Update infrastructure reference: fix stale JARVIS port, rotate GitHub PAT reference, add ChuckCo Time Keeper site, FortiGate DNS change, git/repo management section

public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md

@@ -1,5 +1,5 @@
 # INFRASTRUCTURE REFERENCE — COMPLETE SYSTEM MAP
-**Last Updated:** 2026-07-02  
+**Last Updated:** 2026-07-05  
 **Owner:** Myron Blair — myronblair@outlook.com
 
 ---
@@ -17,6 +17,7 @@
 10. [Backup Systems](#10-backup-systems)
 11. [SSH Quick Reference](#11-ssh-quick-reference)
 12. [Critical Credentials Master List](#12-critical-credentials-master-list)
+13. [Git & Repository Management](#13-git--repository-management)
 
 ---
 
@@ -29,7 +30,7 @@ INTERNET
 [Cloudflare CDN] ──────────────────────────────────────────────────────────────
     │ (proxied DNS for public sites)
     │
-    ├─► [DigitalOcean 165.22.1.228] — CyberPanel/OLS — All websites (6 sites)
+    ├─► [DigitalOcean 165.22.1.228] — CyberPanel/OLS — All websites (7 sites)
     │
     └─► [FusionPBX 134.209.72.226] — FreeSWITCH PBX (SSH via DO relay)
 
@@ -73,7 +74,7 @@ FortiGate Port Forwards:
 | **OS** | Ubuntu 22.04 LTS |
 | **Panel** | CyberPanel (OpenLiteSpeed) |
 | **SSH** | `ssh root@165.22.1.228` — password: `Gonewalk1974!@#` |
-| **Purpose** | All public websites (6 sites) — webhook deploy for websites |
+| **Purpose** | All public websites (7 sites) — webhook deploy for websites |
 
 **Key Paths:**
 - All sites: `/home/<domain>/public_html/`
@@ -371,14 +372,14 @@ Vision is enabled via: `/etc/systemd/system/jarvis-arc.service.d/vision.conf`
 
 All sites are at `/home/<domain>/public_html/` on DO (165.22.1.228).  
 **Auto-deploy:** Push to `main` on GitHub → webhook → server pulls in ~1 min.  
-**GitHub PAT:** `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` (expires ~2026-08-20)
+**GitHub PAT:** `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` (rotated 2026-07-05 — old PAT `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` was found exposed in `.git/config` on all 6 original sites and must be treated as compromised/revoked)
 
 ---
 
 ### jarvis.orbishosting.com — JARVIS AI Dashboard (MOVED TO PVE1 VM 211)
 | Field | Value |
 |-------|-------|
-| **URL** | http://jarvis.orbishosting.com:1972 |
+| **URL** | http://jarvis.orbishosting.com (port 80 — old `:1972` reference was wrong, corrected 2026-07-04) |
 | **Path** | `/var/www/jarvis/ (on JARVIS VM 10.48.200.211)` |
 | **GitHub** | `myronblair/jarvis` |
 | **Login** | `myron / Joker1974!!!` |
@@ -388,6 +389,22 @@ See Section 7 for full JARVIS details.
 
 ---
 
+### worktracking.orbishosting.com — ChuckCo Time Keeper
+| Field | Value |
+|-------|-------|
+| **URL** | https://worktracking.orbishosting.com |
+| **Path** | `/home/worktracking.orbishosting.com/public_html/` |
+| **GitHub** | `myronblair/chucko` (private) |
+| **Gitea** | `myron/chucko` (pull-mirror of GitHub) |
+| **Local clone** | `C:\Users\myron\repos\chucko` on admin Windows machine |
+| **Purpose** | Work-tracking app for a flat-rate 5-day (Fri–Thu) work week — self-reported hours via personal secret-URL tokens (no login), single shared admin password, phone-friendly screenshot pages for texting workers/payer |
+| **Admin URL** | `https://worktracking.orbishosting.com/admin/login.php` — password `Joker1974!!!` |
+| **DB** | `workt_track_db` / `workt_track_user` / `ZWCNMRP2N5NVPsghmve5aRS9` |
+| **Linked from Blair HQ** | `web.orbishosting.com` dashboard's "Websites" card has direct links to the admin login and the all-workers overview page (site-wide token `972f82cbf7832fdb2cffcdcc84129a4af69e30bd`) |
+| **Note** | Built 2026-07-05. `includes/config.php` (DB creds, admin password hash, site token) lives outside `public_html`/webroot and is intentionally NOT in the git repo. |
+
+---
+
 ### tomsjavajive.com — Tom's Java Jive
 | Field | Value |
 |-------|-------|
@@ -471,11 +488,11 @@ See Section 7 for full JARVIS details.
 
