Output:
Chunk ID: 381205
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 1538
Output:
# Backup-Ordnerstruktur — dmz-backup + Synology Pull

Stand: 2026-06-19

## Zielbild

- `dmz-backup` (`192.168.20.90`) ist der DMZ-Staging-Host.
- K3s/DMZ-Cluster darf Backups nach `dmz-backup` pushen.
- Synology/DiskStation pullt von `dmz-backup` und bleibt Backup-Master.
- Direkte Schreibrechte aus der DMZ auf Synology werden vermieden.

## Empfehlung

Ja: diskstation-bot soll die Struktur grundsaetzlich nach Platform/Tenants uebernehmen.

Nicht nur nach Kubernetes-Namespace sortieren, weil aktuelle Namespaces historisch gewachsen sind (`hf-*`, `pidoka-hf-*`, `homarr`, `zammad`). Besser ist:

1. fachliche Grenze: `platform` oder `tenants/<tenant>`
2. Umgebung: `prod`, `stage`, `dev`
3. Anwendung/Komponente
4. Backup-Art: `db-dumps`, `files`, `volume-backups`, `manifests`, `metadata`, `restore-tests`

## Vorgeschlagener Root

Auf `dmz-backup`:

```text
/srv/dmz-backup/k3s-dmz/
```

Auf Synology als Pull-Ziel sinngemaess:

```text
K3S_DMZ_Backups/
```

## Ordnerstruktur

```text
k3s-dmz/
  README.md
  _incoming/
    quarantine/
    incomplete/
  _indexes/
    latest.json
    backup-catalog.jsonl
    checksums/
  _restore-tests/
    platform/
    tenants/

  platform/
    argocd/
      prod/
        manifests/
        app-exports/
        restore-tests/
    infisical/
      prod/
        db-dumps/
        app-exports/
        restore-tests/
    external-secrets/
      prod/
        manifests/
        crd-inventory/
    longhorn/
      prod/
        volume-backups/
        metadata/
        restore-tests/
    nginx-proxy-manager/
      prod/
        database/
        letsencrypt/
        config/
        restore-tests/
    cluster/
      prod/
        manifests/
        inventory/
        events/
        node-metadata/

  tenants/
    pidoka/
      prod/
        n8n/
          db-dumps/
          files/
          manifests/
          restore-tests/
        matomo/
          db-dumps/
          files/
          manifests/
          restore-tests/
        mautic/
          db-dumps/
          files/
          redis/
          manifests/
          restore-tests/
        suitecrm/
          db-dumps/
          files/
          manifests/
          restore-tests/
        zammad/
          db-dumps/
          files/
          manifests/
          restore-tests/
        homarr/
          db-dumps/
          files/
          manifests/
          restore-tests/

    cattaro/
      stage/
        guestbook/
          manifests/
          restore-tests/
      prod/
        _reserved/

  legacy/
    hf-matomo/
      prod/
        db-dumps/
        files/
        manifests/
        restore-tests/
    default-my-release/
      prod/
        db-dumps/
        manifests/
        restore-tests/
    keycloak/
      prod/
        db-dumps/
        manifests/
        restore-tests/
```

## Dateinamensschema

Empfohlen:

```text
<UTC timestamp>__<cluster>__<tenant-or-platform>__<app>__<kind>__<scope>.<ext>
```

Beispiele:

```text
20260619T193000Z__dmz-k3s__pidoka__matomo__db-dump__mariadb.sql.gz
20260619T193000Z__dmz-k3s__pidoka__zammad__files__uploads.tar.zst
20260619T193000Z__dmz-k3s__platform__argocd__manifests__apps.yaml.gz
20260619T193000Z__dmz-k3s__platform__longhorn__metadata__volumes.json.gz
```

Zu jedem Backup gehoert eine kleine Metadatendatei:

```text
<backup-file>.meta.json
<backup-file>.sha256
```

## Minimale Metadaten

```json
{
  "created_at_utc": "2026-06-19T19:30:00Z",
  "cluster": "dmz-k3s",
  "source_host": "192.168.20.40",
  "backup_staging_host": "dmz-backup",
  "backup_staging_ip": "192.168.20.90",
  "category": "tenant",
  "tenant": "pidoka",
  "environment": "prod",
  "app": "matomo",
  "namespace": "pidoka-hf-matomo",
  "kind": "db-dump",
  "contains_secrets": false,
  "encryption": "tbd",
  "retention_class": "prod-standard",
  "restore_test_required": true
}
```

## Retention-Klassen

Vorschlag fuer diskstation-bot:

- `prod-critical`: taeglich 30 Tage, woechentlich 12 Wochen, monatlich 12 Monate
- `prod-standard`: taeglich 14 Tage, woechentlich 8 Wochen, monatlich 6 Monate
- `platform-critical`: taeglich 30 Tage, woechentlich 12 Wochen, monatlich 12 Monate
- `legacy-cleanup`: taeglich 7 Tage, woechentlich 4 Wochen, danach nur falls explizit markiert
- `pre-change`: mindestens 30 Tage oder bis Change/Restore-Test abgeschlossen ist
- `restore-test-artifacts`: 14 Tage, sofern kein Incident-Beleg

## Security-Leitlinien

- Cluster bekommt nur Schreibrechte auf definierte Zielpfade auf `dmz-backup`.
- Synology bekommt Pull-Rechte von `dmz-backup`, idealerweise read-only.
- Kein breit nutzbarer Synology-Key im Cluster.
- Backups mit Secret-/Credential-Inhalt markieren und bevorzugt vor Ablage verschluesseln.
- Synology-Pull initial ohne destruktives `--delete`; Loesch-/Retention-Entscheidung liegt beim Backup-Master.
- Restore-Test ist Pflicht: Backup ohne getesteten Restore gilt nicht als belastbar.

## Mapping aktueller DMZ-Workloads

- Platform:
  - `platform-infisical` -> `platform/infisical/prod/`
  - `argocd` / IT15-ArgoCD Exporte -> `platform/argocd/prod/`
  - `external-secrets` -> `platform/external-secrets/prod/`
  - Longhorn -> `platform/longhorn/prod/`
  - Nginx Proxy Manager auf `192.168.20.20` -> `platform/nginx-proxy-manager/prod/`
- Tenant `pidoka`:
  - `hf-n8n` -> `tenants/pidoka/prod/n8n/`
  - `pidoka-hf-matomo` -> `tenants/pidoka/prod/matomo/`
  - `hf-mautic` -> `tenants/pidoka/prod/mautic/`
  - `hf-suitecrm` -> `tenants/pidoka/prod/suitecrm/`
  - `zammad` -> `tenants/pidoka/prod/zammad/`
  - `homarr` -> `tenants/pidoka/prod/homarr/`
- Legacy:
  - alter Namespace `hf-matomo` -> `legacy/hf-matomo/prod/`
  - default `my-release` -> `legacy/default-my-release/prod/`
  - alter `keycloak` -> je nach Entscheidung `legacy/keycloak/prod/` oder spaeter `platform/keycloak/prod/`

## Offene Punkte fuer diskstation-bot

1. Finalen Synology Share-Namen festlegen.
2. Pull-Protokoll festlegen: SSH/rsync bevorzugt; alternativ SFTP.
3. Retention/Snapshot/Immutability pro Retention-Klasse abbilden.
4. Quota fuer `dmz-backup` und Synology-Ziel definieren.
5. Verschluesselung entscheiden: dateibasiert vor Ablage oder Synology-seitig.


Output:
Chunk ID: aa00c6
Wall time: 0.0004 seconds
Process exited with code 0
Original token count: 262144
Output:
Total output lines: 8439

