Masterplan Optimiser
Root & controller

Operator Guide

Server Overview

Choose the deployment model deliberately, understand which copies protect which failures, and know what MP-OPT can and cannot recover.

Two supported deployment models

Choose the deployment that matches the risk

Both models require an external recovery copy. HA adds availability, dependencies, and commissioning duties.

Standalone

One VPS serves the application and PostgreSQL

  • Simpler to deploy and operate
  • Host failure requires a restore or rebuild
  • External snapshot is the disaster-recovery path

VPS A

Either node may hold the lease

VPS B

Recent accepted recovery point

  • Survives one VPS loss after qualified failover
  • Requires witness, load balancer, replication, and alerts
  • Still requires an independent external snapshot
ModelProtects againstOperator obligations
StandaloneApplication mistakes and VPS loss when a verified portable recovery snapshot exists.Export fresh snapshots and keep the private recovery identity off the VPS.
Symmetric two-node HALoss of either VPS, with automatic or planned ownership transfer.Maintain Cloudflare witness/routing, monitor replication, certify the pair, and retain an independent recovery snapshot.

Recovery objectives

  • Replication interval: configurable from 5 to 1440 minutes; default 15 minutes.
  • RPO: all writes after the last complete peer copy may be lost.
  • Automatic failover time: roughly five minutes, plus local promotion and Cloudflare health/routing delay.
  • Witness outage: reads remain possible on the last holder, but writes fail closed to prevent split brain.

Three independent resilience layers

Availability, recent redundancy, and disaster recovery solve different problems and must not be treated as interchangeable.

1. Live service

The holder serves requests. In HA, either VPS may hold the writer lease.

2. Peer recovery point

A recent accepted complete bundle supports failover after one VPS is lost.

3. External recovery copy

An independently encrypted and verified snapshot protects against both VPSs, corruption, and operator mistakes.

HA can rapidly copy a bad change to the peer. Only an older independent recovery point lets an operator return to an earlier known-good state.

What changed from the older server guides

  • Production configuration is now performed through the guarded mp-opt wizard rather than hand-editing secrets into .env.
  • Application, VAPID, root-bootstrap and optional SMTP credentials use protected Docker secret files.
  • Root recovery, database wipe, secret rotation and restore create and deep-verify rollback snapshots before mutation.
  • Recovery archives use age-encrypted v2 manifests/receipts and can be exported as portable workstation files.
  • Two-node deployments are symmetric and provider-neutral; a Cloudflare witness, not a permanently named primary, controls writing.
  • The root web interface now separates Security, High Availability and Audit Log.

Two different kinds of snapshots

Schedule-history snapshots are created when a desktop schedule is published. They restore one event's schedule through the web History tab.

Recovery snapshots are encrypted operator archives created through mp-opt. They can contain the PostgreSQL database, configuration and shared secrets and are used for infrastructure recovery.

Continue