Malin
fa7c367420
- server-fleet-map: add gringo row - bastille-jail-provisioning: elevate default-deny-outbound to the standard for every new jail; reference gringo's live pf.conf - modded-app-update-pattern: new skill, fork/rebase pattern for locally patched apps; uses tailnetatlas on gringo as the concrete example - dependency-vuln-scanning: new skill, npm audit / pip-audit / osv-scanner cadence for deployments and monthly thereafter
45 lines
3.7 KiB
Markdown
45 lines
3.7 KiB
Markdown
---
|
|
name: server-fleet-map
|
|
description: Use when deciding WHICH host a piece of work belongs on, or when you need a host's connection details. Reference map of the FreeBSD/bastille jail fleet and what each host is actually for.
|
|
---
|
|
|
|
# Server Fleet Map
|
|
|
|
All hosts reachable over Tailscale (`root@<host>`, SSH key
|
|
`/root/.ssh/id_ed25519` unless noted). Each host has a distinct
|
|
**purpose** — check this before assuming a new site/service belongs on
|
|
whichever host you happen to already be connected to.
|
|
|
|
| Host | Tailscale IP | Purpose | Notes |
|
|
|---|---|---|---|
|
|
| **staging** | `100.104.61.54` | Dev/staging — pre-production testing, throwaway experiments | New jail IPs here need the same arp-scan discipline as everywhere else on this shared LAN (see `bastille-jail-provisioning` skill) — this is where that gotcha was first found. |
|
|
| **venus** | `100.109.251.127` (LAN `192.168.0.33`) | Corporate — internal business sites/tools, the iWP.es plugin-subscription platform, and other CloudHost-org first-party projects | Bastille jails, combined web+db (local MariaDB, no shared external DB host). New jails typically created via `bastille clone -a <known-good-base>` rather than from scratch. |
|
|
| **granja** | `100.98.197.28` | Affiliate network — the travel/tourism site network (menorca.ro, palma.ro, and similar) | No public interface configured directly; sits behind a reverse-proxy manager (NPM) over Tailscale. See `docs/server-granja.md` for the local-curl-simulates-NPM testing trick. |
|
|
| **funky** | `100.127.21.100` (LAN `192.168.0.218`) | Customers — sites migrated from the old Linux affiliate fleet, actual paying-customer properties (e.g. news.easycut.es, photomouse.ro) | Combined web+db+valkey, bastille jails. Migration target that absorbed several now-decommissioned Linux hosts (maagar, shoe, proton). |
|
|
| **gringo** | `100.95.46.79` (LAN `192.168.168.68`) | Internal apps/tools host — replacement for the old Linux Docker host barky-1 | ~45 Bastille VNET jails on `10.20.0.0/24` (APIs, dashboards, Gitea, analytics, productivity tools). Default-deny outbound pf model; NPM dedicated ports `8000 + last octet`. See `docs/server-gringo.md`. |
|
|
| **zamolxis** | `100.115.128.41` | Standalone (non-jailed) FreeBSD site host | Not part of the granja/external-fleet jail families — a single site (Newspaper/tagDiv theme, PHP 8.5) running directly on the host, not in a jail. |
|
|
| **cabrera** | `100.100.108.19`, SSH port `79` | External Linux affiliate-network host (BTPanel-style) | Part of the older Linux fleet (alongside raptor/maagar/formentor/moonie/spunky/proton/shoe — several since decommissioned/migrated to funky). Hosts easycut.es's main WooCommerce e-commerce site directly (not jailed). |
|
|
|
|
## How to decide where new work belongs
|
|
|
|
1. **What kind of thing is it?** A corporate/internal tool → venus. A
|
|
customer's production site → funky. A new affiliate-network travel
|
|
site → granja. A quick experiment or something not ready for anything
|
|
resembling production → staging.
|
|
2. **Does it already have an established host from a related sibling
|
|
project?** (e.g. another CloudHost-org first-party tool already lives
|
|
on venus) — match that, don't scatter related things across hosts
|
|
without a reason.
|
|
3. **When genuinely unsure, ask** rather than guessing — which host
|
|
something lives on affects DNS, backup scope, and who has access to
|
|
it later.
|
|
|
|
## Gitea (separate from any of the above)
|
|
|
|
`https://devops.cloudhost.es` — not one of the site-hosting fleet, this
|
|
is the internal git/CI host. Orgs seen so far: `CloudHost` (main
|
|
internal projects + this skills repo), `iWP.es` (the plugin-subscription
|
|
product and its forked/rebranded plugins), `InformatiQ` (the security
|
|
plugin), `External` (mirrors of third-party repos for internal
|
|
reference).
|