sam-4screen-desktop 2026-8-28:15:24:8

.obsidian/workspace.json

@@ -211,6 +211,12 @@
   },
   "active": "7066c9273c6fb936",
   "lastOpenFiles": [
+    "200 projects/220 Web Host Migration/Migration Work Log.md",
+    "200 projects/220 Web Host Migration/Phase 5 — Decommission InMotion.md",
+    "200 projects/220 Web Host Migration/Phase 3 — Local Infra Prep.md",
+    "200 projects/220 Web Host Migration/Phase 2 — Email.md",
+    "200 projects/220 Web Host Migration/Phase 1 — AWS Offsite Backup.md",
+    "200 projects/220 Web Host Migration/Phase 0 — Pre-flight.md",
     "200 projects/220 Web Host Migration/Migration Plan — InMotion to Local + AWS Offsite.md",
     "300 areas/360 Dev-Ops Network Computers/Filesystem Drive Map.md",
     "300 areas/360 Dev-Ops Network Computers/Home Network Map Overview.md",
@@ -231,12 +237,6 @@
     "400 resources/450 Recipes/Easy Yogurt flat bread.md",
     "400 resources/450 Recipes/Chilli Sauce Hack.md",
     "000 daily/basketball training.md",
-    "000 daily/Daily Notes and  To Do.md",
-    "200 projects/210 AI Resume/AI Resume - Content Organization Plan.md",
-    "200 projects/210 AI Resume/Trigger.Dev.md",
-    "000 daily/House Family General.md",
-    "100 inbox/Pi Subagent Integration.md",
-    "100 inbox/Photo Consolidation Plan.md",
     "000 daily/ThinkPad Recommendations",
     "500 archive/510 Daily",
     "300 areas/305 Ideas Businesses",

200 projects/220 Web Host Migration/Migration Work Log.md

@@ -0,0 +1,43 @@
+---
+created: 2026-08-28
+modified: 2026-08-28
+type: log
+client: sam
+project: web-host-migration
+status: active
+priority: 1
+tags:
+  - migration
+  - log
+aliases:
+  - migration-work-log
+  - work-log
+id: 1848129023-LOG
+---
+# Migration Work Log
+
+> Central log of what has been **done** across the migration phases.
+> Update this as work completes. Each entry: **date · phase · what · evidence**.
+
+## Phase legend
+- **P0** Pre-flight · **P1** AWS offsite · **P2** Email · **P3** Local infra · **P4** CMS (separate) · **P5** Decommission
+
+---
+
+## 2026-08-28
+| Phase | What was done | Notes/Evidence |
+|---|---|---|
+| P0 | Verified no AWS CLI / rclone / creds on `.13` (clean slate) | `command -v aws` empty; `rclone` empty on `.13` |
+| P0 | Verified existing backup stack on `.13` | Borg 1.4.3 in `backup.nix` (`services.borgbackup.jobs.*`, timers 04:00/05:00/06:00, BORG_RSH wrapper for SSH to `.35`) |
+| P0 | Verified `.13` containers | `wherewoof-admin`(:3031), `wherewoof-minio`(:9010), `wherewoof-db`(:5434), Garage(:3900/3902)+portal(:8500) |
+| P0 | Confirmed external exposure | static IP port-forward 80/443 → Caddy `.35`; `where-woof.com`→`192.168.20.13:3020` |
+| P1 | Decision: AWS-only, S3→Glacier DA, ap-southeast-2 (Sydney), IAM least-privilege | Awaiting AWS account signup to proceed |
+| — | Created per-phase plan notes (P0, P1, P2, P3, P5) + this log | Obsidian `220 Web Host Migration/` |
+
+## Pending next action
+- **User:** finish AWS account signup (https://aws.amazon.com) → root MFA + billing + region `ap-southeast-2`.
+- **Then:** build Phase 1 on `.13` (IAM user `backup-offsite`, bucket `sam-offsite-backup`, lifecycle, rclone/Borg→S3, first seed, test restore).
+
+---
+
+*Linked from [[Migration Plan — InMotion to Local + AWS Offsite]].*

