📖 THE BIBLE

🏰 Hierarchy 🖥 Servers 🔑 SSH Keys 🔐 VPN 🔧 Services 🌐 URLs 🔀 Nginx 🐳 Docker ⏰ Cron 🔑 Configs & Keys 🧠 Skills 📦 GitHub 🛟 Babigon 🛟 Recovery 📂 Directories

🏰 Commander / Worker Hierarchy

👑 Godji — COMMANDER

Role	Primary orchestrator, the "you" instance
Server	Old Contabo — `185.218.125.121`
Framework	Hermes Agent (bare metal)
Model	DeepSeek V4 Pro (custom provider)
Identity	Godji (ゴッジ) — Commander
Persona	Thai-commander, ค่ะ/นะคะ, direct, thorough
Platforms	Discord DM (auttapongb), local CLI
SSH to workers	`/root/.ssh/hermes_key`

🤖 Ginnie — WORKER

Role	Discord bot for end-users, general chat
Server	New Contabo — `13.140.145.203`
Framework	Hermes Agent (profile: ginnie)
Model	DeepSeek Chat
Platform	Discord (connected, 5+ channels)
PID	121295 (gateway run --replace)
Config	`~/.hermes/profiles/ginnie/`

🛟 Babigon — RECOVERY WORKER

Role	Monitors Godji, resurrects him if down, executes delegated tasks
Server	New Contabo — `13.140.145.203`
Framework	OpenClaw (TypeScript) — separate from Hermes for cross-framework resilience
Model	DeepSeek V4 Flash
Port	`18790` (OpenClaw gateway)
SSH	`/opt/openclaw-babigon/ssh/hermes_key` → Godji (passwordless)
Config	`/opt/openclaw-babigon/.openclaw/`

🔮 Mew (TeenOpenclaw) — WORKER (CORRUPTED)

Role	Dashboard/analytics bot (OpenClaw framework)
Server	Old Contabo — `185.218.125.121`
Status	CORRUPTED — needs full rebuild from Bible
Dashboard	`https://dashboard.cfoth.ai` (served by dashboard PM2 now)

🖥 Server Inventory

Server	IP	CPU	RAM	Disk	Role	SSH Key
Commander Old Contabo	`185.218.125.121`	6 cores	11 GB	193 GB (67%)	Godji (Hermes only)	— (this machine)
Worker New Contabo	`13.140.145.203`	12 cores	47 GB	484 GB (7%)	ALL services + Ginnie	`/root/.ssh/hermes_key`
Standby Hostinger	`72.60.43.17`	Decommissioned — standby only			—	—

🔑 SSH Access & Keys

🟡 Old Contabo — GODJI (Commander)

Server Info
IP	`185.218.125.121`
Hostname	`vmi3155729.contaboserver.net`
Role	Commander — Godji-Hermes agent (this is where "you" run)

🔐 SSH Keys ON this server

Key File	Fingerprint (SHA256)
`~/.ssh/hermes_key`	`DFJKw2LfT8SaW4iOoWHsBo0wAXE4ibvGblQChY1ZXRE` godji-hermes-contabo-access
`~/.ssh/ginnie-recovery`	`ZJ1+v7a1UM5pUI0vV/BDz5JC77mHDVi0VEsEP1J31g8` godji-hermes-recovery
`~/.ssh/id_ed25519`	`guZw0l2mk9nHE2ooEMHrQDziAjAPVoQSyaUQvAgY2v8` godji-hermes-contabo

🔓 Authorized Keys (who can SSH in)

# Only auttapong's MacBook:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICRgm8VT1FIJFZLp5A5UmiQNutpJ1wA29Iv38iOdeuTZ auttapong@bssadmins-MacBook-Air.local

🚀 How to SSH in

# From your MacBook (has the matching key):
ssh root@185.218.125.121

# RECOVERY: Contabo panel → Reset root password → upload your key

🔵 New Contabo — ALL SERVICES + GINNIE (Worker)

Server Info
IP	`13.140.145.203`
Hostname	`vmi3354910.contaboserver.net`
Role	All public services + Ginnie + Mew dashboard

