Goal
Make production mail storage recoverable after total Hetzner host loss while retaining strong encryption and repeatable operations.
Scope
- Move the LUKS2 image onto a dedicated Hetzner volume with monitored capacity.
- Add authenticated, client-side encrypted off-host backups to S3 using an established repository format.
- Snapshot SQLite consistently before backup.
- Add automated retention, integrity checks, and restore drills.
- Keep S3 SSE-KMS as defense in depth.
- Add a second recovery keyslot with custody independent from AWS.
- Use a customer-managed KMS key and least-privilege policies for the operational secret and backup objects.
- Document boot unlock, restore, key rotation, and break-glass recovery.
Acceptance criteria
- Dedicated volume survives instance replacement.
- Latest off-host backup is less than 24 hours old.
- Backup contents are encrypted and authenticated before upload.
- Automated check and isolated restore succeed.
- Volume usage alerts before 70/85/95%.
- Two independently held LUKS keyslots verify.
- Production lock/unlock and reboot recovery are tested.
- Runbook and reusable commands are committed.