Advanced Search
Search Results
123 total results found
Maintenance & Patching
Patch windows, upgrade procedure, rollback
Appendices
Resource inventory, firewall rule table, acronym table, references (NIST SP 800-207, OWASP ASVS L2)
Chapter 1 — Introduction & Scope
1.1 Document Purpose This document (LH-SBS-INF-001) is the authoritative infrastructure specification for The Dash — SBS's Multi-Gated AI Orchestrator Platform, designed by Ledger Hub Networks exclusively for SBS. It defines the complete DigitalOcean hosting e...
Chapter 2 — Infrastructure Overview
2.1 DigitalOcean Account Structure The Platform operates under a single dedicated DigitalOcean account owned by SBS (the "SBS Account"). A dedicated account — rather than a shared or Ledger Hub-owned account — keeps billing, resource ownership, and access cont...
Chapter 3 — Network Architecture
3.1 VPC Design Target: two dedicated VPC networks, one per environment, both in NYC2, no peering: VPC Environment Members prod-vpc-nyc2 Prod sbsdash-server-prod, monitor-servers, sbs-wiki (post NYC2 rebuild) dev-vpc-nyc2 Dev Dev-SBS-server As built: neither ...
Chapter 4 — DNS & Domain Architecture
4.1 Domain and Registrar sbsdash.com is the sole Platform domain. Registrar-level state is a security control surface in its own right (DNS-01): Ownership (target) — the domain is registered to SBS (org-level contact, SBS-controlled email alias — same survivab...
Chapter 5 — TLS & Edge Security
5.1 Edge Model Every public surface is fronted by an nginx reverse proxy terminating TLS on the droplet that serves it. No CDN or external proxy layer is in scope at this fleet size; origin concealment (TLS-04) is addressed in §5.6 within that constraint. Surf...
Chapter 6 — Compute & Application Layer
6.1 Compute Model The Platform runs on a small fixed droplet fleet with containerized workloads under Docker Compose — no Kubernetes, no managed PaaS. Rationale: the fleet is ≤5 hosts with a single-application production profile; Compose delivers the required ...
Chapter 7 — Storage & Data Layer
7.1 Data Layer Overview Three engines serve the Platform, each with a distinct role; nothing else is introduced without a Change Order: Engine Role Persistence class PostgreSQL System of record — Compartment relational data, platform configuration, decision me...
Chapter 8 — Secrets Management
8.1 Current State and Scope As of 2026-07-18 no secrets manager is deployed. Credential state is the Chapter 2 CRITICAL nonconformance: plaintext passwords in the operational changelog, a shared fleet-wide root password, and service identities on non-SBS mailb...
Chapter 9 — Identity & Access
9.1 Current State and Scope As of 2026-07-18 no IdP integration exists: Grafana and BookStack run on local admin accounts (both credentials exposed in the changelog — item 15 applies), the platform application is pre-deployment, and host access is the shared-k...
Chapter 10 — Infrastructure as Code
10.1 Current State and Scope As of 2026-07-18 no IaC exists: all resources to date (droplets, DNS records, ufw rules, Grafana/Prometheus configs) were created by console or shell, documented after the fact in SERVER_CHANGELOG.md. That changelog discipline is t...
Chapter 11 — Supply-Chain Controls
11.1 Current State and Scope As-built supply-chain posture is minimal but deliberately clean so far: everything installed to date (Docker, Compose, Prometheus, nginx, certbot) came from Ubuntu official repos or the official Grafana apt repo — no curl-pipe-bash...
Chapter 12 — Observability
12.1 Current State and Scope Prometheus + Grafana 13.1.0 + nginx/TLS on monitor-servers, serving monitor.sbsdash.com; node_exporter on all four droplets (prod/dev private-bind at 10.100.0.3/.2:9100, wiki public-bind with ufw scope — the §3.3 interim, monitor...
Chapter 13 — Audit Infrastructure
13.1 Purpose and Distinction from Operational Logging This chapter specifies the evidentiary tier: the tamper-evident, hash-chained audit record backing the Platform's compliance claims — every AI Agent decision tagged by Risk Tier, admissible for FCC and SOX ...
Chapter 14 — Backup & Disaster Recovery
14.1 Current State and Scope As of 2026-07-18, tier 1 (DigitalOcean Backups) is enabled on the droplet fleet — the first backup layer in production. Tiers 2 and 3 remain unbuilt: no database dumps (no databases yet), no repo mirrors, no Vault snapshots (no Vau...
Chapter 15 — Capacity & Scaling
15.1 Philosophy and Scope Capacity planning at this fleet size is not autoscaling — it is knowing the numbers, naming the thresholds, and pre-writing the procedures so scaling is a scheduled maintenance action rather than an incident response. The Platform's l...
Chapter 17 — Maintenance & Patching
17.1 Current State and Scope As-built patching is unmanaged: no unattended-upgrades confirmation, no defined windows, no reboot policy, and one already-tracked drift instance (OS mix 24.04/26.04, item 21). This chapter defines the patch regime for every layer ...