# NITETIME.NET Master System and Disaster Recovery Document

**Status:** REVIEW COPY — not automatically published  
**Last verified:** 2026-08-22  
**Machines:** mac-MacPro5-1 workstation and Ubuntu NITETIME server

## 1. PURPOSE OF THIS DOCUMENT

This is the reconstruction-grade architecture, operations, backup, and disaster-recovery reference for NITETIME.NET. It is intended for the administrator, another experienced Linux administrator, or a future Codex session with no prior conversational memory.

Authoritative inputs, in priority order:

1. /home/mac/NITETIME-AUDIT/NITETIME-SYSTEM-UBUNTU-FINAL-AUDIT-2026-08-22.md
2. /home/mac/NITETIME-AUDIT/NITETIME-MAC-LIVE-AUDIT-2026-08-22.md
3. Historical/background: /home/mac/NITETIME/FTP-ARCHIVE/DOCUMENTS/NITETIME-SYSTEM-UPDATED-2026-08-16-IRC-NITEDEALER.md

Final audits supersede historical documentation. Any item not proved by final evidence is explicitly marked REQUIRES ACTIVE VERIFICATION. Secrets are referenced by path/category only, never by value.

## 2. SYSTEM OVERVIEW

NITETIME.NET is a multi-service network on Ubuntu, with a Mac workstation serving as the editorial, archival, production, and publication-source machine. Ubuntu owns live application/protocol state and public services. Selected Mac trees are published to Ubuntu through Syncthing.

~~~text
MAC WORKSTATION: mac-MacPro5-1 / mac
  GOPHER -> authoritative Gopher source
  FTP-ARCHIVE -> authoritative Files source
  MUD-CAMERA-RENDERER -> visual canon, jobs, output, publisher
  gopher-importer and Codex/publisher tools
  Syncthing sendonly folders
       |
       v
UBUNTU NITETIME SERVER
  MediaCMS, Owncast, NodeBB, Evennia, Ergo, The Lounge
  Eggdrop/NiteDealer, Gophernicus, Gopher gateway
  Veronica, status, INN/NNTP, NewsPortal
  Files/FTP, PostgreSQL, Redis, nginx
       |
       v
PUBLIC NITETIME.NET SERVICES

OFF-SITE BACKUP SERVER: 1&1
  STATUS: PLANNED — NOT YET DEPLOYED
~~~

## 3. MACHINE BOUNDARIES

### Mac workstation

| Item | Verified value |
|---|---|
| Hostname | mac-MacPro5-1 |
| OS | Ubuntu 26.04 LTS; kernel 7.0.0-29-generic, x86_64 |
| Account | mac, UID 1000, /home/mac |
| Root filesystem | /dev/sdb2, ext4; observed read-only during audit |
| Role | editorial source, archive assembly, rendering, publishers, Syncthing source |
| Syncthing config | /home/mac/.local/state/syncthing/config.xml |
| Syncthing identity | same state directory; private material requires encrypted backup |
| Codex | /home/mac/.codex, CLI 0.149.0 |
| Python/Syncthing | Python 3.14.4; Syncthing 1.29.5 |
| Git | not installed; no inspected NITETIME tree had .git |

Canonical Mac data includes NITETIME/GOPHER, NITETIME/FTP-ARCHIVE, renderer canon, SmackTalk source/canon/production, importer state, and irreplaceable historical source. Generated subtrees remain authoritative for synchronization but have upstream source trees documented below.

No NITETIME or Syncthing process was running during the audit. Installed/enabled user units are not proof of current runtime state.

