myron/do-server-config
1
0
Fork 0
mirror of https://github.com/myronblair/do-server-config synced 2026-06-30 09:41:06 -05:00
Code Issues Packages Projects Releases Wiki Activity

[orbis] Weekly backup 2026-06-21 — 8 files changed, 218 insertions(+), 302 deletions(-)

Browse Source
This commit is contained in:
DO Server Backup
2026-06-21 04:00:08 +00:00
parent 91852514c8
commit 8185a4fd93
8 changed files with 218 additions and 302 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cron/root_custom
+1 -1
View File
@@ -1,5 +1,5 @@
* * * * * /usr/local/bin/jarvis-deploy.sh
*/5 * * * * /usr/local/bin/jarvis-watchdog.sh
0 2 * * * /usr/local/bin/jarvis-backup.sh >> /var/backups/jarvis/backup.log 2>&1
0 2 * * * su -s /bin/bash tomto8868 -c '/usr/local/bin/ttg-backup.sh' >> /home/tomtomgames.com/backups/backup.log 2>&1
0 4 * * 0 /usr/local/bin/do-server-backup >> /var/log/do-server-backup.log 2>&1
* * * * * /usr/local/bin/jarvis-deploy.sh
cron/root_full
+1 -4
View File
@@ -22,11 +22,8 @@
* * * * * /usr/local/CyberCP/bin/python /usr/local/CyberCP/manage.py run_scheduled_scans >/usr/local/lscp/logs/scheduled_scans.log 2>&1
*/5 * * * * /usr/local/CyberCP/bin/python /usr/local/CyberCP/plogical/pdnsHealthCheck.py >/dev/null 2>&1
*/3 * * * * /usr/local/lsws/lsphp85/bin/lsphp /home/jarvis.orbishosting.com/api/endpoints/facts_collector.php >> /home/jarvis.orbishosting.com/logs/cron.log 2>&1
*/5 * * * * /usr/local/lsws/lsphp85/bin/lsphp /home/jarvis.orbishosting.com/api/endpoints/stats_cache.php >> /home/jarvis.orbishosting.com/logs/cron.log 2>&1
* * * * * /usr/local/bin/jarvis-deploy.sh
*/5 * * * * /usr/local/bin/jarvis-watchdog.sh
0 2 * * * /usr/local/bin/jarvis-backup.sh >> /var/backups/jarvis/backup.log 2>&1
*/15 * * * * /usr/local/lsws/lsphp85/bin/lsphp /home/jarvis.orbishosting.com/api/endpoints/calendar_sync.php >> /home/jarvis.orbishosting.com/logs/cron.log 2>&1
0 2 * * * su -s /bin/bash tomto8868 -c '/usr/local/bin/ttg-backup.sh' >> /home/tomtomgames.com/backups/backup.log 2>&1
0 4 * * 0 /usr/local/bin/do-server-backup >> /var/log/do-server-backup.log 2>&1
* * * * * /usr/local/bin/jarvis-deploy.sh
infra/CLAUDE.md
+139 -23
View File
@@ -6,18 +6,44 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
This is a home-lab / managed-hosting environment. There is no local codebase to build or test — work consists of editing PHP/JS files on remote servers via SSH and managing infrastructure across several machines. All tool calls use `sshpass` with password auth.
## Tailscale Network
All key hosts are on Tailscale (myronblair@gmail.com). Use Tailscale IPs for SSH — no relay or port forwarding needed.
| Host | Tailscale IP | LAN IP | Password |
|------|-------------|--------|----------|
| Claude VM (this) | 100.69.120.58 | 10.48.200.29 | — |
| PVE1 | 100.80.188.8 | 10.48.200.90 | `Joker1974!!!` |
| PVE2 | 100.87.186.12 | 10.48.200.91 | `Joker1974!!!` |
| DO server (orbis) | 100.121.13.34 | 165.22.1.228 | `Gonewalk1974!@#` |
| FusionPBX | 100.74.46.120 | 134.209.72.226 | `Joker1974!@#` |
| JARVIS VM | 100.77.178.42 | 10.48.200.211 | `Joker1974!!!` |
| NPM VM | 100.110.239.71 | 10.48.200.201 | `Joker1974!!!` |
| Ollama VM | 100.96.100.113 | 10.48.200.210 | `Joker1974!!!` |
| NovaCPX (hostpanel-110) | 100.86.51.18 | 10.48.200.110 | `Joker1974!!!` |
| HomeBridge | 100.124.182.18 | 10.48.200.18 | — |
| WireGuard CT | 100.122.55.10 | 10.48.200.19 | — |
| Synology NAS | 100.118.175.5 | 10.48.200.249 | — |
| mini-it12 (Windows) | 100.98.151.120 | 10.48.200.87 | — |
**DNS note:** FortiGate blocks outbound port 53. All PVE1 VMs must use `10.48.200.90` (PVE1 dnsmasq → 100.100.100.100) as their DNS server, not 8.8.8.8 directly.
