Restore drills, yearly

The procedures and their Drill logs are the Ansible runbooks, mirrored on this site. This card is the round: every drill once, then a row in the run log below. Nothing announces that the year is up.

Before you start #

1. Roboformthe age private key, the s3-mirror crypt password and salt, the Shamir recovery keys (3 of 5), the ansible-vault passphrase
2. The Google Drive login, for gdrive-pieter:Homelab Backups
3. A host with rclone, age, Docker, kubectl, jq and a browser. The KubeCoder pod does not qualify: it has no rclone or Docker.
4. For the S3 mirrorsrvk8sdev (VM 919 on pve, off by default) can be started
5. For YouTracka local YouTrack administrator's password
6. Each drill the morning after a successful nightly run of its backup, so production has changed as little as possible since

The round #

1. OpenBao, whole-cluster lossopenbao.md §3 on the real srvvault VMs, through the re-issue of every AppRole, to its step 9. Record the timings in its Drill log. Last drilled 2026-05-23.
2. OpenBao, single-node lossopenbao.md §2: replace one srvvaultN, let the roles converge, watch Raft stream the snapshot from the leader. Never drilled; its timings are the TBD in the Drill log.
3. S3 mirrors3-mirror.md §5: iot-prd-attachments from Drive into a scratch bucket on srvk8sdev, checked byte for byte against the live bucket. Record it in its Drill log. First drill still owed.
4. YouTrackyoutrack-restore.md §3: the newest Drive backup into a throwaway container, with the chart's start arguments. Record it in its Drill log. First drill still owed.
5. Add a row per drill to the run log below.

Run log #