Mike Swanson
d8f05cb443
Seeded via /wiki-compile (parallel sub-agents): - clients: gonzvar-tax-services, tohono-oodham-doit (Syncro 33069069), tucson-golden-corral (Syncro 3859123) - projects: gururmm-agent (artifact-based, agent/ @ origin/main), msp-tools (umbrella) Index rows added for all five. Deduped the duplicate system:neptune compile-queue entry (merged the cert/DkimSigner note into one). Left as-is (intentional, not duplicates/dead): wiki/projects/guru-rmm.md is a redirect tombstone; the patterns/tailscale-client-enroll.ps1 index link is valid (the .ps1 script exists).
86 lines
5.9 KiB
Markdown
86 lines
5.9 KiB
Markdown
---
|
|
type: client
|
|
name: tohono-oodham-doit
|
|
display_name: Tohono O'odham Nation - Department of Information & Technology (DoIT)
|
|
last_compiled: 2026-06-12
|
|
compiled_by: GURU-5070/claude-main
|
|
sources:
|
|
- clients/tohono-oodham-doit/session-logs/2026-05-27-session.md
|
|
- syncro:33069069
|
|
backlinks:
|
|
- clients/sif-oidak
|
|
---
|
|
|
|
# Tohono O'odham Nation - Department of Information & Technology (DoIT)
|
|
|
|
## Profile
|
|
- **Contract type:** Break-fix with recurring Starlink service reseller billing (monthly internet + per-incident labor)
|
|
- **Key contacts:**
|
|
- Shannon Ramon — shannon.ramon@tonation-nsn.gov, 520-471-3072 (primary)
|
|
- Brandon Capeheart (I&T System Administrator) — brandon.capeheart@tonation-nsn.gov, 520-993-5779
|
|
- Marcus Ramon (I&T Network Manager) — marcus.ramon@tonation-nsn.gov, 520-240-0844
|
|
- Trina Rodriguez (DoIT) — trina.rodriguez@tonation-nsn.gov, 520-383-0270 / 520-349-4297
|
|
- Yvonne Enriguez (DoIT Office Manager) — Yvonne.Enriquez@tonation-nsn.gov, 520-383-0270
|
|
- Tianna Aguilla (Accounts Payable) — tianna.aguilla@tonation-nsn.gov, (520) 648-4130 ext 4108
|
|
- Denise Darrell (Accounts Payable, Dept of IT) — denise.darrell@tonnation-nsn.gov, 520-383-6600
|
|
- **Billing rate:** $175/hr (onsite labor)
|
|
- **Hours remaining (if prepaid):** N/A — no prepaid block
|
|
- **Active ticket:** Syncro #32328 (Waiting on Customer)
|
|
- **Syncro customer ID:** 33069069
|
|
- **Address:** 25310 South Toltec Buttes Road, Eloy, AZ 85131; mailing: PO Box 837, Sells, AZ 85634; DoIT Annex: 307 Vamori Street, Tucson, AZ 85756
|
|
|
|
## Infrastructure
|
|
|
|
### Servers & Services
|
|
| Host | IP | Role | OS | Notes |
|
|
|---|---|---|---|---|
|
|
|
|
No Syncro-managed assets on record. No RMM agents deployed as of 2026-06-12.
|
|
|
|
### Email & Identity
|
|
- **M365 tenant:** (verify)
|
|
- **MX / mail flow:** (verify) — staff use @tonation-nsn.gov addresses
|
|
- **MFA status:** (verify)
|
|
|
|
### Network
|
|
- **ISP / WAN (field sites x2):** Starlink Roam Unlimited (mobile); configured in bypass mode — Check Point 1550 WAN interface holds the ISP-assigned IP directly. Starlink Roam issues CGNAT 100.64.x.x addresses, so each field site has no public routable WAN IP.
|
|
- **ISP / WAN (main office):** Non-Starlink; public static IP(s). ISP and gateway hardware unconfirmed.
