# Rebuild runbook: bare metal to working Brain

## Recovery sources

```text
data_NAS/_brain_backup/baseline/current/tree/
bart_NAS/_brain_backup/baseline/current/tree/
data_NAS/_brain_backup/rolling/<snapshot-id>/tree/
bart_NAS/_brain_backup/rolling/<snapshot-id>/tree/
```

Never restore `.partial-*`. A valid snapshot contains `.complete`.

## 1. Install Ubuntu

Install in UEFI mode with username `bart` and hostname `brain`. Do not format a surviving data disk.

```bash
sudo apt update
sudo apt upgrade -y
sudo apt install -y build-essential git curl python3-venv python3-pip cifs-utils rsync uuid-runtime util-linux timeshift
```

## 2. Mount the data disk

```bash
sudo blkid
sudo mkdir -p /mnt/data
sudo nano /etc/fstab
sudo mount -a
findmnt /mnt/data
```

Fstab entry:

```text
UUID=<data-uuid> /mnt/data ext4 defaults 0 2
```

## 3. Restore swap

```bash
sudo fallocate -l 32G /swap-tabby.img
sudo chmod 600 /swap-tabby.img
sudo mkswap /swap-tabby.img
sudo swapon /swap-tabby.img
echo '/swap-tabby.img none swap sw 0 0' | sudo tee -a /etc/fstab
```

## 4. NVIDIA and MOK

```bash
sudo ubuntu-drivers autoinstall
sudo reboot
```

At the physical console, enroll MOK. Verify with:

```bash
nvidia-smi
mokutil --sb-state
```

Restore the 280 W power-limit service.

## 5. Restore platform services

Install Tailscale, Ollama, BGE-M3, and TabbyAPI. Verify Ollama embeddings and the authenticated TabbyAPI model ID. Use Tailscale Serve, never Funnel.

## 6. Mount NAS shares

```bash
sudo mkdir -p /mnt/data_NAS /mnt/bart_NAS
sudo chown bart:bart /mnt/data_NAS /mnt/bart_NAS
sudo chmod 755 /mnt/data_NAS /mnt/bart_NAS

sudo mount -t cifs //192.168.1.67/data_NAS /mnt/data_NAS   -o credentials=/etc/samba/nas-credentials,uid=1000,gid=1000,forceuid,forcegid,file_mode=0644,dir_mode=0755,vers=3.0,noserverino

sudo mount -t cifs //192.168.1.67/bart_NAS /mnt/bart_NAS   -o credentials=/etc/samba/nas-credentials,uid=1000,gid=1000,forceuid,forcegid,file_mode=0644,dir_mode=0755,vers=3.0,noserverino

findmnt /mnt/data_NAS
findmnt /mnt/bart_NAS
```

## 7. Restore data

```bash
sudo rsync -a --numeric-ids   /mnt/data_NAS/_brain_backup/baseline/current/tree/   /mnt/data/
```

If inappropriate, inspect `baseline/previous` and completed rolling snapshots first.

## 8. Restore home

```bash
sudo rsync -a   /mnt/bart_NAS/_brain_backup/baseline/current/tree/   /home/bart/
sudo chown -R bart:bart /home/bart
```

Confirm `brain`, `brain-web`, `brain-test`, and `signals-agent` exist.

## 9. Rebuild derivatives

Rebuild every venv from its lock or requirements file. Rebuild Chroma from `/mnt/data/Library`. Do not restore copied venvs or an old Chroma index.

## 10. Restore application services

Restore/recreate required units and secrets. `brain-web.service` must load both configuration and secrets environment files. Enable services and restore Tailscale Serve paths.

## 11. Restore the backup system

Required files:

```text
/usr/local/sbin/brain-backup
/usr/local/sbin/brain-backup-all
/usr/local/sbin/brain-backup-promote
/etc/brain-backup/data.conf
/etc/brain-backup/home.conf
/etc/systemd/system/brain-backup.service
/etc/systemd/system/brain-backup.timer
```

The service must contain one backup entry point:

```text
ExecStart=/usr/local/sbin/brain-backup-all
```

Do not use separate sequential `ExecStart=` lines for data and home. The dispatcher always attempts both and fails the overall service if either fails.

Verify and enable:

```bash
sudo bash -n /usr/local/sbin/brain-backup-all
sudo systemd-analyze verify   /etc/systemd/system/brain-backup.service   /etc/systemd/system/brain-backup.timer
sudo systemctl daemon-reload
sudo systemctl enable --now brain-backup.timer
systemctl is-enabled brain-backup.timer
systemctl is-active brain-backup.timer
systemctl list-timers brain-backup.timer --all
sudo systemctl cat brain-backup.service
```

Warnings naming unrelated XFS scrub units are benign. Resolve messages naming Brain backup units.

Test:

```bash
sudo systemctl start --no-block brain-backup.service
sudo tail -f /mnt/data/backup/events.log
```

Both jobs must write an event even if one fails. `inactive (dead)` after a successful oneshot run is normal.

## 12. Configure Timeshift

Use RSYNC mode, snapshot storage on `/dev/sda1`, exclude `/home/**` and `/mnt/data/**`, and retain three daily snapshots.

```bash
sudo timeshift --create --comments "known-good after rebuild" --tags O
sudo timeshift --list
```

## 13. End-to-end proof

- Verify `/mnt/data/Library` and `/mnt/data/memory`.
- Verify the four home projects.
- Run ingestion and inspect corpus counts.
- Ask a known question through CLI and Brain Web.
- Run the Brain test suite.
- Confirm recent backup events and both approved baselines.
- Record elapsed rebuild time and every improvised step.

## Limitations

This runbook cannot prove content correctness, NAS internal replication, retrieval quality, future MOK survival, or resilience against a shared physical event. Perform a real scratch restore after material recovery-system changes.