🔐 SSH Keys ON this server

Key File	Fingerprint (SHA256)
`~/.ssh/hermes_key`	`DFJKw2LfT8SaW4iOoWHsBo0wAXE4ibvGblQChY1ZXRE`
`~/.ssh/ginnie-recovery`	`ZJ1+v7a1UM5pUI0vV/BDz5JC77mHDVi0VEsEP1J31g8`

🔓 Authorized Keys (4 keys — Godji can SSH in)

ssh-ed25519 ... hermes-agent@185.218.125.121     ← Godji's hermes_key
ssh-ed25519 ... babigon-hermes-contabo            ← Ginnie recovery #1
ssh-ed25519 ... babigon-hermes-contabo            ← Ginnie recovery #2
ssh-ed25519 ... godji-hermes-contabo-access        ← Godji access key

🚀 How to SSH in

# From old Contabo (Godji) — passwordless:
ssh -i ~/.ssh/hermes_key root@13.140.145.203

# Babigon's SSH to Godji (reverse direction — for recovery):
# On New Contabo, Babigon uses:
ssh -i /opt/openclaw-babigon/ssh/hermes_key root@185.218.125.121
# Key fingerprint: SHA256:uyANplCQN6FjViEiC2qWOBtnoGaxmTJaMTyKZe6XBEE

# From MacBook — use Godji as jump host: ssh -J root@185.218.125.121 root@13.140.145.203 # RECOVERY: Contabo panel → Reset root password

💀 Hostinger — `72.60.43.17` UNREACHABLE

Status	SSH ACCESS LOST — Permission denied (publickey,password)
Former Role	Ginnie's original home (Ollama, Freqtrade, Docker, OpenClaw)
Migration	All services moved to New Contabo (13.140.145.203)
Recovery	Hostinger panel needed to reset access. NOT needed for current ops — all services on New Contabo.

🗺 SSH Connection Map

┌──────────────────────────────────────────────────────────────────┐
│                                                                  │
│  auttapong's MacBook                                             │
│       │                                                          │
│       │ SSH (authorized key)                                      │
│       ▼                                                          │
│  ┌──────────────────────┐     SSH (hermes_key)     ┌──────────────────────┐
│  │  OLD CONTABO         │ ──────────────────────▶  │  NEW CONTABO         │
│  │  185.218.125.121     │◀─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─  │  13.140.145.203      │
│  │  GODJI (Commander)   │◀──SSH (recovery)─────  │  ALL SERVICES        │
│  │                      │                          │  + GINNIE (Worker)   │
│  │  Hermes Agent        │                          │  + MEW (Dashboard)   │
│  │  ~/.ssh/hermes_key   │                          │  + BABIGON (OpenClaw)│
│  │  ~/.ssh/hermes_key   │                          │                      │
│  │  ~/.ssh/ginnie-recov │                          │  PM2 × 10 services   │
│  └──────────────────────┘                          │  Nginx × 15 sites    │
│       │                                            │  PostgreSQL × 7 DB   │
│       │ SSH (FAILED)                               └──────────────────────┘
│       ▼
│  ┌──────────────────────┐
│  │  HOSTINGER           │
│  │  72.60.43.17         │
│  │  💀 UNREACHABLE      │
│  │  Permission denied   │
│  └──────────────────────┘
│                                                                  │
└──────────────────────────────────────────────────────────────────┘

🔐 VPN / Tunnels

Type	Status	Details
WireGuard	NOT INSTALLED	No WireGuard config on any server (`/etc/wireguard/` empty)
OpenVPN	NOT INSTALLED	No OpenVPN config on any server (`/etc/openvpn/` empty)
SSH Tunnel (Ollama)	Active	Port 11434 forwarded: `ssh -i ~/.ssh/ginnie-recovery -N -L 11434:127.0.0.1:11434 root@<ginnie-host>`. Auto-fallback to Gemini embeddings if down.

⚠️ No VPN layer exists between servers. Communication is direct via public IPs over SSH. To add VPN: install WireGuard on both Contabo servers, generate keys, create mesh config. Consider for production hardening.