 ## 7. JARVIS AI SYSTEM
 
-**URL:** http://jarvis.orbishosting.com:1972  
+**URL:** http://jarvis.orbishosting.com  
 **Files:** `/var/www/jarvis/` on JARVIS VM (PVE1 VM 211 — 10.48.200.211, 8 cores, 16GB RAM)  
 **DB:** `jarvis_db` — `jarvis_user / J4rv1s_Pr0t0c0l_2026!`  
 **Login:** `myron / Joker1974!!!`  
-**Admin portal:** http://jarvis.orbishosting.com:1972/admin
+**Admin portal:** http://jarvis.orbishosting.com/admin
 
 ### Architecture (end-to-end)
 
@@ -611,6 +628,7 @@ fs_cli -x "reloadacl"                           # reload ACL (safe)
 - WAN IP: 97.154.109.245 (dynamic)
 - DDNS: `orbisne.fortiddns.com` (FortiGate auto-updates on IP change)
 - Blocks: outbound port 53 (DNS) — MediaStack uses PVE1 dnsmasq (10.48.200.90) as resolver → 100.100.100.100
+- **Upstream DNS (changed 2026-07-05):** Network → DNS set to "Specify" mode — Primary `1.1.1.1` (Cloudflare), Secondary `8.8.4.4` (Google). Previously defaulted to the router itself (`10.48.200.1`)/ISP-provided servers. Admin: `https://10.48.200.1:9443` — `admin / Joker1974!!!`. Note: `8.8.8.8` specifically showed as "Unreachable" during setup (transient — ISP's own DNS servers were also showing high latency at that moment); `1.1.1.1`/`8.8.4.4` tested healthy and are what's live now.
 
 **Port Forwards:**
 | External Port | Internal Destination | Purpose |
@@ -661,8 +679,9 @@ fs_cli -x "reloadacl"                           # reload ACL (safe)
 - **Repo:** `myronblair/fusionpbx-config`
 - **Schedule:** Weekly, Sunday 5am
 - **Launcher:** `/usr/local/bin/fusionpbx-backup`
-- **Covers:** PostgreSQL dump (gzip, ~29MB) + FreeSWITCH configs
+- **Covers:** PostgreSQL dump (gzip, ~29-60MB) + FreeSWITCH configs
 - **Restore:** 10-phase wizard in `restore.sh`
+- **Known issue (found 2026-07-05):** this repo has grown to ~166MB on GitHub / ~196MB on Gitea because the DB dump gets committed directly into git history on every backup run (3 copies in history as of this writing, each ~60MB) rather than being excluded/rotated. Options not yet decided: gitignore the dump going forward, or purge it from history with `git filter-repo` + force-push (destructive, needs explicit sign-off).
 
