# ADR 0005 — ZFS dataset per site (nested under customer)

**Status:** Accepted

## Context
Backups must be cheap, integrity-checked, and restorable per customer without
touching neighbours. ZFS offers checksummed integrity, cheap copy-on-write
snapshots, and incremental `zfs send`.

## Decision
Create a **ZFS dataset per site**, nested under the owning customer
(`tank/customers/<customer>/<site>/web`), holding **only the web root**. The
customer level is a grouping parent enabling recursive snapshots and a single
SFTP chroot; the site level is the isolation/restore unit. Docker image/layer
storage and the MariaDB datadir live on separate platform datasets. Site web
data is bind-mounted into containers from its dataset.

## Consequences
- ✅ Snapshot and `zfs send` operate at the customer granularity — restore one
  customer independently.
- ✅ Data integrity via checksums; cheap frequent snapshots.
- ✅ Keeping the dataset to web files **only** (no logs, no DB dumps) means an
  unchanged site produces a near-empty incremental, keeping offsite `send` cheap
  — the explicit reason logs and DB dumps are stored elsewhere
  ([ADR 0006](0006-decoupled-backup-streams.md)).
- ❌ Ties the platform to a ZFS-capable host (OpenZFS on Linux); not portable to
  arbitrary cloud block storage without rework.