From 6929e752bf6c64535eb10a5fb5f41db00d517c07 Mon Sep 17 00:00:00 2001
From: Vuong Hoang <vh@phasefinal.com>
Date: Wed, 29 Apr 2026 17:01:21 -0700
Subject: [PATCH] README: refresh backup coverage table (date + cleared rows)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumped "as of" date 2026-04-20 → 2026-04-29 and reconciled the
table against STATUS.md ground truth:

  ana-ml2 restic         ❌ → ✅ (deployed; configs/restic/ana-ml2/)
  DB dumps row           consolidated — synapse/seafile/vaultwarden-pg/
                         gitea/openwebui hooks all live now
  Cross-site rsync       ❌ → ✅ (ana-nas↔nh3-nas at 04:00/05:00)
  Prune ceremony         ❌ → ✅ (quarterly ritual; runbook in docs/)
  irv-ml1 + esh-vm-db    added (both have restic now)
  mattermost             dropped (retired 2026-04-21)

Found via /tend-docs.
---
 README.md | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index eef3f4d..e7076ee 100644
--- a/README.md
+++ b/README.md
@@ -162,22 +162,23 @@ Backups are driven by per-host `resticprofile` configs under `configs/restic/<ho
 - **Prune**: manual ceremony (rest-server runs with `--append-only`, which blocks destructive prune ops).
 - **Off-site**: cross-site rsync between the two rest-server data dirs is planned (not yet implemented).
 
-### Coverage status (as of 2026-04-20)
+### Coverage status (as of 2026-04-29)
 
 Goal: **every Docker host + configs + every database** covered, not just VM images.
 
 | Layer | State |
 |---|---|
 | VM-level (Proxmox vzdump) | ✅ All running guests covered across pfi-pve / nh3-pve / esh-pve-nas; esh-pve has VMID 108 uncovered |
-| ana-docker restic (host files + DBs) | ✅ `configs/restic/ana-docker/` with pre-backup hooks for synapse / seafile / vaultwarden |
-| ana-ml2 restic | ❌ **Bare metal — no vzdump**, no restic yet. Highest-priority gap |
+| ana-docker restic (host files + DBs) | ✅ `configs/restic/ana-docker/` with pre-backup hooks for synapse / seafile / vaultwarden-pg / gitea (native dump) / openwebui |
+| ana-ml2 restic | ✅ `configs/restic/ana-ml2/` — bare-metal host files (no DB hooks needed) |
 | nh3-docker restic | ✅ Light — no DB hooks needed |
 | esh-docker-vm restic | ✅ With DB hooks for paperless-postgres (external), home-assistant + pgadmin + uptime-kuma (host-side sqlite3), calibre-web-automated (in-container sqlite3) |
 | vm-esh-nas restic | ✅ Light — NFS mounts explicitly excluded |
 | nh3-dev (workstation) restic | ✅ `/home/lkraven` + `/etc` with language-toolchain and build-output excludes |
-| DB dumps: mattermost, openwebui, gitea, beszel-hub | ❌ Pre-backup hooks not written yet |
-| Cross-site redundancy | ❌ rsync between rest-server-ana ↔ rest-server-nh3 planned |
-| Prune ceremony | ❌ `scripts/restic-prune.sh` planned (rest-server `--append-only` blocks direct prune) |
+| irv-ml1 restic | ✅ Cross-site to rest-server-nh3 via WireGuard |
+| esh-vm-db restic | ✅ With pg_dumpall + mongodump pre-backup hooks |
+| Cross-site redundancy | ✅ `ana-nas → nh3-nas` rsync at 04:00 daily; `nh3-nas → ana-nas` at 05:00 daily (`configs/rsync/`) |
+| Prune ceremony | ✅ Quarterly manual ritual documented in `docs/runbooks/nh3-prune-ritual.md` (DSM-mediated `--append-only` toggle) |
 | offen/docker-volume-backup sidecars on esh-docker-vm | ❌ Remove once restic proves itself (~1 week of clean runs) |
 
 ## Authoritative vs. mirror