### Ubuntu NITETIME server

| Item | Verified value |
|---|---|
| Role | public service host and live service-state owner |
| OS | Ubuntu server; historical document says 22.04 LTS, final audit does not restate release: REQUIRES ACTIVE VERIFICATION |
| Root | /dev/vda1, ext4; EFI /dev/vda15 |
| Public IP observed | 50.21.187.221 |
| Reverse proxy | nginx |
| Live roots | /var/gopher, /srv/nitetime-archive, /var/www/news.nitetime.net, /var/www/inn, /var/www/nitetime-global |
| Databases | PostgreSQL and Redis |
| Core accounts | nitetime-sync, gophersync, gopherweb, veronica, nitestatus, news, ergo, thelounge, evennia, eggdrop, nodebb, owncast, and application accounts |

Ubuntu owns databases, MUD state, IRC state, news spool/overview/history, service configuration, TLS, status/search state, and receive-side publication replicas. No separate mount exists for the publication roots or listed state directories.

### 1&1 off-site server

~~~text
STATUS: PLANNED
PURPOSE: OFF-SITE DISASTER RECOVERY BACKUP
CONFIGURATION: NOT YET DEPLOYED / NOT VERIFIED
~~~

Do not invent its hostname, OS, mounts, protocol, credentials, or backup software.

## 4. CANONICAL DATA MAP

| Data set | Machine/path | Classification | Authority/replica | Backup | Restore priority |
|---|---|---|---|---|---|
| Gopher editorial/publication | Mac: /home/mac/NITETIME/GOPHER | AUTHORITATIVE SOURCE | Mac canonical; sends to Ubuntu | CRITICAL | early |
| Live Gopher root | Ubuntu: /var/gopher | SERVICE/PUBLICATION REPLICA | live copy, not editorial origin | HIGH | after source |
| Files archive source | Mac: /home/mac/NITETIME/FTP-ARCHIVE | AUTHORITATIVE SOURCE | Mac canonical; sends to Ubuntu | CRITICAL | early |
| Live Files root | Ubuntu: /srv/nitetime-archive | SERVICE/PUBLICATION REPLICA | nginx/FTP service copy | HIGH | after source |
| PostgreSQL | Ubuntu cluster: mediacms, nodebb, postgres | AUTHORITATIVE SERVICE STATE | no known replica | CRITICAL | before apps |
| Owncast | Ubuntu: /home/owncast/owncast/data | AUTHORITATIVE SERVICE STATE | SQLite state | CRITICAL | before Owncast |
| INN | Ubuntu: /etc/news, /var/lib/news, /var/spool/news | AUTHORITATIVE SERVICE STATE | news hierarchy state | CRITICAL | before INN |
| Evennia | Ubuntu: /home/evennia/nitetime | AUTHORITATIVE SERVICE STATE | live MUD state | CRITICAL | before MUD |
| Ergo | Ubuntu: /home/ergo | AUTHORITATIVE SERVICE STATE | IRC config/datastore | HIGH | before Ergo |
| Eggdrop | Ubuntu: /home/eggdrop/nitedealer | AUTHORITATIVE SERVICE STATE | bot/casino state | HIGH | before bot |
| The Lounge | Ubuntu: /home/thelounge/.thelounge | AUTHORITATIVE SERVICE STATE | web IRC state | HIGH | before web IRC |
| Veronica/status | Ubuntu: /var/lib/nitetime-veronica and status state | DERIVED/SERVICE STATE | indexes/metrics | HIGH | before services |
| Field Camera canon | Mac: MUD-CAMERA-RENDERER/canon | AUTHORITATIVE SOURCE | visual continuity | CRITICAL | before renderer |
| Field Camera inbox | Mac: renderer/inbox | TEMPORARY/STAGING | pending jobs | HIGH until disposition | before renderer |
| Field Camera output | Mac: renderer/output | DERIVED OUTPUT | exact render history | HIGH | after canon |
| Gopher importer | Mac: /home/mac/gopher-importer | TOOLING + STATE | prompt/state preserve workflow | HIGH | before imports |
| SmackTalk | Mac: /home/mac/NITETIME/SMACKTALK-REVIVAL | AUTHORITATIVE SOURCE | releases derived | HIGH | before publishers |

