Personal AT Protocol PDS Deployment #

This repository documents and supports a personal AT Protocol PDS deployment for 3drx.top.

The production service host is:

• PDS service: https://pds.3drx.top
• Public handle: @3drx.top
• Compute: Google Compute Engine VM reachable by SSH outside this repo
• Live blob storage: private Cloudflare R2 bucket
• Local PDS state: /pds on the VM root disk
• Backups: R2 bucket or prefix separate from live blobs
• Origin TLS: Cloudflare Origin CA certificate with Cloudflare SSL/TLS set to Full (strict)

This repo is deliberately public-safe. It contains runbooks, templates, and scripts. It must not contain real credentials, private keys, generated passwords, database files, account recovery material, or backup archives.

Quick Links #

• Architecture
• Current State
• First Deployment
• Maintenance
• Restore
• Migration
• Secrets

Local Checks #

Run these before committing changes:

scripts/preflight.sh --local
scripts/healthcheck.sh

If shellcheck is installed:

shellcheck scripts/*.sh

VM-Only R2 Secret File #

R2 credentials live on the VM at /etc/pds-r2.env, never in Git:

R2_ENDPOINT=https://<cloudflare-account-id>.r2.cloudflarestorage.com
R2_ACCESS_KEY_ID=<your-access-key-id>
R2_SECRET_ACCESS_KEY=<your-secret-access-key>
PDS_BLOBSTORE_S3_BUCKET=<pds-blob-bucket>
R2_BACKUP_BUCKET=<pds-backup-bucket>
R2_BACKUP_PREFIX=pds

After editing that file on the VM, run sudo /usr/local/sbin/apply-r2-config.sh.

Production Safety Rules #

• Commit only templates and public documentation.
• Store production secret values on the VM, in Cloudflare, or in a password manager.
• Do not paste secret values into issues, commits, command history, or docs.
• Treat /pds as sensitive even when blob storage is in R2. It contains account state, repo data, databases, admin credentials, and PLC recovery material.