Current Deployment State #

Last verified: 2026-05-02 Asia/Shanghai.

VM #

• Host: intentionally omitted from public repo.
• SSH: ssh -i <ssh-key-path> <vm-user>@<vm-public-ip>
• Hostname: intentionally omitted from public repo.
• OS: Linux VM running Docker and the official PDS distribution.
• VM provider: Google Compute Engine.
• Local PDS state: /pds on the root filesystem.
• Swap: configured at /swapfile.

Installed Tools #

• Docker: installed.
• Docker Compose plugin: installed.
• AWS CLI: installed.
• DNS tools: dig from dnsutils
• Baseline utilities: curl, tar, gzip, awk, sed, jq, git, unzip

Filesystem #

• PDS state directory: /pds
• Origin certificate directory: /pds/certs
• Both directories are owned by root:root and mode 0755.
• Public-safe runbook copy: /opt/atstack
• Operational scripts installed:
  • /usr/local/sbin/apply-r2-config.sh
  • /usr/local/sbin/backup-pds.sh
  • /usr/local/sbin/restore-pds.sh
  • /usr/local/sbin/pds-healthcheck.sh
  • /usr/local/sbin/update-pds.sh
  • /usr/local/sbin/verify-r2-blobstore.sh

Services and Ports #

• Docker service: active and enabled.
• pds.service: active and enabled.
• Containers: pds, caddy, watchtower.
• PDS version: 0.4.219.
• Ports:
  • 80/tcp: Caddy
  • 443/tcp: Caddy
  • 3000/tcp: PDS backend

DNS #

pds.3drx.top resolves through Cloudflare proxy IPs:

<cloudflare-proxy-ip>

The account DID is known and _atproto.3drx.top should be set to:

did=did:plc:tcrkgt4o6nm5qlfdzjcz6el6

Health #

PDS health endpoint works through Cloudflare:

https://pds.3drx.top/xrpc/_health -> {"version":"0.4.219"}

Account #

• Handle: 3drx.top
• Original temporary handle: intentionally omitted from public repo.
• DID: did:plc:tcrkgt4o6nm5qlfdzjcz6el6
• Account credentials file on VM: /root/pds-account-credentials.txt
• Credentials file mode: 0600 root:root

The handle has been switched to 3drx.top.

R2 #

• Endpoint: https://<cloudflare-account-id>.r2.cloudflarestorage.com
• Live blob bucket: <pds-blob-bucket>
• Backup bucket: <pds-backup-bucket>
• R2 credential source on VM: /etc/pds-r2.env
• PDS backup env on VM: /etc/pds-backup.env
• R2 object write/read/delete verification: passed.
• AWS CLI compatibility: scripts force path-style addressing and checksum behavior compatible with R2.

Backups #

• Backup timer: enabled.
• Next timer can be inspected with systemctl list-timers pds-backup.timer.
• Backup retention lifecycle: configured.
• R2 lifecycle rules on <pds-backup-bucket>:
  • expire-pds-backups-after-7-days: delete completed objects under pds/ after 7 days.
  • Default Multipart Abort Rule: abort incomplete multipart uploads after 7 days.
• Verified backup archives:
  • s3://<pds-backup-bucket>/pds/pds-<hostname>-<timestamp>.tar.gz

Not Yet Done #

• R2 credentials are installed in root-only env files and verified.
• Cloudflare Origin CA certificate and key are installed at:
  • host copy: /pds/certs/cloudflare-origin.pem and /pds/certs/cloudflare-origin.key
  • Caddy container-visible copy: /pds/caddy/etc/caddy/certs/cloudflare-origin.pem and /pds/caddy/etc/caddy/certs/cloudflare-origin.key
• Caddy is configured to use the container-visible Cloudflare Origin CA certificate for pds.3drx.top.
• Initial deployment is complete.