     1→# Credentials & Authorization Reference
     2→**Last Updated:** 2025-12-16
     3→**Purpose:** Centralized credentials for Claude Code context recovery across all machines
     4→
     5→---
     6→
     7→## Infrastructure - SSH Access
     8→
     9→### Jupiter (Unraid Primary)
    10→- **Host:** 172.16.3.20
    11→- **User:** root
    12→- **Port:** 22
    13→- **Password:** Th1nk3r^99##
    14→- **WebUI Password:** Th1nk3r^99##
    15→- **Role:** Primary container host (Gitea, NPM, GuruRMM, media)
    16→- **iDRAC IP:** 172.16.1.73 (DHCP)
    17→- **iDRAC User:** root
    18→- **iDRAC Password:** Window123!@#-idrac
    19→- **iDRAC SSH:** Enabled (port 22)
    20→- **IPMI Key:** All zeros
    21→
    22→### Saturn (Unraid Secondary)
    23→- **Host:** 172.16.3.21
    24→- **User:** root
    25→- **Port:** 22
    26→- **Password:** r3tr0gradE99
    27→- **Role:** Migration source, being consolidated to Jupiter
    28→
    29→### pfSense (Firewall)
    30→- **Host:** 172.16.0.1
    31→- **User:** admin
    32→- **Port:** 2248
    33→- **Password:** r3tr0gradE99!!
    34→- **Role:** Firewall, Tailscale gateway
    35→- **Tailscale IP:** 100.79.69.82 (pfsense-1)
    36→
    37→### OwnCloud VM (on Jupiter)
    38→- **Host:** 172.16.3.22
    39→- **Hostname:** cloud.acghosting.com
    40→- **User:** root
    41→- **Port:** 22
    42→- **Password:** Paper123!@#-unifi!
    43→- **OS:** Rocky Linux 9.6
    44→- **Role:** OwnCloud file sync server
    45→- **Services:** Apache, MariaDB, PHP-FPM, Redis, Datto RMM agents
    46→- **Storage:** SMB mount from Jupiter (/mnt/user/OwnCloud)
    47→- **Note:** Jupiter has SSH key auth configured
    48→
    49→### GuruRMM Build Server
    50→- **Host:** 172.16.3.30
    51→- **Hostname:** gururmm
    52→- **User:** guru
    53→- **Port:** 22
    54→- **Password:** Gptf*77ttb123!@#-rmm
    55→- **Sudo Password:** Gptf*77ttb123!@#-rmm (special chars cause issues with sudo -S)
    56→- **OS:** Ubuntu 22.04
    57→- **Role:** GuruRMM/GuruConnect dedicated server (API, DB, Dashboard, Downloads, GuruConnect relay)
    58→- **Services:** nginx, PostgreSQL, gururmm-server, gururmm-agent, guruconnect-server
    59→- **SSH Key Auth:** ✅ Working from Windows/WSL (ssh guru@172.16.3.30)
    60→- **Service Restart Method:** Services run as guru user, so `pkill` works without sudo. Deploy pattern:
    61→  1. Build: `cargo build --release --target x86_64-unknown-linux-gnu -p <package>`
    62→  2. Rename old: `mv target/release/binary target/release/binary.old`
    63→  3. Copy new: `cp target/x86_64.../release/binary target/release/binary`
    64→  4. Kill old: `pkill -f binary.old` (systemd auto-restarts)
    65→- **GuruConnect:** Static files in /home/guru/guru-connect/server/static/, binary at /home/guru/guru-connect/target/release/guruconnect-server
    66→
    67→---
    68→
    69→## Services - Web Applications
    70→
    71→### Gitea (Git Server)
    72→- **URL:** https://git.azcomputerguru.com/
    73→- **Internal:** http://172.16.3.20:3000
    74→- **SSH:** ssh://git@172.16.3.20:2222
    75→- **User:** mike@azcomputerguru.com
    76→- **Password:** Window123!@#-git
    77→- **API Token:** 9b1da4b79a38ef782268341d25a4b6880572063f
    78→
    79→### NPM (Nginx Proxy Manager)
    80→- **Admin URL:** http://172.16.3.20:7818
    81→- **HTTP Port:** 1880
    82→- **HTTPS Port:** 18443
    83→- **User:** mike@azcomputerguru.com
    84→- **Password:** Paper123!@#-unifi
    85→
    86→### Cloudflare
    87→- **API Token (Full DNS):** DRRGkHS33pxAUjQfRDzDeVPtt6wwUU6FwtXqOzNj
    88→- **API Token (Legacy/Limited):** U1UTbBOWA4a69eWEBiqIbYh0etCGzrpTU4XaKp7w
    89→- **Permissions:** Zone:Read, Zone:Edit, DNS:Read, DNS:Edit
    90→- **Used for:** DNS management, WHM plugin, cf-dns CLI
    91→- **Domain:** azcomputerguru.com
    92→- **Notes:** New full-access token added 2025-12-19
    93→
    94→---
    95→
    96→## Projects - GuruRMM
    97→
    98→### Dashboard/API Login
    99→- **Email:** admin@azcomputerguru.com
   100→- **Password:** GuruRMM2025

<system-reminder>
Whenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.
</system-reminder>

# Credentials & Authorization Reference
**Last Updated:** 2025-12-16
**Purpose:** Centralized credentials for Claude Code context recovery across all machines

---

## Infrastructure - SSH Access

### Jupiter (Unraid Primary)
- **Host:** 172.16.3.20
- **User:** root
- **Port:** 22
- **Password:** Th1nk3r^99##
- **WebUI Password:** Th1nk3r^99##
- **Role:** Primary container host (Gitea, NPM, GuruRMM, media)
- **iDRAC IP:** 172.16.1.73 (DHCP)
- **iDRAC User:** root
- **iDRAC Password:** Window123!@#-idrac
- **iDRAC SSH:** Enabled (port 22)
- **IPMI Key:** All zeros

### Saturn (Unraid Secondary)
- **Host:** 172.16.3.21
- **User:** root
- **Port:** 22
- **Password:** r3tr0gradE99
- **Role:** Migration source, being consolidated to Jupiter

### pfSense (Firewall)
- **Host:** 172.16.0.1
- **User:** admin
- **Port:** 2248
- **Password:** r3tr0gradE99!!
- **Role:** Firewall, Tailscale gateway
- **Tailscale IP:** 100.79.69.82 (pfsense-1)

### OwnCloud VM (on Jupiter)
- **Host:** 172.16.3.22
- **Hostname:** cloud.acghosting.com
- **User:** root
- **Port:** 22
- **Password:** Paper123!@#-unifi!
- **OS:** Rocky Linux 9.6
- **Role:** OwnCloud file sync server
- **Services:** Apache, MariaDB, PHP-FPM, Redis, Datto RMM agents
- **Storage:** SMB mount from Jupiter (/mnt/user/OwnCloud)
- **Note:** Jupiter has SSH key auth configured

### GuruRMM Build Server
- **Host:** 172.16.3.30
- **Hostname:** gururmm
- **User:** guru
- **Port:** 22
- **Password:** Gptf*77ttb123!@#-rmm
- **Sudo Password:** Gptf*77ttb123!@#-rmm (special chars cause issues with sudo -S)
- **OS:** Ubuntu 22.04
- **Role:** GuruRMM/GuruConnect dedicated server (API, DB, Dashboard, Downloads, GuruConnect relay)
- **Services:** nginx, PostgreSQL, gururmm-server, gururmm-agent, guruconnect-server
- **SSH Key Auth:** ✅ Working from Windows/WSL (ssh guru@172.16.3.30)
- **Service Restart Method:** Services run as guru user, so `pkill` works without sudo. Deploy pattern:
  1. Build: `cargo build --release --target x86_64-unknown-linux-gnu -p <package>`
  2. Rename old: `mv target/release/binary target/release/binary.old`
  3. Copy new: `cp target/x86_64.../release/binary target/release/binary`
  4. Kill old: `pkill -f binary.old` (systemd auto-restarts)
- **GuruConnect:** Static files in /home/guru/guru-connect/server/static/, binary at /home/guru/guru-connect/target/release/guruconnect-server

---

## Services - Web Applications

### Gitea (Git Server)
- **URL:** https://git.azcomputerguru.com/
- **Internal:** http://172.16.3.20:3000
- **SSH:** ssh://git@172.16.3.20:2222
- **User:** mike@azcomputerguru.com
- **Password:** Window123!@#-git
- **API Token:** 9b1da4b79a38ef782268341d25a4b6880572063f

### NPM (Nginx Proxy Manager)
- **Admin URL:** http://172.16.3.20:7818
- **HTTP Port:** 1880
- **HTTPS Port:** 18443
- **User:** mike@azcomputerguru.com
- **Password:** Paper123!@#-unifi

### Cloudflare
- **API Token (Full DNS):** DRRGkHS33pxAUjQfRDzDeVPtt6wwUU6FwtXqOzNj
- **API Token (Legacy/Limited):** U1UTbBOWA4a69eWEBiqIbYh0etCGzrpTU4XaKp7w
- **Permissions:** Zone:Read, Zone:Edit, DNS:Read, DNS:Edit
- **Used for:** DNS management, WHM plugin, cf-dns CLI
- **Domain:** azcomputerguru.com
- **Notes:** New full-access token added 2025-12-19

