5e5c8cb698
- UFW configurado en 4/4 servidores con whitelist TZZR
- SSH hardening (PermitRootLogin prohibit-password, PasswordAuthentication no)
- SWAP 2GB en todos los servidores
- Backups automatizados documentados en ARCHITECT
- IPs bloqueadas documentadas en CORP
🤖 Generated with Claude Code
170 lines
4.3 KiB
Markdown
170 lines
4.3 KiB
Markdown
# Servidor ARCHITECT (69.62.126.110)
|
|
|
|
## Overview
|
|
|
|
ARCHITECT es el servidor central del sistema TZZR. Coordina todos los servicios, gestiona la base de datos centralizada, y aloja Gitea para control de versiones.
|
|
|
|
**IP**: 69.62.126.110
|
|
**Usuario**: architect
|
|
**Acceso SSH**: ssh root@69.62.126.110 -i ~/.ssh/tzzr
|
|
|
|
## Servicios Principales
|
|
|
|
### 1. Gitea (Puerto 3000)
|
|
- **URL Local**: http://localhost:3000
|
|
- **URL Remota**: https://git.tzzrarchitect.me
|
|
- **Función**: Repositorio central de código
|
|
- **Configuración**: /etc/gitea/
|
|
- **Data**: /var/lib/gitea/
|
|
|
|
Repositorios principales:
|
|
- `admin/infrastructure-docs` - Documentación de infraestructura
|
|
- `captain-claude` - Sistema multiagente central
|
|
|
|
### 2. PostgreSQL
|
|
- **Host**: localhost
|
|
- **Puerto**: 5432
|
|
- **Rol Principal**: architect
|
|
- **Base de datos**: tzzr_db
|
|
|
|
Bases de datos:
|
|
- `tzzr_db` - Base de datos principal del sistema
|
|
- Backups en: `s3://architect/backups/`
|
|
|
|
### 3. Context Manager
|
|
- **Ubicación**: /home/architect/captain-claude/context-manager/
|
|
- **Función**: Gestión de contexto para agentes IA
|
|
- **Tecnología**: Python + PostgreSQL
|
|
- **Configuración**: src/database.py
|
|
|
|
## Directorios Importantes
|
|
|
|
```
|
|
/home/architect/
|
|
├── captain-claude/ # Sistema multiagente principal
|
|
│ ├── context-manager/ # Gestor de contexto
|
|
│ └── agents/ # Agentes IA
|
|
├── .ssh/ # Claves SSH
|
|
├── .gitea-token # Token de autenticación Gitea
|
|
└── .git-credentials # Credenciales de Git
|
|
```
|
|
|
|
## Backup y Recuperación
|
|
|
|
### Backup Gitea
|
|
```bash
|
|
gitea dump -o /tmp/gitea-backup-$(date +%Y%m%d).zip
|
|
aws s3 cp /tmp/gitea-backup-*.zip s3://architect/backups/ \
|
|
--endpoint-url https://7dedae6030f5554d99d37e98a5232996.r2.cloudflarestorage.com
|
|
```
|
|
|
|
### Backup PostgreSQL
|
|
```bash
|
|
pg_dump -U architect tzzr_db > /tmp/tzzr_db.sql
|
|
aws s3 cp /tmp/tzzr_db.sql s3://architect/backups/ \
|
|
--endpoint-url https://7dedae6030f5554d99d37e98a5232996.r2.cloudflarestorage.com
|
|
```
|
|
|
|
## Conexiones a Servidores Remotos
|
|
|
|
ARCHITECT se conecta a:
|
|
- **DECK**: ssh root@72.62.1.113 -i ~/.ssh/tzzr
|
|
- **CORP**: ssh root@92.112.181.188 -i ~/.ssh/tzzr
|
|
- **HST**: ssh root@72.62.2.84 -i ~/.ssh/tzzr
|
|
|
|
## Almacenamiento R2
|
|
|
|
### Credenciales R2
|
|
- Endpoint: https://7dedae6030f5554d99d37e98a5232996.r2.cloudflarestorage.com
|
|
- Access Key: Almacenada en ~/.aws/credentials
|
|
|
|
### Buckets
|
|
- **architect**: Almacenamiento principal
|
|
- `documentos adjuntos/` - Documentos para usuarios
|
|
- `system/` - Archivos internos
|
|
- `backups/` - Backups del sistema
|
|
- `auditorias/` - Logs de auditoría
|
|
|
|
## Monitoreo y Logs
|
|
|
|
```bash
|
|
# Estado de servicios
|
|
systemctl status gitea
|
|
systemctl status postgresql
|
|
|
|
# Logs Gitea
|
|
tail -f /var/log/gitea/gitea.log
|
|
|
|
# Logs PostgreSQL
|
|
tail -f /var/log/postgresql/postgresql-*.log
|
|
|
|
# Logs del sistema
|
|
journalctl -xe
|
|
```
|
|
|
|
## Tareas Administrativas
|
|
|
|
### Crear Repositorio en Gitea
|
|
```bash
|
|
TOKEN=$(cat ~/.gitea-token)
|
|
curl -X POST "http://localhost:3000/api/v1/user/repos" \
|
|
-H "Authorization: token $TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"name": "repo-name", "description": "Description", "private": false, "auto_init": true}'
|
|
```
|
|
|
|
### Conectar a PostgreSQL
|
|
```bash
|
|
psql -U architect -d tzzr_db
|
|
```
|
|
|
|
## Seguridad
|
|
|
|
### Firewall (UFW)
|
|
```
|
|
Status: active
|
|
Default: deny incoming, allow outgoing
|
|
|
|
Reglas:
|
|
- ALLOW from 72.62.1.113 (DECK)
|
|
- ALLOW from 92.112.181.188 (CORP)
|
|
- ALLOW from 72.62.2.84 (HST)
|
|
- ALLOW 22/tcp (SSH)
|
|
- ALLOW 80/tcp (HTTP)
|
|
- ALLOW 443/tcp (HTTPS)
|
|
- ALLOW 3000/tcp (Gitea)
|
|
- ALLOW 8082, 8090, 8100/tcp (Apps)
|
|
- ALLOW on docker0 (Docker)
|
|
- ALLOW 5432 from 172.18.0.0/16 (PostgreSQL Docker)
|
|
```
|
|
|
|
### SSH Hardening
|
|
```
|
|
PermitRootLogin prohibit-password
|
|
PasswordAuthentication no
|
|
```
|
|
Backup config: `/etc/ssh/sshd_config.bak`
|
|
|
|
### SWAP
|
|
```
|
|
/swapfile 2GB (persistente en /etc/fstab)
|
|
```
|
|
|
|
## Backups Automatizados
|
|
|
|
### Gitea
|
|
- **Script**: `/opt/tzzr/claude-code/backup_gitea.sh`
|
|
- **Cron**: `0 2 * * *` (diario 2AM)
|
|
- **Destino**: `s3://architect/backups/gitea/`
|
|
|
|
### PostgreSQL
|
|
- **Script**: `/home/architect/scripts/backup_postgres_all.sh`
|
|
- **Cron**: `0 3 * * *` (diario 3AM)
|
|
- **Destino**: `s3://architect/backups/postgresql/`
|
|
|
|
## Últimas Actualizaciones
|
|
|
|
- 2025-12-30: UFW habilitado, SSH hardening, SWAP 2GB, Docker permissions
|
|
- 2025-12-30: Documentación inicial
|
|
- 2025-12-18: Instalación inicial de ARCHITECT
|