From ccdd1483910480da726f4691d363ae217f23f1b2 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Wed, 26 Aug 2026 10:10:27 -0700 Subject: [PATCH 1/2] Trim the External Backup Pull's Detail in OPERATIONS.md Lines describing the pull's copied data and its push-versus-pull trust model belong to the backup host's own configuration, not this repository's contract, per #111's stated intent. Keep only that the pull writes rotated access logs to LOG_ARCHIVE_ROOT. --- OPERATIONS.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/OPERATIONS.md b/OPERATIONS.md index 3c60248..9232bd4 100644 --- a/OPERATIONS.md +++ b/OPERATIONS.md @@ -215,9 +215,7 @@ ssh "$VPS_SSH_HOST" true && echo reachable **There are two credentials to this host and picking the wrong one is the first mistake to avoid.** `DEPLOY_SSH_USER`, held per environment and used only by the deploy, reaches a confined account behind an `rrsync` forced command that can write one release tree and read nothing else. `VPS_SSH_HOST` is the ordinary administrative login used for everything on this page. They are deliberately separate credentials with different blast radii, so reaching for the deploy account to read a log fails in a way that reads like an outage, and reaching for the admin account to deploy grants far more than the deploy needs. -**The off-host copy is made by a pull, maintained outside this repository, on a `systemd` timer on the backup host.** It copies the VPS's encrypted archives, a plaintext copy of its non-secret host files, and the rotated access logs, the last of those landing in `LOG_ARCHIVE_ROOT`. What it does beyond that, how it is installed, and how the VPS itself is provisioned and hardened are the backup host's own configuration to document, not this repository's -- this page covers only what Log Review needs: that `LOG_ARCHIVE_ROOT` exists and is where the rotated logs land. Read the unit and its last run on the backup host rather than trusting a schedule written down anywhere, including here. - -**It is a pull rather than a push, and nothing on the VPS knows it happens.** That direction is the security property rather than an implementation detail: the backup host holds a key the VPS trusts, and the VPS holds no credential reaching any other system, so a compromise of the web server cannot walk into the backups that exist to survive it. +**The off-host copy, maintained outside this repository, writes the rotated access logs to `LOG_ARCHIVE_ROOT`, and this repository depends on nothing else about it.** Its schedule, what else it copies, its pull-versus-push direction, and its trust model are the backup host's own configuration to document, not this repository's. Read the unit and its last run on the backup host rather than trusting a schedule written down anywhere, including here. **`LOG_ARCHIVE_ROOT` is spelled the same way on both sides, so there is nothing to reconcile.** The pull writes it and the log review reads it, under the one name. Every value this repository reads or writes is described once, in [`ENVIRONMENT.md`](./ENVIRONMENT.md), and [`checks/check-env-docs.py`](./checks/check-env-docs.py) fails if one is declared without a description or described without existing. From a21086ac4ac3410edfc9a42e066ae28f8424ad1a Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Wed, 26 Aug 2026 10:13:52 -0700 Subject: [PATCH 2/2] Narrow the Backup-Host Disclaimer to Avoid Contradicting Log Review The prior wording claimed this repository documents nothing about the pull's schedule and copy behavior, but Log Review does, for what it needs to read the logs correctly. Scope the disclaimer to what stays undocumented: installation, VPS provisioning, and the trust model. --- OPERATIONS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/OPERATIONS.md b/OPERATIONS.md index 9232bd4..8fc115c 100644 --- a/OPERATIONS.md +++ b/OPERATIONS.md @@ -215,7 +215,7 @@ ssh "$VPS_SSH_HOST" true && echo reachable **There are two credentials to this host and picking the wrong one is the first mistake to avoid.** `DEPLOY_SSH_USER`, held per environment and used only by the deploy, reaches a confined account behind an `rrsync` forced command that can write one release tree and read nothing else. `VPS_SSH_HOST` is the ordinary administrative login used for everything on this page. They are deliberately separate credentials with different blast radii, so reaching for the deploy account to read a log fails in a way that reads like an outage, and reaching for the admin account to deploy grants far more than the deploy needs. -**The off-host copy, maintained outside this repository, writes the rotated access logs to `LOG_ARCHIVE_ROOT`, and this repository depends on nothing else about it.** Its schedule, what else it copies, its pull-versus-push direction, and its trust model are the backup host's own configuration to document, not this repository's. Read the unit and its last run on the backup host rather than trusting a schedule written down anywhere, including here. +**The off-host copy, maintained outside this repository, writes the rotated access logs to `LOG_ARCHIVE_ROOT`, and this section covers nothing more about it.** Its installation, how the VPS itself is provisioned, and its trust model are the backup host's own configuration to document, not this repository's. What "Log Review" needs from its schedule and copy behavior, to read the logs correctly, is covered there instead. Read the unit and its last run on the backup host rather than trusting a schedule written down anywhere, including here. **`LOG_ARCHIVE_ROOT` is spelled the same way on both sides, so there is nothing to reconcile.** The pull writes it and the log review reads it, under the one name. Every value this repository reads or writes is described once, in [`ENVIRONMENT.md`](./ENVIRONMENT.md), and [`checks/check-env-docs.py`](./checks/check-env-docs.py) fails if one is declared without a description or described without existing.