---

## Projects - GuruRMM

### Dashboard/API Login
- **Email:** admin@azcomputerguru.com
- **Password:** GuruRMM2025


C:\Users\MikeSwanson\claude-projects\dataforth-dos\SYNC_SCRIPT.md-124-Timestamp: 2026-01-13 18:54:24
C:\Users\MikeSwanson\claude-projects\dataforth-dos\SYNC_SCRIPT.md:125:Status: OK
C:\Users\MikeSwanson\claude-projects\dataforth-dos\SYNC_SCRIPT.md-126-

[Showing results with pagination = limit: 50, offset: 0]


total 197
drwxr-xr-x 1 AzureAD+MikeSwanson 4096    0 Dec 21 17:40 ./
drwxr-xr-x 1 AzureAD+MikeSwanson 4096    0 Jan 15 17:06 ../
-rw-r--r-- 1 AzureAD+MikeSwanson 4096  255 Dec 19 13:10 .gitignore
-rw-r--r-- 1 AzureAD+MikeSwanson 4096 4416 Dec 19 13:10 BUILD-EXE.md
-rw-r--r-- 1 AzureAD+MikeSwanson 4096 8974 Dec 19 13:10 CHANGELOG.md
-rw-r--r-- 1 AzureAD+MikeSwanson 4096 1604 Dec 19 13:10 compress-perms.ps1
drwxr-xr-x 1 AzureAD+MikeSwanson 4096    0 Dec 19 13:10 config/
-rw-r--r-- 1 AzureAD+MikeSwanson 4096  893 Dec 19 13:10 convert-perms.ps1
drwxr-xr-x 1 AzureAD+MikeSwanson 4096    0 Dec 19 13:10 data/
-rw-r--r-- 1 AzureAD+MikeSwanson 4096 1202 Dec 19 13:10 deploy.bat
-rw-r--r-- 1 AzureAD+MikeSwanson 4096 1186 Dec 19 13:10 DEVELOPMENT.md
-rw-r--r-- 1 AzureAD+MikeSwanson 4096  870 Dec 19 13:10 extract-perms.ps1
-rw-r--r-- 1 AzureAD+MikeSwanson 4096 3407 Dec 19 13:10 generate-version.ps1
-rw-r--r-- 1 AzureAD+MikeSwanson 4096 3605 Dec 19 13:10 README.md
drwxr-xr-x 1 AzureAD+MikeSwanson 4096    0 Dec 19 13:10 scripts/
-rw-r--r-- 1 AzureAD+MikeSwanson 4096 5783 Dec 19 13:10 version.json


Now let me look at more session logs to find patterns in how projects are tracked.


Bash

ls -1 "C:\Users\MikeSwanson\claude-projects" -d */ 2>/dev/null | grep -v node_modules | head -25

List directories only, excluding node_modules


     1→# Session Log: Grabb & Durando Calendar Fix
     2→**Date:** 2025-12-15
     3→**Status:** Partially resolved - calendar working, root cause needs investigation
     4→
     5→---
     6→
     7→## Problem Summary
     8→Calendar view on data.grabbanddurando.com was broken after migration from GoDaddy VPS to IX server. Displayed only a small date picker instead of the full FullCalendar month/week/day view.
     9→
    10→## Root Cause Identified
    11→**mod_pagespeed** was corrupting JavaScript code, turning:
    12→```javascript
    13→url: 'cal_edit_events.php',
    14→```
    15→into:
    16→```javascript
    17→urlnts.php',
    18→```
    19→
    20→This caused JavaScript syntax errors ("unexpected token: ':'") preventing the calendar from rendering.
    21→
    22→## Fix Applied (Working)
    23→1. **Disabled PageSpeed globally** in `/etc/apache2/conf.modules.d/510_pagespeed.conf`:
    24→   ```apache
    25→   ModPagespeed off
    26→   ```
    27→
    28→2. **Added to .htaccess** at `/home/grabblaw/public_html/data_grabbanddurando/.htaccess`:
    29→   ```apache
    30→   # Disable PageSpeed - breaking calendar JavaScript
    31→   ModPagespeed off
    32→   ModPagespeedDisableFilters combine_javascript,rewrite_javascript
    33→
    34→   # Force revalidation of JS files after PageSpeed fix
    35→   <FilesMatch "\.js$">
    36→       Header set Cache-Control "no-cache, must-revalidate"
    37→   </FilesMatch>
    38→   ```
    39→
    40→3. **Cleared PageSpeed cache:**
    41→   ```bash
    42→   rm -rf /var/mod_pagespeed/cache/*
    43→   systemctl restart httpd
    44→   ```
    45→
    46→4. **Restored original PHP files** (our PHP "fixes" broke something):
    47→   - `manage_calendar.php` ← from `manage_calendar.php.bak`
    48→   - `manage_calendar_page1.php` ← from `manage_calendar_page1.php.bak`
    49→   - `cal_events.php` ← from `cal_events.php.bak3`
    50→
    51→## What We Tried That Broke Things
    52→These PHP changes were attempted but caused issues:
    53→
    54→1. **manage_calendar_page1.php line ~276** - Changed `$ciud` assignment:
    55→   ```php
    56→   // Original:
    57→   $ciud = $_SESSION['userinfo']['user_id'];
    58→   // Changed to (BROKE IT):
    59→   $ciud = isset($_SESSION['userinfo']['user_id']) ? $_SESSION['userinfo']['user_id'] : 0;
    60→   ```
    61→
    62→2. **cal_events.php lines 6-7** - Added isset() checks to session variables
    63→
    64→These changes were intended to fix PHP notices but broke the calendar functionality.
    65→
    66→## Future Work Required
    67→1. **Investigate why isset() checks broke the calendar** - The PHP notices in the error log don't affect functionality, but the "fix" did
    68→2. **Consider upgrading FullCalendar** - Current version is 1.5/1.6.4 (from 2011-2014)
    69→3. **Review PHP session handling** - May need to trace why session is sometimes undefined
    70→4. **Test thoroughly** before making PHP changes
    71→
    72→## Known Cosmetic/Display Issues (May Be Pre-existing)
    73→These issues were observed but may have existed before migration. Note in case client reports them:
    74→
    75→1. **Saturday column slightly wider** in Month view
    76→   - Attempted CSS fix (`table-layout: fixed`) but it broke other views
    77→   - Reverted - cosmetic only, doesn't affect functionality
    78→
    79→2. **Day/Week (agenda) views missing events**
    80→   - Month view shows events correctly

<system-reminder>
Whenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.
</system-reminder>

# Session Log: Grabb & Durando Calendar Fix
**Date:** 2025-12-15
**Status:** Partially resolved - calendar working, root cause needs investigation

---

## Problem Summary
Calendar view on data.grabbanddurando.com was broken after migration from GoDaddy VPS to IX server. Displayed only a small date picker instead of the full FullCalendar month/week/day view.

## Root Cause Identified
**mod_pagespeed** was corrupting JavaScript code, turning:
```javascript
url: 'cal_edit_events.php',
```
into:
```javascript
urlnts.php',
```

This caused JavaScript syntax errors ("unexpected token: ':'") preventing the calendar from rendering.

## Fix Applied (Working)
1. **Disabled PageSpeed globally** in `/etc/apache2/conf.modules.d/510_pagespeed.conf`:
   ```apache
   ModPagespeed off
   ```

2. **Added to .htaccess** at `/home/grabblaw/public_html/data_grabbanddurando/.htaccess`:
   ```apache
   # Disable PageSpeed - breaking calendar JavaScript
   ModPagespeed off
   ModPagespeedDisableFilters combine_javascript,rewrite_javascript

   # Force revalidation of JS files after PageSpeed fix
   <FilesMatch "\.js$">
       Header set Cache-Control "no-cache, must-revalidate"
   </FilesMatch>
   ```

3. **Cleared PageSpeed cache:**
   ```bash
   rm -rf /var/mod_pagespeed/cache/*
   systemctl restart httpd
   ```

4. **Restored original PHP files** (our PHP "fixes" broke something):
   - `manage_calendar.php` ← from `manage_calendar.php.bak`
   - `manage_calendar_page1.php` ← from `manage_calendar_page1.php.bak`
   - `cal_events.php` ← from `cal_events.php.bak3`

## What We Tried That Broke Things
These PHP changes were attempted but caused issues:

1. **manage_calendar_page1.php line ~276** - Changed `$ciud` assignment:
   ```php
   // Original:
   $ciud = $_SESSION['userinfo']['user_id'];
   // Changed to (BROKE IT):
   $ciud = isset($_SESSION['userinfo']['user_id']) ? $_SESSION['userinfo']['user_id'] : 0;
   ```

2. **cal_events.php lines 6-7** - Added isset() checks to session variables

These changes were intended to fix PHP notices but broke the calendar functionality.

