itpp-docs/docs-source/itpp-infrastructure/key-inventory.md

IT Pro Partner — Complete Key Inventory

Generated: 2026-07-23 Sanitized: 2026-07-23 (plaintext secrets replaced with storage references) Scope: All SSH keys, API tokens, service credentials, device keys, and passwords across the infrastructure ⚠️ SENSITIVE: All credential values live in the listed storage locations. See Hudu for API keys (layout 49).

---

1. SSH Keys

Key Name	File	Type	Fingerprint (SHA256)	Purpose	Deployed To
itpp-infra	/root/.ssh/itpp-infra	ED25519	Jxh0bbT9dUV3q1DYYB3hHyhy/1TDj7Q8U4xrVmB38uQ	Universal server admin key	All servers (Core, app1, app2, app3, wphost02, app1-bu, home router)
wisp_rsa	/root/.ssh/wisp_rsa	ED25519	MxQw1oh90NibSgN2mDbKP+07/jE4FEUEBbFAzuk5DcI	WISP MikroTik CCR router SSH	Home CCR router (10.77.0.2 via WireGuard)
germaine-personal	/root/.ssh/germaine-personal	ED25519	dDbLH+bdPFcGU0mm1DpGa43ec0nUZ88YnpCi4p63y3I	Germaine's personal key (from his machines)	Germaine's devices → Core
homelab	/root/.ssh/homelab	ED25519	c1nts4wR9EU06/O/k895Pb2tGZublgnGWG6NoQrK/qs	Homelab Proxmox/QNAP access	vm-host-01, vm-host-02, QNAP NAS
siteground.key	/root/.ssh/siteground.key	RSA (encrypted)	N/A (RSA, encrypted)	SiteGround SFTP backup (port 18765)	SiteGround shared hosting
authorized_keys	/root/.ssh/authorized_keys	—	—	Who can SSH into Core	Core (this server)

SSH Key Details

itpp-infra.pub:    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII4dxTH11aJkBqCY8lXl1kTfZ8yXWhTcthHnt1MtAuIE itpp-infra
wisp_rsa.pub:      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDnI4UwwPL8gJvtP/Jr7qiw0Qj/bQBwi2+f03p730xvn wisp-backup
germaine-personal.pub: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID2H/2VMn8i7YSUUpcag6yXiI6nB3T99h7JIOs5/+73r germaine@itppartner
homelab.pub:       ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHT+727Cti4cZ2x6CiYDeDKZ9BhvCJCzTHlO9vMInHie homelab-itpp

---

2. Server Root Passwords

Storage: Hudu (Vaultwarden asset) + /root/.hermes/.env (netcup CCP section)

Server	IP	Provider	Access	Notes
Core	152.53.192.33	netcup RS 2000	SSH key only	itpp-infra key, password auth disabled
app1	152.53.36.131	netcup RS 4000	Via root or ippadmin+sudo	Root password in Vaultwarden
app2	152.53.39.202	netcup RS 4000	Via root or ippadmin+sudo	Root password in Vaultwarden
app3	152.53.241.111	netcup RS 4000	Via root or ippadmin+sudo	Root password in Vaultwarden
app1-bu	5.161.114.8	Hetzner CPX11	itpp-infra SSH key	Warm standby, offline by default

Admin Account (all servers)

• Username: ippadmin
• Password: → Vaultwarden entry "ippadmin"
• Sudo: Yes (full sudo access)
• SSH: Key-based only (itpp-infra)

---

3. Cloud & Infrastructure API Keys

Storage: All in ~/.hermes/.env + Hudu API assets (layout 49)

Service	Hudu Asset	Storage Location	Status
Hetzner Cloud	[177]	/root/.hermes/scripts/.hetzner_token + /root/.hermes/.env	✅ Verified Jul 22
Cloudflare DNS	[165]	~/.hermes/.env → CLOUDFLARE_API_TOKEN	✅ Active (verified by health check)
Wasabi S3	[176]	/root/.aws/credentials	✅ Active
netcup API	[166]	~/.hermes/.env → NETCUP_API_KEY	✅ Active
netcup CCP	[167]	~/.hermes/.env → NETCUP_CUSTOMER_NUMBER + NETCUP_CCP_PASSWORD	✅ Active
Gitea (OLD/DEAD)	—	⚠️ EXPIRED — still in homelab + itpp-infrastructure remotes	❌ INVALID (verified Jul 23)
Gitea (ACTIVE)	—	All other repos + gitea-backup.sh — ippadmin	✅ Active (verified Jul 23)

---

4. AI Provider API Keys

All stored in /root/.hermes/.env and Hudu API assets (layout 49).

