ops: phasefinal.com moved to Cloudflare Pages; pfi-ana-webhost destroyed and removed from inventory, DNS and the FortiGate
This commit is contained in:
@@ -34,7 +34,7 @@ every NIC. Linux = virtio, Windows = e1000. CTs take DHCP (reserved).
|
||||
| 105 | PFI-Postgres | 10.250.50.80 | 16 (4×4) | 8 G | 80G ospool | Debian 11 | yes / order 3, up 60s | shared Postgres (vaultwarden/gitea/paperless); PGDATA local since 2026-04-23. `servers/pfi-postgres/` |
|
||||
| 106 | corviduo-dev | 10.250.50.152 | 8 (2×4, x86-64-v2-AES) | 8 G | 80G ospool | Debian 13 | yes / order 10 | Worldtree-team dev VM, PFI-hosted. `servers/corviduo-dev/` |
|
||||
| 107 | PFI-Pteradactyl | 10.250.50.55 | 8 (2×4, host) | 8 G | 256G ospool | Debian 11 | yes / — | Pterodactyl game panel. `servers/pfi-pteradactyl/` |
|
||||
| 110 | PFI-ANA-Webhost | 10.250.50.52 | 16 (4×4) | 4 G (balloon 1 G) | 250G ospool | Debian 11 | yes / order 30, up/down 120s | web workload. `servers/pfi-ana-webhost/` |
|
||||
| ~~110~~ | ~~PFI-ANA-Webhost~~ **destroyed 2026-10-04** (last image `pbs-ana:backup/vm/110/2026-10-04T10:28:18Z`) | ~~10.250.50.52~~ | 16 (4×4) | 4 G (balloon 1 G) | 250G ospool | Debian 11 | yes / order 30, up/down 120s | web workload. `servers/pfi-ana-webhost/` |
|
||||
| 111 | pfi-tacticalrmm | 10.250.50.57 | 16 (4×4) | 8 G | 256G ospool | Linux | yes / order 20 | TacticalRMM. `servers/pfi-tacticalrmm/` |
|
||||
|
||||
All VMs have the QEMU guest agent enabled.
|
||||
|
||||
@@ -0,0 +1,55 @@
|
||||
# pfi-ana-webhost — DESTROYED 2026-10-04
|
||||
|
||||
> **Destroyed 2026-10-04 ~1726 (Prime: "retire the webhost — we may want one back in the future, and if so we'll build it fresh").** `qm destroy 110 --purge` on pfi-pve. Last image kept in PBS: `pbs-ana:backup/vm/110/2026-10-04T10:28:18Z` (+ the two before it). Cleaned up with it: FortiGate policy 18, address `ana-webhost-ip`, VIPs `web-to-webhost` + `ssh-to-webhost`, service `ssh-mapped-2223`, MAC object `pfi-ana-webhost`, DHCP reservation (server 5 entry 11); public A `pfi-ana-webhost.phasefinal.com`; internal `pfi-ana-webhost.ana.internal`. **38.120.12.45 is now unmapped.** FortiGate backups on nh3-dev: `/var/tmp/ana-gw-config-20261004T235515Z-pre-webhost-retire.conf`, `/var/tmp/ana-gw-config-20261005T002204Z-pre-webhost-objects-delete.conf`.
|
||||
|
||||
> **Retired 2026-10-04 (Prime: "retire dragonfirepro").** VM 110 shut down, `onboot 0`, out of the nightly vzdump
|
||||
> (last backup `pbs-ana:backup/vm/110/2026-10-04T10:28:18Z`; the VM is kept, not destroyed). FortiGate policy 18
|
||||
> `wan-to-webhost-web` (WAN → HTTP/HTTPS/**SSH**) set `status disable`; VIPs `web-to-webhost` (1:1 .45 → .52) and
|
||||
> `ssh-to-webhost` are left in place but inert. Config backup `/var/tmp/ana-gw-config-20261004T235515Z-pre-webhost-retire.conf`
|
||||
> on nh3-dev.
