Skip to content

Trim the External Backup Pull's Detail in OPERATIONS.md#117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ptr727 merged 2 commits into from
Aug 26, 2026
Merged

Trim the External Backup Pull's Detail in OPERATIONS.md #117

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ccdd148
Trim the External Backup Pull's Detail in OPERATIONS.md
ptr727 Aug 26, 2026
a21086a
Narrow the Backup-Host Disclaimer to Avoid Contradicting Log Review
ptr727 Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions OPERATIONS.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -215,9 +215,7 @@ ssh "$VPS_SSH_HOST" true && echo reachable

**There are two credentials to this host and picking the wrong one is the first mistake to avoid.** `DEPLOY_SSH_USER`, held per environment and used only by the deploy, reaches a confined account behind an `rrsync` forced command that can write one release tree and read nothing else. `VPS_SSH_HOST` is the ordinary administrative login used for everything on this page. They are deliberately separate credentials with different blast radii, so reaching for the deploy account to read a log fails in a way that reads like an outage, and reaching for the admin account to deploy grants far more than the deploy needs.

**The off-host copy is made by a pull, maintained outside this repository, on a `systemd` timer on the backup host.** It copies the VPS's encrypted archives, a plaintext copy of its non-secret host files, and the rotated access logs, the last of those landing in `LOG_ARCHIVE_ROOT`. What it does beyond that, how it is installed, and how the VPS itself is provisioned and hardened are the backup host's own configuration to document, not this repository's -- this page covers only what Log Review needs: that `LOG_ARCHIVE_ROOT` exists and is where the rotated logs land. Read the unit and its last run on the backup host rather than trusting a schedule written down anywhere, including here.

**It is a pull rather than a push, and nothing on the VPS knows it happens.** That direction is the security property rather than an implementation detail: the backup host holds a key the VPS trusts, and the VPS holds no credential reaching any other system, so a compromise of the web server cannot walk into the backups that exist to survive it.
**The off-host copy, maintained outside this repository, writes the rotated access logs to `LOG_ARCHIVE_ROOT`, and this section covers nothing more about it.** Its installation, how the VPS itself is provisioned, and its trust model are the backup host's own configuration to document, not this repository's. What "Log Review" needs from its schedule and copy behavior, to read the logs correctly, is covered there instead. Read the unit and its last run on the backup host rather than trusting a schedule written down anywhere, including here.

**`LOG_ARCHIVE_ROOT` is spelled the same way on both sides, so there is nothing to reconcile.** The pull writes it and the log review reads it, under the one name. Every value this repository reads or writes is described once, in [`ENVIRONMENT.md`](./ENVIRONMENT.md), and [`checks/check-env-docs.py`](./checks/check-env-docs.py) fails if one is declared without a description or described without existing.

Expand Down