itpp-infrastructure/docs/audit/git-audit-2026-08-08.md

Git Audit Report — IT Pro Partner Gitea Organization

Date: 2026-08-08
Auditor: Hermes Agent (automated)
Scope: git.itpropartner.com / ippadmin (all 42 remote repos + 59 local clones in /root/projects/)

---

Summary Verdict

The Gitea organization suffers from repo sprawl, weak hygiene, and live secrets in history. Of 42 remote repos, 32 are single-commit documentation stubs. Only 3–4 repos show active development. The itpp-infrastructure/docs/ folder is a flat grab-bag and needs structured nesting. 23 local-only repos lack any off-server backup. Credentials are embedded in plaintext across at least 2 repos (scripts, hermes-recovery). Consolidation, cleanup, and a hygiene push are overdue.

---

Quick Answers to User's Two Questions

1. Should itpp-infrastructure/docs/ have more nested folders?

Yes, absolutely. The current structure is:

docs/
  backup-restore/     ← already nested (good)
  legal/              ← already nested (good)
  ops-portal/         ← already nested (good)
  app2-caddyfile-audit-2026-07-21.md       ← flat
  client-katie-watts-design.md              ← flat
  cost-control-rollout-2026-07-24.md        ← flat
  git-audit-2026-08-07.md                   ← flat
  infrastructure-gap-assessment-2026-08-04.md ← flat
  key-inventory.md                           ← flat
  mattermost-replacement-analysis.md         ← flat
  model-chain.md                             ← flat
  project-log.md                             ← flat
  projects-master-readme.md                  ← flat
  super-search-cf-bypass.md                  ← flat
  super-search-enhancement-plan.md           ← flat
  uptime-kuma-monitoring-plan.md             ← flat

14 flat files is too many. Recommended restructuring:

docs/
  audit/                    ← git-audit reports, gap assessments
  backup-restore/           ← (existing, keep)
  clients/                  ← client-katie-watts-design.md
  infrastructure/           ← model-chain.md, cost-control-rollout, caddyfile-audit, key-inventory
  legal/                    ← (existing, keep)
  monitoring/               ← uptime-kuma-monitoring-plan.md
  ops-portal/               ← (existing, keep)
  projects/                 ← project-log.md, projects-master-readme.md
  super-search/             ← cf-bypass, enhancement-plan
  mattermost-replacement-analysis.md  ← leave at top level (one-off)

This gives every file a clear home without over-nesting.

2. Are there too many top-level repos? Should they be consolidated?

Yes — 42 repos is far too many for the actual workload. Here's the breakdown:

Category	Count	Action
Active development repos	3–4	Keep (itpp-infrastructure, hermes-skills, scripts, homelab)
Single-commit documentation stubs	32	Consolidate into fewer repos
Empty repos	1	Delete (auth — no commits, no content)
MCP stub repos	5	Merge into one mcp-catalog repo
Duplicate/stale repos	2	Resolve (itpp-infra vs itpp-infrastructure, cartmylist-repo vs cartmylist)
Local-only (unbacked)	23	Push to Gitea or archive

Recommended consolidation:

1. Merge 4 MCP stubs (mcp-browser, mcp-email, mcp-filesystem, mcp-git) into mcp-servers/ as subdirectories
2. Merge related business ideas into a project-ideas monorepo:
   • apex-track, boxpilot, digital-signage, fleettracker360, gift-a-roast, hudu, launchcheck, mooresunnydaze, nvr-shield, osint-tool, shark-game, startup-studio, track-a-flock, personal-assistant
3. Merge related operational repos: disaster-recovery + backup-restore → disaster-recovery/ with backup-restore/ subdir
4. Merge website/docs stubs: itpropartner-website, content-creation-pipeline, ops-portal → subdirectories in itpp-infrastructure
5. Resolve itpp-infra (stale, SSH-only, 1 commit) → archive; use itpp-infrastructure as primary
6. Delete auth (empty repo with auth.db — never committed)
7. Keep as-is: itpp-infrastructure, hermes-skills, hermes-recovery, scripts, homelab, dre, verdicttank, voipsimplicity, voipsimplicity-manual, forefront-wireless-portal, super-search-business, model-fallback, unifi, unms, pipeline, super-search

Target: ~15–20 repos instead of 42.

---

Detailed Findings

Step 1 — Full Inventory

Metric	Count
Remote repos on Gitea	42
Local clones in /root/projects/	59
On Gitea AND cloned locally	36
On Gitea but NOT cloned locally	6
Cloned locally but NOT on Gitea	23
Public repos	30
Private repos	12
Repos using master as default branch	30
Repos using main as default branch	9
Other (HEAD/detached)	20

Repos on Gitea but not cloned locally: cartmylist, mcp-browser, mcp-email, mcp-filesystem, mcp-git, super-search

Local-only repos (no remote — no off-server backup): assistant, auth, capabilities, hear-read, intelsight, intelsight-landing, internal, mockup, my-itpropartner-portal, ops, ops-v2-portal, osint, proposals, pry, research-search-mcp, schedule, shonuff, shonuff-caller, static, status, voice-previews, itpp-infra, cartmylist-repo

Step 2 — Per-Repo Deep Scan

Hygiene Check: .gitignore and README.md

Status	Count
Has .gitignore	8 of 59 (13.6%)
Has README.md	56 of 59 (94.9%)

Repos missing .gitignore: 51 repos. This is the single biggest hygiene gap.

