itpp-infrastructure/docs/infrastructure/core-service-inventory-2026-09-15.md

# Core Service Inventory — 2026-09-15

Host: Core (152.53.192.33, netcup RS 2000, 8 vCPU / 15 GB / 503 GB, Debian 13, Manassas VA)
Purpose: exhaustive, evidence-based inventory to plan the app4 migration (see `app4-migration-plan.md`).
Method: read-only commands only, run directly on Core. No service was started, stopped, or restarted. `hermes-maintenance` was never invoked. The Hermes gateway (`hermes-gateway.service`, user unit) was left untouched and observed only via `systemctl --user status`.

All commands quoted below were actually executed on Core on 2026-09-15. Numbers are copy-pasted from real output, not estimated.

## Headline counts (verified)

| Metric | Count | Command |
|---|---|---|
| Docker containers (all, all running) | 13 | `docker ps -a --format ...` |
| systemd services in `running` state | 57 | `systemctl list-units --type=service --state=running` |
| Caddy site blocks in `/etc/caddy/Caddyfile` | 49 | `grep -cE '^[a-zA-Z0-9].*\{$\|^http://.*\{$' /etc/caddy/Caddyfile` |
| PostgreSQL databases (excl. template0/1/postgres) | 1 (`hotnow`) | `sudo -u postgres psql -c '\l+'` |
| Hermes cron jobs (`/root/.hermes/cron/jobs.json`) | 87 | Python count of `jobs[]` |
| Listening TCP sockets | 66 | `ss -tlnp` |
| Listening UDP sockets | 14 | `ss -ulnp` |
| TLS certs, real ACME (Let's Encrypt / ZeroSSL) | 47 | `find .../certificates -mindepth 2 -maxdepth 2 ! -path '*/local/*'` |
| TLS certs, Caddy `tls internal` self-signed | 7 | `find .../certificates/local -mindepth 1 -maxdepth 1` |
| System crontab entries (root) | 12 | `crontab -l` |
| `/etc/cron.d/*` files | 6 (all stock Debian/PHP/sysstat except `reap-chrome`) | `ls /etc/cron.d` |

## Hostile surprises found (read this section first)

1. **The app4 migration plan's "stays on Core" and "moves to app4" lists are both incomplete.** Core is running roughly 30 additional customer-facing FastAPI/Node/systemd services that the plan document never mentions: DigLocate API, DRE MCP + DRE Portal, FT360 MCP, HotNow API (with its own Postgres DB `hotnow` and its own Redis DB 1), IntelSight API, OSINT API, OSINT Person MCP, Outlook upload receiver, Pipeline API, PRY (OSINT search backend), PTA registration + survey, Rally family calendar, SeeMyTrip, Shark Attack Fantasy Game, Shopping Cart Builder, SNMP metrics server, Transitpin WebSocket relay, Twilio MCP, VerdictTank API + worker, Voice Agent + STT, Auth API, plus two disabled-but-present services (`crawl4ai`, `hermes-control-deck`). See `ambiguities[]` and the systemd table below. Every one of these has a live Caddy site (see caddy_sites) and needs an explicit stays/moves decision.
2. **DocuSeal did NOT move to App1 as the backup-plan.md's "Migration History" section claims.** Three DocuSeal containers (`docuseal`, `docuseal-dre`, `docuseal-modelortho`) are running on Core right now on ports 8091/8094/8092, backed by bind-mounted `./data` dirs, each with its own `.env`. `backup-plan.md` still lists DocuSeal backups running against App1 (`app1/docuseal/`). The app4-migration-plan.md's "Inventory caveat" already flagged this: **confirmed here, DocuSeal is on Core, not migrated.** Same finding for SearXNG: it is running on Core (`searxng` container, port 127.0.0.1:8888, container up 2 hours) despite backup-plan.md marking `core/searxng/` as a stale/removed path.
3. **PostgreSQL on Core has essentially nothing "shared."** Only one real customer database exists: `hotnow` (16 MB, owned by role `hotnow_app`). TimeTrex runs its own **separate PostgreSQL 16 instance inside its own Docker container** (bind-mounted `/root/docker/timetrex/database`), not the host Postgres 17 instance. The migration plan's assumption of "a shared Postgres/Redis instance... provisioned fresh on app4" understates this: there are two independent Postgres engines on Core (host 17.10 for HotNow, containerized 16 for TimeTrex), and they do not share data.
4. **Redis on Core is nearly idle** (`used_memory` 741 KB, 0 keys in DB0, `DBSIZE 0`), but HotNow's `.env` explicitly points at `redis://localhost:6379/1`, meaning host Redis has at least one active customer consumer despite the migration plan describing Redis only as "shared cache" with "consumers TBD in Phase 0." HotNow is that consumer, but note DB1 was also empty at scan time (idle app or nothing warm).
5. **`crm.debtrecoveryexperts.com` and `crm.intelsight.io` are dead Caddy routes.** Both proxy to `localhost:3003` (Twenty CRM), but nothing is listening on port 3003 — `ss -tlnp | grep 3003` returned nothing. Twenty CRM migrated to App1 per backup-plan.md, but the Caddy site blocks pointing at it were never removed from Core's Caddyfile. These will 502 today; they are not "moving" apps, they are stale entries to clean up (or confirm App1 handles them via a different route/CNAME not visible from Core).
6. **UFW has two apparently-orphaned rules**: `8080/tcp on tailscale0` labeled "Vaultwarden via Tailscale" (Vaultwarden migrated off Core, port not listening) and `8890/tcp` labeled "temp map server" (also not listening). Neither is a running risk today but both are stale firewall state that should not be copied to app4.
7. **13 `.env`/config files carry live secrets** (SMTP creds, LetterStream API keys, Docuseal API tokens, Hexclave keys, Twilio SIDs, provider API keys for a dozen LLM vendors, RingLogix creds, netcup creds) all in `/root/.hermes/.env`, `/opt/dre-portal/.env`, `/etc/verdicttank.env`, `/root/hotnow-api/.env`, `/opt/voice-agent/.env`, `/opt/hermes-voice/.env`. None of these are backed up in plaintext by policy (`auth-api-backup.sh` explicitly redacts values), but they must be manually and securely transferred to app4, not rsynced as part of a generic root-essentials backup.
8. **Backup coverage gaps confirmed for the newly-discovered services.** No backup script exists for: DigLocate, HotNow, IntelSight, Pipeline, PRY, PTA registration, PTA survey, SeeMyTrip, Shark Game, Shopping Cart, Survey (pta-survey duplicate), Voice Agent, DRE Portal. Each of these has its own SQLite DB (see `data_paths[]`) with zero S3 backup today. `backup-plan.md`'s "Unbacked Services: none" claim (dated 2026-08-08) is now stale; it predates all of these services appearing in `systemctl list-units`.
9. **Postgres cluster mismatch:** host runs PostgreSQL **17.10** (`postgresql@17-main.service`); TimeTrex's containerized instance is PostgreSQL **16**. A wholesale `pg_dumpall` migration approach from the plan's section 5 will not work across both without per-instance handling.

