# Wasabi S3 Bucket Architecture

Normalized Jul 8, 2026 from a single monolithic bucket into purpose-specific buckets.

## Bucket Layout

| Bucket | Purpose | Created | Initial versioning |
|--------|---------|---------|-------------------|
| `hermes-vps-backups` | Hermes live state, full backups, standby recovery | Pre-existing | ✅ Enabled Jul 8 |
| `itpropartner-system-configs` | Caddyfile, systemd, SSH keys, scripts, .env files | **Manual (Wasabi Console)** | ✅ Enable after creation |
| `itpropartner-docker-volumes` | Docuseal, Vaultwarden, Twenty, SearXNG, Ollama | **Manual (Wasabi Console)** | ✅ Enable after creation |
| `mikrotik-ccr-backups` | Router configs, backup logs | Pre-existing | ✅ Enabled Jul 8 |
| `itpropartner-backups` | Legacy orphaned data (no active writer) | Pre-existing | ✅ Enabled Jul 8 |

**Note:** The Hermes-User IAM key lacks `s3:CreateBucket` permission. New buckets must be created in the Wasabi Console web UI. After creation, enable versioning via CLI:

```bash
source /opt/awscli-venv/bin/activate
aws s3api put-bucket-versioning --bucket itpropartner-system-configs \
  --versioning-configuration Status=Enabled \
  --endpoint-url https://s3.us-east-1.wasabisys.com
```

## Data Formerly in `itpropartner-backups` (legacy, preserved)

| Old path | Copied to |
|----------|-----------|
| `home-router/2026-07-07-config.rsc` | `mikrotik-ccr-backups/wisp-backups/configs/` |
| `shonuff/*` (images) | `hermes-vps-backups/assets/` |

No data deleted — old bucket preserved with versioning.

## Sync Scripts

| Script | Bucket | Schedule | What it syncs |
|--------|--------|----------|--------------|
| `hermes-live-sync.sh` | `hermes-vps-backups` | Every 15 min | Hermes config, skills, cron, sessions, profiles, .env, state.db |
| `hermes-system-config-sync.sh` | `itpropartner-system-configs` | Every 15 min | Caddyfile, systemd services, ops scripts, SSH keys, .env files |
| `hermes-docker-sync.sh` | `itpropartner-docker-volumes` | Every 15 min | Docuseal, Vaultwarden, Twenty, SearXNG, Ollama volume data |
| `wisp-backup.py` | `mikrotik-ccr-backups` | Daily 6 AM | Router config exports |
| `hermes-backup.sh` | `hermes-vps-backups/full/` | Daily 5 AM | Full tarball of everything |

## Data collector tracking

The ops-data-collector.py checks all 6 paths (5 buckets, with one split into sub-paths):

```python
check_s3_backup("s3://hermes-vps-backups/live/")        # → "hermes-vps-backups"
check_s3_backup("s3://hermes-vps-backups/hermes-full-backup/")  # → "hermes-full-backups"
check_s3_backup("s3://itpropartner-system-configs/")     # → "system-configs"
check_s3_backup("s3://itpropartner-docker-volumes/")     # → "docker-volumes"
check_s3_backup("s3://mikrotik-ccr-backups/")            # → "mikrotik-backups"
check_s3_backup("s3://itpropartner-backups/")            # → "itpropartner-backups"
```