docs: update Netgrimoire/Pocket/Deployment_Guide

Netgrimoire/Pocket/Deployment_Guide.md

@@ -2,7 +2,7 @@
 title: Pocket Grimoire 
 description: 
 published: true
-date: 2026-02-21T06:10:17.060Z
+date: 2026-02-21T16:33:03.912Z
 tags: 
 editor: markdown
 dateCreated: 2026-02-20T04:41:35.122Z
@@ -287,6 +287,7 @@ Headroom: 78W
     └── vault.vc
 
 /srv/greenpg/                      # GREEN SSD (personal, rotated)
+└── Pocket/                        # Dataset received from vault/Green/Pocket
     ├── media/library/             # Personal media files
     │   ├── movies/
     │   └── tv/
@@ -695,25 +696,49 @@ du -sh /mnt/pocket-vault/
 **Perform initial sync to GREEN:**
 ```bash
 # On Netgrimoire
-# Sync personal media and Stash data from /export/vault/Green/
+# You have an existing encrypted dataset: vault/Green/Pocket
+# This contains your personal media and will include Stash data
 
-# Sync entire Green directory structure
+# First, verify the dataset exists and its size
-sudo rsync -avP --exclude='cache' \
+zfs list vault/Green/Pocket
-  /export/vault/Green/ \
+# Should show: vault/Green/Pocket  5.01T  2.49T  5.01T  /export/Green/Pocket
-  /mnt/pocket-green/
 
-# Or use ZFS send/receive for atomic snapshot (if Green is a ZFS dataset)
+# Create snapshot for initial send
-sudo zfs snapshot vault/Green@initial
+sudo zfs snapshot vault/Green/Pocket@initial
-sudo zfs send vault/Green@initial | \
-  sudo zfs receive pocket-green/Green
 
-# Verify data
+# Send to pocket-green pool
-ls -lh /mnt/pocket-green/
+# Note: This sends the encrypted data, pocket-green will have its own encryption
-ls -lh /mnt/pocket-green/media/library/
+sudo zfs send vault/Green/Pocket@initial | \
-ls -lh /mnt/pocket-green/stash/
+  sudo zfs receive pocket-green
-du -sh /mnt/pocket-green/
+
+# This creates: pocket-green/Pocket (matching the structure)
+
+# Verify received
+zfs list pocket-green/Pocket
+ls -lh /mnt/pocket-green/Pocket/
+
+# The data structure should now be:
+# /mnt/pocket-green/Pocket/
+# ├── media/library/
+# │   ├── movies/
+# │   └── tv/
+# └── stash/
+#     ├── config/
+#     ├── generated/
+#     └── blobs/
+
+# Verify data integrity
+du -sh /mnt/pocket-green/Pocket/
 ```
 
+**Important notes:**
+- The `vault/Green/Pocket` dataset is encrypted on Netgrimoire
+- `zfs send` transfers the data (decrypted during send)
+- `pocket-green` pool has its own encryption (encrypts during receive)
+- Result: Data is encrypted at rest on both systems with different keys
+- The dataset name becomes `pocket-green/Pocket` (not `pocket-green/Green/Pocket`)
+
+
 **Populate MEDIA-FAMILY (optional - curate family content):**
 ```bash
 # On Netgrimoire
@@ -780,7 +805,11 @@ zpool list
 # Set proper mount points
 sudo zfs set mountpoint=/srv/vaultpg vaultpg
 sudo zfs set mountpoint=/srv/greenpg greenpg
-# Or for family drive:
+
+# For the Pocket dataset (received from vault/Green/Pocket)
+sudo zfs set mountpoint=/srv/greenpg/Pocket greenpg/Pocket
+
+# Or for family drive (when you swap):
 # sudo zfs set mountpoint=/srv/mediapg mediapg
 
 # Create mount points
@@ -796,12 +825,13 @@ sudo zfs mount -a
 df -h | grep srv
 # Should show:
 # vaultpg          mounted on /srv/vaultpg
-# greenpg  mounted on /srv/greenpg (or mediapg on /srv/mediapg)
+# greenpg          mounted on /srv/greenpg
+# greenpg/Pocket   mounted on /srv/greenpg/Pocket
 
 # Verify data
 ls /srv/vaultpg/
-ls /srv/greenpg/media/library/
+ls /srv/greenpg/Pocket/media/library/
-ls /srv/greenpg/stash/
+ls /srv/greenpg/Pocket/stash/
 # Or for family:
 # ls /srv/mediapg/library/
 ```
@@ -813,6 +843,7 @@ ls /srv/greenpg/stash/
 