## containers[] — Docker (13 total, all running)

| name | image | ports | restart policy | bind mounts / volumes | compose file | classification |
|---|---|---|---|---|---|---|
| docuseal | docuseal/docuseal:latest | 127.0.0.1:8091->3000 | always | bind `/root/docker/docuseal/data` -> `/data` | `/root/docker/docuseal/docker-compose.yml` | move-to-app4 |
| docuseal-dre | docuseal/docuseal:latest | 127.0.0.1:8094->3000 | always | bind `/root/docker/docuseal-dre/data` -> `/data` | `/root/docker/docuseal-dre/docker-compose.yml` | move-to-app4 |
| docuseal-modelortho | docuseal/docuseal:latest | 127.0.0.1:8092->3000 | always | bind `/root/docker/docuseal-modelortho/data` -> `/data` | `/root/docker/docuseal-modelortho/docker-compose.yml` | move-to-app4 |
| timetrex | skewll/timetrex:latest | 127.0.0.1:8085->80 | unless-stopped | bind storage/logs/database/ini.php | `/root/docker/timetrex/docker-compose.yml` | move-to-app4 |
| microbin | danielszabo99/microbin:latest | 127.0.0.1:8260->8080 | unless-stopped | bind `/opt/microbin/data` -> `/app/pasta_data` | `/opt/microbin/docker-compose.yml` | move-to-app4 |
| uptime-kuma | louislam/uptime-kuma:latest | 0.0.0.0:3001->3001 | unless-stopped | bind `/root/docker/uptime-kuma/data` -> `/app/data` | `/root/docker/uptime-kuma/docker-compose.yml` | move-to-app4 |
| grafana | grafana/grafana:11.4.0 | 0.0.0.0:3002 (host network, exposed by container itself) | unless-stopped | named volume `grafana_data_final` -> `/var/lib/grafana` | none found (manual `docker run`?) | stays-on-Core |
| prometheus | prom/prometheus:latest | none published (host network via container) 9090 exposed by container | unless-stopped | bind prometheus.yml, named volume `prometheus_data`, bind textfile dir | `/root/docker/monitoring/...` (compose not directly inspected) | stays-on-Core |
| telegraf | telegraf:latest | 9273 (container) | unless-stopped | bind `/root/docker/monitoring/telegraf/telegraf.conf` | monitoring compose | stays-on-Core |
| mikrotik-exporter | swoga/mikrotik-exporter:latest | 127.0.0.1:9436->9436 | unless-stopped | bind config.yml | monitoring compose | stays-on-Core |
| searxng | searxng/searxng:latest | 127.0.0.1:8888->8080 | always | bind searxng-data, searxng-themes; named cache volume | `/root/docker/searxng/docker-compose.yml` | stays-on-Core (Super Search backend; NOTE: backup-plan.md incorrectly marks this removed) |
| browserless | browserless/chrome:latest | 0.0.0.0:3000->3000 | always | none | none found | stays-on-Core (Hermes browser dependency) |
| camofox-browser | camofox-browser:dataimpulse | 0.0.0.0:9377->9377 | unless-stopped | none | none found | stays-on-Core (Hermes stealth browser dependency) |

