Update JARVIS TODO: round 2 fixes (HA poller, DB tables, web.orbishosting.com)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Update JARVIS TODO with comprehensive agent deployment plan
2026-06-30 17:50:10 -05:00 · 2026-06-29 15:53:20 -05:00 · 2026-06-29 13:57:47 -05:00 · 2026-06-29 13:22:24 -05:00 · 2026-06-29 12:45:45 -05:00 · 2026-06-29 12:01:12 -05:00
43 changed files with 1815 additions and 1219 deletions
@@ -1,345 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Environment
-
-This is a home-lab / managed-hosting environment. There is no local codebase to build or test — work consists of editing PHP/JS files on remote servers via SSH and managing infrastructure across several machines. All tool calls use `sshpass` with password auth.
-
-## Tailscale Network
-
-All key hosts are on Tailscale (myronblair@gmail.com). Use Tailscale IPs for SSH — no relay or port forwarding needed.
-
-| Host | Tailscale IP | LAN IP | Password |
-|------|-------------|--------|----------|
-| Claude VM (this) | 100.69.120.58 | 10.48.200.29 | — |
-| PVE1 | 100.80.188.8 | 10.48.200.90 | `Joker1974!!!` |
-| PVE2 | 100.87.186.12 | 10.48.200.91 | `Joker1974!!!` |
-| DO server (orbis) | 100.121.13.34 | 165.22.1.228 | `Gonewalk1974!@#` |
-| FusionPBX | 100.74.46.120 | 134.209.72.226 | `Joker1974!@#` |
-| JARVIS VM | 100.77.178.42 | 10.48.200.211 | `Joker1974!!!` |
-| NPM VM | 100.110.239.71 | 10.48.200.201 | `Joker1974!!!` |
-| Ollama VM | 100.96.100.113 | 10.48.200.210 | `Joker1974!!!` |
-| NovaCPX (hostpanel-110) | 100.86.51.18 | 10.48.200.110 | `Joker1974!!!` |
-| HomeBridge | 100.124.182.18 | 10.48.200.18 | — |
-| WireGuard CT | 100.122.55.10 | 10.48.200.19 | — |
-| Synology NAS | 100.118.175.5 | 10.48.200.249 | — |
-| mini-it12 (Windows) | 100.98.151.120 | 10.48.200.87 | — |
-
-**DNS note:** FortiGate blocks outbound port 53. All PVE1 VMs must use `10.48.200.90` (PVE1 dnsmasq → 100.100.100.100) as their DNS server, not 8.8.8.8 directly.
-
-## Server Map
-
-| Host | IP | SSH | Purpose |
-|------|-----|-----|---------|
-| DO (main) | 165.22.1.228 | `root / Gonewalk1974!@#` | CyberPanel/OLS — all websites (not JARVIS after migration) |
-| FusionPBX | 134.209.72.226 | `root / Joker1974!@#` (via Tailscale 100.74.46.120) | FreeSWITCH PBX |
-| PVE1 (Proxmox) | orbisne.fortiddns.com (10.48.200.90) | `root / Joker1974!!!` (via Tailscale 100.80.188.8) | Primary hypervisor |
-| PVE2 (Proxmox) | 10.48.200.91 | `root / Joker1974!!!` | Secondary hypervisor |
-| JARVIS VM | 10.48.200.211 | `root / Joker1974!!!` (via Tailscale 100.77.178.42) | JARVIS dashboard — PVE1 VM 211, 8c/16GB |
-| NPM VM | 10.48.200.201 | `root / Joker1974!!!` (via Tailscale 100.110.239.71) | Nginx Proxy Manager — PVE1 VM 105 (was VM200 pre-2026-06-22 restore; cloud-init says .200 but runs at .201) |
-| Ollama VM | 10.48.200.210 | `root / Joker1974!!!` (via Tailscale 100.96.100.113) | Local LLM — PVE1 VM 106 (was VM210 pre-2026-06-22 restore), 4c/8GB |
-| Home Assistant | 10.48.200.97 | `myron → sudo` | HA VM 101 |
-| NetworkBackup | 10.48.200.99 | `myron → sudo` | Backup VM (PVE2 VM 302) |
-| MediaStack | 10.48.200.35 | `root via PVE1 key` | Sonarr/Radarr/Prowlarr/qBittorrent (PVE1 VM 103, was VM113 pre-2026-06-22 restore) |
-| NovaCPX | 10.48.200.110 | `root / Joker1974!!!` (direct SSH — Tailscale 100.86.51.18 needs re-auth) | Custom hosting control panel (PVE1 VM 120) |
-| NPM | 10.48.200.201 | `root / Joker1974!!!` (via Tailscale 100.110.239.71) | Nginx Proxy Manager — PVE1 VM 200 · NPM API: `POST http://localhost:81/api/tokens` identity=myronblair@outlook.com |
-
-**SSH password order** (try in sequence if first fails): `Joker1974!@#` → `Joker1974!!!` → `Joker1974!`
-
-**SSH pattern for all remote work:**
-```bash
-sshpass -p 'Gonewalk1974!@#' ssh -o StrictHostKeyChecking=no root@165.22.1.228 'commands here'
-```
-
-For PVE1 from anywhere (FortiGate DDNS, survives IP changes):
-```bash
-sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@orbisne.fortiddns.com 'commands here'
-```
-
-For commands inside VMs on PVE1:
-```bash
-sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@orbisne.fortiddns.com \
-  'qm guest exec <VMID> -- bash -c "commands here"'
-```
-
-## Websites on DO (165.22.1.228)
-
-All sites live at `/home/<domain>/public_html/` on DO. CyberPanel/OpenLiteSpeed serves them.
-
-| Site | Path | GitHub |
-|------|------|--------|
-| ~~jarvis.orbishosting.com~~ | ~~removed from DO~~ | myronblair/jarvis (now on PVE1 VM 211) |
-| tomsjavajive.com | /home/tomsjavajive.com/public_html/ | myronblair/tomsjavajive |
-| epictravelexpeditions.com | /home/epictravelexpeditions.com/public_html/ | myronblair/epictravelexpeditions |
-| parkerslingshotrentals.com | /home/parkerslingshotrentals.com/public_html/ | myronblair/parkerslingshotrentals |
-| orbishosting.com | /home/orbishosting.com/public_html/ | myronblair/orbishosting |
-| orbis.orbishosting.com | /home/orbis.orbishosting.com/public_html/ | myronblair/orbis-hosting-portal |
-| tomtomgames.com | /home/tomtomgames.com/public_html/ | myronblair/tomtomgames |
-
-**Parker Slingshot** is served from epictravelexpeditions.com, not its own domain:
- URL: `https://parkerslingshot.epictravelexpeditions.com`
- Path: `/home/epictravelexpeditions.com/parkerslingshot/`
- GitHub: `myronblair/parkerslingshot` (own repo, auto-deploy active)
- `db.php` and `config.php` are gitignored (credentials); `db.php.example` is the reference template
-
-## Deployment Workflow
-
-**Auto-deploy is active.** Push to `main` on any site repo → GitHub webhook → server pulls automatically within 1 minute. PHP syntax is validated before deploy; bad commits are auto-reverted.
-
-**Two separate webhook handlers:**
- **JARVIS repo** → `http://jarvis.orbishosting.com:1972/webhook.php` — deploys to JARVIS VM (`/var/www/jarvis/`). Deploy log: `/var/www/jarvis/logs/deploy.log`
- **All 6 website repos → `https://tomtomgames.com/webhook.php` on DO — deploys to `/home/<site>/public_html/` on DO. Deploy log: `/home/tomtomgames.com/logs/deploy.log`. Deploy log: `/home/<site>/logs/deploy.log`
-
-HMAC secret (both handlers): `4c8805f0285214ff0a0602b5880270b935f36a896946c7f1`
-Deploy queue: `/tmp/jarvis-deploy-queue.txt` | Runner: `/usr/local/bin/jarvis-deploy.sh` (cron every min, on both DO and JARVIS VM)
-
-For hotfixes that can't wait 1 min, SCP directly:
-```bash
-# JARVIS VM
-scp -o StrictHostKeyChecking=no /tmp/changed.php root@100.77.178.42:/var/www/jarvis/public_html/changed.php
-# DO websites
-sshpass -p 'Gonewalk1974!@#' scp -o StrictHostKeyChecking=no /tmp/changed.php \
-  root@165.22.1.228:/home/site.com/public_html/changed.php
-```
-
-GitHub PAT (embedded in remote URLs): `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` — expires ~2026-08-20.
-Infra repo: `myronblair/infra` — cloned at `/opt/infra` on DO server.
-
-**DO server backup:** `myronblair/do-server-config` — scripts, systemd units, WireGuard, OLS vhosts, cron, MySQL creds + 8-phase restore wizard. Weekly Sunday 4am. Launcher: `/usr/local/bin/do-server-backup`.
-
-Gitignored credentials (never in GitHub): `api/config.php` (JARVIS, epictravelexpeditions), `config/database.php` (tomsjavajive).
-
-## JARVIS System
-
-Iron Man-style AI dashboard at `http://jarvis.orbishosting.com:1972`. **Migrated from DO to PVE1 VM 211 (2026-06-18).** All files on JARVIS VM at `/var/www/jarvis/`.
-
-**Access:**
- Dashboard: `http://jarvis.orbishosting.com:1972`
- Admin: `http://jarvis.orbishosting.com:1972/admin`
- Internal (LAN): `http://10.48.200.211` or via Tailscale `http://100.77.178.42`
- FortiGate VIP: external port `1972` → `10.48.200.211:80`
- Cloudflare: DNS only (grey cloud) — no CF proxy, no SSL overhead on origin
-
-**Stack on JARVIS VM:**
- nginx + PHP 8.3-FPM (replaces OLS/lsphp on DO)
- MariaDB (jarvis_db local, `jarvis_user / J4rv1s_Pr0t0c0l_2026!`)
- Redis (`redis-server`)
- Python 3 + Arc Reactor daemon
-
-**Architecture:**
- `public_html/api.php` — API router; `session_start()` skipped only for machine-agent sub-actions (heartbeat/metrics/ha_state/command_result/register); browser-facing agent routes (list/status/myip) need session. Has `session_write_close()` guard (must skip for `auth` endpoint to prevent LSAPI session deadlock).
- `api/config.php` — all credentials/constants (gitignored)
- `api/endpoints/chat.php` — 4-tier AI: KB intent → Groq (`compound-beta-mini`) → Claude API; includes Tier 0.7 planner intents (tasks/appointments/briefing). Ollama at `http://10.48.200.210:11434`.
- `api/endpoints/agent.php` — push-based agent registration/heartbeat/metrics; browser actions (list/status/myip) auth via `$_SESSION`, machine actions auth via `X-Agent-Key` header
- `api/endpoints/alerts.php` — auto-generates alerts (CPU >85%, RAM >85%, disk >88%, offline agents, site down); dispatches restart commands to agents when their services fail
- `api/endpoints/facts_collector.php` — runs every 3 min via cron (php8.3); collects agent metrics, KB facts, Proxmox/HA status, and all 7 site HTTP health checks. Site checks use external URLs (JARVIS VM is NOT the web host). `$fresh()` queries `WHERE category=?` (not `fact_category`).
- `api/endpoints/stats_cache.php` — runs every 5 min via cron; weather/news/Proxmox cache refresh. Proxmox API at `https://10.48.200.90:8006` (direct LAN).
- `api/endpoints/do_server.php` — reads `/proc` for JARVIS VM stats; also includes DO server agent metrics (`do_server` key from jarvis-do agent via Tailscale).
- `api/endpoints/planner.php` — tasks & appointments CRUD; routes: `planner/tasks`, `planner/appointments`, `planner/today`, `planner/done`
- `api/endpoints/ha.php` — HA entity list reads from `ha_entities` table (real-time agent push); service calls go direct to HA_URL (`http://10.48.200.97:8123`)
- `api/lib/kb_engine.php` — `storeFact()` ON DUPLICATE KEY UPDATE always sets `updated_at=NOW()` explicitly; without this, unchanged values don't bump the timestamp and freshness checks break.
-
-**Voice system (index.html):**
- Continuous SpeechRecognition; mic stays open always (mute toggle button)
- **Phase 1 wake**: say "wake up JARVIS" or "daddy's home" → activates voice mode once
- **Phase 2 command**: say "JARVIS [command]" → executes; opens 17-second free-listen window (no prefix needed for follow-ups)
- After 30 min of no commands → voice sleeps; full wake phrase required again
- Mic paused during ElevenLabs TTS playback (`isSpeaking` guard) to prevent feedback loop
- Auto-reload after 5 min idle is silent (no greeting speech)
-
-**Planner system (2026-05-31):**
- DB tables: `tasks` (id, title, notes, category, priority, status, due_date, due_time, completed_at) and `appointments` (id, title, description, category, start_at, end_at, location, all_day, reminder_min, alerted)
- Voice commands: "add task [title]", "my tasks", "mark [x] done", "schedule [title] on [date]", "my calendar", "daily briefing"
- Home page: small top-bar badge "N TASKS · N APPTS" when items due today (no panel added)
- Admin CRUD at `/admin` under PLANNER section → TASKS and APPOINTMENTS tabs
-
-**Agent system:** Agents phone home every 10s (heartbeat) / 30s (metrics) to `http://10.48.200.211` (direct LAN — no Cloudflare). Config at `/etc/jarvis-agent/config.json` or `/opt/jarvis-agent/config.json` on each Linux agent.
-Agent installer (one-liner for any Linux host): `curl -sk http://10.48.200.211/install-agent.sh | bash -s <hostname> <linux|homeassistant|proxmox>`
-DO server agent (jarvis-do) uses Tailscale: `jarvis_url: http://100.77.178.42`
-
-**Agent file paths by host** (for manual updates — push to correct path then restart service):
- Most Linux hosts: `/opt/jarvis-agent/jarvis-agent.py` · service: `systemctl restart jarvis-agent`
- WireGuard CT (10.48.200.19, Alpine): `/opt/jarvis-agent/agent.py` · service: `rc-service jarvis-agent restart`
- `public_html/agent/jarvis-agent.py` is the self-update URL — must be kept in sync with `agent/jarvis-agent.py` (both are tracked in git; auto-deploy keeps them in sync after 2026-06-17)
-
-**Self-healing:** `/usr/local/bin/jarvis-watchdog.sh` runs every 5 min (root cron on DO). Restarts lsws/mysql/redis on DO if down. Log: `/usr/local/lsws/logs/watchdog.log` on DO.
-
-**JARVIS DB:** `jarvis_db` on JARVIS VM localhost (MariaDB). User: `jarvis_user / J4rv1s_Pr0t0c0l_2026!`. phpMyAdmin at `/phpmyadmin` on JARVIS VM (myron / Joker1974!!!).
-Core tables: agent_commands, agent_metrics, alerts, api_cache, appointments, conversations, ha_entities, kb_facts, kb_intents, kb_ollama_models, kb_preferences, known_commands, metrics_history, network_devices, registered_agents, tasks, users. Arc Reactor adds: arc_jobs, guardian_events, guardian_config, agent_screenshots.
-
-`kb_facts` schema: `(id, category, fact_key, fact_value, host, expires_at, updated_at)` — column is `category` not `fact_category`.
-
-**Arc Reactor daemon:** Python service at `/opt/jarvis-arc/reactor.py` on JARVIS VM, port 7474, managed by `systemctl restart jarvis-arc`. Deploy source: `deploy/reactor.py` in the jarvis repo. After pushing to GitHub, auto-deploy pulls to `/var/www/jarvis/deploy/reactor.py` — then manually `cp /var/www/jarvis/deploy/reactor.py /opt/jarvis-arc/reactor.py && systemctl restart jarvis-arc`. Log: `/var/www/jarvis/logs/arc_reactor.log`.
-
-**Arc Reactor AI routing:**
-| Feature | Provider | Model |
-|---------|----------|-------|
-| Guardian anomaly alerts | Groq | `llama-3.3-70b-versatile` |
-| SITREP | Groq | `llama-3.3-70b-versatile` |
-| Vision: text-only sysinfo snapshot | Groq | `llama-3.3-70b-versatile` |
-| Vision: actual screenshot image | Claude | `claude-opus-4-8-20251101` |
-| Email drafting, research, tool_loop | Claude | `claude-sonnet-4-6` |
-
-`llm_call(messages, provider)` cascades: groq → ollama on failure. Pass `"groq"` or `"claude"` as provider.
-
-**Groq API note:** Use model name `compound-beta-mini` directly — NOT `groq/compound-beta-mini` (that's OpenAI router syntax and will 404 on api.groq.com).
-
-## Tom's Java Jive
-
-PHP e-commerce site. DB: `toms_tjj_db / toms_tjj_user / +60wlPc+55e@gFq4`. Key quirks:
- No `slug` column on products — URLs use `?id=product_id`
- All tables must be `utf8mb4_unicode_ci` — mixed collation causes MySQL error 1267 on JOINs
- `wallet_transactions.type` and `loyalty_transactions.type` have strict enums (see memory for values)
-
-## MediaStack
-
-Automated media server on PVE1 VM 113. All traffic routes through WireGuard VPN → DO, bypassing home ISP.
-
-**SSH:** From PVE1: `ssh -o StrictHostKeyChecking=no -i /root/.ssh/id_rsa root@10.48.200.35`
-
-**Services:**
-| Service | Port | Login |
-|---------|------|-------|
-| qBittorrent | :8080 | admin / Joker1974!!! |
-| Sonarr | :8989 | API key: `b43e04350a594846b4ee95261c29e9e0` |
-| Radarr | :7878 | API key: `53c4268360444feeae5f98c0cc24e0e3` |
-| Prowlarr | :9696 | API key: `9d0ce6c5660743b5bf1c7951efc62252` |
-
-**Media paths:** downloads → `/media/downloads/complete` | movies → `/media/movies` | tv → `/media/tv`
-**Jellyfin NFS mounts** (VM 112, 10.48.200.33): `/mnt/mediastack/movies` and `/mnt/mediastack/tv`
-**WireGuard:** `wg0` IP `10.200.0.4` → CT110 (10.48.200.19:51821) → DO. Kill-switch active; LAN always allowed.
-**DNS:** FortiGate blocks port 53 outbound. PVE1 runs dnsmasq on :53 → 100.100.100.100. MediaStack uses `DNS=10.48.200.90`.
-**Indexer:** IPTorrents via Prowlarr (cookie auth). Prowlarr syncs to Sonarr + Radarr automatically.
-**GitHub:** `myronblair/mediastack` (private) — config files, systemd units, README with full setup notes.
-**JARVIS agent quirks:** needs `jarvis_url`, `registration_key` (`f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518`), `ssl_verify: false` in config.
-
-## NovaCPX Panel
-
-Custom web hosting control panel (PVE1 VM 120, 10.48.200.110). Root SSH: `sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.110` (direct LAN — use this, Tailscale 100.86.51.18 requires re-auth periodically).
-
-**Public URLs (via NPM → FortiGate VIP port 443 → 10.48.200.201):**
- Admin: `https://admin.novacpx.orbishosting.com` (→ port 8882) · `admin / Admin2026!` or `myron / Joker1974!!!`
- Reseller: `https://reseller.novacpx.orbishosting.com` (→ port 8881)
- User: `https://panel.novacpx.orbishosting.com` or `https://novacpx.orbishosting.com` (→ port 8880)
- Webmail: port 8883 (Roundcube) — no public NPM proxy yet
- `https://web.orbishosting.com` → port 80 (placeholder for a new hosted website)
-
-**Ports:** 8880 (user) · 8881 (reseller) · 8882 (admin) · 8883 (Roundcube webmail)
-
-**Paths:** Panel web root `/srv/novacpx/public/` · Git repo `/opt/novacpx-src/` · DB `/var/lib/novacpx/panel.db` (SQLite) · Config `/etc/novacpx/config.ini`
-
-**Config notes:** `/etc/novacpx/config.ini` must have `server = nginx` (not apache) — VhostManager checks this to write the correct vhost format.
-
-**⚠ After any restore from PBS backup:** config.ini reverts to `server = apache`. Always run: `sed -i "s/^server = apache/server = nginx/" /etc/novacpx/config.ini` after a restore. Also: PHP-FPM will fail to start if orphaned pool configs exist from pre-restore accounts — run the cleanup: `for f in /etc/php/8.3/fpm/pool.d/*.conf; do [[ "$f" == *"www.conf"* ]] && continue; u=$(basename "$f" .conf); id "$u" &>/dev/null || rm -f "$f"; done && systemctl start php8.3-fpm`. The `webacct` hosting account and its nginx vhost must be recreated after restore (Linux user survives but DB record and vhost are lost).
-
-**GitHub:** `myronblair/novacpx` (private). Auto-deploy active: push to `main` (stable) or `beta` → webhook → VM pulls. GitHub Actions auto-bumps VERSION: main→PATCH, beta→-beta.N suffix. Current version: 1.0.40.
-
-**Update channels:** `stable` tracks `origin/main`, `beta` tracks `origin/beta`. Set in Admin → Settings → Update Channel.
-
-**Local clone:** `/tmp/novacpx/` on this machine. All edits go here first, then `git push origin main`. The deploy runner syncs `panel/` → `/srv/novacpx/public/` and `panel/lib/` → `/srv/novacpx/public/lib/`. For immediate changes use SCP to `root@10.48.200.110:/srv/novacpx/public/`.
-
-**PHP-FPM:** Per-account pools in `/etc/php/8.3/fpm/pool.d/`. If php8.3-fpm fails to start, check for orphaned pool configs referencing deleted Linux users — remove them and `systemctl start php8.3-fpm`.
-
-**JARVIS agent:** Installed, online. Agent ID: `novacpx_e3b07264`.
-
-**SQLite quirk:** Never use MySQL syntax (ON DUPLICATE KEY, NOW(), DATE_ADD, etc.). DB.php has translate() layer but endpoints must also use SQLite syntax directly.
-
-## Parker Slingshot Rentals
-
-Admin portal at `/admin/index.php` uses HMAC-signed cookie auth (not PHP sessions — sessions were unreliable under LiteSpeed caching). Admin: `admin / Parker2026!`. DB: `epic_parkersling / epic_parkersling / Joker1974!!!`.
-
-## FusionPBX / FreeSWITCH
-
-Production at 134.209.72.226. Web: `https://fusion.orbishosting.com` (admin / fY7XP5swgtpbzrYLhkeVYkA4744). SIP profiles served via Lua XML handler — config changes require deleting `/var/cache/fusionpbx/FusionPBX.configuration.sofia.conf` to force reload. Extension 1000 (Yealink T48S at 10.48.200.43) registered on production server via port 5080 with `aggressive-nat-detection=true` to bypass FortiGate SIP ALG.
-
-**SSH access:** Direct via Tailscale (preferred):
-```bash
-sshpass -p 'Joker1974!@#' ssh -o StrictHostKeyChecking=no root@100.74.46.120
-```
-Fallback if Tailscale down — relay through DO:
-```bash
-sshpass -p 'Gonewalk1974!@#' ssh -o StrictHostKeyChecking=no root@165.22.1.228 \
-  'sshpass -p "Joker1974!@#" ssh -o StrictHostKeyChecking=no root@134.209.72.226 "command"'
-```
-
-**Backup:** `myronblair/fusionpbx-config` — PostgreSQL dump (gzip, ~29MB) + FreeSWITCH configs + restore wizard. Weekly Sunday 5am. Launcher: `/usr/local/bin/fusionpbx-backup`.
-
-## Proxmox
-
-PVE1 at 10.48.200.90, PVE2 at 10.48.200.91. Root login direct. Run commands inside VMs via:
-```bash
-qm guest exec <VMID> -- bash -c 'command'
-```
-Proxmox `--nameserver` must be space-separated: `"8.8.8.8 1.1.1.1"` (comma causes netplan bug).
-
-**Backup:** `myronblair/proxmox-config` — shared cluster configs (VM .conf, storage, HA, SDN) + per-node (network, cron, systemd, scripts). Weekly Sunday 3am. Launcher: `/usr/local/bin/proxmox-backup` on both nodes.
-
-## PHP / OLS Runtime
-
-CyberPanel uses `lsphp85`. Run PHP scripts directly with:
-```bash
-/usr/local/lsws/lsphp85/bin/lsphp /path/to/script.php
-```
-For PHP syntax checking use `php8.3 -l file.php` — lsphp segfaults on `-l` flag.
