clarify how backup servers are interconnected for team#41755

service/backup.md

@@ -1656,16 +1656,27 @@ from the backup server.
 Bacula splits the different responsibilities of the backup system
 among multiple components, namely:
 
- * storage daemon (`bacula::storage` in Puppet, currently `bungei`)
- * director (`bacula::director` in Puppet, currently `bacula-director-01`,
-   PostgreSQL configured by hand)
- * file daemon (`bacula::client`, on all nodes)
+ * Director (`bacula::director` in Puppet, currently
+   `bacula-director-01`, with a PostgreSQL server configured in
+   Puppet), schedules jobs and tells the storage daemon to pull files
+   from the file daemons
+ * Storage daemon (`bacula::storage` in Puppet, currently `bungei`),
+   pulls files from the file daemons
+ * File daemon (`bacula::client`, on all nodes), serves files to the
+   storage daemon, also used to restore files to the nodes
 
 <img src="https://www.bacula.org/9.4.x-manuals/en/images/bacula-applications.png" />
 
 In our configuration, the *Admin workstation*, *Database server*and
 *Backup server* are all on the same machine, the `bacula::director`.
 
+Servers are interconnected over TCP connections authenticated with TLS
+client certificates. Each FD, on all servers, regularly pushes backups
+to the central SD. This works because the FD has a certificate
+(`/etc/ssl/torproject-auto/clientcerts/thishost.crt`) signed by the
+`auto-ca` [TLS certificate authority](howto/tls)
+(in`/etc/ssl/torproject-auto/servercerts/ca.crt`).
+
 Volumes are stored in the storage daemon, in
 `/srv/backups/bacula/`. Each client stores its volumes in a separate
 directory, which makes it easier to purge offline clients and evaluate