# pfi-ana-webhost — DESTROYED 2026-10-04

> **Destroyed 2026-10-04 ~1726 (Prime: "retire the webhost — we may want one back in the future, and if so we'll build it fresh").** `qm destroy 110 --purge` on pfi-pve. Last image kept in PBS: `pbs-ana:backup/vm/110/2026-10-04T10:28:18Z` (+ the two before it). Cleaned up with it: FortiGate policy 18, address `ana-webhost-ip`, VIPs `web-to-webhost` + `ssh-to-webhost`, service `ssh-mapped-2223`, MAC object `pfi-ana-webhost`, DHCP reservation (server 5 entry 11); public A `pfi-ana-webhost.phasefinal.com`; internal `pfi-ana-webhost.ana.internal`. **38.120.12.45 is now unmapped.** FortiGate backups on nh3-dev: `/var/tmp/ana-gw-config-20261004T235515Z-pre-webhost-retire.conf`, `/var/tmp/ana-gw-config-20261005T002204Z-pre-webhost-objects-delete.conf`.

> **Retired 2026-10-04 (Prime: "retire dragonfirepro").** VM 110 shut down, `onboot 0`, out of the nightly vzdump
> (last backup `pbs-ana:backup/vm/110/2026-10-04T10:28:18Z`; the VM is kept, not destroyed). FortiGate policy 18
> `wan-to-webhost-web` (WAN → HTTP/HTTPS/**SSH**) set `status disable`; VIPs `web-to-webhost` (1:1 .45 → .52) and
> `ssh-to-webhost` are left in place but inert. Config backup `/var/tmp/ana-gw-config-20261004T235515Z-pre-webhost-retire.conf`
> on nh3-dev.
>
> Why: it was Debian 11 + Virtualmin with 183 pending updates (177 security) and SSH open to the internet, and it served
> nothing live. Its one vhost, `dragonfirepro.com`, belongs to a drop-catcher since 2025-09-27. Its aliases
> (`dragonfireacoustics.com`, `www.`) moved on 2026-09-24 to **Cloudflare Pages in the client's own Cloudflare account**
> (project `dragonfireacoustics`; source on nh3-dev `~/development/adhoc/dragonfireacoustics-site`, deploy creds vaulted
> `nh3-dev/.config/cloudflare/dragonfireacoustics-com`; domain now on Cloudflare Registrar, expires 2035-10-30,
> transfer-locked). To bring the VM back: `qm set 110 --onboot 1 && qm start 110`, re-enable policy 18.

General-purpose webhost at the Anaheim colo.

## Network

- **LAN IP:** 10.250.50.52
- **SSH:** `lkraven@pfi-ana-webhost` (key auth — verify on first run)

## Infrastructure

- **Hypervisor:** `pfi-pve` (VMID **110**)
- **Type:** Linux VM
- **Site:** Anaheim (PFI colo)

## Role

Web-facing workload host. DNS name includes `pfi-ana-webhost.phasefinal.com`.
Specific services running here aren't catalogued in this workspace yet —
refresh the snapshot and inspect.

## Backup coverage

- **VM-image:** ✅ vzdump on pfi-pve (daily, per the 2026-04-20 audit)
- **File-level restic:** ❌ not yet configured

If this host starts carrying any state worth per-file restore (app
configs, TLS certs, DBs), add a `configs/restic/pfi-ana-webhost/`
profile following the ana-ml2 template.

## Refresh state

```bash
scripts/refresh-server-info.sh pfi-ana-webhost
```

## Discovered via

`scripts/discover-fortigate.sh 10.250.250.1` on 2026-04-21 —
FortiGate DHCP lease (MAC `e6:f9:3a:c9:61:2a`).