notes/docs/home-server/operations.md

schema_version, id, type, scope, sensitivity, last_reviewed, sources, related, update_triggers, unknowns

schema_version	id	type	scope	sensitivity	last_reviewed	sources	related	update_triggers	unknowns
1	home-server.operations	reference	jupiter mercury design-decisions monitoring recovery	private-infrastructure	2026-10-06	kind reference owner-report RAID/media tradeoff, CGNAT/public IPv4 rationale, no alerting and running monitoring/log containers, 2026-10-06 kind reference owner-report Outages over one day catastrophic; no independent credentials except restic key, recovery evidence, host-config archive or operational rules, 2026-10-06	home-server.reference home-server.host home-server.mercury home-server.networking home-server.storage home-server.backups home-server.deployment	data-priority-change architecture-change alerting-change recovery-test	acceptable-data-loss-and-recovery-order-by-service data-criticality-outside-the-four-backed-up-directories tested-full-host-recovery-order monitoring-review-frequency

Operations / decisions

Owner decisions

Decision	Reason / accepted tradeoff
RAID 0 for HDD data	Capacity prioritized over disk redundancy; downloaded media can be reacquired
Back up important state	Four application directories covered; media redundancy is not the objective
Mercury public edge	Static public IPv4; home ISP uses CGNAT
No residential public ingress	Owner preference to avoid exposing the home IP

RAID 0 still stores important state alongside media: either HDD failure loses the array; recovery depends on working backups. Owner intent is not evidence that every important dataset is covered.

Observability

Facility	Current configuration
Host/container monitoring	Beszel hub and host-network agent present
Container logs	Dozzle with Docker socket proxy present
Automatic alerting	None configured

Monitoring does not imply notification delivery. Backup-hook failures, stopped services and storage failures require manual detection.

Recovery status

Item	Current status
Jupiter outage tolerance	At most 24 hours; longer is catastrophic to the owner
Recovery time	Not measured; 24-hour objective is not demonstrated
Acceptable data loss / RPO	Not defined
Independent recovery secrets	Restic encryption key only
Backup/integrity evidence	None supplied
Restore exercise	Never performed
Independent host-config archive	Not maintained
Operational rules / rollback policy	Not established

Backup scope is documented in Backups. The four-directory plan does not establish OS, host-configuration or named-volume recovery.

Proposed recovery storage

Not implemented:

• Private Git repository: sanitized host configuration and bootstrap instructions.
• Encrypted off-host/offline archive: required credentials and secret-bearing configuration.
• Independent access instructions: account recovery, archive location and decryption.

Access/decryption must work without Jupiter or Portainer. A private Git repository is not a substitute for protecting secret values. Restic key custody alone does not provide Google Drive access.