docs(audits): R-82 Phase 0 — P0.1 weekly CONFIRMED, P0.2 benign, P0.3 STOP (capacity)
Read-only gate. No code, no backup triggered, no config changed. P0.1 weekly CONFIRMED: the only 7-day-exposed state is the non-SMB half of settings.json (storage_paths, app_backup toggles, notification prefs, password_hash, launcher token) — none catastrophic, all recoverable. The two items that would have overturned it, encryption.key and the offbox credentials, are STABLE files unchanged since first boot, so a 7-day-old copy is byte-identical. Everything referentially coupled to app state is carried daily by Tier-1/2/3, and Tier-3 offsite was verified running and ok on both production boxes. CONDITIONAL: drill-r50 has offsite:null, so the verdict does not hold there. P0.2 RESOLVED, benign: PBS returns HTTP 200 with zeroed usage to the namespace-scoped token (DatastoreBackup, not Datastore.Audit), so PVE prints 0/0/0. Ground truth via the hub ep0 df op: 28.9% of 37.2 GB. Writes work — the 07-18 snapshot is owned by this token, 9.74 GB, verify ok. P0.3 STOP: 37.2 GB datastore, 10.8 GB used, 80% alert at 29.8 GB. Encrypted per-tenant backups do not dedup across customers. Current 3 boxes project to ~15-21 GB weekly keep-3; each additional customer costs ~5-10 GB, so the 80% alert fires at roughly the SECOND additional customer — inside the alpha horizon. Needs a ruling on datastore size / retention before recurring writes.
This commit is contained in:
Claude Code
@@ -0,0 +1,243 @@
|
||||
# SPIKE — R-82 Phase 0: the three gates before the backup target split (2026-07-26)
|
||||
|
||||
**Class:** read-only Phase-0 gate for R-82. **No code written. No backup triggered. No config changed.**
|
||||
Baselines: felhom-agent `dfd5d73` v0.96.0, felhom-controller `47fda06` v0.173.0, felhom.eu `c73800c`
|
||||
hub v0.75.0. All three trees clean at `origin/main`.
|
||||
|
||||
---
|
||||
|
||||
## Verdicts — one gate returns STOP
|
||||
|
||||
| Gate | Verdict |
|
||||
|---|---|
|
||||
| **P0.1** — what is exposed for seven days | **weekly CONFIRMED**, with the exposed set named and one conditional |
|
||||
| **P0.2** — the `pvesm status` 0/0/0 anomaly | **RESOLVED — benign PVE-side reporting artifact.** Not a blocker |
|
||||
| **P0.3** — capacity headroom | **🛑 STOP.** The 80% alert is reached at roughly the **second additional customer**, inside the alpha horizon |
|
||||
|
||||
**R-82 stops here pending an operator ruling on P0.3.** P0.1 and P0.2 clear; the blocker is
|
||||
capacity, not correctness.
|
||||
|
||||
---
|
||||
|
||||
## P0.1 — What is exposed for seven days?
|
||||
|
||||
### Method
|
||||
|
||||
The whole-guest vzdump covers what PVE will actually snapshot. Live guest config (`pct config 9201`,
|
||||
demo-felhom):
|
||||
|
||||
```
|
||||
rootfs: local-lvm:vm-9201-disk-0,size=32G → IN the snapshot
|
||||
mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/docker,backup=1,size=200G → IN
|
||||
mp1: local-lvm:vm-9201-disk-2,mp=/mnt/sys_drive,backup=1,size=50G → IN
|
||||
mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives → BIND — NOT in the snapshot
|
||||
mp9: /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1 → BIND — NOT in
|
||||
```
|
||||
|
||||
Corroborated by the agent's own report: `"uncovered_volumes": ["/etc/felhom-bootstrap",
|
||||
"/mnt/felhom-drives"]`.
