Completing Phase 9: Private File Access and Sync

Phase 9 of my Cyber Operations Center Engineering Program is complete. The final acceptance session crossed the UTC date boundary: September 10 in Toronto (EDT, UTC−04:00), September 11 in the server logs.

One private entry point

Nextcloud 34.0.3 runs on Atlas with Apache, PostgreSQL, Redis and a separate cron container. Clients use Tailscale and private DNS to reach a consistent canonical HTTPS hostname through Caddy. The application listens on loopback behind the proxy. Private connectivity, name resolution and certificate trust are all part of making that path usable.

Security controls with observed results

Wazuh file-integrity monitoring produced a real alert, and ClamAV integration was tested with EICAR. Two-factor authentication and outbound email work. The Windows 11 laptop is configured, including Virtual Files, and the Windows 10 client is complete.

A backup had to become a restore

The dedicated encrypted Restic system has a proven backup and database restore. Integrity checking reported no errors, and retention/prune was tested. Daily backup runs at 02:30 UTC, retention at 04:30 UTC, and the weekly integrity check at 05:30 UTC on Sundays. Retention keeps 7 daily, 4 weekly and 3 monthly snapshots; persistent timers recover missed schedules.

The reboot was the final acceptance check

After restarting Atlas, the application and cron containers returned, PostgreSQL and Redis were healthy, and Nextcloud reported maintenance off with no database upgrade needed. Tailscale, Caddy, ClamAV and the backup timers recovered. I then opened the canonical site from Windows, signed in and accessed my files.

Keeping completion finite

The Galaxy S25 and Galaxy Tab A11 are intentionally deferred for Nextcloud onboarding. They are not Phase 9 blockers. Phase 8.5 also remains a separate Cerberus-dependent workstream. Phase 10 is planned; finishing this service does not automatically start another build.

The lesson is practical: a service is ready when I can use it, observe it, recover it and trust it to return after a reboot. Optional device work can stay on the backlog without reopening that result.

Read the Phase 9 completion record ↗