claudetools/credentials.md

# Credentials & Authorization Reference

**Last Updated:** 2026-01-19
**Purpose:** Centralized credentials for Claude Code context recovery
**Project:** ClaudeTools MSP Work Tracking System

---

## Infrastructure - SSH Access

### GuruRMM Server (172.16.3.30)
- **Host:** 172.16.3.30
- **User:** guru
- **SSH Port:** 22
- **Role:** Production server hosting ClaudeTools database and API
- **Services:**
  - MariaDB 10.6.22 (Port 3306)
  - ClaudeTools API (Port 8001)
  - Nginx reverse proxy (Port 80/443)
- **Database:**
  - Database: claudetools
  - User: claudetools
  - Password: CT_e8fcd5a3952030a79ed6debae6c954ed
- **Notes:** Primary ClaudeTools infrastructure, systemd service auto-starts API

### Jupiter (Unraid Primary - 172.16.3.20)
- **Host:** 172.16.3.20
- **User:** root
- **SSH Port:** 22
- **Password:** Th1nk3r^99##
- **Role:** Primary container host, Gitea server
- **Services:**
  - Gitea (Port 3000, SSH 2222)
  - Docker containers
- **Notes:** Used for code repository management and version control

---

## Dataforth Infrastructure

### AD2 (Production Server - 192.168.0.6)
- **Host:** 192.168.0.6
- **Domain:** INTRANET
- **User:** INTRANET\sysadmin
- **Password:** Paper123!@#
- **OS:** Windows Server 2022
- **Local Path:** C:\Shares\test
- **Share Access:** \\192.168.0.6\C$ (admin share, requires credentials)
- **Role:** Production server for Dataforth DOS machines
- **Services:**
  - Active Directory Domain Controller
  - File Server (SMB3)
  - Scheduled sync task (Sync-FromNAS.ps1 every 15 min)
- **Network:** 192.168.0.0/24
- **Connection Method (PowerShell):**
  ```powershell
  $pass = ConvertTo-SecureString 'Paper123!@#' -AsPlainText -Force
  $cred = New-Object System.Management.Automation.PSCredential('INTRANET\sysadmin', $pass)
  New-PSDrive -Name Z -PSProvider FileSystem -Root '\\192.168.0.6\C$' -Credential $cred
  # Access: Z:\Shares\test\
  ```
- **Software Update Locations:**
  - Common (all machines): C:\Shares\test\COMMON\ProdSW\ and C:\Shares\test\_COMMON\ProdSW\
  - Station-specific: C:\Shares\test\TS-XX\ProdSW\
  - System files: C:\Shares\test\COMMON\DOS\
- **Notes:**
  - SMB1 disabled for security (after crypto attack)
  - Sync mechanism moved from NAS to AD2 due to WINS crashes
  - Files sync to NAS within 15 minutes after placement
  - DOS machines pull from NAS (not directly from AD2)

### D2TESTNAS (SMB1 Proxy - 192.168.0.9)
- **Host:** 192.168.0.9
- **HTTP:** http://192.168.0.9/
- **User (Web):** admin
- **Password (Web):** Paper123!@#-nas
- **SSH User:** root
- **SSH Auth:** ed25519 key (passwordless)
- **Role:** SMB1 proxy/bridge for DOS 6.22 machines
- **OS:** Linux (NAS appliance)
- **Share:** \\D2TESTNAS\test (maps to /data/test)
- **Services:**
  - SMB1 server (for DOS machine compatibility)
  - SSH server (Port 22)
- **Notes:**
  - Bridges DOS machines (SMB1) with AD2 (SMB3)
  - Previous sync location (moved to AD2)
  - Network path: /data/test/

### Dataforth DOS Machines (TS-XX)
- **Network:** 192.168.0.0/24
- **OS:** MS-DOS 6.22
- **Count:** ~30 machines for QC testing
- **Naming:** TS-01 through TS-30
- **Network Share:** T: drive (maps to \\D2TESTNAS\test)
- **Machine Variable:** %MACHINE% (set in AUTOEXEC.BAT)
- **Backup Location:** T:\%MACHINE%\BACKUP\
- **Update Path:** T:\COMMON\
- **Credentials:** None (local DOS machines)
- **Notes:**
  - SMB1 protocol required
  - DOS 6.22 limitations: no %COMPUTERNAME%, no IF /I
  - Network stack: MS Client 3.0, Netware VLM client
  - Update workflow: AD2 → D2TESTNAS → DOS machines

### AD2-NAS Sync System
- **Script:** C:\Shares\test\scripts\Sync-FromNAS.ps1
- **Runs:** Every 15 minutes (Windows Scheduled Task)
- **User:** INTRANET\sysadmin
- **Direction:** Bidirectional
- **Tools:** PuTTY (plink.exe, pscp.exe)
- **Log:** C:\Shares\test\scripts\sync-from-nas.log
- **Status:** C:\Shares\test\_SYNC_STATUS.txt (monitored by DattoRMM)
- **Last Verified:** 2026-01-19 12:09 PM (running successfully)
- **PULL (NAS → AD2):**
  - Test results: /data/test/TS-XX/LOGS/*.DAT → C:\Shares\test\TS-XX\LOGS\
  - Reports: /data/test/TS-XX/Reports/*.TXT → C:\Shares\test\TS-XX\Reports\
  - Files deleted from NAS after successful sync
  - DAT files imported to database automatically
- **PUSH (AD2 → NAS):**
  - Common updates: C:\Shares\test\COMMON\ProdSW\ → /data/test/COMMON/ProdSW/
  - Station updates: C:\Shares\test\TS-XX\ProdSW\ → /data/test/TS-XX/ProdSW/
  - Root utility: C:\Shares\test\UPDATE.BAT → /data/test/UPDATE.BAT
  - One-shot tasks: C:\Shares\test\TS-XX\TODO.BAT → /data/test/TS-XX/TODO.BAT
- **Notes:**
  - Moved from NAS to AD2 in January 2026
  - Reason: WINS crashes and SSH lockups on NAS
  - NAS script (/root/sync-to-ad2.sh) is DEPRECATED

