Ω Infrastructure Audit

graphlab.info VPS · 2026-07-05 · Sibylle (deepseek-v4-pro)
READ-ONLY 2026-07-05 Hermes v0.18.0
01 Architecture Summary 02 Port Map 03 Service Map 04 Reverse Proxy Routing 05 Problems & Risks 06 Recommended Target Architecture 07 Cleanup Plan 08 Current Architecture Diagram 09 Recommended Architecture Diagram

01 · Architecture Summary

Stack: Cloudflare Tunnel → Caddy (TLS) → VONDER (Python HTTP proxy on :10276) → 30+ backends on localhost. DNS: graphlab.info → 177.7.52.251. Tailscale mesh for private access.

Ingress channels:

ChannelEndpointScope
Cloudflare Tunnelgraphlab.info :443Public HTTPS
Tailscale100.67.155.37Private mesh
Direct SSH:22, :4422Public (fail2ban protected)
Cloudflare WARPwarp-svcZero Trust client
Tor:9050SOCKS5 proxy
System Services
60
Listening Ports
45
VONDER Routes
26
Docker Containers
4
Hermes Profiles
12
Skills
112
Disk Used
81%
Memory Free
166 MB

02 · Port Map

PortBindProcessPurpose
220.0.0.0sshdSSH primary
44220.0.0.0sshdSSH secondary
25127.0.0.1postfixSMTP (local only)
80,443*caddyHTTP/HTTPS
4450.0.0.0smbd⚠ Samba
6310.0.0.0cupsd⚠ CUPS
2019127.0.0.1caddyCaddy admin API
3001127.0.0.1node (kuma)Uptime Kuma
3210127.0.0.1nodeHermes Dashboard WS
39780.0.0.0hermesTeams messaging
8642127.0.0.1hermes (mirror)Mirror gateway API
86430.0.0.0hermes (omega)Omega gateway
86440.0.0.0hermes (mirror)Mirror gateway
8765127.0.0.1python3Signs365 Pricing
87770.0.0.0pythonWeatherBet Dashboard
8787127.0.0.1pythonHermes WebUI
8795127.0.0.1uvicornSentinel Backend
8888127.0.0.1docker-proxySearXNG
9050127.0.0.1torTor SOCKS5
91190.0.0.0hermesDashboard (exposed)
9300127.0.0.1python3Trading Dashboard
10272127.0.0.1nodeHermes Control (HCI)
10273127.0.0.1docker-proxyVaultwarden
10276127.0.0.1python3VONDER API
10278127.0.0.1python3Vectorizer V3
10281127.0.0.1python3Print Broker
10282127.0.0.1python3Aether Engine
10284127.0.0.1nodeUA Dashboard
10285127.0.0.1ttydWeb Terminal
10286100.67.155.37filebrowser⚠ Tailscale only
10289127.0.0.1uvicornTIB3
10290127.0.0.1vibe-tradingVibe Trading API
10291127.0.0.1uvicornTIB4
10292127.0.0.1python3Zak Quote
10293127.0.0.1python3Aether CLI
10294127.0.0.1python3Options Finder
10295127.0.0.1python3Options Tracker
10296127.0.0.1pythonMind Atlas
102970.0.0.0pythonAI Investment Firm
10299127.0.0.1python3Sibylle VP Webhook
10300127.0.0.1uvicornArgus Scanner

03 · Service Map

ServicePortTypeStatus
caddy80,443EdgeActive
vonder-api10276ProxyActive
aether10282TradingActive
aether-cli10293TradingActive
weatherbot—TradingActive
weatherbet-api8777TradingActive
tib310289TradingActive
tib410291TradingActive
vibe-trading10290TradingActive
options-finder10294TradingActive
options-tracker10295TradingActive
argus10300TradingActive
ai-investment-firm10297TradingActive
dashboard9300TradingActive
sentinel-backend8795IntelActive
vectorizer-v310278ToolActive
print-broker-quote10281BusinessActive
zak-quote10292BusinessActive
signs365-pricing8765BusinessActive
hermes-control10272HermesActive
hermes-dashboard9119HermesActive
hermes-webui8787HermesActive
hermes-mod—HermesActive
ua-dashboard10284ToolActive
ttyd10285ToolActive
filebrowser10286ToolTailscale only
sibylle-vp-webhook10299ToolActive