## Server Map
| Host | IP | SSH | Purpose |
|------|-----|-----|---------|
| DO (main) | 165.22.1.228 | `root / Gonewalk1974!@#` | CyberPanel/OLS — all websites + JARVIS |
| FusionPBX | 134.209.72.226 | `root / Joker1974!@#` | FreeSWITCH PBX |
| PVE1 (Proxmox) | orbisne.fortiddns.com (10.48.200.90) | `root / Joker1974!!!` | Primary hypervisor — FortiGate DDNS, auto-updates if IP changes |
| DO (main) | 165.22.1.228 | `root / Gonewalk1974!@#` | CyberPanel/OLS — all websites (not JARVIS after migration) |
| FusionPBX | 134.209.72.226 | `root / Joker1974!@#` (via Tailscale 100.74.46.120) | FreeSWITCH PBX |
| PVE1 (Proxmox) | orbisne.fortiddns.com (10.48.200.90) | `root / Joker1974!!!` (via Tailscale 100.80.188.8) | Primary hypervisor |
| PVE2 (Proxmox) | 10.48.200.91 | `root / Joker1974!!!` | Secondary hypervisor |
| Ollama VM | 10.48.200.95 | `myron → sudo` | llama3.2 local LLM (PVE1 VM 210) |
| JARVIS VM | 10.48.200.211 | `root / Joker1974!!!` (via Tailscale 100.77.178.42) | JARVIS dashboard — PVE1 VM 211, 8c/16GB |
| NPM VM | 10.48.200.201 | `root / Joker1974!!!` (via Tailscale 100.110.239.71) | Nginx Proxy Manager — PVE1 VM 200 (LAN IP .201 despite VM ID 200) |
| Ollama VM | 10.48.200.210 | `root / Joker1974!!!` (via Tailscale 100.96.100.113) | Local LLM — PVE1 VM 210, 4c/8GB |
| Home Assistant | 10.48.200.97 | `myron → sudo` | HA VM 101 |
| NetworkBackup | 10.48.200.99 | `myron → sudo` | Backup VM (PVE2 VM 302) |
| MediaStack | 10.48.200.35 | `root via PVE1 key` | Sonarr/Radarr/Prowlarr/qBittorrent (PVE1 VM 113) |
| NovaCPX | 10.48.200.110 | `root / Joker1974!!!` (direct SSH — Tailscale 100.86.51.18 needs re-auth) | Custom hosting control panel (PVE1 VM 120) |
| NPM | 10.48.200.201 | `root / Joker1974!!!` (via Tailscale 100.110.239.71) | Nginx Proxy Manager — PVE1 VM 200 · NPM API: `POST http://localhost:81/api/tokens` identity=myronblair@outlook.com |
**SSH password order** (try in sequence if first fails): `Joker1974!@#` → `Joker1974!!!` → `Joker1974!`
@@ -34,7 +60,7 @@ sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@orbisne.fortiddns
For commands inside VMs on PVE1:
```bash
sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@orbisne.fortiddns.com \
'qm guest exec 210 -- bash -c "commands here"'
'qm guest exec <VMID> -- bash -c "commands here"'
```
## Websites on DO (165.22.1.228)
@@ -43,7 +69,7 @@ All sites live at `/home/<domain>/public_html/` on DO. CyberPanel/OpenLiteSpeed
| Site | Path | GitHub |
|------|------|--------|
| jarvis.orbishosting.com | /home/jarvis.orbishosting.com/ | myronblair/jarvis |
| ~~jarvis.orbishosting.com~~ | ~~removed from DO~~ | myronblair/jarvis (now on PVE1 VM 211) |
| tomsjavajive.com | /home/tomsjavajive.com/public_html/ | myronblair/tomsjavajive |
| epictravelexpeditions.com | /home/epictravelexpeditions.com/public_html/ | myronblair/epictravelexpeditions |
| parkerslingshotrentals.com | /home/parkerslingshotrentals.com/public_html/ | myronblair/parkerslingshotrentals |
@@ -61,12 +87,18 @@ All sites live at `/home/<domain>/public_html/` on DO. CyberPanel/OpenLiteSpeed
**Auto-deploy is active.** Push to `main` on any site repo → GitHub webhook → server pulls automatically within 1 minute. PHP syntax is validated before deploy; bad commits are auto-reverted.
Webhook handler: `https://jarvis.orbishosting.com/webhook.php` (HMAC secret: `4c8805f0285214ff0a0602b5880270b935f36a896946c7f1`)
Deploy queue: `/tmp/jarvis-deploy-queue.txt` | Runner: `/usr/local/bin/jarvis-deploy.sh` (cron every min)
Deploy log: `/home/jarvis.orbishosting.com/logs/deploy.log`
**Two separate webhook handlers:**
- **JARVIS repo** → `http://jarvis.orbishosting.com:1972/webhook.php` — deploys to JARVIS VM (`/var/www/jarvis/`). Deploy log: `/var/www/jarvis/logs/deploy.log`
- **All 6 website repos → `https://tomtomgames.com/webhook.php` on DO — deploys to `/home/<site>/public_html/` on DO. Deploy log: `/home/tomtomgames.com/logs/deploy.log`. Deploy log: `/home/<site>/logs/deploy.log`
HMAC secret (both handlers): `4c8805f0285214ff0a0602b5880270b935f36a896946c7f1`
Deploy queue: `/tmp/jarvis-deploy-queue.txt` | Runner: `/usr/local/bin/jarvis-deploy.sh` (cron every min, on both DO and JARVIS VM)
For hotfixes that can't wait 1 min, SCP directly:
```bash
# JARVIS VM
scp -o StrictHostKeyChecking=no /tmp/changed.php root@100.77.178.42:/var/www/jarvis/public_html/changed.php
# DO websites
sshpass -p 'Gonewalk1974!@#' scp -o StrictHostKeyChecking=no /tmp/changed.php \
root@165.22.1.228:/home/site.com/public_html/changed.php
```
@@ -80,18 +112,33 @@ Gitignored credentials (never in GitHub): `api/config.php` (JARVIS, epictravelex
## JARVIS System
Iron Man-style AI dashboard at `https://jarvis.orbishosting.com`. All files on DO at `/home/jarvis.orbishosting.com/`.
Iron Man-style AI dashboard at `http://jarvis.orbishosting.com:1972`. **Migrated from DO to PVE1 VM 211 (2026-06-18).** All files on JARVIS VM at `/var/www/jarvis/`.
**Access:**
- Dashboard: `http://jarvis.orbishosting.com:1972`
- Admin: `http://jarvis.orbishosting.com:1972/admin`
- Internal (LAN): `http://10.48.200.211` or via Tailscale `http://100.77.178.42`
- FortiGate VIP: external port `1972` → `10.48.200.211:80`
- Cloudflare: DNS only (grey cloud) — no CF proxy, no SSL overhead on origin
**Stack on JARVIS VM:**
- nginx + PHP 8.3-FPM (replaces OLS/lsphp on DO)
- MariaDB (jarvis_db local, `jarvis_user / J4rv1s_Pr0t0c0l_2026!`)
- Redis (`redis-server`)
- Python 3 + Arc Reactor daemon
**Architecture:**
- `public_html/api.php` — API router; has `session_write_close()` guard (must skip for `auth` endpoint to prevent LSAPI session deadlock)
- `public_html/api.php` — API router; `session_start()` skipped only for machine-agent sub-actions (heartbeat/metrics/ha_state/command_result/register); browser-facing agent routes (list/status/myip) need session. Has `session_write_close()` guard (must skip for `auth` endpoint to prevent LSAPI session deadlock).
