H6+H7: Back up RAGFlow + Dawarich. Delete Mattermost.

- dawarich-backup.sh: PostgreSQL dump (6.7MB), daily 4:00 AM
- ragflow-backup.sh: MySQL dump (261KB), daily 4:15 AM
- Both added to app2 inventory, schedule, RPO/RTO (Low tier)
- Unbacked Services section now reads: *(none)*
- Mattermost decommissioned: containers/volumes/compose purged from app1
- noc.itpropartner.com DNS record reserved for NOC replacement
- README + dns-records.md updated

README.md

@@ -39,7 +39,7 @@
   - Open WebUI (Docker, port 3000) — ai.itpropartner.com
   - n8n + Postgres (Docker, port 5678) — n8n.itpropartner.com
   - LiteLLM (Docker) + Postgres — admin-ai.itpropartner.com
-  - Mattermost Team Edition (Docker, port 8065) — noc.itpropartner.com
+  - Mattermost (decommissioned 2026-08-08 — noc.itpropartner.com reserved for replacement)
   - Caddy (systemd, 80/443)
   - 4 MCP servers: Browser (:8901), Filesystem (:8900), Email (:8902), Git (:8903)
   - Super Search MCP (systemd, port 8899)

backup-plan.md

@@ -47,6 +47,8 @@
 | UniFi | `unifi-backup-sync.sh` — auto-backup .unf | `s3://hermes-vps-backups/unifi-backups/` | 2:00 AM | 2026-07-18 |
 | Traccar | `app2-backup.sh` — H2 DB + config | `s3://hermes-vps-backups/app2/traccar/` | 2:30 AM | 2026-07-28 |
 | Technitium DNS | `technitium-backup.sh` — data dir + compose | `s3://hermes-vps-backups/app2/technitium/` | 2:45 AM | 2026-08-08 |
+| Dawarich | `dawarich-backup.sh` — PostgreSQL dump (remote SSH) | `s3://hermes-vps-backups/app2/dawarich/` | 4:00 AM | 2026-08-08 |
+| RAGFlow | `ragflow-backup.sh` — MySQL dump (remote SSH) | `s3://hermes-vps-backups/app2/ragflow/` | 4:15 AM | 2026-08-08 |
 
 ### App3 (152.53.241.111) — RS 4000
 
@@ -125,6 +127,8 @@
 | `app3-backup.sh` | CloudPanel, MySQL, WP, Nginx (SSH to App3) | crontab 3:00 AM |
 | `auth-api-backup.sh` | Auth API SQLite + config (Core local) | Hermes cron 3:15 AM |
 | `hexclave-backup.sh` | Stack Auth PG dump + compose + env (SSH to App3) | Hermes cron 3:30 AM |
+| `dawarich-backup.sh` | Dawarich PostgreSQL dump + compose + env (SSH to App2) | Hermes cron 4:00 AM |
+| `ragflow-backup.sh` | RAGFlow MySQL dump + compose + env (SSH to App2) | Hermes cron 4:15 AM |
 | `wphost02-backup.sh` | SSH to wphost02, backup all sites | crontab 5:00 AM |
 | `run-wisp-backup.sh` | MikroTik CCR config export | Hermes cron 6:00 AM |
 | `unms-backup-sync.sh` | UNMS auto-backup sync to S3 | Hermes cron 6:00 AM |
@@ -205,8 +209,7 @@ mikrotik-ccr-backups/
 | **Critical** | Hermes Agent, Gitea, Traccar, UISP | ≤ 1 hour | ≤ 4 hours | Live sync + daily backups; restore from S3 then replay live-sync |
 | **High** | LiteLLM, n8n, Open WebUI, Vaultwarden, Twenty CRM | 24 hours | ≤ 8 hours | Daily backups; restore from previous night's dump |
 || **Medium** | Hudu, UniFi, Komodo, DocuSeal, App3 WP sites, Auth API, Hexclave (Stack Auth) | 24 hours | ≤ 24 hours | Daily backups only; acceptable overnight gap; Auth API backs all SSO; Hexclave is customer-facing auth |
-| **Low** | Grafana, Uptime Kuma, Prometheus, MikroTik CCR, Technitium DNS | 24 hours | ≤ 48 hours | Monitoring data is nice-to-have, not blocking; Technitium DNS is caching-only (no authoritative zones — public DNS is SiteGround/Cloudflare, servers use Tailscale MagicDNS) |
+|| **Low** | Grafana, Uptime Kuma, Prometheus, MikroTik CCR, Technitium DNS, Dawarich, RAGFlow | 24 hours | ≤ 48 hours | Monitoring data is nice-to-have; Dawarich is personal location tracking; RAGFlow is dev-stage RAG pipeline |
-| **Unbacked** | Dawarich, RAGFlow | N/A | N/A | No backup exists — see Unbacked Services below |
 
 ## Restore Testing Cadence
 
@@ -230,13 +233,9 @@ These paths contain data from services that migrated off Core (Jul 28, 2026) or
 ## Unbacked Services
 
 These services are running in production with **zero backup coverage**:
+| Unbacked | *(none)* | N/A | N/A | All services are backed up as of 2026-08-08 |
 
-| Service | Server | Data Path | Risk |
+> **All 14 previously-unbacked services are now backed up.**
-|---|---|---|---|
-| **Dawarich** | app2 | Docker: `dawarich_db`, `dawarich_app` (4 containers) | Location history lost on disk failure |
-|| **RAGFlow** | app2 | Docker: `ragflow-cpu-1` | RAG pipeline state lost |
-
-> **Action needed:** Create backup scripts for both remaining unbacked services. For Dawarich and RAGFlow, determine database engines before designing backup strategy.
 
 ---
 

dns-records.md

@@ -27,7 +27,7 @@
 | admin-ai.itpropartner.com | 152.53.36.131 | app1 | LiteLLM |
 | ai.itpropartner.com | 152.53.36.131 | app1 | Open WebUI |
 | n8n.itpropartner.com | 152.53.36.131 | app1 | Workflow automation |
-| **noc.itpropartner.com** | **152.53.36.131** | **app1** | **Mattermost NOC chat** |
+| **noc.itpropartner.com** | **152.53.36.131** | **app1** | **NOC chat (decommissioned — reserved for replacement)** |
 | **vault.itpropartner.com** | **152.53.36.131** | **app1** | **Vaultwarden** |
 | **status.itpropartner.com** | **152.53.192.33** | **Core** | **Public status page** |
 | app1.itpropartner.com | 152.53.36.131 | app1 | App server 1 |
@@ -65,7 +65,7 @@ DNS, Digital Signage, Networking, Status, Tech Support, Web Hosting, Marketplace
 
 ### ops.itpropartner.com (152.53.192.33) — Technical Hub
 - `/` — Operations Dashboard (port 8090)
-- `/grafana/` — Grafana (Core :3002)
+- `/grafana/` — Grafana (Core :3002) — **NOT CONFIGURED in Caddy. Internal access via `http://core:3002` only. Public subdomain `grafana.itpropartner.com` has no DNS record.**
 - `/uptime/` — Uptime Kuma (Core :3001)
 - `/gitea/` — Gitea (app2 :3000)
 - `/n8n/` — n8n (app1 :5678)