Docker Containers

ContainerImagePortStatus
searxngsearxng/searxng:latest127.0.0.1:8888→8080Up 4w
uptime-kumalouislam/uptime-kuma:1host networkUp 4w healthy
vaultwardenvaultwarden/server:latest127.0.0.1:10273→80Up 4w healthy
discovery-dashboard-api-1discovery-dashboard-api—Up 4w healthy

Hermes Cron Jobs (Omega Profile)

IDNameScheduleLast RunStatus
3b48f1ee54e4GBrain Daily Digest1:00 AM dailyJul 5 01:04ok
ec1c08faae7fWeekly ReviewSun 6 PMJul 5 18:06ok
8b2e2a8360e2Topic News Digest8:00 AM dailyJul 5 08:03ok
c48eee3706a5Daily Paper Trading6:00 AM dailyJul 5 06:01ok
24ab38f15a6bMorning Selfie6:00 AM dailyJul 5 06:01ok
af58486841b0Vault Brain Pipeline2:00 AM dailyJul 5 02:01ok
14feb8a1dd33Mind Atlas Insights3:00 AM dailyJul 5 03:00error
c51ffcd037a9Mind Atlas Auto-Feed2:30 AM dailyJul 5 02:30error
5d820b47ae24Vault Content IngestHourlyJul 5 23:00ok
685a615b7d50Argus OHLC Snapshot4:30 PM weekdaysJul 3 16:30ok
c1fb956bc718Morning Brief Pipeline9:00 AM weekdaysJul 3 10:26ok

System Crontab

ScheduleJob
0 1 * * *GBrain Dream (gbrain-dream-wrapper.sh)
0 9 * * 0GBrain Doctor (weekly)
0 * * * *Hermes Sentinel hourly check
5 1 * * *Hermes Veritas
*/5 * * * *DuckDNS update
0 4 * * *Restic backup
30 16 * * 1-5Argus OHLC snapshot
0 9 * * 1-5Argus brief
0 10 * * 1-5Argus resolve

04 · Reverse Proxy Routing

Caddy (Edge TLS)

DomainTargetNotes
graphlab.info→ :10276 (VONDER)Primary, all VONDER routes below
graphlab.info/terminal/*→ :10285 (ttyd)Web terminal
graphlab.info/signworks/*→ static /root/signworks.htmlStatic page
graphlab.info/argus/*→ :10300 (Argus)Scanner API
graphlab.info/files/*403 ForbiddenBlocked by Caddy
vault.graphlab.info→ :10273 (Vaultwarden)DNS: ❌ no A record

VONDER Proxy Routes (partial — full matrix)

Path PrefixTargetBackendHealth
/socket.io, /dashboard, /api/badge/*, etc.:3001Uptime Kuma✓
/weatherbet/api/*:8777WeatherBet✓
/files:10286File Browser✗ Tailscale-only bind
/sentinel/*:8795Sentinel✓
/mind-atlas/*:10296Mind Atlas✓
/vaultstaticVault Brain✓ static
/webhooks:8644Mirror Gateway✓
/api/plugins/*, /api/*:9119Hermes Dashboard✓
/vectorize, /static/, /output/*:10278Vectorizer V3✓
/vibe:10290Vibe Trading✓
/firm:10297AI Investment Firm✓
/uptime:3001Uptime Kuma✓
/quote:10281Print Broker✓
/zak:10292Zak Quote✓
/signs365:8765Signs365✓
/webui:8787Hermes WebUI✓
/options2:10294Options Finder✓
/brief/accuracy:10295Options Tracker✓
/trading-dash:9300Trading Dashboard✓
/trading:10282Aether✓
/cli:10293Aether CLI✓
/dashboard:9119Hermes Dashboard✓
/tib3:10289TIB3✓
/tib4:10291TIB4✓
/understand:10284UA Dashboard✓
/hci/*:10272HCI✓
/sibylle/vp-webhook:10299VP Webhook✓

05 · Problems & Risks

🔴 Critical — No Firewall

UFW is not active. This VPS has no firewall. Ports 22, 4422, 445, 631, 3978, 8643, 8644, 8777, 9119, and 10297 are all bound to 0.0.0.0 with no iptables protection. fail2ban is running for SSH but that's it.