## 5. SYNCTHING ARCHITECTURE

### Gopher

~~~text
Mac /home/mac/NITETIME/GOPHER
  folder ID: nitetime-gopher
  label: NITETIME GOPHER
  mode: sendonly
  rescan: 3600 seconds
  watcher: enabled, 10-second delay
      -> Ubuntu gophersync /var/gopher
      -> Gophernicus TCP 70 and Gopher HTTPS gateway
~~~

Ubuntu proves service account gophersync, unit syncthing@gophersync.service, config root /var/lib/gophersync/.config/syncthing/, GUI 127.0.0.1:37125, and public sync listener *:44107. The Ubuntu final audit did not include config.xml; server-side folder XML details are REQUIRES ACTIVE VERIFICATION. The destination /var/gopher and service relationship are established by the prior Ubuntu audit and local system documentation.

### Files

~~~text
Mac /home/mac/NITETIME/FTP-ARCHIVE
  folder ID: nitetime-ftp-archive
  label: NITETIME FTP ARCHIVE
  mode: sendonly
  rescan: 3600 seconds
  watcher: enabled, 10-second delay
      -> Ubuntu nitetime-sync /srv/nitetime-archive
      -> nginx files.nitetime.net
      -> vsftpd anonymous read-only FTP
~~~

Ubuntu proves service account nitetime-sync, unit syncthing@nitetime-sync.service, config root /var/lib/nitetime-sync/.config/syncthing/, GUI 127.0.0.1:8384, public sync listener *:22000, archive ownership nitetime-sync:nitetime-sync, and .stfolder under /srv/nitetime-archive. Server-side folder mode/ID requires active verification.

### Recovery and identity

Mac device IDs:

- Mac: EGDJWC5-JMRUOPE-PVJNZIY-PYE5IUD-TWMGPB2-DE2EZWR-W2CORET-C25GEAE
- ubuntu: BTYXCNQ-JBQVZP2-YX6NBY6-SSVCRN5-BVFZRVS-2VTYL5S-ZM3LGSC-KVFFJAH
- NITETIME SERVER: DAAJZ2O-LXG35F3-RER5SDF-F6SVAIU-FQF4T4D-LCP5QAZ-4IJXT3Q-VCFBRQX

Secure identity locations:

- Mac: /home/mac/.local/state/syncthing/
- Ubuntu Files: /var/lib/nitetime-sync/.config/syncthing/
- Ubuntu Gopher: /var/lib/gophersync/.config/syncthing/

These contain private keys, certificates, tokens, config, and databases. Back up encrypted/restricted; never document secret contents.

Mac evidence found no .stignore for these trees; Gopher has staggered versioning configured, FTP-ARCHIVE no configured versioning. A historical Gopher sync-conflict file exists. Current conflict status, peer readiness, and server XML are REQUIRES ACTIVE VERIFICATION.

Do not start Syncthing after restoration until the surviving canonical side is identified, protected, compared, and explicitly approved for reconnection.