|
||||
>
|
||||
> Why: it was Debian 11 + Virtualmin with 183 pending updates (177 security) and SSH open to the internet, and it served
|
||||
> nothing live. Its one vhost, `dragonfirepro.com`, belongs to a drop-catcher since 2025-09-27. Its aliases
|
||||
> (`dragonfireacoustics.com`, `www.`) moved on 2026-09-24 to **Cloudflare Pages in the client's own Cloudflare account**
|
||||
> (project `dragonfireacoustics`; source on nh3-dev `~/development/adhoc/dragonfireacoustics-site`, deploy creds vaulted
|
||||
> `nh3-dev/.config/cloudflare/dragonfireacoustics-com`; domain now on Cloudflare Registrar, expires 2035-10-30,
|
||||
> transfer-locked). To bring the VM back: `qm set 110 --onboot 1 && qm start 110`, re-enable policy 18.
|
||||
|
||||
General-purpose webhost at the Anaheim colo.
|
||||
|
||||
## Network
|
||||
|
||||
- **LAN IP:** 10.250.50.52
|
||||
- **SSH:** `lkraven@pfi-ana-webhost` (key auth — verify on first run)
|
||||
|
||||
## Infrastructure
|
||||
|
||||
- **Hypervisor:** `pfi-pve` (VMID **110**)
|
||||
- **Type:** Linux VM
|
||||
- **Site:** Anaheim (PFI colo)
|
||||
|
||||
## Role
|
||||
|
||||
Web-facing workload host. DNS name includes `pfi-ana-webhost.phasefinal.com`.
|
||||
Specific services running here aren't catalogued in this workspace yet —
|
||||
refresh the snapshot and inspect.
|
||||
|
||||
## Backup coverage
|
||||
|
||||
- **VM-image:** ✅ vzdump on pfi-pve (daily, per the 2026-04-20 audit)
|
||||
- **File-level restic:** ❌ not yet configured
|
||||
|
||||
If this host starts carrying any state worth per-file restore (app
|
||||
configs, TLS certs, DBs), add a `configs/restic/pfi-ana-webhost/`
|
||||
profile following the ana-ml2 template.
|
||||
|
||||
## Refresh state
|
||||
|
||||
```bash
|
||||
scripts/refresh-server-info.sh pfi-ana-webhost
|
||||
```
|
||||
|
||||
## Discovered via
|
||||
|
||||
`scripts/discover-fortigate.sh 10.250.250.1` on 2026-04-21 —
|
||||
FortiGate DHCP lease (MAC `e6:f9:3a:c9:61:2a`).
|
||||
@@ -0,0 +1,104 @@
|
||||
|
||||
===== HOST =====
|
||||
|
||||
Hostname: pfi-ana-webhost.phasefinal.com
|
||||
Date: 2026-04-23T01:00:53-07:00
|
||||
Uptime: up 34 weeks, 4 days, 11 hours, 35 minutes
|
||||
OS: Debian GNU/Linux 11 (bullseye)
|
||||
Kernel: 5.10.0-34-amd64
|
||||
Arch: x86_64
|
||||
|
||||
===== HARDWARE =====
|
||||
|
||||
CPU cores: 16
|
||||
CPU model: Common KVM processor
|
||||
MemTotal: 0.8 GB
|
||||
MemAvailable: 0.3 GB
|
||||
|
||||
===== GPUS =====
|
||||
|
||||
nvidia-smi not present (no NVIDIA GPUs or driver not installed)
|
||||
|
||||
===== FILESYSTEMS (df) =====
|
||||
|
||||
Filesystem Size Used Avail Use% Mounted on
|
||||
/dev/sda1 245G 8.6G 224G 4% /
|
||||
|
||||
===== PERSISTENT MOUNTS (/etc/fstab, non-comment) =====
|
||||
|
||||
UUID=110a7e2b-aaf8-4a55-a064-408b665ee322 / ext4 rw,grpquota,errors=remount-ro,relatime,quota,usrquota 0 1
|
||||
UUID=f788f710-a3ec-457e-8053-2eeca8c3f029 none swap sw 0 0
|
||||
/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0
|
||||
/home/dragonfirepro /home/chroot/169559808468512/home/dragonfirepro bind defaults,bind 0
|
||||
|
||||
===== TARGETED DATA PATHS =====
|
||||
|
||||
/opt (total: 4.0K)
|
||||
total 8
|
||||
drwxr-xr-x 2 root root 4096 2023-09-24 15:42 .
|
||||
drwxr-xr-x 18 root root 4096 2025-04-12 13:58 ..
