas_monitor_pool_warning_percent: 80
 atlas_monitor_pool_critical_percent: 90
 atlas_monitor_root_warning_percent: 80
 atlas_monitor_root_critical_percent: 90
 atlas_monitor_snapshot_warning_percent: 10
 atlas_monitor_snapshot_critical_percent: 20
 atlas_monitor_snapshot_growth_warning_gib_day: 100
 atlas_monitor_backup_growth_warning_gib_day: 100
 atlas_monitor_cpu_warning_c: 85
 atlas_monitor_cpu_critical_c: 95
 atlas_monitor_borg_max_runtime_days: 14
 # Explicit post-restore relabeling only; never relabel datasets during ordinary runs.
 atlas_restorecon_paths: []
 atlas_archive_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_archive }}"
 atlas_services_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_services }}"
 atlas_app_data_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_app_data }}"
 atlas_navidrome_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_navidrome }}"
 atlas_syncthing_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_syncthing }}"
 atlas_media_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_media }}"
 atlas_music_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_music }}"
 atlas_backup_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_backup }}"
 atlas_host_backups_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_host_backups }}"
 atlas_backup_prometheus_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_backup_prometheus }}"
-atlas_icloud_photos_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_icloud_photos }}"
+atlas_photobook_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_photobook }}"
 atlas_syncthing_config_dir: "{{ atlas_admin_home }}/.local/state/syncthing"
 atlas_syncthing_default_dir: "{{ atlas_syncthing_mountpoint }}/Sync"
 atlas_45drives_repo_url: https://repo.45drives.com/repofiles/rocky/45drives-enterprise.repo
 atlas_45drives_repo_file: /etc/yum.repos.d/45drives-enterprise.repo
@@ -34,18 +152,61 @@ atlas_45drives_packages:
  - cockpit-zfs
  - cockpit-scheduler
-atlas_nfs_exports: []
+atlas_nfs_exports:
-atlas_samba_share_name: work
+  - path: "{{ atlas_photobook_mountpoint }}"
    client: "{{ atlas_aegis_ip }}"
    options:
      - rw
      - sync
      - no_subtree_check
      - all_squash
      - "anonuid={{ atlas_immich_uid }}"
      - "anongid={{ atlas_immich_gid }}"
 atlas_samba_share_name: Archive
 atlas_samba_workgroup: WORKGROUP
 # Keep encryption mandatory unless a verified client-compatibility exception is explicitly required.
 atlas_samba_encryption: required
 atlas_samba_valid_users: []
-atlas_samba_password: ""
+atlas_samba_accounts: []
-atlas_samba_password_marker: /var/lib/samba/private/.atlas-password.sha256
+atlas_samba_password_marker_dir: /var/lib/samba/private/ansible-passwords
 atlas_firewalld_rich_rules: []
 atlas_firewalld_restricted_services:
  - ssh
  - cockpit
  - nfs
  - samba
  - http
  - https
 atlas_selinux_booleans:
  - samba_export_all_rw
  - nfs_export_all_rw
 atlas_manage_media_stack: false
 atlas_container_quadlet_dir: /etc/containers/systemd
 atlas_container_data_root: /var/lib/atlas-containers
 atlas_npm_data_dir: "{{ atlas_container_data_root }}/npm/data"
 atlas_npm_letsencrypt_dir: "{{ atlas_container_data_root }}/npm/letsencrypt"
 atlas_npm_admin_bind_address: 127.0.0.1
 atlas_timezone: Europe/Rome
 atlas_immich_upload_dir: "{{ atlas_container_data_root }}/immich/upload"
 atlas_immich_model_cache_dir: "{{ atlas_container_data_root }}/immich/model-cache"
 atlas_immich_machine_learning_config_dir: "{{ atlas_container_data_root }}/immich/machine-learning-config"
 atlas_immich_machine_learning_cache_dir: "{{ atlas_container_data_root }}/immich/machine-learning-cache"
 atlas_immich_redis_data_dir: "{{ atlas_container_data_root }}/immich/redis"
 atlas_immich_postgres_data_dir: "{{ atlas_container_data_root }}/immich/postgres"
 atlas_npm_image: docker.io/jc21/nginx-proxy-manager:latest
 atlas_immich_version: release
 atlas_immich_server_image: "ghcr.io/immich-app/immich-server:{{ atlas_immich_version }}"
 atlas_immich_machine_learning_image: "ghcr.io/immich-app/immich-machine-learning:{{ atlas_immich_version }}-openvino"
 atlas_immich_redis_image: docker.io/valkey/valkey:9
 atlas_immich_postgres_image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
 atlas_immich_db_username: postgres
 atlas_immich_db_name: immich
 atlas_immich_db_password: "{{ vault_atlas_immich_db_password | default('') }}"
 atlas_media_quadlet_services:
  - atlas-immich-redis.service
  - atlas-immich-postgres.service
  - atlas-immich-machine-learning.service
  - atlas-immich-server.service
  - atlas-npm.service
--- a/ansible/roles/profile_atlas/files/atlas-borg-progress.py
+++ b/ansible/roles/profile_atlas/files/atlas-borg-progress.py
@@ -0,0 +1,59 @@
 #!/usr/bin/env python3
 """Turn Borg's JSON progress stream into bounded, readable journal entries."""
 import argparse
 import json
 import sys
 import time
 def size(value):
    if not isinstance(value, (int, float)):
        return "unknown"
    return f"{value / (1024 ** 3):.2f} GiB"
 parser = argparse.ArgumentParser()
 parser.add_argument("--estimated-total-bytes", type=int, required=True)
 args = parser.parse_args()
 if args.estimated_total_bytes <= 0:
    parser.error("estimated total must be positive")
 last_progress = 0.0
 for line in sys.stdin:
    try:
        event = json.loads(line)
    except json.JSONDecodeError:
        print(line.rstrip(), flush=True)
        continue
    kind = event.get("type")
    if kind == "archive_progress":
        now = time.monotonic()
        if now - last_progress < 60 and not event.get("finished"):
            continue
        path = event.get("path") or ""
        parts = path.split("/")
        dataset = parts[1] if len(parts) > 1 and parts[0] == "source" else "unknown"
        original_size = event.get("original_size")
        if isinstance(original_size, (int, float)) and original_size >= 0:
            percent = original_size / args.estimated_total_bytes * 100
            estimated_progress = (
                f"{percent:.1f}%" if percent < 100 else ">=100% (ZFS estimate exceeded)"
            )
        else:
            estimated_progress = "unknown"
        print(
            "Borg create progress: "
            f"estimated={estimated_progress} dataset={dataset} "
            f"files={event.get('nfiles', 'unknown')} "
            f"original={size(original_size)} "
            f"compressed={size(event.get('compressed_size'))} "
            f"deduplicated={size(event.get('deduplicated_size'))}",
            flush=True,
        )
        last_progress = now
    elif kind == "log_message":
        print(f"Borg {event.get('levelname', 'INFO')}: {event.get('message', '')}", flush=True)
    elif kind == "progress_message" and event.get("message"):
        print(f"Borg: {event['message']}", flush=True)
--- a/ansible/roles/profile_atlas/files/atlas-health-monitor.py
+++ b/ansible/roles/profile_atlas/files/atlas-health-monitor.py
@@ -0,0 +1,396 @@
 #!/usr/bin/python3
 """Read-only Atlas health probes with deduplicated 45Drives Alerts."""
 import argparse
 import fcntl
 import json
 import os
 import re
 import subprocess
 import sys
 import tempfile
 import time
 from datetime import datetime, timezone
 from pathlib import Path
 CONFIG_PATH = Path("/etc/atlas-health-monitor.json")
 STATE_DIR = Path("/var/lib/atlas-health-monitor")
 STATE_PATH = STATE_DIR / "state.json"
 GIB = 1024**3
 def run(*argv, timeout=40):
    return subprocess.run(argv, capture_output=True, text=True, timeout=timeout, check=False)
 def issue(issues, key, severity, message):
    issues[key] = {"severity": severity, "message": message}
 def notify(config, event, severity, subject, message):
    now = datetime.now(timezone.utc)
    payload = {
        "timestamp": now.isoformat(timespec="seconds"),
        "unixtime": int(now.timestamp()),
        "event": event,
        "severity": severity,
        "subject": subject,
        "email_message": message,
    }
    result = run(config["notifier"], json.dumps(payload, ensure_ascii=False), timeout=30)
    if result.returncode:
        raise RuntimeError(f"45Drives notifier exited {result.returncode}: {result.stderr.strip()}")
 def parse_fields(text):
    return dict(line.split("=", 1) for line in text.splitlines() if "=" in line)
 def systemd_fields(unit, *properties):
    result = run("systemctl", "show", unit, *(f"-p{item}" for item in properties))
    if result.returncode:
        raise RuntimeError(f"systemctl show {unit} exited {result.returncode}")
    return parse_fields(result.stdout)
 def unix_time(text):
    if not text or text == "n/a":
        return None
    result = run("date", "-d", text, "+%s")
    if result.returncode:
        raise ValueError(f"Cannot parse systemd timestamp: {text}")
    return int(result.stdout.strip())
 def check_pool(config, issues, measurements):
    pool = config["pool"]
    listing = run("zpool", "list", "-H", "-p", "-o", "size,alloc,capacity,health", pool)
    if listing.returncode:
        issue(issues, "pool.probe", "critical", f"Cannot query ZFS pool {pool}")
        return
    try:
        size, alloc, capacity, health = listing.stdout.strip().split("\t")
        size, alloc, capacity = int(size), int(alloc), int(capacity)
    except (ValueError, TypeError):
        issue(issues, "pool.probe", "critical", "Invalid ZFS pool capacity response")
        return
    measurements.update(pool_size_bytes=size, pool_alloc_bytes=alloc, pool_capacity_percent=capacity)
    if health != "ONLINE":
        issue(issues, "pool.health", "critical", f"ZFS pool {pool} state is {health}")
    if capacity >= config["pool_critical_percent"]:
        issue(issues, "pool.capacity", "critical", f"ZFS pool {pool} is {capacity}% full")
    elif capacity >= config["pool_warning_percent"]:
        issue(issues, "pool.capacity", "warning", f"ZFS pool {pool} is {capacity}% full")
    status = run("zpool", "status", "-P", pool)
    if status.returncode:
        issue(issues, "pool.status", "critical", f"Cannot query detailed ZFS status for {pool}")
        return
    bad_vdevs = []
    for line in status.stdout.splitlines():
        match = re.match(r"^\s*(\S+)\s+(ONLINE|DEGRADED|FAULTED|OFFLINE|UNAVAIL|REMOVED)\s+(\d+)\s+(\d+)\s+(\d+)", line)
        if match:
            name, state, reads, writes, checksums = match.groups()
            if state != "ONLINE" or any(int(value) for value in (reads, writes, checksums)):
                bad_vdevs.append(f"{name}: {state}, READ={reads}, WRITE={writes}, CKSUM={checksums}")
    if bad_vdevs:
        issue(issues, "pool.vdevs", "critical", "ZFS vdev errors: " + "; ".join(bad_vdevs))
    errors = re.search(r"^errors:\s*(.*)$", status.stdout, re.MULTILINE)
    if not errors or errors.group(1).strip() != "No known data errors":
        issue(issues, "pool.data_errors", "critical", "ZFS status reports data errors; inspect zpool status -v")
    if re.search(r"^\s*scan:\s*resilver in progress", status.stdout, re.MULTILINE | re.IGNORECASE):
        issue(issues, "pool.resilver", "warning", "ZFS resilver is in progress; inspect zpool status")
    scan = re.search(r"^\s*scan:\s*(.*)$", status.stdout, re.MULTILINE)
    if scan and re.search(r"\bwith [1-9][0-9]* errors\b", scan.group(1)):
        issue(issues, "pool.scan_errors", "critical", f"ZFS scan reported errors: {scan.group(1)}")
 def check_capacity(config, issues, measurements):
    pool = config["pool"]
    listing = run("zfs", "list", "-H", "-p", "-o", "name,usedbysnapshots", "-r", pool)
    if listing.returncode:
        issue(issues, "snapshot.probe", "warning", "Cannot query ZFS snapshot space")
    else:
        try:
            snapshots = sum(int(line.split("\t")[1]) for line in listing.stdout.splitlines())
            measurements["snapshots_bytes"] = snapshots
            size = measurements.get("pool_size_bytes")
            if size:
                percent = snapshots * 100 // size
                measurements["snapshots_percent"] = percent
                if percent >= config["snapshot_critical_percent"]:
                    issue(issues, "snapshot.capacity", "critical", f"Snapshots use {percent}% of pool size")
                elif percent >= config["snapshot_warning_percent"]:
                    issue(issues, "snapshot.capacity", "warning", f"Snapshots use {percent}% of pool size")
        except (ValueError, IndexError):
            issue(issues, "snapshot.probe", "warning", "Invalid ZFS snapshot-space response")
    backup = run("zfs", "list", "-H", "-p", "-o", "used", config["backup_dataset"])
    if backup.returncode:
        issue(issues, "backup.capacity_probe", "warning", "Cannot query local backup dataset space")
    else:
        try:
            measurements["backup_bytes"] = int(backup.stdout.strip())
        except ValueError:
            issue(issues, "backup.capacity_probe", "warning", "Invalid local backup space response")
    try:
        filesystem = os.statvfs("/")
        total = filesystem.f_blocks * filesystem.f_frsize
        available = filesystem.f_bavail * filesystem.f_frsize
        used_percent = (total - available) * 100 // total
        measurements["root_capacity_percent"] = used_percent
        if used_percent >= config["root_critical_percent"]:
            issue(issues, "root.capacity", "critical", f"Atlas system filesystem is {used_percent}% full")
        elif used_percent >= config["root_warning_percent"]:
            issue(issues, "root.capacity", "warning", f"Atlas system filesystem is {used_percent}% full")
    except (OSError, ZeroDivisionError):
        issue(issues, "root.capacity_probe", "warning", "Cannot query Atlas system filesystem space")
 def check_remote_capacity(config, issues, measurements):
    """Query only the Storage Box quota; do not open or inspect the Borg repository."""
    remote = config["remote_capacity"]
    try:
        result = run("runuser", "-u", remote["run_as"], "--", remote["ssh_wrapper"],
                     f"{remote['user']}@{remote['host']}", "df", "-m", timeout=65)
        if result.returncode:
            raise ValueError(f"SSH df exited {result.returncode}")
        lines = result.stdout.strip().splitlines()
        if len(lines) != 2:
            raise ValueError("Unexpected Storage Box df output")
        fields = lines[1].split()
        if len(fields) < 5:
            raise ValueError("Incomplete Storage Box df output")
        total_mib, used_mib, available_mib = (int(value) for value in fields[1:4])
        percent = int(fields[4].rstrip("%"))
        if total_mib <= 0 or not 0 <= percent <= 100 or available_mib < 0:
            raise ValueError("Invalid Storage Box quota values")
    except (OSError, ValueError, subprocess.TimeoutExpired):
        issue(issues, "remote.capacity_probe", "warning", "Cannot query Hetzner Storage Box quota via pinned-key SSH")
        return
    measurements.update(remote_capacity_percent=percent, remote_bytes=used_mib * 1024**2,
                        remote_available_bytes=available_mib * 1024**2)
    if percent >= remote["critical_percent"]:
        issue(issues, "remote.capacity", "critical", f"Hetzner Storage Box quota is {percent}% full")
    elif percent >= remote["warning_percent"]:
        issue(issues, "remote.capacity", "warning", f"Hetzner Storage Box quota is {percent}% full")
 def check_smart(config, issues, measurements):
    for device in config["smart_devices"]:
        name, path = device["name"], device["path"]
        try:
            result = run("smartctl", "-j", "-a", path, timeout=60)
            data = json.loads(result.stdout)
            status = int(data.get("smartctl", {}).get("exit_status", result.returncode))
        except (subprocess.TimeoutExpired, json.JSONDecodeError, ValueError) as exc:
            issue(issues, f"smart.{name}.probe", "critical", f"SMART probe failed for {name}: {type(exc).__name__}")
            continue
        if status:
            severity = "critical" if status & 0b00001111 else "warning"
            issue(issues, f"smart.{name}.status", severity, f"SMART reported exit status {status} for {name}")
        passed = data.get("smart_status", {}).get("passed")
        if passed is False:
            issue(issues, f"smart.{name}.health", "critical", f"SMART self-assessment failed for {name}")
        elif passed is None:
            issue(issues, f"smart.{name}.health", "warning", f"SMART self-assessment unavailable for {name}")
        temperature = data.get("temperature", {}).get("current")
        if isinstance(temperature, (int, float)):
            measurements[f"smart_{name}_c"] = temperature
            if temperature >= device["critical_c"]:
                issue(issues, f"smart.{name}.temperature", "critical", f"{name} temperature is {temperature} C")
            elif temperature >= device["warning_c"]:
                issue(issues, f"smart.{name}.temperature", "warning", f"{name} temperature is {temperature} C")
        else:
            issue(issues, f"smart.{name}.temperature", "warning", f"Temperature unavailable for {name}")
        for attribute in data.get("ata_smart_attributes", {}).get("table", []):
            attribute_id = attribute.get("id")
            if attribute_id in (5, 187, 197, 198):
                raw = attribute.get("raw", {}).get("value", 0)
                if isinstance(raw, int) and raw > 0:
                    severity = "critical" if attribute_id in (197, 198) else "warning"
                    issue(issues, f"smart.{name}.ata_{attribute_id}", severity,
                          f"{name} SMART attribute {attribute_id} raw count is {raw}")
        nvme = data.get("nvme_smart_health_information_log", {})
        if isinstance(nvme, dict):
            if int(nvme.get("critical_warning", 0)):
                issue(issues, f"smart.{name}.nvme_warning", "critical", f"{name} NVMe critical warning is nonzero")
            if int(nvme.get("media_errors", 0)):
                issue(issues, f"smart.{name}.nvme_media", "critical", f"{name} NVMe media errors are nonzero")
 def check_cpu(config, issues, measurements):
    sensors = []
    for hwmon in Path("/sys/class/hwmon").glob("hwmon*"):
        try:
            if (hwmon / "name").read_text().strip() != "coretemp":
                continue
            sensors.extend(int(path.read_text().strip()) / 1000 for path in hwmon.glob("temp*_input"))
        except (OSError, ValueError):
            continue
    if not sensors:
        issue(issues, "cpu.temperature_probe", "warning", "CPU temperature sensors are unavailable")
        return
    hottest = max(sensors)
    measurements["cpu_max_c"] = hottest
    if hottest >= config["cpu_critical_c"]:
        issue(issues, "cpu.temperature", "critical", f"CPU temperature is {hottest:g} C")
    elif hottest >= config["cpu_warning_c"]:
        issue(issues, "cpu.temperature", "warning", f"CPU temperature is {hottest:g} C")
 def check_jobs(config, issues, measurements, now):
    for timer in config["timers"]:
        name = timer["name"]
        try:
            fields = systemd_fields(name, "ActiveState", "UnitFileState", "LastTriggerUSec", "ActiveEnterTimestamp")
            if fields.get("ActiveState") != "active" or fields.get("UnitFileState") != "enabled":
                issue(issues, f"timer.{name}", "critical", f"Timer {name} is not active and enabled")
            max_age = int(timer["max_age_hours"]) * 3600
            if max_age:
                last = unix_time(fields.get("LastTriggerUSec"))
                if last is None:
                    last = unix_time(fields.get("ActiveEnterTimestamp"))
                if last is not None and now - last > max_age:
                    issue(issues, f"timer.{name}.stale", "warning",
                          f"Timer {name} has not fired in {int((now-last)/3600)} hours")
        except (RuntimeError, ValueError, subprocess.TimeoutExpired):
            issue(issues, f"timer.{name}.probe", "warning", f"Cannot query timer {name}")
    for unit in config["failure_units"]:
        if unit.endswith("@.service"):
            continue
        try:
            fields = systemd_fields(unit, "ActiveState", "Result", "ExecMainStartTimestamp")
            state = fields.get("ActiveState")
            if state == "failed" or (state == "inactive" and fields.get("Result") not in (None, "", "success")):
                issue(issues, f"service.{unit}", "critical", f"Service {unit} failed: {fields.get('Result')}")
            if unit == "atlas-borg-backup.service" and fields.get("ActiveState") == "activating":
                started = unix_time(fields.get("ExecMainStartTimestamp"))
                if started is not None and now - started > config["borg_max_runtime_days"] * 86400:
                    issue(issues, "backup.borg_long_running", "warning",
                          "Borg has run longer than its configured limit")
        except (RuntimeError, ValueError, subprocess.TimeoutExpired):
            issue(issues, f"service.{unit}.probe", "warning", f"Cannot query service {unit}")
 def check_growth(config, issues, measurements, samples, now):
    previous = [sample for sample in samples if 20 * 3600 <= now - sample.get("time", now) <= 48 * 3600]
    if previous:
        baseline = min(previous, key=lambda sample: abs(now - sample["time"] - 86400))
        days = (now - baseline["time"]) / 86400
        for name, threshold in (("snapshots", config["snapshot_growth_warning_gib_day"]),
                                ("backup", config["backup_growth_warning_gib_day"]),
                                ("remote", config["remote_capacity"]["growth_warning_gib_day"])):
            current, old = measurements.get(f"{name}_bytes"), baseline.get(f"{name}_bytes")
            if isinstance(current, int) and isinstance(old, int) and days > 0:
                growth_gib_day = (current - old) / GIB / days
                measurements[f"{name}_growth_gib_day"] = round(growth_gib_day, 1)
                if growth_gib_day >= threshold:
                    issue(issues, f"{name}.growth", "warning",
                          f"Local {name} usage grew {growth_gib_day:.1f} GiB/day over {days:.1f} days")
 def allowed_failure_unit(config, unit):
    for allowed in config["failure_units"]:
        if allowed == unit:
            return True
        if allowed.endswith("@.service") and unit.startswith(allowed[:-9] + "@") and unit.endswith(".service"):
            return True
    return False
 def load_state():
    if not STATE_PATH.exists():
        return {"active": {}, "samples": []}
    with STATE_PATH.open(encoding="utf-8") as stream:
        state = json.load(stream)
    if not isinstance(state.get("active"), dict) or not isinstance(state.get("samples"), list):
        raise ValueError("Invalid Atlas monitor state; refusing to overwrite it")
    return state
 def save_state(state):
    with tempfile.NamedTemporaryFile("w", dir=STATE_DIR, prefix=".state-", delete=False,
                                     encoding="utf-8") as stream:
        path = Path(stream.name)
        os.chmod(path, 0o600)
        json.dump(state, stream, sort_keys=True)
        stream.write("\n")
        stream.flush()
        os.fsync(stream.fileno())
    os.replace(path, STATE_PATH)
 def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--dry-run", action="store_true", help="probe without notifications or state changes")
    parser.add_argument("--test-notification", action="store_true", help="submit a labelled test alert")
    parser.add_argument("--job-failed", metavar="UNIT", help="notify about a failed configured service")
    args = parser.parse_args()
    with CONFIG_PATH.open(encoding="utf-8") as stream:
        config = json.load(stream)
    if args.test_notification:
        notify(config, "atlas_monitor_test", "warning", "Test monitoraggio Atlas",
               "Notifica di prova: il monitoraggio Atlas raggiunge 45Drives Alerts. Non conferma l'invio email.")
        print("Atlas monitor test submitted to 45Drives Alerts; email delivery is not verified.")
        return 0
    if args.job_failed:
        if not allowed_failure_unit(config, args.job_failed):
            raise ValueError("Unconfigured Atlas failure unit")
        notify(config, "atlas_job_failed", "critical", f"Job Atlas fallito: {args.job_failed}",
               f"Il servizio {args.job_failed} e' fallito. Controlla: "
               f"sudo journalctl -u {args.job_failed} -n 100 --no-pager")
        print(f"Atlas job failure submitted to 45Drives Alerts: {args.job_failed}")
        return 0
    now = int(time.time())
    issues, measurements = {}, {}
    check_pool(config, issues, measurements)
    check_capacity(config, issues, measurements)
    check_remote_capacity(config, issues, measurements)
    check_smart(config, issues, measurements)
    check_cpu(config, issues, measurements)
    check_jobs(config, issues, measurements, now)
    if args.dry_run:
        print(json.dumps({"issues": issues, "measurements": measurements}, sort_keys=True))
        return 0
    STATE_DIR.mkdir(mode=0o700, exist_ok=True)
    with (STATE_DIR / "monitor.lock").open("w") as lock:
        fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
        state = load_state()
        check_growth(config, issues, measurements, state["samples"], now)
        active, failed_notifications = state["active"], []
        for key, details in issues.items():
            old = active.get(key)
            if old is None or old.get("severity") != details["severity"]:
                try:
                    notify(config, "atlas_health_issue", details["severity"],
                           f"Atlas: {key}", details["message"])
                    active[key] = details
                    print(f"ALERT {details['severity']} {key}: {details['message']}", flush=True)
                except (RuntimeError, subprocess.TimeoutExpired) as exc:
                    failed_notifications.append(key)
                    print(f"NOTIFICATION FAILED {key}: {exc}", file=sys.stderr, flush=True)
        for key in set(active) - set(issues):
            print(f"RECOVERED {key}", flush=True)
            del active[key]
        state["samples"] = [sample for sample in state["samples"] if now - sample.get("time", 0) < 48 * 3600]
        state["samples"].append({"time": now, **{key: value for key, value in measurements.items()
                                                 if key in ("snapshots_bytes", "backup_bytes", "remote_bytes")}})
        save_state(state)
        print(f"Atlas health: issues={len(issues)} notifications_failed={len(failed_notifications)} "
              f"pool={measurements.get('pool_capacity_percent', 'unknown')}% "
              f"remote={measurements.get('remote_capacity_percent', 'unknown')}% "
              f"snapshots={measurements.get('snapshots_bytes', 'unknown')} bytes "
              f"backup={measurements.get('backup_bytes', 'unknown')} bytes", flush=True)
        return 1 if failed_notifications else 0
 if __name__ == "__main__":
    try:
        sys.exit(main())
    except (OSError, RuntimeError, ValueError, subprocess.TimeoutExpired) as error:
        print(f"Atlas health monitor failed: {error}", file=sys.stderr)
        sys.exit(1)
--- a/ansible/roles/profile_atlas/handlers/main.yml
+++ b/ansible/roles/profile_atlas/handlers/main.yml
@@ -28,7 +28,26 @@
    name: smb
    state: restarted
- name: Restart Atlas Syncthing service
+- name: Restart Atlas Borg timers
  ansible.builtin.systemd:
-    name: atlas-syncthing
+    name: "{{ item }}"
    state: restarted
    daemon_reload: true
  loop:
    - atlas-borg-backup.timer
    - atlas-borg-check.timer
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
 - name: Restart Atlas media Quadlets
  ansible.builtin.systemd:
    name: "{{ item }}"
    state: restarted
    daemon_reload: true
  loop: "{{ atlas_media_quadlet_services }}"
  loop_control:
    label: "{{ item }}"
  when:
    - atlas_manage_media_stack | bool
    - not ansible_check_mode
--- a/ansible/roles/profile_atlas/tasks/account.yml
+++ b/ansible/roles/profile_atlas/tasks/account.yml
@@ -6,9 +6,11 @@
      - atlas_admin_username != 'CHANGEME_ATLAS_ADMIN'
      - (atlas_admin_ssh_keys | default([])) | length > 0
      - atlas_admin_password_hash not in ['', '!', '*']
      - atlas_ssh_allow_tcp_forwarding in ['no', 'yes', 'local', 'remote', 'all']
      - "'wheel' not in atlas_immich_supplementary_groups"
    fail_msg: >-
-      Define atlas_admin_username, vault_atlas_authorized_ssh_keys and
+      Define atlas_admin_username, atlas_admin_ssh_keys and vault_atlas_admin_password_hash
-      vault_atlas_admin_password_hash before applying the Atlas profile.
