docs-alpha.jayfield.org/SYNC-PLAN.md

alpha.jayfield.org — Intranet Sync Plan (vlda-01 → alpha)

Status: planning only, nothing implemented yet. This is a point-in-time plan for later reference, not a live inventory (README.md is the live inventory) and not a build runbook (SETUP.md is that). Update this file as decisions get made and pieces get built; move finished work into README.md once it's live, the way the KeePass/Nextcloud migration did.

Problem

vlda-01 (home intranet server, behind a home LAN, not 24/7 online) hosts four things the household wants reliably available: plain files, Gitea, Jellyfin, and a Dogecoin node/wallet used for daily transaction catchup. Goal: use alpha.jayfield.org (public, 24/7, already running Docker + Nextcloud) as the always-available side, without reproducing the failure mode that got the old setup removed.

Why not just revive the old WireGuard tunnel + CIFS mount (see README.md's "Previously resolved" history — alpha_at_moon tunnel + 192.168.22.0/24 CIFS mount, purged 2026-07-19, configs backed up to /root/removed-configs-backup/ if ever needed as a reference): that setup required vlda-01 to be reachable at the moment alpha wanted the data — a live mount. That's structurally incompatible with "not 24/7 online." Each service below instead either pulls data to alpha ahead of time or migrates outright, so alpha's availability stops depending on vlda-01's.

Per-service plan

1. Files → Syncthing

• Syncthing container on alpha, data lands at /srv/intranet-data/<folder> (host-inspectable, matching the /srv/nextcloud/data pattern). Admin GUI bound to 127.0.0.1:8384, reverse-proxied through Apache like Portainer/Nextcloud — never expose the setup UI directly.
• Syncthing client on vlda-01 dials out to alpha — no inbound port forwarding needed at home, unlike the old tunnel. Catches up automatically whenever vlda-01 gets power + internet.
• Direction: start send-only from vlda-01 → receive-only on alpha (vlda-01 stays authoritative, alpha is a live mirror). Revisit bidirectional later once trusted.
• Firewall: open 22000/tcp + 21027/udp on alpha for Syncthing.
• Expose via Nextcloud: enable the built-in files_external app, mount /srv/intranet-data/<folder> as local external storage — same web UI (cloud.jayfield.org) already used for the KeePass vaults.

Status: not started.

2. Gitea → full migration, not sync

Just repos + a small DB — no reason to keep this tied to vlda-01's uptime.

• Stop the Gitea container on vlda-01, copy its data volume (repos + DB + config) to alpha.
• Bring it up on alpha as a permanent container, following the exact pattern already used for web/cloud.jayfield.org: publish to 127.0.0.1:<port> → Apache vhost (git.jayfield.org) → certbot --apache.
• Decommission or keep vlda-01's copy as a cold backup, admin's choice.

Status: not started. No open questions — ready to build when wanted.

3. Jellyfin → scoping question, not yet planned

Media libraries are often hundreds of GB to multiple TB, and local hardware transcoding at home may not have an equivalent on the VPS. Before sketching an approach, need:

• Approximate library size.
• Is the actual goal remote streaming (away from home), or is Jellyfin only ever watched on the home LAN? If the latter, migrating buys nothing — Jellyfin only needs to be up when someone's actually watching, which is whenever vlda-01 would be on anyway. If remote access is wanted, next step is sizing alpha's disk/bandwidth budget for it.

Status: blocked on the above — no plan yet.

4. Dogecoin node/wallet → security-conscious split, needs sign-off

Do not migrate the wallet wholesale without explicit confirmation. Per the attacker report (SendUserFile'd 2026-07-19), this host takes on the order of 10,000 automated SSH/scan attempts a month. Putting spending keys on the same public, constantly-probed box is a materially different risk than at home.

Recommended design:

• Run dogecoind on alpha as a Docker container with disablewallet=1 — blockchain sync only, no private keys, no funds at risk. Stays permanently caught up with the network regardless of vlda-01's uptime.
• Keep the actual wallet (wallet.dat, spending keys) only on vlda-01. Point vlda-01's dogecoin-cli/GUI at alpha's node as its backend (-connect=), with RPC reachable only over an authenticated tunnel (SSH-forwarded or WireGuard) — never bind RPC to a public interface; an open Dogecoin RPC port is exactly the kind of thing scanners probe for.
• Result: "daily transaction catchup" becomes near-instant once vlda-01 turns on, since the chain is already synced — without private keys ever touching the internet-facing box.

Open question, needs the user's explicit answer before implementing: go with the wallet-split design above, or is the fund exposure small enough to just run the wallet on alpha too, for simplicity? Do not proceed with either without confirmation — this is the one piece of this plan with real financial/security stakes.

Suggested build order

1. Gitea (no open questions, most self-contained, validates the general "migrate a dockerized service to alpha + Apache vhost" pattern).
2. Files via Syncthing (validates the intermittent-sync approach before trusting it with anything else).
3. Dogecoin node — only after explicit sign-off on the wallet-split question above.
4. Jellyfin — only after the scoping question above is answered.