- `api/config.php` — all credentials/constants (gitignored)
- `api/endpoints/chat.php` — 4-tier AI: KB intent → Ollama (10.48.200.95:11434) → Groq (`compound-beta-mini`) → Claude API; includes Tier 0.7 planner intents (tasks/appointments/briefing)
- `api/endpoints/agent.php` — push-based agent registration/heartbeat/metrics
- `api/endpoints/chat.php` — 4-tier AI: KB intent → Groq (`compound-beta-mini`) → Claude API; includes Tier 0.7 planner intents (tasks/appointments/briefing). Ollama at `http://10.48.200.210:11434`.
- `api/endpoints/agent.php` — push-based agent registration/heartbeat/metrics; browser actions (list/status/myip) auth via `$_SESSION`, machine actions auth via `X-Agent-Key` header
- `api/endpoints/alerts.php` — auto-generates alerts (CPU >85%, RAM >85%, disk >88%, offline agents, site down); dispatches restart commands to agents when their services fail
- `api/endpoints/facts_collector.php` — runs every 3 min via cron; collects agent metrics, KB facts, Proxmox/HA/Ollama status, and all 7 site HTTP health checks
- `api/endpoints/stats_cache.php` — runs every 5 min via cron; weather/news/Proxmox cache refresh
- `api/endpoints/facts_collector.php` — runs every 3 min via cron (php8.3); collects agent metrics, KB facts, Proxmox/HA status, and all 7 site HTTP health checks. Site checks use external URLs (JARVIS VM is NOT the web host). `$fresh()` queries `WHERE category=?` (not `fact_category`).
- `api/endpoints/stats_cache.php` — runs every 5 min via cron; weather/news/Proxmox cache refresh. Proxmox API at `https://10.48.200.90:8006` (direct LAN).
- `api/endpoints/do_server.php` — reads `/proc` for JARVIS VM stats; also includes DO server agent metrics (`do_server` key from jarvis-do agent via Tailscale).
- `api/endpoints/planner.php` — tasks & appointments CRUD; routes: `planner/tasks`, `planner/appointments`, `planner/today`, `planner/done`
- `api/endpoints/ha.php` — HA entity list reads from `ha_entities` table (real-time agent push); service calls go direct to HA_URL (`http://orbisne.fortiddns.com:8123`)
- `api/endpoints/ha.php` — HA entity list reads from `ha_entities` table (real-time agent push); service calls go direct to HA_URL (`http://10.48.200.97:8123`)
- `api/lib/kb_engine.php` — `storeFact()` ON DUPLICATE KEY UPDATE always sets `updated_at=NOW()` explicitly; without this, unchanged values don't bump the timestamp and freshness checks break.
**Voice system (index.html):**
- Continuous SpeechRecognition; mic stays open always (mute toggle button)
@@ -107,14 +154,34 @@ Iron Man-style AI dashboard at `https://jarvis.orbishosting.com`. All files on D
- Home page: small top-bar badge "N TASKS · N APPTS" when items due today (no panel added)
- Admin CRUD at `/admin` under PLANNER section → TASKS and APPOINTMENTS tabs
**Agent system:** Agents phone home every 10s (heartbeat) / 30s (metrics) to `https://165.22.1.228` with `Host: jarvis.orbishosting.com` header (bypasses Cloudflare). Config at `/opt/jarvis-agent/config.json` on each Linux agent.
Agent installer (one-liner for any Linux host): `curl -sk https://jarvis.orbishosting.com/install-agent.sh | bash -s <hostname> <linux|homeassistant|proxmox>`
**Agent system:** Agents phone home every 10s (heartbeat) / 30s (metrics) to `http://10.48.200.211` (direct LAN — no Cloudflare). Config at `/etc/jarvis-agent/config.json` or `/opt/jarvis-agent/config.json` on each Linux agent.
Agent installer (one-liner for any Linux host): `curl -sk http://10.48.200.211/install-agent.sh | bash -s <hostname> <linux|homeassistant|proxmox>`
DO server agent (jarvis-do) uses Tailscale: `jarvis_url: http://100.77.178.42`
**Self-healing:** `/usr/local/bin/jarvis-watchdog.sh` runs every 5 min (root cron). Restarts lsws/mysql/redis if down, restarts offline Proxmox VM agents via `qm guest exec`, inserts alerts to DB, rotates logs.
Watchdog log: `/home/jarvis.orbishosting.com/logs/watchdog.log`
**Agent file paths by host** (for manual updates — push to correct path then restart service):
- Most Linux hosts: `/opt/jarvis-agent/jarvis-agent.py` · service: `systemctl restart jarvis-agent`
- WireGuard CT (10.48.200.19, Alpine): `/opt/jarvis-agent/agent.py` · service: `rc-service jarvis-agent restart`
- `public_html/agent/jarvis-agent.py` is the self-update URL — must be kept in sync with `agent/jarvis-agent.py` (both are tracked in git; auto-deploy keeps them in sync after 2026-06-17)
**JARVIS DB:** `jarvis_db` on localhost. User: `jarvis_user / J4rv1s_Pr0t0c0l_2026!`. phpMyAdmin at `/phpmyadmin` (myron / Joker1974!!!).
Tables (18 total): agent_commands, agent_metrics, alerts, api_cache, appointments, conversations, ha_entities, kb_facts, kb_intents, kb_ollama_models, kb_preferences, known_commands, metrics_history, network_devices, registered_agents, tasks, users + (see schema for full column list)
**Self-healing:** `/usr/local/bin/jarvis-watchdog.sh` runs every 5 min (root cron on DO). Restarts lsws/mysql/redis on DO if down. Log: `/usr/local/lsws/logs/watchdog.log` on DO.
**JARVIS DB:** `jarvis_db` on JARVIS VM localhost (MariaDB). User: `jarvis_user / J4rv1s_Pr0t0c0l_2026!`. phpMyAdmin at `/phpmyadmin` on JARVIS VM (myron / Joker1974!!!).
