inference-bot
a2088e3976
Verified against live DNS, federation and backup state (no privileged commands): - IPv6: the zone carries AAAA records (2a02:4780:6e:83fd::1, Hostinger) that the plan never mentioned. Switching A records only leaves IPv6 clients - including other homeservers and mail senders - on the old box. Repoint or delete; decide pre-flight. - TTL: the runbook said 760-1642s, which was a decrementing cache countdown, not the zone TTL (3600s). Propagation is up to an hour, which is why the next item matters. - "Leave the old box running read-only" was undefined and dangerous: during the TTL window a still-serving old box silently collects Matrix messages, Gitea pushes, API spend and mail into a database that gets thrown away. Now step 3: stop the apps after the final backup; keep the machine powered for rollback only. - Port 25 inbound was missing from the port list (mail delivery); 8448 noted as intentionally closed - federation is delegated to 443 via the apex .well-known, verified live. - DMARC is p=reject pct=100: post-restore mail misalignment means discarded mail, not junk. DKIM TXT must be verified against the restored key; test delivery to an external mailbox, not just that the app accepts the send. - Post-restore federation check now includes the apex .well-known (served by the website app), without which federation breaks while matrix.inference.coop looks fine. - Stale text removed: the once-daily backup schedule IS applied (00 00 23 * * *, verified), and the backup space was enlarged - newest run healthy at 4.6 GB.
Runbooks
Operational runbooks for the co-op's infrastructure. Private: these contain topology, addresses, and procedure detail that should not be public.