## Future Work Required
1. **Investigate why isset() checks broke the calendar** - The PHP notices in the error log don't affect functionality, but the "fix" did
2. **Consider upgrading FullCalendar** - Current version is 1.5/1.6.4 (from 2011-2014)
3. **Review PHP session handling** - May need to trace why session is sometimes undefined
4. **Test thoroughly** before making PHP changes

## Known Cosmetic/Display Issues (May Be Pre-existing)
These issues were observed but may have existed before migration. Note in case client reports them:

1. **Saturday column slightly wider** in Month view
   - Attempted CSS fix (`table-layout: fixed`) but it broke other views
   - Reverted - cosmetic only, doesn't affect functionality

2. **Day/Week (agenda) views missing events**
   - Month view shows events correctly


ACPlus//
ACPP//
Autocode-remix//
C:\Users\MikeSwanson\claude-projects/
claude-code-transcripts//
claude-settings//
cloudflare-whm//
dataforth-dos//
grabb-website-move//
guru-connect//
gururmm.temp//
gururmm//
msp-toolkit//
msp-toolkit-rust//
prompts//
reference//
seafile-graph-email//
session-logs//
shared-data//
Website2025//
whm-dns-cleanup//
windows-setup-helper//


     1→# Session Log: 2026-01-13
     2→
     3→**Date:** 2026-01-13
     4→**Status:** COMPLETE
     5→**Projects:** IX Server maintenance, Dataforth UDM, Dataforth DOS documentation
     6→
     7→---
     8→
     9→## Summary
    10→
    11→This session covered four main tasks:
    12→
    13→1. **Dataforth UDM Network Issue** - Investigated ERR_CONNECTION_CLOSED errors for paychex.com
    14→   - Initial diagnosis: IPS blocking (whitelisted paychex.com IPs)
    15→   - Root cause: DNS servers offline on 192.168.1.0/24 network
    16→   - Fixed: Updated DHCP DNS servers to working domain controllers
    17→
    18→2. **IX Server WordPress Performance** - Fixed slow backend on acepickupparts.com
    19→   - Increased PHP memory from 128MB to 256MB
    20→   - Cleaned 7.5MB database bloat (Action Scheduler, Simple History, Post SMTP logs)
    21→   - Rotated large log files
    22→
    23→3. **IX Server-Wide Audit** - Scanned all 80 cPanel accounts for similar issues
    24→   - Found 38 sites with problems
    25→   - Fixed 2 critical sites: arizonahatters.com (468MB error log, 429 PHP memory errors) and peacefulspirit.com (310MB database bloat)
    26→   - Created comprehensive priority report and reusable scan scripts
    27→
    28→4. **IX Server Domain Redirect** - Configured ix.azcomputerguru.com → azcomputerguru.com
    29→   - HTTP redirect working via .htaccess
    30→   - HTTPS redirect failing (served directory listing)
    31→   - Fixed by updating post_virtualhost_global.conf with rewrite rules
    32→   - Both HTTP and HTTPS now redirect correctly (301)
    33→
    34→5. **Dataforth DOS Project Documentation** - Created complete project folder
    35→   - 8 comprehensive documentation files (54KB total)
    36→   - All credentials, network topology, technical details
    37→   - Ready for Gitea and future Claude instances
    38→
    39→---
    40→
    41→## 1. Dataforth UDM - Network Issue (ERR_CONNECTION_CLOSED)
    42→
    43→### Problem
    44→Users on Dataforth network reporting ERR_CONNECTION_CLOSED when accessing paychex.com
    45→
    46→### Investigation
    47→**Dataforth UDM:** 192.168.0.254
    48→- **SSH:** root@192.168.0.254
    49→- **SSH Password:** Paper123!@#-unifi
    50→- **Credentials:** azcomputerguru / Paper123!@#-unifi
    51→
    52→**Initial Diagnosis:**
    53→- Checked IPS (Intrusion Prevention System) - Suricata running
    54→- Found aggressive rule categories enabled
    55→- Paychex.com IPs: 141.123.122.0 and 141.123.222.0
    56→
    57→**First Fix Attempt (IPS Whitelist):**
    58→```javascript
    59→// MongoDB commands on UDM
    60→db.setting.updateOne({key: "ips"}, {$push: {"suppression.whitelist": {mode: "ip", value: "141.123.122.0", direction: "both"}}})
    61→db.setting.updateOne({key: "ips"}, {$push: {"suppression.whitelist": {mode: "ip", value: "141.123.222.0", direction: "both"}}})
    62→```
    63→
    64→Reloaded Suricata:
    65→```bash
    66→kill -USR2 $(cat /run/suricata.pid)
    67→```
    68→
    69→**User Feedback:** Issue persisted, but only on 192.168.1.0/24 network ("mydata")
    70→
    71→### Root Cause
    72→DNS servers configured for "mydata" network were offline:
    73→- **Old DNS (broken):** 192.168.0.11, 192.168.0.13
    74→- **Working DNS:** 192.168.0.27, 192.168.0.6, 192.168.1.254
    75→
    76→### Final Fix
    77→Updated DHCP DNS configuration for "mydata" network:
    78→```javascript
    79→db.networkconf.updateOne(
    80→  {_id: ObjectId("67b3c01605357732af452841")},
    81→  {$set: {
    82→    "dhcpd_dns_1": "192.168.0.27",
    83→    "dhcpd_dns_2": "192.168.0.6",
    84→    "dhcpd_dns_3": "192.168.1.254"
    85→  }}
    86→)
    87→```
    88→
    89→Restarted dnsmasq:
    90→```bash
    91→systemctl restart dnsmasq
    92→```
    93→
    94→**Resolution:** Users need to renew DHCP lease or reboot to get new DNS servers
    95→
    96→### Network Configuration
    97→- **Network:** 192.168.1.0/24 ("mydata")
    98→- **Gateway:** 192.168.0.254 (UDM)
    99→- **Domain Controllers:** 192.168.0.27 (AD1), 192.168.0.6 (AD2)
   100→- **Domain:** INTRANET (intranet.dataforth.com)

<system-reminder>
Whenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.
</system-reminder>

# Session Log: 2026-01-13

**Date:** 2026-01-13
**Status:** COMPLETE
**Projects:** IX Server maintenance, Dataforth UDM, Dataforth DOS documentation

---

## Summary

This session covered four main tasks:

1. **Dataforth UDM Network Issue** - Investigated ERR_CONNECTION_CLOSED errors for paychex.com
   - Initial diagnosis: IPS blocking (whitelisted paychex.com IPs)
   - Root cause: DNS servers offline on 192.168.1.0/24 network
   - Fixed: Updated DHCP DNS servers to working domain controllers

2. **IX Server WordPress Performance** - Fixed slow backend on acepickupparts.com
   - Increased PHP memory from 128MB to 256MB
   - Cleaned 7.5MB database bloat (Action Scheduler, Simple History, Post SMTP logs)
   - Rotated large log files

3. **IX Server-Wide Audit** - Scanned all 80 cPanel accounts for similar issues
   - Found 38 sites with problems
   - Fixed 2 critical sites: arizonahatters.com (468MB error log, 429 PHP memory errors) and peacefulspirit.com (310MB database bloat)
   - Created comprehensive priority report and reusable scan scripts

4. **IX Server Domain Redirect** - Configured ix.azcomputerguru.com → azcomputerguru.com
   - HTTP redirect working via .htaccess
   - HTTPS redirect failing (served directory listing)
   - Fixed by updating post_virtualhost_global.conf with rewrite rules
   - Both HTTP and HTTPS now redirect correctly (301)

5. **Dataforth DOS Project Documentation** - Created complete project folder
   - 8 comprehensive documentation files (54KB total)
   - All credentials, network topology, technical details
   - Ready for Gitea and future Claude instances

---

## 1. Dataforth UDM - Network Issue (ERR_CONNECTION_CLOSED)

### Problem
Users on Dataforth network reporting ERR_CONNECTION_CLOSED when accessing paychex.com

### Investigation
**Dataforth UDM:** 192.168.0.254
- **SSH:** root@192.168.0.254
- **SSH Password:** Paper123!@#-unifi
- **Credentials:** azcomputerguru / Paper123!@#-unifi

**Initial Diagnosis:**
- Checked IPS (Intrusion Prevention System) - Suricata running
- Found aggressive rule categories enabled
- Paychex.com IPs: 141.123.122.0 and 141.123.222.0

**First Fix Attempt (IPS Whitelist):**
```javascript
// MongoDB commands on UDM
db.setting.updateOne({key: "ips"}, {$push: {"suppression.whitelist": {mode: "ip", value: "141.123.122.0", direction: "both"}}})
db.setting.updateOne({key: "ips"}, {$push: {"suppression.whitelist": {mode: "ip", value: "141.123.222.0", direction: "both"}}})
```

Reloaded Suricata:
```bash
kill -USR2 $(cat /run/suricata.pid)
```

**User Feedback:** Issue persisted, but only on 192.168.1.0/24 network ("mydata")

### Root Cause
DNS servers configured for "mydata" network were offline:
- **Old DNS (broken):** 192.168.0.11, 192.168.0.13
- **Working DNS:** 192.168.0.27, 192.168.0.6, 192.168.1.254

### Final Fix
Updated DHCP DNS configuration for "mydata" network:
```javascript
db.networkconf.updateOne(
  {_id: ObjectId("67b3c01605357732af452841")},
  {$set: {
    "dhcpd_dns_1": "192.168.0.27",
    "dhcpd_dns_2": "192.168.0.6",
    "dhcpd_dns_3": "192.168.1.254"
  }}
)
```

Restarted dnsmasq:
```bash
systemctl restart dnsmasq
```

**Resolution:** Users need to renew DHCP lease or reboot to get new DNS servers

### Network Configuration
- **Network:** 192.168.1.0/24 ("mydata")
- **Gateway:** 192.168.0.254 (UDM)
- **Domain Controllers:** 192.168.0.27 (AD1), 192.168.0.6 (AD2)
- **Domain:** INTRANET (intranet.dataforth.com)


