admin
9268d9933b
Spike, no product change. Venue u629488-sub4 (tester-1, operator ruling); scratch repo removed, authorized_keys restored byte-identical. Closed R-436 (due-check cleared), R-430. Opened R-820, R-821, R-822. R-95 and R-342 updated. 07 §D [FACT] block. STATUS: two operator decisions. Register 326 -> 327. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2.7 KiB
R-342 — the ep0 datastore safeguard: options (2026-10-03, read only, nothing changed on ep0)
The gap: ep0's server snapshot covers the 38 GB system disk, not /mnt/pbs-datastore (a separate
100 GB Hetzner Cloud Volume). The hub's Offsite page read today: datastore felhom-offsite,
19.5 GB used of 97.9 GB (20 %). ep0 holds the only off-premises copy of the households'
whole-box backups. Those backups are client-side encrypted per customer (encryption-key in each
box's storage.cfg, 07 §8a) — a copy elsewhere holds ciphertext only.
A correction first
R-342's first candidate does not exist. Hetzner Cloud has no Volume snapshots: server snapshots and backups exclude attached volumes, and volume snapshots have been an open feature request since 2019 (hetznercloud/csi-driver issue #79; simplebackups.com Hetzner note). Not measured on the panel; documented by third parties and consistent with R-342's own evidence file.
The options
| What | Money / month | Setup | What it protects | |
|---|---|---|---|---|
| A. PBS pull-sync to DooPlex's PBS | A sync job on DooPlex's existing PBS pulls the felhom-offsite datastore from ep0 (read-only token on ep0, DatastoreReader), e.g. nightly |
€0 (DooPlex /mnt/5_hdd has 5.5 TB free; ~20 GB now) |
~1–2 h: a PBS remote + sync job + a read-only token; one route from DooPlex to ep0 :8007 must be chosen (the tunnel or the public address) | A lost/corrupted ep0 datastore, a bad ep0 procedure, and losing Hetzner entirely (a different provider and site). Ciphertext only — no custody change. Cost: a new job on DooPlex (Tier 2 — the operator's call, not CC's) |
| B. Written acceptance + a copy before each risky procedure | Accept that the datastore is unprotected in normal running; any runbook step that can touch /mnt/pbs-datastore first copies it off (e.g. to DooPlex, rsync -a without -H — -H was measured running out of memory on a PBS chunk store here, and PBS uses no hard links) |
€0 | ~10 min to write the rule; ~20–40 min per procedure | Only the procedure itself. Not disk loss, not the provider, not a mistake between procedures |
| does not exist | — | — | — | |
| A second Hetzner volume / server | another volume ≈ €0.057/GB/month (April 2026 price, third-party source) → 100 GB ≈ €5.70 + a server to attach it to | €5–10 | hours | Disk loss only; same provider, same failure domain (07 §D) |
Recommendation
A. It costs no money, protects against everything B protects against and more, and keeps the custody model because the data is already encrypted per customer. Its one real cost is a new job on DooPlex, which is why it is the operator's decision.