docs: add Uptime Kuma monitoring plan

- Covers all monitored endpoints across ITPP infrastructure - Includes alert thresholds and escalation paths
2026-08-07 08:30:37 -04:00
parent 25e6b8cb79
commit f0138e5d85
1 changed files with 580 additions and 0 deletions
@@ -0,0 +1,580 @@
+# Uptime Kuma Monitoring Plan — ITPP Infrastructure
+
+**Generated:** 2026-08-07  
+**Uptime Kuma Instance:** https://uptimekuma.itpropartner.com  
+**Methodology:** Full- stack audit via Caddy/Nginx config inspection across all 5 servers + DNS enumeration
+
+---
+
+## 1. Current Monitors (27)
+
+| # | Name | URL | Type |
+|---|------|-----|------|
+| 1 | Admin-AI | https://admin-ai.itpropartner.com | HTTP |
+| 2 | Backup Restore | https://my.itpropartner.com/backups/ | HTTP |
+| 3 | CloudPanel | https://panel.itpropartner.com | HTTP |
+| 4 | DNS1 | https://dns1.itpropartner.com | HTTP |
+| 5 | DRE Portal | https://portal.debtrecoveryexperts.com | HTTP |
+| 6 | FW Gateway | (ping) | PING |
+| 7 | FW Internet | (ping) | PING |
+| 8 | Forefront Wireless Website | https://www.forefrontwireless.com | HTTP |
+| 9 | GPS | https://gps.fleettracker360.com | HTTP |
+| 10 | Gift-A-Roast | https://giftaroast.com | HTTP |
+| 11 | Git | https://git.itpropartner.com | HTTP |
+| 12 | Grand Lake Club | https://www.grandlakeclub.com | HTTP |
+| 13 | HotNow API | https://api.hotnow.io/api/health | HTTP |
+| 14 | Hudu | https://hudu.itpropartner.com | HTTP |
+| 15 | IT Pro Partner | https://itpropartner.com | HTTP |
+| 16 | Mealie | https://recipe.iamgmb.com | HTTP |
+| 17 | My VoIPSimplicity | https://my.voipsimplicity.com | HTTP |
+| 18 | NOC | https://noc.itpropartner.com | HTTP |
+| 19 | Ops | https://ops.itpropartner.com | HTTP |
+| 20 | Splynx | https://portal.forefrontwireless.com | HTTP |
+| 21 | Status | https://status.itpropartner.com | HTTP |
+| 22 | Timeline | https://timeline.iamgmb.com | HTTP |
+| 23 | UNMS | https://unms.forefrontwireless.com/ | HTTP |
+| 24 | Unifi | https://unifi.itpropartner.com | HTTP |
+| 25 | Vault | https://vault.itpropartner.com | HTTP |
+| 26 | VoIPSimplicity | https://www.voipsimplicity.com | HTTP |
+| 27 | Wazuh | https://wz.itpropartner.com | HTTP |
+
+---
+
+## 2. Complete Inventory of All Public-Facing Services
+
+### 2.1 Core (152.53.192.33) — Caddy reverse proxy
+
+| # | Service | URL | Backend | Status |
+|---|---------|-----|---------|--------|
+| C1 | Ops Portal | https://ops.itpropartner.com | :8090 | **Monitored (#19)** |
+| C2 | Uptime Kuma | https://uptimekuma.itpropartner.com | :3001 | **MISSING** |
+| C3 | Status Page | https://status.itpropartner.com | static + :3001 API | **Monitored (#21)** |
+| C4 | My ITPP (Backup Restore) | https://my.itpropartner.com | static + :8090 API | **Monitored (#2)** |
+| C5 | DRE Portal | https://portal.debtrecoveryexperts.com | static | **Monitored (#5)** |
+| C6 | DRE Pay | https://pay.debtrecoveryexperts.com | static | **MISSING** |
+| C7 | DRE Internal | https://internal.debtrecoveryexperts.com | static | **MISSING** |
+| C8 | DRE CRM | https://crm.debtrecoveryexperts.com | :3003 (Twenty CRM) | **MISSING** |
+| C9 | IntelSight CRM | https://crm.intelsight.io | :3003 (Twenty CRM) | **MISSING** |
+| C10 | Shark Attack | https://shark.iamgmb.com | :8083 | **MISSING** |
+| C11 | DigLocate | https://dig.iamgmb.com | :8000 API + static | **MISSING** |
+| C12 | Sign (DocuSeal on Core) | https://sign.iamgmb.com | :8090 | **MISSING** ⚠️ |
+| C13 | Mockup Lab | https://mockup.iamgmb.com | static + :8200/:8210 | **MISSING** |
+| C14 | Schedule | https://schedule.iamgmb.com | static | **MISSING** |
+| C15 | SeeMyTrip | https://seemytrip.iamgmb.com | :8113 + static | **MISSING** |
+| C16 | Rally Calendar | https://rally.iamgmb.com | :8105 + static | **MISSING** |
+| C17 | Shopping Cart | https://shopping.iamgmb.com | :8101 + static | **MISSING** |
+| C18 | Proposals | https://proposals.iamgmb.com | static | **MISSING** |
