416 lines
20 KiB
Markdown
416 lines
20 KiB
Markdown
# Session Log — 2026-04-20
|
|
|
|
## User
|
|
- **User:** Mike Swanson (mike)
|
|
- **Machine:** DESKTOP-0O8A1RL
|
|
- **Role:** admin
|
|
|
|
## Session Summary
|
|
|
|
This session continued from a previous context that ran out of window. It covered two bodies of work:
|
|
|
|
1. **Remediation skill complete rewrite** — Updated all skill files to reflect the new 5-app tiered Entra architecture (Security Investigator, Exchange Operator, User Manager, Tenant Admin, Defender Add-on) replacing the old single over-permissioned app.
|
|
|
|
2. **Cascades Tucson breach check on John Trozzi** — Ran a full 10-point breach check after John reported spoofed email in his inbox. Mailbox confirmed clean; incident is inbound phishing, not account compromise.
|
|
|
|
---
|
|
|
|
## Work 1: Remediation Skill Rewrite
|
|
|
|
### Context (from prior session — summarized)
|
|
|
|
Previous session built out the full tiered MSP Entra app architecture:
|
|
- Created all 5 apps + management app via ComputerGuru-Management SP
|
|
- Granted admin consent in Grabblaw for Security Investigator + User Manager
|
|
- Old app `fabb3421` (ComputerGuru - AI Remediation) had 159 permissions including Defender ATP, which broke consent on tenants without MDE license (AADSTS650052)
|
|
|
|
### Files Rewritten
|
|
|
|
**`D:/claudetools/.claude/skills/remediation-tool/scripts/get-token.sh`**
|
|
- Completely rewritten: accepts `<tenant-id|domain> <tier>` instead of `<tenant-id> <scope>`
|
|
- Tiers: `investigator` | `investigator-exo` | `exchange-op` | `user-manager` | `tenant-admin` | `defender`
|
|
- Each tier maps to correct CLIENT_ID, vault SOPS path, and resource scope URL
|
|
- Cache key is now `{tenant}/{tier}.jwt` (not `{tenant}/{scope}.jwt`)
|
|
- Falls back through both `credentials.client_secret` and `credentials.credential` field names
|
|
- Falls back to raw sops+python if vault.sh fails
|
|
|
|
**`D:/claudetools/.claude/skills/remediation-tool/SKILL.md`**
|
|
- Added full app tier table with App IDs and vault files
|
|
- Updated Exchange REST prerequisites to name correct SP per operation
|
|
- Added minimum-privilege guidance ("never use tenant-admin for read-only check")
|
|
|
|
**`D:/claudetools/.claude/commands/remediation-tool.md`**
|
|
- Rewrote token acquisition to use tier flags
|
|
- Added per-app consent URLs in correct format (`redirect_uri=https://azcomputerguru.com`)
|
|
- Added `disable-smtp-auth` action
|
|
- Mapped each remediation action to its correct app tier (Exchange Operator for EXO write, User Manager for user ops)
|
|
|
|
**`D:/claudetools/.claude/skills/remediation-tool/references/gotchas.md`**
|
|
- Full rewrite: 5-app suite table, per-app consent URLs, directory role map updated
|
|
- Tenant table updated: Grabblaw now shows Security Investigator + User Manager consented (2026-04-20)
|
|
- Migration note for Valleywide/Dataforth/Cascades (still on old app)
|
|
- AADSTS650052 note for Defender tier on non-MDE tenants
|
|
|
|
**`D:/claudetools/.claude/skills/remediation-tool/references/checklist.md`**
|
|
- False-positive filter updated to match any "ComputerGuru" app display name
|
|
|
|
**`D:/claudetools/.claude/skills/remediation-tool/references/graph-endpoints.md`**
|
|
- Added token acquisition block at top with tier variable mapping
|
|
- Exchange REST section now distinguishes `$EXO_R` (Security Investigator) from `$EXO_W` (Exchange Operator)
|
|
|
|
### Vault Field Name Note
|
|
|
|
New SOPS files for the 5 apps were created in previous session. The field name for client secrets may be `credentials.client_secret` or `credentials.credential`. The updated `get-token.sh` tries both. If neither works on first use, check field with:
|
|
```bash
|
|
bash D:/vault/scripts/vault.sh get msp-tools/computerguru-security-investigator.sops.yaml
|
|
```
|
|
|
|
---
|
|
|
|
## Work 2: Cascades Tucson — John Trozzi Breach Check
|
|
|
|
### Trigger
|
|
John reported "spoofed email in his inbox." He forwarded the phishing email to howard@azcomputerguru.com and emailed Mike at 12:26 UTC with subject "Spoof emails."