-When a PHP endpoint uses `ob_start()` + `header.php` pattern, add `ob_end_clean()` before any CSV/JSON response output.
-
-**Cloudflare Rocket Loader:** JARVIS uses `data-cfasync="false"` on every `<script>` tag in `index.html` (including CDN scripts like face-api.js). One untagged script is enough to trigger Rocket Loader's bootstrap, which injects `mainScript.js` and causes `SyntaxError: Identifier 'mainScriptFlag' has already been declared`. `Cache-Control: no-store, no-cache, must-revalidate, no-transform` is set in `index.php` but tag every new script with `data-cfasync="false"` anyway.
-
-**Cloudflare auto-deploy cache problem:** After pushing JS fixes, Cloudflare CDN serves stale cached files even on hard refresh. Bump the `?v=YYYYMMDD` query param on script tags in `index.html` to force a cache miss. Current version param: `?v=20260617b`.
-
-**JS file structure (as of 2026-06-17):**
- `assets/js/jarvis-effects.js` — canvas particle effects, sparklines
- `assets/js/jarvis-overlays.js` — sleep overlay, network map canvas
- `assets/js/jarvis-app.js` — globals, init, chat, voice, system/network/HA/alerts/weather panels
- `assets/js/panels/jarvis-arc.js` — Arc Reactor, Intel Protocol, Comms Protocol, Guardian Mode
- `assets/js/panels/jarvis-agents.js` — Missions, Directives, Memory, Clearance, Agents tab, Sites, Vision Protocol
- `assets/js/panels/jarvis-assistant.js` — Chat History, Command Palette, Suggestions, Mobile switcher, Topology map
-
-A SyntaxError in any panels/ file breaks only that group — other panels stay functional. `escHtml()` is defined in jarvis-arc.js (loads first) and is global to all subsequent files.
-
-## GitHub Repos
-
-| Repo | Site | DB Schema |
-|------|------|-----------|
-| myronblair/jarvis | jarvis.orbishosting.com | db/schema.sql (15 tables) |
-| myronblair/tomsjavajive | tomsjavajive.com | db/schema.sql (45 tables) |
-| myronblair/epictravelexpeditions | epictravelexpeditions.com | db/schema.sql (7 tables) |
-| myronblair/parkerslingshot | parkerslingshot.epictravelexpeditions.com | (no schema file — DB managed directly) |
-| myronblair/parkerslingshotrentals | parkerslingshotrentals.com | db/schema.sql (10 tables) |
-| myronblair/orbishosting | orbishosting.com | — |
-| myronblair/orbis-hosting-portal | orbis.orbishosting.com | — |
-| myronblair/tomtomgames | tomtomgames.com | db/schema.sql (22 tables) |
-| myronblair/infra | server configs | cron, systemd, agent configs |
-| myronblair/mediastack | MediaStack VM 113 | config/, systemd units, wg0.conf, README |
-| myronblair/do-server-config | DO server backup | scripts, systemd, WG, OLS vhosts, restore.sh |
-| myronblair/proxmox-config | PVE1+PVE2 backup | shared cluster configs + per-node, restore.sh |
-| myronblair/novacpx | admin.novacpx.orbishosting.com | db/schema.sql (SQLite, 19+ tables) |
-| myronblair/web-dashboard | web.orbishosting.com | — |
-| myronblair/fusionpbx-config | FusionPBX backup | PostgreSQL dump (gzip) + FS configs, restore.sh |
-
-All repos are private. Each has `config/vhost/` with OLS vhost config. The jarvis repo also has `deploy/` (watchdog, deploy runner, systemd units) and `agent/jarvis-agent.py`.
-
-## Split DNS (added 2026-06-21)
-
-PVE1 dnsmasq (`/etc/dnsmasq.d/forwarder.conf`) has split DNS entries so all NPM-proxied domains resolve to `10.48.200.201` (NPM internal IP) for LAN clients — bypasses FortiGate hairpin NAT for HTTPS:
-
-```
-address=/jarvis.orbishosting.com/10.48.200.201
-address=/hoa.orbishosting.com/10.48.200.201
-address=/novacpx.orbishosting.com/10.48.200.201
-address=/admin.novacpx.orbishosting.com/10.48.200.201
-address=/reseller.novacpx.orbishosting.com/10.48.200.201
-address=/panel.novacpx.orbishosting.com/10.48.200.201
-address=/web.orbishosting.com/10.48.200.201
-```
-
-For any LAN device to use this: set DNS to `10.48.200.90` in Wi-Fi settings (or update FortiGate DHCP to push 10.48.200.90 as DNS for all clients).
-
-## NovaCPX Panel (updated 2026-06-22)
-
-Post-restore notes added — see `deploy/novacpx-post-restore.sh` which fixes config.ini, cleans pools, rebuilds webacct account. VM IDs changed after restore: MediaStack VM103, NPM VM105, Ollama VM106. Run script after any PBS restore.
-
-**NovaCPX v1.0.54** — security fixes (CORS, open redirect, CSS injection, exception leakage), subdomains (#36), parked domains (#37), account settings page (#38), better default index (#39), post-restore script (#50), collapsible nav (#48).
-
-**web.orbishosting.com** — Blair HQ dashboard with server-backed notes (notes.php → /home/webacct/notes.json). Password: myronblair@outlook.com / Joker1974!!!
@@ -1,738 +0,0 @@
-# INFRASTRUCTURE REFERENCE — COMPLETE SYSTEM MAP
-**Last Updated:** 2026-06-14  
-**Owner:** Myron Blair — myronblair@outlook.com
-
---
-
-## TABLE OF CONTENTS
-1. [Network Overview](#1-network-overview)
-2. [Cloud Servers](#2-cloud-servers)
-3. [On-Premise — Proxmox Hypervisors](#3-on-premise--proxmox-hypervisors)
-4. [On-Premise — Virtual Machines](#4-on-premise--virtual-machines)
-5. [NAS Storage](#5-nas-storage)
-6. [Websites (all on DO)](#6-websites--all-on-do)
-7. [JARVIS AI System](#7-jarvis-ai-system)
-8. [Phone System (FusionPBX)](#8-phone-system-fusionpbx)
-9. [Networking & VPN](#9-networking--vpn)
-10. [Backup Systems](#10-backup-systems)
-11. [SSH Quick Reference](#11-ssh-quick-reference)
-12. [Critical Credentials Master List](#12-critical-credentials-master-list)
-
---
-
-## 1. NETWORK OVERVIEW
-
-```
-INTERNET
-    │
-    ▼
-[Cloudflare CDN] ──────────────────────────────────────────────────────────────
-    │ (proxied DNS for public sites)
-    │
-    ├─► [DigitalOcean 165.22.1.228] — CyberPanel/OLS — All websites + JARVIS
-    │
-    └─► [FusionPBX 134.209.72.226] — FreeSWITCH PBX (SSH via DO relay)
-
-HOME NETWORK (FortiGate router at 10.48.200.1)
-    WAN: 97.154.109.245 (dynamic, DDNS: orbisne.fortiddns.com)
-    │
-    ├─► PVE1 Proxmox    10.48.200.90  (primary hypervisor)
-    │     ├── VM 101    10.48.200.97  Home Assistant
-    │     ├── VM 112    10.48.200.33  Jellyfin
-    │     ├── VM 113    10.48.200.35  MediaStack (Sonarr/Radarr/qBT/Prowlarr)
-    │     ├── VM 118    10.48.200.18  Homebridge
-    │     ├── VM 120    10.48.200.110 NovaCPX hosting panel
-    │     ├── VM 210    10.48.200.95  Ollama (local LLM)
-    │     └── CT110     10.48.200.19  WireGuard exit container
-    │
-    ├─► PVE2 Proxmox    10.48.200.91  (secondary hypervisor)
-    │     └── VM 302    10.48.200.99  NetworkBackup
-    │
-    ├─► Synology NAS    10.48.200.249 — Media & backup storage
-    ├─► Yealink T48S    10.48.200.2   — Ext 1000 (Myron Blair, Desk)
-    ├─► Yealink T48S    10.48.200.43  — Ext 1001 (Tommy Ivy, Desk)
-    ├─► Yealink AX86R   10.48.200.65  — Ext 1002 (Myron Blair, WiFi Work)
-    ├─► Yealink T57W    10.48.200.3   — External SIP (United Mirror & Glass)
-    ├─► Yealink T57W    10.48.200.83  — Ext 1003 (Kitchen)
-    └─► Yealink T57W    10.48.200.85  — Ext 1004 (Master Bedroom)
-
-FortiGate Port Forwards:
-  orbisne.fortiddns.com:8006  → PVE1:8006    (Proxmox web UI)
-  orbisne.fortiddns.com:8123  → HA:8123      (Home Assistant)
-  orbisne.fortiddns.com:22    → HA VM:22     (SSH — key only, unreliable)
-```
-
---
-
-## 2. CLOUD SERVERS
-
-### 2A. DigitalOcean — Main Server
-| Field | Value |
-|-------|-------|
-| **IP** | 165.22.1.228 |
-| **OS** | Ubuntu 22.04 LTS |
-| **Panel** | CyberPanel (OpenLiteSpeed) |
-| **SSH** | `ssh root@165.22.1.228` — password: `Gonewalk1974!@#` |
-| **Purpose** | All public websites + JARVIS AI + webhook deploy system |
-
-**Key Paths:**
- All sites: `/home/<domain>/public_html/`
- JARVIS: `/home/jarvis.orbishosting.com/`
- Deploy log: `/home/jarvis.orbishosting.com/logs/deploy.log`
- Watchdog log: `/home/jarvis.orbishosting.com/logs/watchdog.log`
- Infra repo: `/opt/infra`
-
-**Services running:**
- OpenLiteSpeed web server (`lsws`) — serves all 7 sites
- MySQL 8 — all site databases on localhost
- Redis — session/cache
- PHP 8.5 (`lsphp85`) — runtime for all sites
- Cron jobs: JARVIS deploy runner (every 1 min), facts collector (every 3 min), stats cache (every 5 min), watchdog (every 5 min)
-
-**CyberPanel Web UI:** `https://165.22.1.228:8090`  
-Login: `myron / Joker1974!!!`
-
-**phpMyAdmin:** `https://165.22.1.228/phpmyadmin`  
-Login: `myron / Joker1974!!!`
-
---
-
-### 2B. FusionPBX / FreeSWITCH — PBX Server
-| Field | Value |
-|-------|-------|
-| **IP** | 134.209.72.226 |
-| **OS** | Debian (DigitalOcean droplet) |
-| **SSH** | Must relay via DO: `ssh root@165.22.1.228` → `ssh root@134.209.72.226` — password: `Joker1974!@#` |
-| **Direct SSH** | Only from: 107.178.2.130 / 97.154.109.245 |
-| **Purpose** | VoIP phone system — handles all inbound/outbound calls |
-
-**Web UI:** `https://fusion.orbishosting.com`  
-Login: `admin / fY7XP5swgtpbzrYLhkeVYkA4744`
-
-**Database:** PostgreSQL  
-User: `fusionpbx` / Password: `pSJaF9mUJqPr4Sj5mwJyRqvCCpc` / Host: 127.0.0.1
-
-**SIP Trunk:** SignalWire  
-DID: +1 (817) 764-5007  
-Gateway: `signalwire` on external profile (port 5080, UDP)
-
-**How calls flow:**
-```
-Caller → SignalWire SIP → FusionPBX:5080 → IVR (ext 900) → Ring extensions
-Outbound: Phone → FusionPBX:5080 → SignalWire → PSTN
-```
-
-**SSH Relay Command:**
-```bash
-sshpass -p 'Gonewalk1974!@#' ssh -o StrictHostKeyChecking=no root@165.22.1.228 \
-  'sshpass -p "Joker1974!@#" ssh -o StrictHostKeyChecking=no root@134.209.72.226 "COMMAND"'
-```
-
---
-
-## 3. ON-PREMISE — PROXMOX HYPERVISORS
-
-### PVE1 — Primary Hypervisor
-| Field | Value |
-|-------|-------|
-| **Local IP** | 10.48.200.90 |
-| **External** | orbisne.fortiddns.com (FortiGate DDNS — auto-updates on WAN IP change) |
-| **OS** | Proxmox VE 8.x |
-| **SSH** | `ssh root@orbisne.fortiddns.com` OR `ssh root@10.48.200.90` — password: `Joker1974!!!` |
-| **Web UI** | `https://orbisne.fortiddns.com:8006` — `root / Joker1974!!!` |
-| **Purpose** | Runs VMs 101, 112, 113, 118, 120, 210, CT110 |
-
-**Useful commands:**
-```bash
-qm list                          # list all VMs
-qm start/stop/restart <VMID>     # control VMs
-qm guest exec <VMID> -- bash -c "cmd"  # run command inside VM (requires QEMU agent)
-```
-
-**JARVIS API Token:** `root@pam!jarvis=c45b5feb-f9a9-445d-a626-14fbb959f78b`
-
---
-
-### PVE2 — Secondary Hypervisor
-| Field | Value |
-|-------|-------|
-| **Local IP** | 10.48.200.91 |
-| **OS** | Proxmox VE 8.x |
-| **SSH** | `ssh root@10.48.200.91` — password: `Joker1974!!!` |
-| **Web UI** | `https://10.48.200.91:8006` — `root / Joker1974!!!` |
-| **Purpose** | Runs VM 302 (NetworkBackup); part of shared Proxmox cluster with PVE1 |
-
---
-
-## 4. ON-PREMISE — VIRTUAL MACHINES
-
-### VM 101 — Home Assistant (PVE1)
-| Field | Value |
-|-------|-------|
-| **IP** | 10.48.200.97 |
-| **OS** | Ubuntu + Home Assistant OS/Supervised |
-| **Web UI** | `http://orbisne.fortiddns.com:8123` — `myron / [HA password]` |
-| **SSH** | Via HA web terminal only (Settings → Add-ons → Advanced SSH & Web Terminal) |
-| **Purpose** | Smart home automation — 212 entities (lights, switches, scenes, sensors) |
-| **JARVIS Agent** | ID: `homeassistant_ha` — pushes entity states to JARVIS every 10s |
-
-**JARVIS ↔ HA Integration:**
- HA custom component at `/config/custom_components/jarvis_agent/`
- Pushes all entity state changes to JARVIS `/api/agent/ha_state` (debounced 2s)
- JARVIS admin toggles → queued in `agent_commands` table → HA executes natively
- HA Long-lived Token (Jarvis2): `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiIzNmI0N2I1Njk5ZGQ0MTQ2ODMwZWFmYjZiYTQ1MjJkMSIsImlhdCI6MTc4MDIwMzU5NCwiZXhwIjoyMDk1NTYzNTk0fQ.sYRok-jRDlA4lFgWxLQELcEjkJNGQdprk6ZziLwLtXE`
-
---
-
-### VM 112 — Jellyfin Media Server (PVE1)
-| Field | Value |
-|-------|-------|
-| **IP** | 10.48.200.33 |
-| **OS** | Ubuntu 22.04 LTS |
-| **SSH** | `ssh root@10.48.200.33` — password: `Joker1974!!!` (enabled 2026-06-14) |
-| **Web UI** | `http://10.48.200.33:8096` |
-| **Purpose** | Media streaming server — Movies and TV shows |
-| **JARVIS Agent** | Not yet installed |
-
-**Media Libraries:**
- Movies: `/mnt/mediastack/movies` — NFS from MediaStack (10.48.200.35:/media/movies)
- TV: `/mnt/mediastack/tv` — NFS from MediaStack (10.48.200.35:/media/tv)
-
-**NFS chain:** Jellyfin → MediaStack → Synology NAS (`/volume1/video/movies` and `/volume1/video/tv`)
-
-**Admin token:** `7c0ccf78b91d4b5bafa607f585f24f2d`
-
-**If library scan needed:**
-```bash
-curl -X POST "http://10.48.200.33:8096/Library/Refresh" \
-  -H "X-Emby-Token: 7c0ccf78b91d4b5bafa607f585f24f2d"
-```
-
-**If NFS stale after MediaStack changes:**
-```bash
-umount -l /mnt/mediastack/movies && umount -l /mnt/mediastack/tv
-mount /mnt/mediastack/movies && mount /mnt/mediastack/tv
-```
-
---
-
-### VM 113 — MediaStack (PVE1)
-| Field | Value |
-|-------|-------|
-| **IP** | 10.48.200.35 |
-| **OS** | Ubuntu 24.04 LTS |
-| **SSH** | Via PVE1: `ssh -i /root/.ssh/id_rsa root@10.48.200.35` (no direct access from DO) |
-| **Purpose** | Automated media download pipeline + NFS server to Jellyfin |
-| **JARVIS Agent** | ID: `MediaStack_2c00b1b8` |
-
-**Services:**
-| Service | Port | Login | API Key |
-|---------|------|-------|---------|
-| qBittorrent | :8080 | `admin / Joker1974!!!` | — |
-| Sonarr | :8989 | `admin / Joker1974!!!` | `b43e04350a594846b4ee95261c29e9e0` |
-| Radarr | :7878 | `admin / Joker1974!!!` | `53c4268360444feeae5f98c0cc24e0e3` |
-| Prowlarr | :9696 | `admin / Joker1974!!!` | `9d0ce6c5660743b5bf1c7951efc62252` |
-
-**All services run as root** — required by Synology NFS ACL (only root can write).
-
-**VPN:** NordVPN — `nordlynx` WireGuard interface — exit IP 181.214.226.188 (US Dallas)  
-All download traffic exits via NordVPN. If downloads stall, check: `ip rule show` for rules 32764/32765.
-
-**Media Flow:**
-```
-IPTorrents (Prowlarr) → Sonarr/Radarr search → qBittorrent download
-→ /mnt/nas/video/downloads (NAS)
-→ Sonarr/Radarr import → /mnt/nas/video/tv or /mnt/nas/video/movies (NAS)
-→ NFS → Jellyfin /mnt/mediastack/movies or /mnt/mediastack/tv
-```
-
-**Indexer:** IPTorrents via Prowlarr cookie auth  
-Cookie: `uid=2237410; pass=JzLP2niTWxBJAZIU3yvtLbJzD55kdLeB`  
-(Expires — if search fails, log into iptorrents.com, copy uid+pass cookies)
-
-**If Radarr/Sonarr shows "0 active indexers":**
-```bash
-systemctl stop radarr
-sqlite3 /var/lib/radarr/radarr.db "DELETE FROM IndexerStatus WHERE ProviderId=1;"
-systemctl start radarr
-```
-
-**SSH from DO:**
-```bash
-sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.90 \
-  'ssh -o StrictHostKeyChecking=no -i /root/.ssh/id_rsa root@10.48.200.35 "COMMAND"'
-```
-
---
-
-### VM 118 — Homebridge (PVE1)
-| Field | Value |
-|-------|-------|
-| **IP** | 10.48.200.18 |
-| **OS** | Linux |
-| **SSH** | `ssh myron@10.48.200.18` — password: `Joker1974!` |
-| **Purpose** | Apple HomeKit bridge — exposes non-HomeKit devices to Apple Home app |
-| **JARVIS Agent** | ID: `homebridge_b57cbaea` |
-
---
-
-### VM 120 — NovaCPX Hosting Panel (PVE1)
-| Field | Value |
-|-------|-------|
-| **IP** | 10.48.200.110 |
-| **OS** | Ubuntu 24.04 LTS |
-| **SSH** | `ssh root@10.48.200.110` — password: `Joker1974!!!` (direct, no PVE hop) |
-| **Purpose** | Custom web hosting control panel (cPanel alternative), v1.0.27 |
-| **JARVIS Agent** | ID: `novacpx_e3b07264` |
-
-**Ports:**
-| Port | Panel |
-|------|-------|
-| :8880 | User panel |
-| :8881 | Reseller panel |
-| :8882 | Admin panel |
-| :8883 | Roundcube webmail |
-
-**Admin:** `https://10.48.200.110:8882` — `admin / Admin2026!`  
-**phpMyAdmin:** `http://10.48.200.110/phpmyadmin`
-
-**File Paths:**
- Web root: `/srv/novacpx/public/`
- DB (SQLite): `/var/lib/novacpx/panel.db`
- Config: `/etc/novacpx/config.ini`
- Git repo: `/opt/novacpx-src/`
- GitHub: `myronblair/novacpx` (auto-deploy on push to `main`)
-
---
-
-### VM 210 — Ollama Local LLM (PVE1)
-| Field | Value |
-|-------|-------|
-| **IP** | 10.48.200.95 |
-| **OS** | Ubuntu (cloud image) |
-| **SSH** | `ssh myron@10.48.200.95` — password: `Joker1974!` (then `sudo`) |
-| **Purpose** | Local AI inference — runs llama3.2 model for JARVIS Tier 1 chat |
-| **API** | `http://10.48.200.95:11434` (Ollama REST API) |
-| **JARVIS Agent** | ID: `ollama-ai_ubuntu` |
-
-**JARVIS uses this as Tier 1 AI** — if Ollama is down, falls back to Groq (cloud).
-
---
-
-### VM 302 — NetworkBackup (PVE2)
-| Field | Value |
-|-------|-------|
-| **IP** | 10.48.200.99 |
-| **OS** | Ubuntu/Linux |
-| **SSH** | `ssh myron@10.48.200.99` — password: `Joker1974!` (then `sudo`) |
-| **Purpose** | Network backup storage / backup operations |
-| **JARVIS Agent** | ID: `networkbackup_NetworkB` |
-
---
-
-### CT110 — WireGuard Exit Container (PVE1)
-| Field | Value |
-|-------|-------|
-| **IP** | 10.48.200.19 / 10.48.200.67 |
-| **Purpose** | Legacy WireGuard exit tunnel to DO (10.200.0.4 via wg-exit) — currently NOT used by MediaStack/Jellyfin |
-| **Note** | MediaStack uses NordVPN directly; Jellyfin uses wg1 peer on MediaStack for NFS only |
-
---
-
-## 5. NAS STORAGE
-
-### Synology NAS
-| Field | Value |
-|-------|-------|
-| **IP** | 10.48.200.249 |
-| **Login** | `nas / Joker1974!!!` |
-| **DSM Web UI** | `http://10.48.200.249:5000` |
-| **Purpose** | Primary media and download storage |
-
-**NFS Share:** `/volume1/video` (exported to MediaStack only)
-
-**Directory structure:**
-```
-/volume1/video/
-  movies/       ← Radarr imports here; NFS-exported to Jellyfin via MediaStack
-  tv/           ← Sonarr imports here; NFS-exported to Jellyfin via MediaStack
-  downloads/    ← qBittorrent downloads here (temp)
-    incomplete/ ← in-progress torrents
-```
-
-**Important:** Synology NFS ACL only allows root to write. All services on MediaStack run as root.
-
---
-
-## 6. WEBSITES (ALL ON DO)
-
-All sites are at `/home/<domain>/public_html/` on DO (165.22.1.228).  
-**Auto-deploy:** Push to `main` on GitHub → webhook → server pulls in ~1 min.  
-**GitHub PAT:** `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` (expires ~2026-08-20)
-
---
-
-### jarvis.orbishosting.com — JARVIS AI Dashboard
-| Field | Value |
-|-------|-------|
-| **URL** | https://jarvis.orbishosting.com |
-| **Path** | `/home/jarvis.orbishosting.com/` |
-| **GitHub** | `myronblair/jarvis` |
-| **Login** | `myron / Joker1974!!!` |
-| **Purpose** | Iron Man-style AI home dashboard with voice control, smart home, media, planner |
-
-See Section 7 for full JARVIS details.