+| C19 | HotNow Landing | https://hotnow.io | static | **MISSING** |
+| C20 | HotNow App | https://app.hotnow.io | static | **MISSING** |
+| C21 | HotNow API | https://api.hotnow.io | :8001 | **Monitored (#13)** ⚠️ |
+| C22 | HotNow Admin | https://admin.hotnow.io | static | **MISSING** |
+| C23 | IntelSight Landing | https://intelsight.io | static | **MISSING** |
+| C24 | IntelSight Landing (alt) | https://intelsight.iamgmb.com | static | **MISSING** |
+| C25 | My IntelSight | https://my.intelsight.io | :8099 + static | **MISSING** |
+| C26 | GPS Traccar (proxy) | https://gps.fleettracker360.com | proxy→app2:8082 | **Monitored (#9)** |
+| C27 | Hear FleetTracker | https://hear.fleettracker360.com | static | **MISSING** |
+| C28 | Track FleetTracker | http://track.fleettracker360.com | proxy→app2:5055 | **MISSING** (HTTP only) |
+| C29 | Voice (Hermes) | https://voice.itpropartner.com | :4331 | **MISSING** |
+| C30 | Voice Open | https://voice-open.itpropartner.com | :9101 | **MISSING** |
+| C31 | Central Auth | https://auth.itpropartner.com | static + :8500 API | **MISSING** |
+| C32 | TimeTrex | https://timetrex.iamgmb.com | :8085 | **MISSING** |
+| C33 | MicroBin Share | https://share.itpropartner.com | :8260 | **MISSING** |
+| C34 | PRY | http://pry.iamgmb.com | :8905 | **MISSING** (HTTP only) |
+| C35 | FleetTracker360 TLD | https://fleettracker360.com | proxy→app2:8082 | **MISSING** – served by Core Caddy but DNS says app2, TLD also on app2 Caddy |
+
+### 2.2 App1 (152.53.36.131) — Caddy reverse proxy
+
+| # | Service | URL | Backend | Status |
+|---|---------|-----|---------|--------|
+| A1 | Vaultwarden | https://vault.itpropartner.com | :8081 | **Monitored (#25)** |
+| A2 | Vaultwarden (alt) | https://vault.iamgmb.com | :8081 | **MISSING** |
+| A3 | n8n | https://n8n.itpropartner.com | :5678 | **MISSING** |
+| A4 | Open WebUI | https://ai.itpropartner.com | :3000 | **MISSING** |
+| A5 | LiteLLM / Admin-AI | https://admin-ai.itpropartner.com | :4000 | **Monitored (#1)** |
+| A6 | NOC (Mattermost) | https://noc.itpropartner.com | :8065 | **Monitored (#18)** |
+| A7 | DocuSeal (app1) | https://sign.iamgmb.com | :3002 | **MISSING** ⚠️ |
+| A8 | Wazuh | https://wz.itpropartner.com | :5601 | **Monitored (#27)** |
+| A9 | Gift-A-Roast | https://giftaroast.com | static | **Monitored (#10)** |
+| A10 | Gift-A-Roast WWW | https://www.giftaroast.com | static | **MISSING** (alias) |
+| A11 | Gift-A-Roast API | https://api.giftaroast.com | :8100 | **MISSING** |
+| A12 | Komodo | https://komodo.iamgmb.com | :9120 | **MISSING** |
+| A13 | CRM DRE (app1 dupe) | https://crm.debtrecoveryexperts.com | :3003 | **MISSING** (DNS→Core) |
+
+⚠️ **Conflict:** `sign.iamgmb.com` is configured on BOTH Core (:8090) and app1 (:3002). DNS resolves to app1 (152.53.36.131), so app1 wins. `crm.debtrecoveryexperts.com` is on BOTH Core and app1; DNS resolves to Core.
+
+### 2.3 App2 (152.53.39.202) — Caddy reverse proxy
+
+| # | Service | URL | Backend | Status |
+|---|---------|-----|---------|--------|
+| B1 | Technitium DNS | https://dns1.itpropartner.com | :5380 | **Monitored (#4)** |
+| B2 | Traccar GPS | https://gps.fleettracker360.com | :8082 | **Monitored (#9)** |
+| B3 | FleetTracker360 TLD | https://fleettracker360.com | :8082 | **MISSING** |
+| B4 | UNMS | https://unms.forefrontwireless.com | :8444 | **Monitored (#23)** |
+| B5 | UniFi Controller | https://unifi.itpropartner.com | :8443 | **Monitored (#24)** |
+| B6 | Hudu | https://hudu.itpropartner.com | :3000 | **Monitored (#14)** |
+| B7 | Gitea | https://git.itpropartner.com | :3001 | **Monitored (#11)** |
+| B8 | Dawarich Timeline | https://timeline.iamgmb.com | :3002 | **Monitored (#22)** |
+| B9 | RAGFlow | https://ragflow.itpropartner.com | :9392 | **MISSING** (NO DNS!) |
+
+⚠️ **RAGFlow** has a Caddy vhost on app2 but NO DNS A/CNAME record. It will not resolve publicly. Needs DNS before monitoring.