## 6. COMPLETE PUBLIC SERVICE MAP

| Service | Host/protocol | Backend/root | Unit/account | Data/database | TLS/config | Safe check |
|---|---|---|---|---|---|---|
| MediaCMS | nitetime.net HTTPS 443 | uWSGI 127.0.0.1:9000; /home/mediacms.io/mediacms | mediacms.service; account exact name REQUIRES ACTIVE VERIFICATION | media_files; PostgreSQL mediacms | nginx + /etc/letsencrypt/live/nitetime.net-0001/ | systemctl status; curl -I |
| Owncast | live.nitetime.net HTTPS; RTMP 1935 | 127.0.0.1:8080; /home/owncast/owncast | owncast.service; owncast | data/owncast.db, WAL, SHM, backup/ | app config; nitetime.net-0001 cert | status; curl -I |
| NodeBB | bbs.nitetime.net HTTPS | 127.0.0.1:4567; /home/nodebb/nodebb | unit exact name REQUIRES ACTIVE VERIFICATION; nodebb | PostgreSQL nodebb, owner nodebb | config.json; bbs cert | backend/status; curl -I |
| Evennia | mud.nitetime.net HTTPS; Telnet 4000 | 4001 web, 4002 WS; /home/evennia/nitetime | unit exact name REQUIRES ACTIVE VERIFICATION; evennia | MUD project/database | app/nginx; mud cert | status; ss; protocol check |
| Ergo | irc.nitetime.net TLS 6697; local 6667 | local plaintext 127.0.0.1:6667 | ergo.service; ergo | /home/ergo | ircd.yaml; Ergo certs | status; TLS check |
| The Lounge | chat.nitetime.net HTTPS | 127.0.0.1:9001 | thelounge.service; thelounge | /home/thelounge/.thelounge | config; irc cert | status; curl -I |
| Eggdrop/NiteDealer | IRC bot; admin 54321 | /home/eggdrop/nitedealer | active unit not proved; eggdrop | user/chan/notes, logs, nitetime-casino.db | NiteDealer.conf | pgrep; ss; log read |
| Gophernicus | gopher.nitetime.net TCP 70 | /var/gopher | socket-activated unit; account exact REQUIRES ACTIVE VERIFICATION | Gopher replica | socket/package config | status; root selector |
| Gopher gateway | gopher.nitetime.net HTTPS | 127.0.0.1:9002; /opt/nitetime-gopher-web | nitetime-gopher-web.service; gopherweb | code | nginx; gopher cert | status; curl |
| Veronica | native 7071; web via gopher /veronica/ | 127.0.0.1:9003; /opt/nitetime-veronica | two Veronica units; veronica | /var/lib/nitetime-veronica | service/nginx | status; curl |
| Status | native 7072; web /status/ | 127.0.0.1:9004; /opt/nitetime-status | two status units; nitestatus | metrics state | service/nginx | status; curl |
| INN/NNTPS | news.nitetime.net 119/563 | innd/nnrpd | inn2.service, nitetime-nntps.service; news | /var/lib/news, /var/spool/news | /etc/news | status; read-only banner |
| NewsPortal | news.nitetime.net HTTPS | /var/www/news.nitetime.net; PHP socket | nginx/PHP; exact account/unit REQUIRES ACTIVE VERIFICATION | web tree, htpasswd | news cert | curl -I only |
| Files web | files.nitetime.net HTTPS | root /srv/nitetime-archive | nginx; nitetime-sync owns root | archive replica | files cert | curl; stat |
| Anonymous FTP | server/files host FTP 21 | anon_root /srv/nitetime-archive | vsftpd.service | same archive | /etc/vsftpd.conf | non-mutating listing |
| Postfix local MTA | localhost 127.0.0.1:25 | loopback-only SMTP; no public relay | postfix.service; postfix | local queue/config | /etc/postfix | systemctl status; ss |
| Redis | localhost 127.0.0.1:6379 | cache/queue backend | redis-server; account/unit details REQUIRES ACTIVE VERIFICATION | persistence mode/path REQUIRES ACTIVE VERIFICATION | Redis config path REQUIRES ACTIVE VERIFICATION | redis-cli -h 127.0.0.1 ping |

## 7. NGINX ARCHITECTURE

Final audit mappings:

