- F-01: document the enforced DOCKER-USER firewall on :8080 (Traefik and
host RETURN, DROP everyone else), its persisting unit
nestquest-api-firewall.service, and operator verification commands;
restore step 6 no longer suggests hitting :8080 from the HA box.
- F-02: restore step 5 uses `dc up -d litestream` so the sidecar is
created on a fresh box instead of `dc start`, which cannot start a
never-created container.
- F-03: pin both reference routers to the `websecure` entrypoint.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add deploy/RUNBOOK.md: the operator procedure to rebuild the API
deployment end to end (image build, compose and the nestquest-db
volume, Traefik TLS and routing on nukapi-03, Authentik OIDC, secrets,
network separation, Litestream backup), restore the database from the
SFTP replica, and verify the result. Point api/README.md at it.
The restore steps were rehearsed locally against a file replica using
the committed compose file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
overseerandClaude Opus 5.5