# Wiki Index

Last updated: 2026-07-17
Compiled by: HOWARD-HOME/claude-main
(2026-07-06: added Goldstein client article; added Reference section — client Wi-Fi inventory.)

This wiki is LLM-maintained. Do not edit articles manually — run `/wiki-compile` to update.
Run `/wiki-lint` to check for stale entries and broken backlinks.

---

## Overview

| Article | Summary | Last Compiled |
|---|---|---|
| [Overview](overview.md) | State of the business: team, all clients, all projects, key infra, tooling — cold-start orientation doc | 2026-05-24 |

## Clients

| Article | Summary | Last Compiled |
|---|---|---|
| [Cascades of Tucson](clients/cascades-tucson.md) | Prepaid block $175/hr, **21.5 hrs remaining** (live Syncro); senior living/HIPAA; active domain migration + caregiver lockdown; CARF Tech Plan finalized 2026-07-15; nurse-station kiosk GPO built 2026-07-17 (Edge SSO + AppLocker + GPP shortcuts); 10 shared mailbox conversions 2026-07-17 (O365BP suspended 23 remaining, needs Pax8 seat swap); SPB 40/45 consumed; 0 open tickets | 2026-07-17 |
| [Dataforth Corporation](clients/dataforth.md) | Prepaid block ~$2,099/mo, **24.75 hrs remaining** (live 2026-07-14, 4 open tickets); signal-conditioning manufacturer; DOS test stations (NWTOC v5.1 deployed fleet-wide 2026-07-05); MYDATA TPSys SMT line controller (`myserver`, Fedora Core 3, VLAN2 — root recovered + DR backup); **2026-07-14: PBX SIP DNAT durable fix (native UniFi Port Forwarding rule, #32553) + Sage printing fix (stale RDP sessions on SAGE-SQL, #32552; Sage `guru` credential vaulted at `clients/dataforth/sage`)**; Sage Pro 200 ERP runs on SAGE-SQL RDS only (Easy Print redirection — native drivers not installed, watch item); 2025 ransomware recovery + incomplete file restore; 2026-03 phishing + MFA; test-datasheet pipeline (Hoffman API + testdatadb on AD2); mail stack INKY->Mailprotector->EXO; shares-ACL project (Phase 2 strawman 2026-06-22); GuruRMM fleet ~50; Bitdefender phase-off | 2026-07-14 |
| [Desert RV Center](clients/desert-rv-center.md) | Break-fix + $213.35/mo recurring; RV dealership, Huachuca City AZ; 6 managed devices; DESERTRV.local domain (LAN 10.0.0.0/24); remote users RDP into on-site VMs over **ZeroTier** ("Desert RV" net 172.29.0.0/16); **2026-07-08: restored Alicia's RDP to DRV-BECKY** (stopped ZeroTierOneService = RDP 0x204; started + auto-restart; BECKY + DESKTOP-LBO396F enrolled in GuruRMM); DRV-BECKY firewall locked to RDP-only (no silent RMM push); BECKY slowness pending; 0 open tickets | 2026-07-08 |
| [Instrumental Music Center](clients/instrumental-music-center.md) | Prepaid block $175/hr; music retail/repair; AIMsi POS on IMC1\SQLEXPRESS (SQL 2019 Std, misleading name); phantom DC (ServerIMC) slow logons; **two locations split into GuruRMM Main + MOO sites 2026-07-07** (Main 14 agents / MOO 3: BigMom, GHG12G3, IMC-LUIS); full fleet enrolled; AV = Datto EDR (not Bitdefender); IMC1 SQL max-memory caps applied 2026-07-07 | 2026-07-10 |
| [Jimmy Company](clients/jimmy.md) | Break-fix, $150/hr; single aging workstation BLASTER2 (Win10 22H2 EOL, i5-3470/3.8GB — replace); backups the recurring theme (QuickBooks data); onboarded to GuruRMM 2026-06-19 (RDP NLA + Kaseya removal + cleanup); MSP360 local backup drive full, 90-day retention set, space reclaim pending in console (cloud B2 healthy) | 2026-06-19 |
| [Valley Wide Plastering](clients/valleywide.md) | Prepaid block, 15.5 hrs remaining; plastering/stucco contractor; HP DL360 Gen10 + XenServer; VWP-FILES (G:) on Hyper-V — SMB1 enabled for the legacy XP Orders VM (V-XP); VB6 app modernization project; RDWeb brute-force incident; 11 Yealink phones pending | 2026-06-23 |
| [ACG Internal Infrastructure](clients/internal-infrastructure.md) | ACG's own hosting infra — Neptune Exchange (cert expires 2026-05-31, DkimSigner disabled), IX server, Cloudflare tunnel workaround, ACG M365 tenant gaps | 2026-05-24 |