+      before applying the Atlas profile.
  no_log: true
 - name: Create Atlas administrator group
@@ -31,6 +33,41 @@
    state: present
  no_log: true
 - name: Create Immich primary group
  tags: [atlas, accounts, containers, immich]
  ansible.builtin.group:
    name: "{{ atlas_immich_group }}"
    gid: "{{ atlas_immich_gid }}"
    state: present
 - name: Ensure Immich hardware-access groups exist
  tags: [atlas, accounts, containers, immich]
  ansible.builtin.group:
    name: "{{ item }}"
    state: present
  loop: "{{ atlas_immich_supplementary_groups }}"
  loop_control:
    label: "{{ item }}"
 - name: Create unprivileged Immich account
  tags: [atlas, accounts, containers, immich]
  ansible.builtin.user:
    name: "{{ atlas_immich_username }}"
    uid: "{{ atlas_immich_uid }}"
    group: "{{ atlas_immich_group }}"
    groups: "{{ atlas_immich_supplementary_groups }}"
    append: false
    home: /nonexistent
    create_home: false
    shell: /sbin/nologin
    system: true
    state: present
 - name: Read Immich hardware-access group IDs
  tags: [atlas, accounts, containers, immich]
  ansible.builtin.getent:
    database: group
 - name: Grant Atlas administrator passwordless sudo
  tags: [atlas, services]
  ansible.builtin.copy:
@@ -41,13 +78,26 @@
    mode: "0440"
    validate: "visudo -cf %s"
- name: Manage Atlas administrator authorized SSH keys exclusively
+- name: Ensure Atlas administrator SSH authorized key fragments directory exists
  tags: [atlas, services]
-  ansible.posix.authorized_key:
+  ansible.builtin.file:
-    user: "{{ atlas_admin_username }}"
+    path: "{{ atlas_admin_ssh_key_directory }}"
-    key: "{{ atlas_admin_ssh_keys | join('\n') }}"
+    state: directory
-    state: present
+    owner: "{{ atlas_admin_username }}"
-    exclusive: true
+    group: "{{ atlas_admin_group }}"
    mode: "0700"
 - name: Manage Atlas administrator SSH authorized key fragments
  tags: [atlas, services]
  ansible.builtin.copy:
    content: "{{ item.key }}\n"
    dest: "{{ atlas_admin_ssh_key_directory }}/{{ item.name }}"
    owner: "{{ atlas_admin_username }}"
    group: "{{ atlas_admin_group }}"
    mode: "0600"
  loop: "{{ atlas_admin_ssh_keys }}"
  loop_control:
    label: "{{ item.name }}"
 - name: Check whether the Atlas SSH host key exists
  tags: [atlas, services]
@@ -113,6 +163,18 @@
      - "'pubkeyauthentication yes' in atlas_sshd_effective_configuration.stdout_lines"
      - "'passwordauthentication no' in atlas_sshd_effective_configuration.stdout_lines"
      - "'kbdinteractiveauthentication no' in atlas_sshd_effective_configuration.stdout_lines"
      - "'authenticationmethods publickey' in atlas_sshd_effective_configuration.stdout_lines"
      - "'x11forwarding no' in atlas_sshd_effective_configuration.stdout_lines"
      - "('allowtcpforwarding ' ~ atlas_ssh_allow_tcp_forwarding) in atlas_sshd_effective_configuration.stdout_lines"
      - "'allowagentforwarding no' in atlas_sshd_effective_configuration.stdout_lines"
      - "'gatewayports no' in atlas_sshd_effective_configuration.stdout_lines"
      - "'permittunnel no' in atlas_sshd_effective_configuration.stdout_lines"
      - "'permituserenvironment no' in atlas_sshd_effective_configuration.stdout_lines"
      - "'maxauthtries 3' in atlas_sshd_effective_configuration.stdout_lines"
      - "'logingracetime 30' in atlas_sshd_effective_configuration.stdout_lines"
      - "'clientaliveinterval 300' in atlas_sshd_effective_configuration.stdout_lines"
      - "'clientalivecountmax 2' in atlas_sshd_effective_configuration.stdout_lines"
      - "'loglevel VERBOSE' in atlas_sshd_effective_configuration.stdout_lines"
      - "('allowusers ' ~ atlas_admin_username) in atlas_sshd_effective_configuration.stdout_lines"
    fail_msg: The effective Atlas SSH configuration does not match the required hardening.
  when: not ansible_check_mode
--- a/ansible/roles/profile_atlas/tasks/borg_backup.yml
+++ b/ansible/roles/profile_atlas/tasks/borg_backup.yml
@@ -0,0 +1,538 @@
 ---
 - name: Validate Atlas Borg backup configuration
  tags: [atlas, storage, backup, borg, borg_key]
  ansible.builtin.assert:
    that:
      - atlas_manage_storage | bool
      - atlas_zfs_pool != 'CHANGEME_ZFS_POOL'
      - atlas_mount_root.startswith('/')
      - atlas_borg_username is match('^[a-z_][a-z0-9_-]*$')
      - atlas_borg_group is match('^[a-z_][a-z0-9_-]*$')
      - atlas_borg_username not in ['root', atlas_admin_username]
      - atlas_borg_group != 'wheel'
      - atlas_borg_home.startswith('/var/lib/')
      - atlas_borg_repository_host is match('^[A-Za-z0-9.-]+$')
      - atlas_borg_repository_user is match('^[A-Za-z0-9_-]+$')
      - atlas_borg_repository_port | int > 0
      - atlas_borg_repository_port | int < 65536
      - atlas_borg_repository_path is match('^\./[A-Za-z0-9][A-Za-z0-9._/-]*$')
      - "'/../' not in ('/' ~ atlas_borg_repository_path ~ '/')"
      - atlas_borg_remote_path is match('^borg-[0-9]+\.[0-9]+$')
      - atlas_borg_host_key.startswith(
          '[' ~ atlas_borg_repository_host ~ ']:' ~ (atlas_borg_repository_port | string) ~ ' ssh-ed25519 '
        )
      - atlas_borg_ssh_private_key_path.startswith('/etc/atlas-borg/')
      - atlas_borg_known_hosts_path.startswith('/etc/atlas-borg/')
      - atlas_borg_passphrase_path.startswith('/etc/atlas-borg/')
      - atlas_borg_ssh_wrapper_path.startswith('/usr/local/libexec/')
      - atlas_borg_encryption_mode == 'repokey'
      - atlas_borg_archive_prefix is match('^[a-z0-9][a-z0-9_-]*$')
      - atlas_borg_snapshot_prefix is match('^[a-z0-9][a-z0-9_-]*$')
      - atlas_borg_keep_daily | int > 0
      - atlas_borg_keep_weekly | int > 0
      - atlas_borg_keep_monthly | int > 0
    fail_msg: >-
      Atlas Borg needs a safe relative repository path, a pinned ED25519 host
      key, positive retention counts, and valid dedicated SSH settings.
  when: atlas_manage_borg_backup | bool
 - name: Create the Atlas Borg system group
  tags: [atlas, storage, backup, borg, borg_key]
  ansible.builtin.group:
    name: "{{ atlas_borg_group }}"
    system: true
    state: present
  when: atlas_manage_borg_backup | bool
 - name: Create the least-privilege Atlas Borg account
  tags: [atlas, storage, backup, borg, borg_key]
  ansible.builtin.user:
    name: "{{ atlas_borg_username }}"
    group: "{{ atlas_borg_group }}"
    groups: []
    append: false
    comment: Atlas Borg backup service
    home: "{{ atlas_borg_home }}"
    create_home: false
    shell: /sbin/nologin
    password_lock: true
    system: true
    state: present
  when: atlas_manage_borg_backup | bool
 - name: Read Atlas Borg account group membership
  tags: [atlas, storage, backup, borg, borg_key]
  ansible.builtin.command:
    argv:
      - id
      - -nG
      - "{{ atlas_borg_username }}"
  register: atlas_borg_account_groups
  changed_when: false
  check_mode: false
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
 - name: Require the Atlas Borg account to have no supplementary groups
  tags: [atlas, storage, backup, borg, borg_key]
  ansible.builtin.assert:
    that:
      - atlas_borg_account_groups.stdout.split() == [atlas_borg_group]
    fail_msg: >-
      The Atlas Borg service account must belong only to its private primary
      group and must never receive wheel or other supplementary membership.
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
 - name: Validate Atlas Borg systemd calendars
  tags: [atlas, storage, backup, borg]
  ansible.builtin.command:
    argv:
      - systemd-analyze
      - calendar
      - "{{ item }}"
  loop:
    - "{{ atlas_borg_backup_calendar }}"
    - "{{ atlas_borg_check_calendar }}"
  changed_when: false
  check_mode: false
  when: atlas_manage_borg_backup | bool
 - name: Create Atlas Borg configuration directory
  tags: [atlas, storage, backup, borg, borg_key]
  ansible.builtin.file:
    path: /etc/atlas-borg
    state: directory
    owner: root
    group: "{{ atlas_borg_group }}"
    mode: "0750"
  when: atlas_manage_borg_backup | bool
 - name: Generate the dedicated Atlas Borg SSH identity
  tags: [atlas, storage, backup, borg, borg_key]
  ansible.builtin.command:
    argv:
      - ssh-keygen
      - -q
      - -t
      - ed25519
      - -N
      - ""
      - -C
      - atlas-borg@atlas
      - -f
      - "{{ atlas_borg_ssh_private_key_path }}"
    creates: "{{ atlas_borg_ssh_private_key_path }}"
  when: atlas_manage_borg_backup | bool
 - name: Protect the Atlas Borg private SSH identity
  tags: [atlas, storage, backup, borg, borg_key]
  ansible.builtin.file:
    path: "{{ atlas_borg_ssh_private_key_path }}"
    owner: "{{ atlas_borg_username }}"
    group: "{{ atlas_borg_group }}"
    mode: "0600"
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
 - name: Set permissions on the Atlas Borg public SSH identity
  tags: [atlas, storage, backup, borg, borg_key]
  ansible.builtin.file:
    path: "{{ atlas_borg_ssh_private_key_path }}.pub"
    owner: "{{ atlas_borg_username }}"
    group: "{{ atlas_borg_group }}"
    mode: "0644"
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
 - name: Read the dedicated Atlas Borg public SSH identity
  tags: [atlas, storage, backup, borg, borg_key]
  ansible.builtin.slurp:
    src: "{{ atlas_borg_ssh_private_key_path }}.pub"
  register: atlas_borg_public_key
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
 - name: Report the public SSH identity to install in the Hetzner sub-account
  tags: [atlas, storage, backup, borg, borg_key]
  ansible.builtin.debug:
    msg: "{{ atlas_borg_public_key.content | b64decode | trim }}"
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
 - name: Pin the Hetzner Storage Box SSH host key
  tags: [atlas, storage, backup, borg]
  ansible.builtin.copy:
    content: "{{ atlas_borg_host_key }}\n"
    dest: "{{ atlas_borg_known_hosts_path }}"
    owner: "{{ atlas_borg_username }}"
    group: "{{ atlas_borg_group }}"
    mode: "0600"
  when: atlas_manage_borg_backup | bool
 - name: Create Atlas Borg state directories
  tags: [atlas, storage, backup, borg]
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "{{ atlas_borg_username }}"
    group: "{{ atlas_borg_group }}"
    mode: "0700"
  loop:
    - "{{ atlas_borg_config_dir }}"
    - "{{ atlas_borg_cache_dir }}"
  when: atlas_manage_borg_backup | bool
 - name: Create the shared Atlas Borg operation lock
  tags: [atlas, storage, backup, borg]
  ansible.builtin.copy:
    content: ""
    dest: "{{ atlas_borg_lock_path }}"
    owner: "{{ atlas_borg_username }}"
    group: "{{ atlas_borg_group }}"
    mode: "0600"
    force: false
  when: atlas_manage_borg_backup | bool
 - name: Require the Atlas Borg encryption passphrase from Vault
  tags: [atlas, storage, backup, borg]
  ansible.builtin.assert:
    that:
      - atlas_borg_passphrase | length >= 20
    fail_msg: >-
      Define vault_atlas_borg_passphrase with a strong unique value in the
      encrypted Vault before activating the Borg repository.
  no_log: true
  when: atlas_manage_borg_backup | bool
 - name: Install the Atlas Borg passphrase
  tags: [atlas, storage, backup, borg]
  ansible.builtin.copy:
    content: "{{ atlas_borg_passphrase }}\n"
    dest: "{{ atlas_borg_passphrase_path }}"
    owner: "{{ atlas_borg_username }}"
    group: "{{ atlas_borg_group }}"
    mode: "0600"
  diff: false
  no_log: true
  when: atlas_manage_borg_backup | bool
 - name: Install the Atlas Borg backup helper
  tags: [atlas, storage, backup, borg, borg_logging]
  ansible.builtin.template:
    src: atlas-borg-backup.sh.j2
    dest: /usr/local/sbin/atlas-borg-backup
    owner: root
    group: root
    mode: "0750"
  when: atlas_manage_borg_backup | bool
 - name: Install the Atlas Borg snapshot cleanup helper
  tags: [atlas, storage, backup, borg, borg_logging]
  ansible.builtin.template:
    src: atlas-borg-snapshot-cleanup.sh.j2
    dest: /usr/local/sbin/atlas-borg-snapshot-cleanup
    owner: root
    group: root
    mode: "0750"
  when: atlas_manage_borg_backup | bool
 - name: Install the Atlas Borg check helper
  tags: [atlas, storage, backup, borg]
  ansible.builtin.template:
    src: atlas-borg-check.sh.j2
    dest: /usr/local/sbin/atlas-borg-check
    owner: root
    group: "{{ atlas_borg_group }}"
    mode: "0750"
  when: atlas_manage_borg_backup | bool
 - name: Create the local libexec directory for the Atlas Borg SSH wrapper
  tags: [atlas, storage, backup, borg, borg_logging]
  ansible.builtin.file:
    path: "{{ atlas_borg_ssh_wrapper_path | dirname }}"
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: atlas_manage_borg_backup | bool
 - name: Install the Atlas Borg progress formatter
  tags: [atlas, storage, backup, borg, borg_logging]
  ansible.builtin.copy:
    src: atlas-borg-progress.py
    dest: /usr/local/libexec/atlas-borg-progress
    owner: root
    group: root
    mode: "0755"
  when: atlas_manage_borg_backup | bool
 - name: Install the capability-dropping Atlas Borg SSH wrapper
  tags: [atlas, storage, backup, borg]
  ansible.builtin.template:
    src: atlas-borg-ssh.sh.j2
    dest: "{{ atlas_borg_ssh_wrapper_path }}"
    owner: root
    group: root
    mode: "0755"
  when: atlas_manage_borg_backup | bool
 - name: Install Atlas Borg systemd units
  tags: [atlas, storage, backup, borg, borg_logging]
  ansible.builtin.template:
    src: "{{ item }}.j2"
    dest: "/etc/systemd/system/{{ item }}"
    owner: root
    group: root
    mode: "0644"
  loop:
    - atlas-borg-backup.service
    - atlas-borg-backup.timer
    - atlas-borg-check.service
    - atlas-borg-check.timer
  notify: Restart Atlas Borg timers
  when: atlas_manage_borg_backup | bool
 - name: Verify dedicated SSH access to the Hetzner Storage Box
  tags: [atlas, storage, backup, borg]
  ansible.builtin.command:
    argv:
      - ssh
      - -T
      - -i
      - "{{ atlas_borg_ssh_private_key_path }}"
      - -p
      - "{{ atlas_borg_repository_port | string }}"
      - -o
      - BatchMode=yes
      - -o
      - IdentitiesOnly=yes
      - -o
      - StrictHostKeyChecking=yes
      - -o
      - "UserKnownHostsFile={{ atlas_borg_known_hosts_path }}"
      - "{{ atlas_borg_repository_user }}@{{ atlas_borg_repository_host }}"
      - pwd
  register: atlas_borg_ssh_probe
  become: true
  become_user: "{{ atlas_borg_username }}"
  changed_when: false
  failed_when: false
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
 - name: Require the dedicated public key on the Hetzner sub-account
  tags: [atlas, storage, backup, borg]
  ansible.builtin.assert:
    that:
      - atlas_borg_ssh_probe.rc == 0
    fail_msg: >-
      Install the reported Atlas Borg public key in the Hetzner sub-account
      before rerunning the Borg tasks. Password authentication is never used.
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
 - name: Probe the remote Atlas Borg repository path
  tags: [atlas, storage, backup, borg]
  ansible.builtin.command:
    argv:
      - ssh
      - -T
      - -i
      - "{{ atlas_borg_ssh_private_key_path }}"
      - -p
      - "{{ atlas_borg_repository_port | string }}"
      - -o
      - BatchMode=yes
      - -o
      - IdentitiesOnly=yes
      - -o
      - StrictHostKeyChecking=yes
      - -o
      - "UserKnownHostsFile={{ atlas_borg_known_hosts_path }}"
      - "{{ atlas_borg_repository_user }}@{{ atlas_borg_repository_host }}"
      - stat
      - "{{ atlas_borg_repository_path }}"
  register: atlas_borg_repository_path_probe
  become: true
  become_user: "{{ atlas_borg_username }}"
  changed_when: false
  failed_when: false
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
 - name: Probe the Atlas Borg repository
  tags: [atlas, storage, backup, borg]
  ansible.builtin.command:
    argv:
      - /usr/bin/borg
      - --remote-path
      - "{{ atlas_borg_remote_path }}"
      - info
      - >-
        ssh://{{ atlas_borg_repository_user }}@{{ atlas_borg_repository_host }}:
        {{- atlas_borg_repository_port }}/{{ atlas_borg_repository_path }}
  environment:
    BORG_CACHE_DIR: "{{ atlas_borg_cache_dir }}"
    BORG_CONFIG_DIR: "{{ atlas_borg_config_dir }}"
    BORG_PASSCOMMAND: "cat {{ atlas_borg_passphrase_path }}"
    BORG_RSH: "{{ atlas_borg_ssh_wrapper_path }}"
  register: atlas_borg_repository_probe
  become: true
  become_user: "{{ atlas_borg_username }}"
  changed_when: false
  failed_when: false
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
    - atlas_borg_repository_path_probe.rc == 0
 - name: Reject an existing path that is not the configured Borg repository
  tags: [atlas, storage, backup, borg]
  ansible.builtin.assert:
    that:
      - atlas_borg_repository_probe.rc == 0
    fail_msg: >-
      The remote repository path already exists but Borg could not open it.
      Refusing to initialize over existing data; verify the path, passphrase,
      and repository state manually.
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
    - atlas_borg_repository_path_probe.rc == 0
 - name: Initialize the encrypted Atlas Borg repository
  tags: [atlas, storage, backup, borg]
  ansible.builtin.command:
    argv:
      - /usr/bin/borg
      - --remote-path
      - "{{ atlas_borg_remote_path }}"
      - init
      - --encryption
      - "{{ atlas_borg_encryption_mode }}"
      - >-
        ssh://{{ atlas_borg_repository_user }}@{{ atlas_borg_repository_host }}:
        {{- atlas_borg_repository_port }}/{{ atlas_borg_repository_path }}
  environment:
    BORG_CACHE_DIR: "{{ atlas_borg_cache_dir }}"
    BORG_CONFIG_DIR: "{{ atlas_borg_config_dir }}"
    BORG_PASSCOMMAND: "cat {{ atlas_borg_passphrase_path }}"
    BORG_RSH: "{{ atlas_borg_ssh_wrapper_path }}"
  become: true
  become_user: "{{ atlas_borg_username }}"
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
    - atlas_borg_repository_path_probe.rc != 0
 - name: Verify the encrypted Atlas Borg repository
  tags: [atlas, storage, backup, borg]
  ansible.builtin.command:
    argv:
      - /usr/bin/borg
      - --remote-path
      - "{{ atlas_borg_remote_path }}"
      - info
      - >-
        ssh://{{ atlas_borg_repository_user }}@{{ atlas_borg_repository_host }}:
        {{- atlas_borg_repository_port }}/{{ atlas_borg_repository_path }}
  environment:
    BORG_CACHE_DIR: "{{ atlas_borg_cache_dir }}"
    BORG_CONFIG_DIR: "{{ atlas_borg_config_dir }}"
    BORG_PASSCOMMAND: "cat {{ atlas_borg_passphrase_path }}"
    BORG_RSH: "{{ atlas_borg_ssh_wrapper_path }}"
  become: true
  become_user: "{{ atlas_borg_username }}"
  changed_when: false
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
 - name: Check for the local Atlas Borg recovery-key export
  tags: [atlas, storage, backup, borg]
  ansible.builtin.stat:
    path: "{{ atlas_borg_recovery_export_path }}"
  register: atlas_borg_recovery_export
  delegate_to: localhost
  become: false
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
 - name: Export the Atlas Borg recovery key for offline preservation
  tags: [atlas, storage, backup, borg]
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
    - not atlas_borg_recovery_export.stat.exists
  no_log: true
  block:
    - name: Create the local recovery-material directory
      ansible.builtin.file:
        path: "{{ atlas_borg_recovery_export_path | dirname }}"
        state: directory
        mode: "0700"
      delegate_to: localhost
      become: false
    - name: Export the encrypted Borg repository key on Atlas
      ansible.builtin.command:
        argv:
          - /usr/bin/borg
          - --remote-path
          - "{{ atlas_borg_remote_path }}"
          - key
          - export
          - >-
            ssh://{{ atlas_borg_repository_user }}@{{ atlas_borg_repository_host }}:
            {{- atlas_borg_repository_port }}/{{ atlas_borg_repository_path }}
          - "{{ atlas_borg_config_dir }}/atlas-borg-repokey.export"
      environment:
        BORG_CACHE_DIR: "{{ atlas_borg_cache_dir }}"
        BORG_CONFIG_DIR: "{{ atlas_borg_config_dir }}"
        BORG_PASSCOMMAND: "cat {{ atlas_borg_passphrase_path }}"
        BORG_RSH: "{{ atlas_borg_ssh_wrapper_path }}"
      become: true
      become_user: "{{ atlas_borg_username }}"
    - name: Fetch the encrypted Borg recovery key from Atlas
      ansible.builtin.fetch:
        src: "{{ atlas_borg_config_dir }}/atlas-borg-repokey.export"
        dest: "{{ atlas_borg_recovery_export_path }}"
        flat: true
    - name: Protect the local Borg recovery-key export
      ansible.builtin.file:
        path: "{{ atlas_borg_recovery_export_path }}"
        mode: "0600"
      delegate_to: localhost
      become: false
  always:
    - name: Remove the temporary recovery-key export from Atlas
      ansible.builtin.file:
        path: "{{ atlas_borg_config_dir }}/atlas-borg-repokey.export"
        state: absent
 - name: Enable Atlas Borg backup and check timers
  tags: [atlas, storage, backup, borg]
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: true
    state: started
    daemon_reload: true
  loop:
    - atlas-borg-backup.timer
    - atlas-borg-check.timer
  when:
    - atlas_manage_borg_backup | bool
    - not ansible_check_mode
--- a/ansible/roles/profile_atlas/tasks/containers.yml
+++ b/ansible/roles/profile_atlas/tasks/containers.yml
@@ -0,0 +1,140 @@
 ---
 - name: Require completed Atlas media-stack configuration
  tags: [atlas, containers, immich]
  ansible.builtin.assert:
    that:
      - atlas_manage_storage | bool
      - atlas_zfs_pool != 'CHANGEME_ZFS_POOL'
      - atlas_mount_root != '/CHANGEME_ATLAS_MOUNT_ROOT'
      - atlas_immich_db_password | length > 0
      - atlas_npm_admin_bind_address == '127.0.0.1'
    fail_msg: >-
      Enable and configure Atlas storage, provide vault_atlas_immich_db_password,
      and keep the NPM administration port bound to loopback before enabling the media stack.