./win-docker-logs.ps1:12:Get-WinEvent -FilterHashtable @{LogName='Application'; StartTime=(Get-Date).AddMinutes(-30)} -ErrorAction SilentlyContinue | Where-Object { $_.ProviderName -like '*Docker*' -or $_.Message -like '*Docker*' } | Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message -First 10 | Format-List
./win-docker-logs.ps1:14:Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddMinutes(-30)} -ErrorAction SilentlyContinue | Where-Object { $_.Message -like '*docker*' } | Select-Object TimeCreated,ProviderName,Id,LevelDisplayName,Message -First 10 | Format-List
./slack-manifest.yml.backup.app-home.20260607T125518Z:30:      - message.channels
./slack-manifest.yml.backup.app-home.20260607T125518Z:31:      - message.groups
./slack-manifest.yml.backup.app-home.20260607T125518Z:32:      - message.im
./win-add-portproxy-8088.ps1:6:try { (Invoke-WebRequest -UseBasicParsing -TimeoutSec 8 "http://$wslIp`:8088/api/status").Content } catch { Write-Output $_.Exception.Message; exit 1 }
./win-add-portproxy-8088.ps1:13:try { (Invoke-WebRequest -UseBasicParsing -TimeoutSec 8 http://127.0.0.1:8088/api/status).Content } catch { Write-Output $_.Exception.Message; exit 1 }
./install-socat-infisical-proxy.sh:18:Description=Infisical WSL TCP proxy 8088 to Docker localhost 18080 via socat
./install-socat-infisical-proxy.sh:39:systemctl status infisical-wsl-proxy.service --no-pager -l | sed -n '1,18p'
./wsl-install-docker-engine.ps1:9:curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
./wsl-install-docker-engine.ps1:30:wsl -d Ubuntu -u root -- bash -lc 'systemctl is-system-running || true; systemctl enable --now docker; systemctl status docker --no-pager -l; docker info --format "ServerVersion={{.ServerVersion}};OSType={{.OSType}};OperatingSystem={{.OperatingSystem}}"; docker compose version'
./longhorn-test-backup-retry.sh:48:echo '--- staging usage ---'
./win-portproxy-final-8088.ps1:10:if (-not (Get-NetFirewallRule -DisplayName 'Infisical IT15 TCP 8088' -ErrorAction SilentlyContinue)) {
./win-portproxy-final-8088.ps1:11:  New-NetFirewallRule -DisplayName 'Infisical IT15 TCP 8088' -Direction Inbound -Action Allow -Protocol TCP -LocalPort 8088 -Profile Any | Out-Null
./fix-start-wsl-autostart-keepalive.ps1:28:# Start persistent Ubuntu/WSL keepalive for Infisical
./fix-start-wsl-autostart-keepalive.ps1:38:  "$(Get-Date -Format o) Keep-WSL-Ubuntu start error: $($_.Exception.Message)" | Add-Content 'C:\ProgramData\kube-bot\wsl-docker-autostart.log'
./fix-start-wsl-autostart-keepalive.ps1:42:if ($content -notmatch 'Start persistent Ubuntu/WSL keepalive for Infisical') {
./fix-start-wsl-autostart-keepalive.ps1:48:[void][System.Management.Automation.PSParser]::Tokenize((Get-Content $start -Raw), [ref]$errors)
./win-check-open-8088.ps1:3:try { (Invoke-WebRequest -UseBasicParsing -TimeoutSec 8 http://127.0.0.1:8088/api/status).Content } catch { Write-Output $_.Exception.Message }
./win-check-open-8088.ps1:7:Get-NetFirewallRule -DisplayName '*Infisical*8088*' -ErrorAction SilentlyContinue | Select-Object DisplayName,Enabled,Direction,Action,Profile | Format-Table -AutoSize
./win-check-open-8088.ps1:9:if (-not (Get-NetFirewallRule -DisplayName 'Infisical IT15 TCP 8088' -ErrorAction SilentlyContinue)) {
./win-check-open-8088.ps1:10:  New-NetFirewallRule -DisplayName 'Infisical IT15 TCP 8088' -Direction Inbound -Action Allow -Protocol TCP -LocalPort 8088 -Profile Any | Out-Null
./win-check-open-8088.ps1:12:Get-NetFirewallRule -DisplayName 'Infisical IT15 TCP 8088' | Select-Object DisplayName,Enabled,Direction,Action,Profile | Format-Table -AutoSize
./win-docker-step1.ps1:15:  'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager'
./check-longhorn-backup-target.sh:5:  sudo -n /usr/local/bin/kubectl -n longhorn-system get backuptarget default -o jsonpath='url={.spec.backupTargetURL} available={.status.available} msg={.status.conditions[*].message}{"\n"}' || true
./check-longhorn-backup-target.sh:6:  for p in $(sudo -n /usr/local/bin/kubectl -n longhorn-system get pod -l app=longhorn-manager -o name); do
./ESO_UPGRADE_PLAN_20260619.md:7:External Secrets Operator in der DMZ sauber aus dem alten Stand `0.10.5` herausfuehren, ohne laufende Infisical-Secret-Synchronisation fuer PIDOKA-Apps zu gefaehrden.
./ESO_UPGRADE_PLAN_20260619.md:14:- ESO Chart/Image: `0.10.5`.
./ESO_UPGRADE_PLAN_20260619.md:40:Bewertung: Die Infisical-basierte Secret-Synchronisation ist aktuell nicht betroffen. Das Problem ist ein CRD-/Health-Thema, nicht ein Secret-Sync-Ausfall.
./BETRIEBSKONZEPT_PLATFORM.md:5:Owner künftig: platform-manager-bot
./BETRIEBSKONZEPT_PLATFORM.md:20:- Intranet-/Management-Zone für kritische Steuerungs- und Secret-Dienste, soweit verfügbar.
./BETRIEBSKONZEPT_PLATFORM.md:21:- Synology DiskStation als Übergangsort für Infisical-Pilot im Intranet.
./BETRIEBSKONZEPT_PLATFORM.md:22:- Reverse-Proxy-/Firewall-Kette: OPNsense -> Nginx Proxy Manager -> K3s/Traefik/Services.
./BETRIEBSKONZEPT_PLATFORM.md:39:### platform-manager-bot (geplant)
./BETRIEBSKONZEPT_PLATFORM.md:53:- Infisical-Pilot auf Synology aus NAS-Sicht
./BETRIEBSKONZEPT_PLATFORM.md:61:- secrets-bot: Infisical, Machine Identities, Rotation, Audit
./BETRIEBSKONZEPT_PLATFORM.md:70:- Ingress / Traefik / Nginx Proxy Manager
./BETRIEBSKONZEPT_PLATFORM.md:71:- Secrets Management / Infisical
./BETRIEBSKONZEPT_PLATFORM.md:72:- Storage / Longhorn / local-path
./BETRIEBSKONZEPT_PLATFORM.md:78:- Namespace/AppProject beantragen
./BETRIEBSKONZEPT_PLATFORM.md:79:- Infisical-Projekt oder Secret-Pfad beantragen
./BETRIEBSKONZEPT_PLATFORM.md:80:- Ingress/DNS beantragen
./BETRIEBSKONZEPT_PLATFORM.md:81:- Storage/PVC beantragen
./BETRIEBSKONZEPT_PLATFORM.md:84:- produktiven Change beantragen
./BETRIEBSKONZEPT_PLATFORM.md:86:## 5. Change Management / Change Enablement
./BETRIEBSKONZEPT_PLATFORM.md:100:- Infisical-Secret-Sync einführen
./BETRIEBSKONZEPT_PLATFORM.md:111:## 6. Incident Management
./BETRIEBSKONZEPT_PLATFORM.md:122:## 7. Problem Management
./BETRIEBSKONZEPT_PLATFORM.md:138:- Infisical vor produktiver Nutzung: Backup und Restore testen.
./BETRIEBSKONZEPT_PLATFORM.md:143:- platform-manager-bot später für Nachhaltung
./BETRIEBSKONZEPT_PLATFORM.md:148:- öffentliche Exposition von Argo CD, Portainer, Dashboard, Infisical
./BETRIEBSKONZEPT_PLATFORM.md:163:- Storage/Longhorn Health
./BETRIEBSKONZEPT_PLATFORM.md:181:- ein Mandant = eigene Namespaces, eigenes AppProject, eigene Infisical-Struktur, eigene Identities.
./BETRIEBSKONZEPT_PLATFORM.md:185:## 13. Dokumentation / Knowledge Management
./BETRIEBSKONZEPT_PLATFORM.md:199:P0 — Sicherheits-/Betriebsgrundlagen:
./BETRIEBSKONZEPT_PLATFORM.md:200:1. DMZ-Exposure administrativer Dienste prüfen: Argo CD, Portainer, Dashboard, später Infisical.
./BETRIEBSKONZEPT_PLATFORM.md:202:3. Infisical-Pilot auf Synology planen inkl. Restore-Test.
./BETRIEBSKONZEPT_PLATFORM.md:214:11. Dritten Node / Intranet-Management-Node planen.
./BETRIEBSKONZEPT_PLATFORM.md:233:- `tenant-pidoka-stage`
./BETRIEBSKONZEPT_PLATFORM.md:236:- Infisical-Projekt `tenant-pidoka`
./longhorn_sc_option_a.sh:5:echo ---backup-configmap-and-storageclass---
./longhorn_sc_option_a.sh:6:$K -n longhorn-system get configmap longhorn-storageclass -o yaml > /tmp/longhorn-storageclass-configmap-before-2replica-$TS.yaml
./longhorn_sc_option_a.sh:7:$K get storageclass longhorn -o yaml > /tmp/longhorn-storageclass-before-template-fix-$TS.yaml
./longhorn_sc_option_a.sh:8:ls -l /tmp/longhorn-storageclass-*-$TS.yaml
./longhorn_sc_option_a.sh:10:echo ---write-new-storageclass-template---
./longhorn_sc_option_a.sh:11:cat > /tmp/longhorn-storageclass-template-2replica.yaml <<'EOF'
./longhorn_sc_option_a.sh:12:kind: StorageClass
./longhorn_sc_option_a.sh:13:apiVersion: storage.k8s.io/v1
./longhorn_sc_option_a.sh:17:    storageclass.kubernetes.io/is-default-class: "true"
./longhorn_sc_option_a.sh:33:new=open('/tmp/longhorn-storageclass-template-2replica.yaml').read()
./longhorn_sc_option_a.sh:34:patch={"data":{"storageclass.yaml":new}}
./longhorn_sc_option_a.sh:35:subprocess.check_call(["sudo","-n","/usr/local/bin/kubectl","-n","longhorn-system","patch","configmap","longhorn-storageclass","--type=merge","-p",json.dumps(patch)])
./longhorn_sc_option_a.sh:39:$K -n longhorn-system get configmap longhorn-storageclass -o yaml | grep -A24 "storageclass.yaml" | sed -n "1,80p"
./longhorn_sc_option_a.sh:41:echo ---delete-storageclass-for-reconcile---
./longhorn_sc_option_a.sh:42:$K delete storageclass longhorn
./longhorn_sc_option_a.sh:47:  if $K get storageclass longhorn >/dev/null 2>&1; then echo recreated_after=${i}s; recreated=yes; break; fi
./longhorn_sc_option_a.sh:52:  $K create -f /tmp/longhorn-storageclass-template-2replica.yaml
./longhorn_sc_option_a.sh:55:echo ---verify-storageclass-final---
./longhorn_sc_option_a.sh:56:$K get storageclass longhorn -o yaml | sed -n "1,140p"
./TOMORROW_DMZ_INFISICAL.md:1:# Morgen: DMZ Infisical Wiedereinstieg
./TOMORROW_DMZ_INFISICAL.md:4:DMZ-Infisical sicher bootstrappen, ohne Firewall-Öffnung oder Public Exposure.
./TOMORROW_DMZ_INFISICAL.md:7:- ArgoCD grün: `platform-infisical-dmz`, `platform-argocd-projects`, `demo-guestbook-cattaro-stage`.
./TOMORROW_DMZ_INFISICAL.md:9:- Infisical `/api/status`: `Ok`.
./post-reboot-check-it15.ps1:15:Write-Output '== WSL/Docker/Infisical =='
./wsl-fix-infisical-key.ps1:16:enc=secrets.token_hex(16)  # Infisical requires random 16-byte hex string (32 hex chars)
./setup-longhorn-staging.sh:12:echo '--- create mount point/image ---'
./setup-longhorn-staging.sh:16:  sudo -n /usr/sbin/mkfs.ext4 -F -L longhorn-stage "$IMG"
./setup-longhorn-staging.sh:18:  echo "image exists, not recreating: $IMG"
./setup-longhorn-staging.sh:45:sudo -n /usr/bin/systemctl --no-pager --lines=5 status nfs-server
./status-infisical-quick.ps1:2:Write-Output '== WSL Infisical local =='
./status-infisical-quick.ps1:8:try { (Invoke-WebRequest -UseBasicParsing -TimeoutSec 5 http://127.0.0.1:8088/api/status).Content } catch { Write-Output $_.Exception.Message }
./status-infisical-quick.ps1:11:try { (Invoke-WebRequest -UseBasicParsing -TimeoutSec 5 http://192.168.1.121:8088/api/status).Content } catch { Write-Output $_.Exception.Message }
./AGENTS.md:13:5. Bei unklarer Berechtigung oder unklarem Scope stoppen und nachfragen.
./AGENTS.md:52:4. Persistente Merker aktualisieren, z.B. `INFRASTRUCTURE.md`, `SESSION_HANDOFF.md`, Infisical-Metadaten oder Inventar-Dateien, sofern keine Secretwerte offengelegt werden.
./AGENTS.md:57:- Neuer SSH-Zugang: testen, dokumentieren, Infisical-Recovery aktualisieren, Recovery-Probe durchführen.
./AGENTS.md:58:- Cluster-Status geprüft: Findings priorisieren, nächste Diagnose vorschlagen.
./INFRASTRUCTURE.md:22:  4. Kubernetes Service / Pod / Storage / App
./INFRASTRUCTURE.md:31:  - 81/tcp — vermutlich WebUI / Management UI
./INFRASTRUCTURE.md:36:## Nginx Proxy Manager Inventur (read-only)
./INFRASTRUCTURE.md:39:- `ngm2-app-1` — `jc21/nginx-proxy-manager:latest`
./INFRASTRUCTURE.md:41:- Let's Encrypt: `/data/compose/2/letsencrypt:/etc/letsencrypt`
./INFRASTRUCTURE.md:61:- Bevorzugt über Nginx Proxy Manager Mechanismus/API/DB/WebUI-nah, nicht durch freies Editieren generierter nginx-Dateien.
./INFRASTRUCTURE.md:70:- Beispiele aus Nginx Proxy Manager:
./INFRASTRUCTURE.md:80:- Beispiele aus Nginx Proxy Manager:
./INFRASTRUCTURE.md:106:- Raspberry Pi / Nginx Proxy Manager — `192.168.20.20` — Zone: DMZ
./INFRASTRUCTURE.md:109:- IT15 Management-Node — `192.168.1.121` — Zone: Intranet/Management
./INFRASTRUCTURE.md:116:- Offene Aufgabe: kube-bot/OpenClaw SSH-Private-Keys sicher in Infisical ablegen, damit sie nach OpenClaw-Updates nicht verloren gehen.
./INFRASTRUCTURE.md:120:### DMZ Backup Staging — dmz-backup
./INFRASTRUCTURE.md:122:- Hostname/Rolle: `dmz-backup`, Hilfs-Backup-Server in der DMZ.
./INFRASTRUCTURE.md:125:  - K3s/DMZ-Cluster pusht Backup-Dateien nach `dmz-backup`.
./INFRASTRUCTURE.md:126:  - Synology/DiskStation pullt von `dmz-backup` und bleibt Backup-Master.
./INFRASTRUCTURE.md:128:- Vorgeschlagener Staging-Root: `/srv/dmz-backup/k3s-dmz/`.
./INFRASTRUCTURE.md:129:- Ordnerstruktur-Entwurf: `/home/node/.openclaw/workspace/inventory/backup-folder-structure-dmz-backup-20260619.md`.
./INFRASTRUCTURE.md:136:- Zielrolle: Backup-Master, der Backups von `dmz-backup` (`192.168.20.90`) pullt.
./INFRASTRUCTURE.md:157:- IT15 Management-Node:
./INFRASTRUCTURE.md:170:### Infisical Recovery-Ablage — kube-bot SSH Keys — 2026-06-15 14:29 UTC
./INFRASTRUCTURE.md:172:- Infisical Instanz: `http://192.168.1.121:8088`.
./INFRASTRUCTURE.md:182:  - `SSH_HOST_DMZ_CONTROL_PLANE`
./INFRASTRUCTURE.md:183:  - `SSH_HOST_DMZ_WORKER`
./INFRASTRUCTURE.md:185:- Recovery-Prinzip: Private Key aus Infisical lesen, nach `/home/node/.ssh/kube-bot-it15-ed25519` schreiben, `chmod 600`, Fingerprint prüfen, SSH-Test ausführen.
./INFRASTRUCTURE.md:186:- Verifiziert: temporär aus Infisical gelesener Key konnte mit `chmod 600` für SSH auf `Misla@192.168.1.121` genutzt werden. Temporäre Datei wurde gelöscht.
./INFRASTRUCTURE.md:189:### Ergänzung Infisical — DMZ SSH Key-Namenssatz — 2026-06-15 14:35 UTC
./INFRASTRUCTURE.md:191:- Ergänzt im bestehenden Infisical-Pfad `platform-kubernetes/prod:/bots/kube-bot/ssh`:
./INFRASTRUCTURE.md:196:  - `SSH_HOST_DMZ_CONTROL_PLANE`
./INFRASTRUCTURE.md:197:  - `SSH_HOST_DMZ_WORKER`
./INFRASTRUCTURE.md:205:- Key: `/home/node/.ssh/kube-bot-it15-ed25519` bzw. Infisical `platform-kubernetes/prod:/bots/kube-bot/ssh/SSH_KEY_DMZ_PRIVATE`.
./INFRASTRUCTURE.md:212:- Ziel: `kube-bot@192.168.20.20` (`raspi`, Nginx Proxy Manager / Reverse Proxy Host).
./INFRASTRUCTURE.md:219:### Ergänzung Infisical — Nginx/Raspi SSH Key-Namenssatz — 2026-06-15 15:16 UTC
./INFRASTRUCTURE.md:221:- Ergänzt im bestehenden Infisical-Pfad `platform-kubernetes/prod:/bots/kube-bot/ssh`:
./INFRASTRUCTURE.md:227:- Ziel: `kube-bot@192.168.20.20` (`raspi`, Nginx Proxy Manager / Reverse Proxy Host).
./INFRASTRUCTURE.md:232:### DMZ Infisical — deployed via IT15 ArgoCD — 2026-06-15 20:56 UTC
./INFRASTRUCTURE.md:234:- Zweck: DMZ-lokaler Secret Store für K3s Workloads, ohne Firewall-Öffnung zur IT15-Infisical-Instanz.
./INFRASTRUCTURE.md:238:- Helm Chart: Infisical `infisical-standalone` `1.9.0`, Image `infisical/infisical:v0.158.0`.
./INFRASTRUCTURE.md:240:- Storage: Longhorn PVCs für PostgreSQL 8Gi und Redis 2Gi.
./wsl-real-restore-infisical.ps1:35:# normalize common Infisical mappings to 8088:8080
./HEARTBEAT.md:5:# Add tasks below when you want the agent to check something periodically.
./configure-portproxy-now.ps1:12:if (-not (Get-NetFirewallRule -DisplayName 'Infisical IT15 TCP 8088' -ErrorAction SilentlyContinue)) {
./configure-portproxy-now.ps1:13:  New-NetFirewallRule -DisplayName 'Infisical IT15 TCP 8088' -Direction Inbound -Action Allow -Protocol TCP -LocalPort 8088 -Profile Any | Out-Null
./wsl-fix-restore-test-script.ps1:7:BDIR=${1:?usage: restore-test-infisical.sh /path/to/backup-dir}
./post-reboot2-check-it15.ps1:18:Write-Output '== WSL/Docker/Infisical details =='
./win-docker-smoketest.ps1:12:docker ps -a --format 'table {{.Names}}\t{{.Status}}\t{{.Image}}'
./SOUL.md:12:Ich antworte knapp, operativ und nachvollziehbar. Wenn ein Risiko oder eine Unsicherheit besteht, stoppe ich und frage nach.
./wsl-init-docker.ps1:3:wsl -d Ubuntu -u root -- bash -lc "set -eux; id; grep PRETTY_NAME /etc/os-release; apt-get update; DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates curl gnupg lsb-release; install -m 0755 -d /etc/apt/keyrings; curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc; chmod a+r /etc/apt/keyrings/docker.asc; . /etc/os-release; echo \"deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $VERSION_CODENAME stable\" > /etc/apt/sources.list.d/docker.list; apt-get update; DEBIAN_FRONTEND=noninteractive apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin; docker --version; docker compose version"
./wsl-init-docker.ps1:10:wsl -d Ubuntu -u root -- bash -lc "set -eux; systemctl is-system-running || true; systemctl enable --now docker; systemctl status docker --no-pager -l; docker info --format 'ServerVersion={{.ServerVersion}};OSType={{.OSType}};OperatingSystem={{.OperatingSystem}}'; docker compose version"
./INFISICAL_ARGO_K3S_KONZEPT.md:1:# Konzeptnotiz — Argo CD + K3s + Infisical
./INFISICAL_ARGO_K3S_KONZEPT.md:8:Argo CD steuert Deployments deklarativ aus Git. Infisical verwaltet Secrets zentral. K3s führt Workloads aus.
./INFISICAL_ARGO_K3S_KONZEPT.md:14:- eigenes Infisical-Projekt oder streng getrennte Infisical-Struktur pro Mandant
./INFISICAL_ARGO_K3S_KONZEPT.md:20:Empfohlene Regel: ein Mandant = ein Argo-CD-AppProject + ein Namespace-Set + ein Infisical-Projekt + eigene Sync-Identity.
