ai-context/sites.md

Websites & Sites Reference Card

FusionPBX has moved to its own file — see voip.md. It is no longer on the DO server.

All Sites on DO (165.22.1.228)

Site	Path	GitHub Repo	DB
tomsjavajive.com	/home/tomsjavajive.com/public_html/	myronblair/tomsjavajive	toms_tjj_db
epictravelexpeditions.com	/home/epictravelexpeditions.com/public_html/	myronblair/epictravelexpeditions	epic_epic_db
parkerslingshot (subdomain)	/home/epictravelexpeditions.com/parkerslingshot/	myronblair/parkerslingshot	epic_parkersling
parkerslingshotrentals.com	/home/parkerslingshotrentals.com/public_html/	myronblair/parkerslingshotrentals	parker_db
tomtomgames.com	/home/tomtomgames.com/public_html/	myronblair/tomtomgames	tomt_ttg_db
worktracking.orbishosting.com	/home/worktracking.orbishosting.com/public_html/	myronblair/chucko	workt_track_db
orbishosting.com (apex)	/home/orbishosting.com/public_html/	myronblair/orbishosting	—
orbis.orbishosting.com	/home/orbis.orbishosting.com/public_html/	myronblair/orbis-hosting-portal	—

orbishosting.com (apex) and orbis.orbishosting.com are NOT the real live sites — don't audit/fix them expecting user traffic. The apex's /home/orbishosting.com on this DO droplet is just the CyberPanel parent-domain container (its own public_html is SuiteCRM legacy + a static placeholder) — the real public apex orbishosting.com is a WHMCS billing portal hosted somewhere else entirely (location unknown). orbis.orbishosting.com is a confirmed-intentional pre-launch placeholder "sign in" page. The two subdomains that actually matter are web.orbishosting.com (MSP dashboard, on VM110 in the home-lab, not DO — see servers.md) and jarvis.orbishosting.com (JARVIS, VM211, not DO).

ChuckCo Time Keeper (worktracking.orbishosting.com)

Work-tracking app, 5-day Fri–Thu week, flat day-rate pay, token-based access (no login for workers/payer, single shared admin password). DB workt_track_db / workt_track_user / ZWCNMRP2N5NVPsghmve5aRS9. Admin password Joker1974!!! at /admin/login.php.

JARVIS (on PVE1 VM 211, NOT DO)

Site	Path	GitHub Repo	DB
jarvis.orbishosting.com	/var/www/jarvis/ on 10.48.200.211	myronblair/jarvis	jarvis_db
See jarvis.md for full detail.

web.orbishosting.com (MSP dashboard, NOT on DO)

On VM110 (NovaCPX, 10.48.200.110), /home/webacct/public_html/index.html, repo myronblair/web-dashboard, branch main. web-dashboard-deploy.sh (cron */1min on VM110) pulls when a webhook queues the path in /tmp/web-dashboard-deploy.txt. Currently links out to StreamHoard/Sonarr/Radarr/Prowlarr/qBittorrent/Portainer (all on CT104, 10.48.200.104) — the old Jellyfin/MediaStack links were removed 2026-07-23 when those VMs were destroyed.

Deploy Workflow (DO sites)

# 1. Edit files on server via SSH (for quick hotfixes)
sshpass -p 'Gonewalk1974!@#' ssh -o StrictHostKeyChecking=no root@165.22.1.228 \
  'nano /home/site.com/public_html/file.php'

# 2. ALWAYS commit + push to GitHub — deploy for these 7 sites is MANUAL
cd /home/site.com && git add -A && git commit -m "message" && git push
# No webhook/cron auto-pull exists for these DO sites (unlike JARVIS/web-dashboard/StreamHoard,
# which do have auto-deploy). .git lives outside the web root at /home/<site>/git-data.

GitHub PAT

Current: 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 (rotated 2026-07-05 after the previous one, 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, was found exposed in .git/config on all 6 DO sites). This is also the Windows workstation's GH_TOKEN env var.

Database Credentials

DB	User	Password
jarvis_db	jarvis_user	J4rv1s_Pr0t0c0l_2026!
toms_tjj_db	toms_tjj_user	+60wlPc+55e@gFq4
epic_epic_db	epic_epic	(check config.php)
epic_parkersling	epic_parkersling	Joker1974!!!
parker_db	parker_db	(check config.php)
workt_track_db	workt_track_user	ZWCNMRP2N5NVPsghmve5aRS9
MySQL root (DO)	root	b71e5c1a8c7457541b9c1db822de37adfa271926a38b6c20

Gitignored Credentials (never in GitHub)

• api/config.php — JARVIS, epictravelexpeditions
• config/database.php — tomsjavajive
• db.php, config.php — parkerslingshot
• includes/config.php — chucko/worktracking (DB creds, admin password hash, site-wide token)

Payments — status and pending migration

• tomsjavajive.com still uses Stripe — a live Stripe secret/publishable/webhook key was found hardcoded in config/config.php, moved to /home/tomsjavajive.com/config-secrets.php (still in git history, needs rotation via Stripe dashboard — user action, not yet done).
• Planned future task (not started): move tomsjavajive.com off Stripe onto Square, to consolidate all 3 payment-taking sites (tomsjavajive, parkerslingshotrentals, and presumably a third) onto one processor.
• parkerslingshotrentals.com uses Square — access token rotated 2026-07-05: EAAAl_Cj6NVggy_-8JAFzEPcTHQMv0cY27Sy_uwJt-2AiFVq5Jz-42QzyIIMcVhY, live in db-secrets.php.

Tom's Java Jive Quirks

• No slug column on products — URLs use ?id=product_id
• All tables must be utf8mb4_unicode_ci — mixed collation breaks JOINs (error 1267)
• wallet_transactions.type and loyalty_transactions.type have strict enums
• Admin login: admin@tomsjavajive.com / Joker1974!!!

Parker Slingshot Admin

• URL: /admin/index.php
• Auth: HMAC-signed cookie (NOT PHP sessions — sessions unreliable under LiteSpeed caching)
• Login: admin / Parker2026!

Email / SMTP

• All sites use CyberMail (CyberPersons) — current key sk_live_df1965fc93751165d0bdd99a6eb0b46ca793ab9e44129aae (rotated 2026-07-05, shared across tomsjavajive/parkerslingshotrentals/tomtomgames — they're all on the same CyberMail account).
• Manage at: platform.cyberpersons.com
• DO blocks SMTP port 587 — use the CyberMail API over HTTPS (port 443) instead.