Found 7 files
session-logs\2025-12-21-guruconnect-build.md
session-logs\2025-12-21-guruconnect-session.md
session-logs\2025-12-13-mac-context-sync.md
session-logs\2025-12-13-permissions-sync.md
session-logs\2025-12-14-dataforth-dos-machines.md
session-logs\2025-12-15-data-grabbanddurando-complete.md
session-logs\2025-12-15-gururmm-agent-services.md


Let me look at a few more project-specific directories to understand the structure better.


find "C:\Users\MikeSwanson\claude-projects" -maxdepth 2 -name "README.md" -o -name "PLAN.md" -o -name "CLAUDE.md" | grep -v node_modules | sort

Find all README, PLAN, and CLAUDE files in project directories


     1→# Dataforth DOS Project - Quick Index
     2→
     3→**Created:** 2026-01-13
     4→**For:** Future Claude instances working on this project
     5→
     6→## What This Folder Contains
     7→
     8→Complete documentation for the Dataforth DOS test machines project, including all credentials, network topology, technical details, and remaining tasks.
     9→
    10→## Start Here
    11→
    12→1. **README.md** - Read this first for complete project overview
    13→2. **CREDENTIALS.md** - All passwords and access credentials
    14→3. **REMAINING_TASKS.md** - What needs to be done next
    15→
    16→## All Files in This Folder
    17→
    18→| File | Purpose | Read When... |
    19→|------|---------|--------------|
    20→| **README.md** | Complete project overview, technical details, configuration | Starting work on project |
    21→| **CREDENTIALS.md** | All passwords, SSH keys, access info | Need to access NAS or AD2 |
    22→| **NETWORK_TOPOLOGY.md** | Network diagram, IP addresses, data flow | Understanding infrastructure |
    23→| **REMAINING_TASKS.md** | Pending work, blockers, priorities | Planning next steps |
    24→| **SYNC_SCRIPT.md** | Bidirectional sync documentation | Troubleshooting sync issues |
    25→| **DOS_BATCH_FILES.md** | UPDATE.BAT, TODO.BAT, batch file details | Working with DOS machines |
    26→| **GITEA_ACCESS.md** | How to access this folder from Gitea | Cloning project from Git |
    27→| **PROJECT_INDEX.md** | This file - quick reference |
    28→
    29→## Quick Access
    30→
    31→### SSH to NAS
    32→```bash
    33→ssh root@192.168.0.9
    34→# Uses ed25519 key from ~/.ssh/id_ed25519
    35→```
    36→
    37→### View Sync Log
    38→```bash
    39→ssh root@192.168.0.9 'tail -20 /var/log/ad2-sync.log'
    40→```
    41→
    42→### Check Sync Status
    43→```bash
    44→smbclient //192.168.0.6/test -U sysadmin%'Paper123!@#' -c 'get _SYNC_STATUS.txt -'
    45→```
    46→
    47→### Test SMB to NAS
    48→```bash
    49→smbclient //192.168.0.9/test -U ts-1 -N -c 'ls'
    50→```
    51→
    52→## Network Quick Reference
    53→
    54→| Device | IP | Role | Credentials |
    55→|--------|-----|------|-------------|
    56→| D2TESTNAS | 192.168.0.9 | NAS/SMB1 proxy | admin / Paper123!@#-nas |
    57→| AD2 | 192.168.0.6 | Production server | INTRANET\sysadmin / Paper123!@# |
    58→| UDM | 192.168.0.254 | Gateway | See credentials.md |
    59→
    60→## File Locations on NAS
    61→
    62→- **Sync Script:** /root/sync-to-ad2.sh
    63→- **Credentials:** /root/.ad2creds
    64→- **Sync Log:** /var/log/ad2-sync.log
    65→- **Test Share:** /data/test/
    66→- **Datasheets Share:** /data/datasheets/
    67→
    68→## Project Status
    69→
    70→**Current Status:** 90% Complete, Working
    71→
    72→**Blocking Issue:**
    73→- Datasheets share needs to be created on AD2 (waiting for Engineering input)
    74→
    75→**Machines Working:**
    76→- TS-27, TS-8L, TS-8R tested and operational
    77→
    78→**Machines Pending:**
    79→- ~27 DOS machines still need network configuration updates
    80→
    81→## Related Documentation
    82→
    83→### In This Repository
    84→- `session-logs/2025-12-14-dataforth-dos-machines.md` - Full implementation session
    85→- `session-logs/2025-12-20-session.md` - VPN setup
    86→- `shared-data/credentials.md` - Global credentials (includes Dataforth section)
    87→
    88→### On NAS (192.168.0.9)
    89→- `/data/datasheets/CONFIGS/` - Full DOS machine image from TS-27 (44MB, 1790 files)
    90→- `/data/test/UPDATE.BAT` - Central management utility
    91→- `/data/test/TS-XX/` - Per-station folders
    92→
    93→## Common Tasks
    94→
    95→### Update DOS Machine
    96→```batch
    97→REM From DOS machine:
    98→T:\UPDATE TS-XX ALL
    99→```
   100→
   101→### Deploy Remote Task
   102→1. Create TODO.BAT on AD2: `\\AD2\test\TS-XX\TODO.BAT`
   103→2. Wait for sync (every 15 min)
   104→3. DOS machine runs on next boot and deletes
   105→
   106→### Manual Sync
   107→```bash
   108→ssh root@192.168.0.9 '/root/sync-to-ad2.sh'
   109→```
   110→
   111→## Getting Started as New Claude Instance
   112→
   113→```bash
   114→# 1. Clone this folder from Gitea
   115→git clone --no-checkout https://git.azcomputerguru.com/azcomputerguru/claude-projects.git
   116→cd claude-projects
   117→git sparse-checkout init --cone
   118→git sparse-checkout set dataforth-dos shared-data
   119→git checkout main
   120→
   121→# 2. Read project overview
   122→cat dataforth-dos/README.md
   123→
   124→# 3. Read credentials
   125→cat dataforth-dos/CREDENTIALS.md
   126→
   127→# 4. Check what's pending
   128→cat dataforth-dos/REMAINING_TASKS.md
   129→
   130→# 5. Access NAS
   131→ssh root@192.168.0.9
   132→```
   133→
   134→## Important Notes
   135→
   136→- All DOS machines use SMB1 CORE protocol (oldest SMB)
   137→- WINS server is critical for NetBIOS name resolution
   138→- Sync runs every 15 minutes automatically
   139→- TODO.BAT files auto-delete after one execution
   140→- Use UPDATE.BAT for remote management
   141→- All batch files must have DOS line endings (CR+LF)
   142→
   143→## Support & Questions
   144→
   145→- Original implementation: 2025-12-14 (see session logs)
   146→- Project time: ~11 hours
   147→- Tested on: TS-27, TS-8L, TS-8R
   148→- Architecture: QuickBASIC 4.5, GPIB ISA cards, DOS 6.22
   149→
   150→---
   151→
   152→**Next Steps:** See REMAINING_TASKS.md for current blockers and pending work.
   153→

<system-reminder>
Whenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.
</system-reminder>

# Dataforth DOS Project - Quick Index

**Created:** 2026-01-13
**For:** Future Claude instances working on this project

## What This Folder Contains

Complete documentation for the Dataforth DOS test machines project, including all credentials, network topology, technical details, and remaining tasks.

## Start Here

1. **README.md** - Read this first for complete project overview
2. **CREDENTIALS.md** - All passwords and access credentials
3. **REMAINING_TASKS.md** - What needs to be done next

## All Files in This Folder

| File | Purpose | Read When... |
|------|---------|--------------|
| **README.md** | Complete project overview, technical details, configuration | Starting work on project |
| **CREDENTIALS.md** | All passwords, SSH keys, access info | Need to access NAS or AD2 |
| **NETWORK_TOPOLOGY.md** | Network diagram, IP addresses, data flow | Understanding infrastructure |
| **REMAINING_TASKS.md** | Pending work, blockers, priorities | Planning next steps |
| **SYNC_SCRIPT.md** | Bidirectional sync documentation | Troubleshooting sync issues |
| **DOS_BATCH_FILES.md** | UPDATE.BAT, TODO.BAT, batch file details | Working with DOS machines |
| **GITEA_ACCESS.md** | How to access this folder from Gitea | Cloning project from Git |
| **PROJECT_INDEX.md** | This file - quick reference |

## Quick Access

### SSH to NAS
```bash
ssh root@192.168.0.9
# Uses ed25519 key from ~/.ssh/id_ed25519
```

### View Sync Log
```bash
ssh root@192.168.0.9 'tail -20 /var/log/ad2-sync.log'
```

### Check Sync Status
```bash
smbclient //192.168.0.6/test -U sysadmin%'Paper123!@#' -c 'get _SYNC_STATUS.txt -'
```

### Test SMB to NAS
```bash
smbclient //192.168.0.9/test -U ts-1 -N -c 'ls'
```

## Network Quick Reference

| Device | IP | Role | Credentials |
|--------|-----|------|-------------|
| D2TESTNAS | 192.168.0.9 | NAS/SMB1 proxy | admin / Paper123!@#-nas |
| AD2 | 192.168.0.6 | Production server | INTRANET\sysadmin / Paper123!@# |
| UDM | 192.168.0.254 | Gateway | See credentials.md |