+
+### 2.4 App3 (152.53.241.111) — CloudPanel/Nginx
+
+| # | Service | URL | Backend | Status |
+|---|---------|-----|---------|--------|
+| D1 | CloudPanel Admin | https://panel.itpropartner.com | :8443 | **Monitored (#3)** |
+| D2 | Hexclave / Stack Auth | https://auth2.itpropartner.com | :8101 | **MISSING** |
+| D3 | Hexclave API | https://auth2-api.itpropartner.com | :8102 | **MISSING** |
+| D4 | Buzz Relay | https://buzz.iamgmb.com | :3000 | **MISSING** |
+| D5 | Forms | https://forms.itpropartner.com | :8700 | **MISSING** |
+| D6 | My VoIPSimplicity | https://my.voipsimplicity.com | :8080 (WP) | **Monitored (#17)** |
+| D7 | DRE TLD | https://debtrecoveryexperts.com | :8080 (WP) | **MISSING** |
+| D8 | DRE WWW | https://www.debtrecoveryexperts.com | :8080 (WP) | **MISSING** |
+| D9 | IAMGMB TLD | https://iamgmb.com | :8080 (WP) | **MISSING** |
+| D10 | IAMGMB WWW | https://www.iamgmb.com | :8080 (WP) | **MISSING** |
+| D11 | IntelSight TLD (WP) | https://intelsight.io | :8080 (WP) | **MISSING** ⚠️ |
+| D12 | IntelSight WWW (WP) | https://www.intelsight.io | :8080 (WP) | **MISSING** ⚠️ |
+| D13 | MainWP | https://mainwp.itpropartner.com | :8080 (WP) | **MISSING** |
+| D14 | TransitPin | https://transitpin.com | :8080 (WP) | **MISSING** |
+| D15 | TransitPin WWW | https://www.transitpin.com | :8080 (WP) | **MISSING** |
+| D16 | Apex Track Experience | https://apextrackexperience.com | :8080 (WP) | **MISSING** |
+| D17 | BoxPilot Logistics | https://boxpilotlogistics.com | Cloudflare proxied→:8080 | **MISSING** |
+| D18 | Katie Watts Design | https://katiewattsdesign.com | :8080 (WP) | **MISSING** |
+| D19 | Vigilant Tac | https://vigilanttac.com | Cloudflare proxied→:8080 | **MISSING** |
+| D20 | VoIPSimplicity TLD | https://voipsimplicity.com | :8080 (WP) | **MISSING** |
+
+⚠️ **Conflict:** `intelsight.io` has BOTH a static landing site on Core (Caddy) AND a WordPress site on app3 (CloudPanel/Nginx). DNS (104.21.46.116 / 172.67.138.75) goes through Cloudflare proxy — the actual routing depends on Cloudflare's configuration (likely to Core for `intelsight.io` as a landing page, and to app3 for `www.intelsight.io` via separate Cloudflare rules. The app3 Nginx config has `server_name intelsight.io www1.intelsight.io;` which may not actually receive traffic due to DNS routing.)
+
+### 2.5 wphost02 (5.161.62.38) — RunCloud (LEGACY — being migrated)
+
+All sites below are being migrated to app3 CloudPanel. DNS for most already points to app3 or Cloudflare. **Not recommended for new monitoring** as they will be decommissioned. Listed for completeness:
+
+| # | Service | URL | Status |
+|---|---------|-----|--------|
+| W1 | Apex Track Experience | apextrackexperience.com | DNS→app3, migrated |
+| W2 | BoxPilot Logistics | boxpilotlogistics.com | DNS→CF proxy ⚠️ |
+| W3 | DRE (legacy) | debtrecoveryexperts.com | DNS→app3, migrated |
+| W4 | IAMGMB (legacy) | iamgmb.com | DNS→CF proxy ⚠️ |
+| W5 | Katie Watts Design | katiewattsdesign.com | DNS→app3, migrated |
+| W6 | MainWP (legacy) | mainwp.itpropartner.com | DNS→app3, migrated |
+| W7 | Vigilant Tac | vigilanttac.com | DNS→CF proxy ⚠️ |
+| W8 | VoIPSimplicity (legacy) | voipsimplicity.com | DNS→CF proxy ⚠️ |
+
+### 2.6 SiteGround-Hosted (External)
+
+| # | Service | URL | Status |
+|---|---------|-----|--------|
+| S1 | IT Pro Partner | https://itpropartner.com | **Monitored (#15)** |
+| S2 | IT Pro Partner WWW | https://www.itpropartner.com | (redirects to TLD, verified) |
+| S3 | Forefront Wireless | https://www.forefrontwireless.com | **Monitored (#8)** |
+| S4 | Forefront Wireless TLD | https://forefrontwireless.com | **MISSING** (TLD not monitored) |
+| S5 | Grand Lake Club | https://www.grandlakeclub.com | **Monitored (#12)** |
+| S6 | Grand Lake Club TLD | https://grandlakeclub.com | **MISSING** (TLD not monitored) |
+
+### 2.7 Mealie (Route to Recipe)
+
+| # | Service | URL | Status |
+|---|---------|-----|--------|
+| M1 | Mealie | https://recipe.iamgmb.com | **Monitored (#16)** |
+
+---
+
+## 3. Gap Analysis
+
+### 3.1 Summary
+
+| Category | Count |
+|----------|-------|
+| **Currently monitored** | 27 |
+| **Public-facing services total** | ~80 unique URLs |
+| **Services MISSING monitoring** | **53** |
+| **TLDs that need separate monitors** | **10** |
+
+### 3.2 Services With NO Monitoring (Categorized by Priority)
+