./INFISICAL_ARGO_K3S_KONZEPT.md:24:Bestimmte Dienste wie Infisical, Argo CD, Ingress, Monitoring, Logging, Backup, Zertifikatsmanagement oder ggf. Registry/Storage werden mandantenübergreifend bereitgestellt.
./INFISICAL_ARGO_K3S_KONZEPT.md:39:- platform-cert-manager
./INFISICAL_ARGO_K3S_KONZEPT.md:43:- platform-storage
./INFISICAL_ARGO_K3S_KONZEPT.md:48:- tenant-cattaro-stage
./INFISICAL_ARGO_K3S_KONZEPT.md:50:- tenant-kunde-a-stage
./INFISICAL_ARGO_K3S_KONZEPT.md:69:## Infisical Struktur
./INFISICAL_ARGO_K3S_KONZEPT.md:71:### Infisical als Plattformdienst
./INFISICAL_ARGO_K3S_KONZEPT.md:78:### Infisical Projekte
./INFISICAL_ARGO_K3S_KONZEPT.md:87:- stage
./INFISICAL_ARGO_K3S_KONZEPT.md:101:- pro Mandant eigene Infisical Machine Identity
./INFISICAL_ARGO_K3S_KONZEPT.md:103:- pro Workload eigene ExternalSecret/InfisicalSecret Definition
./INFISICAL_ARGO_K3S_KONZEPT.md:105:- Rotation über Infisical, Reconcile über Operator
./INFISICAL_ARGO_K3S_KONZEPT.md:112:- Infisical Betrieb
./INFISICAL_ARGO_K3S_KONZEPT.md:120:- Zugriff auf eigene Infisical-Projekte
./INFISICAL_ARGO_K3S_KONZEPT.md:134:- environment: dev|stage|prod
./INFISICAL_ARGO_K3S_KONZEPT.md:135:- managed-by: argocd
./INFISICAL_ARGO_K3S_KONZEPT.md:143:4. Infisical Projekt tenant-cattaro anlegen.
./INFISICAL_ARGO_K3S_KONZEPT.md:146:7. Kit Hub in tenant-cattaro-stage migrieren.
./INFISICAL_ARGO_K3S_KONZEPT.md:162:   - Mandantenübergreifende Infrastruktur wie Argo CD, Infisical, Ingress, cert-manager, Monitoring, Logging, Backup, Storage.
./INFISICAL_ARGO_K3S_KONZEPT.md:176:- Cluster liegt in DMZ; administrative Dienste und Secret-Management brauchen besonders restriktive Exposition.
./INFISICAL_ARGO_K3S_KONZEPT.md:180:- Infisical nicht öffentlich verfügbar machen, außer zwingend notwendig und dann nur mit starker Auth/MFA, IP-/VPN-Beschränkung und WAF/Proxy-Härtung.
./INFISICAL_ARGO_K3S_KONZEPT.md:181:- Argo CD Adminzugriff nicht öffentlich breit exponieren; bevorzugt VPN/ZTNA/Management-Netz.
./INFISICAL_ARGO_K3S_KONZEPT.md:192:- Infisical nur nach Backup/Restore-Konzept und möglichst mit externer/Longhorn-gesicherter Datenbank.
./INFISICAL_ARGO_K3S_KONZEPT.md:199:- Optional Management-/Platform-Node oder separates Management-Netz prüfen, um Secrets/Admin-UIs nicht rein öffentlich in der DMZ zu betreiben.
./INFISICAL_ARGO_K3S_KONZEPT.md:201:## Vorbereitende Aufgaben vor Infisical-Produktivbetrieb
./INFISICAL_ARGO_K3S_KONZEPT.md:203:1. Backup-Ziel für Longhorn/Infisical klären.
./INFISICAL_ARGO_K3S_KONZEPT.md:207:5. DMZ-Exposure für Argo CD, Infisical, Dashboard, Portainer prüfen.
./INFISICAL_ARGO_K3S_KONZEPT.md:210:8. Infisical-Projekte und Machine Identities mandantenscharf modellieren.
./INFISICAL_ARGO_K3S_KONZEPT.md:227:- Infisical
./INFISICAL_ARGO_K3S_KONZEPT.md:233:- ggf. Container Registry, wenn sie private Images und Credentials hält
./INFISICAL_ARGO_K3S_KONZEPT.md:242:## Infisical-Variante
./INFISICAL_ARGO_K3S_KONZEPT.md:246:- Infisical läuft im Intranet.
./INFISICAL_ARGO_K3S_KONZEPT.md:247:- DMZ-Workloads erhalten keine breit berechtigte…252144 tokens truncated…data/json/registry.json:69492:			"Albarradas Sign Language",
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69505:			"Lyons Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69518:			"Latvian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69530:			"Tibetan Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69542:			"Laos Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69554:			"Panamanian Sign Language",
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69567:			"Trinidad and Tobago Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69579:			"Sivia Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69591:			"Seychelles Sign Language",
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69605:			"Mauritian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69624:		"Macrolanguage": "lv"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69637:		"Macrolanguage": "lv"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69643:			"Malawian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69662:		"Macrolanguage": "zh"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69675:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69681:			"Maltese Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69700:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69713:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69726:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69732:			"Mexican Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69751:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69764:		"Macrolanguage": "zh"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69777:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69783:			"Martha's Vineyard Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69795:			"Yucatec Maya Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69814:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69820:			"Mongolian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69839:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69845:			"Madagascar Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69857:			"Monastic Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69869:			"Mozambican Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69888:		"Macrolanguage": "zh"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69894:			"Namibian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69906:			"Nicaraguan Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69918:			"Nigerian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69930:			"Norwegian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69942:			"Nepalese Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69954:			"Maritime Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69966:			"New Zealand Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69978:			"Old Kentish Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:69997:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70010:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70023:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70036:		"Macrolanguage": "ar"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70042:			"Papua New Guinean Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70054:			"Pakistan Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70066:			"Peruvian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70078:			"Providencia Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70090:			"Iranian Sign Language",
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70091:			"Persian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70103:			"Plains Indian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70122:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70128:			"Penang Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70140:			"Puerto Rican Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70152:			"Polish Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70164:			"Philippine Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70176:			"Portuguese Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70188:			"Paraguayan Sign Language",
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70201:			"Bribri Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70213:			"Romanian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70225:			"Brunca Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70237:			"Rennellese Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70250:			"Russian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70262:			"Miriwoong Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70274:			"Rwandan Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70286:			"Saudi Arabian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70299:			"French Belgian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70311:			"South African Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70323:			"Swiss-German Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70335:			"Sierra Leone Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70354:		"Macrolanguage": "ar"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70360:			"Swiss-Italian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70372:			"Singapore Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70384:			"Albanian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70396:			"Sri Lankan Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70408:			"Kufr Qassem Sign Language (KQSL)"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70427:		"Macrolanguage": "ar"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70433:			"Spanish Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70445:			"Swiss-French Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70457:			"Slovakian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70476:		"Macrolanguage": "sw"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70482:			"Swahili (individual language)",
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70490:		"Macrolanguage": "sw"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70496:			"Swedish Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70508:			"Al-Sayyid Bedouin Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70520:			"Solomon Islands Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70539:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70545:			"Tunisian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70557:			"Turkish Sign Language",
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70570:			"Thai Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70582:			"Taiwan Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70594:			"Tebul Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70606:			"Tanzanian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70618:			"Ugandan Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70630:			"Uruguayan Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70642:			"Ukrainian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70654:			"Urubú-Kaapor Sign Language",
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70655:			"Kaapor Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70674:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70687:		"Macrolanguage": "uz"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70700:		"Macrolanguage": "uz"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70707:			"Flemish Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70726:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70739:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70745:			"Moldova Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70757:			"Venezuelan Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70769:			"Valencian Sign Language",
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70782:			"West Bengal Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70801:		"Macrolanguage": "zh"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70807:			"Kenyan Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70819:			"Malaysian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70838:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70844:			"Moroccan Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70856:			"Yiddish Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70869:			"Yolŋu Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70881:			"Yan-nhaŋu Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70893:			"Yugoslavian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70905:			"Myanmar Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70925:		"Macrolanguage": "zh"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70931:			"Zimbabwe Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70943:			"Malay (individual language)"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70950:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70963:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70969:			"Zambian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:70988:		"Macrolanguage": "ms"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:72128:			"Osage"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:72781:			"Not intended for use as a language subtag"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:75460:			"Portuguese Language Orthographic Agreement of 1990 (Acordo Ortográfico da Língua Portuguesa de 1990)"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:75687:			"Black American Sign Language dialect"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:75695:			"Black American Sign Language (BASL) or Black Sign Variation (BSV) is a dialect of American Sign Language (ASL)"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76038:			"Norwegian following Ivar Aasen's orthographical principles, including modern usage."
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76213:			"The Latgalian language orthography codified in 1929"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76224:			"The Latgalian language orthography codified in the language law in 2007"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76384:			"Pahawh Hmong Second Stage Reduced orthography"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76396:			"Pahawh Hmong Third Stage Reduced orthography"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76442:			"Peano’s Interlingua, created in 1903 by Giuseppe Peano as an international auxiliary language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76458:			"Modern Hokkien Vernacular Romanization System, evolved from the New Dictionary in the Amoy by John Van Nest Talmage in 1894"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76523:			"Puter is one of the five traditional written standards or \"idioms\" of the Romansh language."
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76655:			"Surmiran is one of the five traditional written standards or \"idioms\" of the Romansh language."
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76669:			"Sursilvan is one of the five traditional written standards or \"idioms\" of the Romansh language."
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76683:			"Sutsilvan is one of the five traditional written standards or \"idioms\" of the Romansh language."
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76702:			"Taiwanese Hokkien Romanization System for Hokkien languages",
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76858:			"Vallader is one of the five traditional written standards or \"idioms\" of the Romansh language."
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76872:			"The subtag represents the old orthography of the Latvian language used during c. 1600s–1920s."
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:76967:			"Default Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77092:			"Belgian-French Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77102:			"Belgian-Flemish Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77112:			"Swiss German Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77342:			"Brazilian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77352:			"Colombian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77362:			"German Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77372:			"Danish Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77382:			"Spanish Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77392:			"French Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77402:			"British Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77412:			"Greek Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77422:			"Irish Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77432:			"Italian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77442:			"Japanese Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77452:			"Mexican Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77462:			"Nicaraguan Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77472:			"Dutch Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77482:			"Norwegian Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77492:			"Portuguese Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77502:			"Swedish Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77512:			"American Sign Language"
./camofox-browser/node_modules/language-subtag-registry/data/json/registry.json:77522:			"South African Sign Language"


