category: reference
tags: [dev, vps, ops, v7]
last_updated: 2026-03-15
confidence: high

V7 Operational Hardening

Ansible roles for backup, health checks, logging, and disk monitoring on the robot.wtf VPS. Run via ansible-playbook -i ansible/inventory.yml ansible/v7-harden.yml.

Roles

backup (roles/backup/)

SQLite .backup cron every 4 hours. Backs up robot.db and mcp_oauth.db to /srv/backups/. Prunes after 7 days. Uses sqlite3 .backup (handles WAL mode correctly without stopping services). VM-level backups via Proxmox snapshots are configured separately.

healthcheck (roles/healthcheck/)

Per-minute cron checks all services: systemctl is-active + curl localhost:port for ports 8000-8003 and 8001. Emails via msmtp/Gmail on failure.

logging (roles/logging/)

Configures systemd-journald: 500MB max, 200MB keep-free, 30-day retention. All services use StandardOutput=journal.

diskmon (roles/diskmon/)

Hourly cron checks disk usage on / and /srv. Warns at 80%, critical at 90%. Emails via same msmtp config.

Prerequisites

Set smtp_user, smtp_password, and alert_email in ansible/group_vars/all/vault.yml (encrypted) before running the hardening playbook.

Semantic Search Switch

Switched from ChromaDB (server mode on port 8004) to FAISS + ONNX MiniLM embedding. ChromaDB service disabled. See Tasks/Semantic_Search_Multi_Tenant for the multi-tenant indexing issue.