|
||||
|
||||
**The daily tiers are alive** — this is what makes the answer come out the way it does, so it was
|
||||
verified rather than assumed:
|
||||
|
||||
| Customer | Tier-3 offsite (restic, daily) | Evidence |
|
||||
|---|---|---|
|
||||
| demo-felhom | **running** | `last_run 2026-07-26T02:17:56Z`, `last_status "ok"`, 28 snapshots, 1.08 GB / 50 GB |
|
||||
| demo-hp | **running** | `last_run 2026-07-26T02:15:50Z`, `last_status "ok"`, 4 snapshots, 29 MB / 50 GB |
|
||||
| drill-r50 | **`offsite: null` — not configured** | see the conditional below |
|
||||
|
||||
### The exposed-state table
|
||||
|
||||
| State | Where it lives | In the vzdump? | Covered by a DAILY tier? | 7-day staleness cost |
|
||||
|---|---|---|---|---|
|
||||
| **`encryption.key`** (app-secret key) | controller data dir | ✅ | ❌ none | **NONE — the key is STABLE.** `mtime 2026-07-18 16:32`, unchanged since creation. A 7-day-old copy is byte-identical. *This was the biggest theoretical risk and it is clean.* |
|
||||
| **`settings.json` — SMB shares** (`smb`, `smb_shares`) | controller data dir | ✅ | ✅ **yes** — R-7b payload in tier-2 **and** offsite (`_shares-manifest.json` + `passdb.tar`, staged 2026-07-26 02:16) | none |
|
||||
| **`settings.json` — everything else** | controller data dir | ✅ | ❌ **none** | **THE EXPOSED SET.** `mtime 2026-07-26 10:02` — actively changing. Detailed below |
|
||||
| `controller.yaml` | controller data dir | ✅ | ❌ | **NONE in practice** — the hub is the source of truth (`config_pull` / bootstrap re-fetch overwrites it; it explicitly never touches `settings.json`) |
|
||||
| offbox credentials (`repo_password`, `ssh_key`, `known_hosts`) | controller data dir | ✅ | ❌ | **NONE — stable** (`mtime 2026-07-18 16:55`) *and* the restic password is escrowed hub-side |
|
||||
| App definitions (`/opt/docker/stacks/*`) | guest rootfs | ✅ | ✅ **yes** — Tier-1 recovery unit captures `compose/` per app, daily; tier-3 lifts it offsite | none |
|
||||
| App data (DB dumps, volume tars) | app drives | ✅ (volumes on mp0) | ✅ **yes** — Tier-1/2/3, daily | none |
|
||||
| Customer bulk data | `/mnt/felhom-drives` | ❌ bind | ✅ Tier-2/3 per class | n/a — never was PBS's job |
|
||||
| `bootstrap.json` | host, bind at mp9 | ❌ bind | ❌ | none — agent-side state, regenerated at provision |
|
||||
| `metrics.db` | controller data dir | ✅ | ❌ | metrics history only — cosmetic |
|
||||
| Guest rootfs / OS / packages | rootfs | ✅ | ❌ | 7 days of OS drift. Re-derivable from the golden image + host-install |
|
||||
|
||||
### What is actually lost at 7 days
|
||||
|
||||
Only the non-SMB half of `settings.json`, and none of it is catastrophic:
|
||||
|
||||
| Key | Consequence at 7 days | Recovery |
|
||||
|---|---|---|
|
||||
| `storage_paths` | drive enrollments made in the last week are lost from the registry | drives are **physical and still present** — re-run the drive wizard |
|
||||
| `app_backup` | per-app backup toggles revert | customer re-selects |
|
||||
| `notifications` | prefs revert | hub seeds prefs at claim (F11/F12); `customer_notifications` is hub-side |
|
||||
| `password_hash` | dashboard password reverts | hub-issued claim-reset code — the supported path |
|
||||
| `launcher_share_token` | shared launcher URLs break | regenerate + reshare (v0.165.0) |
|
||||
| `claim_*`, `db_validations`, `hub_*` | operational state | re-derived on next hub contact |
|
||||
|
||||
### Verdict: **weekly CONFIRMED**
|
||||
|
||||
Nothing catastrophic is exposed. The two things that would have overturned this — the app-secret
|
||||
encryption key and the offsite credentials — are **stable files that have not changed since first
|
||||
boot**, so a 7-day-old copy is identical to a fresh one. Everything referentially coupled to app
|
||||
state (definitions, DB dumps, volumes, bulk data, SMB shares) is carried **daily** by Tier-1/2/3, and
|
||||
Tier-3 offsite was verified running and `ok` on both production boxes this morning.