Output:
Chunk ID: 96bb91
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 8
Output:
/usr/bin/openssl
/usr/bin/ssh


Ich habe nur `openssl` und `ssh` als lokale Werkzeuge sicher gefunden, kein `age`, `gpg`, `sops`, `jq` oder `rsync`. Damit ist Verschlüsselung technisch möglich, aber der Empfänger-Key/Passphrase-Pfad muss sauber feststehen, sonst wäre das Backup später nicht belastbar wiederherstellbar.


rg -n "dmz-backup|192\.168\.20\.90|homarr|NEXTAUTH_SECRET|Backup/Restore-Abstimmung|Homarr" SESSION_HANDOFF.md INFRASTRUCTURE.md inventory repos/platform-gitops/tenants/pidoka/prod/homarr repos/platform-gitops/applications/tenants/pidoka/homarr.yaml


Output:
Chunk ID: f8f26f
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 1669
Output:
### DMZ Backup Staging — dmz-backup

- Hostname/Rolle: `dmz-backup`, Hilfs-Backup-Server in der DMZ.
- IP: `192.168.20.90`.
- Zielbild:
  - K3s/DMZ-Cluster pusht Backup-Dateien nach `dmz-backup`.
  - Synology/DiskStation pullt von `dmz-backup` und bleibt Backup-Master.
  - Direkte Schreibrechte aus der DMZ auf Synology werden vermieden.
- Vorgeschlagener Staging-Root: `/srv/dmz-backup/k3s-dmz/`.
- Ordnerstruktur-Entwurf: `/home/node/.openclaw/workspace/inventory/backup-folder-structure-dmz-backup-20260619.md`.
- Änderungen an Backup-Konfigurationen nur nach explizitem OK von Mislav.

### Synology DiskStation

- Rolle: Backup-Ziel / Backup-System.
- kube-bot ist dazu im Austausch mit `diskstation-bot`.
- Zielrolle: Backup-Master, der Backups von `dmz-backup` (`192.168.20.90`) pullt.
- Konkrete Synology Shares, Pull-Jobs, Retention, Snapshots/Immutability und Restore-Tests sind mit `diskstation-bot` abzugleichen.
- Änderungen an Backup-Konfigurationen nur nach explizitem OK von Mislav.

### SSH-Zugangsmerker — kube-bot/OpenClaw Runtime

Stand: 2026-06-15 13:00 UTC. Diese Merker dienen dazu, eingerichtete Diagnosezugänge nicht zu vergessen. Keine Private-Key-Inhalte dokumentieren.

- OpenClaw Runtime läuft nicht direkt auf den Zielsystemen, sondern aktuell als User `node` im Container/Host `0e9d9d0b8619`.
- Lokaler SSH-Key-Pfad in der Runtime: `/home/node/.ssh/kube-bot-it15-ed25519`.
- DMZ K3s Control-Plane:
  - Ziel: `kube-bot@192.168.20.40`
  - Hostnamen: `mbrkanov-Mini-IT13` / `mbrkanov-mini-it13`
  - Status: SSH funktioniert, sudo NOPASSWD funktioniert.
  - Kubernetes read-only Beispiel: `ssh -i ~/.ssh/kube-bot-it15-ed25519 kube-bot@192.168.20.40 'sudo kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml get nodes -o wide'`
  - Hinweis: `sudo KUBECONFIG=... kubectl` funktioniert nicht, weil sudo das Setzen der Env-Variable blockiert. Stattdessen `sudo kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml ...` verwenden.
- DMZ K3s Worker:
  - Ziel: `kube-bot@192.168.20.45`
  - Hostnamen: `Mini-IT13-02` / `mini-it13-02`
  - Status: als bekanntes Ziel dokumentiert; Zugriff bei Bedarf erneut testen.
- IT15 Management-Node:
  - Ziel laut älteren Notizen: `Misla@192.168.1.121`
  - Status am 2026-06-15 12:56 UTC: SSH von aktueller Runtime blockiert (`Permission denied`).
  - Früherer Zugriff war dokumentiert, aber aktueller nutzbarer Key/User muss neu bestätigt oder eingerichtet werden.
- Betriebsregel bleibt: SSH primär read-only Diagnose; Änderungen nur nach explizitem OK von Mislav.

### IT15 SSH-Korrektur — 2026-06-15 14:15 UTC

- Korrektes SSH-Ziel: `Misla@192.168.1.121` mit Key `/home/node/.ssh/kube-bot-it15-ed25519`.
- IT15 ist Windows; K3s/ArgoCD laufen in WSL `Ubuntu`.
- Für Linux/K3s-Kommandos über SSH verwenden: `wsl.exe -d Ubuntu -e bash -lc '<command>'`.
- Beispiel: `ssh -i /home/node/.ssh/kube-bot-it15-ed25519 Misla@192.168.1.121 "wsl.exe -d Ubuntu -e bash -lc 'kubectl get nodes'"`.

### Infisical Recovery-Ablage — kube-bot SSH Keys — 2026-06-15 14:29 UTC

- Infisical Instanz: `http://192.168.1.121:8088`.
- Projekt: `platform-kubernetes` (`c5e8661f-4b7a-43e1-80b0-8674f30950dc`).
- Environment: `prod`.
- Secret-Pfad: `/bots/kube-bot/ssh`.
- Abgelegte Secret-Namen:
  - `SSH_KEY_IT15_PRIVATE`
  - `SSH_KEY_IT15_PUBLIC`
  - `SSH_KEY_IT15_FINGERPRINT`
  - `SSH_HOST_IT15`
  - `SSH_KEY_IT15_LOCAL_PATH`
  - `SSH_HOST_DMZ_CONTROL_PLANE`
  - `SSH_HOST_DMZ_WORKER`
- Key-Fingerprint: `SHA256:v1vAeRvbpSAkVQe2kTdjZjwNexaFJ59XWt8+QlOXgmE`.
- Recovery-Prinzip: Private Key aus Infisical lesen, nach `/home/node/.ssh/kube-bot-it15-ed25519` schreiben, `chmod 600`, Fingerprint prüfen, SSH-Test ausführen.
- Verifiziert: temporär aus Infisical gelesener Key konnte mit `chmod 600` für SSH auf `Misla@192.168.1.121` genutzt werden. Temporäre Datei wurde gelöscht.
- Keine Secretwerte/Private-Key-Inhalte in Markdown, Slack oder Logs ausgeben.

### Ergänzung Infisical — DMZ SSH Key-Namenssatz — 2026-06-15 14:35 UTC

- Ergänzt im bestehenden Infisical-Pfad `platform-kubernetes/prod:/bots/kube-bot/ssh`:
  - `SSH_KEY_DMZ_PRIVATE`
  - `SSH_KEY_DMZ_PUBLIC`
  - `SSH_KEY_DMZ_FINGERPRINT`
  - `SSH_KEY_DMZ_LOCAL_PATH`
  - `SSH_HOST_DMZ_CONTROL_PLANE`
  - `SSH_HOST_DMZ_WORKER`
- Aktuell ist das DMZ-Keymaterial identisch mit dem lokal vorhandenen OpenClaw/kube-bot Key `/home/node/.ssh/kube-bot-it15-ed25519`; es wird bewusst zusätzlich unter DMZ-spezifischen Namen geführt.
- Verifiziert: Readback von `SSH_KEY_DMZ_PRIVATE` in temporäre Datei, `chmod 600`, Fingerprint geprüft, SSH-Probe auf `kube-bot@192.168.20.40` erfolgreich. Temporäre Datei gelöscht.
- Fingerprint: `SHA256:v1vAeRvbpSAkVQe2kTdjZjwNexaFJ59XWt8+QlOXgmE`.

### SSH Verifikation — DMZ Worker `192.168.20.45` — 2026-06-15 15:03 UTC

- Ziel: `kube-bot@192.168.20.45` (`mini-it13-02`).
- Key: `/home/node/.ssh/kube-bot-it15-ed25519` bzw. Infisical `platform-kubernetes/prod:/bots/kube-bot/ssh/SSH_KEY_DMZ_PRIVATE`.
- Status: SSH funktioniert, sudo NOPASSWD funktioniert.
- Read-only Probe: `hostname`, `whoami`, `sudo -n true`, `uname -a`, `df -h /` erfolgreich.
- Keine Änderungen durch kube-bot ausgeführt.

### SSH Verifikation — Nginx Proxy Host `192.168.20.20` — 2026-06-15 15:14 UTC

- Ziel: `kube-bot@192.168.20.20` (`raspi`, Nginx Proxy Manager / Reverse Proxy Host).
- Key: `/home/node/.ssh/kube-bot-it15-ed25519`; passender Public-Key-Kommentar `kube-bot@openclaw-it15-20260614`.
- Status: SSH funktioniert, sudo NOPASSWD funktioniert.
- Host: Raspberry Pi / Debian Bookworm, Kernel `6.12.62+rpt-rpi-v8`, aarch64.
- Authorized Keys bereinigt: alter Eintrag `kube-bot@openclaw-k3s-diagnostics` entfernt; aktueller Key bleibt erhalten.
- Vor Änderung wurde eine Backup-Datei von `/home/kube-bot/.ssh/authorized_keys` auf dem Zielhost angelegt.