🔄 Cross-Framework Resilience

Agent	Framework	Runtime	Directory	PID
Ginnie	Hermes Agent	Python	`~/.hermes/`	121295
Babigon	OpenClaw	Node.js	`/opt/openclaw-babigon/`	153828

rm -rf /root/.hermes/ kills Ginnie → Babigon survives.
rm -rf /opt/openclaw-babigon/ kills Babigon → Ginnie survives.
Either can SSH to Godji (Old Contabo) for mutual recovery.

🔧 PM2 Services (New Contabo)

ID	Name	Port	Path	What It Does
0	hub-server	8081	`/data/sasin-cfoth-ai/`	Sasin hub page + live server proxy
1	upload-server	8897	`/data/sasin-cfoth-ai/`	File/image upload handler
2	gemini-vision	8499	`/data/sasin-cfoth-ai/`	Gemini Vision API for slide analysis
3	brain-server	8400	`/var/www/second-brain/`	Second Brain Flask search server
4	naruto-web-ui	4790	Bun runtime	Naruto research web UI
5	dashboard	8888	`/data/sasin-cfoth-ai/`	THIS PAGE — Mew Dashboard / Bible
7	capture-server	8896	`/data/sasin-cfoth-ai/capture/`	Lecture capture — Groq STT + DeepSeek
13	lgiap-api	8085	`/data/lgiap/`	LINE webhook receiver
14	lgiap-worker	—	`/data/lgiap/`	Dramatiq worker — message processing
15	paperclip	3100	`/root/.paperclip/`	Paperclip AI orchestration

🌐 All URLs — What Should Work

URL	Port	Service	Status
dashboard.cfoth.ai	:8888	📖 THE BIBLE (this page)	OK
brain.cfoth.ai	:8400	Second Brain — LLM Wiki, search, graph	OK
n8n.cfoth.ai	:5678	n8n Automation (main instance)	OK
n8n.brain.cfoth.ai	:5678	n8n Automation (brain alias)	OK
sasin.cfoth.ai	:8081	Sasin Hub — course portal	OK
langfuse.cfoth.ai	:3031	Langfuse — LLM observability	OK
naruto.cfoth.ai	:4790	Naruto Research Web UI	OK
paperclip.cfoth.ai	:3100	Paperclip AI — zero-human orchestration	OK
search.cfoth.ai	:8080	SearXNG — private search engine	OK
lgiap.sasin.cfoth.ai	:8085	LGIAP — LINE Group Intelligence	OK
capture.sasin.cfoth.ai	:8896	Lecture Capture — recording + AI	OK
learn.sasin.cfoth.ai	:8001	DeepTutor API — AI tutoring	OK
live.sasin.cfoth.ai	:8081	Live session proxy	OK
workspace.cfoth.ai	static	Workspace — under migration	OK
autta.cfoth.ai	static	Autta — landing page	OK

🔀 Nginx Routing (New Contabo)

# 15 server blocks in /etc/nginx/sites-enabled/
# SSL: Let's Encrypt via certbot, auto-renewing
# Cloudflare: DNS proxy (orange cloud) for all cfoth.ai domains

autta.cfoth.ai          → static /var/www/autta-cfoth
brain.cfoth.ai          → http://127.0.0.1:8400  (brain-server PM2)
capture.sasin.cfoth.ai → http://127.0.0.1:8896  (capture-server PM2)
dashboard.cfoth.ai      → http://127.0.0.1:8888  (dashboard PM2)
langfuse.cfoth.ai       → http://127.0.1.1:3031  (langfuse-web Docker)
learn.sasin.cfoth.ai    → http://127.0.0.1:8001  (deeptutor Docker)
lgiap.sasin.cfoth.ai    → http://127.0.0.1:8085  (lgiap-api PM2)
live.sasin.cfoth.ai     → http://127.0.0.1:8081  (hub-server PM2)
n8n.brain.cfoth.ai      → http://127.0.0.1:5678  (n8n Docker, host network)
n8n.cfoth.ai            → http://127.0.0.1:5678  (n8n Docker, host network)
naruto.cfoth.ai         → http://127.0.0.1:4790  (naruto-web-ui PM2)
paperclip.cfoth.ai      → http://127.0.0.1:3100  (paperclip PM2)
sasin.cfoth.ai          → http://127.0.0.1:8081  (hub-server PM2)
search.cfoth.ai         → http://127.0.0.1:8080  (searxng Docker)
workspace.cfoth.ai      → static /var/www/workspace (placeholder)