+#### CRITICAL — Core infrastructure (monitor immediately)
+
+| # | Service | URL | Why Critical |
+|---|---------|-----|-------------|
+| G1 | **Uptime Kuma itself** | https://uptimekuma.itpropartner.com | If UK goes down, you lose ALL monitoring visibility |
+| G2 | **n8n Automation** | https://n8n.itpropartner.com | Workflow automation backbone |
+| G3 | **Open WebUI** | https://ai.itpropartner.com | Primary AI chat interface |
+| G4 | **Central Auth** | https://auth.itpropartner.com | Centralized authentication gateway |
+| G5 | **DocuSeal (sign)** | https://sign.iamgmb.com | Document signing service |
+| G6 | **Gitea** | (already monitored #11) | ✓ |
+
+#### HIGH — Business operations
+
+| # | Service | URL | Why |
+|---|---------|-----|-----|
+| G7 | **DRE CRM** | https://crm.debtrecoveryexperts.com | Client CRM (Twenty) |
+| G8 | **DRE Pay** | https://pay.debtrecoveryexperts.com | Payment portal |
+| G9 | **DRE TLD** | https://debtrecoveryexperts.com | Main DRE website |
+| G10 | **IntelSight Landing** | https://intelsight.io | Product landing page |
+| G11 | **My IntelSight** | https://my.intelsight.io | Customer portal |
+| G12 | **IntelSight CRM** | https://crm.intelsight.io | IntelSight CRM (Twenty) |
+| G13 | **Hexclave/Stack Auth** | https://auth2.itpropartner.com | Auth service for apps |
+| G14 | **Hexclave API** | https://auth2-api.itpropartner.com | Auth API backend |
+| G15 | **Komodo** | https://komodo.iamgmb.com | Server management panel |
+| G16 | **HotNow Landing** | https://hotnow.io | Product website |
+| G17 | **HotNow App** | https://app.hotnow.io | Web application |
+| G18 | **HotNow Admin** | https://admin.hotnow.io | Admin dashboard |
+| G19 | **IAMGMB.com** | https://iamgmb.com | Main personal/brand website |
+| G20 | **Shark Attack** | https://shark.iamgmb.com | Game website |
+
+#### MEDIUM — Active but lower traffic
+
+| # | Service | URL | Why |
+|---|---------|-----|-----|
+| G21 | **Buzz Relay** | https://buzz.iamgmb.com | Self-hosted Buzz relay |
+| G22 | **Rally Calendar** | https://rally.iamgmb.com | Family calendar |
+| G23 | **Shopping Cart** | https://shopping.iamgmb.com | Shared shopping list |
+| G24 | **SeeMyTrip** | https://seemytrip.iamgmb.com | Trip planning |
+| G25 | **Proposals** | https://proposals.iamgmb.com | Business proposals |
+| G26 | **Mockup Lab** | https://mockup.iamgmb.com | Project showcase |
+| G27 | **DigLocate** | https://dig.iamgmb.com | Digital locating service |
+| G28 | **Schedule** | https://schedule.iamgmb.com | Scheduling tool |
+| G29 | **Forms** | https://forms.itpropartner.com | Form service |
+| G30 | **Voice (Hermes)** | https://voice.itpropartner.com | Voice agent endpoint |
+| G31 | **Voice Open** | https://voice-open.itpropartner.com | Voice Open endpoint |
+| G32 | **Vault (alt domain)** | https://vault.iamgmb.com | Vaultwarden alt domain |
+| G33 | **TimeTrex** | https://timetrex.iamgmb.com | Time tracking demo |
+| G34 | **MicroBin Share** | https://share.itpropartner.com | Secure file sharing |
+| G35 | **Gift-A-Roast WWW** | https://www.giftaroast.com | WWW redirect for TLD |
+| G36 | **Gift-A-Roast API** | https://api.giftaroast.com | Backend API |
+
+#### LOW — Client WordPress sites (app3 CloudPanel)
+
+| # | Service | URL |
+|---|---------|-----|
+| G37 | **MainWP** | https://mainwp.itpropartner.com |
+| G38 | **My VoIPSimplicity TLD** | https://voipsimplicity.com |
+| G39 | **TransitPin** | https://transitpin.com |
+| G40 | **TransitPin WWW** | https://www.transitpin.com |
+| G41 | **Apex Track Experience** | https://apextrackexperience.com |
+| G42 | **BoxPilot Logistics** | https://boxpilotlogistics.com |
+| G43 | **Katie Watts Design** | https://katiewattsdesign.com |
+| G44 | **Vigilant Tac** | https://vigilanttac.com |
+| G45 | **DRE Internal** | https://internal.debtrecoveryexperts.com |
+| G46 | **Hear FleetTracker** | https://hear.fleettracker360.com |
+
+#### NEEDS DNS BEFORE MONITORING
+
+| # | Service | Expected URL | Issue |
+|---|---------|-------------|-------|
+| G47 | **Grafana** | https://grafana.itpropartner.com | NO DNS record |
+| G48 | **Twenty CRM (ITPP)** | https://crm.itpropartner.com | NO DNS record |
+| G49 | **RAGFlow** | https://ragflow.itpropartner.com | NO DNS record (Caddy configured on app2) |
+| G50 | **SearXNG** | https://search.iamgmb.com | NO DNS record |
+| G51 | **Kokoro TTS** | https://kokoro.iamgmb.com | NO DNS record |
