# Resiliency Notes — atheos-blog-lxc

**Status**: resiliency-baseline extension **opted out** (LAN-only PoC) per Andrew's standing preference.
**Purpose**: record what a non-PoC deployment would need, so the trail survives.

---

## 1. What this guest is, from a resiliency standpoint

A **single small container that can be destroyed and rebuilt** — that is the design, not a gap.
`armistace/blog` is the durability anchor: the source of truth lives in **Gitea**, not on this guest.
Losing the LXC loses only:
- the Atheos install (reproducible: `scripts/provision.sh`)
- the local clone (re-clonable)
- **uncommitted edits** ← the only genuinely perishable data

## 2. Current posture

| Aspect | State | Note |
|---|---|---|
| Rootfs | 20 GB, thin-provisioned on `scotty-local-lvm` | thin pool had 771 GB free at design time |
| `onboot` | enabled | survives a node restart |
| Backups | **none** | acceptable: nothing unique is stored |
| Snapshots | none taken (a `pre-*` snapshot is used during *upgrades* only) | |
| Rebuild path | `scripts/provision.sh` | **this is the resiliency mechanism** |
| Reboot survival | **verified**, not assumed | AC-6 — service returns and the clone persists |

## 3. If this ever moves beyond a LAN PoC

| # | Item | Touch-point |
|---|---|---|
| R-1 | **Scheduled snapshot** of the guest (`pct snapshot` / PBS) with retention | PVE / PBS |
| R-2 | **Automated verification of the rebuild path** — run `provision.sh` into a throwaway VMID on a schedule; a backup you have never restored is a claim | CI or cron on the PVE node |
| R-3 | **Alert on guest down** (`pct status` + HTTP probe) | observability stack |
| R-4 | **Push-based durability for in-progress work**: an auto-commit/ahead-of-time branch so uncommitted edits stop being the failure mode | a small hook or Atheos-side job |
| R-5 | **Disk alert at 80%** of the 20 GB rootfs (a full rootfs silently breaks PHP sessions) | observability stack |
| R-6 | **Move the clone's durability to the repo**: rely on Gitea backup/restore rather than guest backups | Gitea |
| R-7 | **Document RTO/RPO**: here RTO ≈ re-run `provision.sh` (minutes); RPO = last commit | RUNBOOK |
| R-8 | **`scotty-local-lvm` thin-pool monitoring** — a thin pool that fills takes down *every* guest on it, not just this one | PVE node |

## 4. Design choices that already help

- **Nothing unique is stored on the guest** — the deliberately tiny 20 GB root is a *feature*: it
  bounds what can be lost and keeps rebuild cheap.
- **Provisioning is a script**, so rebuild is not a memory exercise (FR-9).
- **The build pipeline is elsewhere** (Q1=A), so this guest is not on the critical path for publishing.
- **OpenRC services are enabled at boot** (AC-6 verifies it), so a reboot is not a repair event.

## 5. Accepted risks

| Risk | Why accepted | Revisit trigger |
|---|---|---|
| No backups | no unique data; rebuild is scripted | if the guest starts holding anything unique |
| Single guest on a single node | LAN PoC scope | on any production expectation → R-1/R-3 |
| Uncommitted edits are perishable | normal for a git worktree; operator controls commit cadence | if it bites → R-4 |