Core tables: agent_commands, agent_metrics, alerts, api_cache, appointments, conversations, ha_entities, kb_facts, kb_intents, kb_ollama_models, kb_preferences, known_commands, metrics_history, network_devices, registered_agents, tasks, users. Arc Reactor adds: arc_jobs, guardian_events, guardian_config, agent_screenshots.
`kb_facts` schema: `(id, category, fact_key, fact_value, host, expires_at, updated_at)` — column is `category` not `fact_category`.
**Arc Reactor daemon:** Python service at `/opt/jarvis-arc/reactor.py` on JARVIS VM, port 7474, managed by `systemctl restart jarvis-arc`. Deploy source: `deploy/reactor.py` in the jarvis repo. After pushing to GitHub, auto-deploy pulls to `/var/www/jarvis/deploy/reactor.py` — then manually `cp /var/www/jarvis/deploy/reactor.py /opt/jarvis-arc/reactor.py && systemctl restart jarvis-arc`. Log: `/var/www/jarvis/logs/arc_reactor.log`.
**Arc Reactor AI routing:**
| Feature | Provider | Model |
|---------|----------|-------|
| Guardian anomaly alerts | Groq | `llama-3.3-70b-versatile` |
| SITREP | Groq | `llama-3.3-70b-versatile` |
| Vision: text-only sysinfo snapshot | Groq | `llama-3.3-70b-versatile` |
| Vision: actual screenshot image | Claude | `claude-opus-4-8-20251101` |
| Email drafting, research, tool_loop | Claude | `claude-sonnet-4-6` |
`llm_call(messages, provider)` cascades: groq → ollama on failure. Pass `"groq"` or `"claude"` as provider.
**Groq API note:** Use model name `compound-beta-mini` directly — NOT `groq/compound-beta-mini` (that's OpenAI router syntax and will 404 on api.groq.com).
@@ -147,6 +214,35 @@ Automated media server on PVE1 VM 113. All traffic routes through WireGuard VPN
**GitHub:** `myronblair/mediastack` (private) — config files, systemd units, README with full setup notes.
**JARVIS agent quirks:** needs `jarvis_url`, `registration_key` (`f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518`), `ssl_verify: false` in config.
## NovaCPX Panel
Custom web hosting control panel (PVE1 VM 120, 10.48.200.110). Root SSH: `sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.110` (direct LAN — use this, Tailscale 100.86.51.18 requires re-auth periodically).
**Public URLs (via NPM → FortiGate VIP port 443 → 10.48.200.201):**
- Admin: `https://admin.novacpx.orbishosting.com` (→ port 8882) · `admin / Admin2026!` or `myron / Joker1974!!!`
- Reseller: `https://reseller.novacpx.orbishosting.com` (→ port 8881)
- User: `https://panel.novacpx.orbishosting.com` or `https://novacpx.orbishosting.com` (→ port 8880)
- Webmail: port 8883 (Roundcube) — no public NPM proxy yet
- `https://web.orbishosting.com` → port 80 (placeholder for a new hosted website)
**Ports:** 8880 (user) · 8881 (reseller) · 8882 (admin) · 8883 (Roundcube webmail)
**Paths:** Panel web root `/srv/novacpx/public/` · Git repo `/opt/novacpx-src/` · DB `/var/lib/novacpx/panel.db` (SQLite) · Config `/etc/novacpx/config.ini`
**Config notes:** `/etc/novacpx/config.ini` must have `server = nginx` (not apache) — VhostManager checks this to write the correct vhost format.
**GitHub:** `myronblair/novacpx` (private). Auto-deploy active: push to `main` (stable) or `beta` → webhook → VM pulls. GitHub Actions auto-bumps VERSION: main→PATCH, beta→-beta.N suffix. Current version: 1.0.40.
**Update channels:** `stable` tracks `origin/main`, `beta` tracks `origin/beta`. Set in Admin → Settings → Update Channel.
**Local clone:** `/tmp/novacpx/` on this machine. All edits go here first, then `git push origin main`. The deploy runner syncs `panel/` → `/srv/novacpx/public/` and `panel/lib/` → `/srv/novacpx/public/lib/`. For immediate changes use SCP to `root@10.48.200.110:/srv/novacpx/public/`.
**PHP-FPM:** Per-account pools in `/etc/php/8.3/fpm/pool.d/`. If php8.3-fpm fails to start, check for orphaned pool configs referencing deleted Linux users — remove them and `systemctl start php8.3-fpm`.
**JARVIS agent:** Installed, online. Agent ID: `novacpx_e3b07264`.
**SQLite quirk:** Never use MySQL syntax (ON DUPLICATE KEY, NOW(), DATE_ADD, etc.). DB.php has translate() layer but endpoints must also use SQLite syntax directly.
## Parker Slingshot Rentals
Admin portal at `/admin/index.php` uses HMAC-signed cookie auth (not PHP sessions — sessions were unreliable under LiteSpeed caching). Admin: `admin / Parker2026!`. DB: `epic_parkersling / epic_parkersling / Joker1974!!!`.
@@ -155,7 +251,11 @@ Admin portal at `/admin/index.php` uses HMAC-signed cookie auth (not PHP session
Production at 134.209.72.226. Web: `https://fusion.orbishosting.com` (admin / fY7XP5swgtpbzrYLhkeVYkA4744). SIP profiles served via Lua XML handler — config changes require deleting `/var/cache/fusionpbx/FusionPBX.configuration.sofia.conf` to force reload. Extension 1000 (Yealink T48S at 10.48.200.43) registered on production server via port 5080 with `aggressive-nat-detection=true` to bypass FortiGate SIP ALG.
**SSH access:** Port 22 firewalled from internet — only from 107.178.2.130 / 97.154.109.245. Relay all SSH through DO:
**SSH access:** Direct via Tailscale (preferred):
```bash
sshpass -p 'Joker1974!@#' ssh -o StrictHostKeyChecking=no root@100.74.46.120
```
Fallback if Tailscale down — relay through DO:
```bash
sshpass -p 'Gonewalk1974!@#' ssh -o StrictHostKeyChecking=no root@165.22.1.228 \
'sshpass -p "Joker1974!@#" ssh -o StrictHostKeyChecking=no root@134.209.72.226 "command"'
@@ -182,6 +282,20 @@ CyberPanel uses `lsphp85`. Run PHP scripts directly with:
For PHP syntax checking use `php8.3 -l file.php` — lsphp segfaults on `-l` flag.