🔴 Critical — Secrets in systemd Environment=

vibe-trading.service (lines 14-15) and weatherbot.service (lines 11-12) have API keys, proxy credentials, and private keys hardcoded in Environment= directives. These are visible to anyone with systemctl cat or /proc/PID/environ access.

🔴 Critical — Cloudflared Token in ExecStart

The Cloudflare tunnel JWT is visible in systemctl cat cloudflared as a command-line argument. Should be in an environment file.

🟡 High — Memory Critically Low

166 MB free, 681 MB available of 7.8 GB. 7.1 GB in use. The box is running at the edge. Six MCP server processes (3x mem0, 3x weatherbot) consuming ~175 MB each. A memory spike from any service could trigger OOM kills.

🟡 High — Disk at 81%

78 GB used of 96 GB. Journal is 1 GB. Docker build cache is 2.74 GB reclaimable. 14 Docker volumes, only 3 active (28 MB reclaimable). GBrain models, research vault, and multiple venvs are the likely space hogs.

🟡 High — Duplicate MCP Server Processes

Three pairs of mem0 + weatherbot MCP servers are running (6 processes total). PIDs: 1380463/69 (Jul 4), 1549230/34 (Jul 5), 1961912/16 (Jul 5). This is classic dashboard+gateway duplication — each restart spawns new MCP children without killing old ones. Causes Chroma SQLite lock contention and wastes ~500 MB RAM.

🟡 High — Two Broken Cron Scripts

mind-atlas-insights.sh and mind-atlas-auto-feed.py are referenced by cron jobs (14feb8a1dd33 and c51ffcd037a9) but the script files don't exist at the expected paths. These have been failing since at least Jul 3.

🟡 High — Samba + CUPS on 0.0.0.0

Samba (:445) and CUPS (:631) are bound to 0.0.0.0 on a headless VPS with no firewall. Neither service has any business being on a public server. CUPS is from a snap package (snap.cups.cupsd).

🟡 High — Hermes 169 Commits Behind

Hermes Agent v0.18.0 (2026.7.1) is 169 commits behind upstream. Bug fixes, new features, and security patches are missing.

🟡 Medium — FileBrowser Dead Route via VONDER

VONDER proxies /files to 127.0.0.1:10286, but FileBrowser is only bound to 100.67.155.37:10286 (Tailscale IP). Requests through VONDER will fail — the service works on Tailscale directly but not through the public proxy. Caddy also blocks /files with 403 anyway.

🟡 Medium — Argus OHLC Snapshot Duplicated

Both the system crontab (30 16 * * 1-5) and a Hermes cron job (685a615b7d50) run the Argus snapshot at 4:30 PM weekdays. Redundant execution.

🟡 Medium — Session DB Zeroed

/root/.hermes/profiles/omega/sessions.db is 0 bytes — last modified June 25. Session history is not being persisted. session_search may return incomplete results.

🟡 Medium — Scout Catalyst Stale

/opt/argus/data/scout-catalyst.json last updated July 3 at 08:35. Two days stale. Catalyst data feeds into the morning brief scoring.

🟢 Low — Trading Pipeline Artifacts Missing (Sunday)

All 7 artifact checks returned MISSING today. This is expected for Sunday — no trading day, no brief, no scan, no resolutions. The morning brief cron (c1fb956bc718) last ran Friday Jul 3 (ok). Verify on Monday.

🟢 Low — Docker Build Cache 2.74 GB

Reclaimable with docker builder prune. Low risk, easy win for disk space.

🟢 Low — Journal 1 GB

Vacuum with journalctl --vacuum-size=500M. Standard hygiene.

06 · Recommended Target Architecture

Key changes from current state:

  1. Enable UFW — allow 22, 4422, 80, 443, Tailscale range. Default deny.
  2. Move secrets to env files — vibe-trading.service, weatherbot.service, cloudflared.service → EnvironmentFile=
  3. Remove Samba + CUPS — apt purge samba cups or at minimum bind to 127.0.0.1
  4. Kill duplicate MCP processes — keep only the gateway-spawned instances
  5. Fix or remove broken cron scripts — mind-atlas-insights.sh, mind-atlas-auto-feed.py
  6. Reclaim disk — docker builder prune (~2.7 GB), journal vacuum (~500 MB), target <70%
  7. Update Hermes — hermes update for 169 commits of fixes
  8. Fix FileBrowser bind — add 127.0.0.1 listener or remove VONDER proxy route
  9. Deduplicate Argus snapshot — remove one of the two 4:30 PM triggers
  10. Restrict Dashboard :9119 — bind to Tailscale IP or 127.0.0.1, not 0.0.0.0
  11. DNS for vault.graphlab.info — add A record or remove Caddy block

