Loopcard

All documents · Operations

Operations — this VPS

Host: vmi3003269
IPv4: 173.249.19.205
Date: 18 September 2026

1. Public surface (operator policy)

All HTTP/WebSocket behind nginx 80/443. SSH may stay open. Do not open extra public ports. Apps listen on 127.0.0.1.

TURN/STUN 3478 and LiveKit RTC UDP ranges are for the old CryptoBook video product. A holding page does not need them. Do not delete firewall rules in this document’s scope without a separate ops change.

2. What is live for cryptobook.space

Piece Location
nginx site /etc/nginx/sites-available/cryptobook.conf (enabled)
Certificate /etc/letsencrypt/live/cryptobook.space/
Frontend /var/www/cryptobook
Backend /root/cryptobook/backend, PM2 name cryptobook, port 3000
LiveKit 127.0.0.1:7880 proxied at /rtc, /twirp

Do not add location ~ /\. { deny all } without excluding /.well-known/acme-challenge/. A 301-to-HTTPS on all of port 80 also breaks HTTP-01 unless ACME is excluded. certbot renew on this host applies a multi-minute random sleep; use --no-random-sleep-on-renew for interactive renewals.

3. DNS

Name Points to Action
cryptobook.space 173.249.19.205 This VPS
www.cryptobook.space 173.249.19.205 This VPS
cryptobook.com 217.160.223.94 Not us. IONOS Apache. Do not add to nginx until A/AAAA change

4. Incomplete Slip prototype

/root/cryptobook-next/app/ — do not PM2 start as production. Postgres role slip and database slip were created during the paused build. .env contains secrets; do not commit. If abandoning Slip permanently: drop DB slip in a later ops ticket, stop nothing on :3000 until nginx no longer needs it.

5. Cutover recipe (only after GO or holding-page decision)

  1. Backup cryptobook.conf.
  2. Deploy static or app on 127.0.0.1:3100.
  3. nginx -t && reload.
  4. curl -sS https://cryptobook.space/healthz or /.
  5. Confirm ACME path still 200 for a test file.
  6. Only then stop PM2 cryptobook cluster.

UFW: do not change in this pivot unless the operator opens a separate hardening ticket (SSH keys, fail2ban, bind/CUPS). Past audit explicitly avoided locking out root-password sessions.

6. Health