When a PHP endpoint uses `ob_start()` + `header.php` pattern, add `ob_end_clean()` before any CSV/JSON response output.
**Cloudflare Rocket Loader:** JARVIS uses `data-cfasync="false"` on every `<script>` tag in `index.html` (including CDN scripts like face-api.js). One untagged script is enough to trigger Rocket Loader's bootstrap, which injects `mainScript.js` and causes `SyntaxError: Identifier 'mainScriptFlag' has already been declared`. `Cache-Control: no-store, no-cache, must-revalidate, no-transform` is set in `index.php` but tag every new script with `data-cfasync="false"` anyway.
**Cloudflare auto-deploy cache problem:** After pushing JS fixes, Cloudflare CDN serves stale cached files even on hard refresh. Bump the `?v=YYYYMMDD` query param on script tags in `index.html` to force a cache miss. Current version param: `?v=20260617b`.
**JS file structure (as of 2026-06-17):**
- `assets/js/jarvis-effects.js` — canvas particle effects, sparklines
- `assets/js/jarvis-overlays.js` — sleep overlay, network map canvas
- `assets/js/jarvis-app.js` — globals, init, chat, voice, system/network/HA/alerts/weather panels
- `assets/js/panels/jarvis-arc.js` — Arc Reactor, Intel Protocol, Comms Protocol, Guardian Mode
- `assets/js/panels/jarvis-agents.js` — Missions, Directives, Memory, Clearance, Agents tab, Sites, Vision Protocol
- `assets/js/panels/jarvis-assistant.js` — Chat History, Command Palette, Suggestions, Mobile switcher, Topology map
A SyntaxError in any panels/ file breaks only that group — other panels stay functional. `escHtml()` is defined in jarvis-arc.js (loads first) and is global to all subsequent files.
## GitHub Repos
| Repo | Site | DB Schema |
@@ -198,6 +312,8 @@ When a PHP endpoint uses `ob_start()` + `header.php` pattern, add `ob_end_clean(
| myronblair/mediastack | MediaStack VM 113 | config/, systemd units, wg0.conf, README |
| myronblair/do-server-config | DO server backup | scripts, systemd, WG, OLS vhosts, restore.sh |
| myronblair/proxmox-config | PVE1+PVE2 backup | shared cluster configs + per-node, restore.sh |
| myronblair/novacpx | admin.novacpx.orbishosting.com | db/schema.sql (SQLite, 19+ tables) |
| myronblair/web-dashboard | web.orbishosting.com | — |
| myronblair/fusionpbx-config | FusionPBX backup | PostgreSQL dump (gzip) + FS configs, restore.sh |
All repos are private. Each has `config/vhost/` with OLS vhost config. The jarvis repo also has `deploy/` (watchdog, deploy runner, systemd units) and `agent/jarvis-agent.py`.
ols-vhosts/httpd_vhosts_summary.txt
-12
View File
@@ -3,8 +3,6 @@ virtualHost Example{
vhRoot Example/
configFile conf/vhosts/Example/vhconf.conf
listener Default{
map mail.jarvis.orbishosting.com mail.jarvis.orbishosting.com
map jarvis.orbishosting.com jarvis.orbishosting.com
map orbis.orbishosting.com orbis.orbishosting.com
map mail.parkerslingshotrentals.com mail.parkerslingshotrentals.com
map parkerslingshotrentals.com parkerslingshotrentals.com
@@ -23,8 +21,6 @@ virtualHost tomtomgames.com {
vhRoot /home/$VH_NAME
configFile $SERVER_ROOT/conf/vhosts/$VH_NAME/vhost.conf
listener SSL {
map mail.jarvis.orbishosting.com mail.jarvis.orbishosting.com
map jarvis.orbishosting.com jarvis.orbishosting.com
map mail.tomtomgames.com mail.tomtomgames.com
map orbis.orbishosting.com orbis.orbishosting.com
map mail.parkerslingshotrentals.com mail.parkerslingshotrentals.com
@@ -41,8 +37,6 @@ virtualHost mail.tomtomgames.com {
vhRoot /home/tomtomgames.com
configFile $SERVER_ROOT/conf/vhosts/$VH_NAME/vhost.conf
listener SSL IPv6 {
map mail.jarvis.orbishosting.com mail.jarvis.orbishosting.com
map jarvis.orbishosting.com jarvis.orbishosting.com
map mail.tomtomgames.com mail.tomtomgames.com
map orbis.orbishosting.com orbis.orbishosting.com
map mail.parkerslingshotrentals.com mail.parkerslingshotrentals.com
@@ -82,9 +76,3 @@ virtualHost mail.parkerslingshotrentals.com {
virtualHost orbis.orbishosting.com {
vhRoot /home/$VH_NAME
configFile $SERVER_ROOT/conf/vhosts/$VH_NAME/vhost.conf
virtualHost jarvis.orbishosting.com {
vhRoot /home/$VH_NAME
configFile $SERVER_ROOT/conf/vhosts/$VH_NAME/vhost.conf
virtualHost mail.jarvis.orbishosting.com {
vhRoot /home/jarvis.orbishosting.com
configFile $SERVER_ROOT/conf/vhosts/$VH_NAME/vhost.conf
ols-vhosts/site-list.txt
+3 -4
View File
@@ -1,9 +1,8 @@
# Websites on DO server — 2026-06-15
# Websites on DO server — 2026-06-21
- epictravelexpeditions.com (5.4M)
- jarvis.orbishosting.com (764K)
- orbishosting.com (114M)
- orbis.orbishosting.com (312K)
- parkerslingshotrentals.com (1.6M)
- tomsjavajive.com (7.6M)
- tomtomgames.com (4.3M)
- tomsjavajive.com (8.0M)
- tomtomgames.com (4.4M)
scripts/jarvis-agent.py
+72 -255
View File
@@ -23,16 +23,50 @@ from pathlib import Path
CONFIG_PATH = "/etc/jarvis-agent/config.json"
STATE_PATH = "/var/lib/jarvis-agent/state.json"
AGENT_VERSION = "3.0" # Phase 4: screenshot + sysinfo commands
AGENT_VERSION = "3.1"
# ── Config helpers ────────────────────────────────────────────────────────────
def load_config() -> dict:
legacy_path = "/opt/jarvis-agent/config.json"
if not os.path.exists(CONFIG_PATH):
print(f"[ERROR] Config not found at {CONFIG_PATH}. Run the installer first.", flush=True)
sys.exit(1)
with open(CONFIG_PATH) as f:
return json.load(f)
if os.path.exists(legacy_path):
print(f"[JARVIS] Config found at legacy path {legacy_path} - migrating...", flush=True)
Path(CONFIG_PATH).parent.mkdir(parents=True, exist_ok=True)
with open(legacy_path) as f:
cfg = json.load(f)
else:
print(f"[ERROR] Config not found at {CONFIG_PATH}. Run the installer first.", flush=True)
