# nuc pull leg — seed after FTTH

Status: **prepared, waiting on the FTTH link.** Everything is already
configured on nuc (see the main [README](../README.md)): incus remote
`ks4` over the WireGuard tunnel (`wg-ks4`, 10.8.0.20 → 10.8.0.1),
target pool `ks4backup` on the USB ZFS pool (`usb4t/backup/ks4`) —
only the seed itself waited on bandwidth.

## Seed (root on nuc)

```sh
# sanity: remote reachable through the tunnel
incus list ks4: | head

# full pull of every ks4 instance into pool ks4backup (screen/tmux —
# first pass moves ~1.7 T through the WG tunnel)
/root/scripts/incus-copy.sh -r ks4 -s ks4backup 2>&1 | tee -a /var/log/incus-copy-ks4.log
```

Notes:

- First pass is a full send per instance; later refreshes are
  ZFS-incremental **as long as they run at least every
  `snapshots.expiry` (7 d on ks4)** — same caveat as
  [ks4's local leg](../ks4/local-backup-cron.md).
- Replicas arrive stopped with `boot.autostart=false` (script does
  this) — they must never come up on the LAN with ks4's proxy devices.

## Cron (after the seed)

Add to nuc's root crontab, offset from the 03:30 local nucbackup copy
and ks4's own 01:00/04:30 jobs:

```cron
0 5 * * * /root/scripts/incus-copy.sh -r ks4 -s ks4backup >> /var/log/incus-copy-ks4.log 2>&1
```

## Verification (release gate for ks2)

```sh
incus list --project backup 2>/dev/null || incus list | grep -c .   # all ks4 instances present
# test-restore one instance: copy a replica to the default pool,
# start it isolated, check the service answers, then delete it
incus copy solar solar-restoretest -s default
incus start solar-restoretest && incus exec solar-restoretest -- systemctl is-system-running
incus delete -f solar-restoretest
```

Once verified, tick the nuc gate in the [ks2 plan](plan.md).