|
|
|
|
### Approach Note
|
|
Cascades Tucson still uses the OLD app (`fabb3421`) — the new Security Investigator hasn't been consented there yet. Used old app credentials from vault (`msp-tools/claude-msp-access-graph-api.sops.yaml`) for this investigation.
|
|
|
|
### Tenant
|
|
- **Domain:** cascadestucson.com
|
|
- **Tenant ID:** `207fa277-e9d8-4eb7-ada1-1064d2221498`
|
|
- **App used:** fabb3421 (old app, still active at Cascades)
|
|
|
|
### User
|
|
- **UPN:** john.trozzi@cascadestucson.com
|
|
- **User ID:** a638f4b9-6936-4401-a9b7-015b9900e49e
|
|
- **Last password change:** 2026-04-16T16:05:11Z (self-service, after April 16 remediation)
|
|
|
|
### 10-Point Results — All Clean
|
|
|
|
| Check | Result |
|
|
|---|---|
|
|
| Graph inbox rules | CLEAN — no custom rules |
|
|
| Exchange REST rules (incl. hidden) | CLEAN — Junk E-mail Rule only |
|
|
| Mailbox forwarding | CLEAN — null/false on all fields |
|
|
| Delegates / FullAccess | CLEAN — no non-SELF |
|
|
| SendAs grants | CLEAN — no non-SELF |
|
|
| OAuth consents | CLEAN — BlueMail (2022) + EAS, both legitimate |
|
|
| Auth methods | NOTE — duplicate Authenticator (SM-F731U null date), low risk |
|
|
| Sign-ins 30d | CLEAN — all US/Phoenix, IP 184.191.143.62, no foreign access |
|
|
| Risky user | CLEAN — riskLevel: none |
|
|
| Directory audits | EXPECTED — April 16 sysadmin reset cycle + John self-service pw change |
|
|
|
|
### Incident Finding
|
|
|
|
John received phishing email:
|
|
- **Subject:** "ATTN!! — Pending 5 (Pages) Documents expires in 2 days REF, ID:f1bb60a2a1d6ae023a3c3e0c0f959a8d"
|
|
- Classic credential-harvesting lure
|
|
- John correctly identified it, forwarded to Howard, reported to Mike
|
|
- No evidence of link click or credential entry
|
|
- Original email no longer in inbox/deleted — John deleted it
|
|
|
|
### Google Account Alert
|
|
John received a security alert (16:01 UTC today) from no-reply@accounts.google.com for `201cascades@gmail.com`. Possibly a shared facility account. Confirm it has 2FA.
|
|
|
|
### DMARC Finding
|
|
```
|
|
_dmarc.cascadestucson.com: v=DMARC1;p=none;pct=100;rua=mailto:info@cascadestucson.com
|
|
cascadestucson.com SPF: v=spf1 ip4:72.194.62.5 include:spf.protection.outlook.com -all
|
|
```
|
|
- SPF is tight (`-all`) — good
|
|
- DMARC is `p=none` — monitoring only, no enforcement. Phishing emails can land in inboxes
|
|
- **Action needed:** Upgrade to `p=quarantine` after confirming DKIM. Coordinate with Meredith.
