age backups everywhere

ansible/group_vars/all/main.yml

@@ -7,3 +7,10 @@ root_domain: contrapeso.xyz
 # playbooks are kept deliberately — the check logic is meant to be rewired to
 # whatever replaces it. This flag keeps them inert until then. See archive/uptime_kuma/.
 uptime_kuma_enabled: false
+
+# age recipient for all backup artefacts
+age_backup_recipient: "age192wwdaseqej2ggwyp884gtm05c396anp7chr0vr8m47g50fahpyqr9fsza"
+
+# Public key small-backups-box pulls with
+# Authorised on each source host for an unprivileged, dedicated user only
+backup_pull_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfIixKMhA9z+Nvyx6ToZIniC8aEgyiInRiboaTTemgX offsite-backup-pull"

ansible/group_vars/nodito_vms.yml

@@ -2,16 +2,23 @@
 # Reach the VMs over Tailscale, and fall back to the LAN if the tailnet is down.
 #
 # ansible_host is a MagicDNS name. If tailscaled is not running on the control
-# node that name does not resolve, so `nc %h %p` fails fast and the second nc
-# takes over on the LAN address recorded as lan_ip in inventory.ini.
+# node that name does not resolve, the probe fails, and the LAN address recorded
+# as lan_ip in inventory.ini takes over.
 #
-# This is safe against the LAN addresses drifting again (which is how
-# fulcrum/mempool came to be transposed): known_hosts is keyed to the MagicDNS
-# NAME, so if lan_ip ever points at a different machine the host key will not
-# match and ssh aborts. Verified 2026-09-12 by pointing fulcrum-box at
-# mempool-box's address: "Host key verification failed."
+# Why the probe-then-connect shape rather than a plain `nc -w5 %h %p`:
+# netcat-openbsd's -w is an IDLE timeout as well as a connect timeout, so a
+# single `nc -w5` silently tears down the SSH session after five quiet seconds.
+# That produced intermittent "Data could not be sent to remote host" failures on
+# exactly the long, quiet operations (apt) where a dropped connection costs most.
+# `nc -z` probes, then `exec nc` carries the session with no timeout at all.
+#
+# Safe against the LAN addresses drifting again (which is how fulcrum/mempool
+# came to be transposed): known_hosts is keyed to the MagicDNS NAME, so if
+# lan_ip ever points at a different machine the host key will not match and ssh
+# aborts. Verified by pointing fulcrum-box at mempool-box's address:
+# "Host key verification failed."
 #
 # lan_ip is a convenience, not an identity. If it goes stale the fallback stops
 # working; it will never connect you to the wrong box.
 ansible_ssh_common_args: >-
-  -o ProxyCommand="sh -c 'nc -w2 %h %p 2>/dev/null || nc -w4 {{ lan_ip }} %p'"
+  -o ProxyCommand="sh -c 'nc -z -w5 %h %p 2>/dev/null && exec nc %h %p || exec nc {{ lan_ip }} %p'"