| [BirthBiologic](clients/birth-biologic.md) | Bio/healthcare (cord blood/donor services), Stilwell KS; Syncro 17983014, prepaid 3.0 hrs; **Datto→SharePoint migration COMPLETE** — all sites reconciled 0 missing; Quality Systems Department final sync done 2026-06-30 (3,768 files, 4 live-work files preserved); **MX cut to M365 2026-06-27**, mail Batch 1 Synced (14/14), Batch 2 (5 formers) pending; tenant fully onboarded (Exchange Operator/User Manager/Defender); migration VM ACG-DWP-X-BB (Jupiter, 172.16.3.45, Datto svc frozen); active: #32187 Scheduled — off-hours site rename → "Quality Department" (Wed 2026-07-01 7-8 PM MST) | 2026-07-01 |
| [CryoWeave](clients/cryoweave.md) | Custom cryogenic cable assemblies; cPanel on IX; website redesign + SEO project in progress; Syncro ID not documented | 2026-05-24 |
| [Darrell Delphen](clients/darrell-delphen.md) | Break-fix residential (Yantis, TX); single Windows workstation DDDOffice072023 (GuruRMM); 2026-06-18 Outlook email links failing = ISP-managed Extreme EXOS gateway "NetIQ" SNI-filtering of Intermedia's url.emailprotection.link rewriter (WARP interim bypass, ISP disabled the feature for permanent fix); Syncro #35996725 | 2026-06-18 |
| [Glaz-Tech Industries](clients/glaztech.md) | ~200 users, 9 locations; prepaid ~22.25 hrs; web server WWW (192.168.8.72 / 65.113.52.88) — IIS 10/VB.NET e-commerce; CRITICAL security posture: website connects to GTI-INV-SQL as sysadmin (login `tom`, named SQL login, C0 top finding) + plaintext PANs+CVV (stored by GTIware PSA, not website) + plaintext passwords + SQLi via `quo()` + XSS; apex 404 fixed + payment TLS fixed 2026-06-03; intrusion/brute-force log review 2026-06-04 (no attacker found; H5 detection blind spot confirmed — HTTP 200 on both success/failure + no failed-login logging); #32378 Waiting on Customer (assessment + reports + Appendix A delivered); M365 no MFA; SCL bypass rules for vendor DMARC + MailProtector digests | 2026-06-04 |
| [Goldstein (Sheldon Goldstein)](clients/goldstein.md) | Law firm (lawyersdallas.com), break-fix/T&M; two locations — Dallas TX (Michelle) + Tucson/Armory Park (Sheldon); GuruRMM client with Dallas (SILVER-PEAK-3739) + Tucson (RED-LION-9255) sites; **DALLAS upgraded Home→Win11 Pro for Workstations + RDP enabled for Tucson over the S2S VPN (2026-07-07, #32490 invoiced $150)**; onboarded 2026-07-06 (ScreenConnect + GuruRMM, diag AMBER, no backup agent); cust 25307933 | 2026-07-10 |
| [Grabb & Durando Law Office](clients/grabb-durando.md) | Personal injury law firm; GND-SERVER GuruRMM enrolled; AI demand review app scoped ($4K–$7K); website migration pending; plaintext DB password in README needs vaulting | 2026-05-24 |
| [Pavon](clients/pavon.md) | Former/archive client; GeoVision NVR surveillance; OwnCloud at 172.16.3.22 backed by Uranus; cron stacking fixed; Nextcloud migration deferred 3–6 months | 2026-05-24 |
| [Rieusset Corp (Tom Sorensen)](clients/rieusset-corp.md) | Small business; email hosted on Neptune Exchange (4 mailboxes: tsorensen, tomrc, ojodeagua, csorensen @rieussetcorp.com); Mailprotector domain ID 57833; outbound via SBR Outbound.Sorensen connector; clipto.com allow rule added 2026-06-08 | 2026-06-08 |
| [Rednour Law Offices](clients/rednour.md) | Law firm (break-fix/T&M, prepay 0); M365 rednourlaw.com (tenant 4a4ca18a) onboarded, 5 ComputerGuru SPs consented, no MDE license; 3 Win workstations GuruRMM-enrolled (all RED, prior MSP agents pending removal) — **all three now on Win 11** (LEGALASST + Carrie/REDNOURCARRIEVI upgraded 2026-06-29); REDNOURCARRIEVI hosts the firm's peer-to-peer SMB shares (Nick's Mac access done 2026-06-25); **Carrie's Win11 upgrade root cause = corrupt download (`ks.sys` 0x80070570 -> SAFE_OS 0x8007000D); fixed via fresh Media Creation Tool media — done in-shop, build 26200**; GuruRMM **works** on the Windows boxes (earlier "not working" disproved); macOS RMM agent still won't enroll (site code-vs-UUID bug, coord 6f2d22be); `endpointprotection.exe` = Datto AV (Defender RTP off by design); #32368 invoiced #67912 $669.55 (Nick = no charge); plaintext local-account creds from Syncro notes vaulted (clients/rednour/local-accounts) | 2026-06-30 |