Sizes (`docker system df -v`): total image space several GB (largest: browserless 3.06GB, camofox 2.27GB, timetrex 1.7GB, twentycrm 1.12GB image present but unused/0 containers, kokoro-fastapi 3.63GB image present but unused). Named volumes of note: `prometheus_data` 118.9MB, `grafana_data_final` 14.65MB, `grafana_data` 50.13MB (older/orphaned), `grafana_data_v3` 14.59MB (orphaned), `twenty_db-data` 71.46MB (orphaned, Twenty CRM no longer runs on Core).

## systemd_units[] — running, non-stock (57 running total; below are the added/customer-relevant ones)

| unit | purpose | exec | port | env file | data path | classification |
|---|---|---|---|---|---|---|
| auth-api.service | ITPP Auth API (SSO) | uvicorn server:app :8500 | 127.0.0.1:8500 | `/root/projects/auth/.env` | `/root/projects/auth/auth.db` (32M dir) | needs-decision (auth.itpropartner.com is customer SSO; plan doesn't mention it) |
| diglocate-api.service | 811 locate ticket mgmt API | uvicorn main:app :8000 | 127.0.0.1:8000 | none found | `/root/projects/diglocate` (118M) | move-to-app4 |
| dre-mcp.service | DRE MCP server (Hermes tool) | python server.py | n/a (stdio/mcp) | `/root/.hermes/.env` | `/root/docker/dre-mcp` (171M) | needs-decision (Hermes MCP but customer=DRE data) |
| dre-portal.service | DRE customer portal API | uvicorn app.main:app :8093 | 127.0.0.1:8093 | `/opt/dre-portal/.env` | `/opt/dre-portal/data/dre.db` (110M dir) | move-to-app4 |
| ft360-mcp.service | FT360 (FleetTracker360) MCP server | python server.py | n/a | none found | `/root/docker/ft360-mcp` (60K) | needs-decision |
| gitea-runner.service | Gitea Actions Runner (core) | act_runner daemon | :35849 | none found | `/var/lib/gitea-runner` | stays-on-Core (CI runner tied to Core, not customer-facing) |
| hermes-assistant.service | Hermes Assistant PWA backend | python server.py | 127.0.0.1:8082 (python3 pid 1098) | none found | `/root/hermes-assistant` (169M) | stays-on-Core (Hermes-related) |
| hermes-browser.service | Headless Chromium (CDP) | chrome --remote-debugging-port=9222 | 127.0.0.1:9222 | n/a | n/a | stays-on-Core (Hermes dependency) |
| hermes-socat-8787.service | port forward for HermesX mobile | socat 8787->8642 | 0.0.0.0:8787 | n/a | n/a | stays-on-Core |
| hermes-voice.service | Hermes Voice (SvelteKit) | node build/index.js | 127.0.0.1:4331 | `/opt/hermes-voice/.env` | `/opt/hermes-voice` (123M) | needs-decision (named "Hermes" but proxied at voice.itpropartner.com, a customer-facing plan item) |
| host-metrics-exporter.service | systemd/docker/disk/mem exporter | python | n/a (writes textfile) | n/a | n/a | stays-on-Core |
| hotnow-api.service | HotNow API backend | uvicorn main:app :8001 | 127.0.0.1:8001 | `/root/hotnow-api/.env` | `/root/hotnow-api` (66M) + Postgres db `hotnow` (16MB) + Redis DB1 | move-to-app4 |
| intelsight-api.service | IntelSight API | python server.py :8099 | 127.0.0.1:8099 | none found | `/root/intelsight-api/intelsight.db` (64M dir) | move-to-app4 |
| node_exporter.service | Prometheus node exporter | node_exporter | 0.0.0.0:9100 | n/a | n/a | stays-on-Core |
| ops-portal.service | ITPP Ops Portal backend | uvicorn server:app :8090 | 127.0.0.1:8090 | `/root/.hermes/.env` | `/opt/ops-portal/ops.db` (148M dir) | move-to-app4 (per plan) |
| osint-api.service | OSINT Tool Daily Discovery API | uvicorn api:app :8100 | 127.0.0.1:8100 | `/root/.hermes/.env` | `/opt/osint-api` (323M) | needs-decision |
| osint-person.service | OSINT Person MCP server | python server.py | n/a | `/root/.hermes/.env` | `/root/docker/osint-person-mcp` (314M) | needs-decision (Hermes MCP tool) |
