Vault Backup & Private Website

Get this vault under version control on GitHub, backed up automatically, and published to a private site at vault.leesteiner.dev where tasks can be ticked off from a phone and the change lands back in the vault.

Done looks like: vault pushes itself to GitHub with no manual git push, the site is live behind a login, and checking a box on the site checks it in Obsidian too.

Tasks

Phase 1 — Backup

Install GitHub CLI ✅ 2026-09-01
Initialize git repo, normalize line endings, first commit ✅ 2026-09-01
Configure obsidian-git for 5-minute auto commit-and-sync ✅ 2026-09-01
Write hourly scheduled-task safety net for when Obsidian is closed ✅ 2026-09-01
Authenticate gh and create the private GitHub repo 🔺 📅 2026-09-02 ✅ 2026-09-02
Register the scheduled task (scripts/register-task.ps1) ⏫ 📅 2026-09-02 ✅ 2026-09-02

Phase 2 — Tasks & projects

Create projects/ and tasks/ structure ✅ 2026-09-01
Install the Tasks and Dataview community plugins ⏫ 📅 2026-09-02
Read START-HERE and confirm the workflow makes sense 📅 2026-09-03

Phase 2b — Mobile

Subscribe to Obsidian Sync and connect the phone ⏫ 📅 2026-09-03
Confirm obsidian-git is NOT enabled on the phone 🔺 📅 2026-09-03

Phase 3 — Website

Point leesteiner.dev at Cloudflare DNS 📅 2026-09-07 ✅ 2026-09-02
Build the Astro site with the medical-exclusion build gate ⏫ ✅ 2026-09-02
Authorize the Cloudflare GitHub App on lees-vault only 🔺
Create the Worker (root dir site), add vault.leesteiner.dev ⏫
Set root directory to site after creation, re-run the failed build ⏫
Tighten the auto-created Access policy to my email only 🔺
Copy AUD + team domain into the Worker’s variables 🔺

Phase 4 — Write-back

Task toggle API with Access JWT verification 🔺 ✅ 2026-09-02
Quick-capture endpoint for the phone ⏫ ✅ 2026-09-02
Project completion endpoint ✅ 2026-09-02
End-to-end test: tick on phone → appears in Obsidian

Notes

Why not GitHub Pages: it’s static and public. Can’t log in, can’t write back. Cloudflare Pages + Access + a Function is the only stack that does all three things.
The repo is private. wiki/home/medical/ lives in it. The website build additionally refuses to publish that folder — belt and braces.
obsidian-git must never run on the phone. Per the plugin’s own docs it’s “very unstable” on mobile; it can’t use real git there. Obsidian Sync carries the phone instead, and the desktop is the only thing that talks to GitHub.
Consequence of that: a note typed on the phone reaches the website only after the desktop next wakes. That’s why tasks get their own capture path on the site.