p24-infra — Information Summary Audit
Date: 2026-07-02
Auditor: Claude Code (claude-sonnet-4-6) + Radek Konarski
Scope: Full codebase structure review for CLAUDE.md accuracy and completeness
Method: Multi-agent codebase exploration + targeted file reads across all subsystems
1. Repository Identity
| Property | Value |
|---|---|
| GitHub | radieu/p24-infra (private) |
| Primary branch | main |
| Active branch at audit | docs/2514-rotation-log-confirm |
| Working dir | C:\code_2026\p24-infra |
| CLAUDE_ENV_LAST_CHANGED | 2026-05-16T12:00:00Z |
2. Subsystem Inventory
2.1 Monitoring stack (monitoring/)
Single Docker Compose file (monitoring/docker-compose.yml, 23.3 KB) running the full observability stack on vps-i1.
Core services:
| Service | Image | Purpose |
|---|---|---|
| prometheus | prom/prometheus:v3.12.0 | Metrics DB, 15d local retention, 2h TSDB block |
| thanos-sidecar | quay.io/thanos/thanos:v0.41.0 | Remote-write to Wasabi S3 |
| thanos-compactor | same | Long-term compaction (90d raw, 180d 5m, 365d 1h) |
| thanos-query | same | Federated query layer |
| grafana | latest | Dashboards + alerting |
| alertmanager | latest | Alert routing (Discord + SMTP) |
| cadvisor | latest | Container metrics |
| blackbox-exporter | latest | HTTP/TCP probes |
| loki | latest | Log aggregation |
| promtail | latest | Log collection (local + remote config) |
| caddy | latest | HTTPS reverse proxy |
| 11 custom exporters | Python/FastAPI | See §2.2 |
Standby stack: monitoring/docker-compose.standby.yml (HA switchover)
Alert rules: monitoring/prometheus/rules/ — queues, pdf-service, reports, security, synthetic, credentials, servers-disk, supabase-sessions
Grafana dashboards provisioned: audit-engine, container-logs, containers, report-scheduler, synthetic, vercel-deployments, supabase-slow-queries, github-actions, audit-costs, backup-health, nightly-jobs, p24-health, versions, nexcon-sim
2.2 Custom Prometheus exporters (monitoring/exporters/)
11 standalone Python FastAPI services, each independently Dockerized:
| Exporter | Port | Metrics source |
|---|---|---|
| backup-exporter | 9220 | Wasabi S3 backup status files |
| cost-exporter | — | Infrastructure cost tracking |
| credential-exporter | — | API key health / expiry |
| mezmo-exporter | — | Log aggregation volume metrics |
| n8n-bms4-exporter | — | n8n queue depth + execution counts (bms-4) |
| n8n-cloud-exporter | — | n8n Cloud metrics |
| nexcon-exporter | — | Nexcon GPS system |
| pg-stats-exporter | — | PostgreSQL statistics |
| queue-exporter | — | p24 job queue depth |
| vercel-exporter | — | Vercel deployment status |
| monitoring-watchdog | — | CF Worker (stack health) |
Each follows the pattern: app.py + Dockerfile (Python 3.12) + requirements.txt + tests/.
2.3 infra-src/ microservices (16 total)
| Service | Runtime | Deployed | Purpose |
|---|---|---|---|
meta-dispatcher | CF Worker / TypeScript | Cloudflare | Job queue dispatch (polls Supabase, triggers GH Actions) |
p24-auth-worker | CF Worker / TypeScript | Cloudflare | Supabase JWT auth proxy |
traccar-gw | CF Worker / TypeScript | Cloudflare | GPS event → Supabase |
wasabi-iam-rotator | Node.js / Vercel | Vercel | S3 IAM credential rotation |
audit-engine | FastAPI / Python 3.12 | Not deployed | Compliance audit automation |
report-scheduler | Python 3.13 cron | vps-i1 | Automated PDF report generation |
waha-router | Node.js (Hono) | bms-4 | WhatsApp message routing (WAHA decommissioned 2026-07-02) |
monitoring-watchdog | CF Worker | Cloudflare | Stack health monitor |
p24-infra-mcp | Python 3.12 | vps-i1 | MCP server for Claude tool calls |
github-agent | — | — | GitHub integration agent |
claude-proxy | — | Removed 2026-06-24 | Claude API router (bms-4) |
telegram-claude-bot | — | — | Telegram bot integration |
n8n-workflows | JSON | bms-4 | n8n workflow definitions |
n8n-workflows-export | — | — | Workflow backup/restore |
gotenberg | Docker Compose | vps-i1 | PDF rendering service |
p24-infra-mcp | Python 3.12 | vps-i1 | Claude MCP server |
2.4 audit-engine/ (FastAPI, not deployed)
Python 3.12 FastAPI service for compliance auditing. Functional but not in production Docker Compose.