-
---
-
-### tomsjavajive.com — Tom's Java Jive
-| Field | Value |
-|-------|-------|
-| **URL** | https://tomsjavajive.com |
-| **Path** | `/home/tomsjavajive.com/public_html/` |
-| **GitHub** | `myronblair/tomsjavajive` |
-| **Purpose** | Coffee shop e-commerce — products, orders, loyalty, wallet, reviews |
-| **Admin URL** | `https://tomsjavajive.com/admin/` |
-| **Admin Login** | `admin@tomsjavajive.com / Joker1974!!!` OR `myronblair@outlook.com / Joker1974!!!` |
-| **DB** | `toms_tjj_db / toms_tjj_user / +60wlPc+55e@gFq4` |
-| **Email** | CyberMail API key: `sk_live_7f9b0f9a29f6de31a0d229d4af75d56b094ad724fc58a57d` |
-| **Email From** | `noreply@tomsjavajive.com` / `Toms Java Jive` (set in DB settings table) |
-
---
-
-### epictravelexpeditions.com — Epic Travel Expeditions
-| Field | Value |
-|-------|-------|
-| **URL** | https://epictravelexpeditions.com |
-| **Path** | `/home/epictravelexpeditions.com/public_html/` |
-| **GitHub** | `myronblair/epictravelexpeditions` |
-| **Purpose** | Travel booking / expeditions website |
-| **DB** | `epic_travel_db` (see `api/config.php`) |
-
---
-
-### parkerslingshot.epictravelexpeditions.com — Parker Slingshot (OLD)
-| Field | Value |
-|-------|-------|
-| **URL** | https://parkerslingshot.epictravelexpeditions.com |
-| **Path** | `/home/epictravelexpeditions.com/parkerslingshot/` |
-| **GitHub** | `myronblair/parkerslingshot` |
-| **Purpose** | Old slingshot rental site (superseded by parkerslingshotrentals.com) |
-
---
-
-### parkerslingshotrentals.com — Parker Slingshot Rentals (LIVE)
-| Field | Value |
-|-------|-------|
-| **URL** | https://www.parkerslingshotrentals.com |
-| **Path** | `/home/parkerslingshotrentals.com/public_html/` |
-| **GitHub** | `myronblair/parkerslingshotrentals` |
-| **Purpose** | Polaris Slingshot rental — bookings, e-signature waiver, admin management |
-| **Admin** | `/admin/index.php` — `admin / Parker2026!` |
-| **DB** | `park_slingshot / park_slingshotuser / 4@rxg*8kovxCr7w6` |
-| **Square** | Production token: `EAAAl3FsAu_2ri8kZE_ENEyi2T_C8HXXm5XQFY6Lbnd8SX6FqYp8J_upUeXNYh7v` |
-
---
-
-### orbishosting.com — Orbis Hosting (Landing Page)
-| Field | Value |
-|-------|-------|
-| **URL** | https://orbishosting.com |
-| **Path** | `/home/orbishosting.com/public_html/` |
-| **GitHub** | `myronblair/orbishosting` |
-| **Purpose** | Public landing page for Orbis Hosting brand |
-
---
-
-### orbis.orbishosting.com — Orbis Hosting Portal
-| Field | Value |
-|-------|-------|
-| **URL** | https://orbis.orbishosting.com |
-| **Path** | `/home/orbis.orbishosting.com/public_html/` |
-| **GitHub** | `myronblair/orbis-hosting-portal` |
-| **Purpose** | Customer-facing hosting portal |
-
---
-
-### tomtomgames.com — TomTom Games
-| Field | Value |
-|-------|-------|
-| **URL** | https://tomtomgames.com |
-| **Path** | `/home/tomtomgames.com/public_html/` |
-| **GitHub** | `myronblair/tomtomgames` |
-| **Purpose** | Gaming website |
-| **DB** | `tomtom_games_db` (see config) |
-| **Email** | CyberMail API key: `sk_live_7f9b...` |
-
---
-
-## 7. JARVIS AI SYSTEM
-
-**URL:** https://jarvis.orbishosting.com  
-**Files:** `/home/jarvis.orbishosting.com/` on DO  
-**DB:** `jarvis_db` — `jarvis_user / J4rv1s_Pr0t0c0l_2026!`  
-**Login:** `myron / Joker1974!!!`  
-**Admin portal:** https://jarvis.orbishosting.com/admin
-
-### Architecture (end-to-end)
-
-```
-Voice (browser mic)
-  → SpeechRecognition API
-  → Wake phrase: "wake up JARVIS" / "daddy's home"
-  → "JARVIS [command]" triggers action
-  → /api/chat.php (4-tier AI)
-       Tier 0.7: KB intents / planner (tasks, appointments)
-       Tier 1:   Knowledge Base (MySQL)
-       Tier 1.5: Ollama (10.48.200.95:11434, llama3.2) — local LLM
-       Tier 2:   Groq (cloud, model: compound-beta-mini)
-       Tier 3:   Claude API (Anthropic, fallback)
-  → ElevenLabs TTS → browser speaker
-```
-
-### Deploy Pipeline
-```
-Code edit → git push → GitHub webhook → /webhook.php (HMAC verified)
-→ /tmp/jarvis-deploy-queue.txt → /usr/local/bin/jarvis-deploy.sh (cron 1min)
-→ git pull + PHP syntax check → deploy or auto-revert
-```
-Webhook secret: `4c8805f0285214ff0a0602b5880270b935f36a896946c7f1`
-
-### Agent System
-Agents installed on all servers — phone home every 10s (heartbeat) / 30s (metrics).  
-Registration key: `f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518`  
-Install command: `curl -sk https://jarvis.orbishosting.com/install-agent.sh | bash -s <hostname> <linux|proxmox>`
-
-### Self-Healing Watchdog
-`/usr/local/bin/jarvis-watchdog.sh` — runs every 5 min (root cron on DO)  
-Restarts: lsws, mysql, redis if down  
-Restarts offline Proxmox VM agents via `qm guest exec`
-
-### Cron Jobs (DO server)
-| Schedule | Script | Purpose |
-|----------|--------|---------|
-| Every 1 min | `jarvis-deploy.sh` | Process GitHub deploy queue |
-| Every 3 min | `facts_collector.php` | Collect agent metrics, KB facts, site health |
-| Every 5 min | `stats_cache.php` | Weather, news, Proxmox stats refresh |
-| Every 5 min | `jarvis-watchdog.sh` | Self-healing: restart dead services |
-
---
-
-## 8. PHONE SYSTEM (FUSIONPBX)
-
-### Extensions
-| Ext | Name | Phone | IP | SIP Password |
-|-----|------|-------|----|-------------|
-| 1000 | Myron Blair — Desk | Yealink T48S | 10.48.200.2 | `Xk9mPw3nQv7rLs2t` |
-| 1001 | Tommy Ivy — Desk | Yealink T48S | 10.48.200.43 | `Tv8xNm4pWq6rZs3k` |
-| 1002 | Myron Blair — WiFi Work | Yealink AX86R | 10.48.200.65 | `yXHaJTwa8rj?$GkrVFQB` |
-| 1003 | Kitchen | Yealink T57W | 10.48.200.83 | — |
-| 1004 | Master Bedroom | Yealink T57W | 10.48.200.85 | — |
-| 1010 | Parker County Slingshot | Virtual (voicemail only) | — | — |
-| 1011 | Epic Travel Expeditions | Virtual (voicemail only) | — | — |
-| 1012 | Tom's Java Jive | Virtual (voicemail only) | — | — |
-| 900 | IVR | — | — | (auto-attendant) |
-
-**Phone SIP Settings (all phones):**
- Server: `134.209.72.226`
- Port: `5080`
- Transport: UDP
-
-**Provisioning URL:** `https://fusion.orbishosting.com/app/provision/`  
-(Username: `provision-master`, Password: `Joker1974!!!`)
-
-### Call Flow
-```
-Inbound (+18177645007)
-→ SignalWire → FusionPBX:5080 (UDP)
-→ signalwire-inbound dialplan (catch-all ^.*$)
-→ IVR ext 900 (ivr_menu_16k.wav)
-→ Routes to extensions 1000/1001/1002/1003/1004
-
-Outbound
-→ Phone → FusionPBX:5080
-→ signalwire gateway → SignalWire → PSTN
-```
-
-### FreeSWITCH CLI Commands
-```bash
-fs_cli -x "sofia status profile external reg"   # check registrations
-fs_cli -x "sofia xmlstatus gateway"             # check SignalWire gateway
-fs_cli -x "reloadxml"                           # reload config (safe)
-fs_cli -x "reloadacl"                           # reload ACL (safe)
-# AVOID: sofia profile external restart (drops all phone registrations)
-```
-
---
-
-## 9. NETWORKING & VPN
-
-### FortiGate Firewall
- WAN IP: 97.154.109.245 (dynamic)
- DDNS: `orbisne.fortiddns.com` (FortiGate auto-updates on IP change)
- Blocks: outbound port 53 (DNS) — MediaStack uses PVE1 dnsmasq (10.48.200.90) as resolver → 100.100.100.100
-
-**Port Forwards:**
-| External Port | Internal Destination | Purpose |
-|--------------|---------------------|---------|
-| :8006 | PVE1:8006 | Proxmox web UI |
-| :8123 | HA VM:8123 | Home Assistant |
-| :22 | HA VM:22 | HA SSH (unreliable) |
-
-### WireGuard — Jellyfin ↔ MediaStack
- MediaStack runs WireGuard server on `wg1` (port 51820, subnet 10.200.0.1/24)
- Jellyfin peer: 10.200.0.3 (active handshake)
- Used for NFS media file access ONLY — not internet VPN
-
-### NordVPN — MediaStack Internet Traffic
- Interface: `nordlynx` on MediaStack
- Exit IP: 181.214.226.188 (US Dallas)
- Policy routing: table 205 (all traffic via nordlynx), managed by `nordvpn-routing.service`
- Required for IPTorrents access (blocks non-VPN IPs)
-
---
-
-## 10. BACKUP SYSTEMS
-
-### DO Server Backup
- **Repo:** `myronblair/do-server-config`
- **Schedule:** Weekly, Sunday 4am
- **Launcher:** `/usr/local/bin/do-server-backup` on DO
- **Covers:** Scripts, systemd units, WireGuard, OLS vhosts, cron, MySQL credentials
- **Restore:** 8-phase wizard in `restore.sh`
- **DB backups:** `jarvis-backup.sh` runs daily (separate)
-
-### Proxmox Config Backup
- **Repo:** `myronblair/proxmox-config`
- **Schedule:** Weekly, Sunday 3am (both PVE1 and PVE2)
- **Launcher:** `/usr/local/bin/proxmox-backup` on each node
- **Covers:** VM .conf files, network, cron, systemd, scripts
- **VM disks:** Covered by Proxmox Backup Server (PBS)
-
-### FusionPBX Backup
- **Repo:** `myronblair/fusionpbx-config`
- **Schedule:** Weekly, Sunday 5am
- **Launcher:** `/usr/local/bin/fusionpbx-backup`
- **Covers:** PostgreSQL dump (gzip, ~29MB) + FreeSWITCH configs
- **Restore:** 10-phase wizard in `restore.sh`
-
---
-
-## 11. SSH QUICK REFERENCE
-
-```bash
-# DO (main web server)
-sshpass -p 'Gonewalk1974!@#' ssh -o StrictHostKeyChecking=no root@165.22.1.228
-
-# FusionPBX (must relay via DO)
-sshpass -p 'Gonewalk1974!@#' ssh root@165.22.1.228 \
-  'sshpass -p "Joker1974!@#" ssh root@134.209.72.226 "CMD"'
-
-# PVE1 (direct or via DDNS)
-sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@orbisne.fortiddns.com
-sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.90
-
-# PVE2
-sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.91
-
-# MediaStack (via PVE1)
-sshpass -p 'Joker1974!!!' ssh root@10.48.200.90 \
-  'ssh -i /root/.ssh/id_rsa root@10.48.200.35 "CMD"'
-
-# Jellyfin (direct, password enabled 2026-06-14)
-sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.33
-
-# NovaCPX (direct)
-sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.110
-
-# Ollama / Homebridge / NetworkBackup (myron user, then sudo)
-sshpass -p 'Joker1974!' ssh myron@10.48.200.95   # Ollama
-sshpass -p 'Joker1974!' ssh myron@10.48.200.18   # Homebridge
-sshpass -p 'Joker1974!' ssh myron@10.48.200.99   # NetworkBackup
-
-# Run command inside VM via Proxmox (requires QEMU agent installed)
-sshpass -p 'Joker1974!!!' ssh root@10.48.200.90 \
-  'qm guest exec 210 -- bash -c "CMD"'
-```
-
-**Password fallback order:** `Joker1974!@#` → `Joker1974!!!` → `Joker1974!`
-
---
-
-## 12. CRITICAL CREDENTIALS MASTER LIST
-
-### SSH / Root Access
-| System | User | Password | Notes |
-|--------|------|----------|-------|
-| DO (165.22.1.228) | root | `Gonewalk1974!@#` | Main web server |
-| FusionPBX (134.209.72.226) | root | `Joker1974!@#` | Via DO relay |
-| PVE1 (10.48.200.90) | root | `Joker1974!!!` | Also via DDNS |
-| PVE2 (10.48.200.91) | root | `Joker1974!!!` | |
-| MediaStack (10.48.200.35) | root | key only | Via PVE1 (`/root/.ssh/id_rsa`) |
-| Jellyfin (10.48.200.33) | root | `Joker1974!!!` | Enabled 2026-06-14 |
-| NovaCPX (10.48.200.110) | root | `Joker1974!!!` | Direct SSH works |
-| Ollama / Homebridge / Backup VMs | myron | `Joker1974!` | Then sudo |
-
-### Web Panels & Admin
-| System | URL | User | Password |
-|--------|-----|------|----------|
-| CyberPanel | https://165.22.1.228:8090 | myron | `Joker1974!!!` |
-| phpMyAdmin (DO) | https://165.22.1.228/phpmyadmin | myron | `Joker1974!!!` |
-| Proxmox PVE1 | https://orbisne.fortiddns.com:8006 | root | `Joker1974!!!` |
-| Proxmox PVE2 | https://10.48.200.91:8006 | root | `Joker1974!!!` |
-| JARVIS | https://jarvis.orbishosting.com | myron | `Joker1974!!!` |
-| JARVIS Admin | https://jarvis.orbishosting.com/admin | myron | `Joker1974!!!` |
-| FusionPBX | https://fusion.orbishosting.com | admin | `fY7XP5swgtpbzrYLhkeVYkA4744` |
-| Home Assistant | http://orbisne.fortiddns.com:8123 | myron | (HA password) |
-| NovaCPX Admin | https://10.48.200.110:8882 | admin | `Admin2026!` |
-| Jellyfin | http://10.48.200.33:8096 | — | token: `7c0ccf78b91d4b5bafa607f585f24f2d` |
-| qBittorrent | http://10.48.200.35:8080 | admin | `Joker1974!!!` |
-| Sonarr | http://10.48.200.35:8989 | admin | `Joker1974!!!` |
-| Radarr | http://10.48.200.35:7878 | admin | `Joker1974!!!` |
-| Prowlarr | http://10.48.200.35:9696 | admin | `Joker1974!!!` |
-| Synology NAS | http://10.48.200.249:5000 | nas | `Joker1974!!!` |
-| Parker Slingshot Admin | https://parkerslingshotrentals.com/admin | admin | `Parker2026!` |
-| TJJ Admin | https://tomsjavajive.com/admin | `admin@tomsjavajive.com` OR `myronblair@outlook.com` | `Joker1974!!!` |
-
-### Databases
-| Site | DB Name | DB User | DB Password |
-|------|---------|---------|-------------|
-| JARVIS | `jarvis_db` | `jarvis_user` | `J4rv1s_Pr0t0c0l_2026!` |
-| Tom's Java Jive | `toms_tjj_db` | `toms_tjj_user` | `+60wlPc+55e@gFq4` |
-| Parker Slingshot Rentals | `park_slingshot` | `park_slingshotuser` | `4@rxg*8kovxCr7w6` |
-| Epic Travel | `epic_travel_db` | (see config.php) | (see config.php) |
-| Epic/Parker Slingshot | `epic_parkersling` | `epic_parkersling` | `Joker1974!!!` |
-| NovaCPX | SQLite: `/var/lib/novacpx/panel.db` | — | — |
-| FusionPBX | PostgreSQL | `fusionpbx` | `pSJaF9mUJqPr4Sj5mwJyRqvCCpc` |
-| MySQL root (DO) | — | root | `b71e5c1a8c7457541b9c1db822de37adfa271926a38b6c20` |
-
-### API Keys
-| Service | Key |
-|---------|-----|
-| GitHub PAT | `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` (exp ~2026-08-20) |
-| JARVIS Agent Registration | `f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518` |
-| Proxmox API Token | `root@pam!jarvis=c45b5feb-f9a9-445d-a626-14fbb959f78b` |
-| HA Long-lived Token | `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiIzNmI0N2I1Njk5ZGQ0MTQ2ODMwZWFmYjZiYTQ1MjJkMSIsImlhdCI6MTc4MDIwMzU5NCwiZXhwIjoyMDk1NTYzNTk0fQ.sYRok-jRDlA4lFgWxLQELcEjkJNGQdprk6ZziLwLtXE` |
-| Sonarr API | `b43e04350a594846b4ee95261c29e9e0` |
-| Radarr API | `53c4268360444feeae5f98c0cc24e0e3` |
-| Prowlarr API | `9d0ce6c5660743b5bf1c7951efc62252` |
-| Jellyfin Admin Token | `7c0ccf78b91d4b5bafa607f585f24f2d` |
-| Square (Parker) Production | `EAAAl3FsAu_2ri8kZE_ENEyi2T_C8HXXm5XQFY6Lbnd8SX6FqYp8J_upUeXNYh7v` |
-| Square App ID (Parker) | `sq0idp-YSM7BU9IVyOWSzpeP-0nzQ` |
-| Webhook HMAC Secret | `4c8805f0285214ff0a0602b5880270b935f36a896946c7f1` |
-
-### SIP / Phone
-| Extension | Name | SIP Password |
-|-----------|------|-------------|
-| 1000 | Myron Blair — Desk (10.48.200.2) | `Xk9mPw3nQv7rLs2t` |
-| 1001 | Tommy Ivy — Desk (10.48.200.43) | `Tv8xNm4pWq6rZs3k` |
-| 1002 | Myron Blair — WiFi Work (10.48.200.65) | `yXHaJTwa8rj?$GkrVFQB` |
-| 1003 | Kitchen (10.48.200.83) | — |
-| 1004 | Master Bedroom (10.48.200.85) | — |
-| 1010 | Parker County Slingshot (voicemail only) | — |
-| 1011 | Epic Travel Expeditions (voicemail only) | — |
-| 1012 | Tom's Java Jive (voicemail only) | — |
-
---
-
-*This document contains sensitive credentials. Store securely and do not share.*
@@ -18,31 +18,3 @@ cp agent/config.json /opt/jarvis-agent/config.json
 systemctl enable jarvis-agent
 systemctl start jarvis-agent
 ```
-
-## Cloudflare Rocket Loader — IMPORTANT
-
-JARVIS (and all sites) sit behind Cloudflare with **Rocket Loader enabled**.
-Rocket Loader does two things that break JavaScript login forms:
-
-1. Changes `<script>` tag `type` to a fake value, deferring execution.
-2. Injects `if (!window.__cfRLUnblockHandlers) return false;` into **every**
-   `onclick=`, `onkeydown=`, and other inline HTML event attributes,
-   blocking them until Rocket Loader finishes loading.
-
-### Rules for any page with JavaScript that must run immediately:
-
- Add `data-cfasync="false"` to ALL `<script>` tags.
- **Never use inline event handler attributes** (`onclick=`, `onkeydown=`, etc.)
-  on HTML elements — Rocket Loader will block them.
- Attach all event listeners via `addEventListener()` in JavaScript.
- Use `XMLHttpRequest` instead of `fetch()` for auth calls (more compatible).
- Put scripts **after** their target DOM elements (end of body), not in `<head>`,
-  so the elements exist when the script runs without needing DOMContentLoaded.
-
-### Current login implementation (jarvis repo: public_html/login.html)
-
-Standalone `/login.html` page handles all auth. `index.html` redirects to
-`/login.html` if no `jarvis_token` in sessionStorage.
- Script is at end of body, after elements, with `data-cfasync="false"`
- All handlers attached via `addEventListener` — no inline attributes
- Uses XHR (not fetch) to POST to `/api/auth`
@@ -0,0 +1,29 @@
+# Memory Index
+
+- [FusionPBX Setup](project_fusionpbx.md) — DO 134.209.72.226; SignalWire SIP trunk (transport=udp required); ext 1000/1001/1002; IVR 900; signalwire-inbound catch-all dialplan; providers ACL includes FortiGate 97.154.109.245
+- [Yealink API](feedback_yealink_api.md) — PKCS1v15+AES-CBC login; token required for writes; account-register page; correct field names (server1, AccountRegisterName, etc.)
+- [Yealink Phone Status](project_yealink_phones.md) — Ext 1000 (Myron/.2) + ext 1001 (Tommy/.43) registered; provisioning URL set; BLF buttons in progress
+- [JARVIS System](project_jarvis.md) — Iron Man AI on DO 165.22.1.228; /admin portal; PVE1 nmap auto-scan; agents on all nodes; Proxmox cluster API via FortiGate DDNS:8006
+- [JARVIS HA Integration](project_jarvis_ha_integration.md) — Two-way HA↔JARVIS via custom component; 212 entities live; webhook fix; HA SSH via web terminal only
+- [Web Server](project_webserver.md) — CyberPanel/OpenLiteSpeed DO at 165.22.1.228 (root/Gonewalk1974!@#); tomsjavajive.com + 5 other sites; IP changed from 206.189.229.53
+- [GitHub Workflow](feedback_github_workflow.md) — All sites have private GitHub repos (myronblair/*); commit+push to GitHub THEN deploy to server for every change; repo map + gitignored creds inside
+- [Tom's Java Jive](project_tomsjavajive.md) — DB creds, admin portal map, schema quirks (no slug col, enum values, collation), bugs fixed 2026-05-22
+- [TJJ Email](project_tomsjavajive_email.md) — CyberMail (CyberPersons); API key in config.php as CYBERMAIL_API_KEY; mgmt at platform.cyberpersons.com
+- [TomTomGames Email](project_tomtomgames_email.md) — CyberMail API key sk_live_7f9b...; mailer.php uses cybermailSend(); sendgridSend() aliased; verified 2026-06-06
+- [SMTP Credentials (all sites)](project_smtp_credentials.md) — All 5 sites on CyberMail, same API key, all verified 2026-06-06; TJJ reads from settings DB table; TJJ email_cybermail bad key fixed
+- [PHP ob_start Export Fix](feedback_php_ob_export.md) — ob_end_clean() required before CSV/JSON responses when ob_start()+header.php pattern is used
+- [MySQL Collation](feedback_mysql_collation.md) — Always utf8mb4_unicode_ci; mixing with general_ci breaks JOINs (error 1267)
+- [Parker Slingshot Rentals](project_parkerslingshotrentals.md) — parkerslingshotrentals.com booking site; HMAC cookie admin auth (not sessions); Square creds stored; 6-step booking flow
+- [SSH Passwords](feedback_ssh_passwords.md) — Try Joker1974!@# → Joker1974!!! → Joker1974!; root direct on PVE; myron/Joker1974!!! + sudo on VMs
+- [Yealink Provisioning](feedback_yealink_provisioning.md) — overwrite_mode=1 required; BLF type=16 in FusionPBX; auto_linekeys=0; factory reset clears URL; git safe.directory for www-data
+- [Cloudflare Rocket Loader](feedback_cloudflare_rocket_loader.md) — breaks inline onclick= handlers and defers scripts; fix with Cache-Control: no-transform in PHP
+- [MediaStack VM](project_mediastack.md) — VM 113 on PVE1; all services admin/Joker1974!!!; NordVPN (not CT110); IPTorrents uid=2237410 cookie; download dirs must be qbittorrent-owned; NFS to Jellyfin
+- [NovaCPX Panel](project_novacpx.md) — VM 120 @ 10.48.200.110 (direct SSH works); v1.0.27; admin/Admin2026!; stable/beta channels; JARVIS agent online; 140-app Docker catalog
+- [NovaCPX Dev Tools](project_novacpx_tools.md) — Direct SSH/SCP to 10.48.200.110 (PVE1 hop broken); API session-cookie auth pattern; key VM paths
+- [Proxmox Config Backup](project_proxmox_backup.md) — myronblair/proxmox-config; weekly cron on PVE1+PVE2; restore.sh wizard; VM configs + network + scripts + systemd; PBS covers VM disks
+- [DO Server Backup](project_do_backup.md) — myronblair/do-server-config; weekly cron Sunday 4am; scripts/systemd/WG/OLS vhosts/mysql; restore.sh 8-phase wizard; DBs covered by jarvis-backup.sh daily
+- [FusionPBX Backup](project_fusionpbx_backup.md) — myronblair/fusionpbx-config; weekly cron Sunday 5am; PostgreSQL dump (gzip, 29MB) IS the config; restore.sh 10-phase wizard; SSH via DO relay only
+- [Context Management](feedback_context_management.md) — Warn before context limit; finish/commit current task cleanly; don't start large features if context is already long
+- [JARVIS TODO](project_jarvis_todo.md) — Master TODO: Workers page, Phase 2/3 modularization, agent fixes, install-agent.sh, Arc Reactor systemd, Jellyfin, Claude credits
+- [Cryptex Safe](user_cryptex.md) — Physical 3D-printed Cryptex key: NEBYMJ (Creality K2 Pro)
+- [Infrastructure TODO](project_infra_todo.md) — Open items: CT110 read-only fs, wg-clients auto-start, MediaStack guest agent, Tailscale PVE1 re-auth, stale ARP watch
@@ -0,0 +1,27 @@
+---
+name: feedback-cloudflare-rocket-loader
+description: Cloudflare Rocket Loader breaks inline JS event handlers and defers scripts — how to avoid and fix
+metadata: 
+  node_type: memory
+  type: feedback
+  originSessionId: dfc59a24-a903-4f91-8c76-331af763d3e6
+---
+
+Cloudflare Rocket Loader is enabled on all orbishosting.com sites and causes two distinct problems:
+
+1. **Script deferral** — changes `<script>` tag type to a fake value, preventing execution until Rocket Loader finishes loading. Breaks any JS that must run on page load.
