sam-4screen-desktop 2026-9-6:10:39:8

200 projects/220 Web Host Migration/Migration Work Log.md

@@ -191,6 +191,12 @@ where-woof.com outgoing (transactional) email:
 - **garage-webui:** API_BASE_URL → `http://garage:3903` (admin moved to 3903), recreated, 0 refused-erores, HTTP 200. **USER CONFIRMED: all buckets now show in the dashboard. ✅**
 - Caddy `garage-ui.lab.audasmedia.com.au` → 3909 (basic-auth). Removed a stale 3902 block.
 - **Rollback:** if needed, stop v2, restore garage-backup-*, revert compose/garage.toml, restart v1.0.1.
+
+## TIER-A DB HARDENING (2026-09-05/06)
+- **Findings:** All ~21 DB containers across .13/.35 are covered by existing backups (Borg on .13 via `~/Docker`; Backrest/Kopia on .35 via `/docker-containers`+volumes) — **no coverage gap**. Confirmed Vikunja = 437 paths in restic; Outline in Borg. The shared weakness: all are **file-copies of live DBs** (inconsistent-restore risk).
+- **Plan:** dump critical DBs to an already-backed-up path before the backup runs.
+- **.13 (done, dumps tested):** `db-dump-13.sh` dumps **outline, wherewoof-db, family-home-lab(portal), langfuse, ai-resume, airflow** Postgres via container-env creds (no secrets in config) → `~/Docker/Containers/<app>/backups/db-dumps/` (inside Borg `~/Docker` paths, keep-3). Tested: 201K/31K/6K/278K/824/197K dumps written.
+- **Pending:** wire .13 timer (03:30 pre-Borg); do .35 Tier-A (vikunja + others) via Backrest pre-hook or dump script.
 1. SES console → Send test email (audasmedia.com.au → samuelrolfe@gmail.com); check delivery + DKIM/SPF pass.
 2. Request SES production access (free).
 3. Then return to Phase 3 (local infra) / CMS migration project.