Added the backups paths to the README

1 files changed, 25 insertions, 0 deletions

diff --git a/README.md b/README.md
index d98fdb3..e8b64f2 100644
--- a/README.md
+++ b/README.md
@@ -345,3 +345,28 @@ All other ports are closed at the firewall. App-level ports (5006, 5230, 8080, 8
 127.0.0.1 and never exposed directly. AdGuard's web UI (3000) binds all interfaces (required
 so its DoH/DoT listener - which shares the same bind host - reaches the public interface),
 but stays unreachable externally because the firewall never opens port 3000.
+
+---
+
+## Backup Notes
+
+This server relies on Hetzner's rolling Cloud Backups (whole-disk snapshots) for disaster
+recovery. Two things are *not* at risk from server loss regardless of that: the OS and every
+service's configuration are fully reconstructable from this repo via `nixos-anywhere` +
+`nixos-rebuild`, and the repo itself (including encrypted secrets in `secrets/secrets.yaml`) is
+already mirrored off-server at `git@gitlab.com:KaranJayachandra/feynman.git`.
+
+What Hetzner's snapshots don't give you is selective or offsite recovery of runtime-generated
+application data - restoring means restoring the whole disk, and the backups live in the same
+Hetzner account as the server. If you ever add an independent (offsite) backup job, these are
+the paths that actually matter, per service:
+
+- **Miniflux** - `/var/lib/postgresql/` (the module's default `services.postgresql`
+  integration). It's a live database, not a flat file - snapshot it with `pg_dump`, not a raw
+  file copy.
+- **Actual Budget** - `/var/lib/actual`.
+- **cgit** - `/srv/git` (the bare repos).
+- **Memos** - `/var/lib/memos` (sqlite database).
+- **AdGuard Home** - `/var/lib/AdGuardHome`, low priority: `mutableSettings = false` means the
+  config is fully regenerated from this repo on every service start, so nothing there is
+  irreplaceable except transient query logs/stats.