## File Locations on NAS

- **Sync Script:** /root/sync-to-ad2.sh
- **Credentials:** /root/.ad2creds
- **Sync Log:** /var/log/ad2-sync.log
- **Test Share:** /data/test/
- **Datasheets Share:** /data/datasheets/

## Project Status

**Current Status:** 90% Complete, Working

**Blocking Issue:**
- Datasheets share needs to be created on AD2 (waiting for Engineering input)

**Machines Working:**
- TS-27, TS-8L, TS-8R tested and operational

**Machines Pending:**
- ~27 DOS machines still need network configuration updates

## Related Documentation

### In This Repository
- `session-logs/2025-12-14-dataforth-dos-machines.md` - Full implementation session
- `session-logs/2025-12-20-session.md` - VPN setup
- `shared-data/credentials.md` - Global credentials (includes Dataforth section)

### On NAS (192.168.0.9)
- `/data/datasheets/CONFIGS/` - Full DOS machine image from TS-27 (44MB, 1790 files)
- `/data/test/UPDATE.BAT` - Central management utility
- `/data/test/TS-XX/` - Per-station folders

## Common Tasks

### Update DOS Machine
```batch
REM From DOS machine:
T:\UPDATE TS-XX ALL
```

### Deploy Remote Task
1. Create TODO.BAT on AD2: `\\AD2\test\TS-XX\TODO.BAT`
2. Wait for sync (every 15 min)
3. DOS machine runs on next boot and deletes

### Manual Sync
```bash
ssh root@192.168.0.9 '/root/sync-to-ad2.sh'
```

## Getting Started as New Claude Instance

```bash
# 1. Clone this folder from Gitea
git clone --no-checkout https://git.azcomputerguru.com/azcomputerguru/claude-projects.git
cd claude-projects
git sparse-checkout init --cone
git sparse-checkout set dataforth-dos shared-data
git checkout main

# 2. Read project overview
cat dataforth-dos/README.md

# 3. Read credentials
cat dataforth-dos/CREDENTIALS.md

# 4. Check what's pending
cat dataforth-dos/REMAINING_TASKS.md

# 5. Access NAS
ssh root@192.168.0.9
```

## Important Notes

- All DOS machines use SMB1 CORE protocol (oldest SMB)
- WINS server is critical for NetBIOS name resolution
- Sync runs every 15 minutes automatically
- TODO.BAT files auto-delete after one execution
- Use UPDATE.BAT for remote management
- All batch files must have DOS line endings (CR+LF)

## Support & Questions

- Original implementation: 2025-12-14 (see session logs)
- Project time: ~11 hours
- Tested on: TS-27, TS-8L, TS-8R
- Architecture: QuickBASIC 4.5, GPIB ISA cards, DOS 6.22

---

**Next Steps:** See REMAINING_TASKS.md for current blockers and pending work.


C:\Users\MikeSwanson\claude-projects\IX_SERVER_CRITICAL_ISSUES_2026-01-13.md-11-- **Issue:** Wordfence file scanning causing continuous memory exhaustion
C:\Users\MikeSwanson\claude-projects\IX_SERVER_CRITICAL_ISSUES_2026-01-13.md:12:- **Status:** ⏳ NEEDS FIXING
C:\Users\MikeSwanson\claude-projects\IX_SERVER_CRITICAL_ISSUES_2026-01-13.md-13-
--
C:\Users\MikeSwanson\claude-projects\IX_SERVER_CRITICAL_ISSUES_2026-01-13.md-18-- **Issue:** WPML email logs and Gravity Forms data bloat
C:\Users\MikeSwanson\claude-projects\IX_SERVER_CRITICAL_ISSUES_2026-01-13.md:19:- **Status:** ⏳ NEEDS FIXING
C:\Users\MikeSwanson\claude-projects\IX_SERVER_CRITICAL_ISSUES_2026-01-13.md-20-
--
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md-5-### Fixed: Sync System Case Sensitivity Bug
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md:6:**Status:** COMPLETED - 2026-01-13
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md-7-
--
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md-17-### Completed: Bidirectional Sync Implementation
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md:18:**Status:** COMPLETED - 2026-01-13
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md-19-
--
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md-24-### Completed: Test Database Web Interface
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md:25:**Status:** COMPLETED - 2026-01-13
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md-26-
--
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md-32-### Completed: Engineer NAS Access
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md:33:**Status:** COMPLETED - 2026-01-13
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md-34-
--
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md-45-### 1. Datasheets Share Creation - HIGH PRIORITY
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md:46:**Status:** BLOCKED - Waiting for Engineering input
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md-47-
--
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md-72-### 2. Send Update Email to Management/Engineering
C:\Users\MikeSwanson\claude-projects\dataforth-dos\REMAINING_TASKS.md:73:**Status:** READY - Needs sending

[Showing results with pagination = limit: 30, offset: 0]


Now let me check for any client-related references in documentation.


ls -1 "C:\Users\MikeSwanson\claude-projects" *.md 2>/dev/null | head -15

List markdown files in root


Found 29 files limit: 40, offset: 0
dataforth-dos\UPDATE-BAT-V2-COMPLETED.md
session-logs\2026-01-15-session.md
dataforth-dos\README.md
session-logs\2026-01-14-session.md
dataforth-dos\CLAUDE.md
shared-data\credentials.md
dataforth-dos\REMAINING_TASKS.md
dataforth-dos\SYNC_SCRIPT.md
dataforth-dos\CREDENTIALS.md
session-logs\2026-01-13-session.md
dataforth-dos\PROJECT_INDEX.md
dataforth-dos\DOS_BATCH_FILES.md
dataforth-dos\GITEA_ACCESS.md
dataforth-dos\NETWORK_TOPOLOGY.md
session-logs\PROJECT-INDEX.md
shared-data\multi-tenant-security-app.md
session-logs\2025-12-22-session.md
session-logs\2025-12-23-session.md
grabb-website-move\email-to-jason.md
grabb-website-move\README.md
session-logs\2025-12-20-session.md
session-logs\2025-12-16-session-3.md
session-logs\2025-12-17-session.md
whm-dns-cleanup\WHM-DNS-Cleanup-Report-2025-12-09.md
session-logs\2025-12-12-session.md
session-logs\2025-12-14-dataforth-dos-machines.md
session-logs\2025-12-15-data-grabbanddurando-complete.md
session-logs\2025-12-15-grabbanddurando-calendar-fix.md
session-logs\2025-12-15-grabbanddurando-user-report.md


CLAUDE.md
claude_code_quickstart.md
IX_SERVER_CRITICAL_ISSUES_2026-01-13.md
ralphstransfer-security-audit-2025-12-12.md

C:\Users\MikeSwanson\claude-projects:
ACPlus/
ACPP/
audit-mike-actions.ps1
Autocode-remix/
bgbuilders-dns-records.txt
bgbuildersllc-godaddy-zonefile.txt
check-firewall.ps1
check-fresh-logs.ps1
check-mailbox-rules.ps1


     1→# Security Audit Report: ralphstransfer.com
     2→
     3→**Date:** December 12, 2025
     4→**Server:** websvr.acghosting.com
     5→**Site URL:** https://ralphstransfer.com
     6→**Prepared for:** Developer/Site Administrator
     7→
     8→---
     9→
    10→## Executive Summary
    11→
    12→This site has **CRITICAL security vulnerabilities** primarily due to severely outdated WordPress core (4.9.5, released April 2018). The site is over **7 years behind** on security updates, exposing it to hundreds of known vulnerabilities. Immediate action is required.
    13→
    14→### Risk Level: **CRITICAL** 🔴
    15→
    16→---
    17→
    18→## Critical Issues
    19→
    20→### 1. WordPress Core - SEVERELY OUTDATED ⚠ CRITICAL
    21→
    22→| Current | Latest | Age |
    23→|---------|--------|-----|
    24→| 4.9.5 | 6.7.x | ~7 years outdated |
    25→
    26→**Impact:** WordPress 4.9.5 has **100+ known security vulnerabilities** including:
    27→- Remote Code Execution (RCE)
    28→- SQL Injection
    29→- Cross-Site Scripting (XSS)
    30→- Authentication Bypass
    31→- Privilege Escalation
    32→
    33→**CVEs affecting WP 4.9.5 include (partial list):**
    34→- CVE-2019-8942 (RCE via uploaded files)
    35→- CVE-2019-8943 (Path traversal)
    36→- CVE-2020-4046 (XSS in block editor)
    37→- CVE-2022-21662 (Stored XSS)
    38→- CVE-2023-2745 (Directory traversal)
    39→- And many more...
    40→
    41→**Recommendation:** Update WordPress to latest version (6.7.x) - This is the #1 priority.
    42→
    43→---
    44→
    45→### 2. Outdated Plugins with Known Vulnerabilities
    46→
    47→| Plugin | Current | Status | Risk |
    48→|--------|---------|--------|------|
    49→| **js_composer (WPBakery)** | 5.4.7 | CRITICAL | Multiple RCE/XSS vulns |
    50→| **revslider (Slider Revolution)** | 5.4.7.3 | CRITICAL | Historically targeted by hackers |

<system-reminder>
Whenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.
</system-reminder>

# Security Audit Report: ralphstransfer.com

**Date:** December 12, 2025
**Server:** websvr.acghosting.com
**Site URL:** https://ralphstransfer.com
**Prepared for:** Developer/Site Administrator

---

## Executive Summary

This site has **CRITICAL security vulnerabilities** primarily due to severely outdated WordPress core (4.9.5, released April 2018). The site is over **7 years behind** on security updates, exposing it to hundreds of known vulnerabilities. Immediate action is required.