 sudo zfs set canmount=noauto vaultpg
 sudo zfs set canmount=noauto greenpg
+sudo zfs set canmount=noauto greenpg/Pocket
 sudo zfs set canmount=noauto mediapg  # For when you swap to family drive
 
 # Pools will need manual unlock via SSH after boot
@@ -1904,7 +1935,61 @@ docker ps
 
 **If anything fails during this test, debug at home before traveling!**
 
-### 10. Verify Data Synced from Netgrimoire
+### 10. Configure Ongoing ZFS Sync (After Initial Setup)
+
+**Once drives are on Pocket Grimoire, set up ongoing sync from Netgrimoire:**
+
+```bash
+# On Pocket Grimoire
+# Create ZFS replication script
+
+sudo nano /usr/local/sbin/pocketgrimoire-zfs-pull.sh
+```
+
+```bash
+#!/usr/bin/env bash
+set -euo pipefail
+
+SRC_HOST="netgrimoire.local"
+SSH_KEY="/srv/pocket-grimoire/keys/zfs_pull_ro"
+
+# Sync GREEN/Pocket dataset (personal media + Stash)
+# This pulls incremental changes from vault/Green/Pocket to greenpg/Pocket
+syncoid --no-sync-snap \
+  --sshkey "${SSH_KEY}" \
+  "root@${SRC_HOST}:vault/Green/Pocket" \
+  "greenpg/Pocket"
+
+# Note: VAULT and MEDIA-FAMILY don't sync ongoing
+# VAULT: Contains backups only, managed separately
+# MEDIA-FAMILY: Manually updated when needed
+```
+
+```bash
+sudo chmod +x /usr/local/sbin/pocketgrimoire-zfs-pull.sh
+```
+
+**This sync runs every 6 hours automatically and:**
+- ✅ Syncs `/export/Green/Pocket/` from Netgrimoire
+- ✅ Includes personal media updates
+- ✅ Includes Stash database changes
+- ✅ Includes new previews/blobs
+- ✅ Only transfers incremental changes (fast)
+
+**Test sync manually:**
+```bash
+# Unlock pools first
+/usr/local/sbin/unlock-pocket-grimoire.sh
+
+# Run sync
+sudo /usr/local/sbin/pocketgrimoire-zfs-pull.sh
+
+# Check for new data
+zfs list greenpg/Pocket
+du -sh /srv/greenpg/Pocket/
+```
+
+### 11. Verify Data Synced from Netgrimoire
 ```bash
 # Check VAULT data present (backups only)
 ls /srv/vaultpg/kopia/
@@ -1913,19 +1998,19 @@ ls /srv/vaultpg/repos/
 du -sh /srv/vaultpg/
 
 # Check GREEN data (personal media + Stash)
-ls /srv/greenpg/media/library/
+ls /srv/greenpg/Pocket/media/library/
-ls /srv/greenpg/stash/
+ls /srv/greenpg/Pocket/stash/
-du -sh /srv/greenpg/
+du -sh /srv/greenpg/Pocket/
 
 # Or check MEDIA-FAMILY data (if that drive is connected)
 ls /srv/mediapg/library/
 du -sh /srv/mediapg/
 
 # Verify Stash database and previews (only on GREEN)
-ls -lh /srv/greenpg/stash/config/
+ls -lh /srv/greenpg/Pocket/stash/config/
 # Should show: stash-go.sqlite
 
-ls /srv/greenpg/stash/generated/ | wc -l
+ls /srv/greenpg/Pocket/stash/generated/ | wc -l
 # Should show: hundreds of preview files
 ```