| [Peaceful Spirit Therapeutic Massage](clients/peaceful-spirit.md) | Massage therapy, two sites (Country Club 2930 N Country Club Rd + Northwest 6650 N Oracle); break-fix, Syncro 278525, 31 assets; **two-DC domain** — PST-SERVER (192.168.0.2, 2016 Essentials, all FSMO) + **PST-DC-NW (192.168.1.5, new 2019 Std physical server, replaced dead PST-SERVER2 on 7/2)** with DFS-R (PST-DFS) — **Gate 4 blocked on initial ~265 GB sync** over S2S VPN; L2TP/IPsec RRAS VPN complete (GuruRMM agents); data protection = B2/MSP360 "Files Backup 2025" + VSS shadow copies on G: + daily deletion-audit report (SACL 4660/4663 → HTML in the legal folder); **June–July 2026 file-deletion investigation** — 47,749 files gone from `@Clients` since 6/24 but ~93% duplicate cleanup, **~3,342 genuine recoverable** from MSP360/B2 staging (Glennda trigger = misspelled duplicate, canonical folder intact; 6/29/2025 restore point purged by 365-day retention); **Admin1/Admin2 NTFS hardening** on G:\Shares\Scanned (fixed inverted group nesting; Admin1 = RX,W + deny-delete, Admin2 = Full); vault drift open (pst-admin password) | 2026-07-03 |
| [Patriot Internal Medicine](clients/patriot-internal-medicine.md) | Medical practice, two locations (Tucson + Sonoita); GuruRMM client+sites provisioned 2026-06-18 (Tucson: NORTH-WOLF-6270, Sonoita: LIGHT-HARBOR-9617); no agents deployed yet; enrollment keys vaulted; infrastructure discovery pending | 2026-06-18 |
| [Sombra Residential LLC](clients/sombra-residential.md) | Property management; Server2013 (actually WS2012 EOL, unpatched) + DESKTOP-UQRN4K3 GuruRMM enrolled; Transwiz migration artifacts cause Office credential prompts | 2026-05-24 |
| [Stamback Septic](clients/stamback-septic.md) | Septic services; prepaid block ~3.5 hrs remaining; DESKTOP-BTR2AM3 + StambackLaptopNew GuruRMM enrolled; OneDrive identity wipe pattern documented | 2026-05-24 |
| [BG Builders LLC](clients/bg-builders.md) | Construction; M365 bgbuildersllc.com (CIPP: sonorangreenllc.com); terminated employee (Lesley Roth) — account disabled, litigation hold, device wipes pending; no Intune | 2026-05-24 |
| [Equity Valuation Services (EVS)](clients/evs.md) | Financial services; minimal infra documented; single Win11 VM maintained by Howard; Win11 right-click menu fix applied | 2026-05-24 |
| [Furrier / Desert Rat](clients/furrier.md) | Mike Furrier owner; desertrat.com on websvr/cPanel; DMARC p=reject + Mailprotector SBR fix applied 2026-04-21; tim@ is a forwarder (not a mailbox); Syncro ID 391491 | 2026-05-24 |
| [Horseshoe Management](clients/horseshoe-management.md) | Property management; prepaid block 31.75 hrs remaining at $175/hr; APC Smart-UPS P.17 bypass relay fault cleared; repeat UPS failures suggest electrical issue; plaintext creds in Syncro notes — needs vault migration | 2026-05-24 |
| [Kittle Design & Construction](clients/kittle-design.md) | **SUPERSEDED → see [kittle.md](clients/kittle.md)** (consolidated 2026-06-09). Older M365-breach-only article; the canonical Kittle record now lives at clients/kittle.md. | 2026-06-09 |
| [Wolkin Law](clients/wolkin.md) | Law practice; contract type (verify); Robert Wolkin (owner/attorney) + Julie (assistant/remote worker); M365 rswolkin.com (Julie has FullAccess to Robert's mailbox); 3 GuruRMM Win11 agents (FRONT office PC, RSW-Laptop remote, DESKTOP-V1JT1SE Bob's desktop); ZeroTier mesh VPN 17d709436c834c9b (10.147.19.199 FRONT, 10.147.19.54 RSW-Laptop); SMB shares Data/OneDrive/ClientFiles accessible via ZeroTier; printer access incomplete (deferred to Windows PC); active ticket #32369 remote work setup | 2026-06-07 |
| [The Law Offices of Chris Scileppi](clients/scileppi-law.md) | Tucson law firm; Syncro ID 9601863; recurring managed (~$481.10/mo) + break-fix; Synology NAS `SL-SERVER` (192.168.242.5, `Data` share); Sylvia Mac `Mac-mini-2` on Wi-Fi (mount by `SL-SERVER.local`, keep displaysleep 0); all-UniFi site (UCG-Scileppi) cloud-managed, Cox WAN; GuruRMM + ScreenConnect enrolled; 8 GB Mail replacement pending (verify) | 2026-07-02 |
