Consolidated principles and lessons

Extracted from the master document on 2026-09-04. §N numbering preserved so cross-references don’t break.

Part XIII — Consolidated principles and lessons

1. DNS is not routing.

DNS     → "which address corresponds to this name?"
Routing → "which path do I take to reach that address?"
Port    → "which service do I want to contact at that destination?"

2. localhost depends on the namespace. 127.0.0.1 inside Caddy is Caddy, not the host (§18).

3. Don’t publish ports unnecessarily. If Caddy and the backend share a Docker network, service:port is enough and nothing needs to be opened on the LAN (§17).

4. Reverse proxy + TLS decouple the entry point from the backend. Only Caddy manages public certificates; the backends speak internal HTTP (§21).

5. .env does not guarantee the secret won’t be printed. docker compose config expands it; use --quiet (§19.4).

6. A VM backup is not the same as the backup of a disk passed through via passthrough. backup=0 means the content is not in the archive, even if the VM config still remembers the device (§46.1).

7. Logical separation ≠ physical separation. An extra virtual disk on the same SSD improves organization, not survival (§35.1).

8. In append-only, deleting is not freeing. borg delete removes the label; only compact frees space — and that is why compact lives far away from the attackable channel (§39.2).

9. systemd scripts run as root and $HOME is /root. Credentials in /etc/<service>/ and absolute paths (§44a).

10. Restoring is part of the backup.

Vaultwarden Borg restore       → VALIDATED      2026-09-01
VM 100 vzdump restore          → VALIDATED      2026-09-04
R2 off-site restore            → VALIDATED      2026-09-04
Borg from R2                   → valid by extension (§48.1)
Full Nextcloud restore         → NOT TESTED

11. Tell a transient startup error apart from a persistent failure. notify-push resolving badly during boot, code 143 in a bootstrap container: normal behaviour (§29).

12. A single alerting channel. One more thing to watch is one thing that stops being watched (§42).

---