3
mirror layers: cold, warm, hot
E2 Mirror · If We Get Hacked, We Stay Online
This page is our mirror plan, written in public. How every site in the E2 universe, our Discord, and Starvard get a second home on different accounts, different providers, and different domains, so one bad hack, one deleted account, or one wiped machine cannot take the whole world down.
The Honest Starting Point
A mirror plan that pretends everything is already backed up is worse than no plan. Here is the true state today.
e2.life, Starvard, and The Studio live in git repos. The safe deploy pipe pushes to the repo first, then deploys from a pristine checkout, with a deletion guard. If a live site vanished, we could redeploy from the repo today.
Our machine has been replaced before and silently took the Discord bots with it. The boot watchdog now notices, restores Sam, Marty, Shippy, Tippy, and presence from saved templates, and starts them again without anyone asking.
Most sites sit in one Cloudflare world, most code in one GitHub world, and Discord history lives only inside Discord. A hack of any one of those three is still a very bad day. That is exactly what the mirror fixes.
What Could Take Us Down
Sites deleted or defaced, DNS changed, Workers replaced. Answer: a second hosting account, already deployed, on a different login, ready for a DNS flip.
Repos are our source of truth, until they are gone. Answer: every repo mirrored daily to a second git host, plus an offline bundle with a signed hash.
The names stop pointing at us. Answer: backup domains on a different registrar, bought in advance, already pointed at the mirrors, published on this page in advance.
A server, its history, and its member list cannot be cloned back by Discord. Answer: a prebuilt lifeboat server, a nightly blueprint of channels and roles, and a passport list we can re-invite from. Below.
It has happened, repeatedly. Answer: bots, ledgers, and jobs are rebuilt from git and watchdog templates, and a second small server holds a hot standby copy.
The sneaky one: a bad edit syncs everywhere before anyone notices. Answer: mirrors never sync blind. Snapshots are signed, versioned, and held as last known good, with a short delay and a big change alarm.
The Plan
Cold is cheap and slow to wake. Hot costs a little and wakes in minutes. We need all three, for different things.
Nightly git bundles of every repo, a full file snapshot of every site, every Worker script, every bot, and every data file that matters: Tippy ledger, presence, bounties, updates, passports, growth history. Encrypted, hashed, stored in two places that are not Cloudflare and not GitHub, plus one offline copy. Restore time: hours. Cost: near zero. This layer means we can never truly lose the work.
Every public site deployed, in advance, to a second Cloudflare account and to one independent static host on a small server. Backup domains already point there. Nobody visits it day to day, it just sits ready, rebuilt on every real deploy, so the copy is never stale. If the main house burns, we move in the same day. Restore time: under an hour, most of it DNS.
For the living things: Discord bots, Tippy money, presence, login, and the Finn chat on Starvard. A standby copy running on a second server, heartbeating the main one, ready to take over in minutes. Standby bots stay silent until promoted, so nobody ever gets two Sams answering at once.
The Sites
Source: the e2 git repo, deployed by the safe pipe. Mirror: second account deploy from the same repo on every ship, backup domain pre-pointed, and a static snapshot on the spare server. The homepage, bounties, updates, feed, and online pages must work on the mirror with no database at all: they already read simple JSON files, which mirror trivially.
The biggest property, and its own section below. In short: rebuildable from its builders and data, mirrored as five projects, not one, because books, chapters, and the main site already ship separately.
Same treatment: repo twin, second account deploy, snapshot. Its tree and repo still need their reconcile finished before a mirror can be trusted, because a mirror of a disagreement is just two disagreements.
Static parts mirror like the rest. The living parts, Llama Chat posts and profiles, need a data export of their own: a nightly database dump, encrypted, in the vault, plus a read only public feed mirror so the community can still read while we rebuild.
Login, Finn, counts, snippets, visitor data: every Worker script lives in git with its config written down, no settings that exist only in a dashboard. A mirror Worker account gets the same scripts from the same repo. Secrets live in the vault, never in this plan, never on this page.
Every site hosts its own images, so every site mirrors its own images too: an asset snapshot per property, hashed, in the vault and on the spare server. No mirror page should ever point back at the original host for its pictures, or it is not a mirror.
The Hard One
Discord gives us no export button for a community. If the server is deleted, the channels, history, and member graph go with it. So we build the lifeboat before we need it, and we keep the important cargo on the web, where we own it.
A reserve server with the same channels, categories, roles, and permissions, already made, sitting empty and quiet. Sam, Marty, Shippy, and Tippy are already members with backup tokens ready. One invite link, published here and on the sites, is the rally point.
Every night a bot exports the server structure as data: channels, roles, permissions, emoji, and settings, saved to git. If both servers vanished, a script rebuilds the structure in minutes, in the right order, with the right names.
