Fleet audit — 2026-11-06

Fleet audit — 2026-11-06

Read-only pass over every reachable host (~/.hermes/scripts/host-audit.sh, run as each host's conor). Facts as found that night; nothing was changed.

cbcore (100.64.0.3)

• Debian 13 trixie, kernel 6.12.113, up 8 days, load 1.06.
• Ryzen 9 7950X, 32 threads, 31 188 MB RAM (12 048 used, 19 139 available).
• Root 915 GB, 767 GB used, 101 GB free, 89%. /home/conor alone is 212 GB.
• Docker 29.8.1, 40 containers running. Forgejo 16.0.6, Nextcloud 33, Twenty v2.45.0, ComfyTax, tradingjournal, rss-hub fusion 1.1.1, Feishin 1.15, Plex, Ollama, netdata, Collabora, mailcow (watchdog 2.11, postfix 3.10.12, dovecot 2.3.21.1, rspamd 4.2.1, nginx 1.30.6, mysql 10.11, sogo 5.12.12).
• Node 24.16.0, npm 11.13.0, PHP 8.4.27, Caddy 2.11.4, MariaDB 11.8.6, PostgreSQL 17.11, Python 3.13.5, uv 0.11.18, git 2.47.3, pm2 7.0.4.
• Users with shells: conor (1000, sudo + docker), ciara (1002), guest (1003), dad (1004). adm includes conor, www-data, netdata.
• Cron (conor): calendar DB backup 04:00, docker builder prune -af weekly, TLS cert check 05:20, container health 05:40, vpn-box watchdog every 5 min.
• Anomaly: certbot.service failed. Caddy owns TLS here, so it is almost certainly a leftover from an older setup — worth masking rather than debugging.
• Risk: disk at 89% is the fleet's tightest margin.

vps2 (100.64.0.16)

• Debian 13, kernel 6.12.113, up 5 days, load 0.04. EPYC 9355P, 2 vCPU, 7 945 MB RAM (1 899 used), 99 GB disk (35 used, 60 free).
• Docker 29.9.2: headscale 0.29.6, headplane 0.8.2, cli-proxy-api v8.0.50 (listening 100.64.0.16:8317).
• Node 22.23.4 system-wide, but strata runs on nvm 24.16.0 as conor; PHP 8.4.27, Caddy 2.11.7, MariaDB 11.8.6.
• Users: conor (1000, sudo + docker), orcaide (1001). Service accounts include caddy (999) and deploy (995); groups caddy:www-data and web:caddy,www-data.
• Listening publicly: 22, 80, 443. Everything else is loopback or tailnet: 6768 (Orca), 8317 (cli-proxy).
• Cron (conor): market-data pipeline 05:00 Tue–Sat.
• Timers include deploy-sites (60 s), exim4-base.
• Anomaly: helios-playground-v4.service failed — unit not found, a stale leftover from the 4–5 Nov rebuild. Safe to remove.
• Anomaly: system exim4 is still active; it must go before the Postfix relay role can bind port 25 for the mail cutover.

cbfarm (100.64.0.4)

• Debian 13, kernel 6.12.113, up 1 day, load 0.09. Ryzen 5 3600, 12 threads, 15 922 MB RAM (4 123 used), 922 GB disk (76 used, 800 free).
• Docker 29.9.2: forgejo 16.0.6 + forgejo_db, twenty-* (server, worker, db, redis) — all up 27 h. Note Forgejo and Twenty also exist on cbcore; one of the two is the live instance and the other is a leftover — confirm before either is touched.
• Host Caddy 2.11.7 listening :80, :81, :8000, :8001, :8002, :8003, :8007. Also 222, 3389 (xrdp), 22000 (syncthing), 8384, 6768.
• PHP 8.4.27, MariaDB 11.8.6, Python 3.13.5, git 2.47.3. No Node in PATH for the audit user.
• Users: conor only, in sudo + docker. Cron: market-data pipeline.
• Anomaly: NetworkManager-wait-online.service failed — cosmetic on a wired box, but it slows boot ordering.

jamievps (100.64.0.17)

• Debian 13, kernel 6.12.115, up 1 day, load 1.32. EPYC 9354P, 8 vCPU, 32 100 MB RAM (14 839 used), 394 GB disk (66 used, 313 free).
• No Docker. Node 22.23.4, MariaDB 11.8.6, Caddy (installed, --version unsupported flag), Python 3.13.5.
• Listening: 22/80/443 public; on tailnet 3306 (MariaDB), 5180, 8096, 8770.
• Users: conor (1000, no sudo), jamie (1001, sudo + adm). Service account helios (999), caddy (994).
• Timers: helios-bitformance-live (5 min), helios-daily-refresh 03:00, helios-stream-freshness weekly, helios-hf-strategy-backtest monthly (2026-12-05), plus the every-few-minutes deployer.
• No failed units.

vps — old edge (100.64.0.2)

• Debian 13, kernel 6.12.113, up 6 days, load 0.20. 1 vCPU, 967 MB RAM, 20 GB disk (7.8 used, 11 free).
• Public ports: 25, 80, 443, 465, 587, 993, 4190 — it still owns the mail edge. Tailnet: 100.64.0.2:25 (relay for cbcore), plus its two tailscaled ports.
• Timers: caddy-cert-stage, mailcow-ban-sync (every min), mpanel-memory-graph, the apt/dpkg set.
• Anomaly: systemd-sysctl.service failed.
• Trap: ssh vps now resolves to vps2 through DNS, so the host key check fails. Address it as 100.64.0.2 until the alias is fixed.

Cross-cutting

• Every host is Debian 13 with conor as the administrative account except jamievps (no sudo) and vps2's deploy/orcaide service accounts.
• conor is in docker on cbcore, cbfarm and vps2 — equivalent to root on those boxes, which is why jamievps deliberately does not have Docker.
• TLS is Caddy everywhere; the old certbot on cbcore and the cert-staging timer on vps are legacy from before the edge moved.
• Only 101 GB free on cbcore against 800 GB on cbfarm and 313 GB on jamievps — bulk data belongs off cbcore.