sam-4screen-desktop 2026-8-28:15:24:8

2026-08-28 15:24:08 +10:00
parent 86e8f9e029
commit 965005aa46
7 changed files with 310 additions and 6 deletions
--- a/Migration/Phase
+++ b/Migration/Phase
@@ -0,0 +1,70 @@
+---
+created: 2026-08-28
+modified: 2026-08-28
+type: plan
+client: sam
+project: web-host-migration
+status: in_progress
+priority: 1
+tags:
+  - migration
+  - aws
+  - s3
+  - glacier
+  - backup
+  - iam
+aliases:
+  - phase-1-aws-offsite
+id: 1848129019-P1
+---
+# Phase 1 — AWS Offsite Backup (initiate ASAP)
+
+> Part of [[Migration Plan — InMotion to Local + AWS Offsite]].
+> **This is the current active phase.** Upstream: [[Phase 0 — Pre-flight]].
+
+## Goal
+Stand up an **AWS-only offsite backup** for `.13` (and photo archive) using the existing Borg pipeline, with **S3 → Glacier Deep Archive** lifecycle. Protect against burn-down / single-drive loss.
+
+## Current verified state
+- `.13`: **no AWS CLI, no rclone, no credentials** — clean slate.
+- Borg managed by NixOS `backup.nix` (`services.borgbackup.jobs.*`, systemd timers, BORG_RSH wrapper). We extend this pattern.
+- Region: `ap-southeast-2` (Sydney).
+
+## Sub-steps
+
+### 1.1 AWS account + IAM (user does)
+- [x] Sign up at https://aws.amazon.com (root MFA, billing, phone)
+- [x] Set region to `ap-southeast-2` (Sydney)
+- [ ] **(built here)** Create least-privilege **IAM user** `backup-offsite` (programmatic): policy only `s3:PutObject/GetObject/ListBucket` on the backup bucket. NO console, NO Admin.
+- [ ] Create access key for that user (store in password manager; not in plaintext on disk).
+
+### 1.2 Bucket + lifecycle (built here)
+- [ ] Create bucket `sam-offsite-backup` (region ap-southeast-2), **block public access**, **enable versioning**, **enable bucket key / server-side encryption (SSE-S3 or KMS)**.
+- [ ] **Lifecycle rule:** transition to **Glacier Flexible** after 30 days → **Glacier Deep Archive** after 90 days. (Optional: expire noncurrent versions to cap cost.)
+- [ ] Logging/object-lock: consider S3 Object Lock (compliance) as optional hardening — decide later.
+
+### 1.3 Local tooling on `.13` (built here)
+- [ ] Install `rclone` (or `awscli`) via NixOS (add to `backup.nix` `packages` or environment.systemPackages).
+- [ ] Configure `rclone remote` (S3 API, access-key, region `ap-southeast-2`). Keep credentials in a root-owned file with 600 perms, referenced via NixOS secret pattern (mirror `.borg-passphrase` approach).
+
+### 1.4 Offsite pipeline (built here)
+Choose approach (prefer **Borg → rclone → S3**, keeps existing repo + dedup):
+- [ ] **Borg to rclone remote** — add a new `services.borgbackup.jobs."offsite-to-aws"` repo `rclone:sambucket:borg/` via BORG_REPO / rclone backend. Schedule e.g. daily 07:00 (after local 04:00).
+  - *Alternatively:* keep local-only Borg, then **rclone copy** the local repo tarball/repo → S3. Simpler, but double-stores dedup loses their value — prefer direct Borg-to-rclone if Borg-backend `rclone` works on 1.4.3.
+- [ ] **Seed first full backup** (photos + site data) to Glacier DA path.
+- [ ] **Test restore** of one archive from S3 → verify read path works (critical; document).
+
+### 1.5 Monitoring & log
+- [ ] systemd timer health check; add an alert (ntfy/apprise) on failure (mirror existing pattern).
+- [ ] Record everything in [[Migration Work Log]].
+
+## Acceptance criteria
+- `rclone lsd sam-offsite-backup:` shows intended tree.
+- At least one acceptable test restore completed.
+- Cost projected < ~5 AUD/mo (photos in Glacier DA ~0.75–1.2/mo).
+
+## Rollback / safety
+- Offsite is additive — local Borg + rsync + archive repos remain untouched. Turning off the new job restores prior state.
+
+---
+*See [[Migration Plan — InMotion to Local + AWS Offsite]] §9 for cost model.*