backup(books-vds): daily 06:00 MSK pipeline to kreknin live 🟢

- scripts/books-vds-backup-daily-kreknin/ — run.sh + .env.example + README
- ES path.repo bootstrap (one-time stack edit, snapshot repo 'kreknin' registered)
- curl smtps://yandex:465 email (CRLF + Date headers, no msmtp dep on CentOS 7)
- StrictHostKeyChecking=yes + pre-populated known_hosts (CentOS 7 no accept-new)
- cron /etc/cron.d/books-vds-backup live, initial sync 4.87 GB in 13m28s, ntfy push sent
- wiki: entities/books-vds.md + sources/books-vds-backup-daily-kreknin-2026-05-25.md created
- wiki: concepts/books-ssh-access → vds-kzntsv-ssh-access (was lying about books on vds-kzntsv)
- .tasks/books-vds-backup-daily-kreknin.md closed 🟢 pending phone-side verify

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.wiki/entities/books-vds.md

@@ -0,0 +1,109 @@
+---
+title: Books VDS (client server — 89.253.255.133)
+type: entity
+tags: [hardware, vds, books, host4g, backup, portainer]
+related: [[kreknin-synology]], [[vds-kzntsv]]
+updated: 2026-05-25
+---
+
+# Books VDS
+
+Клиентский VDS (отдельный от инфра-VDS [[vds-kzntsv]]). Хостит production books app stack (api/web/scheduler/task-runner) + shared infra (mongo, minio, elasticsearch, traefik, portainer).
+
+**Это НЕ vds-kzntsv.** Books-стек живёт здесь, не на vds.kzntsv.site. Domain `books.kzntsv.site` (и `bookva.kzntsv.site`) разрешаются в этот IP.
+
+## Доступ
+
+- **Public IP:** 89.253.255.133
+- **Provider:** host4g.ru (DNS вендорский `vps-21075162-277731.host4g.ru`)
+- **OS:** CentOS 7, kernel 3.10.0-1160.36.2.el7.x86_64 (древний, EOL)
+- **SSH:** `root@89.253.255.133:22` — only via ed25519 key (`~/.ssh/id_ed25519_books_ops` на workstation)
+- **Sudo:** root, passwordless (мы под root напрямую)
+- **Portainer:** `https://portainer.kzntsv.site` (отдельный Portainer, не путать с `portainer.vds.kzntsv.site` для [[vds-kzntsv]])
+
+Все creds — в `pass show books-vds/full-env`.
+
+## Disk
+
+```
+/dev/vda1   122G   59G used (49%)   63G free
+```
+
+Single root partition, нет отдельной `/data`. Docker hub data под `/var/lib/docker/`.
+
+## Стек (2026-05-25 inventory)
+
+### Portainer-managed stacks (endpoint 1)
+
+| Stack | Container(s) | Purpose |
+|---|---|---|
+| `books-api` | books-api | books API server (Nitro, port 3021) |
+| `books-web` | books-web | books-Nuxt front-end |
+| `books-job-scheduler` | books-job-scheduler + books-job-scheduler-mongo | agenda jobs (cron + on-demand) |
+| `books-ntfy` | books-ntfy | local ntfy (separate from shared `ntfy.vds.kzntsv.site`) |
+| `books-ops-mcp` | books-ops-mcp + books-ops-mcp-bootstrap-1 + books-docker-proxy + books-docker-proxy-ro | books ops-mcp endpoint |
+| `chrome` | chrome | Puppeteer browser for PDFs / scraping |
+
+### SSH-managed (legacy compose at `/usr/docker/<svc>/`)
+
+| Compose dir | Containers | Bind data path |
+|---|---|---|
+| `/usr/docker/books-db/` | books-db | `./data` → `/var/lib/mysql` (MariaDB 10.6.4) |
+| `/usr/docker/mongo/` | mongo | `./data/{db,configdb}` |
+| `/usr/docker/minio/` | minio | `./data` (S3 blobs) |
+| `/usr/docker/elasticsearch/` | elasticsearch | `./data` + `./snapshots` (added 2026-05-25) |
+| `/usr/docker/traefik/` | traefik | `./letsencrypt` (acme.json) + `./data/traefik.yml` |
+| `/usr/docker/portainer/` | portainer | named volume `portainer_data` |
+| `/usr/docker/proxy-chain/` | proxy-chain | upstream HTTP-proxy chain |
+
+**TODO**: мигрировать максимум SSH-managed контейнеров под Portainer (отдельная таска после backup-pipeline live). Cause: разделённое управление обламывает CI (Portainer-only deploy.yml) и debugging.
+
+### Build helpers (transient)
+
+- `buildx_buildkit_builder-*` × 7 — buildkit builders, oneshot за `docker buildx`. Не data.
+
+## App-config paths
+
+```
+/opt/books/api/{config,data,upload}
+/opt/books/job-scheduler/{config,mongo/{db,configdb}}
+/opt/books/task-runner/
+/opt/books/ntfy/                # local ntfy data
+/opt/books/books-ops-mcp/
+```
+
+`config/default.json` overrides image-baked config (MySQL/ES/S3 endpoints).
+
+## Backup
+
+Daily 06:00 MSK → kreknin. См. [[../sources/books-vds-backup-daily-kreknin-2026-05-25]]. Pipeline:
+- DB dumps: books-db (mariadb), mongo (shared), books-job-scheduler-mongo
+- ES snapshot via REST API (file repo `kreknin`)
+- rsync bind paths + dumps + `/opt/books/` + `/etc/{ssh,hosts,cron.d}` + `/root/.ssh` → `vitya@kreknin:/volume1/NetBackup/books-vds/<date>/`
+- ntfy `BOOKS-VDS backup OK <date>` + email
+- Retention 7 daily snapshots
+
+Live since 2026-05-25.
+
+## DNS
+
+- `books.kzntsv.site` → 89.253.255.133 (`books-api` host route via local traefik)
+- `bookva.kzntsv.site` → 89.253.255.133 (`books-web` host route)
+- `elasticsearch.kzntsv.site` → 89.253.255.133 (ES via traefik basicAuth)
+- `portainer.kzntsv.site` → 89.253.255.133 (Portainer UI)
+- `edge.kzntsv.site` → 89.253.255.133 (Portainer edge agent)
+
+Auth-зоны DNS — в reg.ru под `kzntsv.site`.
+
+## Cross-refs
+
+- [[kreknin-synology]] — backup target.
+- [[vds-kzntsv]] — наш инфра-VDS (отдельный, gitea/registry/etc.) — НЕ хост books'а.
+- [[../concepts/vds-kzntsv-ssh-access]] — SSH-аудит инфра-VDS (был misnamed как `books-ssh-access` до 2026-05-25; ошибочно claimed vds-kzntsv hosts books).
+- [[../sources/books-vds-backup-daily-kreknin-2026-05-25]] — backup standup chronology.
+
+## Каking-of-history notes
+
+- Discovered 2026-05-25 во время backup-таски. Wiki [[../concepts/books-ssh-access]] до этого ошибочно говорила что books на vds-kzntsv (89.253.255.94). User: «books VDS - это совсем другой сервер, клиентский». Inventory + IP probe confirmed.
+- Workstation SSH key `id_ed25519_books_ops` уже был задеплоен под root до этой сессии (видимо, прошлый bootstrap забыт-без-документации).
+- Hybrid stack-management (Portainer + SSH-compose) — pre-existing, не наш design. Migrate to Portainer-only — follow-up.