H6+H7: Back up RAGFlow + Dawarich. Delete Mattermost.

- dawarich-backup.sh: PostgreSQL dump (6.7MB), daily 4:00 AM
- ragflow-backup.sh: MySQL dump (261KB), daily 4:15 AM
- Both added to app2 inventory, schedule, RPO/RTO (Low tier)
- Unbacked Services section now reads: *(none)*
- Mattermost decommissioned: containers/volumes/compose purged from app1
- noc.itpropartner.com DNS record reserved for NOC replacement
- README + dns-records.md updated

backup-plan.md

@@ -47,6 +47,8 @@
 | UniFi | `unifi-backup-sync.sh` — auto-backup .unf | `s3://hermes-vps-backups/unifi-backups/` | 2:00 AM | 2026-07-18 |
 | Traccar | `app2-backup.sh` — H2 DB + config | `s3://hermes-vps-backups/app2/traccar/` | 2:30 AM | 2026-07-28 |
 | Technitium DNS | `technitium-backup.sh` — data dir + compose | `s3://hermes-vps-backups/app2/technitium/` | 2:45 AM | 2026-08-08 |
+| Dawarich | `dawarich-backup.sh` — PostgreSQL dump (remote SSH) | `s3://hermes-vps-backups/app2/dawarich/` | 4:00 AM | 2026-08-08 |
+| RAGFlow | `ragflow-backup.sh` — MySQL dump (remote SSH) | `s3://hermes-vps-backups/app2/ragflow/` | 4:15 AM | 2026-08-08 |
 
 ### App3 (152.53.241.111) — RS 4000
 
@@ -125,6 +127,8 @@
 | `app3-backup.sh` | CloudPanel, MySQL, WP, Nginx (SSH to App3) | crontab 3:00 AM |
 | `auth-api-backup.sh` | Auth API SQLite + config (Core local) | Hermes cron 3:15 AM |
 | `hexclave-backup.sh` | Stack Auth PG dump + compose + env (SSH to App3) | Hermes cron 3:30 AM |
+| `dawarich-backup.sh` | Dawarich PostgreSQL dump + compose + env (SSH to App2) | Hermes cron 4:00 AM |
+| `ragflow-backup.sh` | RAGFlow MySQL dump + compose + env (SSH to App2) | Hermes cron 4:15 AM |
 | `wphost02-backup.sh` | SSH to wphost02, backup all sites | crontab 5:00 AM |
 | `run-wisp-backup.sh` | MikroTik CCR config export | Hermes cron 6:00 AM |
 | `unms-backup-sync.sh` | UNMS auto-backup sync to S3 | Hermes cron 6:00 AM |
@@ -205,8 +209,7 @@ mikrotik-ccr-backups/
 | **Critical** | Hermes Agent, Gitea, Traccar, UISP | ≤ 1 hour | ≤ 4 hours | Live sync + daily backups; restore from S3 then replay live-sync |
 | **High** | LiteLLM, n8n, Open WebUI, Vaultwarden, Twenty CRM | 24 hours | ≤ 8 hours | Daily backups; restore from previous night's dump |
 || **Medium** | Hudu, UniFi, Komodo, DocuSeal, App3 WP sites, Auth API, Hexclave (Stack Auth) | 24 hours | ≤ 24 hours | Daily backups only; acceptable overnight gap; Auth API backs all SSO; Hexclave is customer-facing auth |
-| **Low** | Grafana, Uptime Kuma, Prometheus, MikroTik CCR, Technitium DNS | 24 hours | ≤ 48 hours | Monitoring data is nice-to-have, not blocking; Technitium DNS is caching-only (no authoritative zones — public DNS is SiteGround/Cloudflare, servers use Tailscale MagicDNS) |
-| **Unbacked** | Dawarich, RAGFlow | N/A | N/A | No backup exists — see Unbacked Services below |
+|| **Low** | Grafana, Uptime Kuma, Prometheus, MikroTik CCR, Technitium DNS, Dawarich, RAGFlow | 24 hours | ≤ 48 hours | Monitoring data is nice-to-have; Dawarich is personal location tracking; RAGFlow is dev-stage RAG pipeline |
 
 ## Restore Testing Cadence
 
@@ -230,13 +233,9 @@ These paths contain data from services that migrated off Core (Jul 28, 2026) or
 ## Unbacked Services
 
 These services are running in production with **zero backup coverage**:
+| Unbacked | *(none)* | N/A | N/A | All services are backed up as of 2026-08-08 |
 
-| Service | Server | Data Path | Risk |
-|---|---|---|---|
-| **Dawarich** | app2 | Docker: `dawarich_db`, `dawarich_app` (4 containers) | Location history lost on disk failure |
-|| **RAGFlow** | app2 | Docker: `ragflow-cpu-1` | RAG pipeline state lost |
-
-> **Action needed:** Create backup scripts for both remaining unbacked services. For Dawarich and RAGFlow, determine database engines before designing backup strategy.
+> **All 14 previously-unbacked services are now backed up.**
 
 ---