|
||||
|
||||
**⚠️ The conditional — and it is load-bearing.** This verdict depends on the daily offsite tier being
|
||||
alive. **drill-r50 reports `offsite: null`.** On a box with no Tier-3, PBS-weekly would be the *only*
|
||||
DR tier, and the 7-day window would then cover **app data and app definitions**, not just settings —
|
||||
a completely different risk. Recommended ruling to carry into Slice D: **PBS weekly is only
|
||||
sufficient where Tier-3 offsite is enabled and healthy; a box without it needs either offsite
|
||||
enabled first, or a shorter PBS cadence.** That is a cadence decision and belongs to the operator.
|
||||
|
||||
---
|
||||
|
||||
## P0.2 — The `pvesm status` 0/0/0 KiB anomaly: RESOLVED, benign
|
||||
|
||||
**It is a PVE-side reporting artifact. The datastore is real, writable, and has capacity.**
|
||||
|
||||
Reproduced, then settled from three independent directions:
|
||||
|
||||
**1. The anomaly is real and consistent** — both the CLI and the API agree:
|
||||
```
|
||||
pvesm status --storage felhom-pbs → active, Total 0, Used 0, Available 0, 0.00% (rc=0, empty stderr)
|
||||
pvesh get /nodes/demo-felhom/storage/felhom-pbs/status
|
||||
→ {"active":1,"avail":0,"content":"backup","enabled":1,"shared":1,"total":0,"type":"pbs","used":0}
|
||||
```
|
||||
|
||||
**2. PBS itself returns zeros to this token — with HTTP 200, not 403.** Queried directly over the wg
|
||||
tunnel as `felhom@pbs!demo-felhom`:
|
||||
```
|
||||
GET /api2/json/admin/datastore/felhom-offsite/status → http=200
|
||||
{"data":{"avail":0,"backend-type":"filesystem","total":0,"used":0}}
|
||||
GET /api2/json/status/datastore-usage → http=200
|
||||
{"data":[{"backend-type":"filesystem","mount-status":"nonremovable","store":"felhom-offsite"}]} ← usage fields OMITTED
|
||||
GET /api2/json/admin/datastore/felhom-offsite/snapshots?ns=demo-felhom → http=200, real data
|
||||
```
|
||||
The token is **namespace-scoped** — `GET .../namespace` returns exactly `[{"ns":"demo-felhom"}]`. It
|
||||
holds `DatastoreBackup` on `/datastore/felhom-offsite/demo-felhom` (per the tenantsync `provision`
|
||||
op's dual-grant), **not** `Datastore.Audit` on the datastore root. PBS answers the status call
|
||||
rather than refusing it, and zeroes/omits the usage figures it will not disclose. PVE has no way to
|
||||
distinguish "zero" from "not permitted" and prints 0/0/0.
|
||||
|
||||
**3. Ground truth from an independent path says the datastore is healthy.** The hub reads fill over
|
||||
the ep0 SSH `usage` op (a literal `df` on the datastore path — `scripts/felhom-tenantsync.sh` v1.2.0,
|
||||
read-only, no admin token):
|
||||
```
|
||||
2026/07/26 11:46:44 [INFO] PBS-DR box refreshed: 28.9% full (10.8 GB of 37.2 GB)
|
||||
2026/07/26 12:02:42 [INFO] PBS-DR box refreshed: 28.9% full (10.8 GB of 37.2 GB)
|
||||
```
|
||||
|
||||
**4. Writes demonstrably work with this exact token.** The 2026-07-18 snapshot is owned by
|
||||
`felhom@pbs!demo-felhom`, is 9.74 GB, encrypted, and `verification.state == "ok"`.
