pdurlej/platform

Fork 0

WIP: ops: ADR-0013 4th replica — Synology + encrypted pCloud #569

Closed

ollama wants to merge 2 commits from ollama/dziadek-4th-replica-pcloud into main

ollama commented

2026-05-28 13:13:03 +02:00

Collaborator

WIP — 4th replica: Synology + encrypted pCloud

ADR-0013 + 4 operational scripts + runbook for the 4th replica backup system.

Original author: claude (2026-05-11, Dropbox version)
Refreshed by: dziadek / DeepSeek-v4-Pro (2026-05-28, switched to pCloud)

What this ships

ADR-0013 — two-tier 4th replica: Synology home NAS (primary local) + encrypted pCloud blob (geographic offsite)
4 scripts:
- scripts/4th-replica/setup-synology.sh — interactive one-time setup (verifies Tailnet, creates share, generates age key, configures rclone pCloud)
- scripts/4th-replica/sync-to-synology.sh — daily M1→Synology rsync (--delete canonical mirror)
- scripts/4th-replica/sync-synology-to-pcloud.sh — weekly tar | age | rclone pipeline; rolling 8 weekly backups
- scripts/restore_check.sh — monthly restore drill (<30 min target)
docs/runbooks/4th-replica.md — full operator procedures

Why pCloud (not Dropbox)

	Dropbox	pCloud
Free tier	2 GB ❌ (baseline 6.8 GB)	10 GB ✅
Jurisdiction	USA	Switzerland 🇨🇭
Lifetime option	No	Yes (~175 EUR / 500 GB)
rclone	✅	✅
Encryption	age (we handle)	age (we handle)

pCloud sees only ciphertext. Age key stays on operator's machine.

⚠️ THIS REQUIRES OPERATOR EXECUTION

These scripts are NOT just for review — they must be run by the operator:

setup-synology.sh — interactive, needs operator at keyboard on M1
pCloud account creation — operator creates free account at pcloud.com
rclone pCloud remote configuration — operator authorizes during setup
First sync and restore drill — operator validates

What this PR does NOT

Does NOT auto-execute setup (operator must run manually)
Does NOT generate age key without operator presence
Does NOT include launchd plists (separate ticket)
Does NOT integrate with attention-dispatcher (future)

Role: deep-reviewer
Refs: ADR-0013, BLOCKERS_FOR_OPERATOR.md §2 (closed), GPT-5.5 Pro oracle review 2026-05-11

## WIP — 4th replica: Synology + encrypted pCloud ADR-0013 + 4 operational scripts + runbook for the 4th replica backup system. **Original author:** claude (2026-05-11, Dropbox version) **Refreshed by:** dziadek / DeepSeek-v4-Pro (2026-05-28, switched to pCloud) ## What this ships - **ADR-0013** — two-tier 4th replica: Synology home NAS (primary local) + encrypted pCloud blob (geographic offsite) - **4 scripts:** - `scripts/4th-replica/setup-synology.sh` — interactive one-time setup (verifies Tailnet, creates share, generates age key, configures rclone pCloud) - `scripts/4th-replica/sync-to-synology.sh` — daily M1→Synology rsync (--delete canonical mirror) - `scripts/4th-replica/sync-synology-to-pcloud.sh` — weekly tar | age | rclone pipeline; rolling 8 weekly backups - `scripts/restore_check.sh` — monthly restore drill (<30 min target) - **`docs/runbooks/4th-replica.md`** — full operator procedures ## Why pCloud (not Dropbox) | | Dropbox | pCloud | |---|---|---| | Free tier | 2 GB ❌ (baseline 6.8 GB) | **10 GB** ✅ | | Jurisdiction | USA | **Switzerland** 🇨🇭 | | Lifetime option | No | Yes (~175 EUR / 500 GB) | | rclone | ✅ | ✅ | | Encryption | age (we handle) | age (we handle) | pCloud sees only ciphertext. Age key stays on operator's machine. ## ⚠️ THIS REQUIRES OPERATOR EXECUTION These scripts are NOT just for review — they must be **run by the operator**: 1. `setup-synology.sh` — interactive, needs operator at keyboard on M1 2. pCloud account creation — operator creates free account at pcloud.com 3. rclone pCloud remote configuration — operator authorizes during setup 4. First sync and restore drill — operator validates ## What this PR does NOT - Does NOT auto-execute setup (operator must run manually) - Does NOT generate age key without operator presence - Does NOT include launchd plists (separate ticket) - Does NOT integrate with attention-dispatcher (future) **Role:** deep-reviewer **Refs:** ADR-0013, BLOCKERS_FOR_OPERATOR.md §2 (closed), GPT-5.5 Pro oracle review 2026-05-11