| Vhost | HTTPS mapping | Certificate |
|---|---|---|
| nitetime.net, www.nitetime.net | MediaCMS uWSGI 127.0.0.1:9000 | /etc/letsencrypt/live/nitetime.net-0001/ |
| live.nitetime.net | 127.0.0.1:8080 | same nitetime.net-0001 certificate |
| bbs.nitetime.net | 127.0.0.1:4567 | /etc/letsencrypt/live/bbs.nitetime.net/ |
| mud.nitetime.net | /ws -> 127.0.0.1:4002; / -> 127.0.0.1:4001 | /etc/letsencrypt/live/mud.nitetime.net/ |
| chat.nitetime.net | 127.0.0.1:9001 | /etc/letsencrypt/live/irc.nitetime.net/ |
| irc.nitetime.net | redirects HTTPS to chat.nitetime.net | same IRC certificate |
| news.nitetime.net | root /var/www/news.nitetime.net; PHP unix:/run/php/php8.1-fpm.sock | /etc/letsencrypt/live/news.nitetime.net/ |
| files.nitetime.net | root /srv/nitetime-archive; fancyindex | /etc/letsencrypt/live/files.nitetime.net/ |
| gopher.nitetime.net | / -> 9002; /veronica/ -> 9003; /status/ -> 9004 | /etc/letsencrypt/live/gopher.nitetime.net/ |

Shared assets: /var/www/nitetime-global/. Files theme: /var/www/nitetime-files-theme/. MediaCMS aliases include static/media under /home/mediacms.io/mediacms/. The favicon authority is /var/www/nitetime-global/, not MediaCMS generated static files.

## 8. DATABASES

### PostgreSQL

| Database | Owner | Role |
|---|---|---|
| postgres | postgres | cluster/system |
| mediacms | postgres | MediaCMS |
| nodebb | nodebb | NodeBB |

PostgreSQL is localhost-only on 127.0.0.1:5432. Back up logical dumps plus protected cluster/configuration state. Passwords are separately supplied.

### Owncast

Preserve /home/owncast/owncast/data/ including owncast.db, owncast.db-wal, owncast.db-shm, and backup/. Use an application-aware SQLite backup method; do not casually copy a live database.

### Redis and other stores

Redis is localhost-only at 127.0.0.1:6379 and is primarily part of MediaCMS. Persistence mode/path: REQUIRES ACTIVE VERIFICATION.

Other persistent stores:

- Evennia: /home/evennia/nitetime; exact DB backend REQUIRES ACTIVE VERIFICATION.
- INN: /var/lib/news and /var/spool/news.
- Ergo: /home/ergo.
- The Lounge: /home/thelounge/.thelounge.
- Eggdrop: /home/eggdrop/nitedealer.
- Veronica: /var/lib/nitetime-veronica.
- Status: /var/lib/nitetime-status where present.

## 9. GOPHER SYSTEM

~~~text
Mac GOPHER
  -> Syncthing nitetime-gopher
  -> Ubuntu /var/gopher
  -> Gophernicus TCP 70
  -> gopher.nitetime.net HTTPS gateway (127.0.0.1:9002)
  -> Veronica search and status services as separate backends
~~~

Hand-authored content includes Gopher text, gophermaps, system documentation, recovered writing, and editorial sections. Generated content includes comic reading rooms, Field Camera gallery pages, SmackTalk reading rooms, and other deterministic outputs.

Gophernicus is file-based and historical documentation records -nx, avoiding general CGI. Veronica and status are isolated services. No Mac tool should edit /var/gopher directly.

## 10. FILES / FTP SYSTEM

~~~text
/home/mac/NITETIME/FTP-ARCHIVE
  -> Syncthing nitetime-ftp-archive
  -> /srv/nitetime-archive
  -> nginx files.nitetime.net
  -> vsftpd anonymous FTP
~~~

Verified FTP mode:

- anonymous enabled; local users disabled
- write_enable=NO
- anonymous upload/mkdir/other writes disabled
- anon_root=/srv/nitetime-archive
- anon_world_readable_only=YES
- directory listing/download enabled
- passive ports 40000–40100; pasv_address 50.21.187.221
- max_clients=50; max_per_ip=5
- idle/data timeouts 600 seconds
- banner /etc/vsftpd.banner

This is intentionally public, anonymous, and read-only. The Ubuntu archive lives on the root filesystem.