  no_log: true
  when: atlas_manage_media_stack | bool
 - name: Check Atlas Intel graphics device
  tags: [atlas, containers, immich]
  ansible.builtin.stat:
    path: /dev/dri
  register: atlas_dri_device
  when: atlas_manage_media_stack | bool
 - name: Require Atlas Intel graphics device
  tags: [atlas, containers, immich]
  ansible.builtin.assert:
    that:
      - atlas_dri_device.stat.isdir | default(false)
    fail_msg: /dev/dri is required for Immich QuickSync and OpenVINO acceleration.
  when: atlas_manage_media_stack | bool
 - name: Create Atlas rootful Quadlet directory
  tags: [atlas, containers]
  ansible.builtin.file:
    path: "{{ atlas_container_quadlet_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: atlas_manage_media_stack | bool
 - name: Create Atlas Immich configuration directory
  tags: [atlas, containers, immich]
  ansible.builtin.file:
    path: /etc/immich
    state: directory
    owner: root
    group: "{{ atlas_immich_group }}"
    mode: "0750"
  when: atlas_manage_media_stack | bool
 - name: Create Atlas Immich persistent directories
  tags: [atlas, containers, immich]
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: "{{ atlas_immich_username }}"
    group: "{{ atlas_immich_group }}"
    mode: "0750"
  loop:
    - "{{ atlas_immich_upload_dir }}"
    - "{{ atlas_immich_model_cache_dir }}"
    - "{{ atlas_immich_machine_learning_config_dir }}"
    - "{{ atlas_immich_machine_learning_cache_dir }}"
    - "{{ atlas_immich_redis_data_dir }}"
    - "{{ atlas_immich_postgres_data_dir }}"
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_media_stack | bool
 - name: Create Atlas NPM persistent directories
  tags: [atlas, containers, npm]
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: root
    mode: "0750"
  loop:
    - "{{ atlas_npm_data_dir }}"
    - "{{ atlas_npm_letsencrypt_dir }}"
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_media_stack | bool
 - name: Allow confined containers to use Atlas graphics devices
  tags: [atlas, containers, immich]
  ansible.posix.seboolean:
    name: container_use_devices
    state: true
    persistent: true
  when:
    - atlas_manage_media_stack | bool
    - (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'
 - name: Render Vault-backed Immich environment
  tags: [atlas, containers, immich]
  ansible.builtin.template:
    src: immich.env.j2
    dest: /etc/immich/immich.env
    owner: root
    group: "{{ atlas_immich_group }}"
    mode: "0640"
  no_log: true
  diff: false
  notify: Restart Atlas media Quadlets
  when: atlas_manage_media_stack | bool
 - name: Render Atlas media Quadlets
  tags: [atlas, containers]
  ansible.builtin.template:
    src: "{{ item }}.j2"
    dest: "{{ atlas_container_quadlet_dir }}/{{ item }}"
    owner: root
    group: root
    mode: "0644"
  loop:
    - atlas-media.network
    - atlas-immich-redis.container
    - atlas-immich-postgres.container
    - atlas-immich-machine-learning.container
    - atlas-immich-server.container
    - atlas-npm.container
  loop_control:
    label: "{{ item }}"
  notify: Restart Atlas media Quadlets
  when: atlas_manage_media_stack | bool
 - name: Start Atlas media Quadlet services
  tags: [atlas, containers, services]
  ansible.builtin.systemd:
    name: "{{ item }}"
    state: started
    daemon_reload: true
  loop: "{{ atlas_media_quadlet_services }}"
  loop_control:
    label: "{{ item }}"
  when:
    - atlas_manage_media_stack | bool
    - not ansible_check_mode
--- a/ansible/roles/profile_atlas/tasks/hardening.yml
+++ b/ansible/roles/profile_atlas/tasks/hardening.yml
@@ -0,0 +1,45 @@
 ---
 - name: Enforce targeted SELinux on Atlas
  tags: [atlas, hardening, security]
  ansible.posix.selinux:
    policy: targeted
    state: enforcing
    update_kernel_param: true
  register: atlas_selinux_enforcement
 - name: Report when Atlas requires a reboot for SELinux enforcement
  tags: [atlas, hardening, security]
  ansible.builtin.debug:
    msg: Reboot Atlas before relying on SELinux enforcement.
  when: atlas_selinux_enforcement.reboot_required | default(false)
 - name: Apply Atlas network-kernel hardening
  tags: [atlas, hardening, security]
  ansible.posix.sysctl:
    name: "{{ item.key }}"
    value: "{{ item.value }}"
    state: present
    sysctl_set: true
    reload: true
  loop: "{{ atlas_hardening_sysctls | dict2items }}"
  loop_control:
    label: "{{ item.key }}={{ item.value }}"
 - name: Read active Atlas SELinux mode
  tags: [atlas, hardening, security]
  ansible.builtin.command:
    argv:
      - getenforce
  register: atlas_selinux_mode
  changed_when: false
  when: not ansible_check_mode
 - name: Require active SELinux enforcement on Atlas
  tags: [atlas, hardening, security]
  ansible.builtin.assert:
    that:
      - atlas_selinux_mode.stdout == 'Enforcing'
    fail_msg: >-
      Atlas SELinux is not enforcing. Reboot if requested by the preceding
      SELinux task, then rerun the hardening role before enabling services.
  when: not ansible_check_mode
--- a/ansible/roles/profile_atlas/tasks/main.yml
+++ b/ansible/roles/profile_atlas/tasks/main.yml
@@ -5,11 +5,32 @@
 - name: Import Atlas 45Drives tasks
  ansible.builtin.import_tasks: cockpit.yml
 - name: Import Atlas network hardening tasks
  ansible.builtin.import_tasks: hardening.yml
 - name: Import Atlas pool bootstrap tasks
  ansible.builtin.import_tasks: pool.yml
 - name: Import Atlas storage tasks
  ansible.builtin.import_tasks: storage.yml
 - name: Import Atlas ZFS maintenance tasks
  ansible.builtin.import_tasks: zfs_maintenance.yml
 - name: Import Atlas Borg backup tasks
  ansible.builtin.import_tasks: borg_backup.yml
 - name: Import Atlas offline USB backup tasks
  ansible.builtin.import_tasks: usb_backup.yml
 - name: Import Atlas health monitoring tasks
  ansible.builtin.import_tasks: monitoring.yml
 - name: Import Atlas post-restore SELinux relabeling tasks
  ansible.builtin.import_tasks: restorecon.yml
 - name: Import Atlas file sharing tasks
  ansible.builtin.import_tasks: sharing.yml
- name: Import Atlas Syncthing tasks
+- name: Import Atlas media-container tasks
-  ansible.builtin.import_tasks: syncthing.yml
+  ansible.builtin.import_tasks: containers.yml
--- a/ansible/roles/profile_atlas/tasks/monitoring.yml
+++ b/ansible/roles/profile_atlas/tasks/monitoring.yml
@@ -0,0 +1,201 @@
 ---
 - name: Validate Atlas health monitoring policy
  tags: [atlas, monitoring]
  ansible.builtin.assert:
    that:
      - atlas_manage_storage | bool
      - atlas_zfs_pool != 'CHANGEME_ZFS_POOL'
      - atlas_monitor_calendar | length > 0
      - atlas_monitor_smart_devices | length > 0
      - atlas_monitor_timers | length > 0
      - atlas_monitor_failure_units | length > 0
      - atlas_monitor_remote_capacity.user == atlas_borg_repository_user
      - atlas_monitor_remote_capacity.host == atlas_borg_repository_host
      - atlas_monitor_remote_capacity.run_as == atlas_borg_username
      - atlas_monitor_remote_capacity.ssh_wrapper == atlas_borg_ssh_wrapper_path
      - >-
        0 < atlas_monitor_remote_capacity.warning_percent | int
        < atlas_monitor_remote_capacity.critical_percent | int < 100
      - atlas_monitor_remote_capacity.growth_warning_gib_day | int > 0
      - atlas_monitor_notifier.startswith('/opt/45drives/houston/')
      - 0 < atlas_monitor_pool_warning_percent | int < atlas_monitor_pool_critical_percent | int < 100
      - 0 < atlas_monitor_root_warning_percent | int < atlas_monitor_root_critical_percent | int < 100
      - 0 < atlas_monitor_snapshot_warning_percent | int < atlas_monitor_snapshot_critical_percent | int < 100
      - atlas_monitor_snapshot_growth_warning_gib_day | int > 0
      - atlas_monitor_backup_growth_warning_gib_day | int > 0
      - 0 < atlas_monitor_cpu_warning_c | int < atlas_monitor_cpu_critical_c | int
      - atlas_monitor_borg_max_runtime_days | int > 0
    fail_msg: >-
      Atlas health monitoring needs real devices, job units, a valid calendar,
      positive ordered thresholds, and the existing Houston notifier.
  when: atlas_manage_monitoring | bool
 - name: Validate monitored Atlas SMART devices
  tags: [atlas, monitoring]
  ansible.builtin.assert:
    that:
      - item.name is match('^[a-z0-9][a-z0-9_-]*$')
      - item.path.startswith('/dev/disk/by-id/')
      - 0 < item.warning_c | int < item.critical_c | int
    fail_msg: "Every monitored disk needs a stable by-id path and ordered temperature thresholds."
  loop: "{{ atlas_monitor_smart_devices }}"
  loop_control:
    label: "{{ item.name }}"
  when: atlas_manage_monitoring | bool
 - name: Validate monitored Atlas timer names and age thresholds
  tags: [atlas, monitoring]
  ansible.builtin.assert:
    that:
      - item.name is match('^[a-zA-Z0-9@_.-]+\\.timer$')
      - item.max_age_hours | int >= 0
  loop: "{{ atlas_monitor_timers }}"
  loop_control:
    label: "{{ item.name }}"
  when: atlas_manage_monitoring | bool
 - name: Validate monitored Atlas failure unit names
  tags: [atlas, monitoring]
  ansible.builtin.assert:
    that:
      - item is match('^[a-zA-Z0-9@_.-]+\\.service$')
  loop: "{{ atlas_monitor_failure_units }}"
  when: atlas_manage_monitoring | bool
 - name: Validate Atlas health monitor calendar
  tags: [atlas, monitoring]
  ansible.builtin.command:
    argv: [systemd-analyze, calendar, "{{ atlas_monitor_calendar }}"]
  changed_when: false
  check_mode: false
  when: atlas_manage_monitoring | bool
 - name: Install SMART tooling for Atlas health checks
  tags: [atlas, monitoring, packages]
  ansible.builtin.dnf:
    name: smartmontools
    state: present
  when: atlas_manage_monitoring | bool
 - name: Inspect the existing 45Drives notifier for monitoring
  tags: [atlas, monitoring]
  ansible.builtin.stat:
    path: "{{ atlas_monitor_notifier }}"
  register: atlas_monitor_notifier_file
  when: atlas_manage_monitoring | bool
 - name: Require the existing 45Drives notifier for monitoring
  tags: [atlas, monitoring]
  ansible.builtin.assert:
    that:
      - atlas_monitor_notifier_file.stat.executable | default(false)
    fail_msg: "The existing 45Drives Houston notifier must be executable."
  when: atlas_manage_monitoring | bool
 - name: Create private Atlas health monitor state directory
  tags: [atlas, monitoring]
  ansible.builtin.file:
    path: /var/lib/atlas-health-monitor
    state: directory
    owner: root
    group: root
    mode: "0700"
  when: atlas_manage_monitoring | bool
 - name: Install Atlas health monitor configuration
  tags: [atlas, monitoring]
  ansible.builtin.template:
    src: atlas-health-monitor.json.j2
    dest: /etc/atlas-health-monitor.json
    owner: root
    group: root
    mode: "0600"
  when: atlas_manage_monitoring | bool
 - name: Install Atlas health monitor helper
  tags: [atlas, monitoring]
  ansible.builtin.copy:
    src: atlas-health-monitor.py
    dest: /usr/local/libexec/atlas-health-monitor
    owner: root
    group: root
    mode: "0750"
  when: atlas_manage_monitoring | bool
 - name: Install Atlas health monitoring units
  tags: [atlas, monitoring]
  ansible.builtin.template:
    src: "{{ item }}.j2"
    dest: "/etc/systemd/system/{{ item }}"
    owner: root
    group: root
    mode: "0644"
  loop:
    - atlas-health-monitor.service
    - atlas-health-monitor.timer
    - atlas-monitor-failure@.service
  when: atlas_manage_monitoring | bool
 - name: Create failure hook directories for monitored Atlas jobs
  tags: [atlas, monitoring]
  ansible.builtin.file:
    path: "/etc/systemd/system/{{ item }}.d"
    state: directory
    owner: root
    group: root
    mode: "0755"
  loop: "{{ atlas_monitor_failure_units }}"
  when: atlas_manage_monitoring | bool
 - name: Notify 45Drives Alerts when an Atlas job fails
  tags: [atlas, monitoring]
  ansible.builtin.template:
    src: atlas-monitor-failure.conf.j2
    dest: "/etc/systemd/system/{{ item }}.d/atlas-monitor.conf"
    owner: root
    group: root
    mode: "0644"
  loop: "{{ atlas_monitor_failure_units }}"
  when: atlas_manage_monitoring | bool
 - name: Reload systemd after installing Atlas monitoring
  tags: [atlas, monitoring]
  ansible.builtin.systemd:
    daemon_reload: true
  when:
    - atlas_manage_monitoring | bool
    - not ansible_check_mode
 - name: Enable the Atlas health monitoring timer
  tags: [atlas, monitoring]
  ansible.builtin.systemd:
    name: atlas-health-monitor.timer
    enabled: true
    state: started
  when:
    - atlas_manage_monitoring | bool
    - not ansible_check_mode
 - name: Validate the deployed Atlas health monitoring units
  tags: [atlas, monitoring]
  ansible.builtin.command:
    argv:
      - systemd-analyze
      - verify
      - atlas-health-monitor.service
      - atlas-health-monitor.timer
      - atlas-monitor-failure@.service
  changed_when: false
  when:
    - atlas_manage_monitoring | bool
    - not ansible_check_mode
 - name: Probe Atlas health without sending notifications
  tags: [atlas, monitoring]
  ansible.builtin.command:
    argv: [/usr/local/libexec/atlas-health-monitor, --dry-run]
  register: atlas_monitor_dry_run
  changed_when: false
  when:
    - atlas_manage_monitoring | bool
    - not ansible_check_mode
--- a/ansible/roles/profile_atlas/tasks/pool.yml
+++ b/ansible/roles/profile_atlas/tasks/pool.yml
@@ -0,0 +1,57 @@
 ---
 - name: Bootstrap Atlas ZFS pool
  tags: [atlas, storage, pool]
  when: atlas_create_pool | bool
  block:
    - name: Validate Atlas pool bootstrap inputs
      ansible.builtin.assert:
        that:
          - atlas_zpool_disks | length == 4
          - atlas_zpool_disks | unique | length == 4
          - atlas_zpool_disks | select('match', '^/dev/disk/by-id/') | list | length == 4
        fail_msg: >-
          Set exactly four distinct persistent /dev/disk/by-id paths in
          atlas_zpool_disks before creating the RAIDZ2 pool.
    - name: Inspect declared Atlas pool disks
      ansible.builtin.stat:
        path: "{{ item }}"
        follow: true
      loop: "{{ atlas_zpool_disks }}"
      loop_control:
        label: "{{ item }}"
      register: atlas_zpool_disk_stats
    - name: Require every declared Atlas pool disk
      ansible.builtin.assert:
        that:
          - item.stat.exists
          - item.stat.isblk | default(false)
        fail_msg: "Declared Atlas pool disk is unavailable or is not a block device: {{ item.item }}"
      loop: "{{ atlas_zpool_disk_stats.results }}"
      loop_control:
        label: "{{ item.item }}"
    - name: Check whether the Atlas ZFS pool already exists
      ansible.builtin.command:
        argv:
          - zpool
          - list
          - -H
          - -o
          - name
          - "{{ atlas_zfs_pool }}"
      register: atlas_zpool_bootstrap_check
      changed_when: false
      failed_when: atlas_zpool_bootstrap_check.rc not in [0, 1]
    - name: Create the Atlas RAIDZ2 pool when absent
      community.general.zpool:
        name: "{{ atlas_zfs_pool }}"
        state: present
        mountpoint: "{{ atlas_mount_root }}"
        force: false
        vdevs:
          - type: raidz2
            disks: "{{ atlas_zpool_disks }}"
      when: atlas_zpool_bootstrap_check.rc == 1
--- a/ansible/roles/profile_atlas/tasks/restorecon.yml
+++ b/ansible/roles/profile_atlas/tasks/restorecon.yml
@@ -0,0 +1,27 @@
 ---
 - name: Validate requested Atlas post-restore relabel paths
  tags: [atlas, restorecon, recovery]
  ansible.builtin.assert:
    that:
      - item is string
      - item.startswith(atlas_mount_root ~ '/')
      - item != atlas_mount_root
    fail_msg: >-
      Post-restore relabeling accepts only explicit paths below the Atlas pool
      mount root. Do not relabel the whole pool during routine provisioning.
  loop: "{{ atlas_restorecon_paths }}"
  when: atlas_restorecon_paths | length > 0
 - name: Restore SELinux labels on explicitly restored Atlas paths
  tags: [atlas, restorecon, recovery]
  ansible.builtin.command:
    argv:
      - restorecon
      - -RFv
      - "{{ item }}"
  register: atlas_restorecon_result
  changed_when: atlas_restorecon_result.stdout | length > 0
  loop: "{{ atlas_restorecon_paths }}"
  when:
    - atlas_restorecon_paths | length > 0
    - not ansible_check_mode
--- a/ansible/roles/profile_atlas/tasks/samba_account.yml
+++ b/ansible/roles/profile_atlas/tasks/samba_account.yml
@@ -0,0 +1,64 @@
 ---
 - name: Require an existing Unix account for Atlas Samba
  ansible.builtin.getent:
    database: passwd
    key: "{{ atlas_samba_account.username }}"
 - name: Read Atlas Samba account
  ansible.builtin.command:
    argv:
      - pdbedit
      - --list
      - --user
      - "{{ atlas_samba_account.username }}"
  register: atlas_samba_account_check
  changed_when: false
  failed_when: false
 - name: Check Atlas Samba password marker
  ansible.builtin.stat:
    path: "{{ atlas_samba_password_marker_dir }}/{{ atlas_samba_account.username }}.sha256"
  register: atlas_samba_password_marker_stat
 - name: Read Atlas Samba password marker
  ansible.builtin.slurp:
    src: "{{ atlas_samba_password_marker_dir }}/{{ atlas_samba_account.username }}.sha256"
  register: atlas_samba_password_marker_content
  no_log: true
  when: atlas_samba_password_marker_stat.stat.exists
 - name: Determine whether Atlas Samba credentials must change
  ansible.builtin.set_fact:
    atlas_samba_password_digest: "{{ atlas_samba_account.password | hash('sha256') }}"
    atlas_samba_password_update_required: >-
      {{
        atlas_samba_account_check.rc != 0
        or not atlas_samba_password_marker_stat.stat.exists
        or (
          atlas_samba_password_marker_content.content | default('')
          | b64decode | trim
        ) != (atlas_samba_account.password | hash('sha256'))
      }}
  no_log: true
 - name: Set Atlas Samba account password
  ansible.builtin.command:
    argv:
      - smbpasswd
      - -s
      - -a
      - "{{ atlas_samba_account.username }}"
    stdin: "{{ atlas_samba_account.password }}\n{{ atlas_samba_account.password }}"
  changed_when: true
  no_log: true
  when: atlas_samba_password_update_required | bool
 - name: Record managed Atlas Samba password digest
  ansible.builtin.copy:
    content: "{{ atlas_samba_password_digest }}\n"
    dest: "{{ atlas_samba_password_marker_dir }}/{{ atlas_samba_account.username }}.sha256"
    owner: root
    group: root
    mode: "0600"
  no_log: true
  when: atlas_samba_password_update_required | bool
--- a/ansible/roles/profile_atlas/tasks/sharing.yml
+++ b/ansible/roles/profile_atlas/tasks/sharing.yml
@@ -1,187 +1,12 @@
 ---
 - name: Render Atlas NFS exports
  tags: [atlas, sharing]
  ansible.builtin.template:
    src: atlas.exports.j2
    dest: /etc/exports.d/atlas.exports
    owner: root
    group: root
    mode: "0644"
  notify: Reload NFS exports
  when: atlas_manage_storage | bool
 - name: Configure Atlas NFSv4-only service
  tags: [atlas, sharing]
  ansible.builtin.template:
    src: atlas-nfs.conf.j2
    dest: /etc/nfs.conf.d/atlas.conf
    owner: root
    group: root
    mode: "0644"
  notify: Restart NFS server
  when: atlas_manage_storage | bool
 - name: Mask Atlas NFSv3 RPC services
  tags: [atlas, sharing, services]
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: false
    state: stopped
    masked: true
  loop:
    - rpc-statd.service
    - rpcbind.service
    - rpcbind.socket
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_storage | bool
 - name: Ensure Atlas NFS mount daemon drop-in directory exists
  tags: [atlas, sharing, services]
  ansible.builtin.file:
    path: /etc/systemd/system/nfs-mountd.service.d
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: atlas_manage_storage | bool
 - name: Disable Atlas NFSv3 mount daemon listeners
  tags: [atlas, sharing, services]
  ansible.builtin.template:
    src: nfs-mountd-v4only.conf.j2
    dest: /etc/systemd/system/nfs-mountd.service.d/v4only.conf
    owner: root
    group: root
    mode: "0644"
  notify: Restart NFS mount daemon
  when: atlas_manage_storage | bool
 - name: Enable SELinux access for Atlas file sharing
  tags: [atlas, sharing, services]
  ansible.posix.seboolean:
    name: "{{ item }}"
    state: true
    persistent: true
  loop: "{{ atlas_selinux_booleans }}"
  loop_control:
    label: "{{ item }}"
  when:
    - atlas_manage_storage | bool
    - (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'
 - name: Render Atlas Samba configuration
  tags: [atlas, sharing]
  ansible.builtin.template:
    src: smb.conf.j2
    dest: /etc/samba/smb.conf
    owner: root
    group: root
    mode: "0644"
    validate: "testparm --suppress-prompt %s"
  notify: Restart Samba service
  when: atlas_manage_storage | bool
 - name: Require Atlas Samba password
  tags: [atlas, sharing]
  ansible.builtin.assert:
    that:
      - atlas_samba_password | length > 0
    fail_msg: Define vault_atlas_samba_password before enabling Atlas storage.
  no_log: true
  when: atlas_manage_storage | bool
 - name: Read Atlas Samba account
  tags: [atlas, sharing]
  ansible.builtin.command:
    argv:
      - pdbedit
      - --list
      - --user
      - "{{ atlas_admin_username }}"
  register: atlas_samba_account
  changed_when: false
  failed_when: false
  when: atlas_manage_storage | bool
 - name: Ensure Atlas Samba private state directory exists
  tags: [atlas, sharing]
  ansible.builtin.file:
    path: "{{ atlas_samba_password_marker | dirname }}"
    state: directory
    owner: root
    group: root
    mode: "0700"
  when: atlas_manage_storage | bool
 - name: Check Atlas Samba password marker
  tags: [atlas, sharing]
  ansible.builtin.stat:
    path: "{{ atlas_samba_password_marker }}"
  register: atlas_samba_password_marker_stat
  when: atlas_manage_storage | bool
 - name: Read Atlas Samba password marker
  tags: [atlas, sharing]
  ansible.builtin.slurp:
    src: "{{ atlas_samba_password_marker }}"
  register: atlas_samba_password_marker_content
  no_log: true
  when:
    - atlas_manage_storage | bool
    - atlas_samba_password_marker_stat.stat.exists
 - name: Determine whether Atlas Samba credentials must change
  tags: [atlas, sharing]
  ansible.builtin.set_fact:
    atlas_samba_password_digest: "{{ atlas_samba_password | hash('sha256') }}"
    atlas_samba_password_update_required: >-
      {{
        atlas_samba_account.rc != 0
        or not atlas_samba_password_marker_stat.stat.exists
        or (
          atlas_samba_password_marker_content.content | default('')
          | b64decode | trim
        ) != (atlas_samba_password | hash('sha256'))
      }}
  no_log: true
  when: atlas_manage_storage | bool
 - name: Set Atlas Samba account password
  tags: [atlas, sharing]
  ansible.builtin.command:
    argv:
      - smbpasswd
      - -s
      - -a
      - "{{ atlas_admin_username }}"
    stdin: "{{ atlas_samba_password }}\n{{ atlas_samba_password }}"
  changed_when: true
  no_log: true
  when:
    - atlas_manage_storage | bool
    - atlas_samba_password_update_required | bool
 - name: Record managed Atlas Samba password digest
  tags: [atlas, sharing]
  ansible.builtin.copy:
    content: "{{ atlas_samba_password_digest }}\n"
    dest: "{{ atlas_samba_password_marker }}"
    owner: root
    group: root
    mode: "0600"
  no_log: true
  when:
    - atlas_manage_storage | bool
    - atlas_samba_password_update_required | bool
 - name: Require completed Atlas firewall placeholders
  tags: [atlas, sharing, services]
  ansible.builtin.assert:
    that:
      - atlas_lan_subnet != 'CHANGEME_LAN_SUBNET'
      - atlas_aegis_ip != 'CHANGEME_AEGIS_IP'
      - atlas_firewalld_zone | length > 0
-    fail_msg: Replace the Atlas LAN subnet and firewall zone placeholders.
