VHNIC Retention Policy
Last updated: 2026-06-22
This project is the local memory bank for the home infrastructure. It should
keep enough information to troubleshoot, rebuild, and hand off work without
keeping raw logs forever.
Rules
- Keep human-readable summaries longer than raw logs.
- Keep helper scripts, handoff docs, topology docs, and current-state docs.
- Treat
.ps1helper scripts as protected assets. Do not delete scripts unless - Do not delete, prune, repair, wipe, or reformat anything without explicit
- Do not modify
/volume1/data/media/personal. - Do not store secrets in incident summaries, registers, or tracked docs.
- Prefer dry-run cleanup reports before any deletion.
- Long-term summary: keep in
INCIDENT_REGISTER.mdand - Raw evidence: keep in
incidents/<date-topic>/evidence/only while it is - Prometheus retention: 30 days.
- Observability Docker logs:
10mmax size and3files per container. - Pi-hole Teleporter backups: 30 days.
- NZBHydra2 config backups: every 7 days, delete after 2 weeks.
- Keep the latest privileged Synology security audit and cross-system inventory
- Failed or superseded security-review captures can be removed after the
- Keep
synology/support-cases/20260614-volume1-btrfs-md2/and related - Treat the included diagnostic folders as active storage-integrity evidence,
- Keep
synology/storage/VOLUME1_REBUILD_MIGRATION_PLAN.md, migration helper - Do not treat
/volume4/migration-from-volume1as disposable cleanup data reports/weekly-maintenance/20260621-073001/retention-cleanup-dry-run.txt- Keep current weekly baselines from 2026-06-21 and retain pre/post change
- require an explicit
-Applystyle switch, - print every path before deletion,
- verify every resolved path is inside the VHNIC workspace,
- avoid
.ps1,.md,.json,.yaml,.yml,.toml,.env, and
the exact script path is explicitly approved.
approval for the exact target.
Incident Evidence
Incident evidence is split into two layers:
incidents/<date-topic>/SUMMARY.md.
useful for an active investigation or post-incident review.
Default retention:
| Evidence Type | Default Retention |
| Active unresolved incident raw evidence | Until resolved, then 30-90 days |
| Resolved incident raw logs and command output | 30 days |
| Storage integrity incidents | 180 days unless summarized enough to remove sooner |
| Security/access incidents | 180 days |
| Performance baselines | Keep latest known-good plus one before/after comparison |
Per-incident SUMMARY.md files | Keep indefinitely |
Top-level INCIDENT_REGISTER.md | Keep indefinitely |
| Snapshot Type | Default Retention |
| Latest known-good inventory per area | Keep |
| Baseline after major configuration change | Keep |
| Failed/incomplete capture attempts | Delete after approval once superseded |
| Duplicate routine captures | Keep newest 3-5 per area unless useful |
| UniFi/Pi-hole/DNS config baselines | Keep current baseline and one prior baseline |
| System | Retention Target |
| Prometheus metrics | 30 days now; consider 90 days only if useful |
| Grafana dashboards/config | Keep as project source plus appdata backup |
| Tautulli history | Keep in Tautulli; do not export raw history unless needed |
| Plex diagnostic pulls | Keep as incident raw evidence, not routine archive |
| Tdarr audit pulls | Keep while rollout/error pattern is active, then summarize |
| Pi-hole Teleporter backups | 30 daily copies; optional 6-12 monthly copies later |
| Google Cloud DNS snapshots | Keep current baseline and previous baseline |
| UniFi snapshots | Keep current baseline and previous baseline |