Provider	Hudu Asset	Purpose	Status
admin-ai (LiteLLM)	[126] Hermes Primary Key	Primary model gateway (all models)	✅ Active
Anthropic	[150]	Claude models	✅ Active
OpenAI	[149]	GPT models	✅ Active
DeepSeek	[152]	DeepSeek models	✅ Active
Google Gemini	[161] / [151]	Gemini models	✅ Active
xAI (Grok)	[154]	Grok models	✅ Active
OpenRouter	[153]	Multi-provider routing	✅ Active
Mistral	[155]	Mistral models	✅ Active
Groq	[157]	Fast inference	✅ Active
Fireworks AI	[156]	Serverless inference	✅ Active
Perplexity	[159]	Search-augmented LLM	✅ Active
Cohere	[158]	Cohere models	✅ Active
AI21 Labs	[160]	Jurassic models	✅ Active
MiniMax	[187]	MiniMax M3	✅ Active
Z.ai (GLM)	[188]	GLM models	✅ Active
Alibaba Qwen	[189] Alibaba Qwen (DashScope)	Qwen models	✅ Active
Deepgram	[162]	STT (voice transcription)	✅ Active

---

5. Communication APIs

Storage: All in ~/.hermes/.env + Hudu API assets (layout 49)

Service	Hudu Asset	Storage	Status
Telegram Bot	[170]	~/.hermes/.env → TELEGRAM_BOT_TOKEN	✅ Active
Twilio (Live)	[184] Twilio Live	~/.hermes/.env → TWILIO_ACCOUNT_SID + TWILIO_AUTH_TOKEN	✅ Active
Twilio (Test)	[185] Twilio Test	~/.hermes/.env → TWILIO_TEST_ACCOUNT_SID + TWILIO_TEST_AUTH_TOKEN	✅ Active
Twilio API Key	[186] Twilio API Key	~/.hermes/.env → TWILIO_API_KEY_SID + TWILIO_API_KEY_SECRET	✅ Active
ElevenLabs	[148]	~/.hermes/config.yaml (auxiliary vision / TTS)	✅ Active
Email SMTP/IMAP	—	/root/.config/himalaya/shonuff.pass	✅ Active
Email account	—	shonuff@germainebrown.com — MXroute via mail.germainebrown.com:2525 (SMTP) / :993 (IMAP)	✅ Active

---

6. VoIP / RingLogix

Storage: ~/.hermes/.env + Hudu API assets

Credential	Hudu Asset	Storage
RingLogix Client ID	[174]	~/.hermes/.env → RINGLOGIX_CLIENT_ID
RingLogix Client Secret	[175]	~/.hermes/.env → RINGLOGIX_CLIENT_SECRET
RingLogix Username	—	~/.hermes/.env → RINGLOGIX_USERNAME
RingLogix Password	—	~/.hermes/.env → RINGLOGIX_PASSWORD
RingLogix Domain	—	~/.hermes/.env → RINGLOGIX_DOMAIN

---

7. MSP / RMM / Security APIs

Storage: All in ~/.hermes/.env + Hudu API assets

Service	Hudu Asset	Storage	Status
SyncroMSP	[168] Token + [169] API Key	~/.hermes/.env → SYNCROMSP_API_TOKEN + SYNCROMSP_API_KEY	✅ Active
Bitdefender GZ	[172]	~/.hermes/.env → BITDEFENDER_API_KEY	✅ Active
VirusTotal	[171]	~/.hermes/.env → VIRUSTOTAL_API_KEY	✅ Active
UISP/UNMS	[173]	~/.hermes/.env → UISP_API_KEY	✅ Active

---

8. Search & Data APIs

Service	Hudu Asset	Storage	Status
Firecrawl	[164]	~/.hermes/.env → FIRECRAWL_API_KEY	✅ Active
Exa AI Search	[163]	~/.hermes/.env → EXA_API_KEY	✅ Active

---

9. Database Credentials

Database	Host	User	Password Location	Purpose
MySQL (apex track)	127.0.0.1:33060 (SSH tunnel from wphost02)	apextrackexperience_1781549652	wp-config.php on wphost02	Apex Track Experience WordPress
MySQL (CloudPanel)	app3:3306	root	/root/.my.cnf on app3 (also in Vaultwarden)	CloudPanel WordPress hosting
LiteLLM Postgres	app1 (Docker)	(in docker-compose)	/root/docker/litellm/docker-compose.yml on app1	LiteLLM operational DB

