# esh-vm-db

ESH-side database VM at `esteban.net`. Hosts **two database servers**:

- **PostgreSQL 15** on port 5432 — primary consumer is paperless-ngx
  on esh-docker-vm (`paperless-ng` user/db).
- **MongoDB** on port 27017 — consumers unknown; document at next
  inventory pass.

Discovered 2026-04-23 during the paperless-ngx password rotation —
paperless's `PAPERLESS_DBHOST: 10.0.50.60` pointed here rather than
the assumed pfi-postgres (VM 105). Up until that point this host was
invisible to inventory.

## Network

- **LAN IP:** 10.0.50.60
- **FQDN:** `esh-vm-db.esteban.net`
- **SSH:** `ssh esh-vm-db` (config alias → `lkraven@10.0.50.60`,
  key auth).
- **Listening ports:** 22 (ssh), 111 (rpcbind — NFS mount support),
  5432 (postgres), 27017 (mongo).

## Hardware

- **Hypervisor:** presumably esh-pve or esh-pve-nas (to be confirmed
  — not yet queried from the PVE side).
- **CPU:** Intel Core i9-13900H (16 cores, mobile) — indicates this
  VM lives on a mini-PC / NUC-class ESH host.
- **RAM:** 7.8 GB
- **Root disk:** 250 GB ext4 on `/dev/sda1`, 5.1 GB used (2%). Plenty
  of headroom for both DBs.
- **OS:** Debian 12 (bookworm), kernel 6.1.0-23
- **Uptime:** 3+ weeks at last snapshot.

## What it runs

- **PostgreSQL 15 (apt package, `postgresql`)** — data directory
  default (`/var/lib/postgresql/15/main` presumably — confirm with
  `pg_lsclusters` on a future refresh). Local disk, not NFS —
  consistent with the "DBs must live on local disk" principle we
  adopted 2026-04-23.
- **MongoDB** — port 27017 bound to 0.0.0.0. DataPath + version to
  be captured.
- **No Docker.** `server_inspect.sh` reports `docker not installed`
  and `/opt/docker` absent — this host is bare-metal DB service,
  not a container host.

## Storage

- `/dev/sda1` (250 GB ext4) — DB data + OS
- `/mnt/backup` mounted from `10.0.50.50:/mnt/backup` via NFS
  (`defaults`). Purpose TBD — possibly for pg_dump outputs or other
  backup staging. Review on next pass.

## Consumers

- **paperless-ngx** on esh-docker-vm — uses postgres user
  `paperless-ng` against DB `paperless-ng` (confirmed 2026-04-23,
  password rotated).
- **MongoDB consumers** — unknown; map these by checking connection
  logs or by inventorying the other ESH-side Docker stacks for
  `27017`/`mongodb` references.

## Backup coverage

**Not yet configured.** Same category as ana-ml2/irv-ml1/esh-vm-db
now (bare-metal DB host without vzdump awareness from the PVE side).

Next steps:

- Add to fleet PBS vzdump schedule (its hypervisor backs it up via
  PBS-ANA if the hypervisor is onboarded).
- Draft `configs/restic/esh-vm-db/profiles.yaml` for file-level +
  per-DB dumps (`pg_dumpall` for postgres, `mongodump` for mongo).
  Target: `rest-server-ana` via the ESH → ANA cross-WAN path, same
  as other ESH-side restic clients.
- `rest-server-ana`'s `.htpasswd` will need an `esh-vm-db` entry.

## Refresh state

```bash
scripts/refresh-server-info.sh esh-vm-db
```

## Follow-ups (do soon)

- Confirm hypervisor (likely esh-pve or esh-pve-nas) — `qm list`
  on each and find VM with this name.
- Map MongoDB consumers.
- Configure backup (restic profile + per-DB dumps + vzdump coverage
  on the hypervisor side).
- Audit postgres `pg_hba.conf` — is 5432 bound to 0.0.0.0 with
  proper host-based auth, or is it over-exposed? paperless connects
  from 10.0.50.45 (esh-docker-vm); other hosts shouldn't be able
  to reach in.