+| G52 | **DocuSeal (ITPP)** | https://docusign.itpropartner.com | NO DNS record |
+
+### 3.3 TLD Monitors Needed
+
+The task requires: for every subdomain service, also monitor the TLD. Here is the gap:
+
+| Domain | Subdomains Monitored | TLD Monitored? | Action |
+|--------|---------------------|----------------|--------|
+| **itpropartner.com** | 17 subdomains monitored | ✓ YES (#15) | Complete |
+| **debtrecoveryexperts.com** | portal ✓ | ✗ **NO** | **Add TLD monitor** |
+| **fleettracker360.com** | gps ✓ | ✗ **NO** | **Add TLD monitor** |
+| **voipsimplicity.com** | www ✓, my ✓ | ✗ **NO** | **Add TLD monitor** |
+| **forefrontwireless.com** | www ✓, portal ✓, unms ✓ | ✗ **NO** | **Add TLD monitor** |
+| **grandlakeclub.com** | www ✓ | ✗ **NO** | **Add TLD monitor** |
+| **iamgmb.com** | recipe ✓, timeline ✓ | ✗ **NO** | **Add TLD monitor** |
+| **hotnow.io** | api ✓ | ✗ **NO** | **Add TLD monitor** |
+| **intelsight.io** | none | ✗ **NO** | **Add TLD monitor** |
+| **giftaroast.com** | TLD ✓ | ✓ YES | Complete |
+
+---
+
+## 4. Recommended New Monitors
+
+### 4.1 TLD Monitors (Priority 1)
+
+These ensure the root domain resolves and responds, independent of any subdomain:
+
+| # | Name | URL | Type | Notes |
+|---|------|-----|------|-------|
+| T1 | DRE TLD | https://debtrecoveryexperts.com | HTTP | WordPress site on app3 CloudPanel |
+| T2 | FleetTracker360 TLD | https://fleettracker360.com | HTTP | Served by app2 Caddy, proxied to Traccar |
+| T3 | VoIPSimplicity TLD | https://voipsimplicity.com | HTTP | WordPress site on app3 CloudPanel |
+| T4 | Forefront Wireless TLD | https://forefrontwireless.com | HTTP | SiteGround-hosted |
+| T5 | Grand Lake Club TLD | https://grandlakeclub.com | HTTP | SiteGround-hosted |
+| T6 | IAMGMB TLD | https://iamgmb.com | HTTP | WordPress site on app3 CloudPanel |
+| T7 | HotNow TLD | https://hotnow.io | HTTP | Static site on Core |
+| T8 | IntelSight TLD | https://intelsight.io | HTTP | Static landing on Core (or WP on app3 — verify) |
+| T9 | Gift-A-Roast WWW | https://www.giftaroast.com | HTTP | WWW alias for giftaroast.com |
+
+### 4.2 Critical Services (Priority 1)
+
+| # | Name | URL | Type | Why |
+|---|------|-----|------|-----|
+| C1 | Uptime Kuma | https://uptimekuma.itpropartner.com | HTTP | **Monitoring the monitor** — use `/health` endpoint for lightweight check |
+| C2 | n8n Automation | https://n8n.itpropartner.com | HTTP | Core workflow automation |
+| C3 | Open WebUI | https://ai.itpropartner.com | HTTP | Primary AI interface |
+| C4 | Central Auth | https://auth.itpropartner.com | HTTP | Auth gateway for multiple services |
+| C5 | DocuSeal (sign) | https://sign.iamgmb.com | HTTP | Document signing (resolves to app1) |
+| C6 | Komodo | https://komodo.iamgmb.com | HTTP | Server management dashboard |
+
+### 4.3 High Priority — Business Services (Priority 2)
+
+| # | Name | URL | Type | Why |
+|---|------|-----|------|-----|
+| H1 | DRE CRM | https://crm.debtrecoveryexperts.com | HTTP | Client CRM (Twenty) |
+| H2 | DRE Pay | https://pay.debtrecoveryexperts.com | HTTP | Payment collection portal |
+| H3 | DRE WWW | https://www.debtrecoveryexperts.com | HTTP | DRE main website (www) |
+| H4 | IntelSight Landing | https://intelsight.io | HTTP | Product landing page |
+| H5 | My IntelSight | https://my.intelsight.io | HTTP | Customer-facing portal |
+| H6 | IntelSight CRM | https://crm.intelsight.io | HTTP | IntelSight CRM (Twenty) |
+| H7 | Hexclave / Stack Auth | https://auth2.itpropartner.com | HTTP | Auth service |
+| H8 | Hexclave API | https://auth2-api.itpropartner.com | HTTP | Auth API backend |
+| H9 | HotNow App | https://app.hotnow.io | HTTP | User-facing web app |
+| H10 | HotNow Admin | https://admin.hotnow.io | HTTP | Admin dashboard |
+| H11 | Shark Attack | https://shark.iamgmb.com | HTTP | Game website |
+| H12 | Buzz Relay | https://buzz.iamgmb.com | HTTP | Buzz relay service |
+
+### 4.4 Medium Priority — Active Services (Priority 3)
+
+| # | Name | URL | Type | Why |
+|---|------|-----|------|-----|
+| M1 | Rally Calendar | https://rally.iamgmb.com | HTTP | Family calendar with backend |
+| M2 | Shopping Cart | https://shopping.iamgmb.com | HTTP | Shared shopping with backend |
+| M3 | SeeMyTrip | https://seemytrip.iamgmb.com | HTTP | Trip planning with backend |
+| M4 | Proposals | https://proposals.iamgmb.com | HTTP | Business proposals |
