diff --git a/CLAUDE.md b/CLAUDE.md index 1e2c8c6..3b6e1d3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -55,7 +55,16 @@ Observed and standardized across servers: |------|-----|------|------|---------| | ana-ml2 | 10.250.50.54 | Anaheim (`10.250.0.0/16`) | GPU / AI inference (bare metal) | `servers/ana-ml2/README.md` | | ana-docker | 10.250.50.70 | Anaheim | General-purpose Docker host (non-GPU VM on pfi-pve) | `servers/ana-docker/README.md` | +| pfi-ana-webhost | 10.250.50.52 | Anaheim | VM on pfi-pve (VMID 110) — web workload | `servers/pfi-ana-webhost/README.md` | +| ana-filebot | 10.250.50.53 | Anaheim | LXC on pfi-pve (CT 112) — file-task automation | `servers/ana-filebot/README.md` | +| pfi-pteradactyl | 10.250.50.55 | Anaheim | VM on pfi-pve (VMID 107) — Pterodactyl game panel | `servers/pfi-pteradactyl/README.md` | +| pfi-tacticalrmm | 10.250.50.57 | Anaheim | VM on pfi-pve (VMID 111) — TacticalRMM | `servers/pfi-tacticalrmm/README.md` | +| pfi-postgres | 10.250.50.80 | Anaheim | VM on pfi-pve (VMID 105) — shared Postgres (vaultwarden/gitea/paperless) | `servers/pfi-postgres/README.md` | +| ana-wg | 10.250.50.252 | Anaheim | LXC on pfi-pve (CT 113) — WireGuard | `servers/ana-wg/README.md` | | pfi-pve | 10.250.250.31 | Anaheim | Proxmox VE hypervisor | `servers/pfi-pve/README.md` | +| sfsrv-ana | 10.250.250.115 | Anaheim | **Tenant (SureFire)** — Proxmox VE hypervisor | `servers/sfsrv-ana/README.md` | +| sf-ana-container | 10.250.150.100 | Anaheim | **Tenant (SureFire)** — container workload on sfsrv-ana | `servers/sf-ana-container/README.md` | +| sf-r630 | iDRAC 10.250.250.110 | Anaheim | **Tenant (SureFire)** — physical Dell R630, iDRAC-managed from PFI side | `servers/sf-r630/README.md` | | nh3-docker | 10.100.50.40 | NH3 (`10.100.0.0/16`) | General-purpose Docker host (non-GPU VM on nh3-pve) | `servers/nh3-docker/README.md` | | nh3-pve | 10.100.250.60 | NH3 | Proxmox VE hypervisor | `servers/nh3-pve/README.md` | | esh-docker-vm | 10.0.50.45 | ESH home lab (`esteban.net`, `10.0.50.0/24`) | Home-lab Docker host (VM on esh-pve) | `servers/esh-docker-vm/README.md` | @@ -69,6 +78,7 @@ Observed and standardized across servers: - NH-site non-GPU services → `nh3-docker`. - ESH home-lab workloads (`esteban.net`) → `esh-docker-vm` (general) or `vm-esh-nas` (needs direct NFS mounts from 10.0.50.50). Not part of the PFI colo topology, but shares monitoring/backup tooling. - Cross-site services (e.g. Beszel hub, Dozzle hub) live on `ana-docker` and pull from agents on the other hosts. +- **SureFire (SF) tenant hosts** (`sf-*`, `sfsrv-ana`) are at the Anaheim colo but PFI doesn't control the OS. Inventory only — coordinate any management with the tenant. - **Hypervisors** (`pfi-pve`, `nh3-pve`, `esh-pve`, `esh-pve-nas`) are tracked for inventory / capacity planning. Don't deploy Docker stacks directly on them; new workloads land as VMs. `server_inspect.sh` captures host-level detail only — VM/LXC/ZFS enumeration needs Proxmox-native tooling (`qm list`, `pvesh get …`, `zpool list`). ## How to refresh a server's state diff --git a/configs/homepage/services.yaml b/configs/homepage/services.yaml index d0b1888..f38f2e3 100644 --- a/configs/homepage/services.yaml +++ b/configs/homepage/services.yaml @@ -85,9 +85,20 @@ icon: mdi-brain description: GPU host (bare-metal) - PFI-ANA-ML2 BMC: - ping: 10.250.250.50 + href: https://10.250.250.50 icon: