VM 101 — backup-manager

Extracted from the master document on 2026-09-04. §N numbering kept so cross-references are not broken.

34. Baseline

VMID:      101
Hostname:  backup-manager
OS:        Debian 13.6 minimal
IP:        192.168.2.10/24  ·  Tailscale 100.79.63.6
CPU:       1 vCPU  ·  RAM 2048 MiB
OS disk:   32 GiB local-lvm
Repo disk: 150 GiB local-lvm (scsi1)  ← Borg repository

The first installation included GNOME by accident; it was destroyed and re-created minimal. Lesson: an infrastructure VM does not need a desktop unless there is a concrete reason.

34.1 Reusable Debian baseline

Debian netinst → "Install"
   ↓
English / American English; hostname according to role; domain blank
   ↓
root + balsero (passwords into Vaultwarden)
   ↓
Guided entire /dev/sda, all files in one partition
   ↓
mirror deb.debian.org; proxy blank; popularity contest: No
   ↓
Software Selection: ONLY "SSH server" + "standard system utilities"
   ↓
GRUB on /dev/sda; remove the ISO before the final boot
   ↓
apt full-upgrade -y ; apt install -y sudo qemu-guest-agent curl
   ↓
usermod -aG sudo balsero
   ↓
ED25519 SSH key + hardening (§8)
   ↓
Tailscale if it needs remote administration
   ↓
official Docker ONLY if the role needs it
   ↓
/opt/stacks/<service> if it uses Compose

35. Disk dedicated to the Borg repository

The repository used to live on the 32 GiB root disk and filled up /. A dedicated disk was added:

sudo parted /dev/sdb --script mklabel gpt
sudo parted /dev/sdb --script mkpart primary ext4 0% 100%
sudo mkfs.ext4 -L borg-repo /dev/sdb1

UUID=865755eb-9ffa-4a52-a7cb-9381be619679 /home/borg/repo ext4 defaults 0 2

The previous copy temporarily remains as /home/borg/repo-old and must not be deleted until the recovery validations are closed.

35.1 Architectural limitation — logical separation ≠ physical

Proxmox PHYSICAL SSD
   ├── VM 100  (services)
   └── VM 101  (backup-manager)
         └── Borg repo virtual disk       ← still on the SAME SSD

The separate disk improves logical isolation and operational recovery, but it is not a second independent physical medium. If that SSD dies, both VMs and the local repository die at the same time. The only copy that survives that today is R2.

36. Duplicati — evaluated, not adopted

Duplicati Server was tried in /opt/stacks/duplicati (VM 101) and the Linux Agent on VM 100 (duplicati-agent.service ended up active (running) and docker-host showed up as Online now). During the evaluation, central-console licensing limits appeared depending on tier and number of machines, which does not fit a homelab that may grow. It is documented as an experiment, not as a solution.

---