halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

docs(deploy): the Storage Box needs external reachability

Browse source 
A Storage Box answers only inside Hetzner's network unless External
Reachability is on, for the box and for the sub-account. FTP and SFTP on
port 22 can't be turned off, so the sub-account turns off Samba and
WebDAV only. A host key of another type is checked against Hetzner's
list too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-03 21:41:21 +02:00
commit 6c20c44cf5
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 11 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

20
deploy/backups.md
View file

@ -41,14 +41,16 @@ Once, in this order. The commands name who runs them, and where.
### 1. The Storage Box (you, in Hetzner Console)
1. Order a Storage Box (BX11, 1 TB, is plenty) in any location; its main login and
password go into your password manager.
2. Turn on **SSH support**.
3. Set up **automatic snapshots**: daily, at a fixed time, with as many kept as the box
1. Create a Storage Box (BX11, 1 TB, is plenty) in any location, with a password, which
goes into your password manager. Turn on **SSH Support** (port 23, which restic uses)
and **External Reachability**: without it, the box only answers inside Hetzner's
network. Samba and WebDAV stay off; FTP and SFTP on port 22 can't be turned off.
2. Set up **automatic snapshots**: daily, at a fixed time, with as many kept as the box
allows (10 on a BX11).
4. Add a **sub-account** for this server: its own directory (e.g. `sahaquiel`), SSH
support on, every other protocol off, not read-only (restic deletes what it prunes).
Note its user name (`uXXXXX-subN`) and password; the password is needed once, below.
3. Add a **sub-account** for this server: its own directory (e.g. `sahaquiel`), **SSH
support** and **External reachability** on, Samba and WebDAV off, not read-only
(restic deletes what it prunes). Note its user name (`uXXXXX-subN`) and password; the
password is needed once, below.
### 2. restic (an admin with sudo, on the server)
@ -75,8 +77,8 @@ EOF
Install the key, with the sub-account's password. SSH first shows the box's host key:
accept it only if its ED25519 fingerprint is
`SHA256:XqONwb1S0zuj5A1CDxpOSuD2hnAArV1A3wKY7Z3sdgM`
([Hetzner's list](https://docs.hetzner.com/storage/storage-box/general/)).
`SHA256:XqONwb1S0zuj5A1CDxpOSuD2hnAArV1A3wKY7Z3sdgM`, or, for another key type, the one
[Hetzner lists](https://docs.hetzner.com/storage/storage-box/general/) for it.
```sh
ssh storagebox install-ssh-key <~/.ssh/storagebox.pub