Verified against live DNS, federation and backup state (no privileged commands):
- IPv6: the zone carries AAAA records (2a02:4780:6e:83fd::1, Hostinger) that the plan
never mentioned. Switching A records only leaves IPv6 clients - including other
homeservers and mail senders - on the old box. Repoint or delete; decide pre-flight.
- TTL: the runbook said 760-1642s, which was a decrementing cache countdown, not the
zone TTL (3600s). Propagation is up to an hour, which is why the next item matters.
- "Leave the old box running read-only" was undefined and dangerous: during the TTL
window a still-serving old box silently collects Matrix messages, Gitea pushes, API
spend and mail into a database that gets thrown away. Now step 3: stop the apps after
the final backup; keep the machine powered for rollback only.
- Port 25 inbound was missing from the port list (mail delivery); 8448 noted as
intentionally closed - federation is delegated to 443 via the apex .well-known,
verified live.
- DMARC is p=reject pct=100: post-restore mail misalignment means discarded mail, not
junk. DKIM TXT must be verified against the restored key; test delivery to an external
mailbox, not just that the app accepts the send.
- Post-restore federation check now includes the apex .well-known (served by the
website app), without which federation breaks while matrix.inference.coop looks fine.
- Stale text removed: the once-daily backup schedule IS applied (00 00 23 * * *,
verified), and the backup space was enlarged - newest run healthy at 4.6 GB.
Pre-flight, ordered cutover, post-restore verification, rollback, and the list of what Cloudron's backup does not cover. Written from a live inventory of the server on 2026-10-29; open unknowns are marked rather than guessed.
inference-bot