vh
60367b307f
Bundles the inventory expansion since 2026-04-22:
- New host dirs (READMEs + ssh-target where dir name doesn't resolve):
ana-nas, ana-wg, esh-vm-db, nh3-nas, pbs-ana, pbs-nh3.
- New PFI VM snapshots (registered + key-installed 2026-04-23):
ana-filebot, pfi-ana-webhost, pfi-postgres, pfi-pteradactyl,
pfi-tacticalrmm, sf-ana-container, sfsrv-ana (system + proxmox).
- servers/irv-ml1: ONBOARDING.md (the first-time setup notes from when
the host was brought into the fleet) + ssh-target (10.100.79.3 over
the WG tunnel — name doesn't DNS-resolve from this workstation).
- servers/{ana-ml2,pfi-pve,sf-r630}/README.md: updates to capture BMC
IPs, the iDRAC vs OS hostname distinction (sf-r630 hardware =
sfsrv-ana OS), and the ana-ml2 Supermicro BMC (10.250.250.50,
distinct from the Dell R750xs iDRAC).
- configs/homepage/docker.yaml: irv-ml1-docker provider added so
homepage auto-discovers irv-ml1's stacks over the WG tunnel.
- docs/orientation.md: narrative fleet overview written for fresh
Claude sessions — sites, backup architecture, governing principles,
gotchas, where-to-look guide. Pointed at from CLAUDE.md.
97 lines
3.4 KiB
Markdown
97 lines
3.4 KiB
Markdown
# esh-vm-db
|
|
|
|
ESH-side database VM at `esteban.net`. Hosts **two database servers**:
|
|
|
|
- **PostgreSQL 15** on port 5432 — primary consumer is paperless-ngx
|
|
on esh-docker-vm (`paperless-ng` user/db).
|
|
- **MongoDB** on port 27017 — consumers unknown; document at next
|
|
inventory pass.
|
|
|
|
Discovered 2026-04-23 during the paperless-ngx password rotation —
|
|
paperless's `PAPERLESS_DBHOST: 10.0.50.60` pointed here rather than
|
|
the assumed pfi-postgres (VM 105). Up until that point this host was
|
|
invisible to inventory.
|
|
|
|
## Network
|
|
|
|
- **LAN IP:** 10.0.50.60
|
|
- **FQDN:** `esh-vm-db.esteban.net`
|
|
- **SSH:** `ssh esh-vm-db` (config alias → `lkraven@10.0.50.60`,
|
|
key auth).
|
|
- **Listening ports:** 22 (ssh), 111 (rpcbind — NFS mount support),
|
|
5432 (postgres), 27017 (mongo).
|
|
|
|
## Hardware
|
|
|
|
- **Hypervisor:** presumably esh-pve or esh-pve-nas (to be confirmed
|
|
— not yet queried from the PVE side).
|
|
- **CPU:** Intel Core i9-13900H (16 cores, mobile) — indicates this
|
|
VM lives on a mini-PC / NUC-class ESH host.
|
|
- **RAM:** 7.8 GB
|
|
- **Root disk:** 250 GB ext4 on `/dev/sda1`, 5.1 GB used (2%). Plenty
|
|
of headroom for both DBs.
|
|
- **OS:** Debian 12 (bookworm), kernel 6.1.0-23
|
|
- **Uptime:** 3+ weeks at last snapshot.
|
|
|
|
## What it runs
|
|
|
|
- **PostgreSQL 15 (apt package, `postgresql`)** — data directory
|
|
default (`/var/lib/postgresql/15/main` presumably — confirm with
|
|
`pg_lsclusters` on a future refresh). Local disk, not NFS —
|
|
consistent with the "DBs must live on local disk" principle we
|
|
adopted 2026-04-23.
|
|
- **MongoDB** — port 27017 bound to 0.0.0.0. DataPath + version to
|
|
be captured.
|
|
- **No Docker.** `server_inspect.sh` reports `docker not installed`
|
|
and `/opt/docker` absent — this host is bare-metal DB service,
|
|
not a container host.
|
|
|
|
## Storage
|
|
|
|
- `/dev/sda1` (250 GB ext4) — DB data + OS
|
|
- `/mnt/backup` mounted from `10.0.50.50:/mnt/backup` via NFS
|
|
(`defaults`). Purpose TBD — possibly for pg_dump outputs or other
|
|
backup staging. Review on next pass.
|
|
|
|
## Consumers
|
|
|
|
- **paperless-ngx** on esh-docker-vm — uses postgres user
|
|
`paperless-ng` against DB `paperless-ng` (confirmed 2026-04-23,
|
|
password rotated).
|
|
- **MongoDB consumers** — unknown; map these by checking connection
|
|
logs or by inventorying the other ESH-side Docker stacks for
|
|
`27017`/`mongodb` references.
|
|
|
|
## Backup coverage
|
|
|
|
**Not yet configured.** Same category as ana-ml2/irv-ml1/esh-vm-db
|
|
now (bare-metal DB host without vzdump awareness from the PVE side).
|
|
|
|
Next steps:
|
|
|
|
- Add to fleet PBS vzdump schedule (its hypervisor backs it up via
|
|
PBS-ANA if the hypervisor is onboarded).
|
|
- Draft `configs/restic/esh-vm-db/profiles.yaml` for file-level +
|
|
per-DB dumps (`pg_dumpall` for postgres, `mongodump` for mongo).
|
|
Target: `rest-server-ana` via the ESH → ANA cross-WAN path, same
|
|
as other ESH-side restic clients.
|
|
- `rest-server-ana`'s `.htpasswd` will need an `esh-vm-db` entry.
|
|
|
|
## Refresh state
|
|
|
|
```bash
|
|
scripts/refresh-server-info.sh esh-vm-db
|
|
```
|
|
|
|
## Follow-ups (do soon)
|
|
|
|
- Confirm hypervisor (likely esh-pve or esh-pve-nas) — `qm list`
|
|
on each and find VM with this name.
|
|
- Map MongoDB consumers.
|
|
- Configure backup (restic profile + per-DB dumps + vzdump coverage
|
|
on the hypervisor side).
|
|
- Audit postgres `pg_hba.conf` — is 5432 bound to 0.0.0.0 with
|
|
proper host-based auth, or is it over-exposed? paperless connects
|
|
from 10.0.50.45 (esh-docker-vm); other hosts shouldn't be able
|
|
to reach in.
|