---

10. Docker Services

Service	URL	Credential Location	Storage
Vaultwarden	vault.itpropartner.com / vault.iamgmb.com	Admin Token → /root/docker/vaultwarden/.env on Core	Docker env file
DRE Portal	portal.debtrecoveryexperts.com	Basic Auth (htpasswd)	/etc/caddy/dre-passwd
SearXNG	(internal, no public endpoint)	(none)	—
DocuSeal	sign.core.itpropartner.com / sign.iamgmb.com	(none / app-managed)	—
Uptime Kuma	uptimekuma.itpropartner.com	(app-managed)	—
Open WebUI	admin-ai.itpropartner.com	admin@itpropartner.com (password: ask Sho'Nuff)	Not in .env
Mealie	recipe.iamgmb.com	G@germainebrown.com (password → Vaultwarden)	Vaultwarden
Ops Portal	ops.itpropartner.com	ippadmin (password → ~/.hermes/.env)	~/.hermes/.env

---

11. VPN & Network Keys

WireGuard (Core)

Item	Value
Interface	wg0
Core Private Key	→ /etc/wireguard/wg0.conf on Core
Core IP	10.77.0.1/24
Listen Port	51821
Home Peer Public Key	1fPwdGQ20CxlZCQZQV134olDcE91hfp78yNDeaKJZzg=
Home Peer Endpoint	76.195.7.60:13231
Routed Networks	10.1.0.0/16, 10.2.0.0/16, 172.16.1.0/24, 172.18.18.0/24

Tailscale

Node	IP	Type	Status
core	100.71.155.7	Linux	✅ Online
app1	100.90.186.109	Linux	✅ Online
app2	100.117.164.66	Linux	✅ Online
app3	100.72.15.12	Linux	✅ Online
app1-bu	100.112.23.21	Linux	⚠️ Offline (7d)
iphone-15-pro-max	100.106.231.86	iOS	✅ Online
ipp-g-lap	100.120.64.120	macOS	✅ Online
m4-mac-mini	100.116.232.65	macOS	✅ Online

---

12. UniFi / UDM Pro Device Keys

Site	Key Location	Type	Status
Grand Lake Club	UniFi Network Controller → Settings → API	Local Network API Key	✅ Stored, pending direct verification
Liberty Tire	UniFi Network Controller → Settings → API	Local Network API Key	✅ Stored, pending direct verification

---

13. Unknown / Not Found

The following credentials are known to exist but were not found in the standard locations:

Item	Notes
Open WebUI admin password	Recovery manual says "in .env or ask Sho'Nuff" — NOT in current .env. Must ask Germaine.
Hudu API key	In skill docs (hudu-management) — used programmatically, not in .env.
Traccar/FleetTracker360 admin	Not in .env. May be Docker env or app-managed.
Twenty CRM credentials	Docker on Core, env at /root/docker/twenty/.env (not read).
WordPress site DB passwords	Various sites, typically in wp-config.php on wphost02 or app3.
app1-bu root password	Hetzner CPX11 — accessed via itpp-infra SSH key only.
ComfyUI / Z4	GPU server allocated for TripFlow — credentials not yet documented.
Home MikroTik admin	SSH via admin@10.77.0.2 with wisp_rsa key. RouterOS password in router config (not extracted).

---

14. Key Rotation & Audit Notes

• Last full audit: 2026-07-23
• Last sanitization: 2026-07-23 — all plaintext secrets removed; use Hudu + file paths for values
• Hetzner token: Rotated Jul 22 (old tokens in Hudu were invalid)
• Twilio: Live + test credentials both present in Hudu [184]/[185]/[186]
• OpenRouter: Fallback routing key — keep active even if not primary
• admin-ai: Primary gateway — all model calls route through this
• Backups: All .env + config files included in daily Hermes backup to S3

Recovery Priority

If Core is lost, you need these to rebuild (in order):

1. /root/.ssh/itpp-infra — SSH to all servers
2. /root/.hermes/.env — All API keys and secrets
3. /root/.aws/credentials — S3 access for backups
4. /root/.hermes/config.yaml — Full Hermes config
5. /root/.config/himalaya/shonuff.pass — Email access

Hudu API Assets (layout 49)

All API keys are documented as Hudu assets. List them via:

GET https://hudu.itpropartner.com/api/v1/companies/1/assets?page=1&per_page=25

Filter by asset_layout_id == 49 to see all API keys with their Hudu asset IDs and storage locations.