+| M5 | Mockup Lab | https://mockup.iamgmb.com | HTTP | Project showcase with API |
+| M6 | DigLocate | https://dig.iamgmb.com | HTTP | Digital locating with API |
+| M7 | Schedule | https://schedule.iamgmb.com | HTTP | Scheduling tool |
+| M8 | Forms | https://forms.itpropartner.com | HTTP | Form service (app3) |
+| M9 | Voice (Hermes) | https://voice.itpropartner.com | HTTP | Voice agent endpoint |
+| M10 | Voice Open | https://voice-open.itpropartner.com | HTTP | Voice open endpoint |
+| M11 | Vault (alt) | https://vault.iamgmb.com | HTTP | Vaultwarden alt domain |
+| M12 | TimeTrex | https://timetrex.iamgmb.com | HTTP | Time tracking demo |
+| M13 | MicroBin Share | https://share.itpropartner.com | HTTP | Secure file sharing |
+| M14 | Gift-A-Roast API | https://api.giftaroast.com | HTTP | Backend API |
+| M15 | IAMGMB WWW | https://www.iamgmb.com | HTTP | WWW redirect for TLD |
+| M16 | IntelSight WWW | https://www.intelsight.io | HTTP | WWW alias |
+
+### 4.5 Low Priority — Client WordPress Sites (Priority 4)
+
+These are WordPress sites on app3 CloudPanel. Some have DNS proxied through Cloudflare:
+
+| # | Name | URL | Type | Notes |
+|---|------|-----|------|-------|
+| L1 | MainWP | https://mainwp.itpropartner.com | HTTP | WP management |
+| L2 | TransitPin | https://transitpin.com | HTTP | Client site |
+| L3 | TransitPin WWW | https://www.transitpin.com | HTTP | WWW alias |
+| L4 | Apex Track Experience | https://apextrackexperience.com | HTTP | Client site |
+| L5 | BoxPilot Logistics | https://boxpilotlogistics.com | HTTP | Cloudflare proxied |
+| L6 | Katie Watts Design | https://katiewattsdesign.com | HTTP | Client site |
+| L7 | Vigilant Tac | https://vigilanttac.com | HTTP | Cloudflare proxied |
+| L8 | DRE Internal | https://internal.debtrecoveryexperts.com | HTTP | Internal DRE portal |
+| L9 | Hear FleetTracker | https://hear.fleettracker360.com | HTTP | Static page |
+| L10 | DRE WWW | https://www.debtrecoveryexperts.com | HTTP | WordPress DRE site |
+
+### 4.6 Needs DNS Resolution First (Priority 5)
+
+These services have no DNS A/CNAME records. Add DNS before monitoring:
+
+| # | Name | Expected URL | Server | Port |
+|---|------|-------------|--------|------|
+| D1 | Grafana | https://grafana.itpropartner.com | Core | :3002 |
+| D2 | Twenty CRM (ITPP) | https://crm.itpropartner.com | app1 | :3003 |
+| D3 | RAGFlow | https://ragflow.itpropartner.com | app2 | :9392 |
+| D4 | SearXNG | https://search.iamgmb.com | Core | TBD |
+| D5 | Kokoro TTS | https://kokoro.iamgmb.com | app1 | :8880 |
+| D6 | DocuSeal (ITPP) | https://docusign.itpropartner.com | app1 | :3002 |
+
+### 4.7 Additional Recommendations
+
+| # | Name | URL | Type | Notes |
+|---|------|-----|------|-------|
+| A1 | Server Health: Core | (internal) | TCP PORT | Monitor SSH :22 on 152.53.192.33 |
+| A2 | Server Health: app1 | (internal) | TCP PORT | Monitor SSH :22 on 152.53.36.131 |
+| A3 | Server Health: app2 | (internal) | TCP PORT | Monitor SSH :22 on 152.53.39.202 |
+| A4 | Server Health: app3 | (internal) | TCP PORT | Monitor SSH :22 on 152.53.241.111 |
+| A5 | CloudPanel HTTPS | https://panel.itpropartner.com:8443 | HTTPS | Direct CloudPanel check (in addition to existing proxy monitor) |
+
+---
+
+## 5. Priority Order for Adding Monitors
+
+### Phase 1 — Immediate (today)
+1. **Uptime Kuma** — can't monitor anything if this is down and you don't know
+2. **n8n** — automation backbone; workflows stop if this is down
+3. **Open WebUI (ai)** — primary user-facing AI service
+4. **Central Auth** — breaks login for dependent services
+5. **TLDs (all 9)** — foundational; many subdomains depend on TLD being healthy
+
+### Phase 2 — This Week (business-critical)
+6. **DocuSeal (sign.iamgmb.com)**
+7. **DRE CRM** + **DRE TLD** + **DRE WWW** + **DRE Pay**
+8. **IntelSight Landing** + **My IntelSight** + **IntelSight CRM**
+9. **Hexclave Auth** + **Hexclave API**
+10. **HotNow TLD** (if not done in Phase 1) + **HotNow App** + **HotNow Admin**
+11. **Komodo**
+
+### Phase 3 — Next Week (active services)
+12. **IAMGMB TLD** + **WWW**
+13. **Shark Attack**
+14. **Buzz Relay**
+15. All medium-priority iamgmb.com subdomains (Rally, Shopping, SeeMyTrip, Proposals, Mockup, DigLocate, Schedule)
+16. **Voice** + **Voice Open**
+17. **Forms** + **Share** + **TimeTrex** + **Vault (alt)**
+18. **Gift-A-Roast API** + **WWW**
