From 0b997fec0ddacaed51b893ad13496cbd2526db4b Mon Sep 17 00:00:00 2001
From: Vuong Hoang <vh@phasefinal.com>
Date: Mon, 20 Apr 2026 22:31:53 -0700
Subject: [PATCH] docs: surface backup pipeline coverage gaps

VM images are backed up via Proxmox vzdump, but ana-ml2 (bare metal) has
no backup at all, and file-level restic + DB dumps are still missing on
three of four Docker-host VMs. Adds an explicit coverage table to the
README backup section so the gaps don't get overlooked while planning.

Goal (per user): every Docker host + configs + every database, not just
the VM image layer.
---
 README.md | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/README.md b/README.md
index d96957e..57c5519 100644
--- a/README.md
+++ b/README.md
@@ -129,6 +129,23 @@ Backups are driven by per-host `resticprofile` configs under `configs/restic/<ho
 - **Prune**: manual ceremony (rest-server runs with `--append-only`, which blocks destructive prune ops).
 - **Off-site**: cross-site rsync between the two rest-server data dirs is planned (not yet implemented).
 
+### Coverage status (as of 2026-04-20)
+
+Goal: **every Docker host + configs + every database** covered, not just VM images.
+
+| Layer | State |
+|---|---|
+| VM-level (Proxmox vzdump) | ✅ All running guests covered across pfi-pve / nh3-pve / esh-pve-nas; esh-pve has VMID 108 uncovered |
+| ana-docker restic (host files + DBs) | ✅ `configs/restic/ana-docker/` with pre-backup hooks for synapse / seafile / vaultwarden |
+| ana-ml2 restic | ❌ **Bare metal — no vzdump**, no restic yet. Highest-priority gap |
+| nh3-docker restic | ❌ VM is vzdump'd but no file-level restic |
+| esh-docker-vm restic | ❌ VM is vzdump'd; needs pre-backup hooks for paperless-postgres, home-assistant SQLite, calibre-web-automated, pgadmin |
+| vm-esh-nas restic | ❌ Light setup needed (low RAM, few stacks) |
+| DB dumps: mattermost, openwebui, gitea, beszel-hub | ❌ Pre-backup hooks not written yet |
+| Cross-site redundancy | ❌ rsync between rest-server-ana ↔ rest-server-nh3 planned |
+| Prune ceremony | ❌ `scripts/restic-prune.sh` planned (rest-server `--append-only` blocks direct prune) |
+| offen/docker-volume-backup sidecars on esh-docker-vm | ❌ Remove once restic proves itself (~1 week of clean runs) |
+
 ## Authoritative vs. mirror
 
 - **Authoritative:** files on each server under `/opt/docker/compose/<stack>/` and `/opt/docker/conf/<stack>/`.