Add Kopia backup stack with Backblaze B2 offsite target.

Protects /config, selective labdata, and nightly DB dumps; documents homelab improvement plan briefs.
2026-06-10 21:21:34 -05:00
parent 225078afbe
commit 7c7f6dfebc
47 changed files with 3105 additions and 1 deletions
@@ -0,0 +1,60 @@
+# TB-005 — Obsidian / CouchDB hardening
+
+**Status:** not started  
+**Your call:** _(unset — talk first)_
+
+---
+
+## Talk first
+
+> **Stop.** Don't read Reference until we've talked.
+> In chat, say **"let's do TB-005"** or **"obsidian / couchdb hardening"**.
+
+**In one sentence:** Your whole PKM vault syncs over a public URL — let's decide how exposed you're okay with.
+
+**Why it came up:** obsidian.ginnoir.com has no LAN-only or SSO gate; LiveSync needs remote access from phones.
+
+### Questions
+
+1. Do you sync Obsidian from your phone without Tailscale always on?
+2. Would 'Tailscale only' work, or do you need public access?
+3. Authentik login in front — okay if we test LiveSync still works?
+
+### Your options
+
+| Option | Meaning |
+|--------|---------|
+| **Do it** | We're doing this — I'll implement or walk you through it |
+| **Later** | Keep on the list, not now |
+| **Drop** | Remove from plan — totally fine |
+| **Tweak** | Change scope; tell me how |
+
+### What we decided
+
+| | |
+|---|---|
+| **Decision** | |
+| **Notes** | |
+| **Date** | |
+
+---
+
+<details>
+<summary>Reference (only open if we're doing it)</summary>
+
+### Stack / files
+
+Caddyfile, stacks/notes/
+
+### If we do it — rough steps
+
+1. Pick model: Tailscale-only, Authentik, or hybrid
+2. Implement + test sync from each device
+3. Rotate CouchDB password
+
+### Done when
+
+- [ ] You can still sync where you need to
+- [ ] Admin/_utils not wide open
+
+</details>