|
|
|
|
### Recommendations
|
|
1. Confirm John didn't click anything or enter credentials (if he did: revoke-sessions + password-reset)
|
|
2. Howard should delete the forwarded phishing email without clicking
|
|
3. Upgrade DMARC to p=quarantine (coordinate with Meredith)
|
|
4. Confirm DKIM is configured for cascadestucson.com in Exchange Online
|
|
5. Verify 201cascades@gmail.com Google alert
|
|
6. Clean up duplicate Authenticator entry (SM-F731U, null date) — low priority
|
|
|
|
### Report Location
|
|
`D:/claudetools/clients/cascades-tucson/reports/2026-04-20-breach-check-john-trozzi.md`
|
|
Committed: db157e3
|
|
|
|
---
|
|
|
|
## Credentials Reference (from prior session — carried forward)
|
|
|
|
### ComputerGuru-Management App (ACG home tenant)
|
|
- **App ID:** `0df4e185-4cf2-478c-a490-cc4ef36c6118`
|
|
- **Tenant ID:** `ce61461e-81a0-4c84-bb4a-7b354a9a356d`
|
|
- **Secret:** `C8t8Q~.bN-q5kJ~ARhkK3oMgg~w6pQhRq3-IKc15`
|
|
- **Vault:** `D:/vault/msp-tools/computerguru-management.sops.yaml`
|
|
- **Permissions:** Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, User.Read.All
|
|
|
|
### ComputerGuru Security Investigator (multi-tenant, read-only breach checks)
|
|
- **App ID:** `bfbc12a4-f0dd-4e12-b06d-997e7271e10c`
|
|
- **Secret:** `LS28Q~wHInqBB1y1TOWfwamKHBz~D2IFeSyUCcb0`
|
|
- **Vault:** `D:/vault/msp-tools/computerguru-security-investigator.sops.yaml`
|
|
- **Tenants consented:** Grabblaw (032b383e) — Security Investigator + Exchange Admin role needed
|
|
- **Note:** NOT YET CONSENTED at Cascades, Dataforth, Valleywide — still using old app there
|
|
|
|
### ComputerGuru Exchange Operator (multi-tenant, EXO write)
|
|
- **App ID:** `b43e7342-5b4b-492f-890f-bb5a4f7f40e9`
|
|
- **Secret:** `Ct28Q~fKYUu.RvkMaGNAV1YeK6h-HBewCTPnwa.Y`
|
|
- **Vault:** `D:/vault/msp-tools/computerguru-exchange-operator.sops.yaml`
|
|
|
|
### ComputerGuru User Manager (multi-tenant, user/group write)
|
|
- **App ID:** `64fac46b-8b44-41ad-93ee-7da03927576c`
|
|
- **Secret:** `GEQ8Q~Xl0_Lrbq85QjEyUsvK9rMe1m-C.ze.0ahN`
|
|
- **Vault:** `D:/vault/msp-tools/computerguru-user-manager.sops.yaml`
|
|
- **Tenants consented:** Grabblaw (032b383e)
|
|
|
|
### ComputerGuru Tenant Admin (multi-tenant, high-privilege)
|
|
- **App ID:** `709e6eed-0711-4875-9c44-2d3518c47063`
|
|
- **Secret:** `GYe8Q~I-hzqK1hUsh2uUg6RVFwM1TQt8C7h8XaUm`
|
|
- **Vault:** `D:/vault/msp-tools/computerguru-tenant-admin.sops.yaml`
|
|
|
|
### ComputerGuru Defender Add-on (multi-tenant, MDE only)
|
|
- **App ID:** `dbf8ad1a-54f4-4bb8-8a9e-ea5b9634635b`
|
|
- **Secret:** `r1h8Q~L4kPb3STTjazbxNDsYw3JuHm1yIhTy5bqM`
|
|
- **Vault:** `D:/vault/msp-tools/computerguru-defender-addon.sops.yaml`
|
|
|
|
### Old App (DEPRECATED — still active at Cascades/Dataforth/Valleywide)
|
|
- **App ID:** `fabb3421-8b34-484b-bc17-e46de9703418`
|
|
- **Display name:** ComputerGuru - AI Remediation
|
|
- **Vault:** `D:/vault/msp-tools/claude-msp-access-graph-api.sops.yaml` → field: `credentials.credential`
|
|
- **Status:** Retire after migrating remaining tenants to new app suite
|
|
|
|
### Mike's Entra User ID (for app ownership)
|
|
- **Object ID:** `f34ebe40-9565-4135-af4c-2e808df57a25`
|
|
- **ACG Tenant:** `ce61461e-81a0-4c84-bb4a-7b354a9a356d`
|
|
|
|
### Grabblaw
|
|
- **Tenant ID:** `032b383e-96e4-491b-880d-3fd3295672c3`
|
|
- **Svetlana Larionova:** slarionova@grabblaw.com (created 2026-04-20, temp pw: TempGrabb2026!, User ID: affab40c-5535-4c1a-9a78-a2eda1a4a3b7)
|
|
- **License:** M365 Business Premium (f245ecc8-75af-4f8e-b61f-27d8114de5f3)
|
|
- **Apps consented:** Security Investigator, User Manager
|
|
- **Directory roles:** none assigned yet (no Exchange Admin on either SP)
|
|
|
|
### Cascades Tucson
|
|
- **Tenant ID:** `207fa277-e9d8-4eb7-ada1-1064d2221498`
|
|
- **Apps:** Still using old app fabb3421. New app not yet consented.
