The thing that tells you whether any of the above is actually working: rebuild something on purpose.
Pick one service, ideally a middling one rather than the most important, and rebuild it from your repository onto a fresh container or a spare machine. Not a thought experiment, do it.
What it finds, every time:
- A file that was never in the repository
- A manual step you did once and never recorded
- A secret that lives only on the box
- A dependency on something you set up years ago and forgot existed
- A restore procedure that does not work
Each of those is a landmine you have now defused on a calm evening rather than during an outage.
Do it once or twice a year, on a different service each time. It takes an hour and it is the only honest test of whether you could recover.
A smaller version, if a full rebuild is too much: read your own documentation as though you were somebody else and try to follow it. You will find the steps that only make sense to you.
And on your immediate situation, the useful order: capture what exists into git first, write the whys as you go, then do one rebuild drill. The first step alone removes most of the risk you are worried about.