# systems-prod-01 Server Profile
# Last Updated: 2026-06-25
# Updated By: jared

server:
  name: systems-prod-01
  hostname: systems-prod-01.vps.ovh.us
  provider: OVHcloud
  location: Virginia (US-EAST-VA) - USA
  region: os-us-east-va-2
  ip: 15.204.247.153
  ipv6: 2604:2dc0:101:200::c3
  gateway_ipv6: 2604:2dc0:101:200::1
  created: 2025-09-18
  status: Active
  purpose: Multi-service hosting migration from DigitalOcean for cost optimization

specs:
  model: VPS-3
  cpu: 8 vCores
  ram: 24 GB
  storage: 200 GB
  bandwidth: TBD
  os: Ubuntu 25.04
  kernel: 6.14.0-29-generic
  arch: x86_64

access:
  ssh_user: jared
  ssh_port: 22
  ssh_key: ~/.ssh/id_rsa.pub (jared@x1carbon)
  root_login: disabled
  password_auth: disabled
  auth_method: ssh_key_only
  sudo: full_access
  jump_host: N/A

security:
  firewall: ufw
  firewall_status: active
  firewall_rules:
    - "22/tcp (OpenSSH) ALLOW IN Anywhere"
    - "80/tcp ALLOW IN Anywhere"
    - "443/tcp ALLOW IN Anywhere"
    - "default: deny (incoming), allow (outgoing)"
  selinux: N/A
  fail2ban: not_configured
  ids: not_configured
  auto_updates: enabled (unattended-upgrades)

software:
  docker:
    version: 29.2.1
    compose_version: 2.39.3
    user_in_group: jared
    installed_from: official_convenience_script
    daemon_config: production_ready
    networks:
      - traefik (172.20.0.0/16) # external-facing; Traefik routes here
      - internal (172.21.0.0/16) # backend communication

  runtime:
    - traefik:v3.6 (reverse proxy)
    - apache2-utils (for htpasswd)

  system_packages:
    essential_installed: curl, git, vim, htop, iftop, iotop, ncdu, tree, jq, zip, unzip, build-essential, rsync, fail2ban
    pending_updates: 3 (held due to phasing)
    status: completed

services:
  - name: traefik
    type: reverse_proxy
    version: v3.6
    status: running
    ports: [80, 443]
    ssl: letsencrypt (HTTP-01) + cloudflare (DNS-01 for remetrics)
    dashboard: protected (see credentials.md)
    directory: /home/jared/services/traefik

monitoring:
  status: partial_coverage
  tools:
    - htop (system monitoring, manual)
    - container-health-monitor.sh (BestSolarTech-only, runs every 10 min)
    - daily-maintenance.sh (BestSolarTech-only, runs 4:30 AM EST — FIXED 2026-06-25)
    - health-check.sh (all services, on-demand via syshealth — FIXED 2026-06-25)
    - backup.sh (all services, runs 2 AM EST)
    - watchtower (opt-in only via WATCHTOWER_LABEL_ENABLE=true — FIXED 2026-06-25, runs 3 AM)
  notes:
    - syshealth now works (points to ~/services/monitoring/scripts/health-check.sh, deployed 2026-06-25)
    - Per-service auto-remediation only for BestSolarTech; health-check.sh covers detection for all
    - See docs/health-monitoring.md for full gap list
  logs: local_with_rotation
  alerts: none

backups:
  status: configured_and_active
  strategy: pg_dumpall (PostgreSQL), mysqldump (MariaDB), service-dir tar
  frequency: nightly at 02:00 EST (07:00 UTC)
  retention:
    on_server: 2 days (~/backups/current/)
    synology_nas: pulled nightly at 03:00 EST
    offsite_b2: via Synology Hyper Backup
  script: ~/services/backup.sh (auto-discovers all services in ~/services/)
  notification: ~/.local/bin/notify_backup.rb (on success)
  tested: yes (remetrics 480-user migration confirmed, 2026-06-24)

networking:
  vpc: N/A
  subnet: N/A
  private_ip: N/A
  dns: TBD
  domain: TBD
  cdn: N/A

storage:
  volumes:
    - mount: /
      size: 200 GB
      type: SSD
      purpose: System and application storage

maintenance:
  auto_updates: configured (unattended-upgrades)
  last_system_update: 2025-09-18
  last_docker_update: N/A
  reboot_required: no
  maintenance_window: TBD
  swap_configured: yes (4GB active)
  timezone: America/New_York
  ntp_sync: active (chrony)
  log_rotation: configured

cost:
  monthly: TBD
  billing: monthly
  credits_used: N/A

notes:
  - MIGRATION COMPLETE (2026-06-24): All services migrated from DigitalOcean to OVH
  - Source DigitalOcean VPS (hyperthrive-docker-services, 161.35.12.75) DELETED 2026-06-24
  - remetrics.io migrated 2026-06-24 from separate DO droplet (147.182.131.217); that droplet FROZEN as rollback (not yet deleted)
  - 21 containers running as of 2026-06-25 (see docs/services-inventory.md for full list)
  - Passwordless sudo configured for automation
  - 4GB swap file active
  - Historical phase notes (Phases 1-7 setup) moved to migrations/migration-plan.md