Fix: app1-bu IP 5.161.114.8→5.161.225.131, CPX11→CPX21; Mattermost/noc dns entry updated

dns-records.md

@@ -12,7 +12,7 @@
 
 | Subdomain | Current IP | Should Be | Reason |
 |---|---|---|---|
-| app1-bu.itpropartner.com | 5.161.114.8 | **5.161.225.131** | Old CPX11 → new CPX21 warm standby |
+| app1-bu.itpropartner.com | 5.161.225.131 | — | CPX21 warm standby, DNS updated 2026-08-08 |
 
 ## PRODUCTION (Netcup — no changes)
 
@@ -70,7 +70,7 @@ DNS, Digital Signage, Networking, Status, Tech Support, Web Hosting, Marketplace
 - `/gitea/` — Gitea (app2 :3000)
 - `/n8n/` — n8n (app1 :5678)
 - `/search/` — Super Search / OSINT (app1 :8100)
-- `/noc/` — Mattermost (future, app1)
+- `/noc/` — noc.itpropartner.com (replacement for Mattermost, future, app1)
 
 ### core.itpropartner.com (152.53.192.33) — Minimal Landing
 Stripped down — just links to ops, my, and other services. Keep Core lean for Hermes.

docs/infrastructure/key-inventory.md

@@ -218,7 +218,7 @@ The following credentials are known to exist but were not found in the standard
 | **Traccar/FleetTracker360 admin** | Not in .env. May be Docker env or app-managed. |
 | **Twenty CRM credentials** | Docker on Core, env at `/root/docker/twenty/.env` (not read). |
 | **WordPress site DB passwords** | Various sites, typically in `wp-config.php` on wphost02 or app3. |
-| **app1-bu root password** | Hetzner CPX11 — accessed via itpp-infra SSH key only. |
+| **app1-bu** | 5.161.225.131 | Hetzner CPX21 — accessed via itpp-infra SSH key only. |
 | **ComfyUI / Z4** | GPU server allocated for TripFlow — credentials not yet documented. |
 | **Home MikroTik admin** | SSH via `admin@10.77.0.2` with `wisp_rsa` key. RouterOS password in router config (not extracted). |