Security Notice

This document has been auto-published from the internal knowledge base. All passwords, API keys, tokens, and IP addresses have been redacted for security.

Infrastructure Specialist

VPS Inventory

srv1139900 — [VPS_IP] (Primary)

• SSH: ssh -i ~/.ssh/id_hostinger root@[VPS_HOSTNAME]
• Specs: KVM 8, 8 CPU, 32GB RAM
• 17 containers:

Service	Container	Port	Domain
Traefik	root-traefik-1	80/443	(reverse proxy)
n8n	root-n8n-1	5678 (localhost)	n8n.[VPS_HOSTNAME]
HandyManny (CHAROS)	handymanny	3002	charos.handymanny.cloud
HandyManny (U1ST)	u1st-handymanny	3004	u1st.handymanny.cloud
Expediente	charos-expediente	3005	expediente.handymanny.cloud
Landing Page	handymanny-site	80 (internal)	handymanny.cloud
VIA Dashboard	via-plan + via-plan-api	80 (internal)	via.handymanny.cloud
Mission Control v3	mission-control	80 (internal)	mc.handymanny.cloud
WSI MC	wsi-mc	80 (internal)	wsi.handymanny.cloud
Sales MC	sales-mc	80 (internal)	sales.handymanny.cloud
Consultin Gruas	consultin-gruas	80 (internal)	consultin.handymanny.cloud
Headless Browser	headless-browser	3000	(direct port)
Evolution API	evolution-api	8080	(direct port)
PDF Splitter	pdf-splitter	5555	(direct port)
docs-1414	docs-1414	80 (internal)	docs-1414.[VPS_HOSTNAME]
PostgreSQL (HM)	handymanny-postgres	5432 (internal)	—
PostgreSQL (Exp)	expediente-postgres	5432 (internal)	—
PostgreSQL (Evo)	evolution-postgres	5432 (internal)	—

srv1379713 — [VPS_IP] (OpenClaw Only)

• **ssh user@server`
• 1 container: openclaw-ruln-openclaw-1 (port 63034 localhost-only)
• Access UI via SSH tunnel only

Docker Networks

• root_default — shared by n8n, Traefik, all app containers, headless-browser, pdf-splitter

Deploy Patterns by Project

Project	Source	Deploy Command
HandyManny (CHAROS)	~/projects/handymanny/	./deploy.sh charos
HandyManny (U1ST)	~/projects/handymanny/	./deploy.sh u1st
Expediente	~/projects/expediente/	bash ~/projects/expediente/deploy.sh
Mission Control v3	~/mission-control/	bash ~/mission-control/deploy.sh
WSI MC	~/wsi-mc/	bash ~/wsi-mc/deploy.sh
Sales MC	~/projects/sales-mc/	cd ~/projects/sales-mc && bash deploy.sh
Consultin Gruas	~/projects/consultin-gruas/	bash ~/projects/consultin-gruas/deploy.sh
VIA Dashboard	~/Downloads/via-plan-deploy/	bash ~/Downloads/via-plan-deploy/deploy.sh
Landing Page	~/projects/handymanny-site/	cd ~/projects/handymanny-site && bash deploy.sh
Headless Browser	~/projects/docker-stack/headless-browser/	SCP → cd /docker/headless-browser && docker compose up -d --build
WSI Mgmt Report	~/projects/wsi-management-report/	TODO: add deploy.sh

Passwords & Auth

Service	User	Password
n8n UI	—	[REDACTED]
MC basic auth	chavez684	Ch@r0s2026MC
WSI MC basic auth	(same as MC)	(same as MC)
Sales MC basic auth	admin	WestSide
HandyManny admin	user@example.com	[PASSWORD]

n8n Credentials (Reference IDs)

Credential	ID	Used By
Anthropic	[CREDENTIAL_ID]	AI parsing (all workflows)
MS SQL (CW)	[CREDENTIAL_ID]	AN Audit, AP Invoice
Gmail	[CREDENTIAL_ID]	Shipment Notice Emailer
SSH srv1139900	ssh-srv1139900-pk	CrowBot Security/Versions/Briefing
Anthropic Header	[CREDENTIAL_ID]	CrowBot Orchestrator
Google Calendar OAuth	calendar-credentials.json (local)	Mission Control