| [Western Tire](clients/western-tire.md) | Tire retail (jackfurriers.com brand); Mike Furrier owner (Syncro ID 391491); email migrated from websvr to IX 2026-04-22; 30 mailboxes; SSL cert expires 2026-05-30 | 2026-05-24 |
| [Kittle Design & Construction LLC](clients/kittle.md) | **Canonical Kittle article.** GC Tucson AZ; Syncro 32460233; M365 kittlearizona.com (tenant 3d073ebe); **major June 2026 BEC/ACH-fraud incident** — Ken+marco+Accounting compromised, fraudulent bank-change to City of Tucson + Town of Marana ($130K+ exposure, PREVENTED, no loss), IC3 filed; root cause = April credential theft + incomplete remediation (password never reset → ~2mo persistence); CA hardened + Entra P2 added 6/9; HPE MicroServer WS2025 EVAL, no backups/firewall | 2026-06-09 |
| [Khalsa (two-site)](clients/khalsa.md) | Khalsa Montessori School (Syncro 9456554); two-site (Camden + River); domain khalsa.local on 10.11.12.0/22. **Server inventory captured 2026-06-19** (Syncro+ScreenConnect): TROUT (Camden, 10.11.12.254) = sole live DC+DNS+file(K:)+QuickBooks on aging Dell T110 II, ~490GB used, C: only 10% free; SALMON (River, 10.11.14.76) = standalone file/QB server; KHALSADC2 = intended 2nd DC OFFLINE since 2025-08 (no AD redundancy). **TROUT can't be removed as-is** (Schoolmaster gone but it now runs DC/DNS/QB) — needs role migration first. No server backups captured; VPN to ACG broken (manage via ScreenConnect). M365/contract terms still pending | 2026-06-19 |
| [Lone Star Electrical Systems](clients/lonestar-electrical.md) | Electrical contractor Tucson AZ; Syncro 33809612, prepaid block DEPLETED (0 hrs @2026-07-06); Google Workspace (not M365); ManageEngine MDM (Zoho); Unraid "Tower" (7.1.4, live IP 192.168.120.177) + LONESTAR-VM — recurring VM-loss ROOT-CAUSED+FIXED 2026-07-06 (leftover /boot/config/go libvirt hijack); LS-1/LS-2 Sophos removal COMPLETE; field/mobile-first | 2026-07-06 |
| [Anaise](clients/anaise.md) | Single workstation client; contact David (anaisedavid.office@gmail.com); DESKTOP-O8GF4SD; creds in vault at clients/anaise/desktop-o8gf4sd.sops.yaml; onboarding incomplete; M365 enrollment unconfirmed | 2026-05-24 |
| [ACG Website (azcomputerguru.com)](clients/azcomputerguru.com.md) | Public website redesign (Astro); score 33/40; placeholder testimonials + no-backend form are pre-launch blockers; OKLCH token design system; see internal-infrastructure.md for ACG servers | 2026-05-24 |
| [Quantum WMS](clients/quantumwms.md) | WMS company; quantumwms.com tenant (ddf3d2c9); GoDaddy decoupling + M365 migration; 2x Business Premium + Exchange Online Plan 1; deadline 2026-06-03; Tenant Admin consented 2026-05-26 | 2026-05-26 |
| [AT Trebesch](clients/attrebesch.md) | Residential, Tucson AZ; Syncro 238740; GuruRMM enrolled (DESKTOP-QNP3ON5, SWIFT-LION-2892); PST contact recovery imported (~660 contacts, emails populating, one Gleason); 4 source PSTs re-mounted after accidental unmount; Suggested Contacts (639) cleared (not reversible); pending Howard clarification before next step; Syncro #31953 open | 2026-06-02 |
| [Deere Park Development, LLC](clients/deere-park-development.md) | Property development ("Glabman"); Syncro 7088463; per-incident, no prepaid block; no tax rate assigned (must fix before billing); active estimate #7190 (ticket #32366) — UniFi WiFi 7 deployment (4x U7 Pro + 2x U7 Mesh + UCG Ultra + USW-Flex-2.5G-8-PoE), $2,816.70, Fresh | 2026-06-02 |
| [Universal Cryogenics](clients/ucryo.md) | New client onboarded 2026-06-02; ucryo.local DC (UC2-SERVER), 8 agents, 2019 TrickBot remediated, Backblaze TLS backup fix | 2026-06-02 |
| [Sif-oidak District - Tohono O'odham Nation](clients/sif-oidak.md) | Tribal government; SifOidak.local AD domain; SIF-SERVER (primary DC) + SIF-SERVER2 + 2 laptops GuruRMM enrolled; M365 sifoidak.onmicrosoft.com onboarded 2026-06-03 (all 4 ACG MSP apps; 11/11 seats); not yet in CIPP; Syncro 7694718 | 2026-06-03 |