### Risk Level: **CRITICAL** 🔴

---

## Critical Issues

### 1. WordPress Core - SEVERELY OUTDATED ⚠ CRITICAL

| Current | Latest | Age |
|---------|--------|-----|
| 4.9.5 | 6.7.x | ~7 years outdated |

**Impact:** WordPress 4.9.5 has **100+ known security vulnerabilities** including:
- Remote Code Execution (RCE)
- SQL Injection
- Cross-Site Scripting (XSS)
- Authentication Bypass
- Privilege Escalation

**CVEs affecting WP 4.9.5 include (partial list):**
- CVE-2019-8942 (RCE via uploaded files)
- CVE-2019-8943 (Path traversal)
- CVE-2020-4046 (XSS in block editor)
- CVE-2022-21662 (Stored XSS)
- CVE-2023-2745 (Directory traversal)
- And many more...

**Recommendation:** Update WordPress to latest version (6.7.x) - This is the #1 priority.

---

### 2. Outdated Plugins with Known Vulnerabilities

| Plugin | Current | Status | Risk |
|--------|---------|--------|------|
| **js_composer (WPBakery)** | 5.4.7 | CRITICAL | Multiple RCE/XSS vulns |
| **revslider (Slider Revolution)** | 5.4.7.3 | CRITICAL | Historically targeted by hackers |


Let me check a few more client names to understand the scope better.


ls -1 "C:\Users\MikeSwanson\claude-projects" *.txt 2>/dev/null

List text files in root with client names


bgbuilders-dns-records.txt
bgbuildersllc-godaddy-zonefile.txt
cookies.txt
server-migration-email.txt
shelly-exo-results.txt
shelly-investigation-results.txt

C:\Users\MikeSwanson\claude-projects:
ACPlus/
ACPP/
audit-mike-actions.ps1
Autocode-remix/
bgbuilders-dns-records.txt
bgbuildersllc-godaddy-zonefile.txt
check-firewall.ps1
check-fresh-logs.ps1
check-mailbox-rules.ps1
check-mike-signins.ps1
check-monday-meetings.ps1
check-nps.ps1
check-nps-listening.ps1
check-nps-logs.ps1
check-nps-service.ps1
check-rules-graph.ps1
check-sysadmin.ps1
claude.bat
CLAUDE.md
claude_code_quickstart.md
claude-code-transcripts/
claude-settings/
cleanup-lehman.ps1
cloudflare-whm/
connect-acg-tenant.ps1
cookies.txt
create-app.ps1
dataforth-dos/
dataforth-vpn.ovpn
dataforth-vpn-linux.ovpn
debug-nps.ps1
exo-investigate.ps1
exo-shelly.ps1
find-users.ps1
fix-nps.ps1
fix-nps-logging.ps1
fix-radius-client.ps1
full-investigate.ps1
get-nps-config.ps1
get-nps-policies.ps1
get-nps-simple.ps1
grabb-website-move/
grant-access.ps1
grant-access-scan.ps1
graph-admin-investigate.ps1
graph-rest-investigate.ps1
guru-connect/
guruconnect.toml
gururmm/
gururmm.temp/
install_claudecode.sh*
investigate-interactive.ps1
investigate-mike.ps1
investigate-mike-full.ps1
investigate-shelly.ps1
IX_SERVER_CRITICAL_ISSUES_2026-01-13.md
launch-investigation.ps1
lehman-dup-contacts.csv
lehman-dup-events.csv
list-users.ps1
monitor-radius.ps1
msp-toolkit/
msp-toolkit-rust/
nul
prompts/
ralphstransfer-security-audit-2025-12-12.md
reference/
run-scan.ps1
scan-duplicates.ps1
scan-lehman.ps1
scan-my-duplicates.ps1
seafile-graph-email/
send-migration-notice.sh*
server-migration-email.txt
session-logs/
setup-claude-mac.sh*
setup-claude-workstation.ps1
shared-data/
shelly-exo-results.txt
shelly-investigation-results.txt
temp-ipban-install.ps1
test-radius.ps1
tmpclaude-0032-cwd
tmpclaude-01ca-cwd
tmpclaude-022e-cwd
tmpclaude-029f-cwd
tmpclaude-0475-cwd
tmpclaude-04ec-cwd
tmpclaude-06d5-cwd
tmpclaude-0835-cwd
tmpclaude-08aa-cwd
tmpclaude-0aa3-cwd
tmpclaude-0b80-cwd
tmpclaude-0bd3-cwd
tmpclaude-0c37-cwd
tmpclaude-0c3f-cwd
tmpclaude-0cc1-cwd
tmpclaude-0d61-cwd
tmpclaude-0dc6-cwd
tmpclaude-133a-cwd
tmpclaude-13c2-cwd
tmpclaude-14a1-cwd
tmpclaude-14e1-cwd
tmpclaude-1543-cwd
tmpclaude-15cf-cwd
tmpclaude-15e0-cwd
tmpclaude-16a1-cwd
tmpclaude-16be-cwd
tmpclaude-1755-cwd
tmpclaude-1924-cwd
tmpclaude-19cd-cwd
tmpclaude-1b73-cwd
tmpclaude-1b88-cwd
tmpclaude-1c78-cwd
tmpclaude-1cd7-cwd
tmpclaude-1d79-cwd
tmpclaude-1dd0-cwd
tmpclaude-1df1-cwd
tmpclaude-1e3f-cwd
tmpclaude-2157-cwd
tmpclaude-215f-cwd
tmpclaude-2292-cwd
tmpclaude-26fb-cwd
tmpclaude-2705-cwd
tmpclaude-2a10-cwd
tmpclaude-2a31-cwd
tmpclaude-2d86-cwd
tmpclaude-3186-cwd
tmpclaude-32d8-cwd
tmpclaude-3312-cwd
tmpclaude-338f-cwd
tmpclaude-34a5-cwd
tmpclaude-34da-cwd
tmpclaude-3656-cwd
tmpclaude-372a-cwd
tmpclaude-3906-cwd
tmpclaude-3990-cwd
tmpclaude-3d24-cwd
tmpclaude-3db6-cwd
tmpclaude-4001-cwd
tmpclaude-402d-cwd
tmpclaude-4036-cwd
tmpclaude-40ba-cwd
tmpclaude-4393-cwd
tmpclaude-45ba-cwd
tmpclaude-45c8-cwd
tmpclaude-475b-cwd
tmpclaude-4a1a-cwd
tmpclaude-4bb5-cwd
tmpclaude-4c3c-cwd
tmpclaude-4de6-cwd
tmpclaude-4e40-cwd
tmpclaude-4e88-cwd
tmpclaude-4ee4-cwd
tmpclaude-4f04-cwd
tmpclaude-5075-cwd
tmpclaude-534b-cwd
tmpclaude-54a5-cwd
tmpclaude-56c8-cwd
tmpclaude-580b-cwd
tmpclaude-5844-cwd
tmpclaude-5941-cwd
tmpclaude-5d81-cwd
tmpclaude-5de2-cwd
tmpclaude-5f04-cwd
tmpclaude-5f75-cwd
tmpclaude-6015-cwd
tmpclaude-62ba-cwd
tmpclaude-631c-cwd
tmpclaude-6344-cwd
tmpclaude-6372-cwd
tmpclaude-64a0-cwd
tmpclaude-6619-cwd
tmpclaude-6679-cwd
tmpclaude-68ec-cwd
tmpclaude-6bf6-cwd
tmpclaude-6cab-cwd
tmpclaude-6da0-cwd
tmpclaude-6dca-cwd
tmpclaude-6f9d-cwd
tmpclaude-70c0-cwd
tmpclaude-71e0-cwd
tmpclaude-72c8-cwd
tmpclaude-72d9-cwd
tmpclaude-73e0-cwd
tmpclaude-7661-cwd
tmpclaude-7a09-cwd
tmpclaude-7a1b-cwd
tmpclaude-7a33-cwd
tmpclaude-7bec-cwd
tmpclaude-7d85-cwd
tmpclaude-7e3e-cwd
tmpclaude-81ba-cwd
tmpclaude-832d-cwd
tmpclaude-87ec-cwd
tmpclaude-8856-cwd
tmpclaude-89d6-cwd
tmpclaude-89ee-cwd
tmpclaude-8aa2-cwd
tmpclaude-8ab9-cwd
tmpclaude-8c8b-cwd
tmpclaude-8cb4-cwd
tmpclaude-8cd7-cwd
tmpclaude-8fb5-cwd
tmpclaude-9110-cwd
tmpclaude-913f-cwd
tmpclaude-91f1-cwd
tmpclaude-9270-cwd
tmpclaude-92d7-cwd
tmpclaude-93b5-cwd
tmpclaude-9484-cwd
tmpclaude-94bd-cwd
tmpclaude-95b3-cwd
tmpclaude-95e1-cwd
tmpclaude-9701-cwd
tmpclaude-976a-cwd
tmpclaude-979c-cwd
tmpclaude-98b7-cwd
tmpclaude-992a-cwd
tmpclaude-9adc-cwd
tmpclaude-9bde-cwd
tmpclaude-9c82-cwd
tmpclaude-9d4e-cwd
tmpclaude-9e8d-cwd
tmpclaude-9e90-cwd
tmpclaude-a2da-cwd
tmpclaude-a2f1-cwd
tmpclaude-a3c0-cwd
tmpclaude-a4ca-cwd
tmpclaude-a658-cwd
tmpclaude-a775-cwd
tmpclaude-aa4f-cwd
tmpclaude-ae83-cwd
tmpclaude-aeed-cwd
tmpclaude-b27e-cwd
tmpclaude-b319-cwd
tmpclaude-b43a-cwd
tmpclaude-b5f6-cwd
tmpclaude-b914-cwd
tmpclaude-bc03-cwd
tmpclaude-bcaf-cwd
tmpclaude-bdc5-cwd
tmpclaude-bef9-cwd
tmpclaude-bf6e-cwd
tmpclaude-c1a2-cwd
tmpclaude-c278-cwd
tmpclaude-c3de-cwd
tmpclaude-c621-cwd
tmpclaude-c69e-cwd
tmpclaude-c70d-cwd
tmpclaude-c771-cwd
tmpclaude-c946-cwd
tmpclaude-c9f4-cwd
tmpclaude-cdb9-cwd
tmpclaude-ce5f-cwd
tmpclaude-cf8d-cwd
tmpclaude-d1b0-cwd
tmpclaude-d2ad-cwd
tmpclaude-d32e-cwd
tmpclaude-d4e3-cwd
tmpclaude-d54d-cwd
tmpclaude-d612-cwd
tmpclaude-d96d-cwd
tmpclaude-da44-cwd
tmpclaude-dfb9-cwd
tmpclaude-e066-cwd
tmpclaude-e18d-cwd
tmpclaude-e289-cwd
tmpclaude-e4a3-cwd
tmpclaude-e4ad-cwd
tmpclaude-e843-cwd
tmpclaude-e873-cwd
tmpclaude-e913-cwd
tmpclaude-e955-cwd
tmpclaude-e9b8-cwd
tmpclaude-eaba-cwd
tmpclaude-eced-cwd
tmpclaude-ecee-cwd
tmpclaude-ed58-cwd
tmpclaude-eeb2-cwd
tmpclaude-f023-cwd
tmpclaude-f0a8-cwd
tmpclaude-f1b4-cwd
tmpclaude-f37d-cwd
tmpclaude-f39f-cwd
tmpclaude-f580-cwd
tmpclaude-f5cc-cwd
tmpclaude-f67d-cwd
tmpclaude-f859-cwd
tmpclaude-f87c-cwd
tmpclaude-f9e0-cwd
tmpclaude-fc4e-cwd
tmpclaude-fd84-cwd
tmpclaude-fe56-cwd
tmpclaude-ff2a-cwd
tmpclaude-ff49-cwd
tmpclaude-ff70-cwd
tmpclaude-ffa6-cwd
trace-radius.ps1
verify-and-restart-nps.ps1
verify-lehman.ps1
Website2025/
whm-dns-cleanup/
windows-setup-helper/


