hermes-skills/skills/devops/ops-portal-and-collector/references/s3-bucket-architecture.md

Wasabi S3 Bucket Architecture

Normalized Jul 8, 2026 from a single monolithic bucket into purpose-specific buckets.

Bucket Layout

Bucket	Purpose	Created	Initial versioning
hermes-vps-backups	Hermes live state, full backups, standby recovery	Pre-existing	✅ Enabled Jul 8
itpropartner-system-configs	Caddyfile, systemd, SSH keys, scripts, .env files	Manual (Wasabi Console)	✅ Enable after creation
itpropartner-docker-volumes	Docuseal, Vaultwarden, Twenty, SearXNG, Ollama	Manual (Wasabi Console)	✅ Enable after creation
mikrotik-ccr-backups	Router configs, backup logs	Pre-existing	✅ Enabled Jul 8
itpropartner-backups	Legacy orphaned data (no active writer)	Pre-existing	✅ Enabled Jul 8

Note: The Hermes-User IAM key lacks s3:CreateBucket permission. New buckets must be created in the Wasabi Console web UI. After creation, enable versioning via CLI:

source /opt/awscli-venv/bin/activate
aws s3api put-bucket-versioning --bucket itpropartner-system-configs \
  --versioning-configuration Status=Enabled \
  --endpoint-url https://s3.us-east-1.wasabisys.com

Data Formerly in itpropartner-backups (legacy, preserved)

Old path	Copied to
home-router/2026-07-07-config.rsc	mikrotik-ccr-backups/wisp-backups/configs/
shonuff/* (images)	hermes-vps-backups/assets/

No data deleted — old bucket preserved with versioning.

Sync Scripts

Script	Bucket	Schedule	What it syncs
hermes-live-sync.sh	hermes-vps-backups	Every 15 min	Hermes config, skills, cron, sessions, profiles, .env, state.db
hermes-system-config-sync.sh	itpropartner-system-configs	Every 15 min	Caddyfile, systemd services, ops scripts, SSH keys, .env files
hermes-docker-sync.sh	itpropartner-docker-volumes	Every 15 min	Docuseal, Vaultwarden, Twenty, SearXNG, Ollama volume data
wisp-backup.py	mikrotik-ccr-backups	Daily 6 AM	Router config exports
hermes-backup.sh	hermes-vps-backups/full/	Daily 5 AM	Full tarball of everything

Data collector tracking

The ops-data-collector.py checks all 6 paths (5 buckets, with one split into sub-paths):

check_s3_backup("s3://hermes-vps-backups/live/")        # → "hermes-vps-backups"
check_s3_backup("s3://hermes-vps-backups/hermes-full-backup/")  # → "hermes-full-backups"
check_s3_backup("s3://itpropartner-system-configs/")     # → "system-configs"
check_s3_backup("s3://itpropartner-docker-volumes/")     # → "docker-volumes"
check_s3_backup("s3://mikrotik-ccr-backups/")            # → "mikrotik-backups"
check_s3_backup("s3://itpropartner-backups/")            # → "itpropartner-backups"