| outlook-upload.service | Outlook folder upload receiver | python upload_server.py | 127.0.0.1:8240 | none | `/root/upload-staging` | needs-decision |
| pipeline-api.service | Project Pipeline API (customer portal backend) | python server.py :8200 | 127.0.0.1:8200 | none found | `/root/projects/pipeline/pipeline.db` (30M dir) | move-to-app4 |
| pry.service | PRY unified OSINT search backend | python server.py :8905 | 127.0.0.1:8905 | `/root/.hermes/.env` | `/root/docker/pry` (66M) | needs-decision |
| pta-registration.service | TIMAPTA Membership Registration | uvicorn server:app :8114 | 127.0.0.1:8114 | none | `/opt/pta-registration/pta.db` (53M dir) | move-to-app4 |
| rally.service | Rally Family Calendar | python run.py :8105 | 127.0.0.1:8105 | none found | `/opt/rally/data/rally.db` (294M dir) | move-to-app4 |
| seemytrip.service | SeeMyTrip media pipeline | uvicorn server:app :8113 | 127.0.0.1:8113 | none | `/opt/seemytrip/data/seemytrip.db` (212M dir) | move-to-app4 |
| shark-game.service | Shark Attack Fantasy Game backend | python server.py :8083 | 0.0.0.0:8083 | none | `/root/shark-game/backend/game.db` (127M dir) | move-to-app4 |
| shopping-cart.service | Shopping Cart Builder | uvicorn app:app :8101 | 127.0.0.1:8101 | none | `/opt/shopping-cart` (147M) | move-to-app4 |
| snmp-metrics.service | SNMP metrics HTTP server | python snmp-http-server.py :8105-adjacent (0.0.0.0:8105) | 0.0.0.0:8105 | n/a | n/a | stays-on-Core |
| super-search.service | Super Search MCP server | python server.py :8899 | 0.0.0.0:8899 | `/root/.hermes/.env` | `/root/docker/super-search` (1.1G) | stays-on-Core (Hermes MCP) |
| survey-registration.service | TIMA Location Survey | uvicorn server:app :8115 | 127.0.0.1:8115 | none | `/opt/pta-survey/survey.db` (50M dir) | move-to-app4 |
| transitpin.service | TransitPin WebSocket relay | node server.js | 127.0.0.1:8210 | none | `/opt/transitpin` (496K) | move-to-app4 |
| twilio-mcp.service | Twilio MCP server | python server.py | n/a | `/root/.hermes/.env` | `/root/docker/twilio-mcp` (171M) | stays-on-Core (Hermes MCP; also feeds voice stack) |
| verdicttank-api.service | VerdictTank form handler + PDF gen | python api.py :8201 | 127.0.0.1:8201 | `/etc/verdicttank.env` | `/opt/verdicttank/users.db` (15M dir) | move-to-app4 |
| verdicttank-worker.service | VerdictTank review worker (multi-model panel) | python worker.py | n/a | `/etc/verdicttank.env` | `/opt/verdicttank` | move-to-app4 |
| voice-agent-stt.service | Voice Agent STT (faster-whisper) | uvicorn stt_server:app :9000 | 127.0.0.1:9000 | none | `/opt/voice-agent` (470M) | needs-decision (plan lists voice stack for app4 but not this STT sub-service explicitly) |
| voice-agent.service | Voice Agent (open-source stack) | uvicorn agent_server:app :9101 | 127.0.0.1:9101 | `/opt/voice-agent/.env` | `/opt/voice-agent` | move-to-app4 (voice.itpropartner.com / voice-open.itpropartner.com) |
| wazuh-agent.service | Wazuh SIEM agent | (Wazuh binary) | n/a | n/a | n/a | stays-on-Core (security agent, host-level) |
| caddy.service | reverse proxy | caddy run | 152.53.192.33:80/443 | `/etc/caddy/Caddyfile` | `/var/lib/caddy` (TLS store) | stays-on-Core per plan (routes to be trimmed after cutover) |
| postgresql@17-main.service | Postgres host instance | postgres | 127.0.0.1:5432, [::1]:5432 | n/a | `/var/lib/postgresql` (71M) | needs-decision (only DB is `hotnow`, which is moving) |
| redis-server.service | Redis | redis-server | 127.0.0.1:6379, [::1]:6379 | n/a | `/var/lib/redis` (8K, no persistence file written; `appendonly no`, RDB save schedule set) | needs-decision (HotNow is the only confirmed consumer found) |