Our passport register, the online page, and the active page already name the people who matter most, with their Discord IDs. The full member export, handled privately and encrypted, is the re-invite list. People are the community, not the channel history.
Announcements already mirror to Updates, bounties to the Bounties board, tips and level ups to the Live Feed. We extend that rule: anything the community would grieve losing gets posted to a page we own, not only to Discord. Discord becomes a copy, never the only copy.
Bot code already lives on our machine and in git. The mirror adds: backup bot apps created in advance, tokens in the vault, and the standby server copy that watchdog already knows how to restore. Tippy gets special care, next section.
Once a quarter, we actually use the lifeboat for an evening: a voice hang in the reserve server, a test tip, a test welcome. A lifeboat nobody has sat in is a decoration, not a plan.
Starvard
Starvard is tens of thousands of pages: courses, books, chapters, and the same welcome in 17 languages. Copying HTML is fragile. The real mirror is the thing that made the pages: the builders, the course data, the book sources, and the counts file, all in git and in the vault. From those, a clean machine can regenerate the whole university, which we already prove every time a builder reruns.
Most of the library is public domain books. Their source texts get their own simple mirror: plain, small, and shareable, pinned in more than one place. Even with no website at all, the library survives as files anyone can host. That fits the mission: a free university should be hard to delete.
The dream mirror: a single downloadable snapshot, homepage, courses, and library, that runs offline from a folder or a USB stick. If the site is ever down for a student, the box is the class. It is also the perfect test: if the box builds, the mirror works.
Finn is a Worker plus a prompt and a book index: all text, all in git, redeployable to the mirror account in minutes. The live counts are one JSON file read at runtime, exactly the pattern that mirrors best. No baked numbers, no hidden database.
Data and Money
The ledger is the one dataset where loss means people lose money. It mirrors hourly, encrypted, to the vault and the standby server, with a public hash so anyone can check a restored ledger is the real one. In a crisis Tippy freezes first and resumes last, after the hash checks out. Private wallet details never appear in any mirror, ever, by our standing rule.
Presence, online counts, and the passport register are small JSON files with producers we control. They snapshot with the sites, and their producers are in git, so the living layer can be regrown, not just restored.
Every mirror snapshot carries a manifest of file hashes, the same idea as our deploy deletion guard, extended fleet wide. Restores only ever use a signed last known good snapshot. A mirror that cannot prove it is really us is a phishing site waiting to happen, so mirror domains are listed only on this page and in our own footers.
When It Happens
An outside checker on a different provider watches content, not just status codes: the real titles and key text of the homepages, Starvard, and the login and Finn endpoints. A defaced page fails this check even when it returns a cheerful 200.
One person can declare a mirror flip. The call, the time, and the bad snapshot hash go in the runbook log. Freezing Tippy and the bots happens here, before anything moves.
DNS for the main domains points at the warm mirror, or, if DNS itself is the problem, we announce the backup domains everywhere we still control: socials, the lifeboat server, and email. Low time to live values, set in advance, keep this fast.
The mirror is checked the way we check everything: by title, by content, by clicking through, never by status code alone. Then the originals get rebuilt from the vault, cleanly, and only then do we flip back.
When the backup domains and the lifeboat invite exist, their only official list will be this page, copied into every site footer. If you ever see a mirror address announced anywhere else, treat it as fake until it appears here. The plan is public, the keys never are.
Build Order
Nightly repo bundles to a second git host and the vault, a Discord structure export to git, Tippy ledger hourly copies verified by hash, and an inventory file that names every property, repo, project, Worker, bot, and domain in one place. Mostly scripts we already half have. This is the set up that starts today, in our mirror folder, next to this page.
A second hosting account with every property pre-deployed, backup domains bought on a second registrar and pre-pointed, the reserve Discord server built from the blueprint with backup bots inside, and standby bot hosting on a small second server.
A status page on independent ground, quarterly flip and lifeboat drills, an outside content checker, and Starvard in a box. The plan is only finished when a drill passes with nobody improvising.
Rough cost of the whole thing: backup domains and one small server, on the order of a nice lunch per month. The expensive version of this plan is the one we invent during a hack.
Talk About It
If a property, a bot, or a dataset is missing from this page, it is probably missing from the mirror too. Shout in the E2 Discord. Finding holes on a calm day is the whole game.
Each property gets one named mirror owner, the same one owner per page rule we use for deploys. Mirrors rot when everybody owns them in general and nobody owns them in particular.
When the mirror plan changes, this page changes first, then the runbook, then the scripts. A secret plan nobody can read during a crisis is not a plan.
Two of everything, so the kinder world stays up. Built to be enjoyed, mirrored to survive.