ippadmin/itpp-infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sync docs, audit artifacts, project notes, and VerdictTank proposal docs

Browse Source 
- audit/phase-one + phase-two: security audit briefs, findings, credential-rotation plan, Docker-USER hardening scripts, rollback refs
- disaster-recovery/restore-test-log.md + backup-dr-audit-2026-08-10.md
- clients/ (modelortho SEO audit, ai-biz-dev competitive landscape), notes/ (tiktok strategy)
- projects/: front-desk-voice-agent, seo-visibility-checker product plan, hotnow-savannah HTML, resend-transactional-email, backup-dashboard-enhancements, code-review-graph, seo-ci-architecture
- proposals/verdicttank/: architecture v4.0, methodology, judge-pool review, consolidation reasoning, cross-check review
- docs/super-search/firecrawl-provider-strategy.md
- updates: CHANGELOG, model-chain, projects-master-readme, intelsight.io
- .gitignore: exclude nested standalone repos (seo-tool, venturebuilt)
This commit is contained in:
root
2026-08-26 02:27:28 -04:00
parent 23e9751d38
commit f5175f1ce0
55 changed files with 14669 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
audit/phase-one/brief.md
+92
View File
@@ -0,0 +1,92 @@
# Phase One: ITPP Infrastructure Audit - Operational Brief
**Engagement:** Discovery, audit, and documentation only. **READ-ONLY.**
**Status:** GO authorized by Germaine Brown on 2026-08-13.
**Conductor:** Sho'Nuff (deepseek-v4-pro). Hands-on discovery runs through fresh subagents only.
## ABSOLUTE RULES (every subagent, no exceptions)
1. **READ-ONLY.** No config changes, restarts, patches, credential rotations, firewall edits, or any live modification - regardless of how beneficial. Every remediation is written up as a Phase Two finding.
2. If validating a finding requires a non-read-only action (test change, restart, failover test), **do not do it** - document the limitation and flag for Phase Two.
3. **Verify against live systems, never assume from docs/memory.** No finding based solely on existing documentation without confirming against what is actually running.
4. Flag any area where access/credentials/visibility were insufficient - do not guess.
5. Never emit credentials. Use `[REDACTED]` everywhere, including paths that contain secrets.
6. No em dashes. Write findings in plain English a technical-but-not-infra-SME reader understands - explain *why* a finding matters, not just what it is.
## KNOWN INFRASTRUCTURE FOOTPRINT (verify independently, do not trust)
Hosting: **Netcup** (4 servers) + **Hetzner** (2 servers) = 6 total.
| Server | Provider | IP | Role (to verify) |
|---|---|---|---|
| Core | Netcup RS 2000 | (this host) | Hermes host + core services: Grafana :3002, Prometheus, Super Search MCP :8899, backup scripts |
| app1 | Netcup RS 4000 | 152.53.36.131 | LiteLLM/admin-ai (docker), Caddy, super-search, mcp-*, browserless |
| app2 | Netcup RS 4000 | 152.53.39.202 | Hudu, UNMS, UniFi, Traccar, Gitea, Dawarich, Technitium DNS (docker) |
| app3 | Netcup RS 4000 | 152.53.241.111 | CloudPanel static+PHP, WordPress sunset |
| app1-bu | Hetzner CPX21 | 5.161.225.131 | Warm standby for Core, Hermes failover |
| wphost02 | Hetzner | (resolve) | Legacy WordPress/RunCloud host |
**Also in scope:** MikroTik CCR tower backups, UniFi/UISP edge, git.itpropartner.com (Gitea), docs.itpropartner.com (to be created), Wasabi S3 backups.
