Server Reference Card

SSH Patterns

# DigitalOcean (websites only — JARVIS/FusionPBX no longer here)
sshpass -p 'Gonewalk1974!@#' ssh -o StrictHostKeyChecking=no root@165.22.1.228 'cmd'

# PVE1 (hop node for everything else — password auth)
sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.90 'cmd'
# also reachable via FortiGate DDNS (survives WAN IP changes, which happen often):
sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@orbisne.fortiddns.com 'cmd'

# Any VM behind PVE1 — nested hop through PVE1
sshpass -p 'Joker1974!!!' ssh root@10.48.200.90 \
  'ssh -o StrictHostKeyChecking=no root@<VM_IP> "cmd"'

# PVE2 (local only, no external port-forward)
sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.91 'cmd'

# Run a command inside an LXC container (CT) via PVE1's pct
sshpass -p 'Joker1974!!!' ssh root@10.48.200.90 'pct exec <CTID> -- bash -c "cmd"'

# Run a command inside a QEMU VM via guest agent (works even if network/SSH is down)
sshpass -p 'Joker1974!!!' ssh root@10.48.200.90 'qm guest exec <VMID> -- bash -c "cmd"'
# guest-exec has no HOME env by default — many CLI tools need: export HOME=/root; ...

# Local VMs using myron user + sudo
sshpass -p 'Joker1974!' ssh -o StrictHostKeyChecking=no myron@10.48.200.18 'sudo cmd'

# Synology NAS — needs password auth FORCED (pubkey silently preferred/fails otherwise)
sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no -o PreferredAuthentications=password \
  -o PubkeyAuthentication=no nas@10.48.200.249 'echo Joker1974!!! | sudo -S cmd'
# scp to the NAS needs the legacy flag too: scp -O ...

Password order to try if first fails: Joker1974!!! → Joker1974! → Gonewalk1974!@# (DO only).

Server Map (current)

Host	IP	User	Password	Purpose
DO	165.22.1.228	root	Gonewalk1974!@#	Websites (CyberPanel/OLS), 7 sites
PVE1	orbisne.fortiddns.com (10.48.200.90)	root	Joker1974!!!	Primary hypervisor, SSH hop for everything
PVE2	10.48.200.91	root	Joker1974!!!	Secondary hypervisor
JARVIS VM 211	10.48.200.211	root	Joker1974!!!	JARVIS AI dashboard
StreamHoard CT104	10.48.200.104	root	Joker1974!!! (via `pct exec 104`)	Consolidated media server — see streamhoard.md
NovaCPX VM120	10.48.200.110	root	Joker1974!!!	Hosting panel + web.orbishosting.com dashboard
FusionPBX VM130	10.48.200.130	root	Joker1974!!!	FreeSWITCH PBX (on-prem now, not the old DO droplet)
Ollama VM106	10.48.200.210	root	Joker1974!!!	Local LLM (llama3.1:8b, llava:7b vision), port 11434
Home Assistant	10.48.200.97	—	—	HA VM 109/101 (web terminal only)
Homebridge VM118	10.48.200.18	myron	Joker1974!	HomeKit bridge
NetworkBackup	10.48.200.99	myron	Joker1974!	PVE2 VM 302
NPM VM105	10.48.200.200	—	—	Nginx Proxy Manager (Docker), admin `myronblair@outlook.com`
Synology NAS	10.48.200.249	nas	Joker1974!!!	Media + MSP360 backup storage, DSM 7.3.2, Gitea
FortiGate	10.48.200.1	admin	Joker1974!!!	Router/firewall — admin GUI on :9443, not 443

Retired, do not use: 10.48.200.33, .35, .67, .19. .35 is squatted by an unidentified device (SSH banner OpenSSH_8.4p1, NFS shares TimeMachineBackup/Public/iTunes) — don't assume that IP is safe or known if it answers.

Proxmox API

# Accessible from anywhere via FortiGate DDNS (port 8006 forwarded)
curl -sk "https://orbisne.fortiddns.com:8006/api2/json/..." \
  -H "Authorization: PVEAPIToken=root@pam!jarvis=c45b5feb-f9a9-445d-a626-14fbb959f78b"

# Cluster API — gets VMs from BOTH PVE1 and PVE2
GET /api2/json/cluster/resources?type=vm

Key Paths on JARVIS VM (10.48.200.211)

/var/www/jarvis/              — JARVIS app root, IS the live git repo (push from it directly)
/var/www/jarvis/public_html/  — web root (index.html, api.php, admin/)
/var/www/jarvis/api/          — backend (config.php [gitignored], endpoints/, lib/)
/var/www/jarvis/deploy/       — Arc Reactor source (reactor.py)
/opt/jarvis-arc/reactor.py    — Arc Reactor daemon (copy deploy/reactor.py here + restart to deploy)
/var/backups/jarvis/          — daily backups (tar.gz, 7-day retention)
/usr/local/bin/jarvis-backup.sh — backup script
/var/www/jarvis/public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md — the master live infra doc (edit here first, gitignored, NOT in GitHub — relay-copy to VM110 through PVE1 after editing)

Key paths on StreamHoard CT104 (10.48.200.104)

See streamhoard.md for full detail.

/opt/kino/                 — docker-compose.yml, .env, app source (repo kino-app)
/opt/streamhoard-config/   — migrated radarr/sonarr/prowlarr/qbittorrent config+library
/mnt/nas/video/            — LXC mountpoint passthrough of the NAS media library (movies/tv)
/mnt/nas-backups/          — LXC mountpoint passthrough for MSP360 destination

Key Paths on DO (165.22.1.228)

/home/tomsjavajive.com/public_html/
/home/epictravelexpeditions.com/public_html/
/home/parkerslingshotrentals.com/public_html/
/home/orbishosting.com/public_html/       — NOT the real public apex site (see sites.md)
/home/orbis.orbishosting.com/public_html/
/home/tomtomgames.com/public_html/
/home/worktracking.orbishosting.com/public_html/  — ChuckCo Time Keeper (repo: chucko)

.git for all 7 sites lives OUTSIDE the web root at /home/<site>/git-data (a gitdir: pointer file sits in public_html/.git) — git commands from public_html work normally.

PHP / OLS Notes (DO server)

Run scripts: /usr/local/lsws/lsphp85/bin/lsphp /path/to/script.php
Syntax check: php8.3 -l file.php (lsphp segfaults on -l)
Web server: OpenLiteSpeed (lshttpd), NOT apache/nginx
Cron bug: */3 * * * * restarts lshttpd if any .htaccess is newer than /usr/local/lsws/cgid (a directory) — nothing re-touches that dir after restart, so editing .htaccess triggers a restart loop until you touch /usr/local/lsws/cgid manually.

GitHub / Gitea

GitHub is source of truth; Gitea (gitea.orbishosting.com, on the NAS) is a one-way, read-only mirror — never push directly to Gitea.
gh CLI at C:\Program Files\GitHub CLI\gh.exe (Windows workstation), auth via GH_TOKEN env var, PAT scopes repo+workflow (no read:org, so use GH_TOKEN directly or gh api, not gh auth login --with-token).
After any GitHub push, trigger the mirror manually: curl -X POST -u myron:Joker1974!!! https://gitea.orbishosting.com/api/v1/repos/myron/<repo>/mirror-sync
5 repos are Gitea-only by design, never push to GitHub: fortigate-config, infra-private, jarvis-secrets, msp360-config, proxmox-secrets — these hold real credentials deliberately kept off a third-party cloud host.

6.8 KiB Raw Blame History