diff options
Diffstat (limited to 'prompts/skills/f3s-storage')
| -rw-r--r-- | prompts/skills/f3s-storage/SKILL.md | 4 | ||||
| -rw-r--r-- | prompts/skills/f3s-storage/references/usb-keys.md | 27 |
2 files changed, 30 insertions, 1 deletions
diff --git a/prompts/skills/f3s-storage/SKILL.md b/prompts/skills/f3s-storage/SKILL.md index 82c0a5e..865c2e3 100644 --- a/prompts/skills/f3s-storage/SKILL.md +++ b/prompts/skills/f3s-storage/SKILL.md @@ -12,6 +12,7 @@ Note: original plan was HAST, replaced by **zrepl** (ZFS send/receive) — more ## When to Use - Working on the homelab storage layer: ZFS pools/datasets, encryption, USB keys +- The removable `zusb` backup pool (quarterly load/unload, moving the USB disks between f-hosts) - zrepl replication (f0→f1 nfsdata, f3→f2 VM), CARP failover, NFS-over-stunnel - Diagnosing NFS mount problems, SUSPENDED pools, or thermal issues - For the physical hosts, WireGuard mesh, and host/IP inventory this depends on, see the [`f3s`](../f3s/SKILL.md) hub skill. @@ -19,7 +20,7 @@ Note: original plan was HAST, replaced by **zrepl** (ZFS send/receive) — more ## Reference Files - [ZFS Pools & Encryption](references/zfs.md) — `zdata` pool, physical disks, USB-stored keys mounted by `f3skeys` (not `/etc/fstab`), encrypted datasets, boot-time key loading -- [USB Key Mounting](references/usb-keys.md) — `f3skeys`, `/usr/local/sbin/f3s-mount-keys`, and current `zfskeys_datasets` per f-host +- [USB Key Mounting](references/usb-keys.md) — `f3skeys`, `/usr/local/sbin/f3s-mount-keys`, current `zfskeys_datasets` per f-host, and the removable quarterly `zusb` backup pool (raw key on `/keys/zusb.key`, manual `zusb-load`/`zusb-unload` on all f-hosts) - [zrepl Replication](references/zrepl.md) — `f0 → f1` nfsdata, `f3 → f2` freebsd VM, sink configs, troubleshooting, DL-state recovery - [CARP HA VIP](references/carp.md) — VIP `192.168.1.138`, `carpcontrol.sh`, mgmt script, auto-failback, SUSPENDED-pool limitation - [NFS over stunnel](references/nfs.md) — NFS server, mutual-TLS stunnel, Rocky client config, `/etc/fstab` @@ -39,3 +40,4 @@ Note: original plan was HAST, replaced by **zrepl** (ZFS send/receive) — more | Local-path | k3s local-path provisioner | Node-local storage for SQLite/cache workloads | | LAN access | FreeBSD relayd on CARP VIP | TCP forwarding to k3s :80/:443 | | Backup | S3 Glacier Deep Archive | Off-site encrypted backup | +| Removable backup | `zusb` raidz2 (4 × 1.8 TB USB-SATA) | Offline backup storage, plugged in ~quarterly; raw key on `/keys/zusb.key`, manual `zusb-load`/`zusb-unload` on all f-hosts | diff --git a/prompts/skills/f3s-storage/references/usb-keys.md b/prompts/skills/f3s-storage/references/usb-keys.md index 9871daa..07b7414 100644 --- a/prompts/skills/f3s-storage/references/usb-keys.md +++ b/prompts/skills/f3s-storage/references/usb-keys.md @@ -114,3 +114,30 @@ change. Note: `zroot/sink/f3/zroot/bhyve/freebsd` on f2 has `mountpoint=none`; the reboot check expects its key to be `available`, but it is not mounted because it has no filesystem mountpoint. + +## Removable backup pool (`zusb`) + +`zusb` is a **4-disk raidz2 ZFS pool on 1.8 TB USB-SATA disks** (ASMT ASM235CM +bridges) used as the **offline backup storage device** — plugged in and loaded +**roughly once per quarter** to back up data, then exported and unplugged. It +lives on whichever f-host it is currently plugged into (f1 as of 2026-07-20). + +It is **not** auto-imported or auto-mounted at boot and is **not** in any +host's `zfskeys_datasets` (removable disks must never block boot). It is loaded +manually with `/usr/local/bin/zusb-load` and exported with +`/usr/local/bin/zusb-unload`. + +The encryption root is `zusb/data/enc`, rekeyed to the same raw-key-on-stick +scheme as the other f-host secrets: `keyformat=raw`, +`keylocation=file:///keys/zusb.key`. The 32-byte key file `/keys/zusb.key` is +placed on **all four** `F3S_KEYS` sticks, and the load/unload scripts are +deployed to **all four** f-hosts, so the disk stack can be re-plugged to any +f-host and loaded there with no per-host setup. + +`zusb/data/enc` was migrated from t450, where it was unlocked via a +passphrase-protected `zroot/secret` keystore (`/zroot/secret/zroot.enc.key`); +that old passphrase key is now obsolete for `zusb`. + +Scripts and deployment docs live in the conf repo at +`f3s/freebsd-hosts/zusb/` (`zusb-load`, `zusb-unload`, `README.md`). The raw +key itself is **not** in git — it is copied stick-to-stick like the other keys. |