Disabled-but-present units (not running, found via unit files, no `.service` entry in the running list): `crawl4ai.service` (Crawl4AI extraction microservice, port 8910, disabled/inactive) and `hermes-control-deck.service` (backend API, port 8200 conflicts with pipeline-api's port 8200 if ever enabled — flagged in ambiguities). Both should be accounted for even though inactive.

Hermes-related systemd units confirmed via `systemctl --user list-units` (separate user-level manager, NOT touched or restarted): `hermes-gateway.service` (active running, PID 100998, 5.3G RAM) and `ssh-agent.service`. These stay on Core by definition of the migration and were only observed, never controlled.

## ports[] — Listening sockets (66 TCP, 14 UDP)

Representative table (full list captured via `ss -tlnp`/`ss -ulnp`, see raw command output in this task's tool log for the complete 80-row set):

| port | bind | process | service |
|---|---|---|---|
| 443 | 152.53.192.33 | caddy | Caddy HTTPS (customer + core sites) |
| 80 | 152.53.192.33 | caddy | Caddy HTTP redirect |
| 443 | 100.71.155.7 (Tailscale) | tailscaled | Tailscale-only HTTPS |
| 22 | 0.0.0.0 / [::] | sshd | SSH |
| 5432 | 127.0.0.1 / [::1] | postgres | Host PostgreSQL 17 |
| 6379 | 127.0.0.1 / [::1] | redis-server | Redis |
| 3000 | 0.0.0.0 / [::] | docker-proxy | browserless |
| 3001 | 0.0.0.0 / [::] | docker-proxy | uptime-kuma |
| 3002 | * (all interfaces) | grafana | Grafana (not port-mapped through Caddy's default_bind; exposed directly) |
| 9377 | 0.0.0.0 / [::] | docker-proxy | camofox-browser |
| 8090-8115, 8200-8210, 8500, 8899-8905 range | mostly 127.0.0.1 | uvicorn/python | see systemd_units table above |
| 8787 | 0.0.0.0 | socat | Hermes API forward for mobile |
| 8642 | 0.0.0.0 | hermes | Hermes gateway internal API (do not touch) |
| 9090 | * | prometheus | Prometheus |
| 9100 | * | node_exporter | Node exporter |
| 9273 | * | telegraf | Telegraf |
| 9436 | 127.0.0.1 | docker-proxy | mikrotik-exporter |
| 9222 | 127.0.0.1 | chrome | Hermes headless browser CDP |
| 25 | 127.0.0.1 / [::1] | exim4 | local mail relay |
| 500, 4500 (UDP) | 0.0.0.0 / [::] | charon (strongSwan) | IPsec (unclear purpose — see ambiguities) |
| 1701 (UDP) | 0.0.0.0 | xl2tpd | L2TP (unclear purpose — see ambiguities) |
| 51821 (UDP) | 0.0.0.0 / [::] | (no owning process shown) | WireGuard, per UFW comment |
| 41641 (UDP) | 0.0.0.0 / [::] | tailscaled | Tailscale |
| 5353 (UDP) | 0.0.0.0 / [::] | avahi-daemon | mDNS |

## caddy_sites[] — 49 site blocks

Extracted from `/etc/caddy/Caddyfile` (513 lines; global block sets `default_bind 152.53.192.33`, `email info@itpropartner.com`). Full list of hostnames and their backend targets:

