vh
1f37857acc
Section claimed gitea + paperless-ng Postgres passwords were "currently in use" with trivial values and that rotation was pending. Per STATUS.md: "Rotate exposed secrets — done 2026-04-23. All six rotated: vaultwarden/gitea/paperless-ng Postgres passwords (hardcoded compose.yaml literals moved to gitignored .env files in the process)..." Rotation happened; literals are no longer in compose.yaml; passwords are no longer trivial. Removing the section rather than amending — once fixed, there's no value in carrying a "we have weak passwords" section that lies about the current state. Surfaced by /tend-docs audit 2026-05-14.
48 lines
1.2 KiB
Markdown
48 lines
1.2 KiB
Markdown
# pfi-postgres
|
|
|
|
Shared Postgres cluster at the Anaheim colo.
|
|
|
|
## Network
|
|
|
|
- **LAN IP:** 10.250.50.80
|
|
- **Port:** 5432
|
|
- **SSH:** `lkraven@pfi-postgres`
|
|
|
|
## Infrastructure
|
|
|
|
- **Hypervisor:** `pfi-pve` (VMID **105**)
|
|
- **Type:** Linux VM
|
|
- **Site:** Anaheim (PFI colo)
|
|
|
|
## Role
|
|
|
|
Shared Postgres server backing multiple ana-docker stacks:
|
|
|
|
| Consumer | DB | User |
|
|
|---|---|---|
|
|
| vaultwarden | `vaultwarden` | `vaultwarden` |
|
|
| gitea | `gitea` | `gitea` |
|
|
| paperless-ngx (on esh-docker-vm) | `paperless-ng` | `paperless-ng` |
|
|
| (Likely others — audit as more stacks surface) |
|
|
|
|
## Backup coverage
|
|
|
|
- **VM-image:** ✅ vzdump on pfi-pve (daily)
|
|
- **App-consistent DB dumps:** ✅ each dependent stack's host runs a
|
|
pre-backup hook that `pg_dump`s its database from this server into
|
|
its own restic stage:
|
|
- ana-docker: vaultwarden + gitea (via `configs/restic/ana-docker/pre-backup.sh`)
|
|
- esh-docker-vm: paperless-ngx (via `configs/restic/esh-docker-vm/pre-backup.sh`)
|
|
- **File-level restic on this host:** ❌ not configured. Optional — the
|
|
VM-image + per-consumer pg_dumps together cover most recovery paths.
|
|
|
|
## Refresh state
|
|
|
|
```bash
|
|
scripts/refresh-server-info.sh pfi-postgres
|
|
```
|
|
|
|
## Discovered via
|
|
|
|
FortiGate DHCP (MAC `c2:1f:cc:71:66:d0`).
|