vh
60367b307f
Bundles the inventory expansion since 2026-04-22:
- New host dirs (READMEs + ssh-target where dir name doesn't resolve):
ana-nas, ana-wg, esh-vm-db, nh3-nas, pbs-ana, pbs-nh3.
- New PFI VM snapshots (registered + key-installed 2026-04-23):
ana-filebot, pfi-ana-webhost, pfi-postgres, pfi-pteradactyl,
pfi-tacticalrmm, sf-ana-container, sfsrv-ana (system + proxmox).
- servers/irv-ml1: ONBOARDING.md (the first-time setup notes from when
the host was brought into the fleet) + ssh-target (10.100.79.3 over
the WG tunnel — name doesn't DNS-resolve from this workstation).
- servers/{ana-ml2,pfi-pve,sf-r630}/README.md: updates to capture BMC
IPs, the iDRAC vs OS hostname distinction (sf-r630 hardware =
sfsrv-ana OS), and the ana-ml2 Supermicro BMC (10.250.250.50,
distinct from the Dell R750xs iDRAC).
- configs/homepage/docker.yaml: irv-ml1-docker provider added so
homepage auto-discovers irv-ml1's stacks over the WG tunnel.
- docs/orientation.md: narrative fleet overview written for fresh
Claude sessions — sites, backup architecture, governing principles,
gotchas, where-to-look guide. Pointed at from CLAUDE.md.
pfi-postgres
Shared Postgres cluster at the Anaheim colo.
Network
- LAN IP: 10.250.50.80
- Port: 5432
- SSH:
lkraven@pfi-postgres
Infrastructure
- Hypervisor:
pfi-pve(VMID 105) - Type: Linux VM
- Site: Anaheim (PFI colo)
Role
Shared Postgres server backing multiple ana-docker stacks:
| Consumer | DB | User |
|---|---|---|
| vaultwarden | vaultwarden |
vaultwarden |
| gitea | gitea |
gitea |
| paperless-ngx (on esh-docker-vm) | paperless-ng |
paperless-ng |
| (Likely others — audit as more stacks surface) |
Backup coverage
- VM-image: ✅ vzdump on pfi-pve (daily)
- App-consistent DB dumps: ✅ each dependent stack's host runs a
pre-backup hook that
pg_dumps its database from this server into its own restic stage:- ana-docker: vaultwarden + gitea (via
configs/restic/ana-docker/pre-backup.sh) - esh-docker-vm: paperless-ngx (via
configs/restic/esh-docker-vm/pre-backup.sh)
- ana-docker: vaultwarden + gitea (via
- File-level restic on this host: ❌ not configured. Optional — the VM-image + per-consumer pg_dumps together cover most recovery paths.
Known weak password (rotate)
The inline passwords currently in use for these databases are trivially weak:
gitea/giteapaperless-ng/paperless-ng
Rotation is on the post-backup-pipeline cleanup list. Exposed in the 2026-04-21 transcripts.
Refresh state
scripts/refresh-server-info.sh pfi-postgres
Discovered via
FortiGate DHCP (MAC c2:1f:cc:71:66:d0).