# Certificates: /etc/letsencrypt/live//
# Configs:    /etc/nginx/sites-available/
# Enabled:    /etc/nginx/sites-enabled/ → ../sites-available/

🐳 Docker Containers (New Contabo)

Container	Image	Ports	Purpose
n8n	n8nio/n8n:latest	:5678 (host net)	n8n automation — uses host PostgreSQL
searxng	searxng/searxng:latest	:8080	Private search engine
deeptutor	ghcr.io/hkuds/deeptutor:latest	:3782, :8001	AI tutoring API
langfuse-web	langfuse/langfuse:2	:3031	LLM observability web UI
langfuse-minio	minio/minio:latest	:9000	S3-compatible storage for Langfuse
local-deep-research	localdeepresearch/local-deep-research	:5000	Deep research agent

⏰ Cron Jobs

Schedule	Command	Purpose
`/5 * * *`	`cd /data/lgiap && venv/bin/python backend/app/analyzer.py`	LGIAP — group conversations + rate messages

🔑 Configs & API Keys Location

🔐 Godji (Old Contabo)

Config	`~/.hermes/config.yaml`
Env / Keys	`~/.hermes/.env`
API Vault	`~/.hermes/.api_vault.py`
SSH Key	`/root/.ssh/hermes_key`
Skills	`~/.hermes/skills/`
Sessions	`~/.hermes/state.db`

🔐 New Contabo (13.140.145.203)

Ginnie Config	`~/.hermes/profiles/ginnie/config.yaml`
Ginnie Env	`~/.hermes/profiles/ginnie/.env`
Capture Env	`/data/sasin-cfoth-ai/capture/.env`
LGIAP Env	`/data/lgiap/.env`
n8n Env	`/root/n8n.env`
n8n Compose	`/root/n8n-docker-compose.yml`

🔑 Required API Keys (names only — values in vault)

Key Name	Used By	Where Stored
`DEEPSEEK_API_KEY`	Godji, Ginnie, Capture co-learner	~/.hermes/.env, ginnie/.env, capture/.env
`DISCORD_BOT_TOKEN`	Ginnie, Godji	~/.hermes/.env, ginnie/.env
`GROQ_API_KEY`	Capture STT (whisper-large-v3)	/data/sasin-cfoth-ai/capture/.env
`GEMINI_API_KEY`	Capture slide analysis, LGIAP ratings	capture/.env, lgiap/.env
`LINE_CHANNEL_SECRET`	LGIAP webhook signature	/data/lgiap/.env
`LINE_CHANNEL_TOKEN`	LGIAP profile sync	/data/lgiap/.env
`N8N_ENCRYPTION_KEY`	n8n workflow encryption	/root/n8n.env
`GITHUB_TOKEN`	Git push/pull (classic PAT)	~/.hermes/.api_vault.py

🧠 Skills Loaded (Godji — Commander)

Autonomous Agents

claude-code · codex · opencode · hermes-agent · hermes-agent-recovery

DevOps

infrastructure-recovery · rtk-token-killer · dogfood · kanban-orchestrator · kanban-worker

Software Dev

plan · spike · systematic-debugging · test-driven-development · requesting-code-review · agent-knowledge-recovery

GitHub

github-auth · github-pr-workflow · github-issues · github-code-review · github-repo-management · codebase-inspection

Productivity

google-workspace · obsidian · notion · powerpoint · ocr-and-documents · maps

Data & Research

jupyter-live-kernel · arxiv · polymarket · llm-wiki · blogwatcher

Creative

architecture-diagram · ascii-art · excalidraw · claude-design · sketch · popular-web-designs