| hostname(s) | backend | notes |
|---|---|---|
| core.itpropartner.com | 127.0.0.1:8240, 127.0.0.1:8201, static /var/www | multi-path handler; Ops Portal / VerdictTank API paths mixed in |
| sign.itpropartner.com | 127.0.0.1:8091 | DocuSeal |
| sign.modelortho.com | 127.0.0.1:8092 | DocuSeal (modelortho) |
| sign.debtrecoveryexperts.com | 127.0.0.1:8094 | DocuSeal (DRE) |
| ops.itpropartner.com | 127.0.0.1:8090, 127.0.0.1:8100, static | Ops Portal + OSINT API |
| shark.iamgmb.com | 127.0.0.1:8083 | Shark Game |
| internal.debtrecoveryexperts.com | 127.0.0.1:8093, static, basic_auth | DRE Portal internal, password-protected |
| portal.debtrecoveryexperts.com | redirect to my.debtrecoveryexperts.com/start | |
| pay.debtrecoveryexperts.com | static | |
| my.debtrecoveryexperts.com | 127.0.0.1:8093, static | DRE Portal |
| crm.debtrecoveryexperts.com | localhost:3003 | **DEAD — nothing listening on 3003** |
| dig.iamgmb.com | 127.0.0.1:8000, static | DigLocate |
| uptimekuma.itpropartner.com | localhost:3001 | Uptime Kuma |
| gps.fleettracker360.com | 152.53.39.202:8082 (App2, remote proxy) | Traccar on App2, not Core |
| my.itpropartner.com | 152.53.241.111:8090 (App3, remote), 127.0.0.1:8200 (pipeline), static | Mixed remote+local |
| status.itpropartner.com | 127.0.0.1:8210, 127.0.0.1:3001, static | Transitpin relay + Uptime Kuma API |
| track.fleettracker360.com (http only) | 152.53.39.202:5055 (App2, remote) | |
| hear.fleettracker360.com | static | |
| voice.itpropartner.com | 127.0.0.1:4331 | Hermes Voice / SvelteKit |
| voice-open.itpropartner.com | 127.0.0.1:9101 | Voice Agent |
| auth.itpropartner.com | 127.0.0.1:8500, static | Auth API |
| my.intelsight.io | 127.0.0.1:8099, static | IntelSight |
| intelsight.io | static | landing page |
| intelsight.iamgmb.com | static | landing page |
| schedule.iamgmb.com | static | |
| seemytrip.iamgmb.com | 127.0.0.1:8113, static | SeeMyTrip |
| rally.iamgmb.com | 127.0.0.1:8105, static | Rally |
| shopping.iamgmb.com | 127.0.0.1:8101, 127.0.0.1:8210, static | Shopping Cart |
| pry.iamgmb.com (http only) | 127.0.0.1:8905, static | PRY |
| crm.intelsight.io | localhost:3003 | **DEAD — same as above** |
| www.hotnow.io | redirect to hotnow.io | |
| hotnow.io | static | |
| app.hotnow.io | static | |
| api.hotnow.io | 127.0.0.1:8001 | HotNow API |
| admin.hotnow.io | static | |
| timetrex.iamgmb.com | 127.0.0.1:8085 | TimeTrex |
| webmail.timapta.org, webmail.transitpin.com, webmail.rfptank.com, webmail.radartank.com, webmail.verdicttank.com | redirect to heracles.mxrouting.net, `tls internal` | 5 sites, self-signed certs |
| share.itpropartner.com | 127.0.0.1:8260 | Microbin |
| verdicttank.com, www.verdicttank.com | 127.0.0.1:8201, static | VerdictTank |
| voipsimplicity.itpropartner.com | static, `tls internal` | |
| forefront.itpropartner.com | static, `tls internal` | |
| ops.verdicttank.com | 127.0.0.1:8201, static | |
| register.timapta.org | 127.0.0.1:8114 | PTA registration |
| pta.iamgmb.com | 127.0.0.1:8114 | PTA registration (dup route) |
| survey.iamgmb.com | 127.0.0.1:8115 | PTA survey |

`caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile` returned **Valid configuration** (with a formatting-only warning, no functional errors).

## databases[] — PostgreSQL + Redis

PostgreSQL 17.10 (host, `postgresql@17-main.service`, port 5432):

| database | owner | size |
|---|---|---|
| hotnow | hotnow_app | 16 MB |
| postgres | postgres | 7510 kB |
| template0 | postgres | 7353 kB |
| template1 | postgres | 7582 kB |

Roles: `hotnow_app` (no special attrs), `postgres` (superuser).

TimeTrex has its own **containerized PostgreSQL 16** instance (visible only via the bind-mounted `/root/docker/timetrex/database` PGDATA directory, `type=postgres, host=localhost, user=timetrex` in `timetrex.ini.php`). Not queryable from the host `psql` since it lives inside the container's own network namespace / port, and the container does not publish 5432 to the host.

Redis 8.0.2 (`redis-server.service`, port 6379): `used_memory` 741 KB, `used_memory_rss` 17 MB, `save 3600 1 300 100 60 10000`, `appendonly no`. `DBSIZE` on DB0 and DB1 both returned 0 at scan time. HotNow's `.env` references `redis://localhost:6379/1` confirming at least one real customer consumer even though it was empty when sampled.