| [Starr Pass Realty](clients/starr-pass.md) | Real estate; Syncro 153298; flat-rate ~$92.93/mo; starrpass.com M365 tenant (222450dd) onboarded 2026-06-10; sole M365 user sysadmin@starrpass.com (Brian Shinn); DNS on ACG IX; legacy Neptune mailbox cansley@devconllc.com; 2 Syncro assets | 2026-06-10 |
| [Universal Minerals International](clients/universal-minerals.md) | Minerals/commodities, Tucson AZ; Syncro 34844920; **break-fix, no prepaid/RMM**; CyndyOffice (HP Pavilion TP01, Win11 Home, QuickBooks Enterprise 22.0) intermittent hard-freeze (Kernel-Power 41, no dump = hardware/firmware) — BIOS F.38 + Fast Startup off + memtest passed 2026-06-10, PSU prime remaining suspect; QB messaging crash-loop repaired; ticket #32397 monitoring; temporary diagnostic RMM agent removed same-day | 2026-06-10 |
| [Putt Land Surveying](clients/putt-land-surveying.md) | Land surveying firm; Syncro 7180175; managed services $223.92/mo; 7 devices; M365 direct (8 mailboxes, cloud-only, 2x Basic + 5x Premium); **DNS wipe 2026-06-09** — all records deleted (MX, SPF, autodiscover, A), email+website down; GoDaddy domain in client's own account (no ACG control); ticket #32404 Waiting on Customer; remediation tools onboarded 2026-06-10 | 2026-06-10 |
| [Gonzvar Tax Services](clients/gonzvar-tax-services.md) | Tax services firm; Syncro 1830740 ("Gonzvar Tax Service", break-fix, ~$175/hr); 6 machines in GuruRMM (GTS.local AD, 2 servers + 4 workstations); open security findings from 2026-06-06 onboarding baseline; QuickBooks RemoteApp + Tailscale VPN pending | 2026-06-12 |
| [Michael Johnson (Law Office)](clients/michaeljohnson.md) | Solo legal practice (inferred — WordPerfect/Seabill, paralegal), Tucson AZ; Syncro 152567 (since 2013), break-fix, no prepaid ($175 onsite); mail on Google (not M365); 2-person peer-to-peer workgroup (Michael + Crystal, share now on static IP); GuruRMM onboarded 2026-06-29 (site Main, BRIGHT-RIVER-8998) + Datto EDR/AV on both — DESKTOP-GG4LKSL (AMBER) + MJ-PARALEGAL (RED: firewall off + E: 0% free); no backup agent on either; no open tickets | 2026-06-29 |
| [Tohono O'odham Nation DoIT](clients/tohono-oodham-doit.md) | Tribal government IT dept; Syncro 33069069; Starlink reseller client — 2x Check Point 1550 field sites on Starlink Roam (CGNAT); break-fix $175/hr; VPN design (IPsec vs Tailscale) pending | 2026-05-27 |
| [Tucson Golden Corral](clients/tucson-golden-corral.md) | Restaurant (Tucson AZ); Syncro 3859123; prepaid block 12.75 hrs; email on Neptune Exchange; WS2016 single-box DC/RDS/Hyper-V/SQL + Sage 100 ERP (TGC-SERVER colocated at ACG main office); architecture concerns outstanding | 2026-05-26 |
| [Russo Law Firm](clients/russo-law.md) | Tucson law practice; Syncro 23331699; managed $543.50/mo (GPS+AV+backup+Seafile hosting+Office) + OIT phone $45.44/mo; 12 prepaid hrs; M365 rrs-law.com (~3 seats, admin guru@ vaulted); **active pre-sales 2026-06: wants to move ~6.5 TB from Seafile to SharePoint — full live move ~$1,120/mo (~$13.4K/yr), recommend hybrid (SP Online working set + Seafile bulk); phone meeting pending, client not yet responded** | 2026-06-15 |
| [Len's Auto Brokerage](clients/lens-auto-brokerage.md) | Auto brokerage Tucson AZ; Syncro 3289131; managed $190.87/mo + 4.25 prepaid hrs; WORKGROUP (no AD), ScreenConnect + GuruRMM (8 agents online, site `UPPER-STAR-2820`); LAB-SVR = LENS-SV = DESKTOP-BMBTQLI (one Server 2019 box, .81); **EOL lab-server (Server 2008 SP2, .241) still in production** — Deskman + QuickBooks migration to 2019 + decommission pending; RDP to 2008 box fails (CredSSP 0x800706be); Deskman transient mid-update crash (UnauthorizedAccessException) self-resolved 2026-06-17; no open tickets | 2026-06-17 |
| [Taylen](clients/taylen.md) | New site (1141 W Calle Concordia, Tucson AZ); single **EdgeRouter X** under UISP remote management — brought online 2026-07-14 (created UISP site "Taylen" + authorized the ER-X, previously stuck unauthorized); WAN 24.23.65.18; **on EdgeOS 3.0.1** (upgraded from 1.10.11 via UISP 2026-07-15); no GuruRMM/Syncro/endpoints documented yet | 2026-07-15 |

