Only what's still open. Tick a box as you clear it — cleared work comes off the board, history lives in ti-context. Tap a marker below to focus one lane.
JWT_SECRET) currently covers both login sessions and QuickBooks token encryption, with an unsafe fallback if it's ever unset. Give QBO its own dedicated key..env is world-readablechmod 600 and move on.ALLOW IN Anywhere ufw rules. The agent on 10050 should only ever be reached by the Zabbix server; 10051 should only accept your actual monitored hosts. Same treatment as the MCP ports — allow the tailnet plus the hosts that genuinely need it, drop the rest.PREROUTING DNAT bypasses ufw's INPUT chain entirely, so a container published on 0.0.0.0 is internet-facing no matter what ufw says — port 5001 was wide open with no ufw rule at all, while 3010, 3011 and 8081 publish on 0.0.0.0 today with no allow rule either. The durable fix is to bind non-public services to 127.0.0.1: in their compose ports: and reach them over Tailscale, instead of adding more DOCKER-USER exceptions. Also verify twenty-server-1 on 3000, which carries a blanket allow.tcpdump on both NICs: SYNs for 81, 3010, 3011, 8443, 21118, 21119 never reach the VPS at all. That is why ports published on 0.0.0.0 with no ufw rule and no DOCKER-USER rule are still unreachable. Dashpane on 3010 — which holds live QuickBooks tokens and mounts the Docker socket — is protected today by a rule set neither of us has seen, one panel toggle from vanishing. Photograph both rule sets.proxy.totalinitiatives.com serves the Nginx Proxy Manager login over 443 (proxy_host 1 → 127.0.0.1:81) — 188 hits from one address plus assorted scanners. Closing port 81 does not touch this; it is a separate decision about whether that panel should be reachable from anywhere but the tailnet.ti-dashpane's backend/ at mode 644, in a repo that pushes to GitHub, with no .gitignore rule covering it. It was untracked so nothing leaked, but one git add -A would have published it. Fixed there (*-key.json, *credentials*.json, *.pem, *.bak-*) and the key is now bind-mounted read-only instead of copied into the image. The other repos have not been checked: ti-agent-core, action1-mcp, itflow-mcp-enhanced, zabbix-mcp, and whatever is on vps2. Same gap, same blast radius.sudo installer CLI install, no GUI wizard, runs as a background LaunchDaemon with no logged-in user or prompt required. That part's ready to go. Held on one open question before rolling it out: should DWG get its own Zabbix proxy, the way C&F already has one, or report straight to TI-VPS-01 like TI-FW does? Workstations, not critical infra, so a good low-stakes place to try the pattern once that's decided.10051, RustDesk 21115-21117, 80/443, 22. To the tailnet: 3333, 5001 — which retires the whole DOCKER-USER guard script and its fragile bridge-name pin. To loopback or deleted: 3000, 3010, 3011, 81, 8081, 1514, 1515, 10050, 21118, 21119. Verified against captured traffic, not assumed. Review page: The Three Firewalls.Create Company is step 1 and Twenty puts a unique index on the company domain. Enter a lead from a company already in the CRM and the run aborts at step 1 and creates nothing at all — no person, no opportunity, no error in front of you. For an MSP that is the common case, not the edge case: a second contact at an existing client. Fix is the same shape the n8n contact-form workflow already uses — FIND_RECORDS + FILTER to find-or-create instead of blind create.http:// across the public internet on every call — rotate it.12.76.103.114, TLS-PSK identity PSK_CFCPC202, reporting direct to TI-VPS-01 instead of through CFNMS01 like the rest of the site, and from a different site egress. Either Store 2 is meant to report direct, or that host was onboarded against the VPS by mistake — in which case others at Store 2 may be too.192.168.1.1 can't be attributed from the DC side. Cost us the scans copier hunt (08-22) and again the 08-27 LDAP-bind storm, where ~24 AD accounts were being walked and the source device stayed hidden. Fix: Sophos Configure → System services → Log settings → syslog to CFNMS01 (on-site, already the Zabbix proxy — no WAN hop, no