+
+2. **Inline handler blocking** — injects `if (!window.__cfRLUnblockHandlers) return false;` into every `onclick=`, `onkeydown=`, etc. HTML attribute. Even if the function is defined, the click is blocked.
+
+**Why:** These are Cloudflare "performance optimizations" that can't be disabled without Cloudflare dashboard access (no API keys stored).
+
+**How to apply:** For any page with JavaScript that must work:
+- Add `Cache-Control: no-transform, no-store` response header — this tells Cloudflare not to modify the response. Use `ini_set('session.cache_limiter', '')` before session_start() or the session headers will override it.
+- Never use inline event handler attributes (`onclick=`, `onkeydown=`). Always use `addEventListener()`.
+- The main JARVIS app (jarvis.orbishosting.com) is now served via `index.php` which adds this header automatically.
+
+**Current solution (2026-06-01):**
+- Login: `login.php` (pure PHP form POST, no JS) with `Cache-Control: no-transform`
+- Entry point: `index.php` checks PHP session, redirects to `login.php` if not auth'd
+- App served with token injected as `var __jarvisToken` global + CSS forcing loginScreen hidden
+- See [[project-jarvis]] for full architecture
@@ -0,0 +1,14 @@
+---
+name: feedback-context-management
+description: User wants to be warned before context limit and have tasks cleanly finished before running out
+metadata: 
+  node_type: memory
+  type: feedback
+  originSessionId: c454fc50-f93d-4ddd-b9f3-f3f442e89fb9
+---
+
+Warn the user proactively when the conversation is getting long and approaching the context limit — before a task is left in a broken/hanging state. Finish or save the current task cleanly, then let the user know the session needs to continue fresh.
+
+**Why:** User wants nothing left hanging when a session ends.
+
+**How to apply:** When making edits mid-feature, always commit and deploy what's done so far. Before starting something large when context is already long, warn the user and offer to continue in a new session rather than starting something that won't finish.
@@ -0,0 +1,43 @@
+---
+name: feedback-github-workflow
+description: Standing rule — all website and Jarvis changes must be committed to GitHub then deployed to the server
+metadata:
+  type: feedback
+  originSessionId: 002fe81e-7e03-414d-b842-1f94f1390a22
+---
+
+For every code change to any website or Jarvis: commit to GitHub first, then deploy to the live server. Never make changes directly without a git commit.
+
+**Why:** User explicitly requested this as a standing workflow on 2026-05-22.
+
+**How to apply:** After editing any file:
+1. `git add -A && git commit -m "description"` in the site root
+2. `git push origin main`
+3. Then SCP/SSH the changed files to the live server (or git pull if pull-based deploy is set up)
+
+## Repo Map
+
+| Site / Project | Server | Path | GitHub Repo |
+|---|---|---|---|
+| tomsjavajive.com | 165.22.1.228 | /home/tomsjavajive.com/public_html | myronblair/tomsjavajive |
+| epictravelexpeditions.com | 165.22.1.228 | /home/epictravelexpeditions.com/public_html | myronblair/epictravelexpeditions |
+| orbishosting.com | 165.22.1.228 | /home/orbishosting.com/public_html | myronblair/orbishosting |
+| orbis.orbishosting.com | 165.22.1.228 | /home/orbis.orbishosting.com/public_html | myronblair/orbis-hosting-portal |
+| parkerslingshotrentals.com | 165.22.1.228 | /home/parkerslingshotrentals.com/public_html | myronblair/parkerslingshotrentals |
+| tomtomgames.com | 165.22.1.228 | /home/tomtomgames.com/public_html | myronblair/tomtomgames |
+| JARVIS | 10.48.200.84 | /var/www/jarvis.orbishosting.com | myronblair/jarvis |
+
+## Gitignored Credentials (never in GitHub)
+- tomsjavajive: `config/database.php`
+- epictravelexpeditions: `api/config.php`
+- jarvis: `api/config.php`
+
+## Git on Servers
+- DO server (165.22.1.228): SSH as root, git runs as root, safe.directory set for all /home/*/public_html paths
+- Jarvis (10.48.200.84): SSH as myron, git requires `sudo` + explicit GIT_DIR/GIT_WORK_TREE env vars
+
+## PAT
+- **Token:** `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`
+- Embedded in all remote URLs on both servers (DO + Jarvis)
+- Expires ~90 days from 2026-05-22 (around 2026-08-20)
+- Rotate via: `git remote set-url origin https://myronblair:NEW_TOKEN@github.com/myronblair/REPO.git`
@@ -0,0 +1,17 @@
+---
+name: feedback-mysql-collation
+description: Always use utf8mb4_unicode_ci for new tables — mixing collations breaks JOINs with MySQL error 1267
+metadata:
+  type: feedback
+  originSessionId: 002fe81e-7e03-414d-b842-1f94f1390a22
+---
+
+All new tables in these MySQL databases must use `utf8mb4_unicode_ci` collation. Never use `utf8mb4_general_ci` or leave it at the server default without checking.
+
+**Why:** Mixing `utf8mb4_general_ci` and `utf8mb4_unicode_ci` in a JOIN causes MySQL error 1267: "Illegal mix of collations." This silently broke wishlist.php and reviews.php on tomsjavajive.com — pages returned 500 with no visible error until a diagnostic script revealed the PDO exception. Fixed by running `ALTER TABLE x CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci` on the mismatched tables.
+
+**How to apply:**
+- When writing `CREATE TABLE`, always include `COLLATE utf8mb4_unicode_ci`
+- When checking an existing table: `SHOW CREATE TABLE tablename\G` — look at the COLLATE line
+- Fix a bad table: `ALTER TABLE tablename CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci`
+- Affected tables on tomsjavajive.com that were wrong (now fixed): wishlist, loyalty_transactions, loyalty_tiers, product_types, loyalty_settings
@@ -0,0 +1,34 @@
+---
+name: feedback-php-ob-export
+description: PHP file export/AJAX handlers that run after ob_start()+header.php must call ob_end_clean() before sending headers
+metadata:
+  type: feedback
+  originSessionId: 002fe81e-7e03-414d-b842-1f94f1390a22
+---
+
+When a PHP admin page uses the pattern `ob_start()` + `require_once header.php` at the top, any handler that sends a non-HTML response (CSV download, JSON AJAX, redirect) must call `ob_end_clean()` before setting Content-Type headers and outputting content.
+
+**Why:** `ob_start()` buffers everything. `require_once header.php` fills the buffer with a full HTML page before any request-type checks run. Without `ob_end_clean()`, the browser receives the full HTML page *followed by* the CSV/JSON body — the export appears to download the entire rendered page instead of the file.
+
+**How to apply:** Any time I add a file export or AJAX handler to an admin page that uses this pattern:
+
+```php
+// ✅ correct
+if (isset($_GET['export'])) {
+    ob_end_clean(); // discard buffered HTML from header.php
+    header('Content-Type: text/csv; charset=UTF-8');
+    header('Content-Disposition: attachment; filename="export.csv"');
+    // ... output CSV ...
+    exit;
+}
+
+// ✅ correct for AJAX
+if ($action === 'inline_edit') {
+    ob_end_clean();
+    header('Content-Type: application/json');
+    echo json_encode(['ok' => true]);
+    exit;
+}
+```
+
+First discovered and fixed in `admin/import-export.php` on tomsjavajive.com (2026-05-22).
@@ -0,0 +1,21 @@
+---
+name: feedback-ssh-passwords
+description: SSH password rotation order for home lab servers; escalation path from myron to root
+metadata: 
+  node_type: memory
+  type: feedback
+  originSessionId: f0b18417-cc26-4fdf-87ec-7b2d69b02c44
+---
+
+Try passwords in this order when SSH password auth is needed for home lab hosts:
+
+1. `Joker1974!@#`
+2. `Joker1974!!!`
+3. `Joker1974!`
+
+Root login is allowed on Proxmox hosts (PVE1 10.48.200.90, PVE2 10.48.200.91) directly.
+On some VMs, login as `myron / Joker1974!!!` then `sudo su` or `sudo -i` to escalate to root.
+
+**Why:** User confirmed these are the rotating passwords used across the home lab.
+
+**How to apply:** Before trying key auth failures or giving up on SSH, cycle through these three variants. [[project-jarvis]]
@@ -0,0 +1,62 @@
+---
+name: feedback-yealink-api
+description: "Yealink T48S web API quirks — RSA/AES login, token-gated writes, correct page/field names for SIP account config"
+metadata: 
+  node_type: memory
+  type: feedback
+  originSessionId: 002fe81e-7e03-414d-b842-1f94f1390a22
+---
+
+Yealink T48S web API (firmware 66.86.0.15) — complete working flow:
+
+## Login (PKCS1v15 + AES-CBC hybrid)
+
+1. GET `/servlet?m=mod_listener&p=login&q=loginForm` — fetch RSA public key (`g_rsa_n`, `g_rsa_e`) and initial `JSESSIONID` cookie
+2. Generate random 16-byte AES key + IV; encrypt plaintext `{rand};{JSESSIONID};{password}` with AES-128-CBC zero-padding (NOT PKCS7), base64 result → `pwd`
+3. RSA-encrypt AES key hex string and IV hex string separately with PKCS1v15 → `rsakey`, `rsaiv`
+   - **Critical**: encrypt the ASCII hex string (e.g. `"a1b2c3..."`) not raw bytes — Yealink's `pkcs1pad2` uses `charCodeAt` per character
+   - **Critical**: AES key/IV hex must be **lowercase**
+4. POST `username=admin&pwd=<b64>&rsakey=<hex>&rsaiv=<hex>` to `/servlet?m=mod_listener&p=login&q=login` with `JSESSIONID` cookie
+5. Returns `{"authstatus":"done"}` on success; cookie jar updates with new JSESSIONID
+
+**Lockout**: 3 failed attempts → ~10 min lockout (polling the login page also resets the timer — stop ALL requests to the phone during lockout)
+
+## SIP Account Config (account-register page)
+
+- **Page**: `account-register` (NOT `account-basic` — that page only has anonymous-call advanced fields)
+- **Load**: GET `/servlet?m=mod_data&p=account-register&q=load`
+- **Write**: POST `/servlet?m=mod_data&p=account-register&q=write&token=<g_strToken>`
+  - Token is **required** — without it returns 403; with it returns 200 + empty `_RES_INFO_` div (that empty response IS success)
+  - Token comes from `g_strToken` variable in the loaded page HTML
+
+**Correct field names** for SIP account 1:
+| Field | Value |
+|-------|-------|
+| `var_accountID` | `0` (0-indexed) |
+| `AccountEnable` | `1` |
+| `AccountLabel` | display label |
+| `AccountDisplayName` | caller ID name |
+| `AccountRegisterName` | SIP auth username (e.g. `1000`) |
+| `AccountUserName` | SIP username (e.g. `1000`) |
+| `server1` | SIP server IP (e.g. `134.209.72.226`) |
+| `port1` | SIP port (e.g. `5080`) |
+| `Transport1` | `0` = UDP |
+| `Expires1` | registration expiry seconds |
+| `AccountPassword` | AES-encrypted password (same AES key/IV as login) |
+
+**Password encryption for writes**: Same AES-CBC approach as login — encrypt plaintext password bytes with zero-padding, base64 result → `AccountPassword`. Send same `rsakey` + `rsaiv` alongside.
+
+## Autoprovision Trigger
+
+GET `/servlet?m=mod_data&p=settings-autop&q=autopnow&token=<g_strToken>` → returns `{"ret":"ok","data":"3"}` on success
+
+## Reboot
+
+POST `/servlet?m=mod_data&p=settings-upgrade&q=write&type=reboot`
+
+## SIP Registration Status
+
+Load page contains JS: `ccStatus = g_json.ParseJSON(...)` with JSON like `{"Account1":"1000@134.209.72.226:2"}` — status codes: `0`=disabled, `1`=registered, `2`=registering, `3`=failed
+
+**Why:** All this was reverse-engineered from Yealink's `commonjs.js` (`pkcs1pad2` function) across multiple sessions after many failed approaches (textbook RSA, wrong plaintext format, wrong field names, missing token).
+**How to apply:** Use this as the reference any time we script Yealink T48S configuration via its web API. Scripts are saved at `/tmp/yfix_server.py` and `/tmp/ydiag_write.py` (on PVE1) as working examples.
@@ -0,0 +1,59 @@
+---
+name: feedback-yealink-provisioning
+description: Yealink T48S + FusionPBX provisioning — complete root causes and fixes for BLF buttons not showing
+metadata: 
+  node_type: memory
+  type: feedback
+  originSessionId: f0b18417-cc26-4fdf-87ec-7b2d69b02c44
+---
+
+**THE ROOT CAUSE OF BLF BUTTONS NOT SHOWING (confirmed fix 2026-05-29):**
+
+Yealink phones ignore DSS key settings in `.boot` files — they only apply them from `.cfg` files. FusionPBX's nginx rewrite for `{mac}.boot` stripped the `file=` param, so the phone received the full 122KB config as a `.boot` file and silently ignored all linekey settings.
+
+**Fix:** Two-part:
+1. Create `{$mac}.boot` template in `/var/www/fusionpbx/resources/templates/provision/yealink/t48s/` containing:
+   ```
+   #!version:1.0.0.1
+   include:config "y000000000065.cfg"
+   include:config "{$mac}.cfg"
+   overwrite_mode = 1
+   ```
+2. Change nginx rewrite in `/etc/nginx/sites-enabled/fusionpbx`:
+   - OLD: `rewrite "^.*/provision/([A-Fa-f0-9]{12})(\.boot)$" /app/provision/index.php?mac=$1;`
+   - NEW: `rewrite "^.*/provision/([A-Fa-f0-9]{12})(\.boot)$" /app/provision/index.php?mac=$1&file=%7b%24mac%7d.boot;`
+
+This makes `{mac}.boot` return a 164-byte boot file with includes. Phone then fetches `{mac}.cfg` as a `.cfg` file, applies ALL settings including DSS/BLF keys.
+
+**After provisioning on firmware 66.86.0.15:** Phone requires a physical power cycle to register and show BLF buttons. `Update Now` downloads the config but doesn't auto-reboot on this firmware.
+
+---
+
+**Other critical lessons:**
+
+**1. overwrite_mode = 1 is required** — default is 0, phone ignores all config changes after first provision.
+- Set in `{$mac}.boot` template (and all `y000000000000.boot` templates)
+
+**2. Factory reset clears the provisioning URL** — must re-enter manually:
+- Menu > Settings > Advanced (password: admin) > Auto Provision
+- Server URL: `https://fusion.orbishosting.com/app/provision/`
+- Username: `provision-master`, Password: `Joker1974!!!`
+- Then: Update Now → power cycle
+
+**3. BLF type = 16 in FusionPBX** (confirmed). NOT type=2 (Speed Dial), NOT type=3.
+- FusionPBX template uses type=16 for BLF (requires `pickup_value` field)
+- `{if type == "1" || type == "16"}` → pickup_value in `{$mac}.cfg` template confirms this
+
+**4. features.auto_linekeys.enable = 0** in `y000000000065.cfg` template — prevents phone firmware from auto-assigning SIP account over BLF keys.
+
+**5. External sofia profile: manage-presence = passive** (not true).
+- Internal profile: manage-presence = true (already correct in FusionPBX default)
+- External profile must be passive so BLF SUBSCRIBEs from phones on port 5080 delegate to internal
+- Fix: UPDATE v_sip_profile_settings SET value='passive' WHERE profile=external AND name='manage-presence'
+- Then delete `/var/cache/fusionpbx/FusionPBX.configuration.sofia.conf` and reload sofia
+
+**6. git safe.directory for www-data** — Fix: `git config --system --add safe.directory /var/www/fusionpbx`
+
+**7. After manual provision (Update Now):** phone may not register until power cycled, especially firmware 66.86.0.15.
+
+**How to apply:** When BLF buttons don't appear despite config downloading correctly, check: (1) is {mac}.boot returning 164 bytes or 122KB? (2) is external sofia profile passive? (3) did the phone power cycle after provisioning?
@@ -0,0 +1,47 @@
+---
+name: do-server-backup
+description: "DO server (165.22.1.228) config backup to GitHub — weekly cron, restore wizard, full rebuild guide"
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: c454fc50-f93d-4ddd-b9f3-f3f442e89fb9
+---
+
+GitHub repo `myronblair/do-server-config` (private) — all scripts, systemd units, WireGuard, OLS vhosts, cron, MySQL creds.
+
+**Why:** So the DO server (orbis) can be fully rebuilt after a droplet failure in ~90 minutes.
+
+## What's Backed Up
+- `scripts/` — jarvis-deploy.sh, jarvis-watchdog.sh, jarvis-backup.sh, jarvis-agent.py, ttg-backup.sh
+- `systemd/` — jarvis-agent.service, fastapi_ssh_server.service
+- `wireguard/` — wg0.conf (includes private keys — private repo)
+- `network/` — netplan 50-cloud-init.yaml, hosts, hostname
+- `cron/` — root_custom (JARVIS lines), root_full (everything)
+- `ols-vhosts/` — all 8 site OLS vhost configs
+- `mysql/` — /root/.my.cnf, database list
+- `infra/` — snapshot of /opt/infra/
+- `smtp-docs/` — /opt/smtp-for-websites/ docs
+
+## Schedule
+Weekly Sunday 4am: `0 4 * * 0 /usr/local/bin/do-server-backup >> /var/log/do-server-backup.log 2>&1`
+
+## Manual trigger
+`/usr/local/bin/do-server-backup` on DO server
+
+## What's NOT backed up
+- Website files (all in GitHub repos)
+- Databases (jarvis-backup.sh daily → /var/backups/jarvis/, 7-day retention)
+- SSL certs (re-issue via CyberPanel)
+- Gitignored configs (api/config.php files — recreate manually from examples)
+- CyberPanel itself (reinstall script: sh <(curl https://cyberpanel.net/install.sh))
+
+## Restore flow
+1. New Ubuntu 24.04 droplet
+2. `apt install git && git clone https://<PAT>@github.com/myronblair/do-server-config.git /opt/do-server-config`
+3. `bash /opt/do-server-config/restore.sh` (8-phase interactive wizard)
+4. Install CyberPanel, create sites, pull GitHub repos
+5. Restore DBs from jarvis-backup.sh archive
+6. Recreate gitignored config files
+
+## MySQL root password
+Z9Of4NVs6ji74x (also in mysql/my.cnf in repo)
@@ -0,0 +1,103 @@
+---
+name: fusionpbx-freeswitch-setup
+description: FusionPBX on DO 134.209.72.226; Yealink T48S ext 1000/1001/1002; SignalWire SIP trunk; inbound routing; provisioning
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: 84bfb029-16a6-4be4-aca0-308e896c1219
+---
+
+FusionPBX (FreeSWITCH) PBX on DigitalOcean 134.209.72.226.
+**SSH:** root / Joker1974!@# (must proxy via 165.22.1.228 — direct SSH blocked)
+**FusionPBX web:** https://fusion.orbishosting.com (admin / fY7XP5swgtpbzrYLhkeVYkA4744)
+**DB:** fusionpbx user / pSJaF9mUJqPr4Sj5mwJyRqvCCpc, host 127.0.0.1
+**Domain:** `134.209.72.226` (uuid: de6d867b-54d2-43f4-b1ed-8fd66803acac) — all devices under this domain
+
+## SIP Profile
+Only `external` profile running (port 5080, UDP+TCP). No internal profile.
+Phones register on external profile — non-standard but working.
+Key settings (2026-06-02):
+- `auth-calls = true`
+- `apply-inbound-acl = providers`
+- `proxy-media = true` (fixes NAT audio issues)
+- `aggressive-nat-detection = true`, `NDLB-force-rport = true`
+- `minimum-session-expires = 300`
+
+**Warning:** Every `sofia profile external restart` drops all phone registrations. Prefer `reloadxml` + `reloadacl` where possible.
+
+## Extensions
+- 1000: Myron Blair — Yealink T48S at 10.48.200.2, MAC 80:5e:c0:35:04:77, password `Xk9mPw3nQv7rLs2t`
+- 1001: Tommy Ivy — Yealink T48S at 10.48.200.43, password `Tv8xNm4pWq6rZs3k`
+- 1002: Home — Yealink AX86R at 10.48.200.65, password `yXHaJTwa8rj?$GkrVFQB`
+
+**1001 short registration:** Registers with ~120s expiry. Causes brief unavailability during re-reg. Fix properly by setting registration expiry to 3600s on the phone itself.
+
+## Phones NAT
+All phones come from FortiGate NAT IP **97.247.128.120** (updated 2026-06-17, was 97.154.109.245). This IP is in the `providers` ACL — required for both inbound call routing AND outbound calls from phones.
+
+## providers ACL (v_access_controls uuid: 47da18a2-6085-4740-a316-6d1bce8240b5)
+Contains: all SignalWire IP ranges (172.110.216.0/21 + individual IPs) + 97.247.128.120 (FortiGate/phones).
+
+## SignalWire Gateway
+- FusionPBX gateway name: `signalwire`, profile: `external`
+- Username: `fusion@orbis-hosting-0364f5f67488.sip.signalwire.com`
+- `register = false` (IP-based auth), state NOREG / status UP = correct
+
+**CRITICAL — transport=udp required:**
+SignalWire SIP Gateway External URI MUST be:
+`sip:18177645007@134.209.72.226:5080;transport=udp`
+Without `;transport=udp`, SignalWire uses TCP from 152.42.144.114 / 159.65.244.171 which FreeSWITCH silently drops (no log entry, no response). Only UDP from 172.110.223.179 works. 20/22 calls failed before this fix.
+
+## Inbound Call Routing (DID: +18177645007)
+SignalWire sends caller's number as Request-URI destination (not the DID) even with SIP Gateway configured. Single-mode Lua handler can't match this to v_destinations → falls to not-found.
+
+**Fix:** Global catch-all dialplan:
+- Name: `signalwire-inbound`, context: `public`, order: 100, domain_uuid: NULL
+- Expression: `^.*$` → `transfer 900 XML 134.209.72.226`
+- If deleted, calls fall through to not-found (404)
+
+Public dialplan order:
+1. caller-details (10, global, continue=true)
+2. signalwire-inbound (100, global) → IVR 900
+3. 18177645007 (100, domain-specific, expression ^(.*)$) → linked via v_destinations
+4. not-found (999, global)
+
+## IVR
+- Extension 900: active IVR, greeting: `ivr_menu_16k.wav`
+- Extension 800: old FIFO queue (disabled)
+- IVR dialplan in domain context 134.209.72.226, name "IVR", matches `^900$`
+
+## Yealink Provisioning
+URL: `https://fusion.orbishosting.com/app/provision/`
+Boot file: `{mac}.boot`, model cfg: `y000000000065.cfg`, device cfg: `{mac}.cfg`
+Yealink web login uses textbook RSA (no padding): encrypt password with g_rsa_n/g_rsa_e from login page using `pow(m,e,n)`.