sys.exit(1)
else:
with open(CONFIG_PATH) as f:
cfg = json.load(f)
# Migrate old key names so the agent self-heals instead of crash-looping
import re as _re
changed = False
if "server_url" in cfg and "jarvis_url" not in cfg:
cfg["jarvis_url"] = cfg.pop("server_url")
print("[JARVIS] Config migrated: server_url -> jarvis_url", flush=True)
changed = True
if "api_key" in cfg and "registration_key" not in cfg:
cfg["registration_key"] = cfg.pop("api_key")
print("[JARVIS] Config migrated: api_key -> registration_key", flush=True)
changed = True
if "hostname" not in cfg:
cfg["hostname"] = socket.gethostname()
changed = True
if "ssl_verify" not in cfg:
cfg["ssl_verify"] = not bool(_re.match(r"https?://\d+\.\d+\.\d+\.\d+", cfg.get("jarvis_url", "")))
changed = True
if changed:
with open(CONFIG_PATH, "w") as f:
json.dump(cfg, f, indent=2)
print("[JARVIS] Config saved after migration.", flush=True)
return cfg
def load_state() -> dict:
if os.path.exists(STATE_PATH):
@@ -119,12 +153,6 @@ def detect_capabilities(cfg: dict) -> list:
# Check for Home Assistant
if os.path.exists("/etc/homeassistant") or os.path.exists("/config/configuration.yaml"):
caps.append("homeassistant")
# Phase 4: screenshot capability
import shutil as _shutil
if (_shutil.which("scrot") or _shutil.which("import") or
_shutil.which("fbcat") or _shutil.which("convert")):
caps.append("screenshot")
caps.append("sysinfo")
return caps
def register(cfg: dict, state: dict) -> str:
@@ -142,6 +170,7 @@ def register(cfg: dict, state: dict) -> str:
f"{cfg['jarvis_url']}/api/agent/register",
{
"hostname": hostname,
"version": AGENT_VERSION,
"agent_type": agent_type,
"ip_address": ip,
"capabilities": capabilities,
@@ -270,11 +299,23 @@ def get_load() -> list:
except Exception:
return [0, 0, 0]
def get_nordvpn_status() -> dict | None:
"""Check nordlynx WireGuard interface. Returns None if nordlynx not present on this host."""
try:
r = subprocess.run(["ip", "link", "show", "nordlynx"],
capture_output=True, text=True, timeout=3)
if r.returncode != 0:
return None
active = "UP,LOWER_UP" in r.stdout or "state UP" in r.stdout
return {"active": active, "interface": "nordlynx"}
except Exception:
return None
def collect_metrics(cfg: dict) -> dict:
# First reading for CPU delta
get_cpu_percent()
time.sleep(1)
return {
metrics = {
"hostname": cfg.get("hostname", socket.gethostname()),
"cpu_percent": get_cpu_percent(),
"memory": get_memory(),
@@ -285,6 +326,10 @@ def collect_metrics(cfg: dict) -> dict:
"platform": platform.system(),
"timestamp": datetime.utcnow().isoformat() + "Z",
}
nordvpn = get_nordvpn_status()
if nordvpn is not None:
metrics["nordvpn"] = nordvpn
return metrics
# ── Proxmox metrics ───────────────────────────────────────────────────────────
@@ -304,198 +349,6 @@ def collect_proxmox_metrics(cfg: dict) -> dict | None:
except Exception as e:
return {"error": str(e)}
# ── Screenshot / Vision helpers ───────────────────────────────────────────────
def _take_screenshot(cmd_data: dict) -> dict:
"""
Attempts to capture a screenshot using available tools.
For headless servers, falls back to a rich text system snapshot.
Returns base64-encoded PNG and metadata.
"""
import base64, tempfile, shutil
tmp = tempfile.mktemp(suffix=".png")
width = height = 0
method = "unknown"
# 1. Try scrot (X11 desktop)
if shutil.which("scrot") and os.environ.get("DISPLAY"):
try:
r = subprocess.run(["scrot", "-z", tmp], capture_output=True, timeout=10)
if r.returncode == 0 and os.path.exists(tmp):
method = "scrot"
except Exception:
pass
# 2. Try import (ImageMagick X11)
if method == "unknown" and shutil.which("import") and os.environ.get("DISPLAY"):
try:
r = subprocess.run(["import", "-window", "root", tmp], capture_output=True, timeout=10)
if r.returncode == 0 and os.path.exists(tmp):
method = "import"
except Exception:
pass
# 3. Try fbcat (Linux framebuffer — headless VMs with framebuffer)
if method == "unknown" and shutil.which("fbcat") and os.path.exists("/dev/fb0"):
try:
ppm = tempfile.mktemp(suffix=".ppm")
r = subprocess.run(["fbcat", "-s", "/dev/fb0"], stdout=open(ppm, "wb"),
stderr=subprocess.PIPE, timeout=10)
if r.returncode == 0 and shutil.which("convert"):
subprocess.run(["convert", ppm, tmp], capture_output=True, timeout=10)
os.unlink(ppm)
if os.path.exists(tmp):
method = "framebuffer"
except Exception:
pass
# 4. Headless fallback: build a PNG system dashboard from text stats
if method == "unknown":
try:
result = _render_sysinfo_png(tmp)
if result:
method = "sysinfo_render"
except Exception:
pass
if method == "unknown" or not os.path.exists(tmp):
# Last resort: return text snapshot only
snap = _sysinfo_snapshot()
snap["screenshot_available"] = False
snap["method"] = "text_only"
return snap
# Read image
try:
with open(tmp, "rb") as f:
raw = f.read()
b64 = base64.b64encode(raw).decode()
fsize = len(raw)
os.unlink(tmp)
# Try to get dimensions via file command
try:
r = subprocess.run(["identify", "-format", "%wx%h", tmp],
capture_output=True, text=True, timeout=5)
if "x" in r.stdout:
w, h = r.stdout.strip().split("x", 1)
width, height = int(w), int(h)
except Exception:
pass
return {
"success": True,
"method": method,
"image_b64": b64,
"image_mime": "image/png",
"file_size": fsize,
"width": width,
"height": height,
"hostname": socket.gethostname(),
}
except Exception as e:
return {"success": False, "error": str(e), "method": method}
def _render_sysinfo_png(out_path: str) -> bool:
"""Render a system info text snapshot as a PNG using ansi2image or ImageMagick."""
