pfi-ana-webhost — DESTROYED 2026-10-04

Destroyed 2026-10-04 ~1726 (Prime: "retire the webhost — we may want one back in the future, and if so we'll build it fresh"). qm destroy 110 --purge on pfi-pve. Last image kept in PBS: pbs-ana:backup/vm/110/2026-10-04T10:28:18Z (+ the two before it). Cleaned up with it: FortiGate policy 18, address ana-webhost-ip, VIPs web-to-webhost + ssh-to-webhost, service ssh-mapped-2223, MAC object pfi-ana-webhost, DHCP reservation (server 5 entry 11); public A pfi-ana-webhost.phasefinal.com; internal pfi-ana-webhost.ana.internal. 38.120.12.45 is now unmapped. FortiGate backups on nh3-dev: /var/tmp/ana-gw-config-20261004T235515Z-pre-webhost-retire.conf, /var/tmp/ana-gw-config-20261005T002204Z-pre-webhost-objects-delete.conf.

Retired 2026-10-04 (Prime: "retire dragonfirepro"). VM 110 shut down, onboot 0, out of the nightly vzdump (last backup pbs-ana:backup/vm/110/2026-10-04T10:28:18Z; the VM is kept, not destroyed). FortiGate policy 18 wan-to-webhost-web (WAN → HTTP/HTTPS/SSH) set status disable; VIPs web-to-webhost (1:1 .45 → .52) and ssh-to-webhost are left in place but inert. Config backup /var/tmp/ana-gw-config-20261004T235515Z-pre-webhost-retire.conf on nh3-dev.

Why: it was Debian 11 + Virtualmin with 183 pending updates (177 security) and SSH open to the internet, and it served nothing live. Its one vhost, dragonfirepro.com, belongs to a drop-catcher since 2025-09-27. Its aliases (dragonfireacoustics.com, www.) moved on 2026-09-24 to Cloudflare Pages in the client's own Cloudflare account (project dragonfireacoustics; source on nh3-dev ~/development/adhoc/dragonfireacoustics-site, deploy creds vaulted nh3-dev/.config/cloudflare/dragonfireacoustics-com; domain now on Cloudflare Registrar, expires 2035-10-30, transfer-locked). To bring the VM back: qm set 110 --onboot 1 && qm start 110, re-enable policy 18.

General-purpose webhost at the Anaheim colo.

Network

LAN IP: 10.250.50.52
SSH: lkraven@pfi-ana-webhost (key auth — verify on first run)

Infrastructure

Hypervisor: pfi-pve (VMID 110)
Type: Linux VM
Site: Anaheim (PFI colo)

Role

Web-facing workload host. DNS name includes pfi-ana-webhost.phasefinal.com. Specific services running here aren't catalogued in this workspace yet — refresh the snapshot and inspect.

Backup coverage

VM-image: ✅ vzdump on pfi-pve (daily, per the 2026-04-20 audit)
File-level restic: ❌ not yet configured

If this host starts carrying any state worth per-file restore (app configs, TLS certs, DBs), add a configs/restic/pfi-ana-webhost/ profile following the ana-ml2 template.

Refresh state

scripts/refresh-server-info.sh pfi-ana-webhost

Discovered via

scripts/discover-fortigate.sh 10.250.250.1 on 2026-04-21 — FortiGate DHCP lease (MAC e6:f9:3a:c9:61:2a).