ollama added 2 commits

2026-05-28 13:13:04 +02:00

ops: ADR-0013 4th replica = Synology + encrypted Dropbox combo (closes BLOCKERS §2) c1dc7e15bb

Two-tier 4th replica:
- Synology home NAS (operator-owned, on Tailnet) — primary local 4th replica
- Encrypted Dropbox blob (cipher-only via age) — geographic offsite

Beats pure Dropbox (per GPT recommendation) by adding operator-owned local
primary while preserving cloud-cipher offsite durability.

Files (8)

- decisions/0013-4th-replica-synology-encrypted-dropbox.md — the ADR
- scripts/4th-replica/setup-synology.sh — interactive one-time setup
  (verifies kip Tailnet reachable, creates iskra-baseline share, generates
  age key, configures rclone Dropbox remote)
- scripts/4th-replica/sync-to-synology.sh — daily M1 -> Synology rsync
  (--delete canonical mirror); state file at ~/.local/share/iskra/4th-replica/last-sync.json
- scripts/4th-replica/sync-synology-to-dropbox.sh — weekly tar | age | rclone
  pipeline; rolling window of 8 weekly backups on Dropbox
- scripts/restore_check.sh — monthly restore drill (rsync from Synology
  to scratch, size+count+10-checksum spot check, <30min target)
- docs/runbooks/4th-replica.md — operator runbook (setup, sync, restore
  procedures from Synology AND from encrypted Dropbox, age key rotation,
  failure scenarios matrix)
- BLOCKERS_FOR_OPERATOR.md §2 amended: closed via ADR-0013

Encryption design

- age (X25519) with operator-held key at ~/.config/iskra-baseline/age-key.txt
- Key backed up: passphrase-encrypted file + Infisical (post-Phase 05) +
  secondary safe location
- Cloud (Dropbox) sees opaque ciphertext only
- Key NEVER in agent context (Claude/Codex never see plaintext or key bytes)

Restore acceptance criteria

- RTO 4h, RPO 24h (per GPT recommendation)
- Monthly drill via scripts/restore_check.sh:
  - Restore from Synology to scratch dir
  - Size diff <1%
  - File count match
  - 10 random spot-check sha256 match
  - <30 min over LAN

Defense in depth: Synology fast restore + Dropbox geographic durability.
Both lost only if fire/burglary AND Dropbox account compromised AND age key
lost — all three independent failures.

What this PR DOES NOT

- Does NOT auto-execute setup (operator runs setup-synology.sh manually)
- Does NOT generate age key for operator (operator runs key-gen prompted by setup)
- Does NOT include launchd plists (separate Phase 07 ticket)
- Does NOT integrate with attention-dispatcher (Phase 07 ticket F)
- Does NOT touch existing replicas or sacred paths

Refs

- GPT-5.5 Pro oracle review 2026-05-11 §4 OPEN DECISIONS (4th replica)
- BLOCKERS_FOR_OPERATOR.md §2 (existing blocker; this PR closes)
- Operator's kip Synology audit (Tailnet 100.91.208.73, on-site home NAS)
- Phase 07 design F (attention-dispatcher) will integrate with state files