+      - ansible_facts.default_ipv4.interface | default('') | length > 0
    fail_msg: Replace the Atlas LAN, Aegis and firewall-zone placeholders.
  when: atlas_manage_firewall | bool
 - name: Apply Atlas firewalld rich rules
@@ -197,6 +22,16 @@
    label: "{{ item }}"
  when: atlas_manage_firewall | bool
 - name: Assign primary Atlas LAN interface to managed firewalld zone
  tags: [atlas, sharing, services]
  ansible.posix.firewalld:
    interface: "{{ ansible_facts.default_ipv4.interface }}"
    zone: "{{ atlas_firewalld_zone }}"
    state: enabled
    permanent: true
    immediate: true
  when: atlas_manage_firewall | bool
 - name: Remove unrestricted Atlas services from firewalld zone
  tags: [atlas, sharing, services]
  ansible.posix.firewalld:
@@ -209,3 +44,228 @@
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_firewall | bool
 - name: Render Atlas NFS exports
  tags: [atlas, sharing]
  ansible.builtin.template:
    src: atlas.exports.j2
    dest: /etc/exports.d/atlas.exports
    owner: root
    group: root
    mode: "0644"
  notify: Reload NFS exports
  when: atlas_manage_sharing | bool
 - name: Ensure Atlas NFS configuration drop-in directory exists
  tags: [atlas, sharing]
  ansible.builtin.file:
    path: /etc/nfs.conf.d
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: atlas_manage_sharing | bool
 - name: Configure Atlas NFSv4-only service
  tags: [atlas, sharing]
  ansible.builtin.template:
    src: atlas-nfs.conf.j2
    dest: /etc/nfs.conf.d/atlas.conf
    owner: root
    group: root
    mode: "0644"
  notify: Restart NFS server
  when: atlas_manage_sharing | bool
 - name: Mask Atlas NFSv3 RPC services
  tags: [atlas, sharing, services]
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: false
    state: stopped
    masked: true
  loop:
    - rpc-statd.service
    - rpcbind.service
    - rpcbind.socket
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_sharing | bool
 - name: Ensure Atlas NFS mount daemon drop-in directory exists
  tags: [atlas, sharing, services]
  ansible.builtin.file:
    path: /etc/systemd/system/nfs-mountd.service.d
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: atlas_manage_sharing | bool
 - name: Disable Atlas NFSv3 mount daemon listeners
  tags: [atlas, sharing, services]
  ansible.builtin.template:
    src: nfs-mountd-v4only.conf.j2
    dest: /etc/systemd/system/nfs-mountd.service.d/v4only.conf
    owner: root
    group: root
    mode: "0644"
  notify: Restart NFS mount daemon
  when: atlas_manage_sharing | bool
 - name: Enable SELinux access for Atlas file sharing
  tags: [atlas, sharing, services]
  ansible.posix.seboolean:
    name: "{{ item }}"
    state: true
    persistent: true
  loop: "{{ atlas_selinux_booleans }}"
  loop_control:
    label: "{{ item }}"
  when:
    - atlas_manage_sharing | bool
    - (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'
 - name: Render Atlas Samba configuration
  tags: [atlas, sharing]
  ansible.builtin.template:
    src: smb.conf.j2
    dest: /etc/samba/smb.conf
    owner: root
    group: root
    mode: "0644"
    validate: "testparm --suppress-prompt %s"
  notify: Restart Samba service
  when: atlas_manage_sharing | bool
 - name: Require Vault-backed Atlas Samba accounts
  tags: [atlas, sharing]
  ansible.builtin.assert:
    that:
      - atlas_samba_encryption in ['required', 'desired']
      - atlas_samba_accounts | length > 0
      - >-
        atlas_samba_accounts | map(attribute='username') | list
        | difference(atlas_samba_valid_users) | length == 0
      - >-
        atlas_samba_valid_users
        | difference(atlas_samba_accounts | map(attribute='username') | list) | length == 0
      - atlas_samba_accounts | selectattr('password', 'equalto', '') | list | length == 0
    fail_msg: Define every authorized Samba account and its Vault-backed password.
  no_log: true
  when: atlas_manage_sharing | bool
 - name: Ensure Atlas Samba private state directory exists
  tags: [atlas, sharing]
  ansible.builtin.file:
    path: "{{ atlas_samba_password_marker_dir }}"
    state: directory
    owner: root
    group: root
    mode: "0700"
  when: atlas_manage_sharing | bool
 - name: Manage Vault-backed Atlas Samba credentials
  tags: [atlas, sharing]
  ansible.builtin.include_tasks: samba_account.yml
  loop: "{{ atlas_samba_accounts }}"
  loop_control:
    loop_var: atlas_samba_account
    label: "{{ atlas_samba_account.username }}"
  no_log: true
  when: atlas_manage_sharing | bool
 - name: Enable Atlas file-sharing services
  tags: [atlas, sharing, services]
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: true
    state: started
  loop:
    - nfs-server.service
    - smb.service
  loop_control:
    label: "{{ item }}"
  when: atlas_manage_sharing | bool
 - name: Gather effective Atlas firewalld zone configuration
  tags: [atlas, sharing, services, security]
  ansible.posix.firewalld_info:
    zones:
      - "{{ atlas_firewalld_zone }}"
  register: atlas_firewalld_info
  when:
    - atlas_manage_firewall | bool
    - not ansible_check_mode
 - name: Verify effective Atlas firewalld restrictions
  tags: [atlas, sharing, services, security]
  ansible.builtin.assert:
    that:
      - atlas_firewalld_zone in atlas_firewalld_info.firewalld_info.zones
      - >-
        ansible_facts.default_ipv4.interface
        in atlas_firewalld_info.firewalld_info.zones[atlas_firewalld_zone].interfaces
      - >-
        atlas_firewalld_restricted_services
        | intersect(atlas_firewalld_info.firewalld_info.zones[atlas_firewalld_zone].services)
        | length == 0
    fail_msg: >-
      The effective Atlas firewalld zone does not restrict the primary LAN
      interface and unmanaged service exposure as declared.
  when:
    - atlas_manage_firewall | bool
    - not ansible_check_mode
 - name: Apply pending Atlas sharing handlers before verification
  tags: [atlas, sharing, services, security]
  ansible.builtin.meta: flush_handlers
  when:
    - atlas_manage_sharing | bool
    - not ansible_check_mode
 - name: Check active Atlas file-sharing services
  tags: [atlas, sharing, services, security]
  ansible.builtin.command:
    argv:
      - systemctl
      - is-active
      - --quiet
      - "{{ item }}"
  loop:
    - nfs-server.service
    - smb.service
  loop_control:
    label: "{{ item }}"
  register: atlas_file_sharing_service_activity
  changed_when: false
  failed_when: false
  when:
    - atlas_manage_sharing | bool
    - not ansible_check_mode
 - name: Require active Atlas file-sharing services
  tags: [atlas, sharing, services, security]
  ansible.builtin.assert:
    that:
      - atlas_file_sharing_service_activity.results | map(attribute='rc') | list == [0, 0]
    fail_msg: Atlas NFSv4 or SMB3 did not start after its managed configuration was applied.
  when:
    - atlas_manage_sharing | bool
    - not ansible_check_mode
 - name: Require Atlas file-sharing TCP listeners
  tags: [atlas, sharing, services, security]
  ansible.builtin.wait_for:
    host: 127.0.0.1
    port: "{{ item }}"
    state: started
    timeout: 15
  loop:
    - 2049
    - 445
  loop_control:
    label: "{{ item }}/tcp"
  when:
    - atlas_manage_sharing | bool
    - not ansible_check_mode
--- a/ansible/roles/profile_atlas/tasks/storage.yml
+++ b/ansible/roles/profile_atlas/tasks/storage.yml
@@ -3,14 +3,84 @@
  tags: [atlas, storage]
  ansible.builtin.set_fact:
    atlas_zfs_datasets:
-      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_work }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_archive }}"
-        mountpoint: "{{ atlas_work_mountpoint }}"
+        mountpoint: "{{ atlas_archive_mountpoint }}"
        owner: "{{ atlas_admin_username }}"
        group: "{{ atlas_admin_group }}"
        properties:
          compression: zstd
          mountpoint: "{{ atlas_archive_mountpoint }}"
      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_services }}"
        mountpoint: "{{ atlas_services_mountpoint }}"
        owner: "{{ atlas_admin_username }}"
        group: "{{ atlas_admin_group }}"
        properties:
          compression: zstd
          mountpoint: "{{ atlas_services_mountpoint }}"
      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_app_data }}"
        mountpoint: "{{ atlas_app_data_mountpoint }}"
        owner: "{{ atlas_admin_username }}"
        group: "{{ atlas_admin_group }}"
        properties:
          compression: zstd
          mountpoint: "{{ atlas_app_data_mountpoint }}"
      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_navidrome }}"
        mountpoint: "{{ atlas_navidrome_mountpoint }}"
        owner: "{{ atlas_admin_username }}"
        group: "{{ atlas_admin_group }}"
        properties:
          compression: zstd
          mountpoint: "{{ atlas_navidrome_mountpoint }}"
      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_syncthing }}"
        mountpoint: "{{ atlas_syncthing_mountpoint }}"
        owner: "{{ atlas_admin_username }}"
        group: "{{ atlas_admin_group }}"
        properties:
          compression: lz4
          mountpoint: "{{ atlas_syncthing_mountpoint }}"
      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_media }}"
        mountpoint: "{{ atlas_media_mountpoint }}"
        owner: "{{ atlas_admin_username }}"
        group: "{{ atlas_admin_group }}"
        properties:
          compression: lz4
          mountpoint: "{{ atlas_media_mountpoint }}"
      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_music }}"
        mountpoint: "{{ atlas_music_mountpoint }}"
        owner: "{{ atlas_admin_username }}"
        group: "{{ atlas_admin_group }}"
        properties:
          compression: lz4
          mountpoint: "{{ atlas_music_mountpoint }}"
      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_backup }}"
        mountpoint: "{{ atlas_backup_mountpoint }}"
        owner: "{{ atlas_admin_username }}"
        group: "{{ atlas_admin_group }}"
        properties:
          compression: lz4
          mountpoint: "{{ atlas_backup_mountpoint }}"
          reservation: "{{ atlas_zfs_backup_reservation }}"
      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_host_backups }}"
        mountpoint: "{{ atlas_host_backups_mountpoint }}"
        owner: "{{ atlas_admin_username }}"
        group: "{{ atlas_admin_group }}"
        properties:
          compression: lz4
          mountpoint: "{{ atlas_host_backups_mountpoint }}"
      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_backup_prometheus }}"
        mountpoint: "{{ atlas_backup_prometheus_mountpoint }}"
-      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_icloud_photos }}"
+        owner: "{{ atlas_admin_username }}"
-        mountpoint: "{{ atlas_icloud_photos_mountpoint }}"
+        group: "{{ atlas_admin_group }}"
        properties:
          compression: lz4
          mountpoint: "{{ atlas_backup_prometheus_mountpoint }}"
      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_photobook }}"
        mountpoint: "{{ atlas_photobook_mountpoint }}"
        owner: "{{ atlas_immich_username }}"
        group: "{{ atlas_immich_group }}"
        properties:
          compression: lz4
          mountpoint: "{{ atlas_photobook_mountpoint }}"
 - name: Require completed Atlas storage placeholders
  tags: [atlas, storage]
@@ -56,8 +126,7 @@
  community.general.zfs:
    name: "{{ item.name }}"
    state: present
-    extra_zfs_properties:
+    extra_zfs_properties: "{{ item.properties }}"
      mountpoint: "{{ item.mountpoint }}"
  loop: "{{ atlas_zfs_datasets }}"
  loop_control:
    label: "{{ item.name }}"
@@ -68,8 +137,8 @@
  ansible.builtin.file:
    path: "{{ item.mountpoint }}"
    state: directory
-    owner: "{{ atlas_admin_username }}"
+    owner: "{{ item.owner }}"
-    group: "{{ atlas_admin_group }}"
+    group: "{{ item.group }}"
    mode: "0770"
  loop: "{{ atlas_zfs_datasets }}"
  loop_control:
--- a/ansible/roles/profile_atlas/tasks/syncthing.yml
+++ b/ansible/roles/profile_atlas/tasks/syncthing.yml
@@ -1,40 +0,0 @@
 ---
 - name: Create Atlas Syncthing configuration directory
  tags: [atlas, syncthing]
  ansible.builtin.file:
    path: "{{ atlas_syncthing_config_dir }}"
    state: directory
    owner: "{{ atlas_admin_username }}"
    group: "{{ atlas_admin_group }}"
    mode: "0700"
  when: atlas_manage_storage | bool
 - name: Create Atlas Syncthing default data directory
  tags: [atlas, syncthing]
  ansible.builtin.file:
    path: "{{ atlas_syncthing_default_dir }}"
    state: directory
    owner: "{{ atlas_admin_username }}"
    group: "{{ atlas_admin_group }}"
    mode: "0770"
  when: atlas_manage_storage | bool
 - name: Render Atlas Syncthing systemd service
  tags: [atlas, syncthing]
  ansible.builtin.template:
    src: atlas-syncthing.service.j2
    dest: /etc/systemd/system/atlas-syncthing.service
    owner: root
    group: root
    mode: "0644"
  notify: Restart Atlas Syncthing service
  when: atlas_manage_storage | bool
 - name: Enable Atlas Syncthing service
  tags: [atlas, syncthing]
  ansible.builtin.systemd:
    name: atlas-syncthing
    enabled: true
    state: started
    daemon_reload: true
  when: atlas_manage_storage | bool
--- a/ansible/roles/profile_atlas/tasks/usb_backup.yml
+++ b/ansible/roles/profile_atlas/tasks/usb_backup.yml
@@ -0,0 +1,145 @@
 ---
 - name: Validate Atlas offline USB backup configuration
  tags: [atlas, storage, backup, usb_backup]
  ansible.builtin.assert:
    that:
      - atlas_manage_storage | bool
      - atlas_zfs_pool != 'CHANGEME_ZFS_POOL'
      - atlas_mount_root.startswith('/')
      - atlas_usb_backup_luks_uuid is match('^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$')
      - atlas_usb_backup_fs_uuid is match('^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$')
      - atlas_usb_backup_luks_uuid != atlas_usb_backup_fs_uuid
      - atlas_usb_backup_mapper_name is match('^[a-z][a-z0-9_-]*$')
      - atlas_usb_backup_min_free_bytes | int > 0
      - atlas_usb_backup_snapshot_prefix is match('^[a-z0-9][a-z0-9_-]*$')
      - atlas_usb_backup_snapshot_prefix != atlas_borg_snapshot_prefix
      - atlas_usb_backup_snapshot_prefix != atlas_zfs_snapshot_prefix
    fail_msg: >-
      The manual Atlas USB backup needs verified LUKS and ext4 UUIDs, a safe
      mapper name, positive free-space reserve, and a unique snapshot prefix.
  when: atlas_manage_usb_backup | bool
 - name: Install rsync for the Atlas offline USB backup
  tags: [atlas, storage, backup, usb_backup]
  ansible.builtin.dnf:
    name: rsync
    state: present
  when: atlas_manage_usb_backup | bool
 - name: Install the manual Atlas offline USB backup helper
  tags: [atlas, storage, backup, usb_backup]
  ansible.builtin.template:
    src: atlas-usb-backup.sh.j2
    dest: /usr/local/sbin/atlas-usb-backup
    owner: root
    group: root
    mode: "0750"
  when: atlas_manage_usb_backup | bool
 - name: Install the Atlas USB snapshot cleanup helper
  tags: [atlas, storage, backup, usb_backup]
  ansible.builtin.template:
    src: atlas-usb-snapshot-cleanup.sh.j2
    dest: /usr/local/sbin/atlas-usb-snapshot-cleanup
    owner: root
    group: root
    mode: "0750"
  when: atlas_manage_usb_backup | bool
 - name: Install the manual Atlas offline USB backup service
  tags: [atlas, storage, backup, usb_backup]
  ansible.builtin.template:
    src: atlas-usb-backup.service.j2
    dest: /etc/systemd/system/atlas-usb-backup.service
    owner: root
    group: root
    mode: "0644"
  when: atlas_manage_usb_backup | bool
 - name: Reload systemd for the Atlas offline USB backup service
  tags: [atlas, storage, backup, usb_backup]
  ansible.builtin.systemd:
    daemon_reload: true
  when:
    - atlas_manage_usb_backup | bool
    - not ansible_check_mode
 - name: Validate the 45Drives Atlas USB reminder configuration
  tags: [atlas, backup, usb_reminder]
  ansible.builtin.assert:
    that:
      - atlas_manage_usb_backup | bool
      - atlas_usb_reminder_calendar | length > 0
      - atlas_usb_reminder_notifier.startswith('/opt/45drives/houston/')
    fail_msg: >-
      Enable the manual USB backup and declare a systemd calendar before
      enabling its 45Drives Alerts reminder.
  when: atlas_manage_usb_reminder | bool
 - name: Validate the Atlas USB reminder calendar
  tags: [atlas, backup, usb_reminder]
  ansible.builtin.command:
    argv:
      - systemd-analyze
      - calendar
      - "{{ atlas_usb_reminder_calendar }}"
  changed_when: false
  check_mode: false
  when: atlas_manage_usb_reminder | bool
 - name: Inspect the existing 45Drives notifier
  tags: [atlas, backup, usb_reminder]
  ansible.builtin.stat:
    path: "{{ atlas_usb_reminder_notifier }}"
  register: atlas_usb_reminder_notifier_file
  when: atlas_manage_usb_reminder | bool
 - name: Require the configured 45Drives notifier for USB reminders
  tags: [atlas, backup, usb_reminder]
  ansible.builtin.assert:
    that:
      - atlas_usb_reminder_notifier_file.stat.executable | default(false)
    fail_msg: >-
      The existing 45Drives Houston notifier must be executable.
  when: atlas_manage_usb_reminder | bool
 - name: Install the 45Drives Atlas USB reminder helper
  tags: [atlas, backup, usb_reminder]
  ansible.builtin.template:
    src: atlas-usb-reminder.py.j2
    dest: /usr/local/libexec/atlas-usb-reminder
    owner: root
    group: root
    mode: "0750"
  when: atlas_manage_usb_reminder | bool
 - name: Install the 45Drives Atlas USB reminder service
  tags: [atlas, backup, usb_reminder]
  ansible.builtin.template:
    src: atlas-usb-reminder.service.j2
    dest: /etc/systemd/system/atlas-usb-reminder.service
    owner: root
    group: root
    mode: "0644"
  when: atlas_manage_usb_reminder | bool
 - name: Install the 45Drives Atlas USB reminder timer
  tags: [atlas, backup, usb_reminder]
  ansible.builtin.template:
    src: atlas-usb-reminder.timer.j2
    dest: /etc/systemd/system/atlas-usb-reminder.timer
    owner: root
    group: root
    mode: "0644"
  when: atlas_manage_usb_reminder | bool
 - name: Enable only the Atlas USB notification reminder timer
  tags: [atlas, backup, usb_reminder]
  ansible.builtin.systemd:
    name: atlas-usb-reminder.timer
    enabled: true
    state: started
    daemon_reload: true
  when:
    - atlas_manage_usb_reminder | bool
    - not ansible_check_mode
--- a/ansible/roles/profile_atlas/tasks/zfs_maintenance.yml
+++ b/ansible/roles/profile_atlas/tasks/zfs_maintenance.yml
@@ -0,0 +1,175 @@
 ---
 - name: Validate Atlas ZFS snapshot policy
  tags: [atlas, storage, snapshots]
  ansible.builtin.assert:
    that:
      - atlas_manage_storage | bool
      - atlas_zfs_pool != 'CHANGEME_ZFS_POOL'
      - atlas_zfs_snapshot_prefix is match('^[a-z0-9][a-z0-9_-]*$')
      - atlas_zfs_snapshot_policies | length > 0
      - >-
        (atlas_zfs_snapshot_policies | map(attribute='name') | unique | list | length)
        == (atlas_zfs_snapshot_policies | length)
    fail_msg: >-
      Enable Atlas storage and declare a non-empty snapshot policy with a safe
      prefix and unique policy names before managing automatic snapshots.
  when: atlas_manage_zfs_snapshots | bool
 - name: Validate Atlas ZFS snapshot policy entries
  tags: [atlas, storage, snapshots]
  ansible.builtin.assert:
    that:
      - item.name is match('^[a-z][a-z0-9_-]*$')
      - item.keep | int > 0
      - item.calendar | length > 0
    fail_msg: >-
      Every Atlas snapshot policy needs a safe name, a positive retention
      count, and a systemd calendar expression.
  loop: "{{ atlas_zfs_snapshot_policies }}"
  loop_control:
    label: "{{ item.name | default('unnamed') }}"
  when: atlas_manage_zfs_snapshots | bool
 - name: Validate Atlas ZFS snapshot calendars
  tags: [atlas, storage, snapshots]
  ansible.builtin.command:
    argv:
      - systemd-analyze
      - calendar
      - "{{ item.calendar }}"
  loop: "{{ atlas_zfs_snapshot_policies }}"
  loop_control:
    label: "{{ item.name }}: {{ item.calendar }}"
  changed_when: false
  check_mode: false
  when: atlas_manage_zfs_snapshots | bool
 - name: Install Atlas ZFS snapshot and retention helper
  tags: [atlas, storage, snapshots]
  ansible.builtin.template:
    src: atlas-zfs-snapshot.sh.j2
    dest: /usr/local/sbin/atlas-zfs-snapshot
    owner: root
    group: root
    mode: "0750"
  when: atlas_manage_zfs_snapshots | bool
 - name: Install Atlas ZFS snapshot systemd service
  tags: [atlas, storage, snapshots]
  ansible.builtin.template:
    src: atlas-zfs-snapshot@.service.j2
    dest: /etc/systemd/system/atlas-zfs-snapshot@.service
    owner: root
    group: root
    mode: "0644"
  when: atlas_manage_zfs_snapshots | bool
 - name: Install Atlas ZFS snapshot systemd timers
  tags: [atlas, storage, snapshots]
  ansible.builtin.template:
    src: atlas-zfs-snapshot.timer.j2
    dest: "/etc/systemd/system/atlas-zfs-snapshot-{{ item.name }}.timer"
    owner: root
    group: root
    mode: "0644"
  loop: "{{ atlas_zfs_snapshot_policies }}"
  loop_control:
    label: "{{ item.name }}"
  when: atlas_manage_zfs_snapshots | bool
 - name: Enable Atlas ZFS snapshot systemd timers
  tags: [atlas, storage, snapshots]
  ansible.builtin.systemd:
    name: "atlas-zfs-snapshot-{{ item.name }}.timer"
    enabled: true
    state: started
    daemon_reload: true
  loop: "{{ atlas_zfs_snapshot_policies }}"
  loop_control:
    label: "{{ item.name }}"
  when:
    - atlas_manage_zfs_snapshots | bool
    - not ansible_check_mode
 - name: Validate Atlas ZFS scrub policy
  tags: [atlas, storage, scrub]
  ansible.builtin.assert:
    that:
      - atlas_manage_storage | bool
      - atlas_zfs_pool != 'CHANGEME_ZFS_POOL'
      - atlas_zfs_scrub_calendar | length > 0
    fail_msg: >-
      Enable Atlas storage and declare a systemd calendar expression before
      managing periodic ZFS scrubs.
