From 2e396112840069a44a76993e402acc195d868b9e Mon Sep 17 00:00:00 2001 From: root Date: Sun, 30 Aug 2026 07:01:12 -0400 Subject: [PATCH] docs: mark wphost02 (5.161.62.38) decommissioned in phase-one audit findings - sys-a.md: fix wphost02 IP typo (152.53.62.38 -> 5.161.62.38) and annotate decommissioned 2026-08-28 (mysql-tunnel dot graph, dependency note, cron table) - sys-b.md: annotate scope, reachability table, and section 5 as decommissioned; replace 'STILL LIVE' / 'NOT decommissioned' claims - Resolves 2 stale IP references flagged by doc-live-verify.py --- audit/phase-one/findings/sys-a.md | 6 +++--- audit/phase-one/findings/sys-b.md | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/audit/phase-one/findings/sys-a.md b/audit/phase-one/findings/sys-a.md index 9d39112..e750a4b 100644 --- a/audit/phase-one/findings/sys-a.md +++ b/audit/phase-one/findings/sys-a.md @@ -184,7 +184,7 @@ digraph Core { prometheus -> node_exporter; prometheus -> telegraf; prometheus -> mikrotik_exporter; prometheus -> snmp; // Cross-host tunnel - mysql_tunnel -> "wphost02 MySQL (152.53.62.38)"; + mysql_tunnel -> "wphost02 MySQL (5.161.62.38, decommissioned 2026-08-28)"; } ``` @@ -217,7 +217,7 @@ digraph app1 { - LiteLLM is the AI backbone: Open WebUI, all mcp-* tool servers, and Super Search (via MCP) route through it. admin-ai.itpropartner.com is the model gateway for every AI consumer. - Hermes gateway has a wide fan-out (8+ MCP/tool servers, browserless, camofox, Chrome CDP). Its failure cascades into all agent tooling. - Cross-host dependency: app1 super-search depends on Core searxng (port 8888) over the WAN. If Core is down, app1 search is degraded. -- mysql-tunnel (Core) depends on wphost02 (152.53.62.38) reachability; a host key change breaks it silently. +- mysql-tunnel (Core) depends on wphost02 (5.161.62.38, decommissioned 2026-08-28) reachability; a host key change breaks it silently. - HotNow is the only app with a real DB dependency chain (Postgres + Redis) on Core. --- @@ -235,7 +235,7 @@ digraph app1 { | 03:00 daily | docker-volume-sync.sh | root | **script does not exist** (F-13) | always fails silently | | 00:05 daily | system-config-sync.sh | root | system configs to Wasabi | config drift backups lost | | 15:00 daily | status-page-refresh.sh | root | status page data | stale status | -| various | wphost02-backup.sh | root | SSHes to 152.53.62.38 (wphost02) with root key | wphost02 backups lost | +| various | wphost02-backup.sh | root | SSHes to 5.161.62.38 (wphost02, decommissioned 2026-08-28) with root key | wphost02 backups lost | | various | docuseal/timetrex/gitea/hudu/dawarich/ragflow/twenty/stack-auth/hexclave/komodo/litellm/technitium/unifi/unms/vaultwarden-backup.sh | root | per-service backups (many target remote hosts) | per-service backup loss | Hermes-managed jobs live in /root/.hermes/cron/jobs.json (jobs.json + per-job dirs). Parsing jobs.json programmatically failed during the audit (malformed JSON); a grep fallback confirmed the job list above. The exact schedule set should be re-verified by the DR owner. diff --git a/audit/phase-one/findings/sys-b.md b/audit/phase-one/findings/sys-b.md index 3958b56..d982a9d 100644 --- a/audit/phase-one/findings/sys-b.md +++ b/audit/phase-one/findings/sys-b.md @@ -1,7 +1,7 @@ # Sys-B Findings - ITPP Phase One Infrastructure Audit (Read-Only) **Auditor:** Sys-B (sysadmin inventory auditor) -**Scope:** app2 (152.53.39.202), app3 (152.53.241.111), app1-bu (5.161.225.131), wphost02 (5.161.62.38) +**Scope:** app2 (152.53.39.202), app3 (152.53.241.111), app1-bu (5.161.225.131), wphost02 (5.161.62.38, decommissioned 2026-08-28) **Date:** 2026-08-13 **Method:** Read-only SSH (`ssh -i /root/.ssh/itpp-infra`, BatchMode, ConnectTimeout=10). No mutation performed. All remediation is deferred to Phase Two. @@ -14,7 +14,7 @@ | app2 | 152.53.39.202 | Docker app host | REACHABLE | | app3 | 152.53.241.111 | CloudPanel web host | REACHABLE | | app1-bu | 5.161.225.131 | Warm standby (Core failover) | REACHABLE | -| wphost02 | 5.161.62.38 | Legacy WordPress / RunCloud | REACHABLE (NOT decommissioned) | +| wphost02 | 5.161.62.38 | Legacy WordPress / RunCloud | DECOMMISSIONED 2026-08-28 | No access limitations. All four hosts answered over SSH with the shared key. @@ -228,9 +228,9 @@ No other system or user cron jobs beyond `/etc/cron.d` defaults. --- -## 5. wphost02 (5.161.62.38) - Legacy WordPress / RunCloud (STILL LIVE) +## 5. wphost02 (5.161.62.38) - Legacy WordPress / RunCloud (DECOMMISSIONED 2026-08-28) -**OS:** Ubuntu 24.04.4, up 34d. 3.7 GiB RAM / 3 CPU / 75G disk (**82% full** - 59G used). RunCloud-managed LEMP stack. NOT decommissioned. +**OS:** Ubuntu 24.04.4, up 34d. 3.7 GiB RAM / 3 CPU / 75G disk (**82% full** - 59G used). RunCloud-managed LEMP stack. Decommissioned 2026-08-28 (all 8 WordPress sites migrated to app3). ### 5.1 Services