Seeded via /wiki-compile (parallel sub-agents):
- clients: gonzvar-tax-services, tohono-oodham-doit (Syncro 33069069),
tucson-golden-corral (Syncro 3859123)
- projects: gururmm-agent (artifact-based, agent/ @ origin/main), msp-tools (umbrella)
Index rows added for all five. Deduped the duplicate system:neptune compile-queue
entry (merged the cert/DkimSigner note into one).
Left as-is (intentional, not duplicates/dead): wiki/projects/guru-rmm.md is a
redirect tombstone; the patterns/tailscale-client-enroll.ps1 index link is valid
(the .ps1 script exists).
Hours remaining (if prepaid): N/A — no prepaid block
Active ticket: Syncro #32328 (Waiting on Customer)
Syncro customer ID: 33069069
Address: 25310 South Toltec Buttes Road, Eloy, AZ 85131; mailing: PO Box 837, Sells, AZ 85634; DoIT Annex: 307 Vamori Street, Tucson, AZ 85756
Infrastructure
Servers & Services
Host
IP
Role
OS
Notes
No Syncro-managed assets on record. No RMM agents deployed as of 2026-06-12.
Email & Identity
M365 tenant: (verify)
MX / mail flow: (verify) — staff use @tonation-nsn.gov addresses
MFA status: (verify)
Network
ISP / WAN (field sites x2): Starlink Roam Unlimited (mobile); configured in bypass mode — Check Point 1550 WAN interface holds the ISP-assigned IP directly. Starlink Roam issues CGNAT 100.64.x.x addresses, so each field site has no public routable WAN IP.
ISP / WAN (main office): Non-Starlink; public static IP(s). ISP and gateway hardware unconfirmed.
Firewall (field): Check Point 1550 (Gaia Embedded) — 2 units, one per field site
Firewall (main office): (verify — make/model unconfirmed; assumed Check Point based on field fleet)
VPN: Pending design decision; two options under evaluation:
Option A — Native IPsec hub-and-spoke: Field 1550s initiate outbound IPsec to office public IP using existing hardware; no overlay required. Cleanest path if main office gateway is also Check Point.
Option B — Tailscale overlay: Subnet-router node deployed behind the office firewall; small Tailscale-capable node (GL.iNet Beryl AX, Flint 2, pfSense, or OPNsense) at each field site. Traverses CGNAT via NAT-traversal and DERP relay on port 443.
Access
No remote access credentials or vault paths on file for this client.
Vault path: (verify — create at clients/tohono-oodham-doit/ if credentials are issued)
CGNAT field WAN: All field sites are behind Starlink Roam Unlimited in bypass mode. Bypass mode removes Starlink's own NAT but Starlink Roam still assigns a CGNAT 100.64.x.x address to the 1550 WAN port — not a public IP. Any site-to-site VPN or remote management initiated from the field must be outbound-only; the main office hub must be the reachable endpoint. On-site verification: each field 1550's WAN IP should show 100.64.x.x. If a real public IP appears, a Starlink public-IP add-on may be active, which changes the VPN calculus.
Check Point 1550 (Gaia Embedded) is a closed appliance: Third-party overlay software (Tailscale, ZeroTier) is not supported and cannot be installed on the 1550 itself. An Option B Tailscale deployment requires a separate device alongside the 1550 at each field site.
Multiple Tohono O'odham accounts in Syncro: DoIT (33069069), Legislative Branch (35323240), Farming Authority (33405788), Sif-oidak District (7694718) are separate Syncro customer records for the same tribal nation. Confirm account before opening tickets.
Starlink reseller billing: ComputerGuru bills DoIT for recurring Starlink internet service (~$397-421/month for 2 lines). Labor is billed break-fix at $175/hr as separate line items.
Active Work
As of 2026-06-12 — Syncro shows 1 open ticket:
Ticket
Subject
Status
Opened
#32328 (ID: 111209848)
Request for Starlink Static IP options
Waiting on Customer
2026-05-27
Ticket #32328: Presented two site-to-site VPN design options (native Check Point IPsec hub-and-spoke vs. Tailscale overlay) for CGNAT field-to-office connectivity. Recommended skipping a Starlink static IP upgrade — the reachable main office hub makes it unnecessary for either option. Awaiting DoIT internal IT decision on VPN entrypoint and main office gateway make/model confirmation.
2025-11-18: Onsite event Starlink rental and setup for November event in Sells, AZ (invoice #66431, $362.50 — rental + 1hr setup + 0.5hr trip fee)
2025-11-25: Sold and installed 2x Starlink Mini Mobile Roam kits (receiver, car adapter, roof mount) at field sites; monthly Starlink service billing initiated (invoice #66494, $915.94 hardware; recurring ~$397-421/month since)
2026-05-27: VPN design consultation for CGNAT field-to-office connectivity — researched Starlink static IP availability (not available on Roam) and CGNAT traversal options; created Ticket #32328, posted customer-visible two-option recommendation; ticket set to Waiting on Customer
Mike Swanson
70c496bb30