200 projects/220 Web Host Migration/Phase 0 — Pre-flight.md

@@ -0,0 +1,38 @@
+---
+created: 2026-08-28
+modified: 2026-08-28
+type: plan
+client: sam
+project: web-host-migration
+status: pending
+priority: 1
+tags:
+  - migration
+  - aws
+  - backup
+aliases:
+  - phase-0-preflight
+id: 1848129018-P0
+---
+# Phase 0 — Pre-flight (read-only, no changes)
+
+> Part of [[Migration Plan — InMotion to Local + AWS Offsite]].
+> **Nothing here changes any system.** All checks are read-only.
+
+## Goal
+Confirm prerequisites so Phase 1 (AWS offsite) can proceed without surprises.
+
+## Checks
+- [ ] **AWS account exists** → fresh signup at https://aws.amazon.com (need root MFA + billing + phone). ✅/⏳
+- [ ] **Region set** → `ap-southeast-2` (Sydney) in console region selector.
+- [ ] **`.13` network can reach AWS** — no egress proxy/firewall blocking HTTPS to S3. Test: `curl -sI https://s3.ap-southeast-2.amazonaws.com`.
+- [ ] **Total offsite media size** — confirm what must go cold (Site media + Immich ~472G + archives). `du -sh` per path → refine cost model.
+- [ ] **Existing backup inventory confirmed** — Borg local `.13` (daily 04:00), rsync→`.35`(05:00), archive→`.23`(06:00). These stay as-is; AWS is additive.
+
+## Output
+- Approved list of source paths for offsite seeding.
+- Confirmed AWS region + account login ready.
+- Go/no-go for Phase 1.
+
+---
+*Work-in-progress log for this phase tracked in [[Migration Work Log]].*

200 projects/220 Web Host Migration/Phase 1 — AWS Offsite Backup.md

@@ -0,0 +1,70 @@
+---
+created: 2026-08-28
+modified: 2026-08-28
+type: plan
+client: sam
+project: web-host-migration
+status: in_progress
+priority: 1
+tags:
+  - migration
+  - aws
+  - s3
+  - glacier
+  - backup
+  - iam
+aliases:
+  - phase-1-aws-offsite
+id: 1848129019-P1
+---
+# Phase 1 — AWS Offsite Backup (initiate ASAP)
+
+> Part of [[Migration Plan — InMotion to Local + AWS Offsite]].
+> **This is the current active phase.** Upstream: [[Phase 0 — Pre-flight]].
+
+## Goal
+Stand up an **AWS-only offsite backup** for `.13` (and photo archive) using the existing Borg pipeline, with **S3 → Glacier Deep Archive** lifecycle. Protect against burn-down / single-drive loss.
+
+## Current verified state
+- `.13`: **no AWS CLI, no rclone, no credentials** — clean slate.
+- Borg managed by NixOS `backup.nix` (`services.borgbackup.jobs.*`, systemd timers, BORG_RSH wrapper). We extend this pattern.
+- Region: `ap-southeast-2` (Sydney).
+
+## Sub-steps
+
+### 1.1 AWS account + IAM (user does)
+- [x] Sign up at https://aws.amazon.com (root MFA, billing, phone)
+- [x] Set region to `ap-southeast-2` (Sydney)
+- [ ] **(built here)** Create least-privilege **IAM user** `backup-offsite` (programmatic): policy only `s3:PutObject/GetObject/ListBucket` on the backup bucket. NO console, NO Admin.
+- [ ] Create access key for that user (store in password manager; not in plaintext on disk).
+
+### 1.2 Bucket + lifecycle (built here)
+- [ ] Create bucket `sam-offsite-backup` (region ap-southeast-2), **block public access**, **enable versioning**, **enable bucket key / server-side encryption (SSE-S3 or KMS)**.
+- [ ] **Lifecycle rule:** transition to **Glacier Flexible** after 30 days → **Glacier Deep Archive** after 90 days. (Optional: expire noncurrent versions to cap cost.)
+- [ ] Logging/object-lock: consider S3 Object Lock (compliance) as optional hardening — decide later.
+
+### 1.3 Local tooling on `.13` (built here)
+- [ ] Install `rclone` (or `awscli`) via NixOS (add to `backup.nix` `packages` or environment.systemPackages).
+- [ ] Configure `rclone remote` (S3 API, access-key, region `ap-southeast-2`). Keep credentials in a root-owned file with 600 perms, referenced via NixOS secret pattern (mirror `.borg-passphrase` approach).
+
+### 1.4 Offsite pipeline (built here)
+Choose approach (prefer **Borg → rclone → S3**, keeps existing repo + dedup):
+- [ ] **Borg to rclone remote** — add a new `services.borgbackup.jobs."offsite-to-aws"` repo `rclone:sambucket:borg/` via BORG_REPO / rclone backend. Schedule e.g. daily 07:00 (after local 04:00).
+  - *Alternatively:* keep local-only Borg, then **rclone copy** the local repo tarball/repo → S3. Simpler, but double-stores dedup loses their value — prefer direct Borg-to-rclone if Borg-backend `rclone` works on 1.4.3.
+- [ ] **Seed first full backup** (photos + site data) to Glacier DA path.
+- [ ] **Test restore** of one archive from S3 → verify read path works (critical; document).
+
+### 1.5 Monitoring & log
+- [ ] systemd timer health check; add an alert (ntfy/apprise) on failure (mirror existing pattern).
+- [ ] Record everything in [[Migration Work Log]].
+
+## Acceptance criteria
+- `rclone lsd sam-offsite-backup:` shows intended tree.
+- At least one acceptable test restore completed.
+- Cost projected < ~5 AUD/mo (photos in Glacier DA ~0.75–1.2/mo).
+
+## Rollback / safety
+- Offsite is additive — local Borg + rsync + archive repos remain untouched. Turning off the new job restores prior state.
+
+---
+*See [[Migration Plan — InMotion to Local + AWS Offsite]] §9 for cost model.*