Key modules: main.py (FastAPI app + APScheduler), ai.py (Claude integration), db.py (Supabase), scheduler.py, vault.py, guardrails.py, patch_supabase.py (sb_secret JWT workaround), actions/, connectors/, render/.
Important: Uses patch_supabase.py to work around supabase-py 2.x rejecting sb_secret_* JWT format.
2.5 portal/ (Next.js 14)
Lightweight infra dashboard deployed to Vercel. Next.js 14.2.35, React 18, Supabase auth helpers, SWR, Tailwind CSS.
Scripts: npm run dev, npm run build, npm run type-check (tsc —noEmit).
2.6 ansible/ (VPS provisioning)
14 roles, 4 forks, pipelining enabled. Requires ansible-core>=2.16 + community.general 8.x.
Key playbooks: site.yml, vps-i1.yml, vps-h1.yml, bms-4.yml, provision-new-vps.yml, ssh-authorized-keys.yml.
Key roles: common, docker, node-exporter, promtail-syslog, claude-runner, claude-env-sync, audit-daemon, github-runner, bms4-workers.
2.7 scripts/ (79 operational scripts)
Mix of Python (sync, no framework) and shell. Key categories:
- Queue:
queue_dispatcher.py,queue-push.ps1,queue-watch.ps1 - Backups:
backup-common.sh,backup-ionos.sh,backup-hstgr.sh,mongodb-backup.sh - Remediation:
scripts/remediation/(prune-disk, reload-prometheus, restart-container, test-sops-canary) - Credential:
rotate-ssh-key.ps1,refresh-claude-token.py,wasabi-cli.py - Monitoring:
alertmanager-escalation.py,openai-monitor.py,p24-status.py - Agent:
agent-session-start.py,agent-session-end.py,claude-agent-runner.sh
2.8 CI/CD — GitHub Actions (57 workflows)
Categories confirmed:
| Category | Count | Key workflows |
|---|---|---|
| Deployment | 5 | deploy-monitoring-config.yml, portal-deploy.yml, deploy-meta-dispatcher.yml |
| Secrets | 5 | secrets-sync.yml, credential-rotation.yml, rotate-schedule.yml |
| Monitoring | 5 | health-check.yml, sops-drift-check.yml, prometheus-alerts-ai-triage.yml |
| Maintenance | 8 | db-maintenance.yml, supabase-backup.yml, n8n-backup.yml, grafana-backup.yml |
| Testing | 5 | python-tests.yml, pdf-integration-tests.yml, image-scan.yml, trivy-scan.yml |
| Infrastructure | 10 | ansible-drift.yml, provision-new-vps.yml, apply-supabase-migrations.yml |
| n8n | 3 | n8n-maintenance.yml, n8n-workflow-snapshot.yml |
| Compliance | 3 | compliance-audit-due-check.yml, cloudflare-security-check.yml |
| Sync | 5 | secrets-sync.yml, sync-claude-skills.yml, sops-sync-receiver.yml |
| Scheduled | 3 | openai-monitor.yml, nightly-devops-triage.yml |
| Utility | 5 | docs-deploy.yml, reusable templates |
Self-hosted runners: ionos (vps-i1), bms4 (bms-4). GitHub-hosted used for secret-safe operations.