07 · Step-by-Step Cleanup Plan

Phase 1 — Security (30 min)

  1. Enable UFW: allow 22, 4422, 80, 443 from any; allow Tailscale range; default deny incoming
  2. Move secrets from systemd Environment= to /etc/hermes/secrets.env (chmod 600)
  3. Move Cloudflared token to env file
  4. Remove Samba: systemctl disable --now smbd; apt purge samba
  5. Remove CUPS snap: snap remove cups
  6. Bind Dashboard (:9119) to 127.0.0.1 or Tailscale IP

Phase 2 — Memory (15 min)

  1. Kill stale MCP processes: keep the newest pair (PIDs 1961912/16), kill 1380463/69 and 1549230/34
  2. Restart only the omega gateway to get a clean MCP state
  3. Verify: ps aux | grep mcp_server | wc -l should be 2 or 4 (not 6)

Phase 3 — Disk (10 min)

  1. docker builder prune -af — reclaims ~2.74 GB
  2. journalctl --vacuum-size=500M — reclaims ~500 MB
  3. Remove unused Docker volumes: docker volume prune
  4. Target: 81% → ~75% used

Phase 4 — Fix Broken Things (20 min)

  1. Fix or remove mind-atlas-insights.sh and mind-atlas-auto-feed.py cron jobs
  2. Fix FileBrowser: add 127.0.0.1 bind or remove VONDER /files proxy route
  3. Deduplicate Argus snapshot (remove system crontab entry — keep Hermes cron)
  4. Investigate session DB (0 bytes since Jun 25)

Phase 5 — Update (10 min)

  1. hermes update — catch up 169 commits
  2. Verify gateway restart is clean
  3. Check cron jobs still fire after update

Phase 6 — Verify (15 min)

  1. curl -I https://graphlab.info/ → 200
  2. curl -I https://graphlab.info/trading/ → 200 (Aether)
  3. curl -I https://graphlab.info/dashboard/ → 200 (Hermes Dash)
  4. Run morning brief cron manually to verify pipeline
  5. Check UFW status: ufw status verbose
  6. Verify MCP processes: 2 pairs max

08 · Current Architecture Diagram

graph TD
    INTERNET((INTERNET)) --> CF[Cloudflare Tunnel]
    INTERNET --> TAIL[Tailscale Mesh]
    INTERNET --> SSH[SSH :22/:4422]
    CF --> CADDY[Caddy :80/:443]
    CADDY --> VONDER[VONDER :10276]
    CADDY --> TERM[ttyd :10285]
    CADDY --> ARGUS[Argus :10300]
    CADDY --> VW[Vaultwarden :10273]
    TAIL --> FB[FileBrowser :10286]
    TAIL --> ALL[All localhost services]
    VONDER --> KUMA[Uptime Kuma :3001]
    VONDER --> AETHER[Aether :10282]
    VONDER --> AETHERCLI[Aether CLI :10293]
    VONDER --> TIB3[TIB3 :10289]
    VONDER --> TIB4[TIB4 :10291]
    VONDER --> VIBE[Vibe Trading :10290]
    VONDER --> OPTS[Options Finder :10294]
    VONDER --> TRACK[Options Tracker :10295]
    VONDER --> DASH[Trading Dash :9300]
    VONDER --> SENTINEL[Sentinel :8795]
    VONDER --> MATLAS[Mind Atlas :10296]
    VONDER --> VEC[Vectorizer V3 :10278]
    VONDER --> PRINT[Print Broker :10281]
    VONDER --> ZAK[Zak Quote :10292]
    VONDER --> S365[Signs365 :8765]
    VONDER --> FIRM[AI Invest Firm :10297]
    VONDER --> WB[WeatherBet :8777]
    VONDER --> HCI[HCI :10272]
    VONDER --> HDASH[Hermes Dash :9119]
    VONDER --> HWEBUI[Hermes WebUI :8787]
    VONDER --> UA[UA Dashboard :10284]
    VONDER --> MIRROR[Mirror GW :8644]
    VONDER --> VPWEB[VP Webhook :10299]
    DOCKER[Docker] --> SEARX[SearXNG :8888]
    DOCKER --> KUMA2[Uptime Kuma]
    DOCKER --> VW2[Vaultwarden]
    DOCKER --> DISC[Discovery Dashboard]
    OMEGAGW[Omega Gateway :8643] --> MCP1[mem0 MCP x3⚠️]
    OMEGAGW --> MCP2[weatherbot MCP x3⚠️]
    MIRGW[Mirror Gateway :8644] --> MCP3[mem0 MCP]
    style AETHER fill:#0d1525,stroke:#2ecc71
    style KUMA fill:#0d1525,stroke:#3b6cf4
    style VONDER fill:#0d1525,stroke:#d4af37
    style MCP1 fill:#0d1525,stroke:#e74c3c
    style MCP2 fill:#0d1525,stroke:#e74c3c