import shutil
snap = _build_sysinfo_text()
# Try convert (ImageMagick) to render text → PNG
if shutil.which("convert"):
try:
r = subprocess.run([
"convert",
"-size", "900x600", "xc:#0a0f14",
"-font", "Courier-New",
"-pointsize", "13",
"-fill", "#00d4ff",
"-annotate", "+20+30", snap[:3000],
out_path,
], capture_output=True, timeout=15)
return r.returncode == 0 and os.path.exists(out_path)
except Exception:
pass
return False
def _build_sysinfo_text() -> str:
"""Build a rich text system snapshot for headless machines."""
lines = [f"JARVIS FIELD STATION — {socket.gethostname()}",
f"Timestamp: {datetime.utcnow().strftime('%Y-%m-%d %H:%M:%S UTC')}",
"─" * 60]
try:
# CPU / mem / disk
with open("/proc/loadavg") as f:
load = f.read().split()[:3]
lines.append(f"Load avg: {' '.join(load)}")
except Exception:
pass
try:
with open("/proc/meminfo") as f:
minfo = {l.split(":")[0].strip(): int(l.split()[1]) for l in f if ":" in l}
total = minfo.get("MemTotal", 0)
avail = minfo.get("MemAvailable", 0)
used = total - avail
lines.append(f"Memory: {used//1024}MB used / {total//1024}MB total")
except Exception:
pass
try:
r = subprocess.run(["df", "-h", "/"], capture_output=True, text=True, timeout=5)
lines.append("Disk:\n" + r.stdout.strip())
except Exception:
pass
try:
r = subprocess.run(["ps", "aux", "--sort=-%cpu"], capture_output=True, text=True, timeout=5)
lines.append("Top processes:\n" + "\n".join(r.stdout.splitlines()[1:8]))
except Exception:
pass
try:
r = subprocess.run(["ss", "-tlnp"], capture_output=True, text=True, timeout=5)
lines.append("Listening ports:\n" + r.stdout.strip()[:500])
except Exception:
pass
return "\n".join(lines)
def _sysinfo_snapshot() -> dict:
"""Return structured system snapshot (no image) for text-based analysis."""
data = {"success": True, "hostname": socket.gethostname(),
"snapshot_type": "text", "screenshot_available": False}
try:
with open("/proc/loadavg") as f:
parts = f.read().split()
data["load_1m"], data["load_5m"], data["load_15m"] = parts[0], parts[1], parts[2]
except Exception:
pass
try:
with open("/proc/meminfo") as f:
m = {l.split(":")[0].strip(): int(l.split()[1])
for l in f if ":" in l and len(l.split()) >= 2}
data["mem_total_mb"] = m.get("MemTotal", 0) // 1024
data["mem_avail_mb"] = m.get("MemAvailable", 0) // 1024
data["mem_used_mb"] = data["mem_total_mb"] - data["mem_avail_mb"]
except Exception:
pass
try:
r = subprocess.run(["df", "-h", "/"], capture_output=True, text=True, timeout=5)
data["disk"] = r.stdout.splitlines()[1] if r.stdout else ""
except Exception:
pass
try:
r = subprocess.run(["ps", "aux", "--sort=-%cpu"], capture_output=True, text=True, timeout=5)
data["top_procs"] = r.stdout.splitlines()[1:8]
except Exception:
pass
try:
r = subprocess.run(["ss", "-tlnp"], capture_output=True, text=True, timeout=5)
data["listening_ports"] = r.stdout.strip()[:800]
except Exception:
pass
return data
# ── Command execution ─────────────────────────────────────────────────────────
def execute_command(cmd: dict) -> dict:
@@ -525,25 +378,17 @@ def execute_command(cmd: dict) -> dict:
return {"success": r.returncode == 0, "output": r.stdout}
elif cmd_type == "update":
_cfg = load_config()
updated = self_update(_cfg)
updated = self_update(cfg)
return {"success": True, "updated": updated}
elif cmd_type == "shell":
# Guard reads LOCAL config, not the server-supplied payload
_cfg = load_config()
if not _cfg.get("allow_shell_commands", False):
return {"success": False, "error": "Shell commands not enabled in agent config"}
# Only allow if explicitly enabled in config
if not cmd_data.get("allowed", False):
return {"success": False, "error": "Shell commands not enabled"}
cmd_str = cmd_data.get("command", "")
r = subprocess.run(cmd_str, shell=True, capture_output=True, text=True, timeout=30)
return {"success": True, "stdout": r.stdout[:2000], "stderr": r.stderr[:500]}
elif cmd_type == "screenshot":
return _take_screenshot(cmd_data)
elif cmd_type == "sysinfo":
return _sysinfo_snapshot()
else:
return {"success": False, "error": f"Unknown command type: {cmd_type}"}
@@ -565,18 +410,15 @@ def main():
poll_interval = int(cfg.get("poll_interval", 30))
heartbeat_every = int(cfg.get("heartbeat_every", 10))