|
||||
|
||||
**Conclusion: cosmetic.** Scheduling recurring writes here is safe on this ground. Two follow-ups
|
||||
recorded, neither blocking: PVE's storage view will keep showing 0% for this storage (the operator
|
||||
must read fill from the hub's PBS-DR gauge, not `pvesm status`), and granting `Datastore.Audit` at
|
||||
the namespace would be the fix if the PVE-side number is ever wanted — a tenantsync `provision`
|
||||
change, deliberately **not** made here.
|
||||
|
||||
---
|
||||
|
||||
## P0.3 — Capacity: 🛑 STOP
|
||||
|
||||
### Measured
|
||||
|
||||
| Fact | Value | Source |
|
||||
|---|---|---|
|
||||
| `felhom-offsite` datastore total | **37.2 GB** | ep0 `df`, via the hub's usage op |
|
||||
| Used now | **10.8 GB (28.9%)** | same, 2026-07-26 12:02 |
|
||||
| 80% alert threshold | **29.8 GB** | hub PBS-DR box checker (`fill warn=80% crit=90%`) |
|
||||
| **Headroom to the alert** | **19.0 GB** | |
|
||||
| demo-felhom snapshot, logical | **9.74 GB** (`root.pxar.didx` 9.739 GB) | PBS API |
|
||||
| demo-hp local vzdump, compressed | 1.48 GB | host-report |
|
||||
| demo-felhom local vzdump, compressed | 5.69 GB | host-report |
|
||||
| Snapshots in the datastore today | **1** (demo-felhom); demo-hp namespace exists, **0 snapshots** | PBS API |
|
||||
|
||||
The single 9.74 GB logical snapshot accounts for essentially all of the 10.8 GB used — first-snapshot
|
||||
compression is ≈1:1 here, which is expected when the source is already-compressed Docker layers.
|
||||
|
||||
### The dedup fact that makes this worse
|
||||
|
||||
**Backups are client-side encrypted per tenant** (`encryption-key` in `storage.cfg`, one key per
|
||||
customer). PBS derives chunk digests under the crypt key, so **chunks do not dedup across
|
||||
customers.** Every customer's snapshots cost their full independent size. There is no fleet-scale
|
||||
dedup dividend to lean on.
|
||||
|
||||
### Projection (weekly, `keep-last=3` = three weeks)
|
||||
|
||||
Weekly *incremental* cost is **not measured** — there has never been a second PBS snapshot of any
|
||||
guest to measure it from. Bracketed at 5–20% of full per week and stated as a range rather than a
|
||||
point estimate:
|
||||
|
||||
| Box | First snapshot | 3 retained weekly | Note |
|
||||
|---|---|---|---|
|
||||
| demo-felhom | 9.7 GB | **10.7 – 13.7 GB** | already on disk |
|
||||
| demo-hp | ~2.5 GB | **2.8 – 3.5 GB** | scaled from local-vzdump ratio 5.69→9.74 (×1.71) |
|
||||
| drill-r50 | ~1.5–3 GB | **1.7 – 4.0 GB** | never backed up; estimate only |
|
||||
| **Fleet total** | | **≈ 15 – 21 GB (40–57%)** | comfortably under 80% |
|
||||
|
||||
The current three boxes fit. The problem is the next ones:
|
||||
|
||||
```
|
||||
Steady state, 3 boxes: ~18 GB (48%)
|
||||
80% alert: 29.8 GB
|
||||
Headroom: ~12 GB
|
||||
Per additional customer: ~5–10 GB (first snapshot + 2 retained weekly increments,
|
||||
no cross-tenant dedup)
|
||||
→ the 80% alert fires at roughly the SECOND additional customer.