|
|
- **Directory roles (old app):** Exchange Administrator, User Administrator
|
|
|
|
---
|
|
|
|
## Pending Items
|
|
|
|
### MSP App Suite Migration
|
|
- [ ] Consent Security Investigator at Cascades, Dataforth, Valleywide
|
|
- [ ] Assign Exchange Administrator role to Security Investigator SP in Cascades + Dataforth
|
|
- [ ] Publisher verification on Apps 3-5 and Defender Add-on (MPN 6149186 — Arizona Computer Guru LLC)
|
|
- [ ] Retire/delete old ComputerGuru - AI Remediation app (`fabb3421`) after migration
|
|
|
|
### Cascades Tucson
|
|
- [ ] Confirm John Trozzi didn't click phishing link / enter credentials
|
|
- [ ] Howard: delete the forwarded phishing email
|
|
- [ ] DMARC p=none → p=quarantine (after DKIM confirmed) — coordinate with Meredith
|
|
- [ ] Confirm DKIM configured for cascadestucson.com in Exchange Online
|
|
- [ ] Verify 201cascades@gmail.com Google security alert
|
|
- [ ] Clean up duplicate John Authenticator entry (low priority)
|
|
|
|
### azcomputerguru.com (from prior session)
|
|
- [ ] Add ToS + Privacy URLs to new app registrations in portal (Branding & properties)
|
|
- [ ] Vault cPanel credentials at `clients/azcomputerguru/cpanel.sops.yaml`
|
|
- [ ] Add Windows SSH key to authorized_keys on 172.16.3.10
|
|
- [ ] Reset mike WP password to permanent value and vault it
|
|
|
|
### ClaudeTools
|
|
- [ ] Add Windows SSH key to authorized_keys on 172.16.3.30
|
|
|
|
---
|
|
|
|
## Update: 19:08 UTC — CLAUDE.md Optimization
|
|
|
|
### Summary
|
|
|
|
Refactored `.claude/CLAUDE.md` to reduce context window pressure. Extracted verbose sections to on-demand reference files. No functional changes — same rules, smaller footprint.
|
|
|
|
### Changes Made
|
|
|
|
**`.claude/CLAUDE.md`** — 494 lines → 252 lines (~49% reduction)
|
|
- Work Mode section: replaced 22-line narrative with a 5-row detection table; dropped color references (color changes don't work programmatically anyway — mode.md handles that)
|
|
- PROJECT_STATE.md Action Protocol: removed entirely (~65 lines) — moved to dedicated file
|
|
- Ollama section: trimmed from ~90 lines to 5-line summary + pointer
|
|
- Auto Context Loading: removed Benefits list, condensed anti-pattern examples to one sentence
|
|
- Credential Access: kept the 4 vault commands, removed encryption/key location details
|
|
|
|
**`.claude/OLLAMA.md`** — new file (67 lines)
|
|
- Full Ollama reference: endpoints, models, connection examples, review policy
|
|
- Only loaded when Claude needs to call Ollama (Tier 0 tasks)
|
|
|
|
**`.claude/PROJECT_STATE_PROTOCOL.md`** — new file (42 lines)
|
|
- Full locking protocol: what requires a lock, how to claim/release, stale lock rule
|
|
- Only loaded when Auto Context Loading finds a PROJECT_STATE.md in a project
|
|
|
|
### Decisions
|
|
|
|
- PROJECT_STATE files already have brief locking instructions embedded in their headers — the full protocol in CLAUDE.md was redundant
|
|
- Work mode colors were dropped from CLAUDE.md because `/color` is a CLI built-in Claude can't invoke programmatically; mode.md already has the authoritative detail
|
|
- Ollama extraction was the biggest single win (~90 lines) — it's only needed for Tier 0 delegation, not every session
|
|
|
|
### Pending
|
|
- None. This was a self-contained optimization pass.
|
|
|
|
---
|
|
|
|
## Update: 19:48 UTC — Python Fix + CLAUDE.md Continued
|
|
|
|
### Summary
|
|
|
|
Fixed Windows python3 Store alias errors (exit code 49) burning tokens on every Python call. Also committed previous CLAUDE.md optimization work.