MLOps

llama-cpp · serving-llms-vllm · huggingface-hub · evaluating-llms-harness · obliteratus

Platform-Specific

lgiap-line-archive · line-messaging-api · messaging-platform-setup · yuanbao

📦 GitHub Repos

Repo	Purpose	Location on Server
auttapongb/cfoth-ai	THE BIBLE repo — architecture docs, recovery guides	— (push target)
auttapongb/lgiap	LINE Group Intelligence & Archive Platform	`/data/lgiap/`
auttapongb/sasin-cfoth-ai	Capture server, hub, dashboard, all PM2 services	`/data/sasin-cfoth-ai/`
auttapongb/DeepTutor	AI Tutoring (Dockerized, on :8001)	Docker image
auttapongb/arb-scanner	Arbitrage scanner	—
auttapongb/highway-guardian	SinkAlert / highway monitoring	—
auttapongb/bdi-hackathon	BDI Hackathon project	—
auttapongb/ruza-prep	RUZA preparation	—
auttapongb/vgi-datahub	VGI Data Hub	—
rtk-ai/rtk	RTK — token-killer CLI proxy (60-90% savings)	Installed via .deb on both servers

🛟 Recovery — How to Rebuild Everything From Scratch

🛟 Automated Recovery: Babigon (OpenClaw on New Contabo) monitors Godji and can resurrect him automatically.
ssh -i /opt/openclaw-babigon/ssh/hermes_key root@185.218.125.121 — passwordless SSH already configured.
If Godji is down, Babigon SSHs in and runs hermes gateway --profile default.

⚠️ If Everything Is Wiped — Start Here

This is the single source of truth. A fresh Hermes instance should load this page and follow these steps:

Step 1: Restore API Keys

# Source of truth: ~/.hermes/.api_vault.py (on old Contabo)
# Contains ALL tokens: DeepSeek, Discord, GROQ, Gemini, LINE, GitHub
# Copy to new instance: scp root@185.218.125.121:~/.hermes/.api_vault.py .

scp ~/.hermes/.api_vault.py new-server:~/.hermes/

Step 2: Clone Repos

cd /data
git clone https://github.com/auttapongb/cfoth-ai.git
git clone https://github.com/auttapongb/lgiap.git
git clone https://github.com/auttapongb/sasin-cfoth-ai.git

Step 3: Install System Dependencies

apt-get install -y nginx certbot python3-certbot-nginx postgresql redis-server python3-venv nodejs npm
# Install rtk (token killer)
curl -sSL https://github.com/rtk-ai/rtk/releases/download/v0.42.3/rtk_0.42.3-1_amd64.deb -o /tmp/rtk.deb
dpkg -i /tmp/rtk.deb

Step 4: SSL Certificates

# Get Let's Encrypt certs for ALL domains
certbot --nginx -d dashboard.cfoth.ai -d brain.cfoth.ai -d n8n.cfoth.ai \
  -d sasin.cfoth.ai -d naruto.cfoth.ai -d paperclip.cfoth.ai \
  -d search.cfoth.ai -d langfuse.cfoth.ai -d n8n.brain.cfoth.ai \
  -d autta.cfoth.ai -d workspace.cfoth.ai --non-interactive --agree-tos

certbot --nginx -d lgiap.sasin.cfoth.ai --non-interactive --agree-tos
certbot --nginx -d capture.sasin.cfoth.ai --non-interactive --agree-tos
certbot --nginx -d learn.sasin.cfoth.ai --non-interactive --agree-tos
certbot --nginx -d live.sasin.cfoth.ai --non-interactive --agree-tos

Step 5: Start PM2 Services

# From /data/sasin-cfoth-ai/
pm2 start /data/sasin-cfoth-ai/venv/bin/python3 server.py --name hub-server
pm2 start /data/sasin-cfoth-ai/venv/bin/python3 capture/server.py --name capture-server
pm2 start /data/sasin-cfoth-ai/venv/bin/python3 dashboard_server.py --name dashboard -- --port 8888

