root
f5175f1ce0
- audit/phase-one + phase-two: security audit briefs, findings, credential-rotation plan, Docker-USER hardening scripts, rollback refs - disaster-recovery/restore-test-log.md + backup-dr-audit-2026-08-10.md - clients/ (modelortho SEO audit, ai-biz-dev competitive landscape), notes/ (tiktok strategy) - projects/: front-desk-voice-agent, seo-visibility-checker product plan, hotnow-savannah HTML, resend-transactional-email, backup-dashboard-enhancements, code-review-graph, seo-ci-architecture - proposals/verdicttank/: architecture v4.0, methodology, judge-pool review, consolidation reasoning, cross-check review - docs/super-search/firecrawl-provider-strategy.md - updates: CHANGELOG, model-chain, projects-master-readme, intelsight.io - .gitignore: exclude nested standalone repos (seo-tool, venturebuilt)
7.2 KiB
7.2 KiB
Phase One: ITPP Infrastructure Audit - Operational Brief
Engagement: Discovery, audit, and documentation only. READ-ONLY. Status: GO authorized by Germaine Brown on 2026-08-13. Conductor: Sho'Nuff (deepseek-v4-pro). Hands-on discovery runs through fresh subagents only.
ABSOLUTE RULES (every subagent, no exceptions)
- READ-ONLY. No config changes, restarts, patches, credential rotations, firewall edits, or any live modification - regardless of how beneficial. Every remediation is written up as a Phase Two finding.
- If validating a finding requires a non-read-only action (test change, restart, failover test), do not do it - document the limitation and flag for Phase Two.
- Verify against live systems, never assume from docs/memory. No finding based solely on existing documentation without confirming against what is actually running.
- Flag any area where access/credentials/visibility were insufficient - do not guess.
- Never emit credentials. Use
[REDACTED]everywhere, including paths that contain secrets. - No em dashes. Write findings in plain English a technical-but-not-infra-SME reader understands - explain why a finding matters, not just what it is.
KNOWN INFRASTRUCTURE FOOTPRINT (verify independently, do not trust)
Hosting: Netcup (4 servers) + Hetzner (2 servers) = 6 total.
| Server | Provider | IP | Role (to verify) |
|---|---|---|---|
| Core | Netcup RS 2000 | (this host) | Hermes host + core services: Grafana :3002, Prometheus, Super Search MCP :8899, backup scripts |
| app1 | Netcup RS 4000 | 152.53.36.131 | LiteLLM/admin-ai (docker), Caddy, super-search, mcp-*, browserless |
| app2 | Netcup RS 4000 | 152.53.39.202 | Hudu, UNMS, UniFi, Traccar, Gitea, Dawarich, Technitium DNS (docker) |
| app3 | Netcup RS 4000 | 152.53.241.111 | CloudPanel static+PHP, WordPress sunset |
| app1-bu | Hetzner CPX21 | 5.161.225.131 | Warm standby for Core, Hermes failover |
| wphost02 | Hetzner | (resolve) | Legacy WordPress/RunCloud host |
Also in scope: MikroTik CCR tower backups, UniFi/UISP edge, git.itpropartner.com (Gitea), docs.itpropartner.com (to be created), Wasabi S3 backups.
SSH access: ssh -i /root/.ssh/itpp-infra root@<ip>. Key at /root/.ssh/itpp-infra on Core.
Verify more than this list - surface shadow IT, forgotten instances, additional accounts.