  when: atlas_manage_zfs_scrub | bool
 - name: Validate Atlas ZFS scrub calendar
  tags: [atlas, storage, scrub]
  ansible.builtin.command:
    argv:
      - systemd-analyze
      - calendar
      - "{{ atlas_zfs_scrub_calendar }}"
  changed_when: false
  check_mode: false
  when: atlas_manage_zfs_scrub | bool
 - name: Require OpenZFS scrub systemd units
  tags: [atlas, storage, scrub]
  ansible.builtin.command:
    argv:
      - systemctl
      - cat
      - "{{ item }}"
  loop:
    - "zfs-scrub@{{ atlas_zfs_pool }}.service"
    - "zfs-scrub-monthly@{{ atlas_zfs_pool }}.timer"
    - "zfs-scrub-weekly@{{ atlas_zfs_pool }}.timer"
  loop_control:
    label: "{{ item }}"
  changed_when: false
  check_mode: false
  when: atlas_manage_zfs_scrub | bool
 - name: Create Atlas ZFS scrub timer override directory
  tags: [atlas, storage, scrub]
  ansible.builtin.file:
    path: "/etc/systemd/system/zfs-scrub-monthly@{{ atlas_zfs_pool }}.timer.d"
    state: directory
    owner: root
    group: root
    mode: "0755"
  when: atlas_manage_zfs_scrub | bool
 - name: Configure Atlas ZFS monthly scrub schedule
  tags: [atlas, storage, scrub]
  ansible.builtin.template:
    src: atlas-zfs-scrub-timer.conf.j2
    dest: >-
      /etc/systemd/system/zfs-scrub-monthly@{{ atlas_zfs_pool }}.timer.d/override.conf
    owner: root
    group: root
    mode: "0644"
  when: atlas_manage_zfs_scrub | bool
 - name: Disable the conflicting weekly OpenZFS scrub timer
  tags: [atlas, storage, scrub]
  ansible.builtin.systemd:
    name: "zfs-scrub-weekly@{{ atlas_zfs_pool }}.timer"
    enabled: false
    state: stopped
    daemon_reload: true
  when:
    - atlas_manage_zfs_scrub | bool
    - not ansible_check_mode
 - name: Enable the Atlas monthly OpenZFS scrub timer
  tags: [atlas, storage, scrub]
  ansible.builtin.systemd:
    name: "zfs-scrub-monthly@{{ atlas_zfs_pool }}.timer"
    enabled: true
    state: started
    daemon_reload: true
  when:
    - atlas_manage_zfs_scrub | bool
    - not ansible_check_mode
--- a/ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2
+++ b/ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2
@@ -3,4 +3,22 @@ PermitRootLogin no
 PubkeyAuthentication yes
 PasswordAuthentication no
 KbdInteractiveAuthentication no
 AuthenticationMethods publickey
 AuthorizedKeysFile {{
  atlas_admin_ssh_keys
  | map(attribute='name')
  | map('regex_replace', '^', '%h/.ssh/authorized_keys.d/')
  | join(' ')
 }}
 X11Forwarding no
 AllowTcpForwarding {{ atlas_ssh_allow_tcp_forwarding }}
 AllowAgentForwarding no
 GatewayPorts no
 PermitTunnel no
 PermitUserEnvironment no
 MaxAuthTries 3
 LoginGraceTime 30
 ClientAliveInterval 300
 ClientAliveCountMax 2
 LogLevel VERBOSE
 AllowUsers {{ atlas_admin_username }}
--- a/ansible/roles/profile_atlas/templates/atlas-borg-backup.service.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-borg-backup.service.j2
@@ -0,0 +1,41 @@
 [Unit]
 Description=Back up Atlas ZFS datasets to the encrypted Borg repository
 Documentation=man:borg-create(1) man:borg-prune(1) man:borg-compact(1)
 Requires=zfs.target
 Wants=network-online.target
 After=zfs.target network-online.target
 StartLimitIntervalSec=6h
 StartLimitBurst=3
 ConditionFileIsExecutable=/usr/local/sbin/atlas-borg-backup
 ConditionPathExists={{ atlas_borg_passphrase_path }}
 ConditionPathExists={{ atlas_borg_ssh_private_key_path }}
 ConditionPathExists={{ atlas_borg_known_hosts_path }}
 [Service]
 Type=oneshot
 ExecStart=/usr/local/sbin/atlas-borg-backup
 ExecStopPost=+/usr/local/sbin/atlas-borg-snapshot-cleanup
 User=root
 Group=root
 UMask=0077
 SuccessExitStatus=1
 Restart=on-failure
 RestartSec=30m
 TimeoutStartSec=infinity
 RuntimeDirectory=atlas-borg
 RuntimeDirectoryMode=0750
 Nice=15
 IOSchedulingClass=best-effort
 IOSchedulingPriority=7
 NoNewPrivileges=true
 PrivateMounts=true
 PrivateTmp=true
 ProtectHome=true
 ProtectSystem=strict
 ReadWritePaths={{ atlas_borg_cache_dir }} {{ atlas_borg_config_dir }} /run/atlas-borg /run/lock
 ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectControlGroups=true
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 RestrictRealtime=true
 LockPersonality=true
--- a/ansible/roles/profile_atlas/templates/atlas-borg-backup.sh.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-borg-backup.sh.j2
@@ -0,0 +1,212 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 export LC_ALL=C.utf8
 export PATH=/usr/sbin:/usr/bin:/sbin:/bin
 export BORG_CACHE_DIR={{ atlas_borg_cache_dir | quote }}
 export BORG_CONFIG_DIR={{ atlas_borg_config_dir | quote }}
 export BORG_PASSCOMMAND={{ ('cat ' ~ atlas_borg_passphrase_path) | quote }}
 export BORG_RSH={{ atlas_borg_ssh_wrapper_path | quote }}
 readonly pool={{ atlas_zfs_pool | quote }}
 readonly mount_root={{ atlas_mount_root | quote }}
 readonly repository={{ ('ssh://' ~ atlas_borg_repository_user ~ '@' ~ atlas_borg_repository_host
  ~ ':' ~ (atlas_borg_repository_port | string) ~ '/' ~ atlas_borg_repository_path) | quote }}
 readonly remote_path={{ atlas_borg_remote_path | quote }}
 readonly archive_prefix={{ atlas_borg_archive_prefix | quote }}
 readonly snapshot_prefix={{ atlas_borg_snapshot_prefix | quote }}
 readonly compression={{ atlas_borg_compression | quote }}
 readonly stage=/run/atlas-borg/source
 readonly snapshot_marker=/run/atlas-borg/snapshot-name
 readonly borg_user={{ atlas_borg_username | quote }}
 readonly borg_group={{ atlas_borg_group | quote }}
 readonly borg_home={{ atlas_borg_home | quote }}
 readonly borg_lock={{ atlas_borg_lock_path | quote }}
 readonly progress_filter=/usr/local/libexec/atlas-borg-progress
 snapshot_name=""
 mounted_targets=()
 # Invoked through the EXIT trap below.
 # shellcheck disable=SC2329
 cleanup() {
  local status=$?
  local cleanup_status=0
  local index
  local source_mount_failed=false
  trap - EXIT HUP INT TERM
  set +e
 {% raw %}
  for ((index = ${#mounted_targets[@]} - 1; index >= 0; index--)); do
 {% endraw %}
    if mountpoint -q "${mounted_targets[$index]}" && ! umount -R "${mounted_targets[$index]}"; then
      printf 'Source snapshot mount cleanup failed: %s\n' "${mounted_targets[$index]}" >&2
      source_mount_failed=true
    fi
    if mountpoint -q "${mounted_targets[$index]}"; then
      printf 'Source snapshot mount is still active: %s\n' "${mounted_targets[$index]}" >&2
      source_mount_failed=true
    else
      rmdir -- "${mounted_targets[$index]}" 2>/dev/null || true
    fi
  done
  if [[ "$source_mount_failed" == false ]]; then
    if [[ -d "$stage" ]]; then
      rmdir -- "$stage" 2>/dev/null || cleanup_status=2
    fi
  else
    cleanup_status=2
    printf 'Source bind mount cleanup failed; keeping the snapshot for recovery\n' >&2
  fi
  if ((status == 0 && cleanup_status != 0)); then
    status=$cleanup_status
  fi
  exit "$status"
 }
 trap cleanup EXIT
 trap 'exit 143' HUP INT TERM
 run_as_borg() {
  setpriv \
    --reuid "$borg_user" \
    --regid "$borg_group" \
    --clear-groups \
    --inh-caps=-all,+dac_read_search \
    --ambient-caps=-all,+dac_read_search \
    --bounding-set=-all,+dac_read_search \
    -- env HOME="$borg_home" USER="$borg_user" LOGNAME="$borg_user" "$@"
 }
 exec 8>"$borg_lock"
 flock 8
 exec 9>/run/lock/atlas-zfs-snapshot.lock
 zpool list -H -o name "$pool" >/dev/null
 rm -rf "$stage"
 mkdir -p "$stage"
 chown root:"$borg_group" /run/atlas-borg "$stage"
 chmod 0750 /run/atlas-borg "$stage"
 flock 9
 while IFS= read -r stale_snapshot; do
  stale_suffix="${stale_snapshot#"${pool}@${snapshot_prefix}-"}"
  if [[ "$stale_suffix" =~ ^[0-9]{8}T[0-9]{6}Z$ ]]; then
    zfs destroy -r "$stale_snapshot"
    printf 'Removed stale Borg source snapshot %s\n' "$stale_snapshot"
  fi
 done < <(
  zfs list -H -t snapshot -o name -r "$pool" |
    grep -E "^${pool}@${snapshot_prefix}-[0-9]{8}T[0-9]{6}Z$" || true
 )
 timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
 readonly timestamp
 snapshot_name="${snapshot_prefix}-${timestamp}"
 readonly snapshot_name
 printf '%s\n' "$snapshot_name" >"$snapshot_marker"
 zfs snapshot -r "${pool}@${snapshot_name}"
 flock -u 9
 printf 'Created recursive Borg source snapshot %s@%s\n' "$pool" "$snapshot_name"
 while IFS=$'\t' read -r dataset dataset_mountpoint mounted; do
  if [[ "$mounted" != yes ]]; then
    printf 'Dataset %s is not mounted; refusing an incomplete backup\n' "$dataset" >&2
    exit 65
  fi
  if [[ "$dataset_mountpoint" != "$mount_root" && "$dataset_mountpoint" != "$mount_root/"* ]]; then
    printf 'Dataset %s has unexpected mountpoint %s\n' "$dataset" "$dataset_mountpoint" >&2
    exit 65
  fi
  dataset_suffix="${dataset#"$pool"}"
  source_path="${dataset_mountpoint}/.zfs/snapshot/${snapshot_name}"
  target_path="${stage}${dataset_suffix}"
  mkdir -p "$target_path"
  mount --bind "$source_path" "$target_path"
  mounted_targets+=("$target_path")
  mount -o remount,bind,ro "$target_path"
 done < <(zfs list -H -o name,mountpoint,mounted -s name -r "$pool")
 estimated_source_bytes=0
 while IFS=$'\t' read -r source_snapshot logical_bytes; do
  if [[ "$source_snapshot" == *"@${snapshot_name}" ]]; then
    [[ "$logical_bytes" =~ ^[0-9]+$ ]] || {
      printf 'Invalid logical size for Borg source snapshot %s\n' "$source_snapshot" >&2
      exit 74
    }
    estimated_source_bytes=$((estimated_source_bytes + logical_bytes))
  fi
 done < <(zfs list -H -p -t snapshot -o name,logicalreferenced -r "$pool")
 ((estimated_source_bytes > 0)) || {
  printf 'Could not estimate the Borg source snapshot size\n' >&2
  exit 74
 }
 printf 'Estimated Borg source logical size: %s bytes (ZFS; progress percentage is approximate)\n' \
  "$estimated_source_bytes"
 archive="${archive_prefix}-${timestamp}"
 readonly archive
 borg_status=0
 printf 'Starting Borg archive %s from snapshot %s@%s\n' "$archive" "$pool" "$snapshot_name"
 set +e
 (
  cd /run/atlas-borg
  run_as_borg borg --remote-path "$remote_path" --lock-wait 600 --log-json --progress create \
    --show-rc \
    --stats \
    --checkpoint-interval 900 \
    --compression "$compression" \
    "${repository}::${archive}" \
    source 2>&1
 ) | /usr/bin/python3 -u "$progress_filter" --estimated-total-bytes "$estimated_source_bytes"
 create_pipeline_status=("${PIPESTATUS[@]}")
 set -e
 create_status=${create_pipeline_status[0]}
 if ((create_pipeline_status[1] != 0)); then
  printf 'Borg progress logging failed with status %s\n' "${create_pipeline_status[1]}" >&2
  exit 2
 fi
 if ((create_status >= 2)); then
  exit "$create_status"
 fi
 borg_status=$create_status
 printf 'Borg archive %s created; applying retention\n' "$archive"
 set +e
 run_as_borg borg --remote-path "$remote_path" --lock-wait 600 prune \
  --show-rc \
  --list \
  --glob-archives "${archive_prefix}-*" \
  --keep-daily {{ atlas_borg_keep_daily | int }} \
  --keep-weekly {{ atlas_borg_keep_weekly | int }} \
  --keep-monthly {{ atlas_borg_keep_monthly | int }} \
  "$repository"
 prune_status=$?
 set -e
 if ((prune_status >= 2)); then
  exit "$prune_status"
 fi
 if ((prune_status > borg_status)); then
  borg_status=$prune_status
 fi
 printf 'Borg retention complete; compacting repository\n'
 set +e
 run_as_borg borg --remote-path "$remote_path" --lock-wait 600 compact \
  --show-rc \
  "$repository"
 compact_status=$?
 set -e
 if ((compact_status >= 2)); then
  exit "$compact_status"
 fi
 if ((compact_status > borg_status)); then
  borg_status=$compact_status
 fi
 printf 'Borg backup %s completed with status %s\n' "$archive" "$borg_status"
 exit "$borg_status"
--- a/ansible/roles/profile_atlas/templates/atlas-borg-backup.timer.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-borg-backup.timer.j2
@@ -0,0 +1,12 @@
 [Unit]
 Description=Schedule the encrypted Atlas Borg backup
 [Timer]
 OnCalendar={{ atlas_borg_backup_calendar }}
 Persistent=true
 RandomizedDelaySec={{ atlas_borg_randomized_delay }}
 AccuracySec=1min
 Unit=atlas-borg-backup.service
 [Install]
 WantedBy=timers.target
--- a/ansible/roles/profile_atlas/templates/atlas-borg-check.service.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-borg-check.service.j2
@@ -0,0 +1,32 @@
 [Unit]
 Description=Check the encrypted Atlas Borg repository
 Documentation=man:borg-check(1)
 Wants=network-online.target
 After=network-online.target atlas-borg-backup.service
 ConditionFileIsExecutable=/usr/local/sbin/atlas-borg-check
 ConditionPathExists={{ atlas_borg_passphrase_path }}
 ConditionPathExists={{ atlas_borg_ssh_private_key_path }}
 ConditionPathExists={{ atlas_borg_known_hosts_path }}
 [Service]
 Type=oneshot
 ExecStart=/usr/local/sbin/atlas-borg-check
 User={{ atlas_borg_username }}
 Group={{ atlas_borg_group }}
 UMask=0077
 SuccessExitStatus=1
 TimeoutStartSec=infinity
 Nice=15
 IOSchedulingClass=best-effort
 IOSchedulingPriority=7
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectHome=true
 ProtectSystem=strict
 ReadWritePaths={{ atlas_borg_cache_dir }} {{ atlas_borg_config_dir }}
 ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectControlGroups=true
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 RestrictRealtime=true
 LockPersonality=true
--- a/ansible/roles/profile_atlas/templates/atlas-borg-check.sh.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-borg-check.sh.j2
@@ -0,0 +1,23 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 export LC_ALL=C
 export PATH=/usr/sbin:/usr/bin:/sbin:/bin
 export BORG_CACHE_DIR={{ atlas_borg_cache_dir | quote }}
 export BORG_CONFIG_DIR={{ atlas_borg_config_dir | quote }}
 export BORG_PASSCOMMAND={{ ('cat ' ~ atlas_borg_passphrase_path) | quote }}
 export BORG_RSH={{ atlas_borg_ssh_wrapper_path | quote }}
 readonly repository={{ ('ssh://' ~ atlas_borg_repository_user ~ '@' ~ atlas_borg_repository_host
  ~ ':' ~ (atlas_borg_repository_port | string) ~ '/' ~ atlas_borg_repository_path) | quote }}
 readonly remote_path={{ atlas_borg_remote_path | quote }}
 readonly archive_prefix={{ atlas_borg_archive_prefix | quote }}
 readonly borg_lock={{ atlas_borg_lock_path | quote }}
 exec 8>"$borg_lock"
 flock 8
 exec borg --remote-path "$remote_path" --lock-wait 600 check \
  --show-rc \
  --glob-archives "${archive_prefix}-*" \
  "$repository"
--- a/ansible/roles/profile_atlas/templates/atlas-borg-check.timer.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-borg-check.timer.j2
@@ -0,0 +1,12 @@
 [Unit]
 Description=Schedule checks of the encrypted Atlas Borg repository
 [Timer]
 OnCalendar={{ atlas_borg_check_calendar }}
 Persistent=true
 RandomizedDelaySec={{ atlas_borg_randomized_delay }}
 AccuracySec=1min
 Unit=atlas-borg-check.service
 [Install]
 WantedBy=timers.target
--- a/ansible/roles/profile_atlas/templates/atlas-borg-snapshot-cleanup.sh.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-borg-snapshot-cleanup.sh.j2
@@ -0,0 +1,51 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 export PATH=/usr/sbin:/usr/bin:/sbin:/bin
 readonly pool={{ atlas_zfs_pool | quote }}
 readonly mount_root={{ atlas_mount_root | quote }}
 readonly snapshot_prefix={{ atlas_borg_snapshot_prefix | quote }}
 readonly marker=/run/atlas-borg/snapshot-name
 [[ -e "$marker" ]] || exit 0
 [[ -f "$marker" && ! -L "$marker" ]] || {
  printf 'Unsafe Atlas Borg snapshot marker; leaving snapshots unchanged\n' >&2
  exit 2
 }
 IFS= read -r snapshot_name <"$marker"
 [[ "$snapshot_name" =~ ^${snapshot_prefix}-[0-9]{8}T[0-9]{6}Z$ ]] || {
  printf 'Invalid Atlas Borg snapshot marker; leaving snapshots unchanged\n' >&2
  exit 2
 }
 exec 9>/run/lock/atlas-zfs-snapshot.lock
 flock 9
 if zfs list -H -t snapshot -o name "${pool}@${snapshot_name}" >/dev/null 2>&1; then
  # The private bind mounts are gone, but ZFS may leave its on-demand
  # .zfs/snapshot mounts in the host namespace until explicitly unmounted.
  snapshot_mounts=()
  snapshot_sources=()
  while IFS=$'\t' read -r dataset dataset_mountpoint; do
    [[ "$dataset_mountpoint" == "$mount_root" || "$dataset_mountpoint" == "$mount_root/"* ]] || continue
    snapshot_mounts+=("${dataset_mountpoint}/.zfs/snapshot/${snapshot_name}")
    snapshot_sources+=("${dataset}@${snapshot_name}")
  done < <(zfs list -H -o name,mountpoint -s name -r "$pool")
 {% raw %}
  for ((index = ${#snapshot_mounts[@]} - 1; index >= 0; index--)); do
 {% endraw %}
    mounted_source="$(findmnt -rn -M "${snapshot_mounts[$index]}" -o SOURCE || true)"
    [[ -n "$mounted_source" ]] || continue
    [[ "$mounted_source" == "${snapshot_sources[$index]}" ]] || {
      printf 'Unexpected source on Atlas Borg snapshot mount: %s\n' \
        "${snapshot_mounts[$index]}" >&2
      exit 2
    }
    umount "${snapshot_mounts[$index]}"
  done
  zfs destroy -r "${pool}@${snapshot_name}"
  printf 'Removed recursive Atlas Borg source snapshot %s@%s after backup exit\n' \
    "$pool" "$snapshot_name"
 fi
--- a/ansible/roles/profile_atlas/templates/atlas-borg-ssh.sh.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-borg-ssh.sh.j2
@@ -0,0 +1,19 @@
 #!/usr/bin/env bash
 set -euo pipefail
 # Borg receives CAP_DAC_READ_SEARCH only for local snapshot traversal. Drop it
 # before starting the network transport so SSH runs as the plain service user.
 exec setpriv \
  --inh-caps=-all \
  --ambient-caps=-all \
  -- /usr/bin/ssh \
  -i {{ atlas_borg_ssh_private_key_path | quote }} \
  -p {{ atlas_borg_repository_port | int }} \
  -o BatchMode=yes \
  -o IdentitiesOnly=yes \
  -o StrictHostKeyChecking=yes \
  -o UserKnownHostsFile={{ atlas_borg_known_hosts_path | quote }} \
  -o ConnectTimeout=30 \
  -o ServerAliveInterval=60 \
  -o ServerAliveCountMax=3 \
  "$@"
--- a/ansible/roles/profile_atlas/templates/atlas-health-monitor.json.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-health-monitor.json.j2
@@ -0,0 +1,20 @@
 {
  "pool": {{ atlas_zfs_pool | to_json }},
  "backup_dataset": {{ (atlas_zfs_pool ~ '/' ~ atlas_zfs_dataset_backup) | to_json }},
  "notifier": {{ atlas_monitor_notifier | to_json }},
  "smart_devices": {{ atlas_monitor_smart_devices | to_json }},
  "timers": {{ atlas_monitor_timers | to_json }},
  "failure_units": {{ atlas_monitor_failure_units | to_json }},
  "remote_capacity": {{ atlas_monitor_remote_capacity | to_json }},
  "pool_warning_percent": {{ atlas_monitor_pool_warning_percent | int }},
  "pool_critical_percent": {{ atlas_monitor_pool_critical_percent | int }},
  "root_warning_percent": {{ atlas_monitor_root_warning_percent | int }},
  "root_critical_percent": {{ atlas_monitor_root_critical_percent | int }},
  "snapshot_warning_percent": {{ atlas_monitor_snapshot_warning_percent | int }},
  "snapshot_critical_percent": {{ atlas_monitor_snapshot_critical_percent | int }},
  "snapshot_growth_warning_gib_day": {{ atlas_monitor_snapshot_growth_warning_gib_day | int }},
  "backup_growth_warning_gib_day": {{ atlas_monitor_backup_growth_warning_gib_day | int }},
  "cpu_warning_c": {{ atlas_monitor_cpu_warning_c | int }},
  "cpu_critical_c": {{ atlas_monitor_cpu_critical_c | int }},
  "borg_max_runtime_days": {{ atlas_monitor_borg_max_runtime_days | int }}
 }
--- a/ansible/roles/profile_atlas/templates/atlas-health-monitor.service.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-health-monitor.service.j2
@@ -0,0 +1,25 @@
 [Unit]
 Description=Check Atlas pool, disks, capacity, temperatures and maintenance jobs
 Wants=houston-dbus.service network-online.target
 After=zfs.target houston-dbus.service network-online.target
 ConditionFileIsExecutable=/usr/local/libexec/atlas-health-monitor
 [Service]
 Type=oneshot
 ExecStart=/usr/local/libexec/atlas-health-monitor
 User=root
 Group=root
 UMask=0077
 StateDirectory=atlas-health-monitor
 StateDirectoryMode=0700
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectHome=true
 ProtectSystem=strict
 ReadWritePaths=/var/lib/atlas-health-monitor
 ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectControlGroups=true
 RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
 RestrictRealtime=true
 LockPersonality=true
--- a/ansible/roles/profile_atlas/templates/atlas-health-monitor.timer.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-health-monitor.timer.j2
@@ -0,0 +1,11 @@
 [Unit]
 Description=Schedule Atlas health checks
 [Timer]
 OnCalendar={{ atlas_monitor_calendar }}
 Persistent=true
 RandomizedDelaySec=5min
 Unit=atlas-health-monitor.service
 [Install]
 WantedBy=timers.target
--- a/ansible/roles/profile_atlas/templates/atlas-immich-machine-learning.container.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-immich-machine-learning.container.j2
@@ -0,0 +1,27 @@
 # Managed by Ansible. Do not edit manually.
 [Unit]
 Description=Atlas Immich machine learning
 [Container]
 ContainerName=atlas-immich-machine-learning
 Image={{ atlas_immich_machine_learning_image }}
 User={{ atlas_immich_uid }}:{{ atlas_immich_gid }}
 {% for group_name in atlas_immich_supplementary_groups %}
 GroupAdd={{ ansible_facts['getent_group'][group_name][1] }}
 {% endfor %}
 AddDevice=/dev/dri
 Network=atlas-media.network
 NetworkAlias=atlas-immich-machine-learning
 Environment=TZ={{ atlas_timezone }}
 Volume={{ atlas_immich_model_cache_dir }}:/cache:Z
 Volume={{ atlas_immich_machine_learning_config_dir }}:/.config:Z
 Volume={{ atlas_immich_machine_learning_cache_dir }}:/.cache:Z
 NoNewPrivileges=true
 DropCapability=NET_RAW
 [Service]
 Restart=always
 TimeoutStartSec=900
 [Install]
 WantedBy=multi-user.target
--- a/ansible/roles/profile_atlas/templates/atlas-immich-postgres.container.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-immich-postgres.container.j2
@@ -0,0 +1,22 @@
 # Managed by Ansible. Do not edit manually.
 [Unit]
 Description=Atlas Immich PostgreSQL database
 [Container]
 ContainerName=atlas-immich-postgres
 Image={{ atlas_immich_postgres_image }}
 User={{ atlas_immich_uid }}:{{ atlas_immich_gid }}
 Network=atlas-media.network
 NetworkAlias=atlas-immich-postgres
 EnvironmentFile=/etc/immich/immich.env
 Volume={{ atlas_immich_postgres_data_dir }}:/var/lib/postgresql/data:Z
 ShmSize=128m
 NoNewPrivileges=true
 DropCapability=NET_RAW
 [Service]
 Restart=always
 TimeoutStartSec=900
 [Install]
 WantedBy=multi-user.target
--- a/ansible/roles/profile_atlas/templates/atlas-immich-redis.container.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-immich-redis.container.j2
@@ -0,0 +1,20 @@
 # Managed by Ansible. Do not edit manually.
 [Unit]
 Description=Atlas Immich Redis-compatible cache
 [Container]
 ContainerName=atlas-immich-redis
 Image={{ atlas_immich_redis_image }}
 User={{ atlas_immich_uid }}:{{ atlas_immich_gid }}
 Network=atlas-media.network
 NetworkAlias=atlas-immich-redis
 Volume={{ atlas_immich_redis_data_dir }}:/data:Z
 NoNewPrivileges=true
 DropCapability=NET_RAW
 [Service]
 Restart=always
 TimeoutStartSec=900
 [Install]
 WantedBy=multi-user.target
--- a/ansible/roles/profile_atlas/templates/atlas-immich-server.container.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-immich-server.container.j2
@@ -0,0 +1,29 @@
 # Managed by Ansible. Do not edit manually.
 [Unit]
 Description=Atlas Immich server
 Requires=atlas-immich-redis.service atlas-immich-postgres.service atlas-immich-machine-learning.service
 After=atlas-immich-redis.service atlas-immich-postgres.service atlas-immich-machine-learning.service
 [Container]
 ContainerName=atlas-immich-server
 Image={{ atlas_immich_server_image }}
 User={{ atlas_immich_uid }}:{{ atlas_immich_gid }}
 {% for group_name in atlas_immich_supplementary_groups %}
 GroupAdd={{ ansible_facts['getent_group'][group_name][1] }}
 {% endfor %}
 AddDevice=/dev/dri
 Network=atlas-media.network
 NetworkAlias=atlas-immich-server
 EnvironmentFile=/etc/immich/immich.env
 Volume={{ atlas_immich_upload_dir }}:/data:Z
 Volume={{ atlas_photobook_mountpoint }}:/external/photobook:ro,Z
 Volume=/etc/localtime:/etc/localtime:ro
 NoNewPrivileges=true
 DropCapability=NET_RAW
 [Service]
 Restart=always
 TimeoutStartSec=900
 [Install]
 WantedBy=multi-user.target
--- a/ansible/roles/profile_atlas/templates/atlas-media.network.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-media.network.j2