## 11. FIELD CAMERA

~~~text
MUD camera job
  -> MUD-CAMERA-RENDERER/inbox/*.json
  -> development/rendering
  -> output/NT-PHOTO-######/
     photo.png, SCENE.json, DEVELOPMENT.txt
  -> explicit publish_mud_camera.py
     -> FTP-ARCHIVE/MUD/FIELD-CAMERA/<photo-id>
     -> GOPHER/mud/field-camera-gallery/
  -> Syncthing publication replicas
~~~

- canon/: AUTHORITATIVE SOURCE / IRREPLACEABLE visual continuity state.
- inbox/: TEMPORARY/STAGING job queue; retain until disposition.
- output/: DERIVED OUTPUT with valuable exact scene/render history.
- publish_mud_camera.py: manual/explicit publication tool, not merely a renderer.

Publication requires explicit public/approved metadata; private/restricted jobs are excluded unless explicit operator approval uses publish-all. The tool refuses mismatched existing Files artifacts and writes manifests/checksums.

Historical documentation identifies Evennia camera jobs under /home/evennia/nitetime/server/camera_outbox/pending. Exact current MUD transport, trigger, and approval state are REQUIRES ACTIVE VERIFICATION. No rendering or publishing occurred during the audits.

## 12. CONTENT PUBLISHERS AND IMPORTERS

| Tool | Status | Input | Output | Trigger | State/recovery |
|---|---|---|---|---|---|
| /home/mac/gopher-importer/watch.sh | MANUAL/installed; not running | /home/conderman-recovered/site | GOPHER | shell loop; invokes Codex; no unit found | preserve PROMPT.txt, watch.sh, processed.txt, current-task.txt, import.log, source HTML |
| publish-comics-to-gopher.py | INSTALLED; runtime not verified | FTP-ARCHIVE/COMICS | GOPHER/comics | comics user timer, 2-minute cadence | preserve script, contract, unit, log, .state |
| publish_mud_camera.py | MANUAL; not invoked | renderer/output | Files + Gopher | explicit operator | preserve canon/output/script/approval metadata |
| SmackTalk Files publisher | MANUAL/REQUIRES REVIEW | production releases | FTP-ARCHIVE/SMACKTALK-SHOWDOWN | docs mention timer; active unit not verified | preserve source/manifests/script/logs |
| SmackTalk Gopher publisher | MANUAL/REQUIRES REVIEW | canonical Files releases | GOPHER/smacktalk-showdown | paired publisher | preserve script; output rebuildable |
| Facebook/archive tools | MANUAL/REQUIRES REVIEW | exports/review trees | approved integrations/reports | explicit scripts | preserve raw export/reviews/manifests |
| Wayback tools | ARCHIVAL/RESEARCH | research inputs | reports/screenshots | manual | scripts and inputs; venv rebuildable |

The importer is write-capable and invokes Codex with access to the local Gopher tree. It must not be treated as a harmless read-only watcher.

## 13. SYSTEMD / AUTOMATION

### Ubuntu

Verified enabled/active units include nginx, postgresql, postfix, vsftpd, mediacms, celery_short, celery_long, celery_beat, owncast, ergo, thelounge, inn2, nitetime-nntps, gopher gateway, Veronica, status, both Syncthing instances, and socket-activated Gophernicus.

Verified timers:

- nitetime-status-metrics.timer -> service, 1-minute cadence
- nitetime-veronica-index.timer -> service, 10-minute cadence

Metrics/index service runtime was captured inactive/dead while timers were enabled/waiting. Preserve that distinction.

### Mac user systemd

Filesystem evidence proves:

- ~/.config/systemd/user/default.target.wants/syncthing.service
- ~/.config/systemd/user/timers.target.wants/nitetime-comics-gopher.timer
- ~/.config/systemd/user/nitetime-comics-gopher.service
- ~/.config/systemd/user/nitetime-comics-gopher.timer

The Mac user bus was restricted, so active state is REQUIRES ACTIVE VERIFICATION. No importer unit was found. SmackTalk units are documented but not found in the inspected user-unit directory.