**Role:** orchestrator / drafter (claude)

ops: switch 4th replica from Dropbox to pCloud + refresh ADR-0013

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 3s

Details

canary-required / canary (pull_request) Successful in 13s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 21s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / sanity (pull_request) Failing after 5m15s

Details

846f039065

pCloud chosen over Dropbox for:
- 10 GB free tier (Dropbox: 2 GB) — fits 6.8 GB baseline
- Swiss privacy (GDPR-friendly, non-US jurisdiction)
- Optional lifetime purchase (one-time, no monthly bill)
- rclone support equivalent to Dropbox

All scripts updated (dropbox→pcloud). ADR refresh note added.

Original: claude (2026-05-11)
Refreshed: dziadek / DeepSeek-v4-Pro (2026-05-28)

codex changed title from ~~ops: ADR-0013 4th replica — Synology + encrypted pCloud (WIP, needs operator)~~ to WIP: ops: ADR-0013 4th replica — Synology + encrypted pCloud

2026-05-28 14:56:45 +02:00

codex added this to the 02 - DR and restore confidence milestone

2026-05-28 14:56:45 +02:00

codex added the

not-ready

label

2026-05-28 19:52:02 +02:00

codex added the

source/agent-generated

labels

2026-05-28 22:48:09 +02:00

codex commented

2026-05-28 22:48:54 +02:00

Collaborator

Codex parking note: this PR is intentionally WIP/archival, not part of the active night closeout path. Treat it as self-contained recovered knowledge from old branches. Next active step, if resurrected: rebase/update against current main, rerun validation, and split/merge only if it directly supports the current milestone. This is DR/recovery work, so no script execution or backup mutation from the PR itself.

Codex parking note: this PR is intentionally WIP/archival, not part of the active night closeout path. Treat it as self-contained recovered knowledge from old branches. Next active step, if resurrected: rebase/update against current `main`, rerun validation, and split/merge only if it directly supports the current milestone. This is DR/recovery work, so no script execution or backup mutation from the PR itself.

codex commented

2026-05-29 16:21:42 +02:00

Collaborator

M10 disposition: moved to 10 - Improvements.

What this is: 4th replica / Synology+pCloud backup design.

Why parked here: Parked in M10 because it is valuable backup-improvement work, but not required to close current post-M01 restore confidence; resurrect when we explicitly start the extra-replica/offsite-backup track.

This preserves the idea without letting it block M02/M03/M04 closeout. Before reactivation, split it into a narrow issue or PR with concrete acceptance criteria.

M10 disposition: moved to `10 - Improvements`. What this is: 4th replica / Synology+pCloud backup design. Why parked here: Parked in M10 because it is valuable backup-improvement work, but not required to close current post-M01 restore confidence; resurrect when we explicitly start the extra-replica/offsite-backup track. This preserves the idea without letting it block M02/M03/M04 closeout. Before reactivation, split it into a narrow issue or PR with concrete acceptance criteria.

codex modified the milestone from 02 - DR and restore confidence to 10 - Improvements

2026-05-29 16:21:42 +02:00

codex referenced this pull request

2026-05-29 16:54:34 +02:00

chore(w9): branch cleanup candidate packet for merged/stale remote branches #536

claude commented

2026-06-01 11:18:29 +02:00

Collaborator

Triage verdict (claude): 🟡 OPERATOR-DECISION. ADR + scripts + runbook are solid (claude original, dziadek refreshed Dropbox→pCloud). But it's belt-and-suspenders: M02 DR is already closed + green (local + vps1000 sandbox restores PASS). Two operator questions before any move: (1) do you have / want a Synology NAS + pCloud account? (2) is a 4th replica worth the added moving parts right now? Runtime/recovery + needs hardware → not a clean cousin merge. Parking pending your call; ADR preserved.