     1→# IX Server Critical Performance Issues - 2026-01-13
     2→
     3→**Report Location on Server:** `/root/URGENT_SITE_ISSUES.txt`
     4→
     5→## 🔴 CRITICAL - IMMEDIATE ACTION
     6→
     7→### 1. arizonahatters.com - **MOST URGENT**
     8→- **Error Log:** 468MB
     9→- **PHP Memory Errors:** 429 occurrences
    10→- **Database:** 24.5MB (Wordfence bloat)
    11→- **Issue:** Wordfence file scanning causing continuous memory exhaustion
    12→- **Status:** ⏳ NEEDS FIXING
    13→
    14→### 2. peacefulspirit.com
    15→- **Error Log:** 4.0MB
    16→- **PHP Memory Errors:** 2 occurrences
    17→- **Database:** 310MB! (wp_wpml_mails: 156MB, wp_gf_entry_meta: 96MB)
    18→- **Issue:** WPML email logs and Gravity Forms data bloat
    19→- **Status:** ⏳ NEEDS FIXING
    20→
    21→---
    22→
    23→## 🟠 HIGH PRIORITY (>50MB error logs)
    24→
    25→3. desertfox.com - 215MB
    26→4. outaboundssports.com - 208MB
    27→5. rrspc.com - 183MB
    28→6. farwest.com - 100MB
    29→7. fsgtucson.com - 64MB
    30→8. tonystech.com - 54MB
    31→9. phxpropane.com - 52MB
    32→10. rednourlaw.com - 50MB
    33→11. gurushow.com - 40MB
    34→12. cryoweave.com - 37MB
    35→13. bruceext.com - 31MB
    36→
    37→---
    38→
    39→## 🟡 MEDIUM PRIORITY (Debug logs)
    40→
    41→14. gentlemansacres.com - debug.log: 350MB
    42→15. azrestaurant.com - debug.log: 181MB + itsec_logs: 53MB
    43→16. rsi.com - debug.log: 166MB
    44→17. voicesofthewest.com - akeeba log: 106MB
    45→
    46→---
    47→
    48→## Common Issues Found
    49→
    50→### Wordfence Bloat (Most Sites)
    51→- wp_wffilemods: 1.4-8.52MB
    52→- wp_wfknownfilelist: 0.86-4.52MB
    53→- wp_wfconfig: Up to 3.30MB
    54→
    55→### Email/Form Logs
    56→- WPML email logs
    57→- Gravity Forms entries
    58→- Post SMTP logs
    59→- Action Scheduler
    60→
    61→### Old Backups (Disk Space)
    62→- acepickupparts: 1.6GB
    63→- azcomputerguru: 3GB+
    64→- sundanzer: 2GB
    65→- berman: 388MB (2019)
    66→- rrspc: 314MB (2021)
    67→
    68→---
    69→
    70→## Scan Commands
    71→
    72→```bash
    73→# Re-run full scan
    74→ssh root@172.16.3.10 /root/scan_sites.sh
    75→cat /root/site_scan_report.txt
    76→
    77→# Check specific database
    78→ssh root@172.16.3.10 /root/check_dbs.sh
    79→cat /root/db_bloat_report.txt
    80→
    81→# View critical issues
    82→ssh root@172.16.3.10 cat /root/URGENT_SITE_ISSUES.txt
    83→```
    84→

<system-reminder>
Whenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.
</system-reminder>

# IX Server Critical Performance Issues - 2026-01-13

**Report Location on Server:** `/root/URGENT_SITE_ISSUES.txt`

## 🔴 CRITICAL - IMMEDIATE ACTION

### 1. arizonahatters.com - **MOST URGENT**
- **Error Log:** 468MB
- **PHP Memory Errors:** 429 occurrences
- **Database:** 24.5MB (Wordfence bloat)
- **Issue:** Wordfence file scanning causing continuous memory exhaustion
- **Status:** ⏳ NEEDS FIXING

### 2. peacefulspirit.com
- **Error Log:** 4.0MB
- **PHP Memory Errors:** 2 occurrences
- **Database:** 310MB! (wp_wpml_mails: 156MB, wp_gf_entry_meta: 96MB)
- **Issue:** WPML email logs and Gravity Forms data bloat
- **Status:** ⏳ NEEDS FIXING

---

## 🟠 HIGH PRIORITY (>50MB error logs)

3. desertfox.com - 215MB
4. outaboundssports.com - 208MB
5. rrspc.com - 183MB
6. farwest.com - 100MB
7. fsgtucson.com - 64MB
8. tonystech.com - 54MB
9. phxpropane.com - 52MB
10. rednourlaw.com - 50MB
11. gurushow.com - 40MB
12. cryoweave.com - 37MB
13. bruceext.com - 31MB

---

## 🟡 MEDIUM PRIORITY (Debug logs)

14. gentlemansacres.com - debug.log: 350MB
15. azrestaurant.com - debug.log: 181MB + itsec_logs: 53MB
16. rsi.com - debug.log: 166MB
17. voicesofthewest.com - akeeba log: 106MB

---

## Common Issues Found

### Wordfence Bloat (Most Sites)
- wp_wffilemods: 1.4-8.52MB
- wp_wfknownfilelist: 0.86-4.52MB
- wp_wfconfig: Up to 3.30MB

### Email/Form Logs
- WPML email logs
- Gravity Forms entries
- Post SMTP logs
- Action Scheduler

### Old Backups (Disk Space)
- acepickupparts: 1.6GB
- azcomputerguru: 3GB+
- sundanzer: 2GB
- berman: 388MB (2019)
- rrspc: 314MB (2021)

---

## Scan Commands

```bash
# Re-run full scan
ssh root@172.16.3.10 /root/scan_sites.sh
cat /root/site_scan_report.txt

# Check specific database
ssh root@172.16.3.10 /root/check_dbs.sh
cat /root/db_bloat_report.txt

# View critical issues
ssh root@172.16.3.10 cat /root/URGENT_SITE_ISSUES.txt
```


C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md-11-
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md-12-```
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md:13:Domain: acepickupparts.com
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md-14-  Name: _2585DA5F8DD4A8D58642D6542A3CC39E
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md-15-  Type: CNAME
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md-16-  Target: _9BFA7F2ED5E12D70EFD88E9A4E03828B.5FC04CC4F2748B6E9588D5C5844D7B25.8e32694b89a59.comodoca.com.
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md-17-
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md:18:Domain: acghosting.com
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md-19-  Name: _9D4B2A64C8B5E7F12A3D6E89B4C71F23
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md-20-  Type: CNAME
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md-21-  Target: [Comodo validation target]
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md-22-
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md:23:Domain: arizonahatters.com
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md-24-  Name: _[DCV_HASH]
C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\WHM-Recovery-Data-2025-12-09.md-25-  Type: CNAME
--
C:\Users\MikeSwanson\claude-projects\session-logs\2025-12-22-session.md-169-Time: 12/22/2025 10:03:56
C:\Users\MikeSwanson\claude-projects\session-logs\2025-12-22-session.md-170-User: cguerrero
C:\Users\MikeSwanson\claude-projects\session-logs\2025-12-22-session.md:171:Domain: VWP
C:\Users\MikeSwanson\claude-projects\session-logs\2025-12-22-session.md-172-Policy: VPN-Access
C:\Users\MikeSwanson\claude-projects\session-logs\2025-12-22-session.md-173-Auth Type: PAP


Perfect! Now I have a comprehensive understanding. Let me compile my findings into a report.