## cron[] — system cron + Hermes cron

Root system crontab (`crontab -l`, 12 real entries beyond blank/env lines): boys-mail-monitor (hourly + daily), shark-game scraper (daily), shark-draft-reminder (15 min), hermes-backup.sh (1 AM), backup-audit-check.sh (2 AM), root-essentials-backup.sh (3 AM), system-config-sync.sh (4 AM), snmp-collect.sh (every minute), core-services-backup.sh (1:30 AM), watchdog-wg-tunnel.sh (10 min), ops-report-collect/send (23:30).

`/etc/crontab`: only stock Debian `run-parts` hourly/daily/weekly/monthly entries.

`/etc/cron.d/`: `e2scrub_all`, `kernel` (fstrim), `php` (session cleanup), `sysstat` — all stock Debian. One custom entry: `reap-chrome` (every 30 min, reaps orphaned Playwright Chrome processes, added per DR note 2026-09-09).

No other Linux user has a crontab (checked every user in `/etc/passwd`).

Hermes cron (`/root/.hermes/cron/jobs.json`): **87 jobs total**, `last_status: ok` for the great majority; 5 jobs currently show `last_status: error` (`Doc-Live Verify`, `Security Compliance Check`, `OSINT Tool Daily Discovery`, `Super Search Daily Discovery`, `Nous LLM Pricing Weekly Report`) — these are Hermes-internal automation, not customer-facing infra, and are flagged for the Hermes team separately, not part of this migration's scope. Backup-relevant Hermes cron jobs (docuseal-backup, docuseal-dre-backup, docuseal-modelortho-backup, timetrex-backup, auth-api-backup, and dozens of others for App1/2/3 services) confirm the backup-plan.md schedule is implemented as documented, with the caveat in surprise #8 above (several newly-found Core services have no corresponding job at all).

## certs[] — TLS

47 real ACME-issued certificates under `/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/` and one under the ZeroSSL CA path (`api.hotnow.io`). All checked with `openssl x509 -noout -enddate`; none are expired, nearest expiry is `status.itpropartner.com` and `voipsimplicity`-adjacent (self-signed, see below) in mid-October 2026, furthest is `pta.iamgmb.com` (Dec 9 2026). Full list of hostname -> expiry captured in the JSON companion file.

7 self-signed (`tls internal`) certs for internal/webmail redirect stubs: `webmail.verdicttank.com`, `webmail.rfptank.com`, `webmail.radartank.com`, `webmail.timapta.org`, `webmail.transitpin.com`, `voipsimplicity.itpropartner.com`, `forefront.itpropartner.com` — these expire within 1 year of issuance and are low-stakes redirect-only stubs.

Migration note: app4 must pre-issue its own certs for every moving hostname before DNS cutover (per the plan's checklist); the existing Core certs cannot be copied over and reused as-is without importing Caddy's storage, which the plan does not currently call for.

## data_paths[] — sizes (`du -sh`, all real measurements)

| path | size | owner service |
|---|---|---|
| /root/docker/uptime-kuma/data | 487M | uptime-kuma |
| /root/docker/super-search/ | 1.1G | super-search MCP (venv-heavy) |
| /opt/voice-agent | 470M | voice-agent/voice-agent-stt |
| /opt/rally/data/rally.db (dir 294M) | 294M | rally |
| /opt/osint-api | 323M | osint-api |
| /root/docker/osint-person-mcp | 314M | osint-person MCP |
| /opt/seemytrip/data | within 212M dir | seemytrip |
| /opt/ops-portal | 148M | ops-portal |
| /opt/shopping-cart | 147M | shopping-cart |
| /root/docker/dre-mcp | 171M | dre-mcp |
| /root/docker/twilio-mcp | 171M | twilio-mcp |
| /root/shark-game | 127M | shark-game |
| /root/hermes-assistant | 169M | hermes-assistant |
| /opt/hermes-voice | 123M | hermes-voice |
| /root/projects/diglocate | 118M | diglocate-api |
| /opt/dre-portal | 110M | dre-portal |
| /var/lib/docker/volumes/prometheus_data/_data | 114.9M | prometheus |
| /opt/pta-registration | 53M | pta-registration |
| /opt/pta-survey | 50M | survey-registration |
| /root/docker/timetrex (container data) | 50M | timetrex |
| /root/hotnow-api | 66M | hotnow-api |
| /root/intelsight-api | 64M | intelsight-api |
| /root/docker/pry | 66M | pry |
| /root/projects/pipeline | 30M | pipeline-api |
| /root/projects/auth | 32M | auth-api |
| /var/lib/docker/volumes/grafana_data_final/_data | 15M | grafana |
| /opt/verdicttank | 15M | verdicttank-api/worker |
| /var/lib/postgresql | 71M | host PostgreSQL |
| /root/docker/docuseal-dre/data | 2.5M | docuseal-dre |
| /root/docker/docuseal-modelortho/data | 1.4M | docuseal-modelortho |
| /root/docker/docuseal/data | 688K | docuseal |
| /opt/transitpin | 496K | transitpin |
| /opt/microbin/data | 4.0K | microbin |
| /var/lib/redis | 8.0K | redis-server (no RDB dump on disk at scan time) |

Overall disk: `/dev/vda4` 503G total, 157G used (33%), 326G available. `/var/lib/docker` 31G, `/root/docker` 5.8G, `/opt` 6.4G.