3. Secrets Infrastructure
3.1 SOPS+age configuration (.sops.yaml)
6 recipients across 2 rule sets:
| Key | Machine | Notes |
|---|---|---|
| Developer age key | C:\Users\konar\.age\p24-infra-keys.txt | All files |
AGE_KEY_GHA | GitHub Actions CI | All non-admin files |
| vps-i1 claude-runner | /home/claude-runner/.age/p24-infra-keys.txt | All non-admin files |
| bms-4 claude-runner | /home/claude-runner/.age/p24-infra-keys.txt | All non-admin files |
| dev-laptop (Berlin) | /home/radieu/.age/p24-infra-keys.txt | All non-admin files |
| vps-h1 claude-runner | /root/.age/vps-h1.key | All non-admin files, added 2026-07-02 |
secrets/administration.env.sops — developer key only, never distributed by CI.
3.2 Distribution chain
SOPS commit → PR → merge to main → secrets-sync.yml auto-triggers → decrypts per-server → SSH-copies .env → container restart.
Vercel env vars for et-operational-platform and brandpilot are also updated by secrets-sync.yml.
3.3 Key files with MAILGUN entries (audit finding)
Both secrets/monitoring.env.sops and secrets/pinbox24-backends.env.sops contain Mailgun entries.
monitoring.env.sops existing Mailgun keys: MAILGUN_API_KEY, MAILGUN_EU_DOMAIN, MAILGUN_REPORT_FROM.
Pending action (interrupted by this audit): add MAILGUN_ADMIN_API_KEY from C:\Users\konar\Desktop\sec.txt.
4. Testing Matrix
| Test suite | Command | Trigger |
|---|---|---|
| audit-engine | python -m pytest audit-engine/tests/ -v --tb=short --cov=audit-engine | Push to audit-engine/** |
| exporters (queue, mezmo) | python -m pytest (pyproject.toml paths) | Push to monitoring/exporters/** |
| scripts | python -m pytest scripts/tests/ -v --tb=short | Push to scripts/** |
| meta-dispatcher | cd infra-src/meta-dispatcher && npm test (vitest) | Push to infra-src/** |
| p24-auth-worker | cd infra-src/p24-auth-worker && npm test | Push to infra-src/** |
| PDF integration | separate workflow, requires live gotenberg | Manual / on push |
| Prometheus config | promtool check config via Docker (CI only) | Push to monitoring/prometheus/** |
Python toolchain: Python 3.12, pytest --import-mode=importlib, ruff (line-length 100, py311 target).
5. Architecture Data Flow
Fleet events / GPS / WhatsApp
→ traccar-gw (CF Worker) → Supabase
→ n8n workflows (bms-4) → various integrations
GitHub Issues (dispatch label)
→ infra-task-request.yml → Supabase p24_queue
→ meta-dispatcher CF Worker (every 4h + on-demand)
→ GH Actions → bms-4 / vps-i1 claude-runner
→ Claude Code headless → PR → auto-merge
Prometheus scrapes (vps-i1):
→ 11 exporters + node + cadvisor + blackbox
→ Thanos Sidecar → Wasabi S3 (long-term)
→ Grafana → dashboards + alerts
→ Alertmanager → Discord + SMTP
6. Findings & Gaps Identified
| # | Finding | Severity | Action |
|---|---|---|---|
| 1 | CLAUDE.md lacked commands section | Low | Fixed — added Commands section 2026-07-02 |
| 2 | CLAUDE.md lacked architecture section | Low | Fixed — added Architecture section 2026-07-02 |
| 3 | Encoding artifacts in existing CLAUDE.md (â€") | Low | Fixed 2026-07-02 |
| 4 | audit-engine not deployed — compliance gap | Medium | Tracked in existing priorities.md / backlog |
| 5 | vps-h1 not yet provisioned as AI worker post-WAHA | Medium | Needs dev_r_server_capacity update |
| 6 | MAILGUN_ADMIN_API_KEY not yet in SOPS | Low | ✅ Fixed 2026-07-02 — PR #2617 merged, vps-i1 synced via secrets-sync run 28618044671 |
| 7 | waha-router in infra-src has node_modules committed | Low | Should be gitignored |
7. Output Artifacts
- Updated
CLAUDE.md— version 2026-07-02 with Commands + Architecture sections - This audit document:
docs/audits/2026-07-02-p24-infra-information-summary.md