# Current Deployment State

Last verified: 2026-05-02 Asia/Shanghai.

## VM

- Host: intentionally omitted from public repo.
- SSH: `ssh -i <ssh-key-path> <vm-user>@<vm-public-ip>`
- Hostname: intentionally omitted from public repo.
- OS: Linux VM running Docker and the official PDS distribution.
- VM provider: Google Compute Engine.
- Local PDS state: `/pds` on the root filesystem.
- Swap: configured at `/swapfile`.

## Installed Tools

- Docker: installed.
- Docker Compose plugin: installed.
- AWS CLI: installed.
- DNS tools: `dig` from `dnsutils`
- Baseline utilities: `curl`, `tar`, `gzip`, `awk`, `sed`, `jq`, `git`, `unzip`

## Filesystem

- PDS state directory: `/pds`
- Origin certificate directory: `/pds/certs`
- Both directories are owned by `root:root` and mode `0755`.
- Public-safe runbook copy: `/opt/atstack`
- Operational scripts installed:
  - `/usr/local/sbin/apply-r2-config.sh`
  - `/usr/local/sbin/backup-pds.sh`
  - `/usr/local/sbin/restore-pds.sh`
  - `/usr/local/sbin/pds-healthcheck.sh`
  - `/usr/local/sbin/update-pds.sh`
  - `/usr/local/sbin/verify-r2-blobstore.sh`

## Services and Ports

- Docker service: active and enabled.
- `pds.service`: active and enabled.
- Containers: `pds`, `caddy`, `watchtower`.
- PDS version: `0.4.219`.
- Ports:
  - `80/tcp`: Caddy
  - `443/tcp`: Caddy
  - `3000/tcp`: PDS backend

## DNS

`pds.3drx.top` resolves through Cloudflare proxy IPs:

```text
<cloudflare-proxy-ip>
```

The account DID is known and `_atproto.3drx.top` should be set to:

```text
did=did:plc:tcrkgt4o6nm5qlfdzjcz6el6
```

## Health

PDS health endpoint works through Cloudflare:

```text
https://pds.3drx.top/xrpc/_health -> {"version":"0.4.219"}
```

## Account

- Handle: `3drx.top`
- Original temporary handle: intentionally omitted from public repo.
- DID: `did:plc:tcrkgt4o6nm5qlfdzjcz6el6`
- Account credentials file on VM: `/root/pds-account-credentials.txt`
- Credentials file mode: `0600 root:root`

The handle has been switched to `3drx.top`.

## R2

- Endpoint: `https://<cloudflare-account-id>.r2.cloudflarestorage.com`
- Live blob bucket: `<pds-blob-bucket>`
- Backup bucket: `<pds-backup-bucket>`
- R2 credential source on VM: `/etc/pds-r2.env`
- PDS backup env on VM: `/etc/pds-backup.env`
- R2 object write/read/delete verification: passed.
- AWS CLI compatibility: scripts force path-style addressing and checksum behavior compatible with R2.

## Backups

- Backup timer: enabled.
- Next timer can be inspected with `systemctl list-timers pds-backup.timer`.
- Backup retention lifecycle: configured.
- R2 lifecycle rules on `<pds-backup-bucket>`:
  - `expire-pds-backups-after-7-days`: delete completed objects under `pds/` after 7 days.
  - `Default Multipart Abort Rule`: abort incomplete multipart uploads after 7 days.
- Verified backup archives:
  - `s3://<pds-backup-bucket>/pds/pds-<hostname>-<timestamp>.tar.gz`

## Not Yet Done

- R2 credentials are installed in root-only env files and verified.
- Cloudflare Origin CA certificate and key are installed at:
  - host copy: `/pds/certs/cloudflare-origin.pem` and `/pds/certs/cloudflare-origin.key`
  - Caddy container-visible copy: `/pds/caddy/etc/caddy/certs/cloudflare-origin.pem` and `/pds/caddy/etc/caddy/certs/cloudflare-origin.key`
- Caddy is configured to use the container-visible Cloudflare Origin CA certificate for `pds.3drx.top`.
- Initial deployment is complete.