+
+### Phase 4 — Within 2 Weeks (client sites)
+19. All client WordPress sites (MainWP, TransitPin, Apex Track, BoxPilot, Katie Watts, Vigilant Tac)
+20. DRE Internal, Hear FleetTracker
+
+### Phase 5 — DNS Pending
+21. Create DNS records for Grafana, CRM, RAGFlow, SearXNG, Kokoro, DocuSeal — then add monitors
+
+---
+
+## 6. Subdomain-to-TLD Mapping
+
+For every subdomain service, here is the required TLD monitor:
+
+| Subdomain | Requires TLD Monitor | Status |
+|-----------|---------------------|--------|
+| admin-ai.itpropartner.com | itpropartner.com | ✓ #15 |
+| panel.itpropartner.com | itpropartner.com | ✓ #15 |
+| git.itpropartner.com | itpropartner.com | ✓ #15 |
+| hudu.itpropartner.com | itpropartner.com | ✓ #15 |
+| vault.itpropartner.com | itpropartner.com | ✓ #15 |
+| wz.itpropartner.com | itpropartner.com | ✓ #15 |
+| unifi.itpropartner.com | itpropartner.com | ✓ #15 |
+| noc.itpropartner.com | itpropartner.com | ✓ #15 |
+| ops.itpropartner.com | itpropartner.com | ✓ #15 |
+| status.itpropartner.com | itpropartner.com | ✓ #15 |
+| dns1.itpropartner.com | itpropartner.com | ✓ #15 |
+| n8n.itpropartner.com | itpropartner.com | ✓ #15 |
+| ai.itpropartner.com | itpropartner.com | ✓ #15 |
+| auth.itpropartner.com | itpropartner.com | ✓ #15 |
+| auth2.itpropartner.com | itpropartner.com | ✓ #15 |
+| auth2-api.itpropartner.com | itpropartner.com | ✓ #15 |
+| uptimekuma.itpropartner.com | itpropartner.com | ✓ #15 |
+| voice.itpropartner.com | itpropartner.com | ✓ #15 |
+| voice-open.itpropartner.com | itpropartner.com | ✓ #15 |
+| share.itpropartner.com | itpropartner.com | ✓ #15 |
+| mainwp.itpropartner.com | itpropartner.com | ✓ #15 |
+| forms.itpropartner.com | itpropartner.com | ✓ #15 |
+| my.itpropartner.com | itpropartner.com | ✓ #15 |
+| portal.debtrecoveryexperts.com | debtrecoveryexperts.com | ✗ **Add T1** |
+| crm.debtrecoveryexperts.com | debtrecoveryexperts.com | ✗ **Add T1** |
+| internal.debtrecoveryexperts.com | debtrecoveryexperts.com | ✗ **Add T1** |
+| pay.debtrecoveryexperts.com | debtrecoveryexperts.com | ✗ **Add T1** |
+| www.debtrecoveryexperts.com | debtrecoveryexperts.com | ✗ **Add T1** |
+| gps.fleettracker360.com | fleettracker360.com | ✗ **Add T2** |
+| track.fleettracker360.com | fleettracker360.com | ✗ **Add T2** |
+| hear.fleettracker360.com | fleettracker360.com | ✗ **Add T2** |
+| my.voipsimplicity.com | voipsimplicity.com | ✗ **Add T3** |
+| www.voipsimplicity.com | voipsimplicity.com | ✗ **Add T3** |
+| www.forefrontwireless.com | forefrontwireless.com | ✗ **Add T4** |
+| portal.forefrontwireless.com | forefrontwireless.com | ✗ **Add T4** |
+| unms.forefrontwireless.com | forefrontwireless.com | ✗ **Add T4** |
+| www.grandlakeclub.com | grandlakeclub.com | ✗ **Add T5** |
+| recipe.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| timeline.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| buzz.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| mockup.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| schedule.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| seemytrip.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| rally.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| shopping.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| proposals.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| shark.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| dig.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| sign.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| pry.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| timetrex.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| komodo.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| vault.iamgmb.com | iamgmb.com | ✗ **Add T6** |
+| api.hotnow.io | hotnow.io | ✗ **Add T7** |
+| app.hotnow.io | hotnow.io | ✗ **Add T7** |
+| admin.hotnow.io | hotnow.io | ✗ **Add T7** |
+| my.intelsight.io | intelsight.io | ✗ **Add T8** |
+| crm.intelsight.io | intelsight.io | ✗ **Add T8** |
+| www.giftaroast.com | giftaroast.com | ✗ **Add T9** |
+| api.giftaroast.com | giftaroast.com | ✗ **Add T9** |
+
+---
+
+## 7. Conflicts & Issues Found
+
+### 7.1 Duplicate Service Routing
+- **`sign.iamgmb.com`**: Configured on BOTH Core Caddy (:8090 — PRY/Ops backend) AND app1 Caddy (:3002 — DocuSeal). DNS resolves to app1 (152.53.36.131), so app1 wins. Core config is stale.