|
||||
```
|
||||
|
||||
### Why this is a STOP
|
||||
|
||||
The alpha horizon is *"the first remote tester"* (ROADMAP pre-invite checklist) and beyond — that is
|
||||
squarely within one-to-two additional customers. The gate condition is met: **projected fill crosses
|
||||
the 80% alert threshold within the alpha horizon.**
|
||||
|
||||
This is not a reason to abandon R-82 — it is a reason not to schedule recurring writes into a 37.2 GB
|
||||
datastore without first ruling on which lever moves:
|
||||
|
||||
| Lever | Effect | Cost |
|
||||
|---|---|---|
|
||||
| **Grow the ep0 datastore** | the clean fix; 37.2 GB is small for fleet DR | Hetzner resize — money + an operator action |
|
||||
| **Retention `keep-last=2`** weekly | ~1 snapshot/guest saved, ≈15% | two weeks of recovery depth instead of three |
|
||||
| **Fortnightly PBS** | halves increment accrual | doubles the P0.1 exposure window to 14 days — would reopen P0.1 |
|
||||
| **Exclude mp1 `/mnt/sys_drive`** from the snapshot | 1.8 GB used of 50 GB today | needs a ruling on what is on it |
|
||||
| **Stage the rollout** | drill + demo-hp now, defer real customers | buys time, does not solve it |
|
||||
|
||||
**Recommendation (operator's call):** grow the datastore, and set PBS retention to `keep-last=2`
|
||||
weekly for now. Together they roughly double the runway. But the sizing question deserves an explicit
|
||||
answer before recurring writes start, because the failure mode — a DR datastore that silently
|
||||
refuses writes at full — is exactly the class of "applied and empty" fault R-82 exists to fix.
|
||||
|
||||
---
|
||||
|
||||
## Not collected
|
||||
|
||||
| Item | Why | Needed access |
|
||||
|---|---|---|
|
||||
| Whether the ep0 datastore filesystem is **dedicated** or shares the root disk | no direct ep0 SSH; the hub's `usage` op returns only total/used/avail for the datastore path | root on ep0 (167.233.158.164) |
|
||||
| Actual PBS **weekly incremental** size for these guests | no second snapshot has ever existed to diff against | resolved by Slice D's first weekly cycle — the projection should be re-measured then, not trusted |
|
||||
| Other namespaces' usage in `felhom-offsite` | the PVE token is namespace-scoped (sees only `demo-felhom`) | PBS admin token |
|
||||
| demo-hp / drill-r50 host-level state | no SSH key; break-glass not used, per standing scope | baked key or explicit break-glass authorisation |
|
||||
|
||||
---
|
||||
|
||||
## Observations
|
||||
|
||||
1. **drill-r50 has no offsite tier at all** (`offsite: null`) and no backups of any kind. It is the
|
||||
box the rollout plan puts *first*, which is right — but it is also the box where the P0.1 verdict
|
||||
does not hold, so its PBS cadence cannot simply inherit the fleet ruling.
|
||||
2. **`last_success` is not a field** on the controller's offsite object — the shape is
|
||||
`last_run` + `last_status`. An early probe here asked for `last_success`, got `null`, and briefly
|
||||
looked like a failing daily tier. Recorded because it is the same shape as the R-80 false alarm:
|
||||
*absence of a field read as evidence of failure.* The real values are `last_status: "ok"` on both
|
||||
production boxes.
|
||||
3. **The PVE storage view will permanently under-report this datastore at 0%.** Any future operator
|
||||
check of PBS fill must use the hub's PBS-DR gauge. Worth a line in the runbook when R-82 lands.
|
||||
4. **`/mnt/sys_drive` (mp1, `backup=1`, 50 GB allocated, 1.8 GB used)** is inside the snapshot. Nobody
|
||||
asked for it to be; it is worth confirming during Slice D that its contents justify the space at
|
||||
weekly cadence.
|
||||
5. `07-backup-architecture.md`'s tier table already carries a **PBS whole-guest** row saying
|
||||
*"bind-mounted drives out of reach"* — which the live `uncovered_volumes` confirms exactly. The
|
||||
doc is stale on versions but correct on this mechanism.
|
||||
Reference in New Issue
Block a user