+**Web lockout:** Multiple failed logins lock the web UI for several minutes.
+Provision trigger: `GET /servlet?p=autoprovision-cfg&q=autoprovision`
+Reboot API: `POST /servlet?p=reboot&q=reboot` (empty body)
+
+**2026-06-02 issue:** `yealink_firmware_t48s = t48s-66.81.0.110.rom` in v_default_settings caused phone to get stuck downloading non-existent firmware. Fixed by disabling that setting (enabled=false). Phone 1000 (10.48.200.2) had its config reset during this process.
+
+**Ext 1000 recovery:** If 1000 not registering — go to phone screen: Menu → Settings → Advanced → admin → Accounts → Account 1:
+server `134.209.72.226`, port `5080`, auth/user `1000`, password `Xk9mPw3nQv7rLs2t`
+
+## Key Commands
+```bash
+# Reload ACL without restart
+fs_cli -x "reloadacl"
+# Reload dialplan/XML config  
+fs_cli -x "reloadxml"
+# Restart external profile (drops registrations — avoid)
+fs_cli -x "sofia profile external restart"
+# Check registrations
+fs_cli -x "sofia status profile external reg"
+# Check gateway
+fs_cli -x "sofia xmlstatus gateway"
+# Clear dialplan cache
+rm -f /var/cache/fusionpbx/dialplan.public.*
+# Clear sofia profile cache
+rm -f /var/cache/fusionpbx/fusion.configuration.sofia.conf
+```
+
+## fail2ban Whitelist
+- 107.178.2.130 (office), 97.247.128.120 (home WAN — updated 2026-06-17, was 97.154.109.245)
+- sip-auth-ip iptables chain — can get the FortiGate IP blocked; check with `iptables -L sip-auth-ip -n`
@@ -0,0 +1,98 @@
+---
+name: fusionpbx-backup
+description: "FusionPBX (134.209.72.226) config backup to GitHub — weekly cron, restore wizard, PostgreSQL dump, full rebuild guide"
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: c454fc50-f93d-4ddd-b9f3-f3f442e89fb9
+---
+
+GitHub repo `myronblair/fusionpbx-config` (private) — PostgreSQL DB dump + FreeSWITCH configs + full rebuild guide.
+
+**Why:** FusionPBX stores ALL config in PostgreSQL — extensions, dialplans, SIP gateways, IVR, ring groups, devices, voicemail, users. The DB dump IS the backup.
+
+**How to apply:** Reference when discussing FusionPBX DR, the backup cron, or if the server needs to be rebuilt. See [[fusionpbx-freeswitch-setup]] for full FusionPBX operational config.
+
+## SSH Access (critical — port 22 firewalled from internet)
+Only accessible from: 107.178.2.130 (FortiGate home) and 97.154.109.245 (FortiGate secondary).
+**From anywhere else, relay through DO:**
+```bash
+sshpass -p 'Gonewalk1974!@#' ssh -o StrictHostKeyChecking=no root@165.22.1.228 \
+  'sshpass -p "Joker1974!@#" ssh -o StrictHostKeyChecking=no root@134.209.72.226 "command"'
+```
+
+## Repo Structure
+- `database/fusionpbx.sql.gz` — Full PostgreSQL dump (gzip compressed; 306MB raw → ~29MB)
+- `database/postgres_globals.sql` — PostgreSQL roles/passwords
+- `freeswitch/` — vars.xml, freeswitch.xml, extensions.conf, sip_profiles/, autoload_configs/
+- `fusionpbx-app/config.php` — DB credentials for FusionPBX web app
+- `nginx/fusionpbx.conf` — nginx config (includes provisioning URL rewrites)
+- `fail2ban/` — jail.local (trusted IPs: 107.178.2.130, 97.154.109.245)
+- `network/` — netplan 50-cloud-init.yaml, hosts, hostname
+- `systemd/` — 9 FusionPBX service units (active_calls, email_queue, event_guard, etc.)
+- `ssh/authorized_keys`
+- `recordings/` — call recordings (~4KB currently)
+
+## Schedule
+Weekly Sunday 5am: `0 5 * * 0 /usr/local/bin/fusionpbx-backup >> /var/log/fusionpbx-backup.log 2>&1`
+
+## Manual trigger
+`/usr/local/bin/fusionpbx-backup` on the fusion server (or via DO relay)
+
+## What's NOT backed up
+- SSL certs — re-issue: `certbot --nginx -d fusion.orbishosting.com`
+- FusionPBX web app `/var/www/fusionpbx/` — reinstalled by official installer
+- FreeSWITCH binary — installed by FusionPBX installer
+- Voicemail audio files — small, not critical
+
+## Full Rebuild Flow (30–45 min)
+
+### 1. New Debian 12 droplet
+Create fresh DO droplet, same region. SSH in (relay via DO if needed).
+
+### 2. Clone repo and run restore
+```bash
+apt update && apt install -y git
+git clone https://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@github.com/myronblair/fusionpbx-config.git /opt/fusionpbx-config
+bash /opt/fusionpbx-config/restore.sh
+```
+
+### 3. Restore script phases (interactive)
+1. SSH authorized_keys + hostname
+2. Run FusionPBX official installer (separate terminal, ~10-15 min):
+   `wget -O - https://raw.githubusercontent.com/fusionpbx/fusionpbx-install.sh/master/debian/install.sh | bash`
+   → When asked for domain: `fusion.orbishosting.com`
+3. **Critical: PostgreSQL restore** — stops all services, drops+recreates DB, restores from `.sql.gz`
+4. FreeSWITCH config files
+5. FusionPBX app config.php (DB credentials)
+6. nginx config
+7. fail2ban
+8. Recordings
+9. Backup script + cron
+10. SSL (manual: `certbot --nginx -d fusion.orbishosting.com`)
+
+### 4. Post-restore checks
+- Update fail2ban trusted IPs if FortiGate IP changed
+- Update Yealink provisioning URL if server IP changed (was 134.209.72.226)
+- Verify SignalWire trunk: FusionPBX → Accounts → Gateways
+- Delete Sofia XML cache: `rm /var/cache/fusionpbx/FusionPBX.configuration.sofia.conf`
+- Test ext 1000 (Myron Yealink T48S at 10.48.200.43)
+- Test ext 1001 (Tommy)
+- Test IVR 900
+
+## Key Credentials
+| Item | Value |
+|------|-------|
+| FusionPBX web | https://fusion.orbishosting.com (admin / fY7XP5swgtpbzrYLhkeVYkA4744) |
+| Root SSH | root / Joker1974!@# |
+| PostgreSQL | fusionpbx database, user fusionpbx |
+| Relay DO server | root@165.22.1.228 / Gonewalk1974!@# |
+
+## Architecture Notes
+- FusionPBX uses Lua XML handler — FreeSWITCH queries PostgreSQL via PHP/Lua for all routing. Static XML config in `/etc/freeswitch/` is mostly skeleton.
+- SignalWire SIP trunk uses `transport=udp` — TCP caused re-INVITE issues (gateway External URI must end in `;transport=udp`)
+- Ext 1000 (Yealink T48S) registers from behind FortiGate on port 5080 with `aggressive-nat-detection=true`
+- FusionPBX cache at `/var/cache/fusionpbx/FusionPBX.configuration.sofia.conf` — delete to force full Sofia reload
+
+## PostgreSQL Dump Size Note
+306MB uncompressed, 29MB gzipped. Exceeds GitHub's 100MB limit uncompressed. Must use gzip (`pg_dump | gzip > fusionpbx.sql.gz`). Restore.sh handles both `.sql.gz` (zcat) and plain `.sql` formats.
@@ -0,0 +1,79 @@
+---
+name: project-infra-todo
+description: Infrastructure TODO list — outstanding issues and fixes needed across homelab
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: b1e93a6a-f101-4ea4-aafb-9cb7e2958821
+---
+
+# Infrastructure TODO
+
+Last updated: 2026-06-28
+
+---
+
+## 🔴 OPEN
+
+- [x] **Synology iSCSI → Proxmox storage** — COMPLETE 2026-06-27. SynologyLVM (lvmthin, 1.86TB) active. SynologyiSCSI raw device also added. NAS at 10.48.200.249, IQN: iqn.2000-01.com.synology:NAS.Target-1.6296e09c4cb. Set as default Proxmox storage. NAS hostname fixed in /etc/hosts (was resolving to Tailscale IP — root cause of past VM corruptions). SynologyProx CIFS stays for backups/ISOs.
+
+- [ ] **FortiGate DNS + Synology Reverse Proxy for all VMs** — Use Synology's built-in Reverse Proxy (DSM → Control Panel → Application Portal → Reverse Proxy) instead of NPM. FortiGate DNS overrides point all .lan domains → 10.48.200.249 (Synology). NPM kept but no longer primary.
+  - **Step 1 — FortiGate DNS**: https://192.168.20.1 (admin / Joker1974!!!) → Network → DNS → Local DNS Records. Each .lan entry → 10.48.200.249
+  - **Step 2 — Synology Reverse Proxy rules** (DSM → Control Panel → Application Portal → Reverse Proxy):
+    | Source FQDN | Destination IP | Port | Notes |
+    |------------|----------------|------|-------|
+    | proxmox.lan | 10.48.200.90 | 8006 | HTTPS backend, enable WebSocket |
+    | jarvis.lan | 10.48.200.211 | 80 | HTTP |
+    | hoa.lan | 10.48.200.97 | 8123 | HTTP, **enable WebSocket** (HA requires it) |
+    | homebridge.lan | 10.48.200.18 | 8581 | HTTP |
+    | jellyfin.lan | 10.48.200.33 | 8096 | HTTP, enable WebSocket |
+    | novacpx.lan | 10.48.200.110 | 8882 | HTTPS backend |
+    | sonarr.lan | 10.48.200.35 | 8989 | HTTP |
+    | radarr.lan | 10.48.200.35 | 7878 | HTTP |
+    | qbit.lan | 10.48.200.35 | 8080 | HTTP |
+    | ollama.lan | 10.48.200.210 | 11434 | HTTP |
+    | npm.lan | 10.48.200.200 | 81 | HTTP |
+    | nas.lan | 10.48.200.249 | 5001 | HTTPS (DSM itself) |
+  - **Step 3 — Client DNS**: Set Windows DNS to FortiGate (192.168.20.1) or PVE1 (10.48.200.90) so .lan resolves
+  - **WebSocket**: Must be enabled on proxmox.lan, hoa.lan, jellyfin.lan rules or those UIs will break
+
+- [ ] **Home Assistant VM109 post-boot setup** — HA is booting (supervisor starting). Once port 8123 is up:
+  1. Restore Google Drive backup (file ID: `1mLE1S9dSvxl0RYQnCt020WT-UZnQuxqP`)
+  2. Install Tailscale addon (go to Supervisor > Add-on Store)
+  3. Re-integrate JARVIS ↔ HA (212 entities)
+  4. Resize disk from 32GB → 150GB (`qm resize 109 sata0 +118G` while VM stopped, then resize partition inside HA)
+
+
+
+- [x] **CT110 WireGuard filesystem read-only** — fsck run, filesystem clean and rw. wg-clients.conf updated with new MediaStack pubkey. 2026-06-24.
+
+- [x] **CT110 wg-clients auto-start** — added `/etc/local.d/wg-clients.start` (OpenRC local service). wg-clients comes up on boot. 2026-06-24.
+
+- [x] **MediaStack QEMU guest agent** — installed and running, `qm guest exec 103` verified working 2026-06-24.
+
+- [x] **Tailscale re-auth on PVE1** — completed 2026-06-24.
+
+- [x] **NovaCPX stale ARP fix permanence** — static ARP for 10.48.200.201 (bc:24:11:67:1d:47) set as PERMANENT via systemd `static-arp.service` on NovaCPX, enabled on boot 2026-06-24.
+
+- [x] **web.orbishosting.com — Ollama link** — verified working 2026-06-24.
+
+- [x] **MediaStack backup to new storage** — VM 103 disk now on GoFlex storage. Backup job runs nightly at 21:00 to SynologyProx and backs up VM regardless of disk location. Verified 2026-06-24.
+
+- [x] **NAS Git Server — Hybrid Mirror Setup** — COMPLETE 2026-06-29. Gitea 1.26.4 (ARM64) on Synology NAS at 10.48.200.249:3000, HTTPS at gitea.orbishosting.com. All 25 GitHub repos mirrored (every 8h). 4 private NAS-only repos: infra-private, fortigate-config, proxmox-secrets, jarvis-secrets. Auto-starts on boot via /usr/local/etc/rc.d/gitea.sh. Added to web.orbishosting.com dashboard.
+
+- [x] **Synology NAS → FortiSwitch** — COMPLETE 2026-06-28. NAS LAN2 → FortiSwitch Port 6, NAS LAN1 → FortiSwitch Port 7. Bonding configured as **Adaptive Load Balancing (ALB)** in Synology DSM (802.3ad LACP not available on FortiGate 60F FortiOS for managed FortiSwitch via CLI or GUI). ALB provides outbound load balancing + redundancy without switch LACP support. NAS remains at 10.48.200.249.
+
+---
+
+## ✅ COMPLETED (2026-06-24 session)
+
+- [x] MediaStack VM 103 restored from 2026-06-23 backup (I/O errors on Synology disk)
+- [x] MediaStack disk moved off Synology to new storage
+- [x] WireGuard kill-switch rebuilt on MediaStack — new keypair, CT110 peer updated, hardcoded fwmark, LAN exception correct
+- [x] WireGuard tunnel verified — exits via DO (165.22.1.228), handshake active
+- [x] Ollama listening on 0.0.0.0:11434 (was 127.0.0.1 only) — added systemd override
+- [x] CT110 LAN IP corrected to 10.48.200.67 (was wrongly documented as 10.48.200.19)
+- [x] NovaCPX 502s fixed — flushed stale ARP on NovaCPX for NPM's IP
+- [x] web.orbishosting.com WireGuard CT link updated to 10.48.200.67
+- [x] JARVIS admin URL updated to https://jarvis.orbishosting.com/admin/ everywhere
+- [x] web.orbishosting.com — Downloads card added (INFRASTRUCTURE-REFERENCE.md, syncs daily from JARVIS)
@@ -0,0 +1,167 @@
+---
+name: project-jarvis
+description: "JARVIS AI Iron Man HUD — DigitalOcean 165.22.1.228; full admin portal at /admin; network auto-scan via PVE1; GitHub: myronblair/jarvis"
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: f0b18417-cc26-4fdf-87ec-7b2d69b02c44
+---
+
+JARVIS is hosted on **PVE1 VM 211** (10.48.200.211), migrated from DO 2026-06-18. URL: https://jarvis.orbishosting.com (via NPM → VM 211). Admin: https://jarvis.orbishosting.com/admin/
+
+**How to apply:** Files at `/var/www/jarvis/` on VM 211. SSH: `sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.211`
+
+## Credentials
+- Login: myron / Joker1974!!!
+- DB: jarvis_db / jarvis_user / J4rv1s_Pr0t0c0l_2026!
+- MySQL root: b71e5c1a8c7457541b9c1db822de37adfa271926a38b6c20
+- phpMyAdmin: /phpmyadmin (myron / Joker1974!!!)
+- HA token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJjZmQyMTYxNzdkZGY0MGQ5YjlkNjFhMTFiZmViZTNhNCIsImlhdCI6MTc3OTI0MTI2MywiZXhwIjoyMDk0NjAxMjYzfQ.wD3yYiCHh6iEuH1mZckg4dgr3zOJHLmlMj_N0OyzdR4
+- Agent registration key: f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518
+- Proxmox API token: root@pam!jarvis=c45b5feb-f9a9-445d-a626-14fbb959f78b
+
+## Network Map (verified 2026-06-17)
+
+### PVE1 VMs (10.48.200.90, orbisne.fortiddns.com)
+| VMID | Name | IP | Agent ID | Status |
+|------|------|----|----------|--------|
+| 100 | SynchroNet-50 | 10.48.200.50 | none | running |
+| 101 | HomeAssistant-97 | 10.48.200.97 | homeassistant_ha | online |
+| 102 | UmbrelOS | DHCP | none | running |
+| 104 | Windows10-DHCP | DHCP | none | running |
+| 105 | Frigate | DHCP | none | running — **not in use, no integration planned** |
+| 112 | Jellyfin-33 | 10.48.200.33 | jellyfin_7e386833 | online (fixed 2026-06-17) |
+| 103 | MediaStack-35 | 10.48.200.35 | MediaStack_2c00b1b8 | online (was VM113 pre-2026-06-22 restore) |
+| 118 | HomeBridge-26 | 10.48.200.18 | homebridge_b57cbaea | online (fixed 2026-06-17) |
+| 120 | NovaCPX-110 | 10.48.200.110 | novacpx_e3b07264 | online |
+
+### PVE2 VMs (10.48.200.91)
+| VMID | Name | IP | Agent ID | Status |
+|------|------|----|----------|--------|
+| 302 | NetworkBackup-99 | 10.48.200.99 | networkbackup_NetworkB | online |
+
+### Other Agents
+- **JARVIS DO**: 165.22.1.228 (agent: jarvis-do_orbis) — online
+- **PVE1**: 10.48.200.90 (agent: claude_pve) — online
+- **PVE2**: 10.48.200.91 (agent: pve2_pve2) — online
+- **FortiGate**: 10.48.200.1 (agent: fortigate_gw) — online
+- **WireGuard CT**: (agent: wireguard_360460f7, no LAN IP) — online
+- **Yealink T48S**: 10.48.200.43 (agent: yealink_t48s) — online
+- **mini_it12**: 10.48.200.87 (agent: mini_it12_windows, Windows) — offline since 2026-06-12
+
+### Gone / No Longer Exist
+- Ollama VM 210 — was listed as deleted but IS running at 10.48.200.210 as VM 106 (was VM210 pre-restore). OLLAMA_HOST=0.0.0.0:11434 fixed 2026-06-24.
+- alien-pc_windows — not registered (Dell devices at .66/.67 exist on network but no agent)
+
+### Agent Config Note
+Agents with old `server_url` config key crash on startup — must use `jarvis_url`. Fixed on homebridge and jellyfin 2026-06-17. If any other agent starts failing, copy config to /etc/jarvis-agent/config.json with `jarvis_url` key.
+
+## Agent System
+- Push-based: heartbeat 10s, metrics 30s
+- agent.php uses CF-Connecting-IP header for real client IP (Cloudflare-aware)
+- Platform detection: windows/mac/linux/tablet — tablet shows view-only message
+- Subnet fallback match: if exact IP miss, matches same /24
+- Shell commands supported with `{"allowed": true}` in command_data
+- Installer: `curl -sk https://jarvis.orbishosting.com/install-agent.sh | bash -s <hostname> <linux|proxmox>`
+- For VMs needing sudo: `echo "Joker1974!" | sudo -S bash /tmp/install.sh <hostname> linux`
+
+### Agent Versions (as of 2026-06-12)
+- **Linux v3.1**: adds version to registration payload, fixes self_update cfg scope bug in execute_command
+- **Windows v3.0**: real self-update (was stub), screenshot (PIL+PS fallback), sysinfo, re-registers on startup
+- **macOS v3.0**: new agent — CPU via `top -l 2`, mem via `sysctl`+`vm_stat`, screenshot via `screencapture -x`
+- Config location (mac): `~/.jarvis-agent/config.json` | agent_type: "macos" | agent_id: "{HOSTNAME}_mac"
+- **Old agents with `cfg` scope bug**: shell and update commands fail with `name 'cfg' is not defined` — auto-updates within 24h via periodic check in main() where cfg IS in scope
+- registered_agents table has `version VARCHAR(20)` column and 'macos' in agent_type ENUM
+
+### Workers Admin Tab (added 2026-06-12)
+- VERSION column shows current vs latest version with color coding (green=current, red=outdated, yellow=unknown)
+- Update button: cyan "⬆ UPDATE" if outdated, dim "↻ UPDATE" if current
+- `agentUpdateFlow()`: popup modal, polls workers_list every 4s up to 90s, updates version cell in-place on completion
+
+## Network Scanning
+- PVE1 cron: `*/3 * * * * /usr/local/bin/jarvis-netscan.sh` — nmap 10.48.200.0/24, pushes to `/api/netscan`
+- netscan.php authenticated via X-Registration-Key header
+- network.php includes netscan-discovered devices (online, last 15 min) in network panel
+- RUN NETWORK SCAN button: queues shell command to PVE1 agent, auto-refreshes panel after 45s
+- DO cannot SSH to PVE1 local IP — must use orbisne.fortiddns.com or agent commands
+- Site monitoring updated 2026-06-09: parkerslingshot key now points to parkerslingshotrentals.com (was parkerslingshot.epictravelexpeditions.com) in facts_collector.php, alerts.php, do_server.php
+
+## Admin Portal (/admin)
+- URL: https://jarvis.orbishosting.com/admin — same login as JARVIS
+- Tabs: Dashboard, Agents, Network, Alerts, KB Facts, KB Intents, Home Assistant, News, Proxmox VMs, Sites, Users, **Tasks, Appointments**
+- Network tab: shows ALL discovered devices (not just named), filter online/offline/named, Scan Now queues PVE1 command
+- HA tab: reads from ha_entities table (real-time); toggle calls DO→HA directly (HA_URL = orbisne.fortiddns.com:8123)
+- News tab: custom pinned news stored in kb_facts (category='custom_news'), merged into main news feed
+- Proxmox VMs tab: uses cluster API (both PVE1+PVE2), shows CPU/RAM/disk/uptime/network per VM
+- Tasks tab: full CRUD (add/edit/mark done/delete), filter by status/category
+- Appointments tab: full CRUD, upcoming 90 days view
+
+## Proxmox API
+- Accessible via orbisne.fortiddns.com:8006 (FortiGate forwards port 8006)
+- stats_cache.php uses cluster/resources API to get ALL VMs from both nodes
+- PVE2 VMs only accessible via cluster API (no direct external port forward for PVE2)
+
+## Key Files (on DO at /home/jarvis.orbishosting.com/)
+- public_html/index.html — Iron Man HUD UI
+- public_html/admin/index.php — Admin portal (single-file PHP+JS)
+- public_html/api.php — API router
+- api/config.php — all config constants
+- api/endpoints/agent.php — agent registration/heartbeat/metrics/commands
+- api/endpoints/chat.php — 4-tier chat: KB intent → action intents → Ollama → Groq → Claude
+- api/endpoints/network.php — network device list (agents + named + netscan)
+- api/endpoints/netscan.php — push endpoint for PVE1 nmap results
+- api/endpoints/stats_cache.php — every 5min: Proxmox (cluster API), HA, weather, news
+- api/endpoints/facts_collector.php — every 3min: system stats, site health, HA facts
+- api/endpoints/do_server.php — reads /proc directly (no SSH loopback)
+
+## DB Schema Notes
+- `agent_metrics` columns: id, agent_id, metric_type, metric_data (JSON longtext), recorded_at
+  - metric_type='system'; CPU/RAM/disk live inside metric_data JSON
+  - Extract with: JSON_EXTRACT(metric_data,'$.cpu_percent'), JSON_EXTRACT(metric_data,'$.memory.percent')
+  - NO cpu_pct/mem_pct/disk_pct columns — always use JSON_EXTRACT
+
+## Chat Architecture
+- Tier 1b: Action intents (network_scan → returns real DB data + queues PVE1 netscan)
+- network_scan intent: action type, returns real device count, never fabricates
+- Groq model: compound-beta-mini (NOT groq/compound-beta-mini)
+
+## Planner System (added 2026-05-31)
+- Tables: `tasks` (title, notes, category ENUM personal/work/todo, priority ENUM low/normal/high/urgent, status ENUM pending/in_progress/done/cancelled, due_date, due_time, completed_at) and `appointments` (title, description, category, start_at, end_at, location, all_day, reminder_min, alerted)
+- API endpoint: `/api/planner/{tasks|appointments|today|done}` (GET=list, POST=save, DELETE=delete)
+- Voice intents in chat.php Tier 0.7: "add task X", "my tasks", "mark X done", "schedule X on date", "my calendar", "daily briefing"
+- Home page: small top-bar badge shows "N TASKS · N APPTS" when items due today; no new panels
+
+## Voice System (updated 2026-05-31)
+- Continuous SpeechRecognition — mic always open, button is mute toggle (🎤 sleep / 🟢 listen / 🔇 mute)
+- Wake phrase (phase 1): "wake up JARVIS" or "daddy's home" → activates; JARVIS responds once
+- Command trigger (phase 2): "JARVIS [command]" executes; opens 17-second free-listen window for follow-ups
+- After 30 min no commands → voice sleeps; after 5 min idle → page reloads silently (no greeting)
+- Mic paused during ElevenLabs TTS via recognition.abort() + isSpeaking flag; resumes 300ms after audio ends
+- ElevenLabs: voice ID JBFqnCBsd6RMkjVDRZzb (George), model eleven_turbo_v2_5, key in config.php
+
+## Arc Reactor AI Routing (updated 2026-06-17)
+- **Arc Reactor daemon**: `/opt/jarvis-arc/reactor.py` (Python, port 7474); service: `jarvis-arc`
+- **Deploy source**: `/home/jarvis.orbishosting.com/deploy/reactor.py` → copy to `/opt/jarvis-arc/reactor.py` + `systemctl restart jarvis-arc`
+- **llm_call() providers**: "claude" → Claude API, "groq" → Groq, "ollama" → local Ollama; cascades groq→ollama on failure
+- **Guardian anomaly alerts** (line ~1025): Groq `llama-3.3-70b-versatile` — 2-3 sentence Iron Man alert when CPU/RAM/disk/service thresholds trip
+- **SITREP** (line ~1068): Groq by default — comprehensive text briefing across all agents
+- **Vision: text-only sysinfo** (line ~691): Groq — when agent returns JSON snapshot (no image)
+- **Vision: actual screenshot** (line ~664): Claude `claude-opus-4-8-20251101` — stays on Claude, Groq has no vision models
+- **Email drafting, research, tool_loop**: still Claude — complex reasoning tasks
+
+## kb_facts Fix (2026-06-17)
+- `storeFact()` ON DUPLICATE KEY UPDATE now explicitly sets `updated_at=NOW()` — previously MySQL wouldn't bump the timestamp if fact_value hadn't changed, causing do_server.php's 15-min freshness check to return empty sites
+- `$fresh()` in facts_collector.php was querying `WHERE fact_category=?` (wrong column); fixed to `WHERE category=?`
+- Site health checks now hit `http://127.0.0.1` with `Host:` header instead of public HTTPS URL (avoids Cloudflare 524 timeouts on self-check)
+
+## Known Quirks
+- LSAPI deadlock: session_write_close() in api.php after auth
+- lsphp segfaults on -l flag; use php8.3 -l for syntax checking
+- DO cannot reach 10.48.200.x directly — use DDNS or agent commands
+- Proxmox local IP in config.php (PROXMOX_HOST=10.48.200.90) but API calls use orbisne.fortiddns.com
+- stats_cache.php uses orbisne.fortiddns.com:8006 (not PROXMOX_HOST) for Proxmox API
+- HA_URL = http://orbisne.fortiddns.com:8123 (FortiGate forwards 8123→HA); service calls work from DO
+- ha.php entity list reads from ha_entities table (NOT api_cache) — real-time data from HA agent
+- When editing index.html with Python patches: always use file-based scripts (not heredocs or inline), avoid double-brace `}}` near function closings
+- Arc Reactor bugs fixed 2026-06-12: capabilities panel uses `s?.capabilities || s?.handlers`; Guardian ts() variable shadowing fixed (renamed evTs); Vision always fetches fresh agents_list
+- Arc reactor DB bugs fixed 2026-06-12: column is `metric_data` not `metrics_json`; system data is flat JSON not nested under "system" key; conversations column is `content` not `message`; disk uses `mount` key not `mountpoint`
@@ -0,0 +1,45 @@
+---
+name: jarvis-ha-integration
+description: "JARVIS ↔ Home Assistant two-way integration — status, what's installed, how it works"
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: d9685e6b-8f79-4948-82e5-fbae607f7aa0
+---
+
+HA is accessible at https://hoa.orbishosting.com (via NPM) or http://10.48.200.97:8123 (LAN direct).