Memory/CPU snapshot at scan time: 15Gi RAM total, 4.9Gi used, 11Gi buff/cache, 8Gi swap configured with 1.9Gi in use; 8 vCPUs.

## ambiguities[]

1. **`grafana`, `prometheus`, `telegraf`, `mikrotik-exporter` containers have no discoverable `docker-compose.yml`** in the paths their bind mounts imply beyond `/root/docker/monitoring/...` for the latter three; Grafana's compose file was not found at all (likely started via a one-off `docker run` or a compose file elsewhere not searched). Confirm before any monitoring-stack changes.
2. **`crawl4ai.service` and `hermes-control-deck.service`** are defined but disabled/inactive. `hermes-control-deck` binds port 8200, the same port `pipeline-api.service` is actively using — if `hermes-control-deck` is ever enabled it will fail to bind. Needs a decision on whether either is still needed; neither showed up in the migration plan.
3. **IPsec (`charon`/strongSwan) on UDP 500/4500 and L2TP (`xl2tpd`) on UDP 1701** are running with no obvious owner in the docs reviewed. Unclear if this is a legacy VPN endpoint for a customer or leftover config. Flag for the infra team, do not assume it is decommission-safe.
4. **UFW rule `8890/tcp "temp map server"`** — nothing is listening on this port today. Unclear what service this was for or whether it is scheduled to return.
5. **`crm.debtrecoveryexperts.com` and `crm.intelsight.io`** Caddy blocks point to `localhost:3003` with nothing listening. Either Twenty CRM on App1 is reached by a different mechanism not visible from Core (e.g. these routes are actually dead code) or there's a missing local proxy. Needs confirmation before deciding whether these Caddy blocks move, get deleted, or get repointed to App1 directly.
6. **`gitea-runner.service`** listens on `*:35849` — purpose of this port (act_runner's own control port) unconfirmed from Core alone; likely not customer-facing, but flagged since it's a nonstandard high port bound to all interfaces.
7. **Grafana bound to `*:3002`** on all interfaces (not proxied through Caddy's default_bind and not restricted to localhost or Tailscale) — worth checking if this is intentionally public; it wasn't found behind any Caddy site block in the scanned Caddyfile.
8. **TimeTrex's internal PostgreSQL 16** could not be queried from the host `psql` (different engine version/instance inside the container, not published to host network). A migration plan needs a container-internal `pg_dump` step (documented in `timetrex-backup.sh`, which already does `docker exec timetrex ... pg_dump`), not a host-level one.
9. Several running services have **no `.env` and no discoverable database config found in a shallow scan** (`diglocate-api`, `ft360-mcp`, `intelsight-api` — wait, intelsight-api does have `intelsight.db`, `pipeline-api`, `pry`, `rally`, `seemytrip`, `shark-game`, `shopping-cart`, `transitpin`) beyond the SQLite files already listed; deeper source inspection would be needed to confirm each has no hidden Postgres/Redis dependency the shallow `.env` grep missed.

## Backup coverage summary (cross-checked against backup-plan.md)

Covered by an existing script (verified script exists, not verified last-run freshness beyond what backup-plan.md states): Hermes (full + live sync), /root essentials, Grafana, Uptime Kuma, Docker volumes, Prometheus, Auth API, DocuSeal (x1 base + x2 named backups for -dre and -modelortho), TimeTrex.

**No backup coverage found** for (all newly-discovered in this audit): DigLocate API, FT360 MCP (only stats/export scripts found, not a DB backup), HotNow API + its Postgres DB + Redis DB1, IntelSight API, OSINT API, OSINT Person MCP, Pipeline API, PRY, PTA Registration, PTA Survey, Rally (only debug/dump scripts found, not a scheduled backup job matching this DB path), SeeMyTrip, Shark Game backend DB, Shopping Cart, DRE Portal (`dre.db`), Voice Agent, Voice Agent STT, VerdictTank's `users.db` (VerdictTank does have `hello-*-collect.py` cron jobs but not a DB backup job).

These gaps should be closed on app4 as part of Phase 1/3 of the migration, not carried over as-is.