# Infrastructure Review - Quick Reference

**Date**: December 27, 2025  
**Full Review**: See `COMPREHENSIVE_INFRASTRUCTURE_REVIEW.md`

---

## 🚨 Critical Issues (Fix First)

### 1. Cloudflare Tunnel Configuration
**Tunnel**: `rpc-http-pub.d-bis.org` (ID: `10ab22da-8ea3-4e2e-a896-27ece2211a05`)  
**Status**: ⚠️ DOWN  
**Issue**: Routing directly to RPC nodes instead of central Nginx

**Fix**: Update Cloudflare dashboard to route HTTP endpoints to:
- `http://192.168.11.21:80` (Central Nginx on VMID 105)

**Affected Endpoints**:
- `explorer.d-bis.org`
- `rpc-http-pub.d-bis.org`
- `rpc-http-prv.d-bis.org`
- `dbis-admin.d-bis.org`
- `dbis-api.d-bis.org`
- `dbis-api-2.d-bis.org`
- `mim4u.org`
- `www.mim4u.org`

### 2. Missing DNS CNAME Records

Create CNAME records for:
- `rpc-http-pub.d-bis.org` → `<tunnel-id>.cfargotunnel.com`
- `rpc-ws-pub.d-bis.org` → `<tunnel-id>.cfargotunnel.com`
- `rpc-http-prv.d-bis.org` → `<tunnel-id>.cfargotunnel.com`
- `rpc-ws-prv.d-bis.org` → `<tunnel-id>.cfargotunnel.com`
- `dbis-admin.d-bis.org` → `<tunnel-id>.cfargotunnel.com`
- `dbis-api.d-bis.org` → `<tunnel-id>.cfargotunnel.com`
- `dbis-api-2.d-bis.org` → `<tunnel-id>.cfargotunnel.com`
- `mim4u.org` → `<tunnel-id>.cfargotunnel.com`
- `www.mim4u.org` → `<tunnel-id>.cfargotunnel.com`

**All should have**: Proxy enabled (orange cloud)

### 3. Duplicate DNS A Records

Remove duplicates:
- `besu.d-bis.org`: Remove one IP (keep single)
- `blockscout.d-bis.org`: Remove one IP
- `explorer.d-bis.org`: Remove one IP
- `d-bis.org`: Remove `20.215.32.42` (keep `20.215.32.15`)

---

## 📊 Infrastructure Summary

### Proxmox Hosts

| Host | IP | Purpose | Key Services |
|------|----|---------|--------------|
| **pve2** | 192.168.11.12 | Primary compute | Cloudflared (102), Nginx Proxy (105), Blockscout (5000) |
| **ml110** | 192.168.11.10 | Secondary compute | RPC nodes (2500-2502), DBIS Core (10100-10151) |

### Active VMIDs

**On pve2 (192.168.11.12)**:
- 100: Mail gateway (192.168.11.4)
- 101: Datacenter manager (192.168.11.6)
- 102: Cloudflared (192.168.11.9) ⭐
- 103: Omada (192.168.11.20)
- 104: Gitea (192.168.11.18)
- 105: Nginx Proxy Manager (192.168.11.21) ⭐
- 130: Monitoring (192.168.11.22)
- 5000: Blockscout (192.168.11.140) ⭐
- 6200: Firefly (192.168.11.7)
- 7800-7802: Sankofa services
- 7810-7811: Miracles In Motion

**On ml110 (192.168.11.10)**:
- 2500: Besu RPC-1 (192.168.11.250) ⭐
- 2501: Besu RPC-2 (192.168.11.251) ⭐
- 2502: Besu RPC-3 (192.168.11.252) ⭐
- 10100: DBIS PostgreSQL Primary (192.168.11.100)
- 10101: DBIS PostgreSQL Replica (192.168.11.101)
- 10120: DBIS Redis (192.168.11.120)
- 10130: DBIS Frontend (192.168.11.130) ⭐
- 10150: DBIS API Primary (192.168.11.150) ⭐
- 10151: DBIS API Secondary (192.168.11.151) ⭐

⭐ = Public-facing service

---

## 🔧 Current Configuration Status

### ✅ Working Correctly

- Central Nginx (VMID 105) configured and running
- All services running on their respective hosts
- WebSocket endpoints routing directly (as intended)
- www.mim4u.org redirect configured

### ⚠️ Needs Fixing

- Tunnel routing HTTP endpoints directly (should go through central Nginx)
- Missing DNS CNAME records
- Duplicate DNS A records
- Tunnel status showing DOWN (needs dashboard configuration)

---

## 🎯 Quick Action Checklist

### Step 1: Update Cloudflare Tunnel (5 minutes)
1. Go to: https://one.dash.cloudflare.com/
2. Zero Trust → Networks → Tunnels
3. Select: `rpc-http-pub.d-bis.org`
4. Configure → Public Hostnames
5. Update HTTP endpoints to: `http://192.168.11.21:80`
6. Keep WebSocket endpoints as-is (direct to RPC nodes)

### Step 2: Create DNS Records (10 minutes)
1. Cloudflare Dashboard → DNS → Records
2. Create CNAME records for all missing endpoints
3. Point to: `<tunnel-id>.cfargotunnel.com`
4. Enable proxy (orange cloud)

### Step 3: Clean Up DNS (5 minutes)
1. Remove duplicate A records
2. Keep single authoritative IP per domain

### Step 4: Test (5 minutes)
1. Test all HTTP endpoints
2. Test WebSocket endpoints
3. Verify redirects work

**Total Time**: ~25 minutes

---

## 📝 Key Architecture Decisions

1. **Central Nginx**: All HTTP traffic routes through VMID 105
2. **Direct WebSocket**: WebSocket traffic routes directly to RPC nodes
3. **Tunnel-based DNS**: All public services should use CNAME to tunnel
4. **Multi-host**: Services distributed across pve2 and ml110

---

**See**: `COMPREHENSIVE_INFRASTRUCTURE_REVIEW.md` for full details