+HA login: myronblair@outlook.com / Joker1974!!!
+After 2026-06-22 Proxmox restore: HA is now VM 109 (was VM 101). QEMU guest agent not installed.
+HA token (Jarvis2): eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiIzNmI0N2I1Njk5ZGQ0MTQ2ODMwZWFmYjZiYTQ1MjJkMSIsImlhdCI6MTc4MDIwMzU5NCwiZXhwIjoyMDk1NTYzNTk0fQ.sYRok-jRDlA4lFgWxLQELcEjkJNGQdprk6ZziLwLtXE
+
+## Custom Component (installed 2026-05-31)
+Repo: myronblair/jarvis → ha_integration/custom_components/jarvis_agent/
+Installed at: /config/custom_components/jarvis_agent/ on HA VM (10.48.200.97)
+Config added to /config/configuration.yaml (jarvis_agent: block at end)
+
+**Why:** Replaces PHP→DDNS→HA REST API with HA-initiated outbound polling — more reliable.
+
+## How it works
+- HA pushes all entity state changes to JARVIS /api/agent/ha_state (debounced 2s)
+- HA polls /api/agent/heartbeat every 10s for queued commands
+- JARVIS admin panel toggle → queues command in agent_commands table → HA executes natively
+- 212 entities live in ha_entities DB table, updated in real-time
+- Agent registered as ID 15, hostname "homeassistant", IP 172.30.32.1 (Docker network)
+
+## JARVIS Admin Panel HOME tab
+- 4-column table: domain icon | device name | state | toggle/run button
+- Unavailable entities filtered out automatically (reappear on next cache refresh)
+- Scenes get ▶ RUN button; switches/lights get toggle slider
+- Cache refreshed every 5 min by stats_cache.php cron
+
+## Webhook fix (2026-05-31)
+webhook.php had wrong require path (../../ instead of /../) causing 500 since May 25.
+Fixed and committed. Auto-deploy pipeline working again.
+
+## HA VM SSH
+- Port 22 on orbisne.fortiddns.com forwards to HA Ubuntu VM (not PVE1)
+- Password auth failing — likely key-only or fail2ban
+- Use HA web terminal (Settings → Add-ons → Advanced SSH & Web Terminal) for shell access
+- QEMU guest agent NOT installed in VM 101 (qm guest exec doesn't work)
+
+**How to apply:** When working on HA component or HA VM files, use HA web terminal or HA File Editor addon. Cannot SSH directly.
@@ -0,0 +1,274 @@
+---
+name: project-jarvis-todo
+description: "Master JARVIS TODO — agent deployment, self-healing, Windows service, HA integration, all outstanding work"
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: e8442c3a-86d9-4b82-8f6d-071acd19159a
+---
+
+# JARVIS Master TODO
+
+Last updated: 2026-06-29
+
+---
+
+## ✅ FIXED THIS SESSION (2026-06-29) — ROUND 2
+
+- [x] **HA Poller deployed on VM211** — `jarvis-ha-poller.py` running as `jarvis-ha-poller.service`. Polls HA at `http://10.48.200.97:8123` every 30s. 241 entities now pushing (lights, switches). Token expires 2033.
+- [x] **Missing DB tables created** — `tasks`, `appointments`, `usage_patterns` tables added. Fixed `registered_agents` enum to include `windows`/`macos` and `version` column.
+- [x] **schema.sql updated** — DB schema dumped from live VM211 to `db/schema.sql`, now includes all tables.
+- [x] **ha.php domain filter** — Added `camera`, `siren`, `remote`, `todo`, `lawn_mower` to `$skipDomains`. Only `light` and `switch` (plugs) show in HOME tab.
+- [x] **web.orbishosting.com fixed** — Root cause: Epson printer had ARP conflict at 10.48.200.200 (NPM's IP). FortiGate VIP for HTTP/HTTPS correctly forwards to 10.48.200.200. Fixed by: (1) bouncing NPM's eth0 to send gratuitous ARP, (2) setting permanent ARP entry on PVE1. https://web.orbishosting.com → NPM → NovaCPX (returns 401 Basic Auth — NovaCPX site auth).
+- [x] **PVE1 static ARP** — `/etc/network/if-up.d/npm-static-arp` persists `10.48.200.200 → BC:24:11:67:1D:47` across reboots.
+
+## ✅ FIXED THIS SESSION (2026-06-29) — ROUND 1
+
+- [x] **JARVIS API not executing PHP** — nginx `location ^~ /api` (no trailing slash) was intercepting `/api.php` and serving it as static text. Fixed to `location ^~ /api/`. PHP-FPM at `/run/php/php8.3-fpm.sock` confirmed working. `/api/ping` now returns JSON.
+- [x] **api.php backward-compat path normalization** — Added path rewrite so old `/api/endpoints/agent.php` format routes to the `agent` endpoint. Agents on old configs can now register.
+- [x] **DB schema: version + windows/macos** — Added `version VARCHAR(32)` to `registered_agents`; expanded `agent_type` enum to `linux|homeassistant|proxmox|windows|macos`.
+- [x] **Ollama models in config.php** — `OLLAMA_MODEL_PRIMARY` and `OLLAMA_MODEL_HEAVY` both set to `llama3.1:8b`. VM106 Ollama upgraded to 32GB RAM, 8 cores.
+- [x] **Windows agent installer** — Created `install-windows.ps1`: one PowerShell command installs Python, pywin32, downloads agent, creates config, registers+starts Windows Service. No open PowerShell needed after install.
+- [x] **Linux installer URL** — `install.sh` was hardcoded to `http://10.48.200.211` (LAN only). Fixed to default `https://jarvis.orbishosting.com`. LAN installs override with `JARVIS_URL=http://10.48.200.211`.
+
+---
+
+## 🔴 CRITICAL — Outstanding
+
+### A. Epson Printer IP Conflict — NEEDS PERMANENT FIX
+Epson printer keeps taking 10.48.200.200 (NPM's static IP). Temporary fix: PVE1 has static ARP + gratuitous ARP from NPM. **Real fix**: assign Epson printer a different static IP in its web admin (find printer IP when it comes back up, log in to its config page, set static IP ≠ 10.48.200.200). DHCP reservation in FortiGate DHCP server for printer's MAC also works.
+
+### B. Windows Agent on Myron's Desktop — NEEDS ADMIN POWERSHELL
+Run this in an **Admin PowerShell** (not Claude Code terminal):
+```powershell
+$env:JARVIS_REG_KEY='f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518'
+& 'C:\Users\myron\repos\jarvis\public_html\agent\install-windows.ps1'
+```
+After install: `Get-Service JARVISAgent` should show Running.
+
+### C. web.orbishosting.com NovaCPX 401
+Site routes correctly to NovaCPX but returns `401 Basic realm="Blair HQ"`. Need to check CyberPanel on NovaCPX (10.48.200.110) — either the website isn't created for web.orbishosting.com, or HTTP auth is enabled on the default site. Access CyberPanel at https://10.48.200.110:8090 to check.
+
+### D. Re-install JARVIS HA Custom Component (VM109 rebuilt)
+```bash
+# From PVE1, get HA terminal or use Proxmox console for VM109:
+# Copy from JARVIS server to HA config:
+ssh root@10.48.200.211 'tar czf /tmp/ha-component.tgz -C /var/www/jarvis ha-component'
+# Then on HA VM or via PVE1 -> VM109 console:
+# mkdir -p /config/custom_components
+# tar xzf ha-component.tgz -C /config/
+# Restart HA
+```
+After restart: `ha_entities` should fill. Also restore HA backup file ID `1mLE1S9dSvxl0RYQnCt020WT-UZnQuxqP` from Google Drive via HA UI.
+
+### B. Push to GitHub + Verify Auto-Deploy
+The fixes in this session need to be committed and pushed so VM211 picks them up (webhook deploy):
+```bash
+cd C:\Users\myron\repos\jarvis
+git add -A && git commit -m "Fix nginx PHP, API paths, Windows installer, install.sh URL"
+git push
+```
+After push: verify VM211 auto-deployed (`journalctl -u jarvis-deploy -n 20` on VM211).
+
+### C. Install Agent on Ollama VM106 (10.48.200.210) — new VM, no agent
+```bash
+# From PVE1:
+ssh root@10.48.200.210 "curl -sk https://jarvis.orbishosting.com/agent/install.sh | bash -s ollama106 linux"
+```
+
+---
+
+## 🟠 HIGH — Deploy Agents to All Hosts
+
+**Linux/Proxmox (LAN) one-liner:**
+```bash
+JARVIS_URL=http://10.48.200.211 curl -sk https://jarvis.orbishosting.com/agent/install.sh | bash -s <hostname> <linux|proxmox>
+```
+
+**Linux (External/DO):**
+```bash
+curl -sk https://jarvis.orbishosting.com/agent/install.sh | bash -s <hostname> linux
+```
+
+**Windows (Admin PowerShell):**
+```powershell
+$env:JARVIS_REG_KEY='f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518'
+irm https://jarvis.orbishosting.com/agent/install-windows.ps1 | iex
+```
+
+**Mac:**
+```bash
+curl -sk https://jarvis.orbishosting.com/agent/install-mac.sh | bash -s -- --key f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518
+```
+
+**Deployment status table:**
+
+| Host | IP | Type | Status | Action Needed |
+|------|-----|------|--------|--------|
+| PVE1 | 10.48.200.90 | proxmox | ❓ check | Verify in Workers tab |
+| PVE2 | 10.48.200.91 | proxmox | ❓ check | Verify in Workers tab |
+| JARVIS VM211 | 10.48.200.211 | linux | ❓ check | Self-monitors |
+| Ollama VM106 | 10.48.200.210 | linux | ❌ missing | Install now (see Critical C) |
+| Jellyfin VM112 | 10.48.200.33 | linux | ❓ check | Verify in Workers tab |
+| MediaStack VM103 | 10.48.200.35 | linux | ❓ check | Verify in Workers tab |
+| HomeBridge VM118 | 10.48.200.18 | linux | ❓ check | Verify in Workers tab |
+| NovaCPX VM120 | 10.48.200.110 | linux | ❓ check | Verify in Workers tab |
+| SynchroNet VM100 | 10.48.200.50 | linux | ❌ missing | Install if SSH accessible |
+| NetworkBackup | 10.48.200.99 | linux | ❓ check | Verify in Workers tab |
+| HA VM109 | 10.48.200.97 | homeassistant | ❌ missing | See Critical A |
+| CT110 WireGuard | 10.48.200.67 | linux | ❌ missing | apk add python3, install agent |
+| DO Server | 165.22.1.228 | linux | ❓ check | Verify in Workers tab |
+| Myron's Desktop (this PC) | DHCP | windows | ❌ missing | Run install-windows.ps1 |
+| Windows VM104 | DHCP | windows | ❌ missing | Run install-windows.ps1 |
+| mini_it12 | 10.48.200.87 | windows | ❌ offline | Last seen 2026-06-12, re-install |
+| Mac machines | any | macos | ❌ missing | Run install-mac.sh |
+
+---
+
+## 🟠 HIGH — Self-Healing Details
+
+**Linux** — systemd `Restart=always` + `RestartSec=10`. Already built into install.sh service file.
+
+**Windows** — After install, run once to add recovery actions:
+```powershell
+sc.exe failure JARVISAgent reset=86400 actions=restart/10000/restart/30000/restart/60000
+```
+
+**Self-update** — All agents auto-update every 24h. Push new agent code to GitHub → VM211 deploys → all agents pick up update within 24h. For urgent: JARVIS Admin → Workers → UPDATE button per agent.
+
+**Alpine/OpenRC** (CT110):
+```sh
+# /etc/local.d/jarvis-agent.start
+nohup sh -c 'while true; do python3 /opt/jarvis-agent/jarvis-agent.py; sleep 10; done' &
+```
+
+---
+
+## 🟠 HIGH — Windows Agent Compiled Executable
+
+Current installer works (installs Python silently) but a standalone `.exe` is cleaner for restricted machines.
+
+Build steps (run on any Windows machine with Python):
+```powershell
+pip install pyinstaller pywin32
+pyinstaller --onefile --hidden-import=win32timezone --hidden-import=win32security `
+    C:\Users\myron\repos\jarvis\agent\jarvis-agent-windows.py -n jarvis-agent
+# Upload dist/jarvis-agent.exe to VM211:/var/www/jarvis/public_html/agent/
+```
+
+Then update `install-windows.ps1` to download the exe and use `.\jarvis-agent.exe --startup auto install`.
+
+---
+
+## 🟡 MEDIUM — HA Integration (VM109)
+
+Full post-rebuild checklist:
+- [ ] Restore Google Drive backup (`1mLE1S9dSvxl0RYQnCt020WT-UZnQuxqP`)
+- [ ] Re-install JARVIS HA component (see Critical A)
+- [ ] Install Tailscale addon (Settings → Add-ons → Search Tailscale)
+- [ ] Resize disk: power off → `qm resize 109 sata0 +118G` → boot → `ha os datadisk resize`
+- [ ] Verify `HA_URL=http://orbisne.fortiddns.com:8123` in config.php
+- [ ] After component reinstall: verify `ha_entities` fills (~2587 rows)
+
+**HA HOME tab filter** — after backup restore, audit `ha.php` `$skipKeywords` to ensure Tuya/TP-Link/Z-Wave switches aren't being filtered out.
+
+---
+
+## 🟡 MEDIUM — JARVIS Server Health Checks
+
+```bash
+# SSH to VM211:
+
+# Verify cron jobs
+crontab -l
+# Should have: */5 * * * * php /var/www/jarvis/api/endpoints/stats_cache.php
+#              */3 * * * * php /var/www/jarvis/api/endpoints/facts_collector.php
+
+# Arc Reactor status
+systemctl status jarvis-arc
+curl -s http://10.48.200.211:7474/health
+
+# Backups
+ls -lh /var/backups/jarvis/
+
+# JARVIS ping
+curl -s https://jarvis.orbishosting.com/api/ping
+```
+
+---
+
+## 🟢 LOW — FortiGate DNS + Synology Reverse Proxy
+
+Adds `.lan` domain access. Full instructions in `project_infra_todo.md`.
+Key entries: jarvis.lan → VM211:80, proxmox.lan → 10.48.200.90:8006, hoa.lan → VM109:8123.
+
+---
+
+## 🔑 Key Constants
+
+| Item | Value |
+|------|-------|
+| Registration key | `f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518` |
+| JARVIS URL (external) | `https://jarvis.orbishosting.com` |
+| JARVIS LAN | `http://10.48.200.211` |
+| HA Token | `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...` (in config.php, expires 2026) |
+| Proxmox API token | `root@pam!jarvis=c45b5feb-f9a9-445d-a626-14fbb959f78b` |
+
+---
+
+## 🔴 OPEN (pre-existing)
+
+- [ ] **HA HOME tab — show all lights, plugs, switches** — currently 17 lights show but only 3 useful switches (Sirens, CEC Scanner, ESPHome) pass the filter. Need to audit what real smart plug/switch entities exist in HA (Tuya, TP-Link Tapo, Z-Wave, etc.) and ensure they appear in the JARVIS HOME tab. The `$skipKeywords` filter in `api/endpoints/ha.php` strips camera/HACS junk — verify real device switches aren't accidentally filtered. Also check if HA custom component is syncing all entity domains.
+
+- [ ] **Claude API credits** — image-based Vision Protocol (`handle_screenshot` with actual PNG) uses `claude-opus-4-8`. Top up at console.anthropic.com if vision fails. Guardian/SITREP now on Groq so those no longer drain credits.
+
+- [x] **HA agent persistence** — SOLVED. The HA custom component (`jarvis_agent`) runs inside HA's Docker container (IP 172.30.32.1) and auto-starts with HA. Online and healthy. The old standalone Python script at 10.48.200.97 is obsolete.
+
+---
+
+## ✅ COMPLETED (2026-06-18 session)
+
+- [x] JARVIS fully migrated DO → PVE1 VM 211 (8c/16GB, nginx/PHP8.3/MariaDB/Redis/Arc Reactor)
+- [x] All 3 new VMs on PVE1: JARVIS-211, NPM-200, Ollama-210 (IP changed from .95 → .210, Reolink owns .95)
+- [x] Tailscale on all key hosts — full mesh, all 13+ nodes documented
+- [x] FortiGate VIPs updated to 97.247.237.97; JARVIS on port 1972, HOA on 8123
+- [x] NPM running at http://10.48.200.200:81 (Docker, proxy hosts for hoa/novacpx)
+- [x] JARVIS backups — /var/backups/jarvis/, daily cron 7am UTC (2am CDT), 7-day retention
+- [x] Jellyfin agent — v3.1 online at 10.200.0.3 via PVE1 password SSH
+- [x] HA agent — v3.1 running on HA VM at 10.48.200.97 via HA web terminal
+- [x] PVE1 ImageMagick — installed
+- [x] Vision screenshots tab — already existed in admin under Arc Reactor → Vision Protocol
+- [x] MediaStack SSH key — DO key generated and copied to MediaStack via PVE1 hop
+- [x] Workers terminology — already "JARVIS AGENT WORKERS" in admin
+- [x] install-agent.sh — default URL updated to http://10.48.200.211
+- [x] Website webhooks — all 7 repos → tomtomgames.com/webhook.php (DO); JARVIS repo → port 1972
+- [x] webhook.php fixed (broken define from bad sed), synced to DO
+- [x] Service monitor updated — nginx/php-fpm/mariadb/redis/arc/agent (not OLS-era services)
+- [x] DO server WEB HOST block on front page — shows DO CPU/RAM/DISK via Tailscale agent
+- [x] Network devices cleaned up — 23 named devices, all infrastructure labeled
+- [x] Agent configs fixed — all 8+ agents pointing to new JARVIS VM, correct watch_services per host
+- [x] Facts collector fixed — external site checks, correct column names, proper timeouts
+- [x] CLAUDE.md + INFRASTRUCTURE-REFERENCE.md fully updated and pushed
+
+---
+
+## ✅ COMPLETED (2026-06-17 session)
+
+- [x] Phase 3 JS modularization — jarvis-protocols.js split into 3 panel files
+- [x] Guardian/SITREP/Vision text → Groq (image analysis stays Claude)
+- [x] kb_facts freshness fix (storeFact updated_at, $fresh() column name)
+- [x] Site health local loopback fix
+- [x] Cloudflare Rocket Loader fix (face-api.js data-cfasync)
+- [x] Session fix (api.php skip logic too broad)
+- [x] JS syntax fix (apostrophe in face-api label)
+- [x] All 8 online Linux/Proxmox agents → v3.1 with version in heartbeat
+
+---
+
+## ✅ COMPLETED (2026-06-12 session)
+
+- [x] Agent v3.1 Linux, v3.0 Windows, v3.0 macOS
+- [x] Workers tab VERSION column + agentUpdateFlow
+- [x] Arc Reactor systemd active, tracked in git
+- [x] All 13 "make it stand out" improvements
+- [x] MediaStack NAS migration
@@ -0,0 +1,70 @@
+---
+name: project-mediastack
+description: MediaStack VM on PVE1 — Sonarr/Radarr/Prowlarr/qBittorrent behind WireGuard VPN through CT110→DO
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: b1e93a6a-f101-4ea4-aafb-9cb7e2958821
+---
+
+## VM Details (updated 2026-06-24)
+- **VM ID:** 103 | **Name:** MediaStack-35 | **IP:** 10.48.200.35
+- **Hypervisor:** PVE1 (10.48.200.90)
+- **Disk:** 50GB on **GoFlex** storage (moved off SynologyProx 2026-06-24 due to I/O errors)
+- **OS:** Ubuntu 24.04 (noble cloud image)
+- **QEMU guest agent:** installed and running (installed 2026-06-24)
+- **SSH:** PVE1 key → `ssh -o StrictHostKeyChecking=no -i /root/.ssh/id_rsa root@10.48.200.35`
+- **GitHub:** `myronblair/mediastack` cloned at `/opt/mediastack`
+
+## Services, Ports & Credentials
+| Service | Port | Login | API Key |
+|---------|------|-------|---------|
+| qBittorrent | :8080 | admin / Joker1974!!! | — |
+| Sonarr | :8989 | — | `b43e04350a594846b4ee95261c29e9e0` |
+| Radarr | :7878 | — | `53c4268360444feeae5f98c0cc24e0e3` |
+| Prowlarr | :9696 | — | `9d0ce6c5660743b5bf1c7951efc62252` |
+
+All services run as root (NFS ACL requires root for writes).