09 · Recommended Architecture Diagram

graph TD
    INTERNET((INTERNET)) --> CF[Cloudflare Tunnel]
    INTERNET --> TAIL[Private Tailscale Mesh]
    CF --> CADDY[Caddy :80/:443]
    CADDY --> VONDER[VONDER :10276]
    TAIL --> HCI[HCI :10272]
    TAIL --> HDASH[Hermes Dash :9119]
    VONDER --> SERVICES[30+ Backend Services]
    SERVICES --> AETHER[Aether :10282]
    SERVICES --> TIB3[TIB3 :10289]
    SERVICES --> TIB4[TIB4 :10291]
    SERVICES --> VIBE[Vibe Trading :10290]
    SERVICES --> DASH[Trading Dash :9300]
    SERVICES --> OPTS[Options :10294/95]
    SERVICES --> ARGUS[Argus :10300]
    SERVICES --> PRINT[Print/Zak :10281/92]
    SERVICES --> S365[Signs365 :8765]
    SERVICES --> SENTINEL[Sentinel :8795]
    SERVICES --> VEC[Vectorizer V3 :10278]
    SERVICES --> MATLAS[Mind Atlas :10296]
    SERVICES --> FIRM[AI Invest Firm :10297]
    SERVICES --> UA[UA Dashboard :10284]
    SERVICES --> WEBUI[Hermes WebUI :8787]
    OMEGAGW[Omega Gateway :8643] --> MCP[MCP Servers x1 pair✅]
    MIRGW[Mirror Gateway :8644] --> MCPM[Mirror MCP]
    DOCKER[Docker] --> SEARX[SearXNG]
    DOCKER --> KUMA[Uptime Kuma]
    DOCKER --> VW[Vaultwarden]
    FIREWALL[UFW Enabled] -.-> INTERNET
    style FIREWALL fill:#0d1525,stroke:#2ecc71
    style AETHER fill:#0d1525,stroke:#2ecc71
    style MCP fill:#0d1525,stroke:#2ecc71

Appendix · System Info

PropertyValue
Hostnamesrv1632845
Public IP177.7.52.251
Tailscale IP100.67.155.37
OSUbuntu (Linux 6.8.0-124-generic)
Uptime30 days
Load0.98 / 0.58 / 0.35
Disk78 GB / 96 GB (81%)
Memory7.1 GB / 7.8 GB (166 MB free)
Hermesv0.18.0 · 169 commits behind
Profiles12 (omega, trader, mirror, scout, coder, scribe, sentinel, curator, librarian, reviewer, architect, prompter)
Skills112
Modeldeepseek-v4-pro @ api.deepseek.com/v1
GatewayOmega :8643 (0.0.0.0), Mirror :8644 (0.0.0.0)

DNS Records

DomainRecordStatus
graphlab.infoA → 177.7.52.251✓
vault.graphlab.info— no record —✗ Missing

Tailscale Nodes

NodeIPOSStatus
srv1632845 (VPS)100.67.155.37linuxactive
iphone172100.95.151.47iOSactive
kyles-macbook-air100.101.43.38macOSoffline 28d
kyles-macbook-pro100.124.7.102macOSidle, tx 600 rx 440

Ω Audit 2026-07-05 · Generated by Sibylle (deepseek-v4-pro) · graphlab.info/audit-2026-07-05.html