**SSH access:** `ssh -i /root/.ssh/itpp-infra root@<ip>`. Key at `/root/.ssh/itpp-infra` on Core.
**Verify more than this list** - surface shadow IT, forgotten instances, additional accounts.
## TEAM ROSTER & BATCHES
| # | Member | Role | Model | Owns | NOT covering |
|---|---|---|---|---|---|
| 0 | Conductor | Audit lead | deepseek-v4-pro (orchestration) + claude-sonnet-5 (report/QA synthesis) | Synthesis, QA, report, policy doc, skill spec, disagreement log | Hands-on discovery |
| 1 | NetEng-A | Network Eng | deepseek-v4-pro | Firewall/ports/DNS/VPN all 6 + MikroTik + UniFi/UISP edge | Segmentation policy |
| 2 | NetEng-B | Network Eng | claude-sonnet-5 | Segmentation & blast-radius (internal vs client vs product/dev) | Raw port/DNS enum |
| 3 | Sec-A | InfoSec | claude-sonnet-5 | IAM + credentials/secrets inventory (standalone) | Hardening/patch |
| 4 | Sec-B | InfoSec | claude-sonnet-5 | Hardening, patch, MFA, logging (Wazuh), CIS/NIST | Secrets inventory |
| 5 | Sys-A | Sysadmin | deepseek-v4-pro | Core + app1 (highest risk) | app2/app3/app1-bu/wphost02 |
| 6 | Sys-B | Sysadmin | deepseek-v4-pro | app2 + app3 + app1-bu + wphost02 | Core/app1 |
| 7 | Sys-C | Sysadmin | claude-sonnet-5 | Backup/DR verification - 27 targets vs live S3, restore-test history, RTO/RPO | Service config drift |
| 8 | Git-A | Repo auditor | claude-sonnet-5 | git.itpropartner.com inventory, classification, lineage, secrets-in-history | Docs repo build |
| 9 | Docs-W | Documentation | claude-sonnet-5 | Docs repo creation + docs.itpropartner.com publish | Git audit findings |
| 10 | Indep | Independent reviewer | claude-sonnet-5 | Bias-check severity + disagreement log (separate model) | Full re-audit |
## BATCH PLAN (conductor executes)
- **Batch 1 (mechanical, deepseek-v4-pro):** NetEng-A, Sys-A, Sys-B
- **Batch 2 (reasoning, claude-sonnet-5):** NetEng-B, Sec-B, Sys-C, Git-A, Docs-W (concurrent, max 3 at a time)
- **Batch 2b (premium, claude-sonnet-5):** Sec-A (standalone IAM/secrets deliverable)
- **Batch 3 (independence check, claude-sonnet-5):** Indep - reviews severity ratings + disagreement log AFTER conductor synthesizes
## DISCOVERY SCOPE (per subagent - see individual briefs for exact deliverables)
Each subagent returns a **structured findings list** with severity (Critical/High/Medium/Low), evidence (command output, file paths, timestamps), and written rationale. Coverage:
1. **Network (NetEng-A, NetEng-B):** topology, routing, firewalls, open ports, DNS records, VPNs, VLAN/segmentation, wireless, public exposure surface, blast-radius between internal/client/product-dev.
2. **InfoSec (Sec-A, Sec-B):** IAM/accounts/MFA, privileged access, secrets location & plaintext/hardcoded/unrotated flags, patch posture, hardening (CIS/NIST/SOC 2 lens), logging/monitoring.
3. **Sysadmin (Sys-A, Sys-B):** per-server per-service granular inventory: identity/version/purpose/dependencies (dependency map), backup status + restore-test history, config file paths + drift vs expected, cron jobs (schedule/user/deps/failure-mode), estimated RTO/RPO for critical services.
4. **Backup/DR (Sys-C):** verify all 27 backup targets against live S3 (Wasabi), retention, restore-test history, evidence-based RTO/RPO per critical service, 3-2-1 rule compliance.
5. **Git (Git-A):** inventory every repo: name/purpose/last commit/primary branch/deploy target; classify active vs stale vs superseded vs orphaned; lineage; secrets-in-history; disposition recommendation per stale repo.
6. **Docs (Docs-W):** determine existing docs; if present audit say-do gap; if absent create. New dedicated repo on git.itpropartner.com + publish to docs.itpropartner.com. Delineate internal vs client vs product/dev.
## DELIVERABLES (conductor produces at end)
**A. Audit Report** (table of contents + exec brief for Germaine, plain-English):
1. Discovery Summary (verified inventory)
2. Findings (prioritized, severity tiers with rationale)
3. Recommendations (mapped to findings, effort estimate)
4. Documentation Status
5. Infrastructure Separation Assessment
6. Git/Docs Reorganization Recommendation (actual proposed tree, plain-English rationale, where existing repos land)
7. Disagreements section (documented, not resolved - Germaine resolves)
8. Independence-check appendix (Indep's severity review)
**B. Policy & Procedure Document** (change mgmt, docs-sync, backup/DR standards, access/offboarding, segmentation for new entities, recurring audit cadence).
**C. Skill Spec (documentation only)** for a Hermes policy-adherence skill: flag requests falling outside policy, only Germaine authorizes exemptions, running Exemptions Document schema (date, requester, provision departed, justification, Germaine approval, one-time vs ongoing, follow-up).
## COST
Estimate (approved): subtotal ~$5.40, realistic $8-10, ceiling ~$13. Under $20 cap. No opus-tier models used.
Track actual via LiteLLM SpendLogs (now verified accruing). Include estimate-vs-actual in final report.
## NOTIFICATION POLICY
- **Silent during run.** Only surface: (1) questions needing Germaine input, (2) Critical/High findings that cannot wait, (3) completion.
- Completion = final report + policy doc + skill spec **emailed to g@germainebrown.com**.