---

## Services - Web Applications

### Gitea (Git Server)
- **URL:** https://git.azcomputerguru.com/
- **Web Port:** 3000
- **SSH:** ssh://git@172.16.3.20:2222
- **User:** mike@azcomputerguru.com
- **API Token:** (Generate via web UI as needed)
- **Repository:** azcomputerguru/ClaudeTools
- **Role:** Source code version control, project sync
- **Notes:** SSH key authentication required (ed25519)

### ClaudeTools API (Production)
- **URL:** http://172.16.3.30:8001
- **Docs:** http://172.16.3.30:8001/api/docs
- **Database:** 172.16.3.30:3306/claudetools
- **Auth:** JWT tokens (POST /api/auth/token)
- **Test User:**
  - Email: test@example.com
  - Password: testpassword123
- **Role:** Primary MSP work tracking API
- **Endpoints:** 95+ endpoints across 17 entities
- **Notes:** Systemd service, auto-starts on boot

---

## Projects - ClaudeTools

### Database (MariaDB)
- **Host:** 172.16.3.30
- **Port:** 3306
- **Database:** claudetools
- **User:** claudetools
- **Password:** CT_e8fcd5a3952030a79ed6debae6c954ed
- **Connection String:**
  ```
  mysql+pymysql://claudetools:CT_e8fcd5a3952030a79ed6debae6c954ed@172.16.3.30:3306/claudetools?charset=utf8mb4
  ```
- **Tables:** 38 tables (fully migrated)
- **Encryption:** AES-256-GCM for credentials table
- **Backup:** Daily automated backups

### API Authentication
- **Method:** JWT tokens
- **Password Hashing:** Argon2
- **Token Endpoint:** POST /api/auth/token
- **Token Format:** Bearer token in Authorization header
- **Example:**
  ```bash
  curl -X POST http://172.16.3.30:8001/api/auth/token \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "username=test@example.com&password=testpassword123"
  ```

### Encryption Keys
- **Method:** AES-256-GCM (Fernet)
- **Key Storage:** Environment variable ENCRYPTION_KEY
- **Usage:** Credentials table password encryption
- **Notes:** Never commit encryption key to git

---

## Projects - Dataforth DOS

### Update Workflow
- **Admin Deposits:** \\AD2\test\COMMON\ (on AD2)
- **Sync Mechanism:** AD2 scheduled task (location TBD)
- **DOS Pull:** T:\COMMON\ (from D2TESTNAS)
- **Backup Target:** T:\%MACHINE%\BACKUP\

### Key Files
- **UPDATE.BAT:** Machine backup utility (runs on DOS)
- **NWTOC.BAT:** Network to Computer updates
- **CTONW.BAT:** Computer to Network uploads
- **STAGE.BAT:** System file staging for reboot
- **REBOOT.BAT:** Auto-generated, applies staged updates
- **AUTOEXEC.BAT:** DOS startup, sets %MACHINE% variable
- **CONFIG.SYS:** DOS system configuration
- **STARTNET.BAT:** Network stack initialization

### Folder Structure
```
\\AD2\test\
├── COMMON\              # Shared updates for all machines
│   ├── DOS\            # System files (AUTOEXEC.NEW, CONFIG.NEW)
│   ├── ProdSW\         # Production software updates
│   └── NewSW\          # New software distributions
└── TS-XX\              # Individual machine folders
    └── Backup\         # Machine-specific backups
```

---

## Connection Testing

### Test Database Connection
```bash
mysql -h 172.16.3.30 -u claudetools -p claudetools
# Password: CT_e8fcd5a3952030a79ed6debae6c954ed
```

### Test API Connectivity
```bash
curl http://172.16.3.30:8001/api/health
```

### Test Gitea SSH
```bash
ssh -p 2222 git@172.16.3.20
# Should return: "Hi there! You've successfully authenticated..."
```

### Test AD2 Access (from Dataforth network)
```cmd
net use T: \\192.168.0.6\test /user:INTRANET\sysadmin Paper123!@#
```

### Test NAS Access (from Dataforth network)
```cmd
net use T: \\192.168.0.9\test
```

---

## Security Notes

- **Never commit this file to public repositories**
- **Credentials are stored unredacted for context recovery**
- **ClaudeTools encrypts credentials in database with AES-256-GCM**
- **JWT tokens expire after configured duration**
- **SSH keys required for Gitea access (ed25519)**
- **Dataforth network is isolated (192.168.0.0/24)**
- **AD2 has SMB1 disabled for security (post crypto-attack)**
- **All production credentials should be rotated regularly**

---

## Context Recovery Usage

When a new Claude session starts or context is lost:

1. **Read this file first** - Get all credentials and infrastructure details
2. **Check session-logs/** - Find recent work and decisions
3. **Read SESSION_STATE.md** - Get project status and phase
4. **Read .claude/claude.md** - Get project overview

This ensures full context recovery without asking user for information already documented.