TEAM ROSTER & BATCHES
| # | Member | Role | Model | Owns | NOT covering |
|---|---|---|---|---|---|
| 0 | Conductor | Audit lead | deepseek-v4-pro (orchestration) + claude-sonnet-5 (report/QA synthesis) | Synthesis, QA, report, policy doc, skill spec, disagreement log | Hands-on discovery |
| 1 | NetEng-A | Network Eng | deepseek-v4-pro | Firewall/ports/DNS/VPN all 6 + MikroTik + UniFi/UISP edge | Segmentation policy |
| 2 | NetEng-B | Network Eng | claude-sonnet-5 | Segmentation & blast-radius (internal vs client vs product/dev) | Raw port/DNS enum |
| 3 | Sec-A | InfoSec | claude-sonnet-5 | IAM + credentials/secrets inventory (standalone) | Hardening/patch |
| 4 | Sec-B | InfoSec | claude-sonnet-5 | Hardening, patch, MFA, logging (Wazuh), CIS/NIST | Secrets inventory |
| 5 | Sys-A | Sysadmin | deepseek-v4-pro | Core + app1 (highest risk) | app2/app3/app1-bu/wphost02 |
| 6 | Sys-B | Sysadmin | deepseek-v4-pro | app2 + app3 + app1-bu + wphost02 | Core/app1 |
| 7 | Sys-C | Sysadmin | claude-sonnet-5 | Backup/DR verification - 27 targets vs live S3, restore-test history, RTO/RPO | Service config drift |
| 8 | Git-A | Repo auditor | claude-sonnet-5 | git.itpropartner.com inventory, classification, lineage, secrets-in-history | Docs repo build |
| 9 | Docs-W | Documentation | claude-sonnet-5 | Docs repo creation + docs.itpropartner.com publish | Git audit findings |
| 10 | Indep | Independent reviewer | claude-sonnet-5 | Bias-check severity + disagreement log (separate model) | Full re-audit |
BATCH PLAN (conductor executes)
- Batch 1 (mechanical, deepseek-v4-pro): NetEng-A, Sys-A, Sys-B
- Batch 2 (reasoning, claude-sonnet-5): NetEng-B, Sec-B, Sys-C, Git-A, Docs-W (concurrent, max 3 at a time)
- Batch 2b (premium, claude-sonnet-5): Sec-A (standalone IAM/secrets deliverable)
- Batch 3 (independence check, claude-sonnet-5): Indep - reviews severity ratings + disagreement log AFTER conductor synthesizes
DISCOVERY SCOPE (per subagent - see individual briefs for exact deliverables)
Each subagent returns a structured findings list with severity (Critical/High/Medium/Low), evidence (command output, file paths, timestamps), and written rationale. Coverage:
- Network (NetEng-A, NetEng-B): topology, routing, firewalls, open ports, DNS records, VPNs, VLAN/segmentation, wireless, public exposure surface, blast-radius between internal/client/product-dev.
- InfoSec (Sec-A, Sec-B): IAM/accounts/MFA, privileged access, secrets location & plaintext/hardcoded/unrotated flags, patch posture, hardening (CIS/NIST/SOC 2 lens), logging/monitoring.
- Sysadmin (Sys-A, Sys-B): per-server per-service granular inventory: identity/version/purpose/dependencies (dependency map), backup status + restore-test history, config file paths + drift vs expected, cron jobs (schedule/user/deps/failure-mode), estimated RTO/RPO for critical services.
- Backup/DR (Sys-C): verify all 27 backup targets against live S3 (Wasabi), retention, restore-test history, evidence-based RTO/RPO per critical service, 3-2-1 rule compliance.
- Git (Git-A): inventory every repo: name/purpose/last commit/primary branch/deploy target; classify active vs stale vs superseded vs orphaned; lineage; secrets-in-history; disposition recommendation per stale repo.
- Docs (Docs-W): determine existing docs; if present audit say-do gap; if absent create. New dedicated repo on git.itpropartner.com + publish to docs.itpropartner.com. Delineate internal vs client vs product/dev.
DELIVERABLES (conductor produces at end)
A. Audit Report (table of contents + exec brief for Germaine, plain-English):
- Discovery Summary (verified inventory)
- Findings (prioritized, severity tiers with rationale)
- Recommendations (mapped to findings, effort estimate)
- Documentation Status
- Infrastructure Separation Assessment
- Git/Docs Reorganization Recommendation (actual proposed tree, plain-English rationale, where existing repos land)
- Disagreements section (documented, not resolved - Germaine resolves)
- Independence-check appendix (Indep's severity review)
B. Policy & Procedure Document (change mgmt, docs-sync, backup/DR standards, access/offboarding, segmentation for new entities, recurring audit cadence).
C. Skill Spec (documentation only) for a Hermes policy-adherence skill: flag requests falling outside policy, only Germaine authorizes exemptions, running Exemptions Document schema (date, requester, provision departed, justification, Germaine approval, one-time vs ongoing, follow-up).
COST
Estimate (approved): subtotal ~$5.40, realistic $8-10, ceiling ~$13. Under $20 cap. No opus-tier models used. Track actual via LiteLLM SpendLogs (now verified accruing). Include estimate-vs-actual in final report.
NOTIFICATION POLICY
- Silent during run. Only surface: (1) questions needing Germaine input, (2) Critical/High findings that cannot wait, (3) completion.
- Completion = final report + policy doc + skill spec emailed to g@germainebrown.com.