200 projects/220 Web Host Migration/Phase 2 — Email.md

@@ -0,0 +1,59 @@
+---
+created: 2026-08-28
+modified: 2026-08-28
+type: plan
+client: sam
+project: web-host-migration
+status: pending
+priority: 2
+tags:
+  - migration
+  - email
+  - ses
+  - zoho
+  - mxroute
+aliases:
+  - phase-2-email
+id: 1848129020-P2
+---
+# Phase 2 — Email (inbound mailboxes + transactional outbound)
+
+> Part of [[Migration Plan — InMotion to Local + AWS Offsite]].
+> Blocked-by: none (can run parallel to Phase 1). Depends-on decision D3/D5/D6.
+
+## Goal
+Deliver working email: **real inbound mailboxes** (webmail/IMAP) + **transactional outbound** per site — with deliverability credibility (reputation isolation, SPF/DKIM/DMARC).
+
+## Decisions (from main plan)
+- **Inbound:** managed provider — **Zoho Mail** (free ≤5 users) or **MXroute** (~30–45/yr). Pick one: _default = Zoho free tier_ for cost; MXroute for unlimited domains.
+- **Outbound:** **Amazon SES** (~0.10/1000, effectively free at low volume).
+- Both on separate reputation islands (don't send transactional from mailbox provider).
+
+## Sub-steps
+
+### 2.1 Inbound mailboxes (user + config)
+- [ ] Pick provider (Zoho / MXroute).
+- [ ] Register custom domain mailbox(es) e.g. `hello@where-woof.com` + site addresses.
+- [ ] Set **MX records** on each domain → provider.
+- [ ] Add `TXT` SPF (include provider + SES), `DKIM` (provider + SES), `DMARC`.
+- [ ] Connect responders: Zoho webmail + Thunderbird/Gmail app via IMAP (993)/SMTP (465) if paid IMAP tier.
+
+### 2.2 Outbound transactional (SES)
+- [ ] Verify sending domains/emails in SES (`samuelrolfe@gmail.com`, site domains).
+- [ ] Configure SPF/DKIM; **exit SES sandbox** (ticket/limit increase).
+- [ ] Optionally use **FLoci** (localhost:4566) to develop/test the SES API integration offline first.
+
+### 2.3 Site integration (later, with CMS migration project)
+- [ ] Point site forms / password reset / notifications → SES SMTP or API.
+- (CMS code changes are the separate migration project — only wire-up decisions here.)
+
+### 2.4 Monitor
+- [ ] Check bounces/complaints/deliverability dashboard.
+
+## Acceptance criteria
+- Can receive into a real mailbox and read via webmail/IMAP.
+- Can send a test transactional email through SES successfully (not sandbox-blocked).
+- DNS passes SPF/DKIM/DMARC checks (use MXToolbox).
+
+---
+*See [[Migration Plan — InMotion to Local + AWS Offsite]] §6.*

