56 lines
2.9 KiB
Markdown
56 lines
2.9 KiB
Markdown
# pfi-ana-webhost — DESTROYED 2026-10-04
|
|
|
|
> **Destroyed 2026-10-04 ~1726 (Prime: "retire the webhost — we may want one back in the future, and if so we'll build it fresh").** `qm destroy 110 --purge` on pfi-pve. Last image kept in PBS: `pbs-ana:backup/vm/110/2026-10-04T10:28:18Z` (+ the two before it). Cleaned up with it: FortiGate policy 18, address `ana-webhost-ip`, VIPs `web-to-webhost` + `ssh-to-webhost`, service `ssh-mapped-2223`, MAC object `pfi-ana-webhost`, DHCP reservation (server 5 entry 11); public A `pfi-ana-webhost.phasefinal.com`; internal `pfi-ana-webhost.ana.internal`. **38.120.12.45 is now unmapped.** FortiGate backups on nh3-dev: `/var/tmp/ana-gw-config-20261004T235515Z-pre-webhost-retire.conf`, `/var/tmp/ana-gw-config-20261005T002204Z-pre-webhost-objects-delete.conf`.
|
|
|
|
> **Retired 2026-10-04 (Prime: "retire dragonfirepro").** VM 110 shut down, `onboot 0`, out of the nightly vzdump
|
|
> (last backup `pbs-ana:backup/vm/110/2026-10-04T10:28:18Z`; the VM is kept, not destroyed). FortiGate policy 18
|
|
> `wan-to-webhost-web` (WAN → HTTP/HTTPS/**SSH**) set `status disable`; VIPs `web-to-webhost` (1:1 .45 → .52) and
|
|
> `ssh-to-webhost` are left in place but inert. Config backup `/var/tmp/ana-gw-config-20261004T235515Z-pre-webhost-retire.conf`
|
|
> on nh3-dev.
|
|
>
|
|
> Why: it was Debian 11 + Virtualmin with 183 pending updates (177 security) and SSH open to the internet, and it served
|
|
> nothing live. Its one vhost, `dragonfirepro.com`, belongs to a drop-catcher since 2025-09-27. Its aliases
|
|
> (`dragonfireacoustics.com`, `www.`) moved on 2026-09-24 to **Cloudflare Pages in the client's own Cloudflare account**
|
|
> (project `dragonfireacoustics`; source on nh3-dev `~/development/adhoc/dragonfireacoustics-site`, deploy creds vaulted
|
|
> `nh3-dev/.config/cloudflare/dragonfireacoustics-com`; domain now on Cloudflare Registrar, expires 2035-10-30,
|
|
> transfer-locked). To bring the VM back: `qm set 110 --onboot 1 && qm start 110`, re-enable policy 18.
|
|
|
|
General-purpose webhost at the Anaheim colo.
|
|
|
|
## Network
|
|
|
|
- **LAN IP:** 10.250.50.52
|
|
- **SSH:** `lkraven@pfi-ana-webhost` (key auth — verify on first run)
|
|
|
|
## Infrastructure
|
|
|
|
- **Hypervisor:** `pfi-pve` (VMID **110**)
|
|
- **Type:** Linux VM
|
|
- **Site:** Anaheim (PFI colo)
|
|
|
|
## Role
|
|
|
|
Web-facing workload host. DNS name includes `pfi-ana-webhost.phasefinal.com`.
|
|
Specific services running here aren't catalogued in this workspace yet —
|
|
refresh the snapshot and inspect.
|
|
|
|
## Backup coverage
|
|
|
|
- **VM-image:** ✅ vzdump on pfi-pve (daily, per the 2026-04-20 audit)
|
|
- **File-level restic:** ❌ not yet configured
|
|
|
|
If this host starts carrying any state worth per-file restore (app
|
|
configs, TLS certs, DBs), add a `configs/restic/pfi-ana-webhost/`
|
|
profile following the ana-ml2 template.
|
|
|
|
## Refresh state
|
|
|
|
```bash
|
|
scripts/refresh-server-info.sh pfi-ana-webhost
|
|
```
|
|
|
|
## Discovered via
|
|
|
|
`scripts/discover-fortigate.sh 10.250.250.1` on 2026-04-21 —
|
|
FortiGate DHCP lease (MAC `e6:f9:3a:c9:61:2a`).
|