mdi-brain + siteMonitor: https://10.250.250.50 description: BMC (ana-ml2) + - SFsrv-ANA: + href: https://10.250.250.115:8006 + icon: si-proxmox + siteMonitor: https://10.250.250.115:8006 + description: Proxmox (SureFire tenant hypervisor at PFI colo) + - SF-R630-iDRAC: + href: https://10.250.250.110/ + icon: si-dell + siteMonitor: https://10.250.250.110/ + description: Dell R630 iDRAC (SureFire tenant hardware) - Infra - NH3: # NH3-Firewall (Fortigate 101F at 10.100.250.1) retired 2026-04-21 — diff --git a/servers/ana-filebot/README.md b/servers/ana-filebot/README.md new file mode 100644 index 0000000..b9ef1b4 --- /dev/null +++ b/servers/ana-filebot/README.md @@ -0,0 +1,39 @@ +# ana-filebot + +File-automation LXC at the Anaheim colo. + +## Network + +- **LAN IP:** 10.250.50.53 +- **SSH:** `root@ana-filebot` (LXC — typically root via key) + +## Infrastructure + +- **Hypervisor:** `pfi-pve` (**LXC 112**) +- **Type:** LXC container +- **Site:** Anaheim (PFI colo) + +## Role + +File-task automation — hostname referenced earlier as `ANA-FileBot` on +the homepage. Handles routine file-processing workflows. + +## Backup coverage + +- **VM-image:** ✅ vzdump on pfi-pve (daily) +- **File-level restic:** ❌ not yet configured + +Container-level backup from pfi-pve covers the rootfs. File-level +restic would add fast per-file restore — worth adding if scripts / +configs here are actively edited. + +## Refresh state + +```bash +scripts/refresh-server-info.sh ana-filebot +``` + +## Discovered via + +FortiGate DHCP (MAC `bc:24:11:c0:35:77`) and pre-existing homepage +reference as `ANA-FileBot`. diff --git a/servers/ana-filebot/ssh-target b/servers/ana-filebot/ssh-target new file mode 100644 index 0000000..2eea524 --- /dev/null +++ b/servers/ana-filebot/ssh-target @@ -0,0 +1 @@ +root@10.250.50.53 diff --git a/servers/ana-wg/README.md b/servers/ana-wg/README.md new file mode 100644 index 0000000..7e2ae6e --- /dev/null +++ b/servers/ana-wg/README.md @@ -0,0 +1,37 @@ +# ana-wg + +WireGuard VPN gateway at the Anaheim colo. + +## Network + +- **LAN IP:** 10.250.50.252 +- **SSH:** `root@ana-wg` (LXC — root via key) + +## Infrastructure + +- **Hypervisor:** `pfi-pve` (**LXC 113**) +- **Type:** LXC container +- **Site:** Anaheim (PFI colo) + +## Role + +WireGuard server providing VPN access into the PFI Anaheim network. +Config lives at `/etc/wireguard/` inside the LXC. + +## Backup coverage + +- **VM-image:** ✅ vzdump on pfi-pve (daily) — captures the LXC rootfs + which contains the wireguard config + peer keys. Sufficient for + disaster recovery. +- **File-level restic:** ❌ not needed — no DB, no high-churn state, + config is small and recoverable from vzdump. + +## Refresh state + +```bash +scripts/refresh-server-info.sh ana-wg +``` + +## Discovered via + +FortiGate DHCP (MAC `bc:24:11:d7:e4:b7`). diff --git a/servers/ana-wg/ssh-target b/servers/ana-wg/ssh-target new file mode 100644 index 0000000..279bdc2 --- /dev/null +++ b/servers/ana-wg/ssh-target @@ -0,0 +1 @@ +root@10.250.50.252 diff --git a/servers/pfi-ana-webhost/README.md b/servers/pfi-ana-webhost/README.md new file mode 100644 index 0000000..bda6bd3 --- /dev/null +++ b/servers/pfi-ana-webhost/README.md @@ -0,0 +1,40 @@ +# pfi-ana-webhost + +General-purpose webhost at the Anaheim colo. + +## Network + +- **LAN IP:** 10.250.50.52 +- **SSH:** `lkraven@pfi-ana-webhost` (key auth — verify on first run) + +## Infrastructure + +- **Hypervisor:** `pfi-pve` (VMID **110**) +- **Type:** Linux VM +- **Site:** Anaheim (PFI colo) + +## Role + +Web-facing workload host. DNS name includes `pfi-ana-webhost.phasefinal.com`. +Specific services running here aren't catalogued in this workspace yet — +refresh the snapshot and inspect. + +## Backup coverage + +- **VM-image:** ✅ vzdump on pfi-pve (daily, per the 2026-04-20 audit) +- **File-level restic:** ❌ not yet configured + +If this host starts carrying any state worth per-file restore (app +configs, TLS certs, DBs), add a `configs/restic/pfi-ana-webhost/` +profile following the ana-ml2 template. + +## Refresh state + +```bash +scripts/refresh-server-info.sh pfi-ana-webhost +``` + +## Discovered via + +`scripts/discover-fortigate.sh 10.250.250.1` on 2026-04-21 — +FortiGate DHCP lease (MAC `e6:f9:3a:c9:61:2a`). diff --git a/servers/pfi-ana-webhost/ssh-target b/servers/pfi-ana-webhost/ssh-target new file mode 100644 index 0000000..f2b5be4 --- /dev/null +++ b/servers/pfi-ana-webhost/ssh-target @@ -0,0 +1 @@ +lkraven@10.250.50.52 diff --git a/servers/pfi-postgres/README.md b/servers/pfi-postgres/README.md new file mode 100644 index 0000000..466e92a --- /dev/null +++ b/servers/pfi-postgres/README.md @@ -0,0 +1,57 @@ +# pfi-postgres + +Shared Postgres cluster at the Anaheim colo. + +## Network + +- **LAN IP:** 10.250.50.80 +- **Port:** 5432 +- **SSH:** `lkraven@pfi-postgres` + +## Infrastructure + +- **Hypervisor:** `pfi-pve` (VMID **105**) +- **Type:** Linux VM +- **Site:** Anaheim (PFI colo) + +## Role + +Shared Postgres server backing multiple ana-docker stacks: + +| Consumer | DB | User | +|---|---|---| +| vaultwarden | `vaultwarden` | `vaultwarden` | +| gitea | `gitea` | `gitea` | +| paperless-ngx (on esh-docker-vm) | `paperless-ng` | `paperless-ng` | +| (Likely others — audit as more stacks surface) | + +## Backup coverage + +- **VM-image:** ✅ vzdump on pfi-pve (daily) +- **App-consistent DB dumps:** ✅ each dependent stack's host runs a + pre-backup hook that `pg_dump`s its database from this server into + its own restic stage: + - ana-docker: vaultwarden + gitea (via `configs/restic/ana-docker/pre-backup.sh`) + - esh-docker-vm: paperless-ngx (via `configs/restic/esh-docker-vm/pre-backup.sh`) +- **File-level restic on this host:** ❌ not configured. Optional — the + VM-image + per-consumer pg_dumps together cover most recovery paths. + +## Known weak password (rotate) + +The inline passwords currently in use for these databases are +trivially weak: +- `gitea` / `gitea` +- `paperless-ng` / `paperless-ng` + +Rotation is on the post-backup-pipeline cleanup list. Exposed in the +2026-04-21 transcripts. + +## Refresh state + +```bash +scripts/refresh-server-info.sh pfi-postgres +``` + +## Discovered via + +FortiGate DHCP (MAC `c2:1f:cc:71:66:d0`). diff --git a/servers/pfi-postgres/ssh-target b/servers/pfi-postgres/ssh-target new file mode 100644 index 0000000..8a1dfd5 --- /dev/null +++ b/servers/pfi-postgres/ssh-target @@ -0,0 +1 @@ +lkraven@10.250.50.80 diff --git a/servers/pfi-pteradactyl/README.md b/servers/pfi-pteradactyl/README.md new file mode 100644 index 0000000..2e95a7d --- /dev/null +++ b/servers/pfi-pteradactyl/README.md @@ -0,0 +1,40 @@ +# pfi-pteradactyl + +Pterodactyl game-server panel at the Anaheim colo. + +## Network + +- **LAN IP:** 10.250.50.55 +- **Web UI:** http://10.250.50.55/ (listed on homepage under **Games**) +- **SSH:** `lkraven@pfi-pteradactyl` + +## Infrastructure + +- **Hypervisor:** `pfi-pve` (VMID **107**) +- **Type:** Linux VM +- **Site:** Anaheim (PFI colo) + +## Role + +Pterodactyl Panel — web UI and daemons for running game servers. + +## Backup coverage + +- **VM-image:** ✅ vzdump on pfi-pve (daily) +- **File-level restic:** ❌ not yet configured + +Game-server state (save files, world data, config) lives inside this +VM. Volume-level restic covering /var/lib/pterodactyl or equivalent +would be a useful layer on top of vzdump — worth a dedicated +`configs/restic/pfi-pteradactyl/` profile if game state turnover is high. + +## Refresh state + +```bash +scripts/refresh-server-info.sh pfi-pteradactyl +``` + +## Discovered via + +FortiGate DHCP (MAC `ca:44:37:8a:bf:e0`) and pre-existing homepage +entry under **Games**. diff --git a/servers/pfi-pteradactyl/ssh-target b/servers/pfi-pteradactyl/ssh-target new file mode 100644 index 0000000..a1b1413 --- /dev/null +++ b/servers/pfi-pteradactyl/ssh-target @@ -0,0 +1 @@ +lkraven@10.250.50.55 diff --git a/servers/pfi-tacticalrmm/README.md b/servers/pfi-tacticalrmm/README.md new file mode 100644 index 0000000..e40f648 --- /dev/null +++ b/servers/pfi-tacticalrmm/README.md @@ -0,0 +1,40 @@ +# pfi-tacticalrmm + +Tactical RMM (remote monitoring + management) server at the Anaheim colo. + +## Network + +- **LAN IP:** 10.250.50.57 +- **SSH:** `lkraven@pfi-tacticalrmm` + +## Infrastructure + +- **Hypervisor:** `pfi-pve` (VMID **111**) +- **Type:** Linux VM +- **Site:** Anaheim (PFI colo) + +## Role + +[TacticalRMM](https://tacticalrmm.com/) — open-source RMM platform. +Monitors and manages endpoints, pushes patches, runs scripts, etc. + +## Backup coverage + +- **VM-image:** ✅ vzdump on pfi-pve (daily) +- **File-level restic:** ❌ not yet configured + +TacticalRMM state (Postgres DB with inventory + automation history, +MeshCentral config, agent registrations) is critical if used in +production. Worth setting up app-consistent DB dumps + file-level +restic if it's the primary management plane. + +## Refresh state + +```bash +scripts/refresh-server-info.sh pfi-tacticalrmm +``` + +## Discovered via + +`scripts/discover-fortigate.sh 10.250.250.1` on 2026-04-21 — +FortiGate DHCP lease (MAC `ba:fa:65:f6:46:25`). diff --git a/servers/pfi-tacticalrmm/ssh-target b/servers/pfi-tacticalrmm/ssh-target new file mode 100644 index 0000000..e9ee29f --- /dev/null +++ b/servers/pfi-tacticalrmm/ssh-target @@ -0,0 +1 @@ +lkraven@10.250.50.57 diff --git a/servers/sf-ana-container/README.md b/servers/sf-ana-container/README.md new file mode 100644 index 0000000..53bf0ae --- /dev/null +++ b/servers/sf-ana-container/README.md @@ -0,0 +1,37 @@ +# sf-ana-container + +**SureFire tenant workload** at the Anaheim colo — a container +host/VM running on the SureFire Proxmox (`sfsrv-ana`, 10.250.250.115). + +## Tenancy + +- **Owner:** SureFire (tenant) +- **PFI role:** hosting provider +- **Management scope:** coordinate with SureFire before any action + +## Network + +- **LAN IP:** 10.250.150.100 +- **SSH:** not wired — tenant equipment. + +## Infrastructure + +- **Hypervisor:** `sfsrv-ana` (SureFire Proxmox, 10.250.250.115) +- **Site:** Anaheim (PFI colo) +- **Subnet:** `10.250.150.0/24` — dedicated SureFire container subnet + +## Role + +Container/workload host for SureFire. Specific services aren't +documented here (not PFI equipment). + +## Backup coverage + +- **Not currently backed up by the PFI fleet.