+
+## VPN Architecture (updated 2026-06-24)
+
+### wg0 — Internet kill-switch (primary VPN)
+- **Interface:** `wg0` | **VPN IP:** `10.200.0.4/24`
+- **Endpoint:** CT110 at `10.48.200.67:51821` → NordVPN (us9156, 2.56.190.66:51820) → internet
+- **Exit IP:** `2.56.190.69` (NordVPN US, verified 2026-06-29)
+- **Kill-switch:** iptables rules — REJECT all non-wg0 non-fwmark traffic; LAN 10.48.200.0/24 always allowed
+- **Config:** `/etc/wireguard/wg0.conf` — fwmark hardcoded as `51820` (not dynamic, avoids PostDown race)
+- **Auto-start:** `systemctl enable wg-quick@wg0` (enabled 2026-06-24)
+- **DNS:** `10.48.200.90` (PVE1 dnsmasq)
+- **MediaStack pubkey:** `CaG79S1fJeJDlYCMhHz8BrDfizBq+OiGnO5VzFIk3gE=`
+- **CT110 pubkey:** `Fqb1KLfHe1r3+Hwhem7YGZB2KikGYy/8pPsOIP4rn18=` (updated 2026-06-29 — old key was RXxD...)
+- **NordVPN exit IP:** 2.56.190.69 (us9156.nordvpn.com) — verified 2026-06-29
+
+### wg1 — Jellyfin media access (NOT internet VPN)
+- MediaStack is WireGuard server on `wg1` (port 51820, 10.200.0.1/24)
+- Jellyfin (10.48.200.33) connects as peer (10.200.0.3)
+- Used for NFS media file access only
+
+## Media Storage
+- Downloads: `/mnt/nas/video/downloads` (Synology NAS NFS)
+- Movies: `/mnt/nas/video/movies` | TV: `/mnt/nas/video/tv`
+- Old paths `/media/movies` and `/media/tv` are NFS mounts from NAS (Jellyfin backward compat)
+- Jellyfin fstab: `10.48.200.35:/media/movies /mnt/mediastack/movies nfs defaults,_netdev 0 0`
+
+## Indexer — IPTorrents
+- Cookie auth in Prowlarr: `uid=2237410; pass=JzLP2niTWxBJAZIU3yvtLbJzD55kdLeB`
+- Cookies expire — if indexer fails, log into iptorrents.com in browser, copy uid+pass cookies
+
+## JARVIS Agent
+- Agent ID: `MediaStack_2c00b1b8` | Config: `/opt/jarvis-agent/config.json`
+- Registration key: `f846a9aaf7ce9a61742c63c87c4186052a71d2a580c65518` | `ssl_verify: false`
+
+## PBS Backup
+- Nightly at 21:00 → SynologyProx storage
+- Backs up VM regardless of which storage the disk lives on
+
+## Known Issues
+- **wg-quick down/up over SSH kills the connection** — PostDown briefly removes LAN ACCEPT before REJECT; SSH reply is dropped. Always use VM console for wg0 cycling, or use `nohup` background.
+- **NFS write failures** = services not running as root
+- **Radarr "0 active indexers"** = blocked in DB; fix: `sqlite3 /var/lib/radarr/radarr.db "DELETE FROM IndexerStatus WHERE ProviderId=1;"`
+- **Stale NFS file handle on Jellyfin** = lazy unmount + remount on Jellyfin VM
@@ -0,0 +1,99 @@
+---
+name: project-novacpx
+description: NovaCPX — custom Linux web hosting control panel (cPanel alternative) built from scratch
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: c454fc50-f93d-4ddd-b9f3-f3f442e89fb9
+---
+
+NovaCPX is a full web hosting control panel built from scratch with 4 dedicated ports: Admin :8882, Reseller :8881, User :8880, Webmail (Roundcube) :8883.
+
+**Why:** User wants a cPanel/Plesk alternative they own outright, with distinctive UI, auto-installer, and extensible feature system.
+
+**How to apply:** Direct SSH to VM works (no PVE hop needed). All code in /tmp/novacpx locally + pushed to GitHub myronblair/novacpx.
+
+## VM Details
+- Host: PVE1 VM 120, name HostPanel-110
+- IP: 10.48.200.110 (static)
+- OS: Ubuntu 24.04 LTS
+- **SSH (direct — works from Claude Code):** `sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.110`
+- **SCP (direct):** `sshpass -p 'Joker1974!!!' scp -o StrictHostKeyChecking=no FILE root@10.48.200.110:/path`
+- PVE1 hop NOT needed and currently broken (permission denied on orbisne.fortiddns.com SSH)
+- Panel web root: /srv/novacpx/public
+- Repo on VM: /opt/novacpx-src
+- Source of truth for deploy scripts: /opt/novacpx-src/deploy/
+
+## GitHub
+- Repo: myronblair/novacpx (private)
+- Branches: `main` (stable releases, PATCH auto-bump) and `beta` (beta releases, -beta.N auto-bump)
+- Auto-deploy: push to main or beta → GitHub webhook → VM pulls (deploy-runner.sh cron every min)
+- PAT: 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
+
+## Ports
+- 8880 — User panel
+- 8881 — Reseller panel
+- 8882 — Admin/datacenter panel
+- 8883 — Roundcube webmail
+
+## Architecture
+- Backend: PHP 8.3 REST API (/api/{endpoint}/{action})
+- Auth: session cookie `ncpx_session` (login returns token, set as cookie) + Bearer tokens for API. Both use SHA256 hash lookup in sessions/api_tokens tables.
+- DB: **SQLite** at /var/lib/novacpx/panel.db (migrated from MySQL 2026-06-09)
+- DB.php has translate() layer: ON DUPLICATE KEY→ON CONFLICT, DATE_ADD/DATE_SUB→datetime(), NOW()→datetime('now')
+- **novacpx_version table**: tracks install history; columns: id, version, installed_at, notes, git_commit
+- **settings table**: panel_version key tracks current version; update_channel (stable/beta) controls which GitHub branch to check/pull
+- Feature registry: 70+ pluggable features in 20 categories
+- Update channels: stable=origin/main (major/minor), beta=origin/beta (patch/pre-release)
+
+## VM Credentials
+- Admin panel: `admin / Admin2026!`
+- Root SSH: `root / Joker1974!!!`
+- MySQL (customer sites): novacpx_user / 6fyWj6vYnJDKEQvNANzj
+- WP provisioning MySQL user: novacpx_wp / tCXAU1K2WX31xUAMY9EM
+- Config: /etc/novacpx/config.ini (root:www-data 640)
+
+## JARVIS Agent
+- Installed 2026-06-09; agent_id: novacpx_e3b07264
+- Status: online, reporting heartbeats to JARVIS every 10s
+- Config: /opt/jarvis-agent/config.json
+- Key config fields: server_url, host_header, api_key, agent_type: linux, heartbeat_interval: 10
+
+## Versioning (as of 2026-06-10)
+- Current git version: 1.0.27 (GitHub main)
+- Active deploy channel: beta (VM settings)
+- GitHub Actions auto-bumps VERSION on push to main (PATCH) or beta (-beta.N)
+- deploy-runner.sh writes new version to novacpx_version + settings.panel_version after every webhook deploy
+- deploy-runner.sh also copies VERSION to web root (/srv/novacpx/public/VERSION) — fixed 2026-06-10
+- apply-novacpx-update endpoint does the same for manual updates
+- Updates page shows installed version, latest remote version, and active channel badge
+
+## Settings Page
+- Loads current values from DB via server-options API (panel_name, default_php, nameservers, update_channel)
+- Saves each field via save-option API individually
+- Update channel dropdown shows stable vs beta with explanatory labels
+
+## Docker App Catalog (as of 2026-06-10)
+- **140 apps** across 15 categories in DockerManager.php
+- Categories: Web/CMS, Productivity, Dev, Analytics, Wiki/Docs, Messaging/Chat, Security/Auth, Business, Design/Collab, AI/LLM, Developer Tools, Databases, Monitoring, Networking/Security, CMS/E-commerce, Project Mgmt, Communication, File/Storage, ERP/Business, Media, Smart Home, Dashboards/Admin
+- Security fixes applied (code review 2026-06-09): shell injection fixes in WordPressManager, PHPManager, install.sh sudoers hardening (removed `ufw *` wildcard, removed `curl *` and `env *` NOPASSWD), SQLite syntax fix, WP-CLI download size validation
+- Per-account uninstall (uninstall-account API action), per-stack Reinstall button
+- Admin Docker page has App Catalog tab to launch apps on behalf of accounts
+
+## nginx / phpMyAdmin (fixed 2026-06-12)
+- Apache2 was holding port 80 — stopped and disabled: `systemctl stop apache2 && systemctl disable apache2`
+- nginx now running and enabled on boot
+- phpMyAdmin accessible at `http://10.48.200.110/phpmyadmin` (returns 200)
+- nginx config: `/etc/nginx/sites-enabled/default` with /phpmyadmin location block
+- phpmyadmin.conf in /etc/nginx/conf.d/ is empty (just a comment) — all config in sites-enabled/default
+
+## Known Quirks
+- PVE1 SSH (orbisne.fortiddns.com) currently permission-denied — use direct IP 10.48.200.110 instead
+- api/.htaccess needed for URL routing
+- NOVACPX_ROOT in api/index.php is dirname(__DIR__) = /srv/novacpx/public (NOT 2 levels up)
+- SQLite only — never use MySQL syntax (ON DUPLICATE KEY, NOW(), etc.)
+- sudo tee pattern needed for writing /etc/postfix/* files as www-data
+- Docker stacks backed by docker_compose_stacks table (separate from docker_containers)
+- Panel reachable at https://10.48.200.110:8882 (self-signed cert with SAN for IP)
+- PHP-FPM pools are root-owned; www-data cannot file_exists()/unlink() them — must use `sudo rm -f`
+- git cherry-pick to beta required after each main push (GitHub Actions version bumps create divergence)
@@ -0,0 +1,72 @@
+---
+name: project-novacpx-tools
+description: NovaCPX development tools and session-start checklist — load at start of every NovaCPX session
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: c454fc50-f93d-4ddd-b9f3-f3f442e89fb9
+---
+
+## Session-start checklist (run at start of every NovaCPX session)
+
+1. **Verify working directory**: `ls /tmp/novacpx/` — if missing, repo needs re-cloning
+2. **Test VM reachability** (direct — PVE1 hop NOT needed):
+   ```bash
+   sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no -o ConnectTimeout=8 root@10.48.200.110 'echo vm-ok'
+   ```
+   > PVE1 (orbisne.fortiddns.com) SSH is currently broken (permission denied). Direct to 10.48.200.110 works fine.
+3. **Load TODO**: read `/root/.claude/projects/-home-myron/memory/project_novacpx_todo.md`
+4. **Check panel live**: `curl -sk -o /dev/null -w "%{http_code}" https://10.48.200.110:8882/`
+
+## Direct SSH / SCP (preferred method)
+```bash
+# Run command on VM
+sshpass -p 'Joker1974!!!' ssh -o StrictHostKeyChecking=no root@10.48.200.110 'command here'
+
+# Copy file to VM
+sshpass -p 'Joker1974!!!' scp -o StrictHostKeyChecking=no /tmp/novacpx/panel/api/endpoints/foo.php \
+  root@10.48.200.110:/srv/novacpx/public/api/endpoints/foo.php
+```
+
+## API auth pattern (session cookie)
+```bash
+# Login and get token
+TOKEN=$(curl -sk -X POST "https://10.48.200.110:8882/api/auth/login" \
+  -H "Content-Type: application/json" \
+  -d '{"username":"admin","password":"Admin2026!"}' | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['token'])")
+
+# Use token as ncpx_session cookie
+curl -sk "https://10.48.200.110:8882/api/system/version" -H "Cookie: ncpx_session=$TOKEN"
+```
+
+## Tools in /tmp/novacpx/tools/
+
+| Script | Purpose | Usage |
+|--------|---------|-------|
+| `nova-ssh.sh` | SSH into VM (double-hop via PVE1 — currently broken) | Use direct SSH instead |
+| `nova-push.sh` | Push single file via base64/double-hop (broken) | Use direct scp instead |
+| `nova-deploy.sh` | Full panel rsync (PVE1 hop — broken) | Use direct scp or git push |
+| `nova-status.sh` | Check SSH + port health | `bash tools/nova-status.sh [--full]` |
+| `nova-logs.sh` | Stream VM logs | `bash tools/nova-logs.sh [apache\|access\|install\|fail2ban\|all]` |
+| `nova-db.sh` | Run queries on VM DB | `bash tools/nova-db.sh [--tables\|--users\|--reset-admin pw\|"SQL"]` |
+
+## Key VM paths
+- Panel web root: `/srv/novacpx/public/`
+- Git repo (source): `/opt/novacpx-src/` (what gets pulled by webhook/deploy-runner.sh)
+- Config: `/etc/novacpx/config.ini` (root:www-data 640)
+- DB: `/var/lib/novacpx/panel.db` (SQLite)
+- Deploy runner: `/opt/novacpx-src/deploy/deploy-runner.sh` (cron runs every min)
+- Webhook: `/opt/novacpx-src/deploy/webhook.php` (linked at /srv/novacpx/public/deploy/webhook.php)
+- Logs: `/var/log/apache2/error.log`, `/var/log/novacpx/access.log`, `/var/log/novacpx/deploy.log`
+- JARVIS agent: `/opt/jarvis-agent/`
+- Cron scripts: `/srv/novacpx/public/bin/` (cache-update-check.php, collect-stats.php, notify-checks.php)
+
+## VM credentials
+- VM IP: 10.48.200.110 (PVE1 VM 120)
+- Root: `root / Joker1974!!!`
+- Admin panel: `admin / Admin2026!`
+- MySQL (customer sites): `novacpx_user / 6fyWj6vYnJDKEQvNANzj`
+- Ports: 8880 (user), 8881 (reseller), 8882 (admin), 8883 (webmail)
+
+**Why:** [[project-novacpx-todo]]  
+**How to apply:** Start every NovaCPX session by running the session-start checklist so you know immediately if the VM is reachable before writing code.
@@ -0,0 +1,44 @@
+---
+name: project-parkerslingshotrentals
+description: "parkerslingshotrentals.com — Polaris Slingshot rental site on DO 165.22.1.228; booking system, waiver, admin portal, Square payment pending"
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: 002fe81e-7e03-414d-b842-1f94f1390a22
+---
+
+Parker County Slingshot Rentals — LIVE at https://www.parkerslingshotrentals.com (DO 165.22.1.228, CyberPanel).
+Deploy path: `/home/parkerslingshotrentals.com/public_html/`
+
+**Why:** Single-vehicle slingshot rental business in Weatherford, TX. Needs online booking, waiver, payments, and admin management.
+
+## Credentials
+- Admin portal: /admin/index.php — user: admin / pass: Parker2026! (URL-token auth, no cookies)
+- DB: park_slingshot / park_slingshotuser / 4@rxg*8kovxCr7w6 on localhost
+- Deploy path: /home/parkerslingshotrentals.com/public_html/
+- SendGrid API key: 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
+- Square production access token: EAAAl3FsAu_2ri8kZE_ENEyi2T_C8HXXm5XQFY6Lbnd8SX6FqYp8J_upUeXNYh7v
+- Square application ID: sq0idp-YSM7BU9IVyOWSzpeP-0nzQ
+- GitHub repo: myronblair/parkerslingshotrentals
+
+## Admin login fix
+PHP sessions were unreliable (LiteSpeed page caching + session dir permissions).
+Replaced with HMAC-signed cookie auth — no session files needed.
+Admin .htaccess has CacheEnable off.
+
+## Packages
+- half-day: $99 / 4 hrs
+- full-day: $169 / 8 hrs
+- weekend: $299 / 48 hrs
+
+## Booking flow (6 steps tracked in admin)
+1. Booking submitted (auto)
+2. Booking confirmed (status dropdown)
+3. Waiver signed (waiver.php?ref=PSR-XXXXXX — canvas e-signature)
+4. Insurance verified (admin toggle)
+5. Deposit received (admin toggle)
+6. License verified (admin toggle at pickup)
+
+## Pending tasks
+- Task #3: Square deposit payment integration (credentials above)
+- Task #6: Vehicle photos (waiting on user)
@@ -0,0 +1,42 @@
+---
+name: proxmox-backup
+description: "Proxmox PVE1/PVE2 config backup to GitHub — weekly cron, restore script, repo structure"
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: c454fc50-f93d-4ddd-b9f3-f3f442e89fb9
+---
+
+GitHub repo `myronblair/proxmox-config` (private) — full config backup + disaster recovery.
+
+**Why:** So both Proxmox nodes can be rebuilt quickly from scratch after hardware failure without losing VM configs, network, custom scripts, or services.
+
+**How to apply:** Reference this when discussing Proxmox maintenance, DR planning, or if a node goes down.
+
+## Repo Structure
+- `shared/` — cluster-wide: all VM/LXC .conf files, storage.cfg, datacenter.cfg, user.cfg, corosync.conf, jobs.cfg, firewall, ha, sdn
+- `pve/` — PVE1 (10.48.200.90): network, cron, scripts, systemd (filebrowser, jarvis-agent, ollama), ssh/authorized_keys
+- `pve2/` — PVE2 (10.48.200.91): network, cron, scripts (just pve-remove-nag.sh), systemd (jarvis-agent)
+- `backup.sh` — runs on each node, pulls repo, collects files, commits+pushes
+- `restore.sh pve1|pve2` — interactive disaster recovery wizard
+
+## Schedule
+Weekly cron on both nodes: `0 3 * * 0 /usr/local/bin/proxmox-backup >> /var/log/proxmox-backup.log 2>&1`
+
+## Manual trigger
+`/usr/local/bin/proxmox-backup` on either node
+
+## What's NOT backed up (intentional)
+- `/etc/pve/priv/` — CA private key, cluster auth keys (Proxmox regenerates these)
+- SSH private keys
+- Large binaries: ollama, filebrowser, blockalign, urbackupclientctl
+- VM disk images → covered by PBS at 10.48.200.85
+
+## Restore flow
+1. Fresh Proxmox install → set hostname + IP
+2. `apt install git && git clone https://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@github.com/myronblair/proxmox-config.git /opt/proxmox-config`
+3. `bash /opt/proxmox-config/restore.sh pve1` (interactive, confirms each step)
+4. Reboot for network, then restore VMs from PBS
+
+## PVE2 disk space issue (2026-06-09)
+PVE2 was at 100% disk — removed old kernels to free ~9GB. Now at 96% (4.4GB free). Worth monitoring.
@@ -0,0 +1,49 @@
+---
+name: project-smtp-credentials
+description: SMTP and email credentials for all websites — CyberMail API, verified 2026-06-06
+metadata: 
+  node_type: memory
+  type: reference
+  originSessionId: f0b18417-cc26-4fdf-87ec-7b2d69b02c44
+---
+
+## CyberMail Account (all sites)
+- **Dashboard:** https://platform.cyberpersons.com
+- **API Key (all sites):** `sk_live_7f9b0f9a29f6de31a0d229d4af75d56b094ad724fc58a57d`
+- **Send Endpoint:** `POST https://platform.cyberpersons.com/email/v1/send`
+- **Auth:** `Authorization: Bearer {api_key}`
+- **DO blocks SMTP port 587** — use API over HTTPS (port 443) for all DO-hosted sites
+- **Last verified:** 2026-06-06 — live test send confirmed, all 5 sites checked
+
+---
+
+## tomsjavajive.com — CyberMail ✅ LIVE (verified 2026-06-06)
+- **From:** noreply@tomsjavajive.com
+- **Key stored in:** `settings` DB table, key `cybermail_api_key`
+- **getSetting()** reads from `settings` table (setting_key / setting_value columns) — NOT site_settings
+- **Mailer:** `includes/functions.php` → `sendEmail()` calls CyberMail API
+- **Fixed 2026-06-06:** `email_cybermail` setting had `"api_key":"Joker1974!!!"` (wrong) — corrected to real API key
+- **Note:** TJJ admin UI (admin/emails.php, admin/integrations.php) still shows SendGrid help links — cosmetic only
+
+## tomtomgames.com — CyberMail ✅ LIVE (verified 2026-06-06)
+- **From:** noreply@tomtomgames.com
+- **Key stored in:** `includes/config.php` as `CYBERMAIL_API_KEY` constant
+- **Mailer:** `includes/mailer.php` → `cybermailSend()` | alias: `sendgridSend()`
+- **SMTP constants also defined** (SMTP_HOST, SMTP_USER, SMTP_PASS) for fallback reference
+
+## epictravelexpeditions.com — CyberMail ✅ LIVE (verified 2026-06-06)
+- **From:** noreply@orbishosting.com (sends via orbishosting.com domain)
+- **Key stored in:** `/home/epictravelexpeditions.com/public_html/api/config.php` (gitignored)
+- **Mailer:** `api/includes/mailer.php` → `sendgridSend()` (name kept for compat, calls CyberMail)
+
+## parkerslingshotrentals.com — CyberMail ✅ LIVE (verified 2026-06-06)
+- **From:** noreply@orbishosting.com
+- **Key stored in:** `/home/parkerslingshotrentals.com/public_html/db.php` (in git)
+- **sendEmail()** in db.php calls CyberMail API directly
+
+## orbishosting.com / jarvis / orbis — No transactional email
+
+---
+
+## GitHub Repo
+**myronblair/smtp-for-websites** (private, master branch) — credentials reference archive
@@ -0,0 +1,104 @@
+---
+name: project-tomsjavajive
+description: Tom's Java Jive coffee shop e-commerce — DB creds, admin portal map, known schema quirks, and fixed bugs
+metadata:
+  type: project
+  originSessionId: 002fe81e-7e03-414d-b842-1f94f1390a22
+---
+
+PHP e-commerce site for a Fort Worth coffee shop. On DO server 165.22.1.228.