|
||||
|
||||
/srv (total: 12K)
|
||||
total 12
|
||||
drwxr-xr-x 3 root root 4096 2023-09-24 16:15 .
|
||||
drwxr-xr-x 18 root root 4096 2025-04-12 13:58 ..
|
||||
drwxr-xr-x 2 ftp nogroup 4096 2023-09-24 16:15 ftp
|
||||
|
||||
|
||||
===== DOCKER =====
|
||||
|
||||
docker not installed
|
||||
|
||||
===== COMPOSE FILES (/opt/docker/compose/) =====
|
||||
|
||||
/opt/docker/compose not present
|
||||
|
||||
===== CONFIG LAYOUT (/opt/docker/conf/ — top 200 entries) =====
|
||||
|
||||
/opt/docker/conf not present
|
||||
|
||||
===== LISTENING PORTS =====
|
||||
|
||||
0.0.0.0:10000
|
||||
0.0.0.0:110
|
||||
0.0.0.0:143
|
||||
0.0.0.0:20000
|
||||
0.0.0.0:22
|
||||
0.0.0.0:993
|
||||
0.0.0.0:995
|
||||
[::]:10000
|
||||
10.250.50.52:53
|
||||
[::]:110
|
||||
[::1]:10023
|
||||
[::1]:25
|
||||
127.0.0.1:10023
|
||||
127.0.0.1:25
|
||||
127.0.0.1:3306
|
||||
127.0.0.1:465
|
||||
127.0.0.1:53
|
||||
127.0.0.1:587
|
||||
127.0.0.1:953
|
||||
[::]:143
|
||||
[::1]:465
|
||||
[::1]:53
|
||||
[::1]:587
|
||||
[::1]:953
|
||||
*:21
|
||||
[::]:22
|
||||
*:2222
|
||||
*:443
|
||||
*:80
|
||||
[::]:993
|
||||
[::]:995
|
||||
[fe80::e4f9:3aff:fec9:612a]%ens18:53
|
||||
|
||||
===== MODEL / HUGGINGFACE CACHES =====
|
||||
|
||||
|
||||
===== DOCKER-ADJACENT SYSTEMD SERVICES =====
|
||||
|
||||
(none matching)
|
||||
|
||||
===== DONE =====
|
||||
|
||||
Paste the above back into the chat, or pass a path as argv[1] to save.
|
||||
@@ -84,7 +84,7 @@ pfi-pve during morning backup window. Backup suspected as trigger
|
||||
### pfi-pve (Proxmox VE, 10.250.250.31)
|
||||
|
||||
**Blast radius — everything hosted on it:**
|
||||
- ana-docker (VM), ana-nas (CT 109), pfi-postgres (VM 105), pfi-ana-webhost, ana-filebot, pfi-pteradactyl, pfi-tacticalrmm, ana-wg, PBS-ANA (VM), + others
|
||||
- ana-docker (VM), ana-nas (CT 109), pfi-postgres (VM 105), ana-filebot, pfi-pteradactyl, pfi-tacticalrmm, ana-wg, PBS-ANA (VM), + others
|
||||
|
||||
Essentially **all Anaheim primary services** go offline. Because ana-nas lives here too, Tier-0 cascade applies simultaneously.
|
||||
|
||||
@@ -197,11 +197,11 @@ Essentially **all Anaheim primary services** go offline. Because ana-nas lives h
|
||||
|
||||
**Recovery:** `pct start 112`.
|
||||
|
||||
### pfi-ana-webhost (VM on pfi-pve) — web workload
|
||||
### ~~pfi-ana-webhost~~ — destroyed 2026-10-04
|
||||
|
||||
**Blast radius:** hosted website(s) offline.
|
||||
|
||||
**Recovery:** VM restart; web server auto-start.
|
||||
Retired and destroyed (Prime). Nothing in the fleet depends on it. Its sites live elsewhere: phasefinal.com on Cloudflare
|
||||
Pages (`stacks/phasefinal-web/`), dragonfireacoustics.com on Cloudflare Pages in the client's account. Last image in PBS:
|
||||
`pbs-ana:backup/vm/110/2026-10-04T10:28:18Z`.
|
||||
|
||||
---
|
||||
|
||||
|
||||
Reference in New Issue
Block a user