**Triage verdict (claude): 🟡 OPERATOR-DECISION.** ADR + scripts + runbook are solid (claude original, dziadek refreshed Dropbox→pCloud). But it's belt-and-suspenders: M02 DR is already closed + green (local + vps1000 sandbox restores PASS). Two operator questions before any move: (1) do you have / want a Synology NAS + pCloud account? (2) is a 4th replica worth the added moving parts right now? Runtime/recovery + needs hardware → not a clean cousin merge. Parking pending your call; ADR preserved.

claude commented

2026-06-01 12:53:50 +02:00

Collaborator

Hardware check (claude, via Tailscale) — you're MORE ready than this issue assumed. On the Tailnet right now:

kasia-i-piotr-synology-nas (100.91.208.73) — the Synology IS here + online → the primary local-replica target. ✅
macbook-pro-old (100.79.83.27) — a spare old MacBook on Tailnet → a BONUS second local target / warm-standby, beyond the ADR's Synology+pCloud plan.

So the "do you have hardware?" question is basically answered: Synology (local) + an extra old Mac. The only remaining external dependency = a pCloud account for the encrypted offsite blob — OR skip pCloud and use the old Mac as a 2nd local node to keep everything on Tailnet.

Decision now: (a) want the 4th replica at all? (M02 DR is already green — this is belt-and-suspenders), and (b) if yes: pCloud-offsite vs old-Mac-as-2nd-local? Hardware's there either way.

**Hardware check (claude, via Tailscale) — you're MORE ready than this issue assumed.** On the Tailnet right now: - **`kasia-i-piotr-synology-nas`** (100.91.208.73) — the Synology IS here + online → the primary local-replica target. ✅ - **`macbook-pro-old`** (100.79.83.27) — a spare old MacBook on Tailnet → a BONUS second local target / warm-standby, beyond the ADR's Synology+pCloud plan. So the "do you have hardware?" question is basically answered: Synology (local) + an extra old Mac. The only remaining external dependency = a **pCloud account** for the encrypted offsite blob — OR skip pCloud and use the old Mac as a 2nd local node to keep everything on Tailnet. **Decision now:** (a) want the 4th replica at all? (M02 DR is already green — this is belt-and-suspenders), and (b) if yes: pCloud-offsite vs old-Mac-as-2nd-local? Hardware's there either way.

claude referenced this pull request from a commit

2026-06-02 23:39:17 +02:00

docs(adr): ADR-0013 offsite+local backup via rclone-crypt pCloud (supersedes #569)

claude referenced this pull request

2026-06-02 23:39:17 +02:00

docs(adr): ADR-0013 offsite+local backup — rclone-crypt pCloud (supersedes #569) #697

claude referenced this pull request

2026-06-02 23:39:18 +02:00

impl(backup): offsite+local backup of unique knowledge — rclone-crypt pCloud (per ADR-0013) #698

claude commented

2026-06-02 23:39:18 +02:00

Collaborator

Closing — superseded by reworked ADR-0013 (PR #697) + impl issue #698.

dziadek's offsite intent is preserved; the medium changes: MacBook (cold/complete) | Synology (hot) local copy + pCloud offsite via rclone-crypt (operator has pCloud; idle MacBook on Tailnet with HDMI-dummy). The Synology-specific scripts here are dropped because pCloud built-in Crypto is not automatable (rclone can't reach Crypto folders) — rclone-crypt-on-a-plain-folder replaces it with the same zero-knowledge guarantee, scriptable. Backup set = unique knowledge (~few GB).

Closing — **superseded** by reworked **ADR-0013** (PR #697) + impl issue **#698**. dziadek's offsite intent is preserved; the medium changes: **MacBook (cold/complete) | Synology (hot) local copy + pCloud offsite via rclone-crypt** (operator has pCloud; idle MacBook on Tailnet with HDMI-dummy). The Synology-specific scripts here are dropped because **pCloud built-in Crypto is not automatable** (rclone can't reach Crypto folders) — rclone-crypt-on-a-plain-folder replaces it with the same zero-knowledge guarantee, scriptable. Backup set = unique knowledge (~few GB).

claude closed this pull request

2026-06-02 23:39:18 +02:00