# From /data/lgiap/
pm2 start /data/lgiap/venv/bin/python3 -m uvicorn app.main:app --host 0.0.0.0 --port 8085 --name lgiap-api
pm2 start /data/lgiap/venv/bin/python3 -m dramatiq app.tasks.ingest --processes 2 --name lgiap-worker

pm2 save

Step 6: Docker Services

# n8n
cd /root && docker compose -f n8n-docker-compose.yml up -d

# SearXNG, DeepTutor, Langfuse, Local Deep Research
# (see individual docker-compose files or run commands)

Step 7: Restore Ginnie

# Create ginnie profile
hermes profile create ginnie

# Copy config and .env from backup
cp backup/ginnie/config.yaml ~/.hermes/profiles/ginnie/
cp backup/ginnie/.env ~/.hermes/profiles/ginnie/

# Start gateway
hermes --profile ginnie gateway run --replace &

Step 8: Cron Jobs

# LGIAP analyzer — every 5 minutes
crontab -e
*/5 * * * * cd /data/lgiap && source venv/bin/activate && python3 backend/app/analyzer.py >> /var/log/lgiap-analyzer.log 2>&1

📂 Key Working Directories (New Contabo)

Path	Purpose
`/data/sasin-cfoth-ai/`	Main app repo — hub, capture, dashboard, upload, gemini-vision
`/data/sasin-cfoth-ai/capture/`	Lecture capture server (server.py, index.html, .env)
`/data/lgiap/`	LINE ingestion pipeline (Flask, Dramatiq, analyzer)
`/data/lgiap/.env`	LINE secret/token, GEMINI key, DATABASE_URL, REDIS_URL
`/var/www/second-brain/`	Second Brain Flask server (search_server.py)
`/root/.paperclip/`	Paperclip AI data + config
`/root/n8n-docker-compose.yml`	n8n Docker Compose config
`/root/n8n.env`	n8n environment variables
`/etc/nginx/sites-available/`	All nginx server block configs
`/etc/nginx/sites-enabled/`	Symlinks to active nginx configs
`/var/log/nginx/error.log`	Nginx error log — check for routing issues
`/root/.pm2/logs/`	PM2 logs for all services
`~/.hermes/profiles/ginnie/`	Ginnie's Hermes profile

🏰 Commander / Worker Hierarchy

👑 Godji — COMMANDER

🤖 Ginnie — WORKER

🛟 Babigon — RECOVERY WORKER

🔮 Mew (TeenOpenclaw) — WORKER (CORRUPTED)

🖥 Server Inventory

🔑 SSH Access & Keys

🟡 Old Contabo — GODJI (Commander)

🔐 SSH Keys ON this server

🔓 Authorized Keys (who can SSH in)

🚀 How to SSH in

🔵 New Contabo — ALL SERVICES + GINNIE (Worker)

🔐 SSH Keys ON this server

🔓 Authorized Keys (4 keys — Godji can SSH in)

🚀 How to SSH in

💀 Hostinger — 72.60.43.17 UNREACHABLE

🗺 SSH Connection Map

🔐 VPN / Tunnels

🔄 Cross-Framework Resilience

🔧 PM2 Services (New Contabo)

🌐 All URLs — What Should Work

🔀 Nginx Routing (New Contabo)

🐳 Docker Containers (New Contabo)

⏰ Cron Jobs

🔑 Configs & API Keys Location

🔐 Godji (Old Contabo)

🔐 New Contabo (13.140.145.203)

🔑 Required API Keys (names only — values in vault)

🧠 Skills Loaded (Godji — Commander)

Autonomous Agents

DevOps

Software Dev

GitHub

Productivity

Data & Research

Creative

MLOps

Platform-Specific

📦 GitHub Repos

🛟 Recovery — How to Rebuild Everything From Scratch

⚠️ If Everything Is Wiped — Start Here

Step 1: Restore API Keys

Step 2: Clone Repos

Step 3: Install System Dependencies

Step 4: SSL Certificates

Step 5: Start PM2 Services

Step 6: Docker Services

Step 7: Restore Ginnie

Step 8: Cron Jobs

📂 Key Working Directories (New Contabo)

💀 Hostinger — `72.60.43.17` UNREACHABLE