@@ -0,0 +1,3 @@
 # Managed by Ansible. Do not edit manually.
 [Network]
 NetworkName=atlas-media
--- a/ansible/roles/profile_atlas/templates/atlas-monitor-failure.conf.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-monitor-failure.conf.j2
@@ -0,0 +1,2 @@
 [Unit]
 OnFailure=atlas-monitor-failure@%n.service
--- a/ansible/roles/profile_atlas/templates/atlas-monitor-failure@.service.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-monitor-failure@.service.j2
@@ -0,0 +1,19 @@
 [Unit]
 Description=Submit a 45Drives Alert for failed Atlas job %I
 Requires=houston-dbus.service
 After=houston-dbus.service
 ConditionFileIsExecutable=/usr/local/libexec/atlas-health-monitor
 [Service]
 Type=oneshot
 ExecStart=/usr/local/libexec/atlas-health-monitor --job-failed %I
 User=root
 Group=root
 UMask=0077
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectHome=true
 ProtectSystem=strict
 RestrictAddressFamilies=AF_UNIX
 RestrictRealtime=true
 LockPersonality=true
--- a/ansible/roles/profile_atlas/templates/atlas-npm.container.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-npm.container.j2
@@ -0,0 +1,21 @@
 # Managed by Ansible. Do not edit manually.
 [Unit]
 Description=Atlas Nginx Proxy Manager
 [Container]
 ContainerName=atlas-npm
 Image={{ atlas_npm_image }}
 Network=atlas-media.network
 NetworkAlias=atlas-npm
 PublishPort=80:80
 PublishPort=443:443
 PublishPort={{ atlas_npm_admin_bind_address }}:81:81
 Volume={{ atlas_npm_data_dir }}:/data:Z
 Volume={{ atlas_npm_letsencrypt_dir }}:/etc/letsencrypt:Z
 [Service]
 Restart=always
 TimeoutStartSec=900
 [Install]
 WantedBy=multi-user.target
--- a/ansible/roles/profile_atlas/templates/atlas-syncthing.service.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-syncthing.service.j2
@@ -1,16 +0,0 @@
 [Unit]
 Description=Atlas Syncthing service
 After=network-online.target
 Wants=network-online.target
 [Service]
 User={{ atlas_admin_username }}
 Group={{ atlas_admin_group }}
 WorkingDirectory={{ atlas_syncthing_mountpoint }}
 Environment=HOME={{ atlas_syncthing_mountpoint }}
 ExecStart=/usr/local/bin/syncthing serve --no-browser --no-restart --no-upgrade --home={{ atlas_syncthing_config_dir }}
 Restart=on-failure
 RestartSec=5
 [Install]
 WantedBy=multi-user.target
--- a/ansible/roles/profile_atlas/templates/atlas-usb-backup.service.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-usb-backup.service.j2
@@ -0,0 +1,30 @@
 [Unit]
 Description=Run a manual, UUID-bound offline USB backup of Atlas ZFS datasets
 Requires=zfs.target
 After=zfs.target
 ConditionFileIsExecutable=/usr/local/sbin/atlas-usb-backup
 [Service]
 Type=oneshot
 ExecStart=/usr/local/sbin/atlas-usb-backup
 ExecStopPost=+/usr/local/sbin/atlas-usb-snapshot-cleanup
 User=root
 Group=root
 UMask=0077
 TimeoutStartSec=infinity
 RuntimeDirectory=atlas-usb-backup
 RuntimeDirectoryMode=0700
 Nice=15
 IOSchedulingClass=best-effort
 IOSchedulingPriority=7
 PrivateMounts=true
 PrivateTmp=true
 ProtectHome=true
 ProtectSystem=strict
 ReadWritePaths=/run/atlas-usb-backup /run/lock
 ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectControlGroups=true
 RestrictAddressFamilies=AF_UNIX
 RestrictRealtime=true
 LockPersonality=true
--- a/ansible/roles/profile_atlas/templates/atlas-usb-backup.sh.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-usb-backup.sh.j2
@@ -0,0 +1,242 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 export LC_ALL=C.utf8
 export PATH=/usr/sbin:/usr/bin:/sbin:/bin
 readonly pool={{ atlas_zfs_pool | quote }}
 readonly mount_root={{ atlas_mount_root | quote }}
 readonly luks_uuid={{ atlas_usb_backup_luks_uuid | quote }}
 readonly fs_uuid={{ atlas_usb_backup_fs_uuid | quote }}
 readonly mapper_name={{ atlas_usb_backup_mapper_name | quote }}
 readonly snapshot_prefix={{ atlas_usb_backup_snapshot_prefix | quote }}
 readonly min_free_bytes={{ atlas_usb_backup_min_free_bytes | int }}
 readonly mapper="/dev/mapper/${mapper_name}"
 readonly outer="/dev/disk/by-uuid/${luks_uuid}"
 readonly runtime_dir=/run/atlas-usb-backup
 readonly snapshot_marker="${runtime_dir}/snapshot-name"
 readonly source_dir="${runtime_dir}/source"
 readonly usb_mount="${runtime_dir}/target"
 readonly backup_root="${usb_mount}/atlas"
 snapshot_name=""
 mapper_opened_by_script=false
 usb_mounted=false
 published=false
 partial=""
 mounted_targets=()
 # shellcheck disable=SC2329
 cleanup() {
  local status=$?
  local cleanup_status=0
  local index
  local source_mount_failed=false
  trap - EXIT HUP INT TERM
  set +e
  if [[ -n "$partial" && "$published" == false && "$usb_mounted" == true ]]; then
    rm -rf -- "$partial" || cleanup_status=2
  fi
  if [[ "$usb_mounted" == true ]]; then
    umount "$usb_mount" || cleanup_status=2
  fi
 {% raw %}
  for ((index = ${#mounted_targets[@]} - 1; index >= 0; index--)); do
 {% endraw %}
    if mountpoint -q "${mounted_targets[$index]}" && ! umount -R "${mounted_targets[$index]}"; then
      printf 'Source snapshot mount cleanup failed: %s\n' "${mounted_targets[$index]}" >&2
      source_mount_failed=true
    fi
    if mountpoint -q "${mounted_targets[$index]}"; then
      printf 'Source snapshot mount is still active: %s\n' "${mounted_targets[$index]}" >&2
      source_mount_failed=true
    else
      rmdir -- "${mounted_targets[$index]}" 2>/dev/null || true
    fi
  done
  if [[ "$source_mount_failed" == false ]]; then
    rmdir -- "$source_dir" 2>/dev/null || true
  else
    cleanup_status=2
    printf 'Source bind mount cleanup failed; keeping the snapshot for recovery\n' >&2
  fi
  if [[ "$usb_mounted" == true || "$mapper_opened_by_script" == true ]] &&
      ! mountpoint -q "$usb_mount" &&
      ! findmnt -rn -S "$mapper" >/dev/null; then
    cryptsetup close "$mapper_name" || cleanup_status=2
  fi
  rmdir -- "$usb_mount" 2>/dev/null || true
  if ((status == 0 && cleanup_status != 0)); then
    status=$cleanup_status
  fi
  exit "$status"
 }
 trap cleanup EXIT
 trap 'exit 143' HUP INT TERM
 exec 8>/run/lock/atlas-usb-backup.lock
 flock -n 8 || { printf 'Atlas USB backup is already running\n' >&2; exit 75; }
 exec 9>/run/lock/atlas-zfs-snapshot.lock
 zpool list -H -o name "$pool" >/dev/null
 [[ -b "$outer" ]] || { printf 'Configured LUKS UUID is not connected\n' >&2; exit 66; }
 [[ "$(blkid -s TYPE -o value "$outer")" == crypto_LUKS ]] || {
  printf 'Configured outer UUID is not a LUKS container\n' >&2
  exit 65
 }
 [[ "$(blkid -s UUID -o value "$outer")" == "$luks_uuid" ]] || exit 65
 if ! cryptsetup status "$mapper_name" >/dev/null; then
  printf 'Requesting the LUKS passphrase for the configured USB disk\n'
  systemd-ask-password -n --no-tty --timeout=300 \
    --id="atlas-usb-backup:${luks_uuid}" \
    'Atlas offline USB backup LUKS passphrase:' |
    cryptsetup open --type luks2 --key-file - "$outer" "$mapper_name"
  mapper_opened_by_script=true
 fi
 backing_device="$(cryptsetup status "$mapper_name" | awk '$1 == "device:" { print $2 }')"
 [[ -n "$backing_device" && "$(readlink -f "$backing_device")" == "$(readlink -f "$outer")" ]] || {
  printf 'The unlocked mapper does not belong to the configured LUKS UUID\n' >&2
  exit 65
 }
 [[ "$(blkid -s TYPE -o value "$mapper")" == ext4 ]] || {
  printf 'The unlocked USB filesystem is not ext4\n' >&2
  exit 65
 }
 [[ "$(blkid -s UUID -o value "$mapper")" == "$fs_uuid" ]] || {
  printf 'The unlocked USB filesystem UUID does not match\n' >&2
  exit 65
 }
 if findmnt -rn -S "$mapper" >/dev/null; then
  printf 'The USB filesystem is already mounted elsewhere\n' >&2
  exit 65
 fi
 [[ ! -e "$source_dir" && ! -e "$usb_mount" ]] || {
  printf 'USB backup staging directories already exist; inspect them manually\n' >&2
  exit 65
 }
 mkdir -m 0700 "$usb_mount"
 mount -t ext4 -o nodev,nosuid,noexec "$mapper" "$usb_mount"
 usb_mounted=true
 [[ "$(readlink -f "$(findmnt -nro SOURCE --target "$usb_mount")")" == "$(readlink -f "$mapper")" ]] || {
  printf 'Mounted USB source does not match the verified mapper\n' >&2
  exit 65
 }
 for path in "$backup_root" "$backup_root/snapshots"; do
  [[ ! -L "$path" ]] || { printf 'Unsafe symlink in USB backup destination\n' >&2; exit 65; }
  mkdir -p -- "$path"
  [[ -d "$path" ]] || exit 65
  chown root:root -- "$path"
  chmod 0700 -- "$path"
 done
 free_bytes="$(df -B1 --output=avail "$usb_mount" | tail -n 1 | tr -d ' ')"
 if ((free_bytes < min_free_bytes)); then
  printf 'USB free space (%s bytes) is below the required reserve (%s bytes)\n' \
    "$free_bytes" "$min_free_bytes" >&2
  exit 73
 fi
 mkdir -m 0700 "$source_dir"
 flock 9
 timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
 snapshot_name="${snapshot_prefix}-${timestamp}-$$"
 printf '%s\n' "$snapshot_name" >"$snapshot_marker"
 zfs snapshot -r "${pool}@${snapshot_name}"
 flock -u 9
 printf 'Created recursive USB source snapshot %s@%s\n' "$pool" "$snapshot_name"
 while IFS=$'\t' read -r dataset dataset_mountpoint mounted; do
  if [[ "$mounted" != yes ]]; then
    printf 'Dataset %s is not mounted; refusing an incomplete backup\n' "$dataset" >&2
    exit 65
  fi
  if [[ "$dataset_mountpoint" != "$mount_root" && "$dataset_mountpoint" != "$mount_root/"* ]]; then
    printf 'Dataset %s has unexpected mountpoint %s\n' "$dataset" "$dataset_mountpoint" >&2
    exit 65
  fi
  dataset_suffix="${dataset#"$pool"}"
  source_path="${dataset_mountpoint}/.zfs/snapshot/${snapshot_name}"
  target_path="${source_dir}${dataset_suffix}"
  mkdir -p "$target_path"
  mount --bind "$source_path" "$target_path"
  mounted_targets+=("$target_path")
  mount -o remount,bind,ro "$target_path"
 done < <(zfs list -H -o name,mountpoint,mounted -s name -r "$pool")
 previous=""
 if [[ -e "$backup_root/latest" || -L "$backup_root/latest" ]]; then
  [[ -L "$backup_root/latest" ]] || { printf 'latest is not a symlink\n' >&2; exit 65; }
  previous="$(readlink -e "$backup_root/latest")"
  [[ -n "$previous" && "$previous" == "$backup_root/snapshots/"* && -d "$previous" ]] || {
    printf 'latest does not point to a complete snapshot on the USB disk\n' >&2
    exit 65
  }
 fi
 backup_name="${timestamp}-$$"
 candidate_partial="${backup_root}/snapshots/.incomplete-${backup_name}"
 complete="${backup_root}/snapshots/${backup_name}"
 [[ ! -e "$candidate_partial" && ! -L "$candidate_partial" && ! -e "$complete" && ! -L "$complete" ]] || exit 65
 mkdir -m 0700 "$candidate_partial"
 partial="$candidate_partial"
 printf 'Copying the consistent pool tree to USB backup %s\n' "$backup_name"
 # Preserve POSIX ACLs, ownership, modes, timestamps, hard links, and sparse
 # files.  Do not preserve generic xattrs: Rocky 9's rsync 3.2.7 fails when
 # combining xattrs with --link-dest, while SELinux labels were intentionally
 # excluded because restores must relabel for their destination host.
 rsync_args=(-aHAS --numeric-ids "--info=progress2,stats2")
 estimate_args=(-aHAS --numeric-ids --dry-run --stats)
 if [[ -n "$previous" ]]; then
  rsync_args+=("--link-dest=$previous")
  estimate_args+=("--link-dest=$previous")
 fi
 # The rsync dry run estimates changed file bytes after link-dest deduplication.
 # Metadata and filesystem allocation still require the separate free-space reserve.
 estimate="$(rsync "${estimate_args[@]}" "${source_dir}/" "${partial}/")"
 transfer_bytes="$(printf '%s\n' "$estimate" | awk -F: \
  '/^Total transferred file size:/ { gsub(/[^0-9]/, "", $2); print $2 }')"
 [[ "$transfer_bytes" =~ ^[0-9]+$ ]] || {
  printf 'Could not determine the USB transfer size\n' >&2
  exit 74
 }
 if ((free_bytes - transfer_bytes < min_free_bytes)); then
  printf 'Insufficient USB space: %s bytes free, %s estimated transfer, %s reserved\n' \
    "$free_bytes" "$transfer_bytes" "$min_free_bytes" >&2
  exit 73
 fi
 rsync "${rsync_args[@]}" "${source_dir}/" "${partial}/"
 printf 'Verifying USB backup %s with a checksum-based dry run\n' "$backup_name"
 verification="${runtime_dir}/verification.out"
 rsync -aHAS --numeric-ids \
  --checksum --dry-run --delete --itemize-changes \
  "${source_dir}/" "${partial}/" >"$verification"
 if [[ -s "$verification" ]]; then
  printf 'USB verification found mismatches; refusing to publish the backup\n' >&2
  exit 74
 fi
 free_bytes="$(df -B1 --output=avail "$usb_mount" | tail -n 1 | tr -d ' ')"
 if ((free_bytes < min_free_bytes)); then
  printf 'USB backup completed below the free-space reserve; refusing to publish it\n' >&2
  exit 73
 fi
 mv -- "$partial" "$complete"
 partial=""
 ln -s "snapshots/${backup_name}" "${backup_root}/.latest-${backup_name}"
 mv -Tf -- "${backup_root}/.latest-${backup_name}" "${backup_root}/latest"
 published=true
 sync -f "$complete"
 sync -f "$backup_root"
 printf 'USB backup %s verified and published; unmounting and closing LUKS\n' "$backup_name"
--- a/ansible/roles/profile_atlas/templates/atlas-usb-reminder.py.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-usb-reminder.py.j2
@@ -0,0 +1,31 @@
 #!/usr/bin/python3
 """Submit a manual-backup reminder through Atlas' existing Houston notifier."""
 import json
 import subprocess
 from datetime import datetime, timezone
 now = datetime.now(timezone.utc)
 message = {
    "timestamp": now.isoformat(timespec="seconds"),
    "unixtime": int(now.timestamp()),
    "event": "atlas_usb_backup_reminder",
    "severity": "warning",
    "subject": "Promemoria backup USB offline Atlas",
    "email_message": (
        "Collega il disco USB di backup ad Atlas ed esegui manualmente il backup offline.\n"
        "Il promemoria non avvia il backup. Controlla che il disco non sia\n"
        "montato; poi esegui:\n\n"
        "  sudo systemctl start atlas-usb-backup.service\n\n"
        "Verifica l'esito con:\n"
        "  sudo journalctl -u atlas-usb-backup.service -n 100 --no-pager\n\n"
        "Dopo la riuscita, scollega fisicamente il disco."
    ),
 }
 subprocess.run(
    [{{ atlas_usb_reminder_notifier | to_json }}, json.dumps(message)],
    check=True,
 )
 print("Atlas USB backup reminder submitted to 45Drives Alerts; email delivery is not verified.", flush=True)
--- a/ansible/roles/profile_atlas/templates/atlas-usb-reminder.service.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-usb-reminder.service.j2
@@ -0,0 +1,22 @@
 [Unit]
 Description=45Drives Alerts reminder to run the manual Atlas offline USB backup
 Requires=houston-dbus.service
 After=houston-dbus.service
 ConditionFileIsExecutable=/usr/local/libexec/atlas-usb-reminder
 [Service]
 Type=oneshot
 ExecStart=/usr/local/libexec/atlas-usb-reminder
 User=root
 Group=root
 UMask=0077
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectHome=true
 ProtectSystem=strict
 ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectControlGroups=true
 RestrictAddressFamilies=AF_UNIX
 RestrictRealtime=true
 LockPersonality=true
--- a/ansible/roles/profile_atlas/templates/atlas-usb-reminder.timer.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-usb-reminder.timer.j2
@@ -0,0 +1,10 @@
 [Unit]
 Description=Remind the administrator to run the manual Atlas offline USB backup
 [Timer]
 OnCalendar={{ atlas_usb_reminder_calendar }}
 Persistent=true
 Unit=atlas-usb-reminder.service
 [Install]
 WantedBy=timers.target
--- a/ansible/roles/profile_atlas/templates/atlas-usb-snapshot-cleanup.sh.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-usb-snapshot-cleanup.sh.j2
@@ -0,0 +1,51 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 export PATH=/usr/sbin:/usr/bin:/sbin:/bin
 readonly pool={{ atlas_zfs_pool | quote }}
 readonly mount_root={{ atlas_mount_root | quote }}
 readonly snapshot_prefix={{ atlas_usb_backup_snapshot_prefix | quote }}
 readonly marker=/run/atlas-usb-backup/snapshot-name
 [[ -e "$marker" ]] || exit 0
 [[ -f "$marker" && ! -L "$marker" ]] || {
  printf 'Unsafe Atlas USB snapshot marker; leaving snapshots unchanged\n' >&2
  exit 2
 }
 IFS= read -r snapshot_name <"$marker"
 [[ "$snapshot_name" =~ ^${snapshot_prefix}-[0-9]{8}T[0-9]{6}Z-[0-9]+$ ]] || {
  printf 'Invalid Atlas USB snapshot marker; leaving snapshots unchanged\n' >&2
  exit 2
 }
 exec 9>/run/lock/atlas-zfs-snapshot.lock
 flock 9
 if zfs list -H -t snapshot -o name "${pool}@${snapshot_name}" >/dev/null 2>&1; then
  # ZFS can leave its on-demand .zfs/snapshot mounts in the host namespace
  # even after the backup's private bind mounts and process have exited.
  snapshot_mounts=()
  snapshot_sources=()
  while IFS=$'\t' read -r dataset dataset_mountpoint; do
    [[ "$dataset_mountpoint" == "$mount_root" || "$dataset_mountpoint" == "$mount_root/"* ]] || continue
    snapshot_mounts+=("${dataset_mountpoint}/.zfs/snapshot/${snapshot_name}")
    snapshot_sources+=("${dataset}@${snapshot_name}")
  done < <(zfs list -H -o name,mountpoint -s name -r "$pool")
 {% raw %}
  for ((index = ${#snapshot_mounts[@]} - 1; index >= 0; index--)); do
 {% endraw %}
    mounted_source="$(findmnt -rn -M "${snapshot_mounts[$index]}" -o SOURCE || true)"
    [[ -n "$mounted_source" ]] || continue
    [[ "$mounted_source" == "${snapshot_sources[$index]}" ]] || {
      printf 'Unexpected source on Atlas USB snapshot mount: %s\n' \
        "${snapshot_mounts[$index]}" >&2
      exit 2
    }
    umount "${snapshot_mounts[$index]}"
  done
  zfs destroy -r "${pool}@${snapshot_name}"
  printf 'Removed recursive Atlas USB source snapshot %s@%s after backup exit\n' \
    "$pool" "$snapshot_name"
 fi
--- a/ansible/roles/profile_atlas/templates/atlas-zfs-scrub-timer.conf.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-zfs-scrub-timer.conf.j2
@@ -0,0 +1,6 @@
 [Timer]
 OnCalendar=
 OnCalendar={{ atlas_zfs_scrub_calendar }}
 Persistent=true
 RandomizedDelaySec=0
 AccuracySec=1min
--- a/ansible/roles/profile_atlas/templates/atlas-zfs-snapshot.sh.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-zfs-snapshot.sh.j2
@@ -0,0 +1,72 @@
 #!/usr/bin/env bash
 set -euo pipefail
 export LC_ALL=C
 export PATH=/usr/sbin:/usr/bin:/sbin:/bin
 if [[ $# -ne 1 ]]; then
  printf 'Usage: %s <policy>\n' "$0" >&2
  exit 64
 fi
 readonly pool={{ atlas_zfs_pool | quote }}
 readonly prefix={{ atlas_zfs_snapshot_prefix | quote }}
 readonly period="$1"
 case "$period" in
 {% for policy in atlas_zfs_snapshot_policies %}
  {{ policy.name | quote }})
    keep={{ policy.keep | int }}
    ;;
 {% endfor %}
  *)
    printf 'Unknown Atlas ZFS snapshot policy: %s\n' "$period" >&2
    exit 64
    ;;
 esac
 readonly keep
 zpool list -H -o name "$pool" >/dev/null
 exec 9>/run/lock/atlas-zfs-snapshot.lock
 flock 9
 timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
 readonly timestamp
 readonly snapshot_prefix="${pool}@${prefix}-${period}-"
 readonly snapshot="${snapshot_prefix}${timestamp}"
 zfs snapshot -r "$snapshot"
 printf 'Created recursive ZFS snapshot %s\n' "$snapshot"
 snapshot_listing="$(zfs list -H -t snapshot -o name -s creation -r "$pool")"
 managed_snapshots=()
 while IFS= read -r snapshot_name; do
  if [[ "$snapshot_name" == "$snapshot_prefix"* ]]; then
    snapshot_suffix="${snapshot_name#"$snapshot_prefix"}"
    if [[ "$snapshot_suffix" =~ ^[0-9]{8}T[0-9]{6}Z$ ]]; then
      managed_snapshots+=("$snapshot_name")
    fi
  fi
 done <<< "$snapshot_listing"
 {% raw %}
 managed_snapshot_count="${#managed_snapshots[@]}"
 {% endraw %}
 prune_count=$((managed_snapshot_count - keep))
 if ((prune_count <= 0)); then
  printf 'Retaining %d of %d managed %s snapshots\n' \
    "$managed_snapshot_count" "$keep" "$period"
  exit 0
 fi
 for ((index = 0; index < prune_count; index++)); do
  candidate="${managed_snapshots[$index]}"
  if [[ "$candidate" != "$snapshot_prefix"* ]]; then
    printf 'Refusing to destroy unexpected snapshot: %s\n' "$candidate" >&2
    exit 65
  fi
  zfs destroy -r "$candidate"
  printf 'Pruned recursive ZFS snapshot %s\n' "$candidate"
 done
--- a/ansible/roles/profile_atlas/templates/atlas-zfs-snapshot.timer.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-zfs-snapshot.timer.j2
@@ -0,0 +1,11 @@
 [Unit]
 Description=Schedule {{ item.name }} ZFS snapshots for {{ atlas_zfs_pool }}
 [Timer]
 OnCalendar={{ item.calendar }}
 Persistent=true
 AccuracySec=1min
 Unit=atlas-zfs-snapshot@{{ item.name }}.service
 [Install]
 WantedBy=timers.target
--- a/ansible/roles/profile_atlas/templates/atlas-zfs-snapshot@.service.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-zfs-snapshot@.service.j2
@@ -0,0 +1,25 @@
 [Unit]
 Description=Create and retain %i ZFS snapshots for {{ atlas_zfs_pool }}
 Documentation=man:zfs-snapshot(8) man:zfs-destroy(8)
 Requires=zfs.target
 After=zfs.target
 ConditionFileIsExecutable=/usr/local/sbin/atlas-zfs-snapshot
 [Service]