|
|
|
|
### Root Cause
|
|
|
|
Windows Store app execution aliases for `python.exe` and `python3.exe` were intercepting calls and returning exit 49 instead of running Python. Fix was two-part:
|
|
1. Code: replace `python3` with `py` (Windows launcher) or `jq` throughout all scripts/docs
|
|
2. System: Mike disabled the Store aliases in Settings > Apps > Advanced app settings > App execution aliases
|
|
|
|
### Files Changed
|
|
|
|
**ClaudeTools repo (936ea49):**
|
|
- `.claude/OLLAMA.md` — reachability check: `python -c` → `jq -r`, one-liner: `python3` → `py`
|
|
- `.claude/commands/syncro.md` — `python` → `py`
|
|
- `.claude/scripts/sync.sh` — fallback loop: `python3 python` → `py python3 python`; also updated error message
|
|
- `.claude/skills/1password/references/op_commands.md` — all `python3` → `py`; JSON one-liners → `jq`
|
|
- `.claude/skills/1password/references/secret_references.md` — all `python3` → `py`; field list → `jq`
|
|
- `.claude/skills/1password/scripts/check_setup.sh` — vault list: `python3` → `jq`
|
|
- `.claude/skills/1password/scripts/env_from_op.sh` — item lists → `jq`; vault/title extraction → `jq`; heredoc: `python3 -` → `py -`
|
|
- `.claude/skills/1password/scripts/store_secret.sh` — item ID + vault name extraction: `python3` → `jq`
|
|
- `.claude/skills/remediation-tool/scripts/get-token.sh` — fallback loop: `python3 python py` → `py python python3`
|
|
- `.claude/DATABASE_FIRST_PROTOCOL.md` — `python -c` → `jq -r`
|
|
- `.claude/settings.local.json` — added `"Bash(py:*)"` to allowlist
|
|
|
|
**Vault repo (4590370):**
|
|
- `scripts/vault.sh` — fallback loop: `python python3 py` → `py python python3`
|
|
|
|
### Python State on DESKTOP-0O8A1RL
|
|
|
|
| Command | Status |
|
|
|---|---|
|
|
| `python3` | BROKEN — Store alias disabled, now fails cleanly |
|
|
| `python` | BROKEN — Store alias disabled |
|
|
| `py` | WORKS — Windows launcher at `C:\Windows\py.exe` |
|
|
| `jq` | WORKS — `C:\Users\guru\AppData\Local\Microsoft\WinGet\Links\jq.exe` |
|
|
| Python install | `C:\Program Files\Python314\python.exe` (also Python312 in user AppData) |
|
|
|
|
### Memory Saved
|
|
|
|
Added `feedback_python_windows.md` to `.claude/memory/`: use `py` not `python3`, prefer `jq` for JSON.
|
|
|
|
### No Credentials / No Pending Items from This Update
|
|
|
|
---
|
|
|
|
---
|
|
|
|
## Update: 12:55
|
|
|
|
### Glaztech — Exchange Online DMARC Override
|
|
|
|
- Consented Exchange Operator app in glaztech.com tenant (82931e3c-de7a-4f74-87f7-fe714be1f160)
|
|
- Created transport rule "TEMP - Allow DMARC fail from clearcutglass.com" via EXO REST InvokeCommand
|
|
- GUID: 6b702a5c-02ad-46e5-a2e1-7cb70284bd5c
|
|
- Action: SetSCL = -1 for sender domain clearcutglass.com
|
|
- Syncro ticket #32176 created for Glaz-Tech Industries (customer ID 143932)
|
|
- Full detail: `clients/glaztech/session-logs/2026-04-20-session.md`
|
|
|
|
### Syncro Skill Fix
|
|
|
|
- Investigated why labor/time entries weren't being saved on tickets
|
|
- Root cause: `POST /tickets/{id}/comment` silently ignores `product_id`, `minutes_spent`, `bill_time_now` (Syncro API bug)
|
|
- Fix: use `POST /tickets/{id}/timer_entry` with `start_at`, `end_at`, `billable`, `product_id` — confirmed working
|
|
- Updated `.claude/commands/syncro.md` with correct two-call pattern and WARNING on broken comment fields
|
|
- New behavior rules: always ask for minutes + labor type before billing; always show comment preview before posting
|
|
|
|
### Memory Updates
|
|
|
|
- `feedback_syncro_billing.md` — ask for time + show preview before any Syncro billing action