VPS Cron Jobs (srv1139900)

Time (UTC)	Script	Purpose
03:00	/backups/pg-backup.sh	PostgreSQL backups (7-day retention)
12:00	/root/scripts/sales-mc-cw-sync.py	CW → Sales MC data sync (pymssql)
12:05	/root/scripts/sales-mc-sf-sync.sh	SF → Sales MC activity sync (via n8n cache)

PostgreSQL Backups

• Script: /backups/pg-backup.sh on srv1139900
• Cron: Daily 3 AM UTC, 7-day retention
• DBs: handymanny, u1st, expediente (x2), evolution
• Logs: /backups/backup.log

SSL / Traefik

• Traefik handles Let's Encrypt auto-renewal for all *.handymanny.cloud subdomains
• SSL bug (2026-02-22): www. variant in Traefik router rules broke LE TLS challenge. Fixed by removing www. from docker-compose files.

CHAROS Auditor — Security CLI

• Location: ~/charos-auditor/
• Run: python auditor.py (full) | --quick (local only)
• Current Score: 83/B (full) | 92/A (quick)
• Schedule: Daily 7 AM via Task Scheduler
• n8n Alert: iCi0oHtOg0k43IFI (ACTIVE) — Telegram to chat 5523342814 when score <70
• 9 modules: deps (20%), secrets (20%), routes (15%), docker (10%), headers (10%), infra (10%), n8n (5%), code (5%), ssl (5%)
• 15/15 security to-dos DONE (webhooks, headers, HSTS, PG backups, vitest, ESLint, Docker limits, alert workflow, trend chart)
• MC integration: generate.py reads ~/charos-auditor/reports/latest.json + history.json

Windows Scheduled Tasks

Task	Execute	Frequency
Claude Session Monitor	run-session-monitor.bat	Every 15 min
MC AI Process Scanner	python ai-processes.py	Every 5 min
MC SSL Health Check	run-health.bat	Every 2 hours
Mission Control Dashboard	run-daily.bat	Every 2 hours
OpenClaw Daily Sync	run-daily.bat	Every 4 hours
CHAROS Auditor Daily	run-audit.bat	Daily 7 AM
MCP Process Cleanup	cleanup-mcp.ps1	Every 30 min
OllamaTunnel	wscript.exe ollama-tunnel.vbs	On logon

• All bat tasks set to Hidden=True (no cmd window flash)
• MCP Cleanup: kills orphaned cmd.exe/node.exe from stale Claude sessions

Maintenance Notes

• MCP orphan processes: ~/scripts/cleanup-mcp.ps1 handles cleanup (3 passes: dead parent, >1hr old, orphaned node)
• PowerShell via Bash: $_ gets mangled; write to .ps1 file first. $pid is reserved — use $procId
• Docker restart vs recreate: Must use docker compose down && up -d (not docker restart) when env vars change — entrypoint bakes vars at creation

Migration Log (2026-02-22)

What	From	To
VIA Dashboard	srv1379713 (HTTP)	srv1139900 (HTTPS via Traefik)
Evolution API	srv1379713 (v1.8.7)	srv1139900 (v2.3.7)
CHAROS Portal	handymanny.cloud	charos.handymanny.cloud
Mission Control	/mc in HandyManny	mc.handymanny.cloud (standalone)
Landing Page	—	handymanny.cloud (nginx static)

Key Local Paths

Path	Purpose
~/mission-control/	Dashboard generator + projects.json
~/openclaw-sync/	OpenClaw daily sync scripts
~/projects/docker-stack/headless-browser/src/	Headless browser source
~/charos-auditor/	Security audit CLI
~/scripts/cleanup-mcp.ps1	MCP process cleanup

Other Services

• Ollama: http://127.0.0.1:11434 (llama3.1 8B) — auto-starts on login via OllamaTunnel
• Evolution API: srv1139900:8080 (v2.3.7, DISCONNECTED, needs QR re-scan)