 Type=oneshot
 ExecStart=/usr/local/sbin/atlas-zfs-snapshot %i
 User=root
 Group=root
 UMask=0077
 Nice=10
 IOSchedulingClass=best-effort
 IOSchedulingPriority=7
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectHome=true
 ProtectSystem=strict
 ProtectKernelTunables=true
 ProtectKernelModules=true
 ProtectControlGroups=true
 RestrictRealtime=true
 LockPersonality=true
--- a/ansible/roles/profile_atlas/templates/atlas.exports.j2
+++ b/ansible/roles/profile_atlas/templates/atlas.exports.j2
@@ -1,4 +1,4 @@
 # Managed by Ansible. Do not edit manually.
 {% for export in atlas_nfs_exports %}
-{{ export.path }} {{ export.clients }}
+{{ export.path }} {{ export.client }}({{ export.options | join(',') }})
 {% endfor %}
--- a/ansible/roles/profile_atlas/templates/immich.env.j2
+++ b/ansible/roles/profile_atlas/templates/immich.env.j2
@@ -0,0 +1,13 @@
 # Managed by Ansible. Contains a Vault secret; do not edit or copy.
 TZ={{ atlas_timezone | to_json }}
 DB_HOSTNAME="atlas-immich-postgres"
 DB_USERNAME={{ atlas_immich_db_username | to_json }}
 DB_PASSWORD={{ atlas_immich_db_password | to_json }}
 DB_DATABASE_NAME={{ atlas_immich_db_name | to_json }}
 DB_VECTOR_EXTENSION="vectorchord"
 POSTGRES_USER={{ atlas_immich_db_username | to_json }}
 POSTGRES_PASSWORD={{ atlas_immich_db_password | to_json }}
 POSTGRES_DB={{ atlas_immich_db_name | to_json }}
 POSTGRES_INITDB_ARGS="--data-checksums"
 REDIS_HOSTNAME="atlas-immich-redis"
 IMMICH_MACHINE_LEARNING_URL="http://atlas-immich-machine-learning:3003"
--- a/ansible/roles/profile_atlas/templates/smb.conf.j2
+++ b/ansible/roles/profile_atlas/templates/smb.conf.j2
@@ -3,11 +3,16 @@
  workgroup = {{ atlas_samba_workgroup }}
  security = user
  map to guest = Never
-  server min protocol = SMB2
+  server min protocol = SMB3
  server signing = mandatory
  smb encrypt = {{ atlas_samba_encryption }}
  disable netbios = yes
  smb ports = 445
  hosts allow = {{ atlas_lan_subnet }}
  include = registry
 [{{ atlas_samba_share_name }}]
-  path = {{ atlas_work_mountpoint }}
+  path = {{ atlas_archive_mountpoint }}
  browseable = yes
  read only = no
  valid users = {{ atlas_samba_valid_users | join(' ') }}
--- a/ansible/roles/profile_backend_phase1/defaults/main.yml
+++ b/ansible/roles/profile_backend_phase1/defaults/main.yml
@@ -0,0 +1,32 @@
 ---
 backend_phase1_enabled: false
 backend_phase1_start_services: false
 backend_phase1_username: "{{ atlas_admin_username }}"
 backend_phase1_user_group: "{{ atlas_admin_group }}"
 backend_phase1_user_home: "{{ atlas_admin_home }}"
 backend_phase1_quadlet_dir: "{{ backend_phase1_user_home }}/.config/containers/systemd"
 backend_phase1_bind_address: CHANGEME_ATLAS_BIND_ADDRESS
 backend_phase1_firewalld_zone: public
 backend_phase1_npm_source_ip: CHANGEME_AEGIS_IP
 backend_phase1_syncthing_native_subnet: CHANGEME_LAN_SUBNET
 backend_phase1_music_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_music }}"
 backend_phase1_archive_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_archive }}"
 backend_phase1_syncthing_folder_path: "{{ backend_phase1_archive_dir }}/Org"
 backend_phase1_app_data_root: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_app_data }}"
 backend_phase1_navidrome_data_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_navidrome }}"
 backend_phase1_syncthing_root: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_syncthing }}"
 backend_phase1_music_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_music }}"
 backend_phase1_archive_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_archive }}"
 backend_phase1_app_data_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_app_data }}"
 backend_phase1_navidrome_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_navidrome }}"
 backend_phase1_syncthing_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_syncthing }}"
 backend_phase1_navidrome_image: docker.io/deluan/navidrome:0.63.2
 backend_phase1_syncthing_image: docker.io/syncthing/syncthing:2.1.3
 backend_phase1_navidrome_port: 4533
 backend_phase1_syncthing_gui_port: 8384
 backend_phase1_syncthing_transfer_port: 22000
 backend_phase1_syncthing_discovery_port: 21027
 backend_phase1_timezone: Europe/Rome
 backend_phase1_services:
  - atlas-navidrome.service
  - atlas-syncthing.service
--- a/ansible/roles/profile_backend_phase1/handlers/main.yml
+++ b/ansible/roles/profile_backend_phase1/handlers/main.yml
@@ -0,0 +1,32 @@
 ---
 - name: Restart Atlas Navidrome Quadlet
  tags: [backend_phase1, navidrome, podman, services]
  become_user: "{{ backend_phase1_username }}"
  ansible.builtin.systemd:
    name: atlas-navidrome.service
    scope: user
    state: restarted
    daemon_reload: true
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
  when:
    - backend_phase1_enabled | bool
    - backend_phase1_start_services | bool
    - not ansible_check_mode
 - name: Restart Atlas Syncthing Quadlet
  tags: [backend_phase1, syncthing, podman, services]
  become_user: "{{ backend_phase1_username }}"
  ansible.builtin.systemd:
    name: atlas-syncthing.service
    scope: user
    state: restarted
    daemon_reload: true
  environment:
    XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
  when:
    - backend_phase1_enabled | bool
    - backend_phase1_start_services | bool
    - not ansible_check_mode
--- a/ansible/roles/profile_backend_phase1/tasks/main.yml
+++ b/ansible/roles/profile_backend_phase1/tasks/main.yml
@@ -0,0 +1,188 @@
 ---
 - name: Configure Atlas phase-one backend services
  tags: [backend_phase1, podman]
  when: backend_phase1_enabled | bool
  block:
    - name: Validate phase-one backend inputs
      ansible.builtin.assert:
        that:
          - not (atlas_manage_media_stack | bool)
          - backend_phase1_bind_address != 'CHANGEME_ATLAS_BIND_ADDRESS'
          - backend_phase1_bind_address is match('^[0-9]{1,3}(\.[0-9]{1,3}){3}$')
          - backend_phase1_firewalld_zone | length > 0
          - backend_phase1_npm_source_ip != 'CHANGEME_AEGIS_IP'
          - backend_phase1_syncthing_native_subnet != 'CHANGEME_LAN_SUBNET'
          - backend_phase1_music_dir.startswith('/')
          - backend_phase1_archive_dir.startswith('/')
          - backend_phase1_syncthing_folder_path.startswith(backend_phase1_archive_dir + '/')
          - backend_phase1_app_data_root.startswith('/')
          - backend_phase1_navidrome_data_dir.startswith(backend_phase1_app_data_root + '/')
          - backend_phase1_syncthing_root.startswith(backend_phase1_app_data_root + '/')
        fail_msg: >-
          Disable the rootful media-stack gate and provide the Atlas LAN bind
          address, firewall sources, and absolute ZFS-backed paths before
          enabling phase one. This role does not manage Prometheus or migrate
          application data.
    - name: Read the rootless service account
      ansible.builtin.getent:
        database: passwd
        key: "{{ backend_phase1_username }}"
    - name: Record rootless service account IDs
      ansible.builtin.set_fact:
        backend_phase1_uid: "{{ ansible_facts['getent_passwd'][backend_phase1_username][1] }}"
        backend_phase1_gid: "{{ ansible_facts['getent_passwd'][backend_phase1_username][2] }}"
    - name: Read system service state before starting rootless Syncthing
      ansible.builtin.service_facts:
    - name: Refuse to overlap a system-level Atlas Syncthing service
      ansible.builtin.assert:
        that:
          - >-
            ansible_facts.services['atlas-syncthing.service'] is not defined
            or ansible_facts.services['atlas-syncthing.service'].state != 'running'
        fail_msg: >-
          Remove or stop the system-level atlas-syncthing.service before
          enabling the rootless Syncthing Quadlet.
    - name: Inspect required ZFS datasets
      community.general.zfs_facts:
        name: "{{ item.dataset }}"
        properties: name,mounted,mountpoint
      loop:
        - dataset: "{{ backend_phase1_music_dataset }}"
          mountpoint: "{{ backend_phase1_music_dir }}"
        - dataset: "{{ backend_phase1_archive_dataset }}"
          mountpoint: "{{ backend_phase1_archive_dir }}"
        - dataset: "{{ backend_phase1_app_data_dataset }}"
          mountpoint: "{{ backend_phase1_app_data_root }}"
        - dataset: "{{ backend_phase1_navidrome_dataset }}"
          mountpoint: "{{ backend_phase1_navidrome_data_dir }}"
        - dataset: "{{ backend_phase1_syncthing_dataset }}"
          mountpoint: "{{ backend_phase1_syncthing_root }}"
      loop_control:
        label: "{{ item.dataset }}"
      register: backend_phase1_zfs_facts
    - name: Require mounted datasets at the declared paths
      ansible.builtin.assert:
        that:
          - item.ansible_facts.ansible_zfs_datasets | length == 1
          - item.ansible_facts.ansible_zfs_datasets[0].mounted == 'yes'
          - item.ansible_facts.ansible_zfs_datasets[0].mountpoint == item.item.mountpoint
        fail_msg: >-
          {{ item.item.dataset }} must already be mounted at
          {{ item.item.mountpoint }}. The phase-one role never creates or
          imports the pool.
      loop: "{{ backend_phase1_zfs_facts.results }}"
      loop_control:
        label: "{{ item.item.dataset }}"
    - name: Enable lingering for the rootless service account
      ansible.builtin.command:
        argv:
          - loginctl
          - enable-linger
          - "{{ backend_phase1_username }}"
        creates: "/var/lib/systemd/linger/{{ backend_phase1_username }}"
    - name: Start the rootless user systemd manager
      ansible.builtin.systemd:
        name: "user@{{ backend_phase1_uid }}.service"
        state: started
      when: not ansible_check_mode
    - name: Create rootless Quadlet and application directories
      ansible.builtin.file:
        path: "{{ item.path }}"
        state: directory
        owner: "{{ backend_phase1_username }}"
        group: "{{ backend_phase1_user_group }}"
        mode: "{{ item.mode }}"
      loop:
        - path: "{{ backend_phase1_quadlet_dir }}"
          mode: "0700"
        - path: "{{ backend_phase1_navidrome_data_dir }}"
          mode: "0750"
        - path: "{{ backend_phase1_syncthing_root }}"
          mode: "0750"
        - path: "{{ backend_phase1_syncthing_folder_path }}"
          mode: "0770"
      loop_control:
        label: "{{ item.path }}"
    - name: Render the rootless Navidrome Quadlet
      ansible.builtin.template:
        src: atlas-navidrome.container.j2
        dest: "{{ backend_phase1_quadlet_dir }}/atlas-navidrome.container"
        owner: "{{ backend_phase1_username }}"
        group: "{{ backend_phase1_user_group }}"
        mode: "0644"
      notify: Restart Atlas Navidrome Quadlet
    - name: Render the rootless Syncthing Quadlet
      ansible.builtin.template:
        src: atlas-syncthing.container.j2
        dest: "{{ backend_phase1_quadlet_dir }}/atlas-syncthing.container"
        owner: "{{ backend_phase1_username }}"
        group: "{{ backend_phase1_user_group }}"
        mode: "0644"
      notify: Restart Atlas Syncthing Quadlet
    - name: Reload the rootless user systemd manager
      become_user: "{{ backend_phase1_username }}"
      ansible.builtin.systemd:
        scope: user
        daemon_reload: true
      environment:
        XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
      when: not ansible_check_mode
    - name: Permit NPM access to phase-one web interfaces through Aegis
      ansible.posix.firewalld:
        rich_rule: >-
          rule family="ipv4" source address="{{ backend_phase1_npm_source_ip }}"
          port port="{{ item }}" protocol="tcp" accept
        zone: "{{ backend_phase1_firewalld_zone }}"
        state: enabled
        permanent: true
        immediate: true
      loop:
        - "{{ backend_phase1_navidrome_port }}"
        - "{{ backend_phase1_syncthing_gui_port }}"
    - name: Permit native Syncthing traffic from the LAN
      ansible.posix.firewalld:
        rich_rule: >-
          rule family="ipv4" source address="{{ backend_phase1_syncthing_native_subnet }}"
          port port="{{ item.port }}" protocol="{{ item.protocol }}" accept
        zone: "{{ backend_phase1_firewalld_zone }}"
        state: enabled
        permanent: true
        immediate: true
      loop:
        - port: "{{ backend_phase1_syncthing_transfer_port }}"
          protocol: tcp
        - port: "{{ backend_phase1_syncthing_transfer_port }}"
          protocol: udp
        - port: "{{ backend_phase1_syncthing_discovery_port }}"
          protocol: udp
    - name: Start rootless phase-one Quadlets
      become_user: "{{ backend_phase1_username }}"
      ansible.builtin.systemd:
        name: "{{ item }}"
        scope: user
        state: started
        enabled: true
        daemon_reload: true
      environment:
        XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
      loop: "{{ backend_phase1_services }}"
      when:
        - backend_phase1_start_services | bool
        - not ansible_check_mode
--- a/ansible/roles/profile_backend_phase1/templates/atlas-navidrome.container.j2
+++ b/ansible/roles/profile_backend_phase1/templates/atlas-navidrome.container.j2
@@ -0,0 +1,28 @@
 # Managed by Ansible. Do not edit manually.
 [Unit]
 Description=Atlas rootless Navidrome backend
 [Container]
 ContainerName=atlas-navidrome
 Image={{ backend_phase1_navidrome_image }}
 UserNS=keep-id
 User={{ backend_phase1_uid }}
 Group={{ backend_phase1_gid }}
 PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_navidrome_port }}:4533
 Environment=ND_LOGLEVEL=info
 Environment=ND_SCANSCHEDULE=1h
 Environment=ND_SESSIONTIMEOUT=24h
 Environment=ND_ENABLETRANSCODING=true
 Environment=TZ={{ backend_phase1_timezone }}
 Volume={{ backend_phase1_navidrome_data_dir }}:/data:Z
 Volume={{ backend_phase1_music_dir }}:/music:ro,z
 NoNewPrivileges=true
 DropCapability=all
 [Service]
 Restart=always
 RestartSec=10
 TimeoutStartSec=900
 [Install]
 WantedBy=default.target
--- a/ansible/roles/profile_backend_phase1/templates/atlas-syncthing.container.j2
+++ b/ansible/roles/profile_backend_phase1/templates/atlas-syncthing.container.j2
@@ -0,0 +1,32 @@
 # Managed by Ansible. Do not edit manually.
 [Unit]
 Description=Atlas rootless Syncthing backend
 [Container]
 ContainerName=atlas-syncthing
 Image={{ backend_phase1_syncthing_image }}
 HostName=atlas-syncthing
 UserNS=keep-id
 User={{ backend_phase1_uid }}
 Group={{ backend_phase1_gid }}
 PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_syncthing_gui_port }}:{{ backend_phase1_syncthing_gui_port }}
 PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_syncthing_transfer_port }}:{{ backend_phase1_syncthing_transfer_port }}
 PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_syncthing_transfer_port }}:{{ backend_phase1_syncthing_transfer_port }}/udp
 PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_syncthing_discovery_port }}:{{ backend_phase1_syncthing_discovery_port }}/udp
 Environment=HOME=/var/syncthing
 Environment=STHOMEDIR=/var/syncthing/config
 Environment=STGUIADDRESS=0.0.0.0:{{ backend_phase1_syncthing_gui_port }}
 Environment=TZ={{ backend_phase1_timezone }}
 Volume={{ backend_phase1_syncthing_root }}:/var/syncthing:Z
 # Archive is intentionally shared with Samba; use a shared SELinux container label.
 Volume={{ backend_phase1_archive_dir }}:/data:z
 NoNewPrivileges=true
 DropCapability=all
 [Service]
 Restart=always
 RestartSec=10
 TimeoutStartSec=900
 [Install]
 WantedBy=default.target
--- a/ansible/roles/profile_server/tasks/main.yml
+++ b/ansible/roles/profile_server/tasks/main.yml
@@ -8,16 +8,6 @@
    fail_msg: >-
      server_firewall_backend must be firewalld for the Rocky server profile.
 - name: Require server container secret variables
  tags: [dotfiles, dotfiles:server, services]
  ansible.builtin.assert:
    that:
      - (vault_navidrome_db_password | default('')) | length > 0
      - (vault_postgres_root_password | default('')) | length > 0
    fail_msg: >-
      Server container secrets are missing. Define vault_navidrome_db_password and
      vault_postgres_root_password in secrets/vault.yml or another vars source.
 - name: Configure DuckDNS updater
  tags: [dotfiles, dotfiles:server, duckdns]
  ansible.builtin.import_tasks: duckdns.yml
@@ -30,15 +20,7 @@
    owner: "{{ item.owner }}"
    group: "{{ item.group }}"
    mode: "{{ item.mode }}"
-  loop: >-
+  loop: "{{ server_directories | default([]) }}"
    {{
      (server_directories | default([]))
      + (
          server_syncthing_directories | default([])
          if server_syncthing_enabled | default(true) | bool
          else []
        )
    }}
  loop_control:
    label: "{{ item.path }}"
@@ -71,6 +53,42 @@
  tags: [services, podman]
  ansible.builtin.include_tasks: podman-compose.yml
 - name: Ensure server SSH authorized key fragments directory exists
  tags: [services, ssh]
  ansible.builtin.file:
    path: "{{ server_ssh_authorized_key_directory }}"
    state: directory
    owner: "{{ server_username }}"
    group: "{{ server_user_group }}"
    mode: "0700"
  when: server_ssh_authorized_keys | length > 0
 - name: Manage server SSH authorized key fragments
  tags: [services, ssh]
  ansible.builtin.copy:
    content: "{{ item.key }}\n"
    dest: "{{ server_ssh_authorized_key_directory }}/{{ item.name }}"
    owner: "{{ server_username }}"
    group: "{{ server_user_group }}"
    mode: "0600"
  loop: "{{ server_ssh_authorized_keys }}"
  loop_control:
    label: "{{ item.name }}"
  when: server_ssh_authorized_keys | length > 0
 - name: Configure server SSH authorized key fragments
  tags: [services, ssh]
  ansible.builtin.lineinfile:
    path: /etc/ssh/sshd_config
    regexp: '^\s*AuthorizedKeysFile\s+'
    line: >-
      AuthorizedKeysFile {{ server_ssh_authorized_keys | map(attribute='name')
      | map('regex_replace', '^', '%h/.ssh/authorized_keys.d/') | join(' ') }}
    state: present
    validate: "sshd -t -f %s"
  notify: Reload SSH service
  when: server_ssh_authorized_keys | length > 0
 - name: Disable SSH root login on server
  tags: [services]
  ansible.builtin.lineinfile:
--- a/ansible/roles/profile_workstation_dev_wsl/tasks/main.yml
+++ b/ansible/roles/profile_workstation_dev_wsl/tasks/main.yml
@@ -66,6 +66,17 @@
  changed_when: false
  failed_when: false
 - name: Check whether the pinned Java 25 version is installed with Mise
  tags: [packages, mise, java, wsl]
  ansible.builtin.command:
    cmd: "mise where java@{{ workstation_mise_java_25_version }}"
  become_user: "{{ username }}"
  environment:
    HOME: "{{ user_home }}"
  register: workstation_mise_java_25_where
  changed_when: false
  failed_when: false
 - name: Check whether the pinned Maven version is installed with Mise
  tags: [packages, mise, maven, wsl]
  ansible.builtin.command:
@@ -86,6 +97,7 @@
    HOME: "{{ user_home }}"
  when: >-
    workstation_mise_java_where.rc != 0 or
    workstation_mise_java_25_where.rc != 0 or
    workstation_mise_maven_where.rc != 0
 - name: Ensure WSL boot configuration file exists
--- a/ansible/roles/wireguard_overlay/defaults/main.yml
+++ b/ansible/roles/wireguard_overlay/defaults/main.yml
@@ -0,0 +1,24 @@
 ---
 wireguard_overlay_enabled: false
 wireguard_interface: wg0
 wireguard_config_dir: /etc/wireguard
 wireguard_private_key_path: "{{ wireguard_config_dir }}/{{ wireguard_interface }}.key"
 wireguard_config_path: "{{ wireguard_config_dir }}/{{ wireguard_interface }}.conf"
 wireguard_address: CHANGEME_WIREGUARD_ADDRESS
 wireguard_listen_port: 0
 wireguard_mtu: 1420
 wireguard_firewalld_zone: wireguard
 wireguard_public_firewalld_zone: public
 wireguard_enable_ipv4_forwarding: false
 # Legacy zone-level masquerading; policy-level masquerading is required for inter-zone forwarding.
 wireguard_enable_masquerade: false
 # A list of narrowly scoped inter-zone forwarding rules, rendered as persistent
 # firewalld policies. Each item requires name, ingress_zone, egress_zone,
 # source, and destination.
 wireguard_forwarding_policies: []
 wireguard_reload_rootful_podman_networks: false
 wireguard_handshake_retries: 12
 wireguard_handshake_delay: 5
 wireguard_peers: []
 wireguard_packages:
  - wireguard-tools
--- a/ansible/roles/wireguard_overlay/handlers/main.yml
+++ b/ansible/roles/wireguard_overlay/handlers/main.yml
@@ -0,0 +1,10 @@
 ---
 - name: Restart WireGuard interface
  tags: [wireguard, services]
  ansible.builtin.systemd:
    name: "wg-quick@{{ wireguard_interface }}.service"
    state: restarted
    daemon_reload: true
  when:
    - wireguard_overlay_enabled | bool
    - not ansible_check_mode
--- a/ansible/roles/wireguard_overlay/tasks/main.yml
+++ b/ansible/roles/wireguard_overlay/tasks/main.yml
@@ -0,0 +1,255 @@
 ---
 - name: Configure WireGuard overlay
  tags: [wireguard, services]
  when: wireguard_overlay_enabled | bool
  block:
    - name: Validate WireGuard host configuration
      ansible.builtin.assert:
        that:
          - wireguard_address != 'CHANGEME_WIREGUARD_ADDRESS'
          - wireguard_address is match('^[0-9]{1,3}(\.[0-9]{1,3}){3}/[0-9]{1,2}$')
          - wireguard_peers | length > 0
          - wireguard_peers | map(attribute='host') | difference(ansible_play_hosts_all) | length == 0
        fail_msg: >-
          Configure this host's WireGuard address and peers, and run the first
          key bootstrap against every peer in the same play.
    - name: Validate WireGuard forwarding policies
      ansible.builtin.assert:
        that:
          - item.name is defined
          - item.ingress_zone is defined
          - item.egress_zone is defined
          - item.source is defined
          - item.destination is defined
        fail_msg: >-
          Every WireGuard forwarding policy requires name, ingress_zone,
          egress_zone, source, and destination.
      loop: "{{ wireguard_forwarding_policies }}"
      loop_control:
        label: "{{ item.name | default('unnamed policy') }}"
    - name: Install WireGuard userspace tools on mutable hosts
      ansible.builtin.dnf:
        name: "{{ wireguard_packages }}"
        state: present
      when: "'platform_fedora_iot' not in group_names"
    - name: Require WireGuard userspace tools in the booted deployment
      ansible.builtin.command:
        argv:
          - wg
          - --version
      changed_when: false
      failed_when: false
      register: wireguard_userspace_tools
    - name: Require active WireGuard userspace tools
      ansible.builtin.assert:
        that:
          - wireguard_userspace_tools.rc == 0
        fail_msg: >-
          WireGuard userspace tools are not present in the booted deployment.
          On Fedora IoT, reboot after rpm-ostree layers wireguard-tools, then
          rerun the WireGuard play.
