vh
1f37857acc
Section claimed gitea + paperless-ng Postgres passwords were "currently in use" with trivial values and that rotation was pending. Per STATUS.md: "Rotate exposed secrets — done 2026-04-23. All six rotated: vaultwarden/gitea/paperless-ng Postgres passwords (hardcoded compose.yaml literals moved to gitignored .env files in the process)..." Rotation happened; literals are no longer in compose.yaml; passwords are no longer trivial. Removing the section rather than amending — once fixed, there's no value in carrying a "we have weak passwords" section that lies about the current state. Surfaced by /tend-docs audit 2026-05-14.
pfi-postgres
Shared Postgres cluster at the Anaheim colo.
Network
- LAN IP: 10.250.50.80
- Port: 5432
- SSH:
lkraven@pfi-postgres
Infrastructure
- Hypervisor:
pfi-pve(VMID 105) - Type: Linux VM
- Site: Anaheim (PFI colo)
Role
Shared Postgres server backing multiple ana-docker stacks:
| Consumer | DB | User |
|---|---|---|
| vaultwarden | vaultwarden |
vaultwarden |
| gitea | gitea |
gitea |
| paperless-ngx (on esh-docker-vm) | paperless-ng |
paperless-ng |
| (Likely others — audit as more stacks surface) |
Backup coverage
- VM-image: ✅ vzdump on pfi-pve (daily)
- App-consistent DB dumps: ✅ each dependent stack's host runs a
pre-backup hook that
pg_dumps its database from this server into its own restic stage:- ana-docker: vaultwarden + gitea (via
configs/restic/ana-docker/pre-backup.sh) - esh-docker-vm: paperless-ngx (via
configs/restic/esh-docker-vm/pre-backup.sh)
- ana-docker: vaultwarden + gitea (via
- File-level restic on this host: ❌ not configured. Optional — the VM-image + per-consumer pg_dumps together cover most recovery paths.
Refresh state
scripts/refresh-server-info.sh pfi-postgres
Discovered via
FortiGate DHCP (MAC c2:1f:cc:71:66:d0).