### Ergänzung Infisical — Nginx/Raspi SSH Key-Namenssatz — 2026-06-15 15:16 UTC

- Ergänzt im bestehenden Infisical-Pfad `platform-kubernetes/prod:/bots/kube-bot/ssh`:
  - `SSH_KEY_NGINX_PRIVATE`
  - `SSH_KEY_NGINX_PUBLIC`
  - `SSH_KEY_NGINX_FINGERPRINT`
  - `SSH_KEY_NGINX_LOCAL_PATH`
  - `SSH_HOST_NGINX_PROXY`
- Ziel: `kube-bot@192.168.20.20` (`raspi`, Nginx Proxy Manager / Reverse Proxy Host).
- Aktuell ist das Nginx/Raspi-Keymaterial identisch mit dem lokal vorhandenen OpenClaw/kube-bot Key `/home/node/.ssh/kube-bot-it15-ed25519`; es wird bewusst zusätzlich unter Nginx-spezifischen Namen geführt.
- Verifiziert: Readback von `SSH_KEY_NGINX_PRIVATE` in temporäre Datei, `chmod 600`, Fingerprint geprüft, SSH-Probe auf `kube-bot@192.168.20.20` erfolgreich. Temporäre Datei gelöscht.
- Fingerprint: `SHA256:v1vAeRvbpSAkVQe2kTdjZjwNexaFJ59XWt8+QlOXgmE`.


Output:
Chunk ID: 60866f
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 84
Output:
total 24
drwx------ 2 node node 4096 Jun 15 15:30 .
drwxr-xr-x 1 node node 4096 Jun 16 19:49 ..
-rw------- 1 node node 4007 Jun 16 17:02 known_hosts
-rw------- 1 node node 3029 Jun 15 15:13 known_hosts.old
-rw------- 1 node node  432 Jun 14 11:07 kube-bot-it15-ed25519
-rw-r--r-- 1 node node  113 Jun 14 11:07 kube-bot-it15-ed25519.pub