## Projects

| Article | Summary | Last Compiled |
|---|---|---|
| [GuruRMM](projects/gururmm.md) | RMM platform, Rust/Axum server + React dashboard + cross-platform agent; **agent v0.6.78 fleet-wide stable / 0.6.79 beta / server v0.3.103 / dashboard = Fleet-Policy Console**; ~360 enrolled; migrations through 068_visible_agents_folder_id. Merge to main = build+deploy; channel default FAIL-CLOSED beta (BUG-023), explicit promote to stable. Recent (2026-07-06): **Fleet-Policy Management Console** shipped to PROD (policy-ui — folder tree table / place-devices / effective-policy viewer / version-history / backfill; migration 068, folder_id in API); **WS-looper comms-durability** hardening (bounded WS write-timeout + heartbeat-count blackhole-vs-stall diagnostic + AIMD adaptive keepalive; agent 0.6.79 beta / server 0.3.102). Prior (2026-07-04/05): four bug-fix batches v0.3.95->v0.3.99 + policy-core (migration 067). **BUG-024 OPEN/CRITICAL** — Linux glibc incident, Linux binaries QUARANTINED (re-quarantined every build) pending glibc-floor fix; 4 chronic one-way-WS agents now have a server-visible blackhole diagnostic. Spec'd 2026-07-07: Feature 6 Phase-1 `security-detection-alerts` (Bitdefender detections -> RMM alerts, planning only). Active development | 2026-07-07 |
| [GuruConnect](projects/guruconnect.md) | ACG's proprietary Rust remote-access/remote-support tool (ScreenConnect-class) — Windows agent + web dashboard; **v0.3.0 production** at connect.azcomputerguru.com; versioned integration contract with GuruRMM; co-located on the physical .30 box (shares the PG cluster); next: SPEC-018 session broker / capture worker as SYSTEM | 2026-06-12 |
| [GPS -> GuruRMM Coverage Audit](projects/gps-rmm-audit.md) | Verify every GPS-billed client is fully enrolled in GuruRMM with billed services real (backup/AV/email). Single current list = `gps-master-status.md`. Phase 4 backup verification: authoritative source = MSP360 API (not B2 buckets); only 16/40 bill backup (7 OK / 2 review / 7 NOT backing up, endpoint-verified). Built msp360/seafile/owncloud/datto-workplace skills; 20 client wikis (56->76); onsite installer kit (Desktop/CLIENTS). Onboarded Janet Altschuler/Marty Ryan/BST + 3 shells. Datto Workplace key pending Mike; billing findings HELD for Winter/Mike; AutoEnroll task disabled | 2026-07-07 |
| [Dataforth DOS — Test Datasheet Pipeline](projects/dataforth-dos.md) | DOS update system + TestDataDB pipeline (Node.js, PostgreSQL, Hoffman API); 469K records, 458.5K live on website; 2025 crypto attack recovery; security incident 2026-03-27; SCMVAS/SCMHVAS extension; email notifications via Graph API | 2026-05-24 |
| [ClaudeTools Discord Bot](projects/discord-bot.md) | Claude Agent SDK bot in Discord; one persistent session per thread; Phase 1.5 complete (native tools, no hand-written tools); Phases 2-4 (API integration, remediation, UX) pending; runs as NSSM service on BEAST | 2026-05-24 |
| [The Computer Guru Show](projects/radio-show.md) | Radio show archive processing pipeline (Whisper + pyannote + SQLite FTS5) + post-show content workflow; 572 episodes indexed; FastAPI UI redesigned; Jupiter audio-file gap open | 2026-05-24 |
| [MSP Pricing & Marketing](projects/msp-pricing.md) | GPS pricing docs + Python calculators + MSP Buyers Guide HTML; covers GPS monitoring, support plans, block time, web/email hosting, VoIP; customer-facing tools pending | 2026-05-24 |
| [Wrightstown Smarthome](projects/wrightstown-smarthome.md) | Home automation project (HA Yellow + Ollama + LiteLLM + Wyoming voice stack); 4-VLAN design; planning phase only as of 2026-02-09; no hardware deployed | 2026-05-24 |
| [Wrightstown Solar](projects/wrightstown-solar.md) | Off-grid solar project (EVE C40 16S5P packs, Victron MultiPlus II, JK BMS); Phase 1 budget $2,175–2,945; planning phase only as of 2026-02-09; no hardware purchased | 2026-05-24 |
| [GuruRMM Agent](projects/gururmm-agent.md) | Cross-platform endpoint agent (Rust) for the GuruRMM platform — metrics, remote execution (system/user_session contexts), BSOD detection, VSS shadow copy, self-update w/ rollback, watchdog, compliance reporting; Windows/Linux/macOS. Companion to [GuruRMM](projects/gururmm.md) | 2026-06-12 |
| [MSP Tools (umbrella)](projects/msp-tools.md) | Umbrella directory for ACG's MSP tooling — hosts the GuruRMM + GuruConnect submodules plus GuruScan, audit scripts, quote-wizard, and operational utilities | 2026-06-12 |
| [Valley Wide "Orders" Modernization](projects/valleywide-orders-modernization.md) | VWP's custom VB6 construction ERP ("ORDERS" / Orders_10A.exe) — Jet/Access, Crystal 7, True DBGrid, FarPoint Spread, ~130 tables (2GB Jet wall). **Full VB6 source RECOVERED 2026-06-13** from Darv's machine backup (Darv.rar on WINFileSvr); staged to repo (147 .frm/4 .bas, newest 2020-06-09). **7-phase modernization roadmap established 2026-06-14** (8-9 months) — dual-client strangler pattern: Jet→SQL first, then gradual web development with beta users. Ticket #32280 | 2026-06-14 |
## Systems