Repos missing README.md: cartmylist-repo, voipsimplicity-manual, auth

Repos with Dirty Working Trees

Repo	Dirty Files	Severity
hermes-skills	33	HIGH — cache artifacts not committed
hermes-recovery	26	HIGH — uncommitted recovery scripts
voipsimplicity-manual	11	MEDIUM
research-search-mcp	10	MEDIUM
auth	9	MEDIUM
digital-signage	6	LOW
itpp-infra	5	LOW
pipeline	5	LOW
disaster-recovery	4	LOW
mooresunnydaze	4	LOW
verdicttank	4	LOW
itpp-infrastructure	3	LOW

13 repos have uncommitted changes. hermes-skills (33 files) and hermes-recovery (26 files) are the worst offenders.

Step 3 — Secrets Scan

CRITICAL findings in 2 repos:

scripts — 10 potential secrets

Real, hardcoded credentials found in Windows provisioning scripts:

+Password="[REDACTED]"
+Password="[REDACTED]"
+Password="[REDACTED]"
+Username="ippadmin"
+Username="liberty-admin"

These are active Windows admin credentials embedded in PowerShell unattend scripts. This is a data breach risk. If these repos ever go public or are cloned outside ITPP infrastructure, client credentials are exposed.

hermes-recovery — 8 potential secrets

Includes the Gitea API token used for this audit:

+TOKEN="[REDACTED]"
+TELEGRAM_BOT_TOKEN="[REDACTED]"
+password="***"
+token = "[REDACTED]"

The Gitea token itself is committed. This means hermes-recovery as a public repo exposes admin credentials.

hermes-skills — 15 potential hits

Most are false positives (example values, process.env. references, placeholder text). One real hit: a Comfy CLI API key in a SKILL.md.

Step 4 — Structural Checks

Remote URL Audit

Remote Type	Count	Action
HTTPS to Gitea	36	OK
GitHub (upstream)	1	OK (msp-claude-skills)
SSH to Gitea	2	FIX — itpp-infra, cartmylist-repo
No remote	23	FIX — local-only, no backup

itpp-infra uses git@git.itpropartner.com:ippadmin/itpp-infra.git (SSH) — this repo has no corresponding HTTPS clone and appears to be a stale/abandoned repo (1 commit, 5 dirty files).

cartmylist-repo (local) vs cartmylist (Gitea) is a naming mismatch. The local clone has an SSH remote to what is likely a different repo.

Branch Naming

• 30 repos use master — industry standard is now main
• 9 repos use main
• 20 repos have detached HEAD or no commits

Branch mismatch: itpp-infrastructure has main locally but master on Gitea. This means the remote may have both branches.

Large Files

Repo	File	Size
hermes-skills	.hub/index-cache/hermes-index.json	38.9 MB
hermes-skills	.curator_backups/2026-07-12T15-48-44Z/skills.tar.gz	2.7 MB

Both are cache artifacts that should be in .gitignore, not tracked.

Public vs Private

30 of 42 repos (71%) are public. This is a concern because:

• scripts contains client admin passwords — public
• hermes-recovery contains Gitea admin token — public
• Many repos with sensitive infrastructure details are public

Step 5 — Commit Quality

Commit Message Quality

Pattern	Count	Assessment
Initial commit — YYYY-MM-DD	16	Poor — conveys nothing
Update YYYY-MM-DD — root	5	Meaningless
Initial: <project name>	8	Barely adequate
Descriptive conventional commits	4	Good (homelab, verdicttank, forefront-wireless-portal)

32 repos have only 1 commit — these are documentation stubs, not developed projects.

Active vs Abandoned

Status	Criteria	Repos
Active	3+ commits, recent activity	itpp-infrastructure (52), scripts (11), homelab (6), forefront-wireless-portal (5), dre (4), verdicttank (4), personal-assistant (3), super-search-business (3), voipsimplicity (3)
Stub	1–2 commits, last push July 2025	32 repos
Abandoned	No commits or stale >3 months	itpp-infra, auth, cartmylist-repo

Step 6 — Local-Only Repos

23 repos in /root/projects/ have no remote. Breakdown:

Category	Repos	Action
Uncommitted stubs (0 commits)	17	Push to Gitea or archive
Has commits, no remote	1 (shonuff-caller)	Push to Gitea
Stale noise	5	Archive and delete (auth, itpp-infra, cartmylist-repo, etc.)