Output:
Chunk ID: 8ab57d
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 8930
Output:
repos/platform-gitops/applications/tenants/pidoka/homarr.yaml:4:  name: pidoka-hf-homarr
repos/platform-gitops/applications/tenants/pidoka/homarr.yaml:11:    path: tenants/pidoka/prod/homarr
repos/platform-gitops/applications/tenants/pidoka/homarr.yaml:14:    namespace: homarr
INFRASTRUCTURE.md:120:### DMZ Backup Staging — dmz-backup
INFRASTRUCTURE.md:122:- Hostname/Rolle: `dmz-backup`, Hilfs-Backup-Server in der DMZ.
INFRASTRUCTURE.md:123:- IP: `192.168.20.90`.
INFRASTRUCTURE.md:125:  - K3s/DMZ-Cluster pusht Backup-Dateien nach `dmz-backup`.
INFRASTRUCTURE.md:126:  - Synology/DiskStation pullt von `dmz-backup` und bleibt Backup-Master.
INFRASTRUCTURE.md:128:- Vorgeschlagener Staging-Root: `/srv/dmz-backup/k3s-dmz/`.
INFRASTRUCTURE.md:129:- Ordnerstruktur-Entwurf: `/home/node/.openclaw/workspace/inventory/backup-folder-structure-dmz-backup-20260619.md`.
INFRASTRUCTURE.md:136:- Zielrolle: Backup-Master, der Backups von `dmz-backup` (`192.168.20.90`) pullt.
SESSION_HANDOFF.md:5:## Backup/Restore-Abstimmung — dmz-backup (2026-06-20)
SESSION_HANDOFF.md:7:- Neue Zielstrecke mit diskstation-bot/Mislav abgestimmt: K3s/DMZ pusht nach `dmz-backup` (`192.168.20.90`), Synology pullt von dort und bleibt Langzeit-Backup-Master.
SESSION_HANDOFF.md:10:- `dmz-backup` darf keine dauerhaften Passphrases oder Private Keys halten; Metadaten enthalten nur Verschlüsselungsstatus, Key-/Secret-Referenz und Fingerprint ohne Werte.
SESSION_HANDOFF.md:1839:  - `homarr`
SESSION_HANDOFF.md:1847:  1. Homarr Secret spaeter nach Infisical/ESO ueberfuehren.
SESSION_HANDOFF.md:1850:## Homarr Einordnung — 2026-06-19 13:00 UTC
SESSION_HANDOFF.md:1852:- Mislav bestaetigt: Homarr ist Dashboard fuer PIDOKA/HF Anwendungen.
SESSION_HANDOFF.md:1854:  - Homarr ist produktiver Service und kein Cleanup-Kandidat.
SESSION_HANDOFF.md:1855:  - Homarr ist erster sinnvoller GitOps-Adoption-Kandidat unter den noch nicht ArgoCD-managed Dashboard/Admin-Tools.
SESSION_HANDOFF.md:1857:  - Namespace `homarr`, Deployment `my-homarr`, Pod `1/1 Running`, Restarts `0`.
SESSION_HANDOFF.md:1858:  - Service `my-homarr` NodePort `30718`; passt zum dokumentierten NPM-Proxy `dashboard.heckenfels.com`.
SESSION_HANDOFF.md:1859:  - Image gepinnt auf `ghcr.io/ajnart/homarr:0.14.2@sha256:3f2389f69db8b497c32c843d44f26afefb4e47b8e7954d0c43c372713d617ed7`.
SESSION_HANDOFF.md:1861:    - `/app/data/configs` -> `my-homarr-config` Longhorn; enthaelt `default.json`, `Heckenfels.json`.
SESSION_HANDOFF.md:1862:    - `/app/public/icons` -> `my-homarr-icons` Longhorn.
SESSION_HANDOFF.md:1863:    - `/data` -> `my-homarr-data` local-path; enthaelt `db.sqlite`.
SESSION_HANDOFF.md:1864:  - Weitere PVCs `my-homarr-data-new` und `my-homarr-data-mb` wirken wie alte Migrationsreste.
SESSION_HANDOFF.md:1866:  - Homarr GitOps-Adoption vorbereiten: bestehende Deployment/Service/PVC/Secret-Referenzen in Repo modellieren, ohne Secretwert offenzulegen; danach mit OK apply/adopt.
SESSION_HANDOFF.md:1868:## Homarr Rename-Wunsch — 2026-06-19 13:05 UTC
SESSION_HANDOFF.md:1870:- Mislav fragt, ob `my-homarr` direkt in `hf-homarr` umbenannt werden kann.
SESSION_HANDOFF.md:1874:    - `my-homarr-config`
SESSION_HANDOFF.md:1875:    - `my-homarr-icons`
SESSION_HANDOFF.md:1876:    - `my-homarr-data`
SESSION_HANDOFF.md:1877:  - Service-Name `hf-homarr` mit gleichem NodePort `30718` braucht kurzen kontrollierten Cutover, weil `my-homarr` den NodePort aktuell belegt.
SESSION_HANDOFF.md:1879:  - Neue ArgoCD App `pidoka-hf-homarr`.
SESSION_HANDOFF.md:1880:  - Neues Deployment `hf-homarr`.
SESSION_HANDOFF.md:1882:  - Secret zunaechst referenzieren oder spaeter via Infisical/ESO sauber nach `hf-homarr-secret` ueberfuehren.
SESSION_HANDOFF.md:1883:  - Service entweder kontrolliert auf `hf-homarr` cutovern oder `my-homarr` vorerst als Kompatibilitaetsanker behalten.
SESSION_HANDOFF.md:1885:## Homarr GitOps-Adoption abgeschlossen — 2026-06-19 12:50 UTC
SESSION_HANDOFF.md:1890:  - Commit: `59281b7 Adopt Homarr into Pidoka GitOps`
SESSION_HANDOFF.md:1891:  - Neue ArgoCD Application: `pidoka-hf-homarr`
SESSION_HANDOFF.md:1892:  - Neuer GitOps-Pfad: `tenants/pidoka/prod/homarr`
SESSION_HANDOFF.md:1893:  - AppProject `tenant-pidoka` um Namespace `homarr` erweitert.
SESSION_HANDOFF.md:1895:  - Deployment/Service Name: `my-homarr`
SESSION_HANDOFF.md:1898:    - `my-homarr-config`
SESSION_HANDOFF.md:1899:    - `my-homarr-icons`
SESSION_HANDOFF.md:1900:    - `my-homarr-data`
SESSION_HANDOFF.md:1901:  - Bestehendes Secret `my-homarr-homarr-secrets` wird referenziert, aber nicht mit Secretwert ins Repo uebernommen.
SESSION_HANDOFF.md:1904:  - `pidoka-hf-homarr`: `Synced / Healthy`, Revision `59281b7`.
SESSION_HANDOFF.md:1906:    - `Deployment/my-homarr`
SESSION_HANDOFF.md:1907:    - `Service/my-homarr`
SESSION_HANDOFF.md:1908:    - `PersistentVolumeClaim/my-homarr-config`
SESSION_HANDOFF.md:1909:    - `PersistentVolumeClaim/my-homarr-icons`
SESSION_HANDOFF.md:1910:    - `PersistentVolumeClaim/my-homarr-data`
SESSION_HANDOFF.md:1912:  - Pod `my-homarr-698bc75847-nsfph`: `1/1 Running`, Restarts `0`.
SESSION_HANDOFF.md:1915:  - Homarr Secret spaeter nach Infisical/ESO ueberfuehren.
SESSION_HANDOFF.md:1916:  - Alte Homarr PVCs `my-homarr-data-new`, `my-homarr-data-mb` und alte Migration-Jobs nur nach Daten-/Backup-Check und separatem OK bereinigen.
SESSION_HANDOFF.md:1918:## Homarr Secret/PVC Cleanup — 2026-06-19 13:05 UTC
SESSION_HANDOFF.md:1920:- Frage von Mislav: Wofuer wird `my-homarr-homarr-secrets` benoetigt?
SESSION_HANDOFF.md:1922:  - Es enthaelt `NEXTAUTH_SECRET`.
SESSION_HANDOFF.md:1923:  - Homarr nutzt diesen Wert fuer NextAuth-/Session-Signatur.
SESSION_HANDOFF.md:1927:  - `my-homarr-data-new` Longhorn 100Gi.
SESSION_HANDOFF.md:1928:  - `my-homarr-data-mb` Longhorn 10Gi.
SESSION_HANDOFF.md:1929:  - Beide waren nicht von Homarr gemountet.
SESSION_HANDOFF.md:1933:  - PVCs `my-homarr-data-new` und `my-homarr-data-mb` geloescht.
SESSION_HANDOFF.md:1936:  - Homarr aktive PVCs bleiben:
SESSION_HANDOFF.md:1937:    - `my-homarr-data`
SESSION_HANDOFF.md:1938:    - `my-homarr-icons`
SESSION_HANDOFF.md:1939:    - `my-homarr-config`
SESSION_HANDOFF.md:1940:  - Pod `my-homarr-698bc75847-nsfph`: `1/1 Running`, Restarts `0`.
SESSION_HANDOFF.md:1941:  - `pidoka-hf-homarr`: `Synced / Healthy`.
SESSION_HANDOFF.md:1944:  - Alte Homarr Migration-Jobs `volume-migration*` geloescht.
SESSION_HANDOFF.md:1945:  - Altes Helm Release Secret `sh.helm.release.v1.my-homarr.v1` geloescht.
SESSION_HANDOFF.md:1946:  - Aktives Kubernetes Secret `my-homarr-homarr-secrets` bleibt bestehen, weil Homarr daraus `NEXTAUTH_SECRET` nutzt.
SESSION_HANDOFF.md:1948:  - `secret/my-homarr-homarr-secrets` bleibt vorhanden.
SESSION_HANDOFF.md:1949:  - Aktive PVCs `my-homarr-data`, `my-homarr-icons`, `my-homarr-config` bleiben vorhanden.
SESSION_HANDOFF.md:1951:  - `pidoka-hf-homarr`: `Synced / Healthy`.
SESSION_HANDOFF.md:1954:  - Homarr Secret spaeter nach Infisical/ESO ueberfuehren.
SESSION_HANDOFF.md:1974:  - Dashy ist als altes Dashboard entfernt; Homarr bleibt das produktive PIDOKA/HF Dashboard und ist ArgoCD-managed.
SESSION_HANDOFF.md:1997:## Backup-Konzept Ergaenzung — dmz-backup — 2026-06-19 19:26 UTC
SESSION_HANDOFF.md:2000:  - Hilfs-Backup-Server in der DMZ: `dmz-backup`
SESSION_HANDOFF.md:2001:  - IP: `192.168.20.90`
SESSION_HANDOFF.md:2002:  - K3s/DMZ-Cluster pusht Backup-Dateien nach `dmz-backup`.
SESSION_HANDOFF.md:2003:  - Synology/DiskStation pullt von `dmz-backup` und bleibt Backup-Master.
SESSION_HANDOFF.md:2006:  - `dmz-backup` ist Staging/Puffer, nicht alleinige Langzeit-Backup-Quelle.
SESSION_HANDOFF.md:2012:  - `/home/node/.openclaw/workspace/inventory/backup-folder-structure-dmz-backup-20260619.md`
SESSION_HANDOFF.md:2017:  - Staging-Root auf `dmz-backup`: `/srv/dmz-backup/k3s-dmz/`.
SESSION_HANDOFF.md:2117:  - `dashboard.heckenfels.com` -> Homarr, HTTP `307`
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:4:  name: my-homarr-config
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:5:  namespace: homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:20:  name: my-homarr-icons
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:21:  namespace: homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:36:  name: my-homarr-data
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:37:  namespace: homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:40:    meta.helm.sh/release-name: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:41:    meta.helm.sh/release-namespace: homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:43:    app: homarr-8.0.4
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:44:    app.kubernetes.io/instance: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:46:    app.kubernetes.io/name: homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:49:    helm.sh/chart: homarr-8.0.4
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:50:    release: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:63:  name: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:64:  namespace: homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:66:    app: homarr-8.0.4
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:67:    app.kubernetes.io/instance: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:69:    app.kubernetes.io/name: homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:72:    helm.sh/chart: homarr-8.0.4
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:73:    release: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:76:    meta.helm.sh/release-name: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:77:    meta.helm.sh/release-namespace: homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:83:      app.kubernetes.io/instance: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:84:      app.kubernetes.io/name: homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:93:        app: homarr-8.0.4
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:94:        app.kubernetes.io/instance: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:96:        app.kubernetes.io/name: homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:99:        helm.sh/chart: homarr-8.0.4
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:101:        release: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:121:        - name: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:122:          image: ghcr.io/ajnart/homarr:0.14.2@sha256:3f2389f69db8b497c32c843d44f26afefb4e47b8e7954d0c43c372713d617ed7
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:133:            - name: NEXTAUTH_SECRET
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:136:                  name: my-homarr-homarr-secrets
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:137:                  key: NEXTAUTH_SECRET
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:207:            claimName: my-homarr-config
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:210:            claimName: my-homarr-data
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:217:            claimName: my-homarr-icons
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:236:  name: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:237:  namespace: homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:239:    app: homarr-8.0.4
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:240:    app.kubernetes.io/instance: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:242:    app.kubernetes.io/name: homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:245:    helm.sh/chart: homarr-8.0.4
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:246:    release: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:250:    meta.helm.sh/release-name: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:251:    meta.helm.sh/release-namespace: homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:263:    app.kubernetes.io/instance: my-homarr
repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml:264:    app.kubernetes.io/name: homarr
inventory/nginx-proxy-abgleich-20260619.md:25:| 5 | `dashboard.heckenfels.com` | `http://192.168.20.40:30718` | OK, Homarr, HTTP `307` nach `/board` |
inventory/longhorn-health-report.md:34:| `homarr` | `my-homarr-config` | 10Gi | attached | degraded | `mbrkanov-mini-it13` | 2 | 1 |
inventory/longhorn-health-report.md:35:| `homarr` | `my-homarr-data-mb` | 10Gi | attached | degraded | `mbrkanov-mini-it13` | 2 | 1 |
inventory/longhorn-health-report.md:36:| `homarr` | `my-homarr-data-new` | 100Gi | detached | unknown | `` | 0 | 2 |
inventory/longhorn-health-report.md:37:| `homarr` | `my-homarr-icons` | 10Gi | attached | degraded | `mbrkanov-mini-it13` | 2 | 1 |
inventory/argocd-mandanten-migrationsmatrix-20260615.md:54:| `homarr` | Homarr | `dashboard.heckenfels.com` zeigt laut NPM auf NodePort `30718` | Vermutlich Pidoka/Heckenfels oder Shared Dashboard; fachlich klären. |
inventory/argocd-mandanten-migrationsmatrix-20260615.md:78:| `dashboard.heckenfels.com` | `http://192.168.20.40:30718` | ja | ja | Homarr NodePort. |
inventory/migration-20260615/raw-inventory.txt:22:homarr                 Active   2y167d
inventory/migration-20260615/raw-inventory.txt:58:homarr                 deployment.apps/my-homarr                          1/1     1            1           2y167d   my-homarr                   ghcr.io/ajnart/homarr:0.14.2@sha256:3f2389f69db8b497c32c843d44f26afefb4e47b8e7954d0c43c372713d617ed7   app.kubernetes.io/instance=my-homarr,app.kubernetes.io/name=homarr,pod.name=main
inventory/migration-20260615/raw-inventory.txt:110:homarr                 service/my-homarr                           NodePort       10.43.177.71    <none>                        10245:30718/TCP                                2y167d   app.kubernetes.io/instance=my-homarr,app.kubernetes.io/name=homarr,pod.name=main
inventory/migration-20260615/raw-inventory.txt:166:homarr        persistentvolumeclaim/my-homarr-data                        Bound    pvc-7be0df84-5f5e-4d9e-9595-b844f177ec54   100Gi      RWO            local-path     2y167d   Filesystem
inventory/migration-20260615/raw-inventory.txt:171:homarr        persistentvolumeclaim/my-homarr-icons                       Bound    pvc-7eaba3dd-5617-46bc-b424-b9343b5037a5   10Gi       RWO            longhorn       2y61d    Filesystem
inventory/migration-20260615/raw-inventory.txt:172:homarr        persistentvolumeclaim/my-homarr-data-mb                     Bound    pvc-c346cdc4-9483-47f4-b90b-ba674c5811d4   10Gi       RWO            longhorn       2y61d    Filesystem
inventory/migration-20260615/raw-inventory.txt:173:homarr        persistentvolumeclaim/my-homarr-data-new                    Bound    pvc-0fb2fdde-4cdc-412c-81c7-768682451e15   100Gi      RWO            longhorn       2y61d    Filesystem
inventory/migration-20260615/raw-inventory.txt:174:homarr        persistentvolumeclaim/my-homarr-config                      Bound    pvc-465c3082-ffe0-4b14-bc80-83fca45ed661   10Gi       RWO            longhorn       2y61d    Filesystem
inventory/priorities-evidence.txt:62:homarr                 my-homarr-698bc75847-nsfph                          1/1     Running            0                   36d      10.42.0.63      mbrkanov-mini-it13   <none>           <none>
inventory/backup-folder-structure-dmz-backup-20260619.md:1:# Backup-Ordnerstruktur — dmz-backup + Synology Pull
inventory/backup-folder-structure-dmz-backup-20260619.md:7:- `dmz-backup` (`192.168.20.90`) ist der DMZ-Staging-Host.
inventory/backup-folder-structure-dmz-backup-20260619.md:8:- K3s/DMZ-Cluster darf Backups nach `dmz-backup` pushen.
inventory/backup-folder-structure-dmz-backup-20260619.md:9:- Synology/DiskStation pullt von `dmz-backup` und bleibt Backup-Master.
inventory/backup-folder-structure-dmz-backup-20260619.md:16:Nicht nur nach Kubernetes-Namespace sortieren, weil aktuelle Namespaces historisch gewachsen sind (`hf-*`, `pidoka-hf-*`, `homarr`, `zammad`). Besser ist:
inventory/backup-folder-structure-dmz-backup-20260619.md:25:Auf `dmz-backup`:
inventory/backup-folder-structure-dmz-backup-20260619.md:28:/srv/dmz-backup/k3s-dmz/
inventory/backup-folder-structure-dmz-backup-20260619.md:115:        homarr/
inventory/backup-folder-structure-dmz-backup-20260619.md:179:  "backup_staging_host": "dmz-backup",
inventory/backup-folder-structure-dmz-backup-20260619.md:180:  "backup_staging_ip": "192.168.20.90",
inventory/backup-folder-structure-dmz-backup-20260619.md:207:- Cluster bekommt nur Schreibrechte auf definierte Zielpfade auf `dmz-backup`.
inventory/backup-folder-structure-dmz-backup-20260619.md:208:- Synology bekommt Pull-Rechte von `dmz-backup`, idealerweise read-only.
inventory/backup-folder-structure-dmz-backup-20260619.md:228:  - `homarr` -> `tenants/pidoka/prod/homarr/`
inventory/backup-folder-structure-dmz-backup-20260619.md:239:4. Quota fuer `dmz-backup` und Synology-Ziel definieren.
inventory/backup-folder-structure-dmz-backup-20260619.md:241:6. Ersten Restore-Testpfad definieren: Synology -> `dmz-backup` -> isolierter Restore im Cluster.
inventory/longhorn-volumes.json:111:                    "namespace": "homarr",
inventory/longhorn-volumes.json:114:                    "pvcName": "my-homarr-data-new",
inventory/longhorn-volumes.json:246:                    "namespace": "homarr",
inventory/longhorn-volumes.json:249:                    "pvcName": "my-homarr-data-mb",
inventory/longhorn-volumes.json:516:                    "namespace": "homarr",
inventory/longhorn-volumes.json:519:                    "pvcName": "my-homarr-icons",