+- **`crm.debtrecoveryexperts.com`**: On BOTH Core (:3003) AND app1 (:3003). DNS resolves to Core (152.53.192.33), so Core wins. The app1 config is likely stale.
+- **`mockup.iamgmb.com`**: On BOTH Core AND app1. DNS resolves to Core (152.53.192.33), so Core wins.
+- **`intelsight.io`**: On BOTH Core (static landing) AND app3 (WordPress). DNS goes through Cloudflare — actual routing unclear.
+
+### 7.2 Missing DNS Records
+Services configured in Caddy/Nginx but with NO DNS A/CNAME records:
+- grafana.itpropartner.com (Core, port :3002)
+- crm.itpropartner.com (app1, port :3003)
+- docusign.itpropartner.com (app1, port :3002)
+- search.iamgmb.com (Core)
+- kokoro.iamgmb.com (app1, port :8880)
+- ragflow.itpropartner.com (app2, port :9392)
+
+### 7.3 wphost02 Migration Status
+Several wphost02 sites have DNS already pointing to app3 but RunCloud configs still exist:
+- **boxpilotlogistics.com** — DNS→CF proxy, wphost02 RunCloud still configured
+- **vigilanttac.com** — DNS→CF proxy, wphost02 RunCloud still configured
+- **voipsimplicity.com** — DNS→CF proxy, wphost02 RunCloud still configured
+- **iamgmb.com** — DNS→CF proxy, wphost02 RunCloud still configured
+
+These legacy configs should be cleaned up once migration is confirmed complete.
+
+### 7.4 Uptime Kuma API Access
+The Uptime Kuma REST API (`/api/monitors`) returns the SPA HTML instead of JSON when accessed via the Caddy reverse proxy. The Socket.IO-based API (via `uptime-kuma-api` Python library with `login_by_token`) should be used for programmatic access. The `/health` endpoint on the Caddy vhost returns `200 OK` and is the recommended lightweight monitor endpoint.
+
+---
+
+## 8. Monitor Configuration Notes
+
+### Uptime Kuma Self-Monitoring
+Uptime Kuma's Caddy vhost has a dedicated `/health` endpoint:
+```
+uptimekuma.itpropartner.com {
+    handle /health {
+        respond "OK" 200
+    }
+    reverse_proxy localhost:3001
+}
+```
+Use `https://uptimekuma.itpropartner.com/health` as the monitor URL for lightweight checking.
+
+### HotNow API
+Currently monitored at `https://api.hotnow.io/api/health`. Verify this endpoint returns the expected status code. Consider also monitoring the TLD `https://hotnow.io` and `https://app.hotnow.io`.
+
+### FleetTracker360
+Note that Core's Caddy proxies `gps.fleettracker360.com` to app2:8082, AND app2's own Caddy also serves `fleettracker360.com:443` and `gps.fleettracker360.com:443`. The current monitor hits the Core proxy. Consider adding a direct app2 monitor as a canary.
+
+### WordPress Sites on CloudPanel
+All CloudPanel WordPress sites on app3 proxy through `127.0.0.1:8080`. If the CloudPanel PHP-FPM pool goes down, ALL WordPress sites go down simultaneously. Consider monitoring CloudPanel's own health endpoint in addition to individual sites.
+
+---
+
+## 9. Summary Statistics
+
+| Metric | Count |
+|--------|-------|
+| Current monitors | 27 |
+| Public-facing URLs discovered | ~80 |
+| Services missing monitoring | 53 |
+| New monitors recommended | 62 (53 services + 9 TLDs) |
+| TLDs needing new monitors | 9 |
+| Phase 1 (immediate) | 14 monitors |
+| Phase 2 (this week) | 14 monitors |
+| Phase 3 (next week) | 18 monitors |
+| Phase 4 (2 weeks) | 10 monitors |
+| Phase 5 (DNS pending) | 6 monitors |
+| Configuration conflicts found | 4 |
+| Missing DNS records | 6 |
+| Servers audited | 5 (Core, app1-3, wphost02) |
+
+---
+
+*Plan generated by Hermes Agent on 2026-08-07 via full infrastructure audit. All URLs verified against live Caddy/Nginx configs and DNS records.*