200 projects/220 Web Host Migration/Phase 3 — Local Infra Prep.md

@@ -0,0 +1,56 @@
+---
+created: 2026-08-28
+modified: 2026-08-28
+type: plan
+client: sam
+project: web-host-migration
+status: pending
+priority: 3
+tags:
+  - migration
+  - nixos
+  - docker
+  - caddy
+  - gpu
+aliases:
+  - phase-3-local-infra
+id: 1848129021-P3
+---
+# Phase 3 — Local Infrastructure Prep on `.13` (no CMS migration)
+
+> Part of [[Migration Plan — InMotion to Local + AWS Offsite]].
+> Depends-on: Phase 1 (AWS), can be parallel after.
+
+## Goal
+Prepare `.13` to receive the incoming sites — **without** yet migrating CMS code/MySQL (separate project).
+
+## Current verified state (2026-08-28)
+- `.13` Docker host; AMD RX 6600 replacing dead GTX 760 (driver: `amdgpu`).
+- Caddy on `.35` already reverse-proxies `*.lab.audasmedia.com.au` and `where-woof.com` → `.13:<port>`.
+
+## Sub-steps
+
+### 3.1 GPU
+- [ ] Confirm AMD RX 6600 installed + `services.xserver.videoDrivers = [ "amdgpu" ]` on `.13`.
+- [ ] Verify KDE/Wayland/`glxinfo` + any Docker GPU passthrough needs.
+
+### 3.2 Docker/Caddy readiness
+- [ ] Map the 5–6 CMS sites → target ports on `.13` (reserve ports).
+- [ ] Draft Caddy reverse_proxy entries (on `.35`) for each new site (do NOT apply until CMS migrated).
+- [ ] Prepare docker-compose volumes/dirs for incoming sites + DBs.
+
+### 3.3 Control-plane (no cPanel)
+- [ ] Confirm NixOS + Docker + Caddy + Garage covers admin. Optional: Portainer for a GUI.
+- [ ] Note FLoci only for offline dev/test (not production).
+
+### 3.4 GPU-media split (future-proofing)
+- [ ] Decide local-first (AMD) vs cloud (Lambda/MediaConvert/Batch) per job type — document for CMS project.
+- (Actual code/cron migration = separate project.)
+
+## Acceptance criteria
+- `.13` GPU working (post-card-swap).
+- Port map + Caddy draft ready to activate when CMS arrives.
+- No changes to live routes until CMS migration project begins.
+
+---
+*See [[Migration Plan — InMotion to Local + AWS Offsite]] §5, §7, §8.*

200 projects/220 Web Host Migration/Phase 5 — Decommission InMotion.md

@@ -0,0 +1,38 @@
+---
+created: 2026-08-28
+modified: 2026-08-28
+type: plan
+client: sam
+project: web-host-migration
+status: pending
+priority: 4
+tags:
+  - migration
+  - decommission
+  - inmotionhosting
+aliases:
+  - phase-5-decommission
+id: 1848129022-P5
+---
+# Phase 5 — Decommission InMotion VPS
+
+> Part of [[Migration Plan — InMotion to Local + AWS Offsite]].
+> **After** sites are live locally (Phase 4 = CMS migration, separate project). Do not run early.
+
+## Goal
+Retire the ~100 AUD/mo InMotion VPS once nothing depends on it.
+
+## Sub-steps
+- [ ] Confirm all 5–6 sites served by `.13` behind Caddy `.35` and DNS final A-records → static IP.
+- [ ] Migrate any remaining InMotion cron jobs → local systemd timers on `.13` (covered by CMS project).
+- [ ] **Backup the VPS one final time** (full dump → local staging → AWS offsite) before cancelling.
+- [ ] Cancel InMotion / disable auto-renew.
+- [ ] Verify no mail MX or site depend on InMotion anymore.
+- [ ] Log final cost saving (expected ~50–70 AUD/mo net) in [[Migration Work Log]].
+
+## Acceptance criteria
+- InMotion cancelled; all live traffic local; no dangling DNS/MX.
+- Burn-down recovery path verified from AWS offsite.
+
+---
+*All phases tracked in [[Migration Work Log]].*