inventory/longhorn-volumes.json:522:                            "podName": "my-homarr-698bc75847-nsfph",
inventory/longhorn-volumes.json:524:                            "workloadName": "my-homarr-698bc75847",
inventory/longhorn-volumes.json:1326:                    "namespace": "homarr",
inventory/longhorn-volumes.json:1329:                    "pvcName": "my-homarr-config",
inventory/longhorn-volumes.json:1332:                            "podName": "my-homarr-698bc75847-nsfph",
inventory/longhorn-volumes.json:1334:                            "workloadName": "my-homarr-698bc75847",
inventory/longhorn-health-raw.txt:170:homarr        my-homarr-data                        Bound    pvc-7be0df84-5f5e-4d9e-9595-b844f177ec54   100Gi      RWO            local-path     2y161d   Filesystem
inventory/longhorn-health-raw.txt:175:homarr        my-homarr-icons                       Bound    pvc-7eaba3dd-5617-46bc-b424-b9343b5037a5   10Gi       RWO            longhorn       2y55d    Filesystem
inventory/longhorn-health-raw.txt:176:homarr        my-homarr-data-mb                     Bound    pvc-c346cdc4-9483-47f4-b90b-ba674c5811d4   10Gi       RWO            longhorn       2y55d    Filesystem
inventory/longhorn-health-raw.txt:177:homarr        my-homarr-data-new                    Bound    pvc-0fb2fdde-4cdc-412c-81c7-768682451e15   100Gi      RWO            longhorn       2y54d    Filesystem
inventory/longhorn-health-raw.txt:178:homarr        my-homarr-config                      Bound    pvc-465c3082-ffe0-4b14-bc80-83fca45ed661   10Gi       RWO            longhorn       2y54d    Filesystem
inventory/k8s-inventory-raw.txt:15:homarr                 Active   2y161d
inventory/k8s-inventory-raw.txt:36:pvc-7be0df84-5f5e-4d9e-9595-b844f177ec54   100Gi      RWO            Delete           Bound    homarr/my-homarr-data                           local-path              2y161d   Filesystem
inventory/k8s-inventory-raw.txt:41:pvc-0fb2fdde-4cdc-412c-81c7-768682451e15   100Gi      RWO            Delete           Bound    homarr/my-homarr-data-new                       longhorn                2y54d    Filesystem
inventory/k8s-inventory-raw.txt:44:pvc-c346cdc4-9483-47f4-b90b-ba674c5811d4   10Gi       RWO            Delete           Bound    homarr/my-homarr-data-mb                        longhorn                2y55d    Filesystem
inventory/k8s-inventory-raw.txt:45:pvc-465c3082-ffe0-4b14-bc80-83fca45ed661   10Gi       RWO            Delete           Bound    homarr/my-homarr-config                         longhorn                2y54d    Filesystem
inventory/k8s-inventory-raw.txt:46:pvc-7eaba3dd-5617-46bc-b424-b9343b5037a5   10Gi       RWO            Delete           Bound    homarr/my-homarr-icons                          longhorn                2y55d    Filesystem
inventory/k8s-inventory-raw.txt:60:homarr        my-homarr-data                        Bound    pvc-7be0df84-5f5e-4d9e-9595-b844f177ec54   100Gi      RWO            local-path     2y161d   Filesystem
inventory/k8s-inventory-raw.txt:65:homarr        my-homarr-icons                       Bound    pvc-7eaba3dd-5617-46bc-b424-b9343b5037a5   10Gi       RWO            longhorn       2y55d    Filesystem
inventory/k8s-inventory-raw.txt:66:homarr        my-homarr-data-mb                     Bound    pvc-c346cdc4-9483-47f4-b90b-ba674c5811d4   10Gi       RWO            longhorn       2y55d    Filesystem
inventory/k8s-inventory-raw.txt:67:homarr        my-homarr-data-new                    Bound    pvc-0fb2fdde-4cdc-412c-81c7-768682451e15   100Gi      RWO            longhorn       2y54d    Filesystem
inventory/k8s-inventory-raw.txt:68:homarr        my-homarr-config                      Bound    pvc-465c3082-ffe0-4b14-bc80-83fca45ed661   10Gi       RWO            longhorn       2y54d    Filesystem
inventory/k8s-inventory-raw.txt:94:homarr                 my-homarr                           NodePort       10.43.177.71    <none>                        10245:30718/TCP                                2y161d   app.kubernetes.io/instance=my-homarr,app.kubernetes.io/name=homarr,pod.name=main
inventory/k8s-inventory-raw.txt:169:homarr                 deployment.apps/my-homarr                          1/1     1            1           2y161d   my-homarr                   ghcr.io/ajnart/homarr:0.14.2@sha256:3f2389f69db8b497c32c843d44f26afefb4e47b8e7954d0c43c372713d617ed7   app.kubernetes.io/instance=my-homarr,app.kubernetes.io/name=homarr,pod.name=main
inventory/k8s-inventory-raw.txt:210:homarr        job.batch/volume-migration                              1/1           49m        2y55d    volume-migration        ubuntu:xenial                               batch.kubernetes.io/controller-uid=f4475c2c-3cb3-4fce-ac7f-b005160451a0
inventory/k8s-inventory-raw.txt:211:homarr        job.batch/volume-migration-new                          1/1           2m44s      2y54d    volume-migration-new    ubuntu:xenial                               batch.kubernetes.io/controller-uid=cbead44c-c03e-44c6-9c6e-b076cbff8f56
inventory/k8s-inventory-raw.txt:212:homarr        job.batch/volume-migration-new2                         1/1           27s        2y54d    volume-migration-new2   ubuntu:xenial                               batch.kubernetes.io/controller-uid=49e47120-dd00-4ab0-aec3-3ad0e5fd85ea
inventory/k8s-inventory-raw.txt:213:homarr        job.batch/volume-migration-new3                         1/1           38s        2y54d    volume-migration-new3   ubuntu:xenial                               batch.kubernetes.io/controller-uid=0785506d-c2dc-4121-a9ac-08ee0c47628d
inventory/k8s-inventory-raw.txt:214:homarr        job.batch/volume-migration-new4                         1/1           2m52s      2y54d    volume-migration-new4   ubuntu:xenial                               batch.kubernetes.io/controller-uid=e2b0580d-b62b-42ee-b2ef-8b0ffc1d9877
inventory/k8s-inventory-raw.txt:274:homarr                 my-homarr-698bc75847-nsfph                          1/1     Running            0                  36d      10.42.0.63      mbrkanov-mini-it13   <none>           <none>
inventory/layered-inventory.md:34:| `homarr` | Plattform/legacy/shared | 7 |
inventory/layered-inventory.md:94:| `homarr` | Deployment | `my-homarr` | 1/1 |
inventory/layered-inventory.md:148:| `homarr` | `my-homarr-config` | Bound | `longhorn` | 10Gi | ReadWriteOnce |
inventory/layered-inventory.md:149:| `homarr` | `my-homarr-data` | Bound | `local-path` | 100Gi | ReadWriteOnce |
inventory/layered-inventory.md:150:| `homarr` | `my-homarr-data-mb` | Bound | `longhorn` | 10Gi | ReadWriteOnce |
inventory/layered-inventory.md:151:| `homarr` | `my-homarr-data-new` | Bound | `longhorn` | 100Gi | ReadWriteOnce |
inventory/layered-inventory.md:152:| `homarr` | `my-homarr-icons` | Bound | `longhorn` | 10Gi | ReadWriteOnce |
inventory/namespaces.json:186:                    "kubernetes.io/metadata.name": "homarr",
inventory/namespaces.json:187:                    "name": "homarr"
inventory/namespaces.json:189:                "name": "homarr",
inventory/argocd-adoption-20260619.md:45:- `pidoka-hf-homarr`
inventory/argocd-adoption-20260619.md:46:  - Namespace: `homarr`
inventory/argocd-adoption-20260619.md:49:  - Ressourcen: Deployment `my-homarr`, Service `my-homarr`, aktive PVCs `my-homarr-config`, `my-homarr-icons`, `my-homarr-data`.
inventory/argocd-adoption-20260619.md:73:1. `homarr` Alt-/Restthemen nach Adoption
inventory/argocd-adoption-20260619.md:74:   - Namespace: `homarr`
inventory/argocd-adoption-20260619.md:75:   - Produktiver Teil ist jetzt IT15-ArgoCD-managed via `pidoka-hf-homarr`.
inventory/argocd-adoption-20260619.md:77:     - Secret `my-homarr-homarr-secrets` ist noch als bestehendes Kubernetes Secret referenziert, nicht via ESO/Infisical modelliert. Es enthaelt `NEXTAUTH_SECRET`, den Homarr fuer NextAuth-/Session-Signatur nutzt.
inventory/argocd-adoption-20260619.md:79:     - Alte PVCs `my-homarr-data-new` und `my-homarr-data-mb` wurden geprueft und geloescht.
inventory/argocd-adoption-20260619.md:84:     - Altes Helm Release Secret `sh.helm.release.v1.my-homarr.v1` wurde geloescht.
inventory/argocd-adoption-20260619.md:120:1. Homarr Secret spaeter nach Infisical/ESO ueberfuehren.
inventory/backup-strategy-draft.md:7:- Neuer Hilfs-Backup-Server in der DMZ: `dmz-backup` (`192.168.20.90`).
inventory/backup-strategy-draft.md:18:- Cluster pusht Backup-Dateien nach `dmz-backup` (`192.168.20.90`).
inventory/backup-strategy-draft.md:19:- Synology pullt von `dmz-backup`.
inventory/backup-strategy-draft.md:20:- `dmz-backup` ist Staging/Puffer in der DMZ, Synology bleibt Backup-Master.
inventory/backup-strategy-draft.md:29:## Ordnerstruktur auf dmz-backup / Synology
inventory/backup-strategy-draft.md:35:- Einige Live-Namespaces sind historisch gewachsen (`hf-*`, `pidoka-hf-*`, `homarr`, `zammad`).
inventory/backup-strategy-draft.md:38:Staging-Root auf `dmz-backup`:
inventory/backup-strategy-draft.md:41:/srv/dmz-backup/k3s-dmz/
inventory/backup-strategy-draft.md:72:- `/home/node/.openclaw/workspace/inventory/backup-folder-structure-dmz-backup-20260619.md`
inventory/backup-strategy-draft.md:178:- Zielstrecke ist aus Cluster-Sicht stimmig: K3s/DMZ pusht nach `dmz-backup` (`192.168.20.90`), Synology pullt von dort und bleibt Langzeit-Backup-Master.
inventory/backup-strategy-draft.md:179:- `dmz-backup` ist nur Staging/Puffer, nicht finales Backup.
inventory/backup-strategy-draft.md:182:- Backups mit Secret-, Credential-, Datenbank- oder personenbezogenem Inhalt werden vor Ablage auf `dmz-backup` clientseitig verschlüsselt. `dmz-backup` darf keine dauerhaften Passphrases oder Private Keys halten. Keine Secretwerte in Metadaten, Logs oder Slack.
inventory/backup-strategy-draft.md:213:- Zielarchitektur soll auf `dmz-backup` umgestellt werden; bisherige Staging-Altlast `192.168.20.40` bleibt als technische Schuld markiert.
inventory/backup-strategy-draft.md:236:- Ablauf: read-only Export, clientseitige Verschluesselung vor `dmz-backup`, Synology Pull ohne `--delete`, Restore-Pruefung nur in Staging/Parser/Doku.
inventory/backup-strategy-draft.md:264:Empfehlung aktualisiert 2026-06-19: Der neue dedizierte DMZ-Backuphost `dmz-backup` (`192.168.20.90`) ersetzt die bisherige Zielarchitektur "Control-Plane als Staging". `192.168.20.40` bleibt nur historische/technische Übergangslösung und sollte abgeloest werden.
inventory/backup-strategy-draft.md:287:- Neuer Zielhost dafuer: `dmz-backup` (`192.168.20.90`)
inventory/backup-strategy-draft.md:308:- Plan replacement by `dmz-backup` (`192.168.20.90`).
inventory/backup-strategy-draft.md:309:- Configure Synology pull from `dmz-backup` without `--delete` initially.
inventory/k8s-objects.json:769:                    "meta.helm.sh/release-name": "my-homarr",
inventory/k8s-objects.json:770:                    "meta.helm.sh/release-namespace": "homarr"
inventory/k8s-objects.json:774:                    "app": "homarr-8.0.4",
inventory/k8s-objects.json:775:                    "app.kubernetes.io/instance": "my-homarr",
inventory/k8s-objects.json:777:                    "app.kubernetes.io/name": "homarr",
inventory/k8s-objects.json:780:                    "helm.sh/chart": "homarr-8.0.4",
inventory/k8s-objects.json:781:                    "release": "my-homarr",
inventory/k8s-objects.json:784:                "name": "my-homarr",
inventory/k8s-objects.json:785:                "namespace": "homarr",
inventory/k8s-objects.json:810:                    "app.kubernetes.io/instance": "my-homarr",
inventory/k8s-objects.json:811:                    "app.kubernetes.io/name": "homarr",
inventory/k8s-objects.json:9301:                    "meta.helm.sh/release-name": "my-homarr",
inventory/k8s-objects.json:9302:                    "meta.helm.sh/release-namespace": "homarr"
inventory/k8s-objects.json:9307:                    "app": "homarr-8.0.4",
inventory/k8s-objects.json:9308:                    "app.kubernetes.io/instance": "my-homarr",
inventory/k8s-objects.json:9310:                    "app.kubernetes.io/name": "homarr",
inventory/k8s-objects.json:9313:                    "helm.sh/chart": "homarr-8.0.4",
inventory/k8s-objects.json:9314:                    "release": "my-homarr"
inventory/k8s-objects.json:9316:                "name": "my-homarr",
inventory/k8s-objects.json:9317:                "namespace": "homarr",
inventory/k8s-objects.json:9327:                        "app.kubernetes.io/instance": "my-homarr",
inventory/k8s-objects.json:9328:                        "app.kubernetes.io/name": "homarr",
inventory/k8s-objects.json:9342:                            "app": "homarr-8.0.4",
inventory/k8s-objects.json:9343:                            "app.kubernetes.io/instance": "my-homarr",
inventory/k8s-objects.json:9345:                            "app.kubernetes.io/name": "homarr",
inventory/k8s-objects.json:9348:                            "helm.sh/chart": "homarr-8.0.4",
inventory/k8s-objects.json:9350:                            "release": "my-homarr"
inventory/k8s-objects.json:9375:                                        "name": "NEXTAUTH_SECRET",
inventory/k8s-objects.json:9378:                                                "key": "NEXTAUTH_SECRET",
inventory/k8s-objects.json:9379:                                                "name": "my-homarr-homarr-secrets"
inventory/k8s-objects.json:9384:                                "image": "ghcr.io/ajnart/homarr:0.14.2@sha256:3f2389f69db8b497c32c843d44f26afefb4e47b8e7954d0c43c372713d617ed7",
inventory/k8s-objects.json:9398:                                "name": "my-homarr",
inventory/k8s-objects.json:9522:                                        "app.kubernetes.io/instance": "my-homarr",
inventory/k8s-objects.json:9523:                                        "app.kubernetes.io/name": "homarr",
inventory/k8s-objects.json:9524:                                        "pod.name": "my-homarr"
inventory/k8s-objects.json:9536:                                        "app.kubernetes.io/instance": "my-homarr",
inventory/k8s-objects.json:9537:                                        "app.kubernetes.io/name": "homarr",
inventory/k8s-objects.json:9538:                                        "pod.name": "my-homarr"
inventory/k8s-objects.json:9552:                                    "claimName": "my-homarr-config"
inventory/k8s-objects.json:9558:                                    "claimName": "my-homarr-data"
inventory/k8s-objects.json:9571:                                    "claimName": "my-homarr-icons"
inventory/k8s-objects.json:9610:                        "message": "ReplicaSet \"my-homarr-698bc75847\" has successfully progressed.",
inventory/k8s-objects.json:16946:                    "meta.helm.sh/release-name": "my-homarr",
inventory/k8s-objects.json:16947:                    "meta.helm.sh/release-namespace": "homarr",
inventory/k8s-objects.json:16959:                    "app": "homarr-8.0.4",
inventory/k8s-objects.json:16960:                    "app.kubernetes.io/instance": "my-homarr",
inventory/k8s-objects.json:16962:                    "app.kubernetes.io/name": "homarr",
inventory/k8s-objects.json:16965:                    "helm.sh/chart": "homarr-8.0.4",
inventory/k8s-objects.json:16966:                    "release": "my-homarr"
inventory/k8s-objects.json:16968:                "name": "my-homarr-data",
inventory/k8s-objects.json:16969:                "namespace": "homarr",
inventory/k8s-objects.json:17192:                    "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"PersistentVolumeClaim\",\"metadata\":{\"annotations\":{},\"name\":\"my-homarr-icons\",\"namespace\":\"homarr\"},\"spec\":{\"accessModes\":[\"ReadWriteOnce\"],\"resources\":{\"requests\":{\"storage\":\"10Gi\"}},\"storageClassName\":\"longhorn\"}}\n",
inventory/k8s-objects.json:17202:                "name": "my-homarr-icons",
inventory/k8s-objects.json:17203:                "namespace": "homarr",
inventory/k8s-objects.json:17235:                    "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"PersistentVolumeClaim\",\"metadata\":{\"annotations\":{},\"name\":\"my-homarr-data-mb\",\"namespace\":\"homarr\"},\"spec\":{\"accessModes\":[\"ReadWriteOnce\"],\"resources\":{\"requests\":{\"storage\":\"10Gi\"}},\"storageClassName\":\"longhorn\"}}\n",
inventory/k8s-objects.json:17245:                "name": "my-homarr-data-mb",
inventory/k8s-objects.json:17246:                "namespace": "homarr",
inventory/k8s-objects.json:17278:                    "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"PersistentVolumeClaim\",\"metadata\":{\"annotations\":{},\"labels\":{\"app\":\"my-homarr-data\"},\"name\":\"my-homarr-data-new\",\"namespace\":\"homarr\"},\"spec\":{\"accessModes\":[\"ReadWriteOnce\"],\"resources\":{\"requests\":{\"storage\":\"100Gi\"}},\"storageClassName\":\"longhorn\"}}\n",
inventory/k8s-objects.json:17289:                    "app": "my-homarr-data"
inventory/k8s-objects.json:17291:                "name": "my-homarr-data-new",
inventory/k8s-objects.json:17292:                "namespace": "homarr",
inventory/k8s-objects.json:17324:                    "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"kind\":\"PersistentVolumeClaim\",\"metadata\":{\"annotations\":{},\"name\":\"my-homarr-config\",\"namespace\":\"homarr\"},\"spec\":{\"accessModes\":[\"ReadWriteOnce\"],\"resources\":{\"requests\":{\"storage\":\"10Gi\"}},\"storageClassName\":\"longhorn\",\"volumeName\":\"pvc-465c3082-ffe0-4b14-bc80-83fca45ed661\"}}\n",
inventory/k8s-objects.json:17331:                "name": "my-homarr-config",
inventory/k8s-objects.json:17332:                "namespace": "homarr",