    - name: Create private WireGuard configuration directory
      ansible.builtin.file:
        path: "{{ wireguard_config_dir }}"
        state: directory
        owner: root
        group: root
        mode: "0700"
    - name: Check for an existing WireGuard private key
      ansible.builtin.stat:
        path: "{{ wireguard_private_key_path }}"
      register: wireguard_private_key_stat
    - name: Generate a missing WireGuard private key
      ansible.builtin.command:
        argv:
          - wg
          - genkey
      register: wireguard_generated_private_key
      changed_when: true
      no_log: true
      when:
        - not wireguard_private_key_stat.stat.exists
        - not ansible_check_mode
    - name: Persist the generated WireGuard private key
      ansible.builtin.copy:
        content: "{{ wireguard_generated_private_key.stdout }}\n"
        dest: "{{ wireguard_private_key_path }}"
        owner: root
        group: root
        mode: "0600"
      no_log: true
      when:
        - not wireguard_private_key_stat.stat.exists
        - not ansible_check_mode
    - name: Require a private key during check mode
      ansible.builtin.assert:
        that:
          - wireguard_private_key_stat.stat.exists
        fail_msg: >-
          The initial WireGuard key generation cannot be simulated safely in
          check mode. Run the gated WireGuard play once without --check.
      when: ansible_check_mode
    - name: Read the persisted WireGuard private key
      ansible.builtin.slurp:
        src: "{{ wireguard_private_key_path }}"
      register: wireguard_private_key_material
      no_log: true
    - name: Derive this host's WireGuard public key
      ansible.builtin.command:
        argv:
          - wg
          - pubkey
        stdin: "{{ wireguard_private_key_material.content | b64decode | trim }}"
      register: wireguard_derived_public_key
      changed_when: false
      no_log: true
    - name: Publish this host's WireGuard public key
      ansible.builtin.set_fact:
        wireguard_public_key: "{{ wireguard_derived_public_key.stdout }}"
    - name: Require every peer's generated public key
      ansible.builtin.assert:
        that:
          - hostvars[item.host].wireguard_public_key is defined
          - hostvars[item.host].wireguard_public_key | length > 0
        fail_msg: >-
          The public key for {{ item.host }} is unavailable. The first
          WireGuard run must include every overlay host.
      loop: "{{ wireguard_peers }}"
      loop_control:
        label: "{{ item.name }}"
    - name: Render the private WireGuard interface configuration
      ansible.builtin.template:
        src: wg.conf.j2
        dest: "{{ wireguard_config_path }}"
        owner: root
        group: root
        mode: "0600"
      diff: false
      no_log: true
      notify: Restart WireGuard interface
    - name: Enable IPv4 forwarding for the ingress host
      ansible.posix.sysctl:
        name: net.ipv4.ip_forward
        value: "1"
        state: present
        sysctl_set: true
        reload: true
      when: wireguard_enable_ipv4_forwarding | bool
    - name: Create the WireGuard firewalld zone
      ansible.posix.firewalld:
        zone: "{{ wireguard_firewalld_zone }}"
        state: present
        permanent: true
      register: wireguard_firewalld_zone_result
    - name: Create the firewalld policy directory
      ansible.builtin.file:
        path: /etc/firewalld/policies
        state: directory
        owner: root
        group: root
        mode: "0755"
      when: wireguard_forwarding_policies | length > 0
    - name: Render WireGuard forwarding policies
      ansible.builtin.template:
        src: wireguard-forwarding-policy.xml.j2
        dest: "/etc/firewalld/policies/{{ item.name }}.xml"
        owner: root
        group: root
        mode: "0644"
      loop: "{{ wireguard_forwarding_policies }}"
      loop_control:
        label: "{{ item.name }}"
      register: wireguard_forwarding_policy_result
    - name: Reload firewalld after WireGuard firewall changes
      ansible.builtin.systemd:
        name: firewalld.service
        state: reloaded
      when:
        - wireguard_firewalld_zone_result is changed or (wireguard_forwarding_policy_result | default({})) is changed
        - not ansible_check_mode
    - name: Restore rootful Podman networking after firewalld reload
      ansible.builtin.command:
        argv:
          - podman
          - network
          - reload
          - --all
      register: wireguard_podman_network_reload
      changed_when: wireguard_podman_network_reload.stdout_lines | length > 0
      when:
        - wireguard_firewalld_zone_result is changed or (wireguard_forwarding_policy_result | default({})) is changed
        - wireguard_reload_rootful_podman_networks | bool
        - not ansible_check_mode
    - name: Assign the WireGuard interface to its firewalld zone
      ansible.posix.firewalld:
        interface: "{{ wireguard_interface }}"
        zone: "{{ wireguard_firewalld_zone }}"
        state: enabled
        permanent: true
        immediate: true
    - name: Manage legacy WireGuard zone masquerading
      ansible.posix.firewalld:
        zone: "{{ wireguard_firewalld_zone }}"
        masquerade: true
        state: "{{ 'enabled' if wireguard_enable_masquerade | bool else 'disabled' }}"
        permanent: true
        immediate: true
    - name: Permit this host's public WireGuard listener
      ansible.posix.firewalld:
        port: "{{ wireguard_listen_port }}/udp"
        zone: "{{ wireguard_public_firewalld_zone }}"
        state: enabled
        permanent: true
        immediate: true
      when: wireguard_listen_port | int > 0
    - name: Enable the WireGuard interface
      ansible.builtin.systemd:
        name: "wg-quick@{{ wireguard_interface }}.service"
        enabled: true
        state: started
        daemon_reload: true
      when: not ansible_check_mode
    - name: Apply pending WireGuard handlers before verification
      ansible.builtin.meta: flush_handlers
      when: not ansible_check_mode
    - name: Wait for every WireGuard peer handshake
      ansible.builtin.command:
        argv:
          - wg
          - show
          - "{{ wireguard_interface }}"
          - latest-handshakes
      register: wireguard_latest_handshakes
      changed_when: false
      retries: "{{ wireguard_handshake_retries }}"
      delay: "{{ wireguard_handshake_delay }}"
      until:
        - wireguard_latest_handshakes.stdout_lines | length == wireguard_peers | length
        - wireguard_latest_handshakes.stdout_lines | select('search', '\t0$') | list | length == 0
      when: not ansible_check_mode
--- a/ansible/roles/wireguard_overlay/templates/wg.conf.j2
+++ b/ansible/roles/wireguard_overlay/templates/wg.conf.j2
@@ -0,0 +1,26 @@
 # Managed by Ansible. Do not edit manually.
 [Interface]
 Address = {{ wireguard_address }}
 PrivateKey = {{ wireguard_private_key_material.content | b64decode | trim }}
 MTU = {{ wireguard_mtu }}
 SaveConfig = false
 {% if wireguard_listen_port | int > 0 %}
 ListenPort = {{ wireguard_listen_port }}
 {% endif %}
 {% for peer in wireguard_peers %}
 [Peer]
 # {{ peer.name }}
 {% if peer.comment is defined %}# {{ peer.comment }}
 {% endif %}PublicKey = {{ hostvars[peer.host].wireguard_public_key }}
 AllowedIPs = {{ peer.allowed_ips | join(', ') }}
 {% if peer.endpoint is defined %}
 Endpoint = {{ peer.endpoint }}
 {% endif %}
 {% if peer.persistent_keepalive | default(0) | int > 0 %}
 PersistentKeepalive = {{ peer.persistent_keepalive }}
 {% endif %}
 {% if not loop.last %}
 {% endif %}
 {% endfor %}
--- a/ansible/roles/wireguard_overlay/templates/wireguard-forwarding-policy.xml.j2
+++ b/ansible/roles/wireguard_overlay/templates/wireguard-forwarding-policy.xml.j2
@@ -0,0 +1,15 @@
 <?xml version="1.0" encoding="utf-8"?>
 <policy target="CONTINUE">
  <short>WireGuard forwarding: {{ item.name }}</short>
  <description>Managed WireGuard-to-LAN forwarding policy.</description>
 {% if item.masquerade | default(false) %}
  <masquerade/>
 {% endif %}
  <ingress-zone name="{{ item.ingress_zone }}"/>
  <egress-zone name="{{ item.egress_zone }}"/>
  <rule family="ipv4">
    <source address="{{ item.source }}"/>
    <destination address="{{ item.destination }}"/>
    <accept/>
  </rule>
 </policy>
--- a/ansible/site.yml
+++ b/ansible/site.yml
@@ -80,6 +80,13 @@
  roles:
    - profile_aegis
 - name: Configure WireGuard overlay
  hosts: wireguard_overlay
  become: true
  roles:
    - wireguard_overlay
 - name: Configure Atlas NAS profile
  hosts: atlas
  become: true
@@ -87,6 +94,13 @@
  roles:
    - profile_atlas
 - name: Configure Atlas phase-one backend services
  hosts: role_backend_phase1
  become: true
  roles:
    - profile_backend_phase1
 - name: Configure Rocky Linux server
  hosts: rocky_server
  become: true
--- a/ansible/templates/server/docker-compose.yml.j2
+++ b/ansible/templates/server/docker-compose.yml.j2
@@ -3,25 +3,6 @@
 name: server
 services:
  navidrome:
    image: docker.io/deluan/navidrome:latest
    container_name: navidrome
    restart: unless-stopped
    expose:
      - "4533"
    environment:
      ND_DATABASE_URL: "postgres://navidrome:{{ vault_navidrome_db_password }}@navidromedb:5432/navidrome_db?sslmode=disable"
      ND_SESSIONTIMEOUT: 24h
      ND_ENABLETRANSCODING: "true"
    volumes:
      - "/opt/navidrome/data:/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
      - "/opt/music:/music:ro{{ ',' ~ selinux_volume_option if selinux_volume_option else '' }}"
    user: "1000:1000"
    networks:
      - web
    depends_on:
      - navidromedb
  nginx-proxy-manager:
    image: docker.io/jc21/nginx-proxy-manager:latest
    container_name: nginx-proxy-manager
@@ -30,6 +11,8 @@ services:
      - "80:80"
      - "443:443"
      - "127.0.0.1:81:81"
    extra_hosts:
      - "host.containers.internal:host-gateway"
    volumes:
      - "/opt/npm/data:/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
      - "/opt/npm/letsencrypt:/etc/letsencrypt{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
@@ -55,20 +38,6 @@ services:
  #   networks:
  #     - web
  navidromedb:
    image: docker.io/library/postgres:13
    container_name: navidromedb
    restart: unless-stopped
    mem_limit: 2048m
    environment:
      POSTGRES_DB: "navidrome_db"
      POSTGRES_USER: "navidrome"
      POSTGRES_PASSWORD: "{{ vault_postgres_root_password }}"
    volumes:
      - "/opt/postgres/data:/var/lib/postgresql/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
    networks:
      - web
  gitea:
    image: docker.gitea.com/gitea:1.25.2
    container_name: gitea
@@ -87,24 +56,6 @@ services:
      - "3000:3000"
      - "127.0.0.1:222:22"
 {% if server_syncthing_enabled | default(true) | bool %}
  syncthing:
    image: docker.io/syncthing/syncthing:2
    container_name: syncthing
    hostname: syncthing
    restart: unless-stopped
    expose:
      - "8384"
    volumes:
      - "/opt/syncthing/config:/var/syncthing{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
      - "/srv/syncthing/data:/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
    ports:
      - "22000:22000/tcp"
      - "22000:22000/udp"
      - "21027:21027/udp"
    networks:
      - web
 {% endif %}
 networks:
  web:
--- a/dotfiles/workstation_dev_wsl/.config/mise/config.toml
+++ b/dotfiles/workstation_dev_wsl/.config/mise/config.toml
@@ -1,3 +1,6 @@
 [tools]
-java = "temurin-11.0.31+11"
+java = ["25.0.2", "temurin-11.0.31+11"]
 maven = "3.9.16"
 [env]
 JAVA_HOME = "{{ env.HOME }}/.local/share/mise/installs/java/25.0.2"
--- a/scripts/migrate_prometheus_data.sh
+++ b/scripts/migrate_prometheus_data.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
-# Copy the persistent Docker data from the retired Ubuntu server to the Rocky
+# Copy the persistent NPM and Gitea data from the retired Ubuntu server to the Rocky
 # replacement. Run this script on the Ubuntu source as root. It is a dry run
 # unless --execute and --quiesce-source are both supplied. Extended attributes
 # are deliberately not copied: Rocky must assign its own SELinux labels.
@@ -14,11 +14,8 @@ EXECUTE=false
 QUIESCE_SOURCE=false
 DATA_PATHS='
 /opt/navidrome/data
 /opt/music
 /opt/npm/data
 /opt/npm/letsencrypt
 /opt/postgres/data
 /opt/gitea/data
 '
@@ -26,8 +23,8 @@ usage() {
  cat <<'EOF'
 Usage: sudo ./scripts/migrate_prometheus_data.sh --destination USER@HOST [options]
-Copies persistent Navidrome, Nginx Proxy Manager, PostgreSQL and Gitea data to
+Copies persistent Nginx Proxy Manager and Gitea data to the Rocky server with
-the Rocky server with rsync. The destination Docker containers must be stopped.
+rsync. The destination Docker containers must be stopped.
 Options:
  --destination USER@HOST  Rocky SSH destination (required).
@@ -97,7 +94,7 @@ if [ -n "$IDENTITY_FILE" ]; then
 fi
 if [ "$EXECUTE" = true ] && [ "$QUIESCE_SOURCE" != true ]; then
-  fail '--execute requires --quiesce-source to keep PostgreSQL data consistent'
+  fail '--execute requires --quiesce-source to keep application data consistent'
 fi
 require_command rsync
--- a/secrets/.gitignore
+++ b/secrets/.gitignore
@@ -2,3 +2,4 @@
 .vault_pass*
 vault.local.yml
 vault.local.yml*
 /recovery/
--- a/secrets/vault.yml
+++ b/secrets/vault.yml
@@ -1,45 +1,83 @@
 $ANSIBLE_VAULT;1.1;AES256
-62633966363435396136666635303362663932366464323231363563373462383134326361346533
+61353065386233646137323235306631353635663530363237636231316265643562353465323430
-3465353461326565356435633866393230383838356235340a333036383038653134323066663031
+6165646466623962313835313537633137633766373930380a316335323962616265643136346666
-37373135643331356366373831343163363835656462343962636538623937356231376337616330
+63336133336131346336383534356637623831363138323165633262386333363535393365383233
-3831626261343761310a306133633264613430613165343265303664383439333230663665333231
+6234393835653439370a313963313365373633323464343263383661383336363662633133643232
-30393934323438333066383737663665316634613932353232343334626261636661393434646163
+34366634383862363635653034313531623330396639616462343630326162316535643465653532
-63316537383866353338353261373161623562343037383032633932383630666339633234326639
+36326534333637376462353561343964633636366331363833313263353133383636623537303663
-64303735663532376433393464616230616236353134383734623132333061356664613039323265
+35393032316439336666343161653439643638376134363535656262343963393365623432336433
-35373434336261313438633866643765323330623336343732346465613264613666616631303633
+35383934313762313037326430316666363731666231336534326661353034333063643364343230
-31333437623437626135623032306434306538323461623161336431353630336539646531313365
+65333739303566366263333565333465613136646237623937393733623438613832393634663463
-30356330356438353037663262643463363636386162393764323133373261376263663338636333
+39376131313234333039633735613233373931613232653036663665316636303961653834366339
-33336537383061643234356365653137333639623863303530666665373663376166316533623737
+36353730316132316233303964303839363161346564396163336137663134353062363733656430
-31616262363132326133666230396636663035343432633830323430336332326261613932633837
+37643339326661653031376265646132623162373562393437373437313732396537383939333666
-62303232306331663936366435666164383335313335326662663363643563643938623739386663
+62353036316633306666313461663033303830393765396131643035353730383931646239663935
-65356431353362623634333437346566363166366161313132653131613861386437306562633934
+32626461316364386135303761383837613063336466363162323332663764616464373565383231
-38306135636161366530303461636665386639396639356265323361623639616265323462333534
+61346463336566346533326535376439643133613762383633396131323632356533636139336365
-61626439616631356532353437653539333631636265346238653439313130326239633035613130
+62393838316634623932643034376631333539343965383436613364643962363834346337353334
-65366161356231356638313633393735356465393339343034356138316366656431336435386437
+32656439366439313734353963343133333533653839613632323338336131373566613835393536
-36366339366463396638303062366263356436666232393437613766623631313264646565316534
+31663433616334373432376531346435336530303936356461303163646463613661643161313661
-32373534366363373737616563616161346265323936336665653934656365323731633637376331
+66663866343565616631616338353737356164353562366164383736346131666662623132333466
-31336262356632313533393366346565373434373134653630303431643037363561613830663339
+39383865653631373232393433663430643961646265386166333137643966303834363262373636
-39313837356362643164386432653030306132643234303162363463376130666239653461623736
+62396434373363353636376133666133663162653265313139313732353639336232333862643036
-65333734303532356462636538326430353831336562666563336333323764346234643037373064
+64386231336561396537326139346566306434633934343038663165396665363032383466633662
-63343533386564356232633661346232666135393365323133323365663637373261396264333432
+62336163633964363435386630343966333162333730336138333239646631633132663931376462
-64616463643931653162373666323731653635616633386231653863623830666637623638353062
+33663139356261313065376636613930353735396131306538306664646135636336643032623131
-61363339613364343239363336626266386561343032333262396436663736353835303863643865
+38346264333331353633326535326431626563323036313665643337353563333339646430386564
-35616136363830326661383066316537633537616565343361633036373163316566653638343638
+31613435383036313430316366323636663735326336393338353835323861333564363832656462
-33323162376537353961383965666165663631396663356533643432356630396435356636366636
+35336435623261326363633033316130393062616339353263643062633331646137376135656365
-32363264303633656335333335356166323164386338363437663435336635643334646532616539
+35636139336564346164616235616431326531333433646330386134323932373339646536356464
-66646336393834613337336661336638613463626230336132386265396165656461623533333738
+66343533326534326165323564663533653666633035343163633832393361336462343937623165
-33353063306336623463396130386335383338383861376330616566643638333230303862356462
+62383931326630363036396333313931393836366439653433623165666166356338653364336534
-63356464313263666538306230636363643665643933323236363864303634343539326239363134
+35333936653833386163633738326164386166613561333530633937343230363366333662666539
-65376231623836363730376631303032393330326362383438373434383633656134373539653461
+39333361633933663735303438663239303536363433313962643137386533633539326365383765
-38306632636463346365396131316234623736626335633361663861316437326635633237346262
+37636538386339333935386132353265353031643662616330316463623661663738353433313830
-38643730666130656335663232366362333164353433613731363131366138633766623433363031
+36373963633166333464653338343830373063323536383364393033393235326639613662343737
-37613337383961386661393733623238393062663065663931313231366366626261666336656134
+38663362636331343061646465313237313431373433353361353265333766633463353632646536
-63646237643864643462653337306462646631663433663461343764306163646466326334323335
+31323231306138323031396630656538363930373439336234343963616334363632653738316465
-61396162353032633937333066313438333461376161666166336337356430373737313266363238
+63653938373830336362313238656266613362636634616537653863336132343931616262396130
-63633365613331636234333765633536653639343234396262653438353132623239303431316134
+66393239303866656232653832343132366537333537343635666563343639323433383163613335
-35663930323535373830313766353630636237343330346232316637336531336466326564306630
+39613533376634316133633430303535306266656333626264343733666335393661666561396633
-62356639356330396465353432333135313130653366303931616165663638633461613961643766
+39346265316137326465326635396362333565393133623637633132616232326263663662343137
-62633564666566616665366336396436386330323536356633323965343566396232303434666534
+33363733306135363361643031306265363733656362386666306334333035393839636533343363
-33333636313136326535303136643265393834613733343362346333336339636437353236326161
+35396638616636633639343930373136376339346162393061393765363837646365383866636131
-65633230656531633238623830343432663365313532343435623133636239333763633930316666
+33653465666239393133616232636231333332396138376332393664343364643835306530393238
-34363535313731666432
+34663237303530303837663535646263393931373531393039356336316561653130356262636562
 38336362326639653237626634376334666565653036353236313634376364626338646538386536
 38626636386466373566646166393963643164343536373236396138303532393161363335386638
 32633032393737626363613463323366366637616361313537356136626661626633613739323338
 35383963666431343566356562333234663936376562616638636261303466633539376334303331
 39303834663234663063356233313962326664383839393832303462643636393034383434303465
 64333635376135326333356435373734643430623736373234643335343130383066326436356664
 63346663326364343634303930343338336139313864316165366232643537366635653764353763
 31363863633261643263303433373330366161323166366462336332313135366338393334653764
 66353733653137663835663731373364613030373334663061313433373861613665363236633130
 65613965366636343465336533613438373466383737373366653965633437323562643966396431
 39303033643438633762633263326132663466643438656366363431616237633031333936313831
 30323930383233313032323638356333626230333764363662313662646536643839353032353462
 30326166653937353130623133303533343934633565393831623033303234316330353432313266
 30636536633933376365623665616262663236383731633633346232613366333137396139306363
 35633336643266326335303261666666653536666630613639376336373237646134306462616537
 33343561373162666332613634643837343566646161373065366637653135613632353334636363
 63363232303963646530333366663862323264326536643337323266396566316233613630303637
 66646366376466373931613734363931316230323063373666653062373364396433633762633762
 38613933323733653238383935623230383562646563363833653838636165626365646537383639
 33666535656363393562316336633439636138373365623431393965653765306138646234663938
 65653133663663393731646337386535333261643932336132396237323930306136643534353930
 65636438396432623034626561613137336138623265393064383034623863303166356138393564
 37373164626634653662326234333539663735323464613334616130643937373730363263633366
 31393937326432386165343338313031376565313866363731643534313233303064373935303538
 31343832336230393636653432653162336361383963633766343461653466316337353931333363
 63313137303564336630343937356564643763383764613362366634373362666465626334336539
 64366533376165306532343461613265366266383862323032333465336161663161376630316465
 30306562666163646235656664653635366461366435663961623635383437663564356563346462
 31636234663765623838333237393239373564366262613637363938653463396530613963643837
 38636634376637366332623035313465393762653865623130336263343663303066366135616639
 63333964356466613038303263366462346261353030646532366361393965306435613131316463
 65366266376637323764643239323730366565633335666638666334663635373961303637383861
 35313431646434656562333937663837393038386361616630626532636339306432353434656165
 33663261383166386432383465666136376237346565303164363461666663346130346162316338
 62373061353034316234303835663439396434343738303764376665336239626238386436386234
 61306166383637366266393730323732386163366261393630336431633862353761343763363665
 61323039396234393835303633363339373633653334343766653032313230343464326664356566
 3462623830666664626633373966363866333337383730313066
--- a/secrets/vault.yml.example
+++ b/secrets/vault.yml.example
@@ -3,13 +3,13 @@ vault_duckdns_token: "CHANGEME"
 vault_personal_full_name: "REPLACE_ME"
 vault_git_email: "REPLACE_ME"
 vault_git_signing_key: "REPLACE_ME"
 vault_icloud_email: "REPLACE_ME"
 vault_protonmail_email: "REPLACE_ME"
 vault_icloud_mail_password: "REPLACE_ME"
 vault_git_work_email: "REPLACE_ME"
 vault_git_work_gpg: "REPLACE_ME"
 vault_openai_api_key: "REPLACE_ME"
 vault_navidrome_db_password: "REPLACE_ME"
 vault_postgres_root_password: "REPLACE_ME"
 vault_ikaros_authorized_ssh_keys:
  - "ssh-ed25519 REPLACE_ME"
 vault_aegis_icloudpd_apple_id: "REPLACE_ME"
 vault_atlas_admin_password_hash: "REPLACE_WITH_A_SHADOW_COMPATIBLE_HASH"
 vault_atlas_samba_password: "REPLACE_ME"
 vault_atlas_immich_db_password: "REPLACE_ME"
 vault_atlas_borg_passphrase: "REPLACE_WITH_A_STRONG_UNIQUE_PASSPHRASE"
Author	SHA1	Message	Date
Fabio Scotto di Santolo	fa1c8c0b82	Document Atlas NAS backups and monitoring	2026-09-25 14:06:28 +02:00
Fabio Scotto di Santolo	0b6efc9ad8	Harden Atlas USB backup cleanup and document restorecon workflow	2026-09-25 08:02:44 +02:00
Fabio Scotto di Santolo	361ee77d72	Add manual Atlas USB backup and reminder services	2026-09-24 08:55:52 +02:00
Fabio Scotto di Santolo	d4e40d423a	Document deferred Cerberus management node plan	2026-09-23 09:01:18 +02:00
Fabio Scotto di Santolo	0a5c2ac1a4	Add progress logging to Atlas Borg backups	2026-09-22 21:21:21 +02:00
Fabio Scotto di Santolo	48a7f57f7e	Add Cockpit storage management to Atlas and Prometheus	2026-09-22 20:49:18 +02:00
Fabio Scotto di Santolo	defa98c968	Install Cockpit Podman plugin on Atlas	2026-09-22 15:00:10 +02:00
Fabio Scotto di Santolo	21e41f4fc1	Prepare Atlas encryption dependencies and update Vault placeholders	2026-09-22 14:37:25 +02:00
Fabio Scotto di Santolo	e10c6694f8	Document populated Atlas archive and pending Borg evaluation	2026-09-21 22:15:42 +02:00
Fabio Scotto di Santolo	4c10af3187	Add openssl to Fedora base packages	2026-09-21 12:07:50 +02:00
Fabio Scotto di Santolo	3ac732751c	Add pinned Java 25 to Mise on WSL workstation	2026-09-21 11:57:51 +02:00
Fabio Scotto di Santolo	e837b0059b	Document validated Atlas Borg backup activation	2026-09-18 10:09:12 +02:00
Fabio Scotto di Santolo	7e498514dd	Add encrypted Borg backups for Atlas	2026-09-18 10:00:45 +02:00
Fabio Scotto di Santolo	e7836ea25f	Manage Atlas ZFS snapshots and scrubs	2026-09-17 23:10:53 +02:00
Fabio Scotto di Santolo	de2c24d15c	Mount the shared Archive in Syncthing	2026-09-17 19:41:23 +02:00
Fabio Scotto di Santolo	bd13cb65cc	Move temporary Navidrome and Syncthing services to Atlas	2026-09-17 10:18:23 +02:00
Fabio Scotto di Santolo	77afdda0a3	Move WireGuard gateway to Aegis	2026-09-17 09:08:25 +02:00
Fabio Scotto di Santolo	add75d74e9	refactor(atlas): separate service and host backup datasets	2026-09-17 00:06:46 +02:00
Fabio Scotto di Santolo	e46a2b22d7	Update Atlas NAS validation status and remaining TODOs	2026-09-16 10:25:38 +02:00
Fabio Scotto di Santolo	a97c64b08f	Configure Aegis host DNS and NFS support	2026-09-16 10:19:06 +02:00
Fabio Scotto di Santolo	160d63c02d	Add Atlas media and storage services [Phase 1] (#9 ) * Add Atlas media and storage services * Document Atlas backend phase one and WireGuard deployment * Enable Atlas NAS management and document bootstrap workflow * Harden Atlas network, SSH, firewall, and sharing * Rotate Ansible Vault secrets * Allow configurable Aegis SSH users and authorized keys * Manage Aegis SSH authorized key fragments * Manage SSH authorized key fragments for infrastructure hosts * Harden Rocky storage and sharing configuration * Verify WireGuard handshakes and restore Podman networking	2026-09-15 22:39:28 +02:00
Fabio Scotto di Santolo	73bf2cd62a	feature: add WSL container tooling	2026-09-15 16:38:33 +02:00
		`@@ -0,0 +1,2 @@`
							`[Unit]`
							`OnFailure=atlas-monitor-failure@%n.service`