 ### MSP360 Backup Status (Dashboard Integration)
 - **Client software:** MSP360 (CloudBerry) Backup CLI installed on all 6 hosts — PVE1, JARVIS (211), NovaCPX (110), Jellyfin (33), MediaStack (35), Homebridge (18)
@@ -741,8 +760,9 @@ sshpass -p 'Joker1974!!!' ssh root@10.48.200.90 \
 | phpMyAdmin (DO) | https://165.22.1.228/phpmyadmin | myron | `Joker1974!!!` |
 | Proxmox PVE1 | https://orbisne.fortiddns.com:8006 | root | `Joker1974!!!` |
 | Proxmox PVE2 | https://10.48.200.91:8006 | root | `Joker1974!!!` |
-| JARVIS | http://jarvis.orbishosting.com:1972 | myron | `Joker1974!!!` |
+| JARVIS | http://jarvis.orbishosting.com | myron | `Joker1974!!!` |
-| JARVIS Admin | http://jarvis.orbishosting.com:1972/admin | myron | `Joker1974!!!` |
+| JARVIS Admin | http://jarvis.orbishosting.com/admin | myron | `Joker1974!!!` |
+| ChuckCo Time Keeper Admin | https://worktracking.orbishosting.com/admin/login.php | — | `Joker1974!!!` |
 | FusionPBX | https://fusion.orbishosting.com | admin | `fY7XP5swgtpbzrYLhkeVYkA4744` |
 | Home Assistant | http://orbisne.fortiddns.com:8123 | myron | (HA password) |
 | NovaCPX Admin | https://10.48.200.110:8882 | admin | `Admin2026!` |
@@ -764,13 +784,14 @@ sshpass -p 'Joker1974!!!' ssh root@10.48.200.90 \
 | Epic Travel | `epic_travel_db` | (see config.php) | (see config.php) |
 | Epic/Parker Slingshot | `epic_parkersling` | `epic_parkersling` | `Joker1974!!!` |
 | NovaCPX | SQLite: `/var/lib/novacpx/panel.db` | — | — |
+| ChuckCo Time Keeper | `workt_track_db` | `workt_track_user` | `ZWCNMRP2N5NVPsghmve5aRS9` |
 | FusionPBX | PostgreSQL | `fusionpbx` | `pSJaF9mUJqPr4Sj5mwJyRqvCCpc` |
 | MySQL root (DO) | — | root | `b71e5c1a8c7457541b9c1db822de37adfa271926a38b6c20` |
 
 ### API Keys
 | Service | Key |
 |---------|-----|
-| GitHub PAT | `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` (exp ~2026-08-20) |
+| GitHub PAT | `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` (rotated 2026-07-05, scopes `repo`+`workflow`) |
 | JARVIS Agent Registration | `f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518` |
 | Proxmox API Token | `root@pam!jarvis=c45b5feb-f9a9-445d-a626-14fbb959f78b` |
 | HA Long-lived Token | `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiIzNmI0N2I1Njk5ZGQ0MTQ2ODMwZWFmYjZiYTQ1MjJkMSIsImlhdCI6MTc4MDIwMzU5NCwiZXhwIjoyMDk1NTYzNTk0fQ.sYRok-jRDlA4lFgWxLQELcEjkJNGQdprk6ZziLwLtXE` |
@@ -796,4 +817,16 @@ sshpass -p 'Joker1974!!!' ssh root@10.48.200.90 \
 
 ---
 
+## 13. GIT & REPOSITORY MANAGEMENT
+
+**GitHub** (`myronblair`, 26 private repos as of 2026-07-05) is the permanent/source-of-truth storage. **Gitea** (`gitea.orbishosting.com`, hosted on the Synology NAS, login `myron / Joker1974!!!`) mirrors it one-way — GitHub → Gitea only, via pull-mirrors triggered by `POST /api/v1/repos/<owner>/<repo>/mirror-sync`. Never push directly to a Gitea remote.
+
+**5 repos are Gitea-only by design, never pushed to GitHub** (deliberately kept off a third-party cloud service since they hold real credentials): `fortigate-config`, `infra-private`, `jarvis-secrets`, `msp360-config`, `proxmox-secrets`.
+
+**Local clones** live on the admin Windows machine at `C:\Users\myron\repos\` (currently `chucko`, `web-dashboard` — more cloned there as needed). Periodic maintenance: `git gc --aggressive --prune=now` to keep loose objects packed.
+
+**Per-site deploy pattern (the 7 DO-hosted sites + jarvis + web-dashboard):** `.git` metadata is relocated outside the public webroot (e.g. `/home/<site>/git-data` with a `gitdir:` pointer file left in `public_html/.git`) so `.git` itself is never web-accessible, while `git` commands run normally from inside `public_html`. Most sites deploy via a GitHub webhook → queue file → cron puller (~1 min); `chucko` (ChuckCo Time Keeper) currently has no auto-deploy hook — pushes are manual (SSH in, `git pull`/`push` directly).
+
+**Known repo-hygiene issue:** `fusionpbx-config` bloated to ~166-196MB from repeatedly committing a large DB dump straight into history — see Section 10.
+
 *This document contains sensitive credentials. Store securely and do not share.*