Production server audit — current state for the vhost redesign
Production server audit — current state for the vhost redesign
Young, 2026-10-18: prod is being redesigned as the services lane. This is the measured baseline before Sol starts the Docker tenancy build.
1. What's running on prod RIGHT NOW
| Service | Port | State | Purpose |
|---|---|---|---|
| nginx | 80/443 | ✅ active | reverse proxy + TLS termination |
| solos-docs.service (Nuxt/Nitro) | 127.0.0.1:8091 | ✅ active | docs.youngle.au (behind basic-auth) |
| pulse-site.service (Nuxt/Nitro) | 127.0.0.1:8092 | ✅ active | pulse.youngle.au (public) |
| v3-heart-prod.service (Python worker) | — | ✅ active (4 days) | SolOS V3 Heart worker |
| opencode-web.service | — | ✅ active | solos.youngle.au (OpenCode web) |
| Docker daemon | — | ✅ installed (v29.7.2) | for tenants (not yet used) |
| tailscaled | — | ❌ inactive, not enabled | already decommissioned |
2. Decommission list (Young's ask)
| Item | State | Action |
|---|---|---|
| sol.service (opencode web, :4090) | ❌ already inactive | remove the nginx vhost + unit file |
| tailscaled | ❌ already inactive, not enabled | remove the binary + config (optional cleanup) |
Both are already off. No action needed — just clean up the leftover config files.
3. What needs to MOVE (docs-site + pulse-site → vhost youngle)
| Service | Current | Target | Notes |
|---|---|---|---|
| docs-site | 127.0.0.1:8091 (direct nginx proxy) | vhost youngle, port 8091 (container or host) | Move nginx proxy to youngle tenant network |
| pulse-site | 127.0.0.1:8092 (direct nginx proxy) | vhost youngle, port 8092 | Move nginx proxy to youngle tenant network |
| yukonit site | 127.0.0.1:8012 (nginx proxy) | vhost yukonit, port 8012 | Already proxied, just needs containerisation |
4. Capacity for the new load
| Resource | Available | Used by existing | Remaining for tenants |
|---|---|---|---|
| RAM | 21 GB | ~2 GB (docs+pulse+heart+opencode) | ~19 GB |
| Disk | 179 GB free | ~14 GB | ~165 GB |
| CPU | 4 cores | ~0.1 core | ~3.9 cores |
Per-tenant ceiling: 3.0 CPU / 5.1 GiB. 4 tenants fit with headroom.
5. What's NOT on prod (gaps)
| Missing | Needed for | Owner |
|---|---|---|
| Medusa (any version) | Commerce tenants | Sol/Ace |
| EVE (any version) | AI receptionist | Sol/Ace |
| Authelia | Security layer (L1 gate) | Sol/Ace |
| nginx tenant-network config | vhost routing | Sol |
| Per-tenant Docker compose | Tenant isolation | Sol/Tam |
6. Cost implications (my lane)
| Item | Cost | Notes |
|---|---|---|
| Docker daemon | $0 (already installed) | — |
| Per-tenant containers | $0 (uses existing node resources) | RAM/CPU from existing budget |
| Authelia | $0 (Apache-2.0, ~50 MB RAM) | — |
| nginx | $0 (already running) | — |
| Total new infra cost | ~$0–15/mo | Only if Oracle PAYG kicks in (Young's check) |
The only cost risk is the Oracle allowance (4 OCPU/24 GB vs 2/12 free). At 4 tenants (~19 GB RAM), we're firmly in billable territory unless trial credits cover it.
7. What I did NOT do
- I did not touch any prod service or config.
- I did not install or remove anything on prod.
- I did not modify nginx, systemd, or Docker.
- This is a report, not an action.
Production implementation stages
Resend notification provider — the shipped email channel
Card: t_1419d598 (build task 3 of 8 from t_c9b50255). Method: live probes on prod (161.33.71.67, aarch64) against the pinned @medusajs/medusa 2.21.2, including a boot of the actual production image. Isolated scratch DB (resend_e2e_2026 on the pg-temp container). No tenant DB was written to.