# Websites & Sites Reference Card

FusionPBX has moved to its own file — see [voip.md](voip.md). It is no longer on the DO server.

## All Sites on DO (165.22.1.228)

| Site | Path | GitHub Repo | DB |
|------|------|-------------|-----|
| tomsjavajive.com | /home/tomsjavajive.com/public_html/ | myronblair/tomsjavajive | toms_tjj_db |
| epictravelexpeditions.com | /home/epictravelexpeditions.com/public_html/ | myronblair/epictravelexpeditions | epic_epic_db |
| parkerslingshot (subdomain) | /home/epictravelexpeditions.com/parkerslingshot/ | myronblair/parkerslingshot | epic_parkersling |
| parkerslingshotrentals.com | /home/parkerslingshotrentals.com/public_html/ | myronblair/parkerslingshotrentals | parker_db |
| tomtomgames.com | /home/tomtomgames.com/public_html/ | myronblair/tomtomgames | tomt_ttg_db |
| worktracking.orbishosting.com | /home/worktracking.orbishosting.com/public_html/ | myronblair/chucko | workt_track_db |
| orbishosting.com (apex) | /home/orbishosting.com/public_html/ | myronblair/orbishosting | — |
| orbis.orbishosting.com | /home/orbis.orbishosting.com/public_html/ | myronblair/orbis-hosting-portal | — |

**orbishosting.com (apex) and orbis.orbishosting.com are NOT the real live sites — don't audit/fix them expecting user traffic.** The apex's `/home/orbishosting.com` on this DO droplet is just the CyberPanel parent-domain container (its own public_html is SuiteCRM legacy + a static placeholder) — the *real* public apex orbishosting.com is a WHMCS billing portal hosted somewhere else entirely (location unknown). `orbis.orbishosting.com` is a confirmed-intentional pre-launch placeholder "sign in" page. The two subdomains that actually matter are **web.orbishosting.com** (MSP dashboard, on VM110 in the home-lab, not DO — see servers.md) and **jarvis.orbishosting.com** (JARVIS, VM211, not DO).

## ChuckCo Time Keeper (worktracking.orbishosting.com)
Work-tracking app, 5-day Fri–Thu week, flat day-rate pay, token-based access (no login for workers/payer, single shared admin password). DB `workt_track_db` / `workt_track_user` / `ZWCNMRP2N5NVPsghmve5aRS9`. Admin password `Joker1974!!!` at `/admin/login.php`.

## JARVIS (on PVE1 VM 211, NOT DO)
| Site | Path | GitHub Repo | DB |
|------|------|-------------|-----|
| jarvis.orbishosting.com | /var/www/jarvis/ on 10.48.200.211 | myronblair/jarvis | jarvis_db |
See [jarvis.md](jarvis.md) for full detail.

## web.orbishosting.com (MSP dashboard, NOT on DO)
On VM110 (NovaCPX, 10.48.200.110), `/home/webacct/public_html/index.html`, repo `myronblair/web-dashboard`, branch `main`. `web-dashboard-deploy.sh` (cron */1min on VM110) pulls when a webhook queues the path in `/tmp/web-dashboard-deploy.txt`. Currently links out to StreamHoard/Sonarr/Radarr/Prowlarr/qBittorrent/Portainer (all on CT104, 10.48.200.104) — the old Jellyfin/MediaStack links were removed 2026-07-23 when those VMs were destroyed.

## Deploy Workflow (DO sites)
```bash
# 1. Edit files on server via SSH (for quick hotfixes)
sshpass -p 'Gonewalk1974!@#' ssh -o StrictHostKeyChecking=no root@165.22.1.228 \
  'nano /home/site.com/public_html/file.php'

# 2. ALWAYS commit + push to GitHub — deploy for these 7 sites is MANUAL
cd /home/site.com && git add -A && git commit -m "message" && git push
# No webhook/cron auto-pull exists for these DO sites (unlike JARVIS/web-dashboard/StreamHoard,
# which do have auto-deploy). .git lives outside the web root at /home/<site>/git-data.
```

## GitHub PAT
Current: `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` (rotated 2026-07-05 after the previous one, `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`, was found exposed in `.git/config` on all 6 DO sites). This is also the Windows workstation's `GH_TOKEN` env var.

## Database Credentials

| DB | User | Password |
|----|------|----------|
| jarvis_db | jarvis_user | J4rv1s_Pr0t0c0l_2026! |
| toms_tjj_db | toms_tjj_user | +60wlPc+55e@gFq4 |
| epic_epic_db | epic_epic | (check config.php) |
| epic_parkersling | epic_parkersling | Joker1974!!! |
| parker_db | parker_db | (check config.php) |
| workt_track_db | workt_track_user | ZWCNMRP2N5NVPsghmve5aRS9 |
| MySQL root (DO) | root | b71e5c1a8c7457541b9c1db822de37adfa271926a38b6c20 |

## Gitignored Credentials (never in GitHub)
- `api/config.php` — JARVIS, epictravelexpeditions
- `config/database.php` — tomsjavajive
- `db.php`, `config.php` — parkerslingshot
- `includes/config.php` — chucko/worktracking (DB creds, admin password hash, site-wide token)

## Payments — status and pending migration
- **tomsjavajive.com still uses Stripe** — a live Stripe secret/publishable/webhook key was found hardcoded in `config/config.php`, moved to `/home/tomsjavajive.com/config-secrets.php` (still in git history, needs rotation via Stripe dashboard — user action, not yet done).
- **Planned future task (not started):** move tomsjavajive.com off Stripe onto **Square**, to consolidate all 3 payment-taking sites (tomsjavajive, parkerslingshotrentals, and presumably a third) onto one processor.
- **parkerslingshotrentals.com uses Square** — access token rotated 2026-07-05: `EAAAl_Cj6NVggy_-8JAFzEPcTHQMv0cY27Sy_uwJt-2AiFVq5Jz-42QzyIIMcVhY`, live in `db-secrets.php`.

## Tom's Java Jive Quirks
- No `slug` column on products — URLs use `?id=product_id`
- All tables must be `utf8mb4_unicode_ci` — mixed collation breaks JOINs (error 1267)
- `wallet_transactions.type` and `loyalty_transactions.type` have strict enums
- Admin login: `admin@tomsjavajive.com / Joker1974!!!`

## Parker Slingshot Admin
- URL: `/admin/index.php`
- Auth: HMAC-signed cookie (NOT PHP sessions — sessions unreliable under LiteSpeed caching)
- Login: `admin / Parker2026!`

## Email / SMTP
- All sites use CyberMail (CyberPersons) — current key `sk_live_df1965fc93751165d0bdd99a6eb0b46ca793ab9e44129aae` (rotated 2026-07-05, shared across tomsjavajive/parkerslingshotrentals/tomtomgames — they're all on the same CyberMail account).
- Manage at: platform.cyberpersons.com
- DO blocks SMTP port 587 — use the CyberMail API over HTTPS (port 443) instead.