|
|
- **Firewall (field):** Check Point 1550 (Gaia Embedded) — 2 units, one per field site
|
|
- **Firewall (main office):** (verify — make/model unconfirmed; assumed Check Point based on field fleet)
|
|
- **VPN:** Pending design decision; two options under evaluation:
|
|
- **Option A — Native IPsec hub-and-spoke:** Field 1550s initiate outbound IPsec to office public IP using existing hardware; no overlay required. Cleanest path if main office gateway is also Check Point.
|
|
- **Option B — Tailscale overlay:** Subnet-router node deployed behind the office firewall; small Tailscale-capable node (GL.iNet Beryl AX, Flint 2, pfSense, or OPNsense) at each field site. Traverses CGNAT via NAT-traversal and DERP relay on port 443.
|
|
|
|
## Access
|
|
- No remote access credentials or vault paths on file for this client.
|
|
- Vault path: (verify — create at `clients/tohono-oodham-doit/` if credentials are issued)
|
|
- Syncro: https://computerguru.syncromsp.com/customers/33069069
|
|
|
|
## Patterns & Known Issues
|
|
|
|
- **CGNAT field WAN:** All field sites are behind Starlink Roam Unlimited in bypass mode. Bypass mode removes Starlink's own NAT but Starlink Roam still assigns a CGNAT 100.64.x.x address to the 1550 WAN port — not a public IP. Any site-to-site VPN or remote management initiated from the field must be outbound-only; the main office hub must be the reachable endpoint. On-site verification: each field 1550's WAN IP should show 100.64.x.x. If a real public IP appears, a Starlink public-IP add-on may be active, which changes the VPN calculus.
|
|
- **Check Point 1550 (Gaia Embedded) is a closed appliance:** Third-party overlay software (Tailscale, ZeroTier) is not supported and cannot be installed on the 1550 itself. An Option B Tailscale deployment requires a separate device alongside the 1550 at each field site.
|
|
- **Multiple Tohono O'odham accounts in Syncro:** DoIT (33069069), Legislative Branch (35323240), Farming Authority (33405788), Sif-oidak District (7694718) are separate Syncro customer records for the same tribal nation. Confirm account before opening tickets.
|
|
- **Starlink reseller billing:** ComputerGuru bills DoIT for recurring Starlink internet service (~$397-421/month for 2 lines). Labor is billed break-fix at $175/hr as separate line items.
|
|
|
|
## Active Work
|
|
|
|
*As of 2026-06-12 — Syncro shows 1 open ticket:*
|
|
|
|
| Ticket | Subject | Status | Opened |
|
|
|---|---|---|---|
|
|
| #32328 (ID: 111209848) | Request for Starlink Static IP options | Waiting on Customer | 2026-05-27 |
|
|
|
|
Ticket #32328: Presented two site-to-site VPN design options (native Check Point IPsec hub-and-spoke vs. Tailscale overlay) for CGNAT field-to-office connectivity. Recommended skipping a Starlink static IP upgrade — the reachable main office hub makes it unnecessary for either option. Awaiting DoIT internal IT decision on VPN entrypoint and main office gateway make/model confirmation.
|
|
|
|
## History Highlights
|
|
|
|
- **2025-01:** Onsite Starlink installation (invoice #64532, 1 hr labor, $175)
|
|
- **2025-11-18:** Onsite event Starlink rental and setup for November event in Sells, AZ (invoice #66431, $362.50 — rental + 1hr setup + 0.5hr trip fee)
|
|
- **2025-11-25:** Sold and installed 2x Starlink Mini Mobile Roam kits (receiver, car adapter, roof mount) at field sites; monthly Starlink service billing initiated (invoice #66494, $915.94 hardware; recurring ~$397-421/month since)
|
|
- **2026-05-27:** VPN design consultation for CGNAT field-to-office connectivity — researched Starlink static IP availability (not available on Roam) and CGNAT traversal options; created Ticket #32328, posted customer-visible two-option recommendation; ticket set to Waiting on Customer
|
|
|
|
## Backlinks
|
|
|
|
- [Sif-oidak District - Tohono O'odham Nation](sif-oidak.md) — related Syncro account for the same tribal nation (Sif-oidak District, ID 7694718)
|