Ich habe die Homarr-Vorlage und vorhandene Betriebsnotizen geprüft. Jetzt hole ich den aktuellen Live-Zustand read-only aus dem Cluster: Workloads, PVC/PV, Longhorn-Metadaten und Secret-Metadaten ohne Secret-Daten.


set -euo pipefail
TS=$(date -u +%Y%m%dT%H%M%SZ)
BASE="/home/node/.openclaw/workspace/backups/homarr-pilot-$TS"
mkdir -p "$BASE"/{manifests,metadata,checksums,restore-tests}
printf '%s' "$BASE" > /tmp/kube-bot-homarr-pilot-base
ssh -i /home/node/.ssh/kube-bot-it15-ed25519 -o BatchMode=yes -o ConnectTimeout=8 kube-bot@192.168.20.40 'hostname; sudo -n /usr/local/bin/kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml get ns homarr --no-headers; sudo -n /usr/local/bin/kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml -n homarr get deploy,svc,pod,pvc --no-headers' > "$BASE/metadata/live-summary.txt"
ssh -i /home/node/.ssh/kube-bot-it15-ed25519 -o BatchMode=yes -o ConnectTimeout=8 kube-bot@192.168.20.40 'sudo -n /usr/local/bin/kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml -n homarr get deploy my-homarr -o yaml' > "$BASE/manifests/deployment-my-homarr.yaml"
ssh -i /home/node/.ssh/kube-bot-it15-ed25519 -o BatchMode=yes -o ConnectTimeout=8 kube-bot@192.168.20.40 'sudo -n /usr/local/bin/kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml -n homarr get svc my-homarr -o yaml' > "$BASE/manifests/service-my-homarr.yaml"
ssh -i /home/node/.ssh/kube-bot-it15-ed25519 -o BatchMode=yes -o ConnectTimeout=8 kube-bot@192.168.20.40 'sudo -n /usr/local/bin/kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml -n homarr get pvc my-homarr-config my-homarr-icons my-homarr-data -o yaml' > "$BASE/manifests/pvc-active.yaml"
ssh -i /home/node/.ssh/kube-bot-it15-ed25519 -o BatchMode=yes -o ConnectTimeout=8 kube-bot@192.168.20.40 'sudo -n /usr/local/bin/kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml -n homarr get secret my-homarr-homarr-secrets -o jsonpath="name={.metadata.name}{'\''\n'\''}namespace={.metadata.namespace}{'\''\n'\''}type={.type}{'\''\n'\''}keys={.data}{'\''\n'\''}"' | sed -E 's/(keys=).*/\1REDACTED_KEY_SET_PRESENT/' > "$BASE/metadata/secret-metadata-redacted.txt"
ssh -i /home/node/.ssh/kube-bot-it15-ed25519 -o BatchMode=yes -o ConnectTimeout=8 kube-bot@192.168.20.40 'sudo -n /usr/local/bin/kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml get pv pvc-465c3082-ffe0-4b14-bc80-83fca45ed661 pvc-7eaba3dd-5617-46bc-b424-b9343b5037a5 pvc-7be0df84-5f5e-4d9e-9595-b844f177ec54 -o yaml' > "$BASE/metadata/pv-active.yaml"
ssh -i /home/node/.ssh/kube-bot-it15-ed25519 -o BatchMode=yes -o ConnectTimeout=8 kube-bot@192.168.20.40 'sudo -n /usr/local/bin/kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml -n longhorn-system get volumes.longhorn.io -o wide | grep -E "my-homarr|pvc-465c3082|pvc-7eaba3dd|pvc-7be0df84" || true' > "$BASE/metadata/longhorn-homarr-volumes.txt"
cp repos/platform-gitops/applications/tenants/pidoka/homarr.yaml "$BASE/manifests/argocd-application-pidoka-hf-homarr.yaml"
cp repos/platform-gitops/tenants/pidoka/prod/homarr/app.yaml "$BASE/manifests/gitops-homarr-app.yaml"
find "$BASE" -type f -print0 | sort -z | xargs -0 sha256sum > "$BASE/checksums/manifest.sha256"
printf '%s\n' "$BASE"


Output:
Chunk ID: d733b6
Wall time: 3.5665 seconds
Process exited with code 0
Original token count: 18
Output:
/home/node/.openclaw/workspace/backups/homarr-pilot-20260620T073545Z


Der read-only Export ist lokal erstellt: Workload-/Service-/PVC-/PV-/Longhorn- und GitOps-Artefakte liegen im Workspace. Ich prüfe jetzt, ob versehentlich Secretwerte enthalten sind, und erstelle die Begleitdateien.


BASE=$(cat /tmp/kube-bot-homarr-pilot-base); find "$BASE" -type f -maxdepth 3 | sort; printf '\n--- live summary ---\n'; sed -n '1,160p' "$BASE/metadata/live-summary.txt"; printf '\n--- redacted secret metadata ---\n'; sed -n '1,80p' "$BASE/metadata/secret-metadata-redacted.txt"; printf '\n--- longhorn ---\n'; sed -n '1,120p' "$BASE/metadata/longhorn-homarr-volumes.txt"


BASE=$(cat /tmp/kube-bot-homarr-pilot-base); rg -n "(?i)(password|passwd|secret|token|key|auth|credential|NEXTAUTH|AKIA|PRIVATE|BEGIN|data:)" "$BASE" || true


BASE=$(cat /tmp/kube-bot-homarr-pilot-base); wc -c "$BASE"/*/* "$BASE"/* 2>/dev/null | sort -n | tail -20


Output:
Chunk ID: 5bf160
Wall time: 0.0000 seconds
Process exited with code 0
Original token count: 516
Output:
/home/node/.openclaw/workspace/backups/homarr-pilot-20260620T073545Z/checksums/manifest.sha256
/home/node/.openclaw/workspace/backups/homarr-pilot-20260620T073545Z/manifests/argocd-application-pidoka-hf-homarr.yaml
/home/node/.openclaw/workspace/backups/homarr-pilot-20260620T073545Z/manifests/deployment-my-homarr.yaml
/home/node/.openclaw/workspace/backups/homarr-pilot-20260620T073545Z/manifests/gitops-homarr-app.yaml
/home/node/.openclaw/workspace/backups/homarr-pilot-20260620T073545Z/manifests/pvc-active.yaml
/home/node/.openclaw/workspace/backups/homarr-pilot-20260620T073545Z/manifests/service-my-homarr.yaml
/home/node/.openclaw/workspace/backups/homarr-pilot-20260620T073545Z/metadata/live-summary.txt
/home/node/.openclaw/workspace/backups/homarr-pilot-20260620T073545Z/metadata/longhorn-homarr-volumes.txt
/home/node/.openclaw/workspace/backups/homarr-pilot-20260620T073545Z/metadata/pv-active.yaml
/home/node/.openclaw/workspace/backups/homarr-pilot-20260620T073545Z/metadata/secret-metadata-redacted.txt

--- live summary ---
mbrkanov-Mini-IT13
homarr   Active   2y172d
deployment.apps/my-homarr   1/1   1     1     2y172d
service/my-homarr   NodePort   10.43.177.71   <none>   10245:30718/TCP   2y172d
pod/my-homarr-698bc75847-nsfph   1/1   Running   0     47d
persistentvolumeclaim/my-homarr-data     Bound   pvc-7be0df84-5f5e-4d9e-9595-b844f177ec54   100Gi   RWO   local-path   2y172d
persistentvolumeclaim/my-homarr-icons    Bound   pvc-7eaba3dd-5617-46bc-b424-b9343b5037a5   10Gi    RWO   longhorn     2y66d
persistentvolumeclaim/my-homarr-config   Bound   pvc-465c3082-ffe0-4b14-bc80-83fca45ed661   10Gi    RWO   longhorn     2y66d

--- redacted secret metadata ---
name=my-homarr-homarr-secrets
namespace=homarr
type=Opaque
keys=REDACTED_KEY_SET_PRESENT

--- longhorn ---
pvc-7eaba3dd-5617-46bc-b424-b9343b5037a5   v1            attached   healthy                  10737418240   mbrkanov-mini-it13   2y66d
pvc-465c3082-ffe0-4b14-bc80-83fca45ed661   v1            attached   healthy                  10737418240   mbrkanov-mini-it13   2y66d