| Article | Summary | Last Compiled |
|---|---|---|
| [GuruRMM server (gururmm-build)](systems/gururmm-build.md) | 172.16.3.30 — **physical box** (Lenovo ThinkCentre M83, Ubuntu 26.04); GuruRMM API :3001, ClaudeTools API :8001, Coord API, MariaDB, PostgreSQL 18, build pipeline. Replaced the Jupiter VM at this IP 2026-06-11 | 2026-06-12 |
| [Jupiter](systems/jupiter.md) | 172.16.3.20 — Unraid primary NAS; virsh host for all VMs; Docker: NPM, Gitea, Seafile; iDRAC at 172.16.1.73 | 2026-05-24 |
| [Pluto (Claude-Builder)](systems/pluto.md) | 172.16.3.36 — Windows Server 2019 virsh VM on Jupiter; **fallback** Windows MSI + cargo build host for GuruRMM (Beast/GURU-BEAST-ROG is primary) | 2026-06-12 |
| [Uranus](systems/uranus.md) | 172.16.3.21 — Unraid secondary (Dell R730xd); OwnCloud archive storage only; formerly Saturn's IP (reused Apr 2026); RAM too low for VMs | 2026-05-24 |
| [IX Web Hosting Server](systems/ix-server.md) | 172.16.3.10 / 72.194.62.5 — cPanel/WHM 134 on CloudLinux 9.7 (64-core Xeon, 4.4 T /home); **72 cPanel accounts / 185 domains / 101 WordPress** + ACG sites (radio Astro, Flarum community, Matomo analytics); GuruRMM-enrolled; SSH key auth from GURU-5070; behind Cloudflare tunnel `acg-origin`; **backups look unconfigured (gap)**. Live SSH inventory 2026-06-05 — full account→domain map in the article | 2026-06-05 |
| [pfsense (ACG Gateway/Firewall)](systems/pfsense.md) | 172.16.0.1 (SSH :2248) — ACG office FreeBSD gateway/firewall + Tailscale subnet router. ALSO the home of the **fleet-wide pfSense management tooling** in the `unifi-wifi` skill: SSH backend (`pfsense-ssh.sh` + `pfsense-gwc.php`) that audits/controls ANY client pfSense — `audit`/`pf-*`/`fw-*`/`block-ips`, DRY-RUN default, cred `clients/<slug>/pfsense-firewall`. Validated on Cascades (Plus 25.07) 2026-06-21 | 2026-06-21 |
| [UOS Server (UniFi OS Server)](systems/uos-server.md) | 172.16.3.29 (web/API :11443 via NPM, **not** 8443) — self-hosted UniFi OS controller (~49 sites), virsh "Unifi" VM on Jupiter; UniFi Network `ace` MongoDB in rootless podman; query via `.claude/scripts/uos-mongo.sh` (root SSH key `infrastructure/uos-server-ssh-key`). UniFi half of the `unifi-wifi` skill — pairs with [pfsense](systems/pfsense.md) at UniFi-behind-pfSense sites | 2026-06-21 |
| [PacketDial (ACG VoIP / NetSapiens via OIT)](systems/packetdial.md) | ACG's VoIP brand on the NetSapiens PBX (white-labeled via OIT/OITVOIP). PBX API `pbx.packetdial.com/ns-api/v2`, reseller `91912.service` (key vault `msp-tools/oitvoip`); Yealink phones via **YMCS** `us-api.ymcs.yealink.com` (one ACG key → all client sites; vault `services/yealink-ymcs`). Driven by the `packetdial` + `yealink-ymcs` skills; `onboard-domain` pipeline. `vwp.91912.service` onboarded 2026-06-22 | 2026-06-22 |

## Patterns

| Article | Summary | Last Compiled |
|---|---|---|
| [Tailscale client management](patterns/tailscale-client-management.md) | One tailnet per client (never merge into yours); you hold Admin; enroll devices as tagged nodes via pre-auth keys pushed from GuruRMM ([enroll script](patterns/tailscale-client-enroll.ps1)). Windows subnet-routing reality + "see each other" ACL. | 2026-06-06 |

## Reference

*Manually / skill maintained — NOT produced by `/wiki-compile`.*

| Article | Summary | Maintained |
|---|---|---|
| [Client Wi-Fi Inventory](reference/client-wifi.md) | Human-readable index of client Wi-Fi networks (SSID/band/location) so we connect onsite without asking. **Passwords are NOT here** — encrypted in vault `clients/<slug>/wifi.sops.yaml`. Build as discovered. Automated `/wifi` importer planned. | 2026-07-06 |

