Snapshot records apps/images/env-names/backup config and data fingerprints for a
post-restore diff. Also resolves an open unknown: the off-box JSON carries only
accessKeyId, so the S3 secretAccessKey must be retrieved before the window. The
restic passphrase is fine - it is on the agent host, which is not migrating.
Verified from outside: rules applied on IPv6, nothing but SSH on IPv4.
Blocked=timeout, permitted-but-idle=refused, so the state is readable
before Cloudron is installed. Inbound 25 required (Cloudron docs);
outbound 25 unnecessary with a relay, which this box has.
Mail is enabled inbound for inference.coop (platform mail server, not the
Mail app container, which is only a UI on :3000). Ports verified against
the old box. Whether mailbox CONTENTS are in the Cloudron backup is
unverified and would be silent data loss - now the highest-priority open
question.
Ubuntu 26.04 LTS is supported (docs) and the real version floor is the
PLATFORM version 10.1.5, not the CLI's 9.0.4. Provider firewall is not
Cloudron's job (80/443 dropped, 22 open), rDNS belongs to Infomaniak, and
the setup wizard is where the subscription/restore happen - so install now,
stop before the wizard.
New box: 179.237.86.116 / 2001:1600:18:206::89, 4CPU/12GB/250GB,
Ubuntu 26.04 LTS, one free snapshot slot, reverse DNS unset on both
addresses. IPv6 exists, so the 18 AAAA records are repointed rather
than deleted.
Live zone inventory: 19 A + 18 AAAA records, all TTL 3600 (the lower values
seen on some answers are cache countdowns). The AAAA scope was understated
in the runbook - it is 18 hostnames, not 3. No CAA records, so no CA
restriction to update. The /var/lib/nextcloud host mount resolves to 3 MB of
regenerable thumbnails, so it is no longer an open unknown.
Verified against live DNS, federation and backup state (no privileged commands):
- IPv6: the zone carries AAAA records (2a02:4780:6e:83fd::1, Hostinger) that the plan
never mentioned. Switching A records only leaves IPv6 clients - including other
homeservers and mail senders - on the old box. Repoint or delete; decide pre-flight.
- TTL: the runbook said 760-1642s, which was a decrementing cache countdown, not the
zone TTL (3600s). Propagation is up to an hour, which is why the next item matters.
- "Leave the old box running read-only" was undefined and dangerous: during the TTL
window a still-serving old box silently collects Matrix messages, Gitea pushes, API
spend and mail into a database that gets thrown away. Now step 3: stop the apps after
the final backup; keep the machine powered for rollback only.
- Port 25 inbound was missing from the port list (mail delivery); 8448 noted as
intentionally closed - federation is delegated to 443 via the apex .well-known,
verified live.
- DMARC is p=reject pct=100: post-restore mail misalignment means discarded mail, not
junk. DKIM TXT must be verified against the restored key; test delivery to an external
mailbox, not just that the app accepts the send.
- Post-restore federation check now includes the apex .well-known (served by the
website app), without which federation breaks while matrix.inference.coop looks fine.
- Stale text removed: the once-daily backup schedule IS applied (00 00 23 * * *,
verified), and the backup space was enlarged - newest run healthy at 4.6 GB.
Pre-flight, ordered cutover, post-restore verification, rollback, and the list of what Cloudron's backup does not cover. Written from a live inventory of the server on 2026-10-29; open unknowns are marked rather than guessed.
inference-bot