## Project Organization Analysis - Findings Report

Based on my analysis of `C:\Users\MikeSwanson\claude-projects\`, here are the findings for database schema design:

---

### 1. PROJECT ORGANIZATION

**Directory Structure Pattern:**
- **Project directories:** Named with hyphens (e.g., `dataforth-dos`, `grabb-website-move`, `guru-connect`)
- **Internal products:** Single names or CamelCase (e.g., `gururmm`, `ACPlus`, `ACPP`)
- **Utility/infrastructure:** Descriptive names (e.g., `cloudflare-whm`, `whm-dns-cleanup`)

**Project Types Identified:**
1. **Client Projects** - Specific customer work (dataforth-dos, grabb-website-move)
2. **Internal Products** - GuruRMM, GuruConnect, MSP Toolkit
3. **Infrastructure Tools** - cloudflare-whm, whm-dns-cleanup, windows-setup-helper
4. **Documentation** - session-logs, shared-data, reference

---

### 2. CLIENT-PROJECT RELATIONSHIPS

**Confirmed Client Projects:**
- **Dataforth Corporation** → `dataforth-dos/` (DOS test machines, VPN setup)
- **Grabb & Durando** → `grabb-website-move/` (website migration, calendar fixes)
- **Neptune** → Session logs reference Exchange migration
- **BGBuilders** → bgbuilders-dns-records.txt (DNS configuration)
- **Lehman** → Multiple PowerShell scripts (calendar cleanup)
- **Ralphstransfer** → ralphstransfer-security-audit-2025-12-12.md
- **ACG Hosting (Internal)** → Multiple infrastructure projects

**Client Sites on IX Server (from IX_SERVER_CRITICAL_ISSUES):**
- arizonahatters.com, peacefulspirit.com, desertfox.com, outaboundssports.com, rrspc.com, farwest.com, fsgtucson.com, tonystech.com, phxpropane.com, rednourlaw.com, gurushow.com, cryoweave.com, bruceext.com, gentlemansacres.com, azrestaurant.com, rsi.com, voicesofthewest.com, acepickupparts.com, sundanzer.com, berman.com

---

### 3. PROJECT METADATA PATTERNS

**Standard Documentation Files:**
1. **README.md** - Complete project overview, technical details
2. **CREDENTIALS.md** - Project-specific credentials (also in `shared-data/credentials.md`)
3. **CLAUDE.md** - Context file for Claude Code instances
4. **PLAN.md** - Active work plans (found in gururmm/tray/)
5. **PROJECT_INDEX.md** - Quick reference guide (dataforth-dos)

**Metadata Found in README.md Files:**
```markdown
**Customer:** [Client Name]
**Project Date:** [Month Year]
**Status:** [WORKING|COMPLETE|BLOCKED|PENDING]
```

**Example from dataforth-dos/README.md:**
- Customer: Dataforth Corporation
- Project Date: December 2025
- Status: WORKING - Pending completion of datasheets share

---

### 4. DOCUMENTATION PATTERNS

**Project-Level Documentation:**
- `README.md` - Main overview
- `CREDENTIALS.md` - Access credentials
- `REMAINING_TASKS.md` - Todo items, blockers
- `NETWORK_TOPOLOGY.md` - Infrastructure diagrams
- `SYNC_SCRIPT.md` - Technical implementation details
- `DOS_BATCH_FILES.md` - Component-specific docs
- `GITEA_ACCESS.md` - Repository access instructions
- `session-logs/` - Per-session work logs

**Session Log Structure:**
```markdown
# Session Log: [Title]
**Date:** YYYY-MM-DD
**Status:** [COMPLETE|PARTIAL|BLOCKED]
**Projects:** [Project names]

## Summary
[Brief overview]

## [Section 1]
[Detailed work]

## Credentials
[Any new credentials]
```

**Common Sections in Session Logs:**
- Summary
- Problem Summary / Root Cause
- Investigation
- Fix Applied
- What We Tried
- Future Work Required
- Related Projects
- Project Locations
- Infrastructure Reference
- Credentials (new ones discovered)

---

### 5. PROJECT LIFECYCLE & STATUS TRACKING

**Status Values Found:**
- **COMPLETE** - Fully finished
- **WORKING** - In progress, functional
- **BLOCKED** - Waiting on external input
- **PENDING** - Planned but not started
- **CRITICAL** - Urgent issues requiring immediate action
- **NEEDS FIXING** - Known issues requiring attention
- **READY** - Prepared but not executed

**Task Tracking Patterns:**
```markdown
### Task Name
**Status:** [STATUS]
**Priority:** [HIGH|MEDIUM|LOW]
**Blocker:** [Description if blocked]
```

**Date Tracking:**
- Project Date - When project started
- Last Updated - In credentials.md and documentation
- Completion dates - In session logs
- "Created: YYYY-MM-DD" in PROJECT_INDEX.md

---

### 6. PROJECT CATEGORIES (for categorization)

Based on analysis, projects fall into these categories:

1. **Client Projects** - Customer-specific work
2. **Internal Products** - GuruRMM, GuruConnect, MSP Toolkit
3. **Infrastructure** - Server configs, network tools
4. **Website Projects** - Website migrations, fixes, audits
5. **Development Tools** - Build systems, deployment scripts
6. **Documentation** - Shared data, session logs, references

---

### 7. RELATIONSHIP PATTERNS

**Project → Client Relationships:**
- One-to-One: Most projects belong to a single client
- Many-to-One: Multiple session logs reference same client (Dataforth: VPN, DOS machines, UDM)
- Implicit: Some clients identified only through session logs, not dedicated project folders

**Project → Related Projects:**
- dataforth-dos relates to Dataforth VPN (cross-referenced in docs)
- GuruRMM relates to GuruConnect (same infrastructure)
- Multiple projects share credentials in `shared-data/credentials.md`

**Session Logs → Projects:**
- Session logs can reference multiple projects
- Session logs contain project-specific subsections
- Cross-referencing via file paths and keywords

---

### 8. GITEA REPOSITORY STRUCTURE

**Confirmed Repositories:**
- `azcomputerguru/gururmm`
- `azcomputerguru/claude-projects` (this repo)
- `azcomputerguru/ai-3d-printing`

**Sparse Checkout Pattern:**
Projects can be checked out individually from claude-projects:
```bash
git sparse-checkout set dataforth-dos shared-data
```

---

### 9. KEY FINDINGS FOR DATABASE DESIGN

**Projects Table Should Track:**
- Project slug/directory name
- Display name
- Client ID (foreign key)
- Status (enum or string)
- Project date (started)
- Category/type
- Priority level
- Description/summary
- Repository URL (if in Gitea)
- Last updated timestamp

**Clients Table Should Track:**
- Client name
- Client type (customer, internal, infrastructure)
- Contact information (optional)
- Notes

**Project Files/Documentation:**
- File path (relative to project root)
- File type (README, CREDENTIALS, session log, etc.)
- Purpose/description
- Last modified

**Session Logs:**
- Date
- Title/summary
- Status
- Related project IDs (many-to-many)
- File path
- Duration/work hours (if tracked)

**Related Items:**
- Cross-references between projects
- Dependencies
- Shared credentials references

---

### 10. INFRASTRUCTURE SERVERS (for context)

**Known Servers Referenced:**
- Jupiter (172.16.3.20) - Unraid, containers
- Saturn (172.16.3.21) - Unraid, secondary
- pfSense (172.16.0.1) - Firewall
- Build Server (172.16.3.30) - Ubuntu 22.04
- WebSvr (websvr.acghosting.com) - WHM/cPanel
- IX (172.16.3.10) - WHM/cPanel

These could be tracked in a separate `servers` table if needed for infrastructure context.

---

### RECOMMENDATIONS FOR DATABASE SCHEMA:

1. **`clients` table** - Track client organizations
2. **`projects` table** - Track individual projects with client FK
3. **`project_files` table** - Track documentation files within projects
4. **`session_logs` table** - Track work sessions
5. **`project_session_logs` junction table - Many-to-many relationship
6. **`project_relationships` table** - Related/dependent projects
7. **`project_status_history` table** - Track status changes over time
8. **`servers` table** (optional) - Track infrastructure servers referenced

**Key Fields:**
- Use slugs for directory names (URL-safe identifiers)
- Status should be enumerated or constrained
- Timestamps for created_at, updated_at
- Full-text search on descriptions, file contents
- Tags/categories for filtering