+
+## Credentials & Access
+- **SSH:** root / Gonewalk1974!@# @ 165.22.1.228
+- **DB:** toms_tjj_db / toms_tjj_user / +60wlPc+55e@gFq4 (localhost)
+- **Admin login:** `admin@tomsjavajive.com / Joker1974!!!` OR `myronblair@outlook.com / Joker1974!!!` (both work, reset 2026-06-14)
+- **Stripe:** placeholder keys in config (test mode — real keys must be added manually)
+- **GitHub:** myronblair/tomsjavajive (private)
+
+## File Structure
+```
+/home/tomsjavajive.com/public_html/
+  admin/                  — admin portal
+    includes/header.php   — nav (Content group: Splash Box, About Us Text; Catalog group: Import/Export at bottom)
+    customers.php         — customer CRUD + wallet adjust
+    reviews.php           — review list + inline edit modal with star picker
+    splashes.php          — Homepage splash blocks CRUD (drag-drop image upload, icon picker, drag-to-reorder)
+    about-us.php          — About Us text CRUD (live preview, paragraph-aware)
+    import-export.php     — Inventory export CSV + import CSV (smart/replace) + inline table editing
+    api/upload-splash.php — handles splash image uploads → /uploads/splashes/
+  api/                    — backend API endpoints
+  account/                — customer-facing portal
+    wishlist.php
+    rewards.php
+    reviews.php
+  config/
+    config.php            — site config (Stripe, SendGrid, etc.) — in git
+    database.php          — DB credentials — GITIGNORED
+  includes/               — shared PHP includes
+  uploads/splashes/       — splash block images (owned nobody:nobody, 755)
+```
+
+## Database Schema Notes
+- **products table:** no `slug` column — product URLs use `?id=product_id` (not `?slug=`)
+- **wallet_transactions.type enum:** deposit, withdrawal, purchase, refund, reward, loyalty_redemption, credit, debit
+- **loyalty_transactions.type enum:** earn, redeem, adjustment, birthday_bonus, referral_bonus, referral_welcome, tier_upgrade
+- **customers table:** has `lifetime_points` (INT) and `loyalty_tier` (VARCHAR 20) columns added 2026-05-22
+- **Collation:** ALL tables must be utf8mb4_unicode_ci — mixed collation (general_ci vs unicode_ci) causes JOIN errors (MySQL 1267)
+
+## Admin Nav Groups
+- **Dashboard** — dashboard.php
+- **Catalog** — products, categories, inventory, import-export
+- **Orders** — orders, fulfillment
+- **Customers** — customers, reviews
+- **Content** — splashes (Splash Box), about-us (About Us Text)
+- **Analytics, Settings, etc.**
+
+## Homepage DB-Driven Sections
+- **Splash blocks:** `homepage_splashes` table → feature cards above products (scrollable if >4)
+- **About Us text:** `about_us_sections` table → paragraphs under "Our Story" heading
+
+## Google Merchant Feed — Fixed 2026-06-17
+- Feed URL: `https://tomsjavajive.com/merchant-feed.php`
+- Title was being built as `$p['name'] . ' ' . $categoryLabel . ' Coffee'` — doubled the suffix for products whose names already include "Whole Bean Coffee" / "Ground Coffee"
+- Fix: title now uses `$p['name']` as-is, matching exactly what's shown on the site
+- Products are approved in Google Merchant Center
+
+## Known Bugs Fixed (2026-05-22)
+- `p.slug` in wishlist/reviews queries → replaced with `p.product_id`, URLs use `?id=`
+- `wallet_transactions` adjust_wallet used wrong enum values (credit/debit) → fixed to deposit/withdrawal
+- `reviews` table uses `comment` (not `content`) and `is_approved` (not `status`)
+- `rewards.php` crashed because `lifetime_points`/`loyalty_tier` didn't exist → added via ALTER TABLE
+- Collation mismatch on wishlist, loyalty_transactions, loyalty_tiers, product_types, loyalty_settings → all converted to unicode_ci
+
+## Pages Added (2026-06-04)
+- `faq.php` — accordion FAQ: Orders & Payment, Coffee & Products, Coffee Freshness & Storage, Account & Loyalty
+- `shipping.php` — rates table (3–5 days standard after processing), "every order made fresh to ship" messaging
+- `returns.php` — three-tier policy: Your Responsibility / Our Responsibility / Shared Responsibility (covers coffee cost up to $25 on shared issues)
+- `returns.php` — adapted from DripShipper policy language
+- `track-order.php` — lookup by order_number + email; shows progress stepper, tracking number/link, items, shipping address; logged-in users see recent orders
+- `privacy.php` — full privacy policy adapted from DripShipper; GDPR section, children's info, log files, third-party cookies
+- `includes/footer.php` — Privacy Policy link added to Support section
+
+## Email (CyberMail) — Fixed 2026-06-14
+- API key: `sk_live_7f9b0f9a29f6de31a0d229d4af75d56b094ad724fc58a57d` (stored in DB as `cybermail_api_key`)
+- From email: `noreply@tomsjavajive.com` (stored as `cybermail_from_email`)
+- From name: `Toms Java Jive` (stored as `cybermail_from_name`)
+- **CyberMail API requires separate `from` and `from_name` fields** — NOT the combined `Name <email>` format. Using `Name <email>` in the `from` field returns "Invalid 'from' email address" error.
+- Fixed in: `includes/email.php` (Email class send method) and `includes/functions.php` (sendEmail function)
+
+## Product Image Upload — Fixed 2026-06-14
+- Upload endpoint: `/admin/upload-image.php`
+- Saved to: `/uploads/products/` (must be owned by `tomsj4710:nogroup`, chmod 755)
+- **Do NOT include `header.php` in upload-image.php** — it outputs full HTML which breaks JSON response
+- Upload-image.php uses `require_once '../includes/auth.php'` + `AdminAuth::getUser()` check directly
+- JS in product-edit.php uses `fetch('/admin/upload-image.php', {credentials: 'same-origin', ...})`
+- Textarea for image URLs must be `name="image_urls"` (form handler reads `$_POST['image_urls']`)
+
+## CSV Import — Fixed 2026-06-14
+- `tags`, `images`, `dimensions` columns have MySQL `CHECK (json_valid())` constraints
+- CSV cells with plain text (e.g. `coffee,dark roast`) or plain URLs must be converted to JSON arrays before insert
+- `toJsonField()` helper in import-export.php handles: already-valid JSON (pass-through), comma-separated → JSON array, empty → NULL
+- Always wrap `$r['tags']` and `$r['images']` with `toJsonField()` in any import code
+
+**Why:** Reference when debugging or extending Tom's Java Jive.
+**How to apply:** Always check these schema quirks before writing new queries against this DB.
@@ -0,0 +1,65 @@
+---
+name: project-tomsjavajive-email
+description: "Tom's Java Jive email service — CyberMail (CyberPersons), API key stored in config.php"
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: f0b18417-cc26-4fdf-87ec-7b2d69b02c44
+---
+
+## Email Service: CyberMail by CyberPersons
+
+**API Key:** `sk_live_d52bf062797105aeaafac9954c21ff988e9b41b77315807d`
+**API Key Management:** https://platform.cyberpersons.com/email/api-keys/
+**Webmail / Hosting Management:** https://platform.cyberpersons.com/email/webmail/hosting/
+
+**Stored in:** `/home/tomsjavajive.com/public_html/config/config.php`
+- Constant: `CYBERMAIL_API_KEY`
+- Replaced the old `SENDGRID_API_KEY` placeholder
+
+## Email Handler
+- File: `/home/tomsjavajive.com/public_html/includes/email.php`
+- Class: `SendGridEmail` (still named SendGrid — rename when integrating CyberMail API)
+- Sends: order confirmation, shipping notification, password reset, welcome, abandoned cart
+- Currently references `CYBERMAIL_API_KEY` constant (was SENDGRID_API_KEY)
+
+## CyberMail API Reference
+- **Send:** `POST https://platform.cyberpersons.com/email/v1/send`
+- **Status:** `GET https://platform.cyberpersons.com/email/v1/messages/{message_id}`
+- **Account Stats:** `GET https://platform.cyberpersons.com/email/v1/account/stats`
+- **Auth:** `Authorization: Bearer {api_key}`
+
+## Error Codes
+| HTTP | error.type | Description |
+|------|-----------|-------------|
+| 400 | invalid_request | Missing required fields or invalid email format |
+| 403 | domain_not_verified | Sending domain not verified |
+| 403 | domain_not_found | Domain not registered to account |
+| 403 | account_inactive | Account suspended or inactive |
+| 403 | forbidden | API key domain/IP restriction |
+| 404 | not_found | Message ID not found |
+| 429 | rate_limit_exceeded | Rate limit reached (includes retry_after field) |
+| 500 | send_failed | Sending failed after failover |
+| 503 | service_unavailable | No healthy mail nodes |
+
+## PHP Integration
+- `email.php` uses `Authorization: Bearer` header, curl over HTTPS (port 443 — no DO block)
+- Success returns `['success'=>true, 'message_id'=>'...']`
+- Failure returns `['success'=>false, 'error'=>'friendly message', 'error_type'=>'code', 'code'=>httpCode]`
+- 429 errors include retry_after seconds in the error message
+- **Required fields:** `from`, `to`, `subject`, `html` (or `text`)
+- **Optional:** `text`, `cc`, `bcc`, `reply_to`, `tags`, `metadata`, `headers`
+- **Success response:** 202 with `data.message_id`, `data.status`
+- **Domain must be verified** at platform.cyberpersons.com before sending
+
+## SMTP Credentials (blocked by DigitalOcean — use API instead)
+- Host: mail.cyberpersons.com | Port: 587 | Security: STARTTLS
+- Username: `smtp_49a1fa9c0f15d2d7`
+- Password: `T3mOFSMK1SG1l4D1d7N8NefRd8xypwMy`
+- DO blocks outbound port 587 — API over HTTPS is the working approach
+
+## Current Status
+- email.php rewritten to use CyberMail API (curl over HTTPS port 443)
+- `SendGridEmail` class renamed to `Email`, `sendEmail()` helper unchanged
+- Blocked by: `tomsjavajive.com` domain not verified in CyberMail dashboard
+- Fix: verify domain at platform.cyberpersons.com (add DNS TXT/CNAME records)
@@ -0,0 +1,30 @@
+---
+name: project-tomtomgames-email
+description: "TomTomGames email service — CyberMail API + SMTP, same API key as tomsjavajive"
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: f0b18417-cc26-4fdf-87ec-7b2d69b02c44
+---
+
+## Email Service: CyberMail (same account as tomsjavajive.com)
+
+**API Key:** `sk_live_7f9b0f9a29f6de31a0d229d4af75d56b094ad724fc58a57d` (verified working 2026-06-06)
+**SMTP Host:** mail.cyberpersons.com | Port: 587 | Security: STARTTLS
+**SMTP Username:** `smtp_ad34c4d915da7bfc`
+**SMTP Password:** `m47o2-UqPgM-IBeYNRz-uHSJAHnPGe9w`
+**From:** noreply@tomtomgames.com
+
+## Files Updated
+- `/home/tomtomgames.com/includes/config.php` — CYBERMAIL_API_KEY + SMTP constants
+- `/home/tomtomgames.com/includes/mailer.php` — rewritten to use CyberMail API via cybermailSend()
+- `/home/tomtomgames.com/public_html/api/admin.php` — mail() replaced with cybermailSend()
+
+## Email Functions
+- `cybermailSend($to, $name, $subject, $text, $html, $tags)` — primary send function
+- `sendgridSend()` — kept as alias (calls cybermailSend) for backward compatibility
+- `sendVerificationEmail($email, $alias, $token)` — registration/resend verification
+
+## Emails Sent
+- Account verification (registration + resend)
+- Password reset (admin.php)
@@ -0,0 +1,33 @@
+---
+name: project-webserver
+description: CyberPanel/OpenLiteSpeed DO server at 165.22.1.228 hosting tomsjavajive.com and 5 other sites
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: 002fe81e-7e03-414d-b842-1f94f1390a22
+---
+
+CyberPanel server running OpenLiteSpeed + MariaDB + PHP (lsphp).
+
+**SSH:** root / Gonewalk1974!@# @ 165.22.1.228
+
+**Sites hosted** (all under /home/<domain>/public_html/):
+- tomsjavajive.com — coffee shop e-commerce (PHP, custom built, Stripe, loyalty/rewards)
+- epictravelexpeditions.com
+- orbishosting.com — email only via CyberPanel; no local site (forwarded/maintained elsewhere — do NOT treat as a stub needing a site built)
+- orbis.orbishosting.com
+- parkerslingshotrentals.com
+- tomtomgames.com
+
+**Stack:** OpenLiteSpeed, MariaDB 10.11, PHP (lsphp), Redis, Memcached, PowerDNS, Postfix/Dovecot, CyberPanel
+
+**tomsjavajive.com structure:**
+- /home/tomsjavajive.com/public_html/
+- admin/ — admin portal (dashboard, products, orders, customers, analytics, etc.)
+- api/ — backend API endpoints
+- account/ — customer account pages
+- config/ — config.php, database.php
+- includes/ — shared PHP includes
+
+**Why:** IP changed from 206.189.229.53 to 165.22.1.228 as of 2026-05-22.
+**How to apply:** Use 165.22.1.228 for all SSH access to these sites.
@@ -0,0 +1,69 @@
+---
+name: project-yealink-phones
+description: Complete Yealink phone inventory — 5 physical phones (T48S/T57W/AX86R) + 3 voicemail-only virtual extensions on FusionPBX
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: 5419c63f-5e28-41c3-9055-3d9a33550b52
+---
+
+## Physical Phones
+
+| IP | MAC | Model | Label | Ext | Status |
+|----|-----|-------|-------|-----|--------|
+| 10.48.200.2 | `80:5e:c0:35:04:77` | T48S | Myron Blair Desk Phone | 1000 | Online |
+| 10.48.200.43 | `80:5e:0c:15:0c:4f` | T48S | Tommy Ivy Desk Phone | 1001 | Online |
+| 10.48.200.65 | `c4:fc:22:13:e1:89` | AX86R | Myron Blair AX86 WiFi Work Phone | 1002 | Online |
+| 10.48.200.83 | `80:5e:0c:e9:44:f8` | T57W | Kitchen Phone | 1003 | Online |
+| 10.48.200.85 | `80:5e:0c:30:75:96` | T57W | Master Bedroom Phone | 1004 | Online |
+| 10.48.200.3 | `c4:fc:22:28:63:71` | T57W | United Mirror & Glass | External SIP | Online |
+
+## Virtual Extensions (Voicemail Only — No Physical Phone)
+
+| Ext | Name |
+|-----|------|
+| 1010 | Parker County Slingshot |
+| 1011 | Epic Travel Expeditions |
+| 1012 | Tom's Java Jive |
+
+## IVR
+
+| Ext | Purpose |
+|-----|---------|
+| 900 | Auto-attendant (IVR) |
+
+## SIP Credentials
+
+| Ext | SIP Password |
+|-----|-------------|
+| 1000 | `Xk9mPw3nQv7rLs2t` |
+| 1001 | `Tv8xNm4pWq6rZs3k` |
+| 1002 | `yXHaJTwa8rj?$GkrVFQB` |
+
+## FusionPBX Connection
+
+- Server: `134.209.72.226`, Port: `5080`, Transport: UDP
+- SSH: relay through DO (`165.22.1.228`) → FusionPBX (`134.209.72.226`)
+- Web: `https://fusion.orbishosting.com` (admin / fY7XP5swgtpbzrYLhkeVYkA4744)
+- Provisioning URL: `https://fusion.orbishosting.com/app/provision/` (provision-master / Joker1974!!!)
+
+## Yealink Web UI Login
+
+T48S phones use RSA-encrypted password login (PKCS#1 v1.5). T57W uses HTTPS on port 8080.
+
+- After factory reset, provisioning URL is cleared — must re-enter manually on phone
+- Path: Menu → Settings → Advanced → Auto Provision
+- To re-provision without reboot: Menu → Settings → Advanced → Auto Provision → Update Now
+
+## BLF Buttons (confirmed working 2026-05-29)
+
+- Device profile "yealink" (UUID 2c68fe07-b29a-4429-a3c2-7ce9010c69ff)
+- 10 BLF keys, type=16 in FusionPBX
+- Buttons: Myron 1000, Tommy 1001, Myron-WkPh 1002, Kitchen 1003, Bedroom 1004, PC Slingshot 1010, Park 5901/5902/5903, Page All
+
+## Key Notes
+
+- `manage-presence = true` set in FreeSWITCH external sofia profile (DB-managed)
+- BLF type=16 required in FusionPBX (pickup_value required)
+- `overwrite_mode=1` required in provisioning
+- AVOID: `sofia profile external restart` — drops all registrations
@@ -0,0 +1,12 @@
+---
+name: user-cryptex
+description: Physical Cryptex safe combination key — 3D printed on Creality K2 Pro
+metadata: 
+  node_type: memory
+  type: user
+  originSessionId: b1e93a6a-f101-4ea4-aafb-9cb7e2958821
+---
+
+**Cryptex safe key:** `NEBYMJ`
+
+Printed on Creality K2 Pro. Physical combination lock safe.
@@ -1,75 +0,0 @@
-# FusionPBX Custom Configs (134.209.72.226)
-
-## Yealink T48S Provisioning — Critical Fixes
-
-### Problem: BLF buttons never applied from provisioning
-Root cause: nginx rewrite for `{mac}.boot` stripped the `file=` param, so FusionPBX
-served the full 122KB config as a boot file. Yealink ignores DSS keys in .boot files —
-they only apply from .cfg files.
-
-### Fix 1: nginx rewrite (in /etc/nginx/sites-enabled/fusionpbx)
-OLD: rewrite "^.*/provision/([A-Fa-f0-9]{12})(\.boot)$" /app/provision/index.php?mac=$1;
-NEW: rewrite "^.*/provision/([A-Fa-f0-9]{12})(\.boot)$" /app/provision/index.php?mac=$1&file=%7b%24mac%7d.boot;
-
-### Fix 2: {$mac}.boot template
-Created: /var/www/fusionpbx/resources/templates/provision/yealink/t48s/{$mac}.boot
-Content: boot file with includes pointing to y000000000065.cfg and {$mac}.cfg
-Phone flow: {mac}.boot (164 bytes) → y000000000065.cfg → {mac}.cfg (full config applied)
-
-### Fix 3: y000000000065.cfg template changes
- features.auto_linekeys.enable = 0  (prevents phone overriding BLF keys)
-
-### Fix 4: All y000000000000.boot templates
- overwrite_mode = 1  (forces re-provision on every reboot, default was 0)
-
-### Fix 5: External sofia profile
- manage-presence = passive  (not true — BLF SUBSCRIBEs delegate to internal profile)
- Fix: UPDATE v_sip_profile_settings SET value='passive' WHERE profile=external AND name='manage-presence'
- Then delete /var/cache/fusionpbx/FusionPBX.configuration.sofia.conf and reload sofia
-
-## Device Profile "yealink" (UUID 2c68fe07-b29a-4429-a3c2-7ce9010c69ff)
-
-| Key | Type | Value | Label | Notes |
-|-----|------|-------|-------|-------|
-| 1 | 16 (BLF) | 1000 | Myron 1000 | |
-| 2 | 16 (BLF) | 1001 | Tommy 1001 | |
-| 3 | 16 (BLF) | 1002 | Myron Vanguard | |
-| 4 | 12 | 1003 | PC Slingshot | |
-| 5 | 12 | 1004 | Epic Travel | |
-| 6 | 12 | 1005 | Toms Java | |
-| 7 | 13 (Speed Dial) | *5901 | Park 5901 | Press during call=park, idle=retrieve |
-| 8 | 13 (Speed Dial) | *5902 | Park 5902 | |
-| 9 | 13 (Speed Dial) | *5903 | Park 5903 | |
-| 11 | 16 (BLF) | *724 | Page All | |
-
-Park buttons use Speed Dial (type=13) not BLF — BLF for park requires mod_presence
-which is not installed. Speed Dial works: press during call parks it, press idle retrieves.
-
-## BLF Type Reference (Yealink T48S firmware 66.86.x, FusionPBX)
- type=16 = BLF (requires pickup_value field in template)
- type=13 = Speed Dial
- type=12 = (user-defined)
- type=1  = Line
-
-## Provisioning URL
- Server: https://fusion.orbishosting.com/app/provision/
- Auth: provision-master / Joker1974!!! (Digest)
- After factory reset: must re-enter manually via Menu > Settings > Advanced > Auto Provision
- Firmware 66.86.0.15: requires power cycle after "Update Now" to register
-
-## fail2ban Whitelist (/etc/fail2ban/jail.local)
- 107.178.2.130 (office)
- 97.154.109.245 (home WAN)
-
-## Phones
- Ext 1000 (Myron): MAC 805ec0350477, firmware 66.86.0.15, IP 10.48.200.2
- Ext 1001 (Tommy): MAC 805e0c150c4f, firmware 66.86.0.160, IP 10.48.200.43
-
-## IVR Audio
- /var/lib/freeswitch/recordings/134.209.72.226/ivr_menu.wav
- American male voice (Festival TTS), 27s, 8kHz 16-bit mono PCM
-
-## mod_presence
- NOT installed — FreeSWITCH built from source at /usr/src/freeswitch-1.11/
- Basic extension BLF works via manage-presence=true on internal sofia profile
- Park slot BLF would require mod_presence — workaround: Speed Dial buttons
@@ -1,10 +0,0 @@
-[DEFAULT]
-ignoreip = 127.0.0.1/8 ::1 107.178.2.130 97.154.109.245
-
-[ssh]
-enabled  = true
-port     = 22
-protocol = ssh
-filter   = sshd
-logpath  = /var/log/auth.log
-action   = iptables-allports[name=sshd, protocol=all]
@@ -1,9 +0,0 @@
-# In /etc/nginx/sites-enabled/fusionpbx
-# Critical fix: pass file= param so FusionPBX returns a boot file (not full config)
-# Phone ignores DSS/BLF keys when received in a .boot file — must come from .cfg
-
-# CORRECT:
-rewrite "^.*/provision/([A-Fa-f0-9]{12})(\.boot)$" /app/provision/index.php?mac=$1&file=%7b%24mac%7d.boot;
-
-# WRONG (original — serves full 122KB config as .boot, phone ignores linekeys):
-# rewrite "^.*/provision/([A-Fa-f0-9]{12})(\.boot)$" /app/provision/index.php?mac=$1;
@@ -1,7 +0,0 @@
-#!version:1.0.0.1
-## The header above must appear as-is in the first line
-
-include:config "y000000000065.cfg"
-include:config "{$mac}.cfg"
-
-overwrite_mode = 1
@@ -1,7 +0,0 @@
-#!version:1.0.0.1
-## The header above must appear as-is in the first line
-
-include:config "y000000000065.cfg"
-include:config "{$mac}.cfg"
-
-overwrite_mode = 1
@@ -0,0 +1 @@
+['back_bathroom', 'back_bedroom', 'back_door', 'back_yard', 'camper', 'car', 'car_port', 'dining_room', 'down_hill', 'front_bedroom', 'front_door', 'front_yard', 'garage', 'hallway', 'hdmibroadcast', 'kitchen', 'konnected_alarm', 'living_room', 'master_bedroom', 'office', 'outdoors', 'side_yard', 'storage', 'utility_room']
@@ -0,0 +1 @@
+404: Not Found
@@ -0,0 +1 @@
+404: Not Found
@@ -0,0 +1 @@
+404: Not Found
@@ -0,0 +1 @@
+404: Not Found
@@ -0,0 +1 @@
+404: Not Found
Author	SHA1	Message	Date
myron	e9af102dbe	Update JARVIS TODO: round 2 fixes (HA poller, DB tables, web.orbishosting.com) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-29 15:53:20 -05:00
myron	27df1eb7c9	Update JARVIS TODO with comprehensive agent deployment plan - Full prioritized TODO: critical fixes, agent deployment checklist for every host (DO, Proxmox VMs, Windows, Mac, Alpine), self-healing config - Windows agent installer details, compiled exe build instructions - HA VM109 post-rebuild checklist Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-29 13:57:47 -05:00
myron	79db9f1a55	Update MediaStack: NordVPN tunnel via CT110, exit IP 2.56.190.69	2026-06-29 13:22:24 -05:00
myron	a467a1de8f	Update CT110 WireGuard pubkey in MediaStack memory (was RXxD, now Fqb1)	2026-06-29 12:45:45 -05:00
myron	225259f1f4	Mark Gitea NAS mirror as complete; remove stale project_claude_vm.md	2026-06-29 12:01:12 -05:00
myron	2a92b958c1	Remove VM107 Claude-DHCP — Claude runs on Windows desktop Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DJT825DchsKy6ABPC4MvJp	2026-06-28 19:10:08 -05:00
myron	b71e58bbae	Remove ProxMailcow — VMs no longer exist, project retired	2026-06-26 09:11:56 -05:00
myron	3080273e0a	Emergency HA config export 2026-06-26 HA disk lost after Proxmox config reset. Exported while VM still running from page cache: areas (24), all entity states (2058), areas list. Note: Google Drive Backup addon was installed — check Google Drive for .tar backups.	2026-06-26 13:37:28 +00:00
myron	f8c406dbad	Remove stale completed-task memory files Deleted: jarvis_improvements_list (all 13 done), novacpx_todo (all done), jarvis_migration (complete — JARVIS on VM 211). Updated MEMORY.md index.	2026-06-26 03:07:03 +00:00
myron	52f6073593	Add Claude Code AI memory files AI context/memory from Claude Code sessions covering all infrastructure: JARVIS, NovaCPX, DO sites, Proxmox, FusionPBX, MediaStack, and project feedback/preferences.	2026-06-26 03:06:26 +00:00
				`@@ -0,0 +1 @@`
				`['back_bathroom', 'back_bedroom', 'back_door', 'back_yard', 'camper', 'car', 'car_port', 'dining_room', 'down_hill', 'front_bedroom', 'front_door', 'front_yard', 'garage', 'hallway', 'hdmibroadcast', 'kitchen', 'konnected_alarm', 'living_room', 'master_bedroom', 'office', 'outdoors', 'side_yard', 'storage', 'utility_room']`