# Always re-register on startup to refresh capabilities, version, and IP.
# Server does an UPDATE when agent_id already exists, so api_key is preserved.
# Register if no API key yet
api_key = state.get("api_key", "")
registered_key = register(cfg, state)
if registered_key:
api_key = registered_key
elif not api_key:
while not api_key:
api_key = register(cfg, state)
if not api_key:
print("[ERROR] Could not register with JARVIS. Retrying in 60s...", flush=True)
time.sleep(60)
if not api_key:
api_key = register(cfg, state)
if not api_key:
print("[ERROR] Could not register with JARVIS. Retrying in 60s...", flush=True)
time.sleep(60)
main()
return
headers = {"X-Agent-Key": api_key}
last_metrics = 0
@@ -592,7 +434,7 @@ def main():
try:
# Heartbeat + get commands
hb = api_post(f"{jarvis_url}/api/agent/heartbeat", {}, headers, ssl_verify=ssl_verify)
hb = api_post(f"{jarvis_url}/api/agent/heartbeat", {"version": AGENT_VERSION}, headers, ssl_verify=ssl_verify)
if "error" in hb:
print(f"[WARN] Heartbeat failed: {hb['error']}", flush=True)
else:
@@ -633,9 +475,7 @@ def main():
# ── Self-update ────────────────────────────────────────────────────────────────
def self_update(cfg: dict) -> bool:
"""Check JARVIS server for a newer version of this script.
Verifies SHA-256 hash from <update_url>.sha256 before replacing."""
import hashlib
"""Check JARVIS server for a newer version of this script. If different, replace and restart."""
jarvis_url = cfg.get("jarvis_url", "").rstrip("/")
default_update_url = f"{jarvis_url}/agent/jarvis-agent.py" if jarvis_url else ""
update_url = cfg.get("update_url", default_update_url)
@@ -643,37 +483,14 @@ def self_update(cfg: dict) -> bool:
return False
script_path = os.path.abspath(__file__)
try:
# Download expected hash first
hash_url = update_url + ".sha256"
req_hash = urllib.request.Request(hash_url)
req_hash.add_header("User-Agent", "JARVIS-Agent/1.0")
if _host_header:
req_hash.add_header("Host", _host_header)
try:
with urllib.request.urlopen(req_hash, timeout=10) as resp:
expected_hash = resp.read().decode().strip().split()[0]
except Exception:
expected_hash = None
# Download new script
req = urllib.request.Request(update_url)
req.add_header("User-Agent", "JARVIS-Agent/1.0")
if _host_header:
req.add_header("Host", _host_header)
with urllib.request.urlopen(req, timeout=30) as resp:
new_content = resp.read()
# Verify hash if available — abort if mismatch
if expected_hash:
actual_hash = hashlib.sha256(new_content).hexdigest()
if actual_hash != expected_hash:
print(f"[JARVIS] Update hash mismatch (expected {expected_hash[:16]}… got {actual_hash[:16]}…) — aborting", flush=True)
return False
with open(script_path, "rb") as f:
current = f.read()
if new_content != current:
print(f"[JARVIS] Update verified — replacing {script_path} and restarting...", flush=True)
print(f"[JARVIS] Update available — replacing {script_path} and restarting...", flush=True)
with open(script_path, "wb") as f:
f.write(new_content)
os.execv(sys.executable, [sys.executable] + sys.argv)
ssh/authorized_keys
+1 -3
View File
@@ -1,4 +1,2 @@
# Added and Managed by DigitalOcean Droplet Agent (code name: DOTTY)
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNIbUSWm6l0NcFEOukQGx5br54nFbjP2FzR7QYBT0dYs5j/AeuQ9WiOomkJMV6zcfUTKpAjUJJtbk1S9SXWrnq8= {"os_user":"root","actor_email":"myronblair@gmail.com","expire_at":"2026-05-27T18:25:20Z"}-dotty_ssh
# Added and Managed by DigitalOcean Droplet Agent (code name: DOTTY)
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMZhO/c3NsDBamiit4eMAIlm/zpg02RzEUNpeupB4azjrvTgAAij1UGlJ5wu4fkT7U//2GRdL4QmDbPYR0uBapQ= {"os_user":"root","actor_email":"myronblair@gmail.com","expire_at":"2026-05-27T18:24:59Z"}-dotty_ssh
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFuD94cTFSBqw9+Qdq8yOvF2ca6KtbtRBDFD3cFpm7kHCDqDbIGMjwgnaDGoEeexABr3+1itCnepvKono6JFMoI= {"os_user":"root","actor_email":"myronblair@gmail.com","expire_at":"2026-06-17T23:17:20Z"}-dotty_ssh
ssh/id_rsa.pub
+1
View File
@@ -0,0 +1 @@
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCqrGQSywH1r8h8cpIZ4qAIematYXmOLaz/7wBktsUI6ugxpBjhFyu4Rl+E+8WcN9icBoEfT0LSk9Ql+v2AjFIOo8pu1ktN5OnFQ28N3WfMU+jUBrZjTg0GaQCwTeiT53eb/+hZYY4JkKNlESZlEIiswM3Gqtm5EteU5Szq2r+eGub1cu0juk+WM+r/CexIXBInPspAP6v/hkRrABlemaA/D+4KB+PNAorMHZab8Vbn+RnEE7C5ppohPsalnowxLy3VHs+cbMAKpiBYfuRGzgbiIf1k/5V+0epl38QajJ0UEUwZwhZ3UgWklR+l1jd8B4VeYilAdaiMg60E64ans9FFEoud+r5DKuyz2GdjSFshOgJPtyoZr7Vw+IqNv4rdnxZv5OBTQprAzx8HlwMtduS8uXIPbDz2QYEQRAeSp8CT9O4auU25hArgLb+lTRN4PdcCIlQM2ZZU8xQG4Upy64Ol5yEbCTYFfc49Hs5EJqv/snNiDJLiH1BMR9r5rye0Y3e0HeM+MwvqgZ0ExQzJgAJbmlLejGmv3p0XUiT3UtIDdfBLL5QTPDYlmrwRpELTPasAc3KkoicWTch/8eRp5mcpRyo4Tb2PVrWmGw/qSkuxoTXzmPgS2//UpYY+6gC+kDqJSJYr0LUgPOfYG1LBYIhrVRM5RNTRaCbnLXFanvzf0Q== root@orbis