tunnel dependency); rsyslog to /var/log/sophos/cffw001.log + logrotate; Zabbix agent logrt[] items using the same discipline as the eventlog template (regex filter, maxlines=5, short history — log items have no trends). Send Authentication / Admin / System categories only; full traffic logging will fill the disk.CF-AutoRegister only fires for registrations relayed via the CFNMS01 proxy. Any host migrated to direct reporting needs a matching rule, or it has to be created manually every time.Set-Content -Encoding UTF8 silently adds a BOM Zabbix Agent 2 can't parse) lives in the script used to onboard the rest of C&F's fleet. Will break the next host it's run against.tailscale ping succeeds instantly) but real ICMP/TCP straight to 100.64.0.5 times out — likely OPNsense not answering host-directed traffic on that interface by default. Doesn't block the real use case (LAN subnet access already works end-to-end), so low priority.ti-lap-03 itself off-site. Needs "Accept routes"/"Use subnet routes" on in the Windows Tailscale client.create_ticket silently drops its priority argument (same field-name bug as the ones fixed — held back because verifying it means creating a real ticket), and the "In Progress" status can't be set through the API even though 13 real tickets use it (one-line shim change). Also: 9 old API-created tickets carry lowercase medium that UI filters won't match.create_ticket).totalinitiatives.com SPF includes spf.protection.outlook.com and DKIM/DMARC align, so relayed mail to outside recipients doesn't land in spam.mail-relay:25 to actually send resets.workflow scope so the knowledge graph self-updatesgist, read:org, repo. Run gh auth refresh -s workflow and the graph Action can be pushed; until then GRAPH.md only refreshes when it is regenerated by hand. Only you can do this one.sameAs, plus hasMappipeline_deals and only mirrors outward to Twenty. Make it read live opportunities and write stage changes back, then retire the local table — migration is trivial, it holds one dead row.PROPOSAL → QuickBooks customer (estimate stays manual)QUOTE_PROPOSAL in Twenty now match-or-creates the QuickBooks customer and writes the QBO id back to Twenty as a note. The estimate stays manual by decision (2026-09-10) — line items vary too much per deal for a template to save a step. What is left here is nothing; kept on the board only until the Won trigger below is built, since that is the piece that closes the loop.Estimate. The payload carries only the entity id, so read the estimate back and check TxnStatus = Accepted, then set the Twenty opportunity to CUSTOMER, create the ITFlow client + contact, and store qbo_customer_id so invoicing works day one. Fallback is the CDC endpoint. Makes "won" an event you receive rather than one you remember to record.chat.totalinitiatives.com proxies to an open-webui container that does not exist, and build.totalinitiatives.com to dwg-app-designer, exited 7 weeks ago. Both answer anyone who visits. The most recent request to build was a bot fetching /.git/config. Either restore them or remove the proxy hosts and their DNS.501-291-3457 number so it agrees with the site and GBP, and a first post. Then add its URL to the site's JSON-LD sameAs.501-291-3457 on it so card, site and GBP all agree.calculate_asset_age produces a quarterly "these machines are due" pack per client. Needs no agent autonomy at all, and turns monitoring data you already collect into a repeatable sales conversation.get_software_drift(org, since) tool and nothing more. Small, safe, and genuinely useful for both security and licence surprises.Already tracked in ti-context, still true as of this pass — parked here so it's all in one place.
mail-relay smarthost; ITFlow/Zabbix/n8n/Twenty wired — see shipped items above). Remaining piece: Dashpane's forgot-password still logs the reset URL and sends nothing — now tracked as its own build-queue item to point it at the relay.ti-dashboard, git remote is still ti-dashpane, no change from beforeindex.html) uses the new design-token system in depth; Infrastructure/Clients/Financials/Admin have only light, likely shared-header-only, token usage