|
|
|
|
---
|
|
|
|
---
|
|
|
|
## Update: 15:40 — BG Builders Billing + OITVOIP API Research
|
|
|
|
### BG Builders — Ticket #109212872
|
|
|
|
**Ticket:** Remote - Set brother printer up on wifi
|
|
**Customer:** BG Builders (Shelly Dooley) — shelly@bgbuildersllc.com | (480) 495-4511
|
|
**Customer ID:** 32622062
|
|
|
|
**Resolution:** Cleared ARP cache on the Verizon router at BG Builders. Shelly confirmed printer working.
|
|
|
|
**Billing:**
|
|
- 30 min Labor - Remote Business (product_id 1190473)
|
|
- Timer entry ID: 38717330
|
|
- Invoice #67431 (ID: 1649993619) — $0.00 (BG Builders is on prepaid block hours — correct behavior)
|
|
- Line item: "Business Remote Service - Applied 0.5 Prepay Hours"
|
|
- Ticket status: Invoiced
|
|
|
|
**Issues encountered + resolutions:**
|
|
1. Duplicate comment posted — two "Resolution" comments at 15:09:02 and 15:09:11. DELETE endpoint (`/tickets/{id}/comments/{id}` and `/ticket_comments/{id}`) both return 404. **Must be deleted manually in Syncro GUI.**
|
|
2. Timer entry didn't show via `ticket_timers?ticket_id=` API query (returns all timers globally, not filtered by ticket). Screenshot from Winter confirmed it IS on the ticket.
|
|
3. Invoice created blank — `POST /invoices` does NOT auto-convert timer entries like the GUI. Deleted blank invoice #67430, recreated #67431, manually added line item via `POST /invoices/{id}/line_items`.
|
|
4. "Not Charged" + $0.00 is correct for block hours customers.
|
|
|
|
**Syncro API finding to document:** `POST /invoices` does not auto-pull timer entries. Must manually `POST /invoices/{id}/line_items` after creating invoice.
|
|
|
|
---
|
|
|
|
### OITVOIP / NetSapiens API Research
|
|
|
|
**Context:** OIT VOIP (Darwin Escaro) pointed to https://voipdocs.io/oitvoip-access-platform-apis. Goal: integrate with ClaudeTools + Syncro + build provisioning tool.
|
|
|
|
**Server:**
|
|
- Portal: https://pbx.packetdial.com
|
|
- API base: `https://pbx.packetdial.com/ns-api/v2`
|
|
- Version: 44.4.7 | Host: portal2-phx.ucaas.network
|
|
- Platform: NetSapiens SNAPsolution v44.4
|
|
|
|
**Docs:**
|
|
- https://docs.ns-api.com/ (login required for full detail)
|
|
- Live OpenAPI spec: `https://pbx.packetdial.com/ns-api/webroot/openapi/openapi.json`
|
|
- Live Swagger UI: `https://pbx.packetdial.com/ns-api/openapi`
|
|
- Dev sandbox: https://ns-api.com/
|
|
|
|
**Auth:**
|
|
- API Key (preferred M2M): `nsr_` prefix = reseller scope, `Authorization: Bearer nsr_<key>`
|
|
- OAuth 2.0: client_id + client_secret + portal creds → `POST /ns-api/oauth2/token`
|
|
- JWT: auto-returned from OAuth on v44+
|
|
|
|
**Credentials:** None created yet.
|
|
- Next: check pbx.packetdial.com portal for Admin > API Keys, OR reply to Darwin for OAuth client credentials
|
|
- Reseller name: unknown — confirm from portal
|
|
|
|
**Planned provisioning flow:**
|
|
1. `POST /domains` → create domain (auto-generates dial plan)
|
|
2. `POST /domains/{domain}/users` → users + extensions
|
|
3. `POST /domains/{domain}/devices` → SIP devices
|
|
4. `POST /domains/{domain}/users/{user}/phonenumbers` → DIDs
|
|
5. Log back to Syncro ticket
|
|
|
|
**Pending:**
|
|
- [ ] Log into pbx.packetdial.com → check for API Keys section
|
|
- [ ] If no self-service: reply to Darwin for reseller-scoped OAuth credentials
|
|
- [ ] Store in SOPS vault: `msp-tools/oitvoip.sops.yaml`
|
|
- [ ] Confirm reseller name
|
|
- [ ] Design provisioning tool spec + Syncro integration
|
|
|
|
---
|
|
|
|
## Key Infrastructure Reference
|
|
|
|
| Resource | Details |
|
|
|---|---|
|
|
| IX Web Hosting | 172.16.3.10 (ext: 72.194.62.5) WHM port 2087 |
|
|
| cPanel user | azcomputerguru |
|
|
| WP DB | azcomputerguru_acg2025, table prefix Lvkai5BQ_, mike/TempWP2026! |
|
|
| ClaudeTools API | http://172.16.3.30:8001 |
|
|
| GuruRMM server | 172.16.3.30:3001 |
|
|
| Gitea | http://172.16.3.20:3000 (internal) |
|
|
| ACG Tenant | ce61461e-81a0-4c84-bb4a-7b354a9a356d |
|