---

## Cross-Reference

| Client | Systems | Projects |
|---|---|---|
| Cascades of Tucson | CS-SERVER (192.168.2.254), pfSense (192.168.0.1), cascadesDS (192.168.0.120) | GuruRMM (RECEPTIONIST-PC + CS-SERVER enrolled) |
| ACG Internal | gururmm-build (172.16.3.30, physical), Jupiter (172.16.3.20), Beast/GURU-BEAST-ROG (100.101.122.4, tailnet), Pluto (172.16.3.36), Uranus (172.16.3.21) | GuruRMM server + ClaudeTools API on gururmm-build; Windows MSI builds on **Beast (primary) / Pluto (fallback)**; Gitea/NPM/Seafile on Jupiter. Saturn DECOMMISSIONED. |
| Dataforth Corporation | AD1 (192.168.0.27), AD2 (192.168.0.6), D2TESTNAS (192.168.0.9), SAGE-SQL (192.168.0.153), FILES-D1, DF-HYPERV-B, UDM (192.168.0.254); Neptune Exchange physically at Dataforth D2 (172.16.3.11 / 67.206.163.124) | Dataforth DOS — Test Datasheet Pipeline; GuruRMM (45 agents enrolled as of 2026-06-04: DF-GAGETRAK, HGHAUBNER, AD1, AD2, FILES-D1, SAGE-SQL, DF-HYPERV-B, DF-SVR-D2-Sync, eng-dev-server + workstations) |
| Instrumental Music Center | IMC1 (192.168.0.2), phantom DC ServerIMC (192.168.0.63 — DNS-only, do not use) | GuruRMM (IMC1 enrolled) |
| Valley Wide Plastering | VWP_ADSRVR (192.168.0.25), VWP-QBS (172.16.9.169), HP DL360 iLO (172.16.9.125), UDM (172.16.9.1) | — |
| BirthBiologic | BB-SERVER (WS2016, GuruRMM enrolled) | GuruRMM |
| Glaz-Tech Industries | M365, ~200 users, 9 locations; WWW (192.168.8.72 / 65.113.52.88, IIS 10 / .NET 4.8, GuruRMM agent 455a1bc7); SQL backend (192.168.8.62,3436); CyberSource REST (PNC merchant) | GuruRMM (WWW agent enrolled) |
| Grabb & Durando Law Office | GND-SERVER (WS2019, GuruRMM enrolled) | GuruRMM; AI demand review app (scoped) |
| Pavon | OwnCloud VM (172.16.3.22), Uranus /Archive storage | — |
| Peaceful Spirit | PST-SERVER (192.168.0.2, agent 87293069), UCG-PST-CC UDR Ultra (192.168.0.10 / 98.190.129.150), 4 workstations | GuruRMM |
| Patriot Internal Medicine | Two locations (Tucson, Sonoita); no systems documented yet | GuruRMM (client+sites provisioned, no agents deployed yet) |
| Sombra Residential LLC | Server2013 (WS2012 EOL) + DESKTOP-UQRN4K3, GuruRMM enrolled | GuruRMM |
| Stamback Septic | DESKTOP-BTR2AM3 + StambackLaptopNew, GuruRMM enrolled | GuruRMM |
| BG Builders LLC | M365 bgbuildersllc.com; no on-prem infra documented | — |
| Equity Valuation Services | Single Win11 VM (no IPs documented) | — |
| Furrier / Desert Rat | websvr.acghosting.com (162.248.93.233); desertrat.com on cPanel/exim | — |
| Horseshoe Management | APC Smart-UPS 1350; no server/network detail documented | — |
| Kittle Design & Construction | M365 kittlearizona.com; no on-prem infra documented | — |
| Scileppi Law | Sylvias-Mini (Mac14,3 M2 8 GB); GuruRMM site WEST-MEADOW-9025 (enrollment pending) | GuruRMM (enrollment blocked — macOS agent not yet shipped) |
| Western Tire | ix.azcomputerguru.com (72.194.62.5) — email host; websvr.acghosting.com — DNS authoritative | — |
| Kittle | HPE MicroServer Gen11 (10.0.0.5), UniFi switch (10.0.0.122); flat 10.0.0.0/24 | GuruRMM (enrollment in progress) |
| Khalsa | DC TROUT (10.11.12.254); two sites (Camden, River) | — |
| Anaise | DESKTOP-O8GF4SD; single-workstation | — |
| ACG Website | IX Web Hosting (cPanel); Astro static site | — |
| Sif-oidak District | SIF-SERVER (DC, SifOidak.local, GuruRMM enrolled), SIF-SERVER2 (role unknown, GuruRMM enrolled), Sif-Laptop554/555 (GuruRMM enrolled); M365 sifoidak.onmicrosoft.com | GuruRMM |
| BG Builders LLC | M365 bgbuildersllc.com; no on-prem infra documented | — |
| Kittle Design & Construction | M365 kittlearizona.com; no on-prem infra documented | — |
| Horseshoe Management | APC Smart-UPS 1350; no server/network detail documented | — |
| Furrier / Desert Rat | websvr.acghosting.com; cPanel exim | — |
| Equity Valuation Services | Single Win11 VM | — |
| Scileppi Law | Sylvias-Mini (M2 Mac mini) | GuruRMM (enrollment pending) |
| Universal Cryogenics | UC2-SERVER (172.29.0.5, DC, guest VM); WIN-709JUVCJ2DQ (172.29.0.4, Hyper-V/Veeam, Dell PowerEdge 2950); 6 workstations (ucryo.local, 172.29.0.x) | GuruRMM (8 agents, site LIGHT-WOLF-2305) |
| Wolkin Law | FRONT (10.147.19.199 ZeroTier, office PC, SMB share host); RSW-Laptop (10.147.19.54 ZeroTier, remote); DESKTOP-V1JT1SE (out of scope); RICOH printer (172.17.110.110); M365 rswolkin.com | GuruRMM (3 Win11 agents, client Wolkin, Robert/Main); ZeroTier mesh VPN 17d709436c834c9b |
| Universal Minerals International | CyndyOffice (HP Pavilion TP01-2xxx, Win11 Home, S/N 2MO21549RB) — break-fix; no managed infra documented | — (RMM agent was temporary, removed 2026-06-10) |

---

## Compilation Queue

| Scope | Priority | Notes |
|---|---|---|
| `system:neptune` | Medium | neptune.acghosting.com, 172.16.3.11 internal / 67.206.163.124 external — Exchange Server 2016; ACG infrastructure colocated at Dataforth D2; active mail server for multiple ACG-hosted clients. Context in clients/dataforth.md + projects/dataforth-dos.md. Warrants own article for SBR config, MailProtector, per-client send connectors, routing. Open items: cert was expiring 2026-05-31 (verify current status); DkimSigner disabled — see internal-infrastructure.md. |
| `system:d2testnas` | Low | 192.168.0.9 — Linux (CachyOS?), SMB1 bridge for Dataforth DOS stations, rsync daemon port 873, hosts Neptune Exchange physically; key routing node for ACG-Dataforth connectivity; SSH root@192.168.0.9; also provides Tailscale 172.16.0.0/22 route |
| `client:key-paul` | Low | GuruRMM enrolled (KEY-MEDIA); no session logs or docs found |
