# Fleet audit — 2026-11-06

# Fleet audit — 2026-11-06

Read-only pass over every reachable host (`~/.hermes/scripts/host-audit.sh`, run
as each host's `conor`). Facts as found that night; nothing was changed.

## cbcore (100.64.0.3)
- Debian 13 trixie, kernel 6.12.113, up 8 days, load 1.06.
- Ryzen 9 7950X, 32 threads, 31 188 MB RAM (12 048 used, 19 139 available).
- Root 915 GB, 767 GB used, 101 GB free, **89%**. `/home/conor` alone is 212 GB.
- Docker 29.8.1, 40 containers running. Forgejo 16.0.6, Nextcloud 33,
  Twenty v2.45.0, ComfyTax, tradingjournal, rss-hub fusion 1.1.1, Feishin 1.15,
  Plex, Ollama, netdata, Collabora, mailcow (watchdog 2.11, postfix 3.10.12,
  dovecot 2.3.21.1, rspamd 4.2.1, nginx 1.30.6, mysql 10.11, sogo 5.12.12).
- Node 24.16.0, npm 11.13.0, PHP 8.4.27, Caddy 2.11.4, MariaDB 11.8.6,
  PostgreSQL 17.11, Python 3.13.5, uv 0.11.18, git 2.47.3, pm2 7.0.4.
- Users with shells: conor (1000, sudo + docker), ciara (1002), guest (1003),
  dad (1004). `adm` includes conor, www-data, netdata.
- Cron (conor): calendar DB backup 04:00, `docker builder prune -af` weekly,
  TLS cert check 05:20, container health 05:40, vpn-box watchdog every 5 min.
- **Anomaly:** `certbot.service` failed. Caddy owns TLS here, so it is almost
  certainly a leftover from an older setup — worth masking rather than debugging.
- **Risk:** disk at 89% is the fleet's tightest margin.

## vps2 (100.64.0.16)
- Debian 13, kernel 6.12.113, up 5 days, load 0.04. EPYC 9355P, **2 vCPU**,
  7 945 MB RAM (1 899 used), 99 GB disk (35 used, 60 free).
- Docker 29.9.2: `headscale` 0.29.6, `headplane` 0.8.2, `cli-proxy-api`
  v8.0.50 (listening `100.64.0.16:8317`).
- Node 22.23.4 system-wide, but strata runs on nvm 24.16.0 as `conor`; PHP
  8.4.27, Caddy 2.11.7, MariaDB 11.8.6.
- Users: conor (1000, sudo + docker), orcaide (1001). Service accounts include
  `caddy` (999) and `deploy` (995); groups `caddy:www-data` and `web:caddy,www-data`.
- Listening publicly: 22, 80, 443. Everything else is loopback or tailnet:
  6768 (Orca), 8317 (cli-proxy).
- Cron (conor): market-data pipeline 05:00 Tue–Sat.
- Timers include `deploy-sites` (60 s), `exim4-base`.
- **Anomaly:** `helios-playground-v4.service` failed — unit *not found*, a stale
  leftover from the 4–5 Nov rebuild. Safe to remove.
- **Anomaly:** system `exim4` is still active; it must go before the Postfix
  relay role can bind port 25 for the mail cutover.

## cbfarm (100.64.0.4)
- Debian 13, kernel 6.12.113, up 1 day, load 0.09. Ryzen 5 3600, 12 threads,
  15 922 MB RAM (4 123 used), 922 GB disk (76 used, **800 free**).
- Docker 29.9.2: `forgejo` 16.0.6 + `forgejo_db`, `twenty-*` (server, worker,
  db, redis) — all up 27 h. Note Forgejo and Twenty also exist on cbcore; one of
  the two is the live instance and the other is a leftover — confirm before
  either is touched.
- Host Caddy 2.11.7 listening :80, :81, :8000, :8001, :8002, :8003, :8007.
  Also 222, 3389 (xrdp), 22000 (syncthing), 8384, 6768.
- PHP 8.4.27, MariaDB 11.8.6, Python 3.13.5, git 2.47.3. No Node in PATH for
  the audit user.
- Users: conor only, in `sudo` + `docker`. Cron: market-data pipeline.
- **Anomaly:** `NetworkManager-wait-online.service` failed — cosmetic on a wired
  box, but it slows boot ordering.

## jamievps (100.64.0.17)
- Debian 13, kernel 6.12.115, up 1 day, load 1.32. EPYC 9354P, 8 vCPU,
  32 100 MB RAM (14 839 used), 394 GB disk (66 used, 313 free).
- **No Docker.** Node 22.23.4, MariaDB 11.8.6, Caddy (installed, `--version`
  unsupported flag), Python 3.13.5.
- Listening: 22/80/443 public; on tailnet 3306 (MariaDB), 5180, 8096, 8770.
- Users: conor (1000, no sudo), jamie (1001, sudo + adm). Service account
  `helios` (999), `caddy` (994).
- Timers: `helios-bitformance-live` (5 min), `helios-daily-refresh` 03:00,
  `helios-stream-freshness` weekly, `helios-hf-strategy-backtest` monthly
  (2026-12-05), plus the every-few-minutes deployer.
- No failed units.

## vps — old edge (100.64.0.2)
- Debian 13, kernel 6.12.113, up 6 days, load 0.20. **1 vCPU, 967 MB RAM**,
  20 GB disk (7.8 used, 11 free).
- Public ports: 25, 80, 443, 465, 587, 993, 4190 — it still owns the mail edge.
  Tailnet: 100.64.0.2:25 (relay for cbcore), plus its two tailscaled ports.
- Timers: `caddy-cert-stage`, `mailcow-ban-sync` (every min),
  `mpanel-memory-graph`, the apt/dpkg set.
- **Anomaly:** `systemd-sysctl.service` failed.
- **Trap:** `ssh vps` now resolves to vps2 through DNS, so the host key check
  fails. Address it as `100.64.0.2` until the alias is fixed.

## Cross-cutting
- Every host is Debian 13 with `conor` as the administrative account except
  jamievps (no sudo) and vps2's `deploy`/`orcaide` service accounts.
- `conor` is in `docker` on cbcore, cbfarm and vps2 — equivalent to root on
  those boxes, which is why jamievps deliberately does not have Docker.
- TLS is Caddy everywhere; the old certbot on cbcore and the cert-staging timer
  on vps are legacy from before the edge moved.
- Only 101 GB free on cbcore against 800 GB on cbfarm and 313 GB on jamievps —
  bulk data belongs off cbcore.