** Needs coverage plan — + see `servers/sfsrv-ana/README.md` for the three approaches under + discussion. + +## Discovered via + +`scripts/discover-fortigate.sh 10.250.250.1` on 2026-04-21 (MAC +`6a:09:9a:8a:08:a5`). diff --git a/servers/sf-r630/README.md b/servers/sf-r630/README.md new file mode 100644 index 0000000..934a750 --- /dev/null +++ b/servers/sf-r630/README.md @@ -0,0 +1,36 @@ +# sf-r630 + +**SureFire tenant physical server** at the Anaheim colo — Dell +PowerEdge R630. Owner operates the OS; PFI provides rack + network. + +## Tenancy + +- **Owner:** SureFire (tenant) +- **PFI role:** hosting provider + +## Network + +- **iDRAC BMC IP:** 10.250.250.110 (on the management subnet) +- **OS-side LAN IP:** unknown — not surfaced via our DHCP discovery. + May be static, on a non-DHCP interface, or assigned to a different + subnet served by SureFire's own gear. +- **iDRAC Web UI:** https://10.250.250.110/ + +## Infrastructure + +- **Type:** Physical Dell PowerEdge R630 +- **Site:** Anaheim (PFI colo) +- **Management:** iDRAC only from the PFI side (power, console, hardware + health). OS-level access is tenant-scoped. + +## Backup coverage + +- Not applicable from the PFI side — tenant equipment. If hosting + terms require PFI to provide backup, coordinate with SureFire on + in-VM or OS-agent approach. + +## Discovered via + +`scripts/discover-fortigate.sh 10.250.250.1` on 2026-04-21 — DHCP +lease on the management interface (MAC `74:e6:e2:fe:2c:7c`, VCI +`iDRAC`). diff --git a/servers/sfsrv-ana/README.md b/servers/sfsrv-ana/README.md new file mode 100644 index 0000000..aa9073a --- /dev/null +++ b/servers/sfsrv-ana/README.md @@ -0,0 +1,51 @@ +# sfsrv-ana + +**SureFire tenant Proxmox host** at the Anaheim colo. Third-party +equipment / workload — tracked here for inventory, backup coverage, +and network awareness. + +## Tenancy + +- **Owner:** SureFire (tenant) +- **PFI role:** hosting provider — provides rack, power, network +- **Management scope:** coordinate with SureFire before any action + +## Network + +- **LAN IP:** 10.250.250.115 +- **Web UI:** https://10.250.250.115:8006 (Proxmox VE) +- **SSH:** not currently wired into this workspace (tenant equipment). + If PFI ever gains admin access, add `ssh-target` here. + +## Infrastructure + +- **Type:** Proxmox VE hypervisor (bare metal) +- **Site:** Anaheim (PFI colo) + +Hosts SureFire's own VMs, including: +- `sf-ana-container` (10.250.150.100) on the container subnet + +## Backup coverage + +- **Not currently backed up by the PFI fleet.** +- User flagged this as **needing coverage** — open plan item. Options: + 1. Coordinate tenant-side backup of SureFire VMs using their own + target. + 2. If PFI is responsible for backups of tenant workloads under the + hosting agreement, deploy restic clients to SureFire VMs writing + into a segregated repo on `rest-server-ana` (e.g. a dedicated + htpasswd user + encryption key scoped to SureFire). + 3. File-level Proxmox vzdump into shared NAS storage, same pattern + as pfi-pve. +- Decision pending. + +## Refresh state + +Not wired into `refresh-proxmox-info.sh` — would require SSH access as +root (same flow as pfi-pve / nh3-pve / etc.). Add an `ssh-target` when +ready. + +## Discovered via + +`scripts/discover-fortigate.sh 10.250.250.1` on 2026-04-21 (MAC +`44:a8:42:33:d9:c3`).