The 17 repos with 0 commits and only detached HEAD are effectively just directories with a .git folder — not real repos. They should be either pushed as proper repos or archived.

---

Prioritized Action Plan

🔴 Immediate (This Week)

#	Action	Severity
1	Rotate all credentials exposed in scripts repo — Windows passwords, Gitea token, Telegram bot token. Then purge from Git history with git filter-branch or bfg-repo-cleaner	CRITICAL
2	Rotate Gitea API token in hermes-recovery — it's publicly visible. Generate new token, update all consumers, purge old from history	CRITICAL
3	Make scripts and hermes-recovery PRIVATE — they contain live credentials visible to anyone	CRITICAL
4	Add .gitignore to all 51 repos missing one — start with the active repos first	HIGH
5	Commit or stash all dirty working trees — 13 repos have uncommitted work at risk of loss	HIGH

🟡 Short-Term (This Month)

#	Action	Severity
6	Reorganize itpp-infrastructure/docs/ into nested folders (audit/, clients/, infrastructure/, monitoring/, projects/, super-search/)	MEDIUM
7	Consolidate 4 MCP repos into mcp-servers/ as subdirectories — delete empty stubs after merge	MEDIUM
8	Merge 14 single-commit business idea repos into a project-ideas monorepo	MEDIUM
9	Delete auth (empty repo, 0 commits)	MEDIUM
10	Resolve itpp-infra vs itpp-infrastructure — archive itpp-infra, standardize on itpp-infrastructure	MEDIUM
11	Add .gitignore entries to hermes-skills for .hub/, .curator_backups/	MEDIUM
12	Rename master → main on repos where it matters (at minimum itpp-infrastructure to fix branch mismatch)	LOW

🔵 Pre-Public / Pre-Open-Source

#	Action	Severity
13	Audit all 30 public repos — ensure no private infrastructure details, client names, IPs, or credentials are exposed	HIGH
14	Decide public/private policy — which repos genuinely need to be public? Currently 71% are public.	MEDIUM
15	Push 23 local-only repos to Gitea or archive them. No code living only on a single server.	HIGH
16	Clean commit history — rebase repos with "Update YYYY-MM-DD — root" messages into meaningful commits	LOW

---

Template: Standard .gitignore

For any new or cleaned repo, use:

# OS
.DS_Store
Thumbs.db

# IDE
.vscode/
.idea/
*.swp
*.swo

# Python
__pycache__/
*.py[cod]
*.egg-info/
.venv/
venv/

# Node
node_modules/

# Secrets — NEVER commit these
.env
.env.*
*.pem
*.key
credentials.json
*.token

# Cache / generated
.hub/
.curator_backups/
*.tar.gz
*.zip

# Data
*.db
*.sqlite
*.sqlite3

---

Appendix: Full Repo Inventory

Active Repos (keep as standalone)

Repo	Commits	Last Commit	Branch	.gitignore	Assessment
itpp-infrastructure	52	2026-08-07	main/master mismatch	YES	Primary hub — healthy
hermes-skills	1	2026-07-15	master	NO	Active mirror, 13.6MB
hermes-recovery	1	2026-07-15	master	YES	Critical backup kit
scripts	11	2026-07-25	master	NO	Active, has secrets
homelab	6	2026-07-24	main	NO	Active, good commits
dre	4	2026-07-25	master	NO	Active development
verdicttank	4	2026-08-07	main	NO	Active, good commits
forefront-wireless-portal	5	2026-07-25	master	NO	Active, good commits
super-search-business	3	2026-07-25	main	NO	Active
voipsimplicity	3	2026-07-24	master	NO	Active client work
voipsimplicity-manual	1	2026-08-05	master	NO	Active client work

Stub Repos (consolidate)

All 32 repos below are single-commit documentation stubs with no ongoing development. Consolidate into project-ideas/ monorepo or relevant parent repo:

apex-track, backup-restore, boxpilot, content-creation-pipeline, digital-signage, disaster-recovery, fleettracker360, gift-a-roast, hudu, itpropartner-website, launchcheck, mcp-browser, mcp-email, mcp-filesystem, mcp-git, mcp-servers, model-fallback, mooresunnydaze, nvr-shield, ops-portal, osint-tool, personal-assistant, pipeline, shark-game, startup-studio, super-search, track-a-flock, unifi, unms, cartmylist

To Delete or Archive

Repo	Reason
auth	Empty (0 commits, 0 content)
itpp-infra	Stale duplicate of itpp-infrastructure, SSH-only remote, 1 commit
cartmylist-repo	Local clone with SSH remote, mismatched name (real one is cartmylist on Gitea)

Local-Only (push or archive)

assistant, auth, capabilities, hear-read, intelsight, intelsight-landing, internal, mockup, my-itpropartner-portal, ops, ops-v2-portal, osint, proposals, pry, research-search-mcp, schedule, shonuff, shonuff-caller, static, status, voice-previews

---

Report generated by Hermes Agent git-audit workflow. Next audit recommended: 2026-11-08.