Search Results

1.1 Document Purpose This document (LH-SBS-INF-001) is the authoritative infrastructure specification for The Dash — SBS's Multi-Gated AI Orchestrator Platform, designed by Ledger Hub Networks exclusively for SBS. It defines the complete DigitalOcean hosting e...

2.1 DigitalOcean Account Structure The Platform operates under a single dedicated DigitalOcean account owned by SBS (the "SBS Account"). A dedicated account — rather than a shared or Ledger Hub-owned account — keeps billing, resource ownership, and access cont...

3.1 VPC Design Target: two dedicated VPC networks, one per environment, both in NYC2, no peering: VPC Environment Members prod-vpc-nyc2 Prod sbsdash-server-prod, monitor-servers, sbs-wiki (post NYC2 rebuild) dev-vpc-nyc2 Dev Dev-SBS-server As built: neither ...

4.1 Domain and Registrar sbsdash.com is the sole Platform domain. Registrar-level state is a security control surface in its own right (DNS-01): Ownership (target) — the domain is registered to SBS (org-level contact, SBS-controlled email alias — same survivab...

5.1 Edge Model Every public surface is fronted by an nginx reverse proxy terminating TLS on the droplet that serves it. No CDN or external proxy layer is in scope at this fleet size; origin concealment (TLS-04) is addressed in §5.6 within that constraint. Surf...

6.1 Compute Model The Platform runs on a small fixed droplet fleet with containerized workloads under Docker Compose — no Kubernetes, no managed PaaS. Rationale: the fleet is ≤5 hosts with a single-application production profile; Compose delivers the required ...

7.1 Data Layer Overview Three engines serve the Platform, each with a distinct role; nothing else is introduced without a Change Order: Engine Role Persistence class PostgreSQL System of record — Compartment relational data, platform configuration, decision me...

8.1 Current State and Scope As of 2026-07-18 no secrets manager is deployed. Credential state is the Chapter 2 CRITICAL nonconformance: plaintext passwords in the operational changelog, a shared fleet-wide root password, and service identities on non-SBS mailb...

9.1 Current State and Scope As of 2026-07-18 no IdP integration exists: Grafana and BookStack run on local admin accounts (both credentials exposed in the changelog — item 15 applies), the platform application is pre-deployment, and host access is the shared-k...

10.1 Current State and Scope As of 2026-07-18 no IaC exists: all resources to date (droplets, DNS records, ufw rules, Grafana/Prometheus configs) were created by console or shell, documented after the fact in SERVER_CHANGELOG.md. That changelog discipline is t...

11.1 Current State and Scope As-built supply-chain posture is minimal but deliberately clean so far: everything installed to date (Docker, Compose, Prometheus, nginx, certbot) came from Ubuntu official repos or the official Grafana apt repo — no curl-pipe-bash...

12.1 Current State and Scope Prometheus + Grafana 13.1.0 + nginx/TLS on  monitor-servers, serving monitor.sbsdash.com; node_exporter on all four droplets (prod/dev private-bind at 10.100.0.3/.2:9100, wiki public-bind with ufw scope — the §3.3 interim, monitor...

13.1 Purpose and Distinction from Operational Logging This chapter specifies the evidentiary tier: the tamper-evident, hash-chained audit record backing the Platform's compliance claims — every AI Agent decision tagged by Risk Tier, admissible for FCC and SOX ...

14.1 Current State and Scope As of 2026-07-18, tier 1 (DigitalOcean Backups) is enabled on the droplet fleet — the first backup layer in production. Tiers 2 and 3 remain unbuilt: no database dumps (no databases yet), no repo mirrors, no Vault snapshots (no Vau...

15.1 Philosophy and Scope Capacity planning at this fleet size is not autoscaling — it is knowing the numbers, naming the thresholds, and pre-writing the procedures so scaling is a scheduled maintenance action rather than an incident response. The Platform's l...

17.1 Current State and Scope As-built patching is unmanaged: no unattended-upgrades confirmation, no defined windows, no reboot policy, and one already-tracked drift instance (OS mix 24.04/26.04, item 21). This chapter defines the patch regime for every layer ...

Appendix A — Resource Inventory A.1 DigitalOcean Account & Projects Resource Identifier Notes DO Account SBS-owned (alias ownership pending, §2.1) MFA/team-audit pending item 15/17 chain Project: SBS The Dash Dev ac656e28-2196-410e-847c-bf3b60363710 Default pr...