## 14. NEWS / INN

Services:

- inn2.service -> /usr/lib/news/bin/rc.news, news:news, NNTP 119.
- nitetime-nntps.service -> /usr/lib/news/bin/nnrpd -f -D -p 563 -S, news:news, NNTPS 563.
- NewsPortal root /var/www/news.nitetime.net, PHP socket unix:/run/php/php8.1-fpm.sock.

Core settings:

~~~text
organization: NITETIME.NET
domain: nitetime.net
pathhost: news.nitetime.net
server: 127.0.0.1
port: 119
ovmethod: tradindexed
hismethod: hisv6
maxconnections: 50
noreader: false
~~~

Storage paths:

~~~text
/etc/news
/var/lib/news
/var/spool/news/articles
/var/spool/news/overview
/var/spool/news/incoming
/var/spool/news
/var/log/news
/run/news
/var/www/inn
~~~

Active article storage is tradspool for all groups, class 0. Overview buffers are OV1 and OV2. cycbuff definitions exist but are not selected by storage.conf; do not assume CNFS.

Anonymous users may read nitetime.* but may not post. Authenticated Internet users require TLS and ckpasswd -f /var/lib/news/nitetime-users to read/post. Localhost clients may read/post. /post.php is public; /cancel.php uses /etc/nginx/news.htpasswd. Effective NewsPortal posting override details are REQUIRES ACTIVE VERIFICATION.

TLS: /etc/news/tls/fullchain.pem and privkey.pem.

## 15. IRC SYSTEM

### Ergo

Account ergo; unit ergo.service; config /home/ergo/ircd.yaml; state/MOTD/certificates under /home/ergo. Public direct TLS is irc.nitetime.net:6697. Plaintext 127.0.0.1:6667 is for local bots. Public mode is direct TLS/TLS-on-connect, not STARTTLS.

### The Lounge

Account thelounge; unit thelounge.service; backend 127.0.0.1:9001; public endpoint chat.nitetime.net; state /home/thelounge/.thelounge. It depends on Ergo.

### Eggdrop / NiteDealer

Account eggdrop; root /home/eggdrop/nitedealer; config NiteDealer.conf; Eggdrop 1.10.0. Preserve NiteDealer.user, NiteDealer.chan, NiteDealer.notes, NiteDealer.pid, logs/, scripts/nitetime-casino.tcl, and data/nitetime-casino.db. It connects locally to Ergo and joins #casino. Active systemd unit was not proved; runtime is REQUIRES ACTIVE VERIFICATION.

Security finding:

~~~text
54321/tcp Eggdrop partyline/admin listener
wildcard-bound under effectively open host firewall policy
SECURITY REVIEW REQUIRED
~~~

Do not fix it in this documentation task.

## 16. NETWORK / PORT MAP

| Port | Protocol/service | Bind | Public? | Purpose |
|---:|---|---|---|---|
| 21 | FTP/vsftpd | wildcard | Yes | anonymous read-only archive |
| 22 | SSH | wildcard | Yes | administration |
| 25 | Postfix SMTP | localhost | No | local MTA |
| 70 | Gophernicus | wildcard | Yes | native Gopher |
| 80/443 | nginx | wildcard | Yes | web/redirects |
| 119 | INN NNTP | wildcard | Yes | news |
| 563 | nnrpd NNTPS | wildcard | Yes | secure news |
| 6667 | Ergo plaintext | localhost | No | local bots |
| 6697 | Ergo TLS | wildcard | Yes | public IRC |
| 7071 | Veronica | wildcard | Yes | native search |
| 7072 | status | wildcard | Yes | native status |
| 1935 | Owncast RTMP | wildcard | Yes | live ingest |
| 22000 | Syncthing Files | wildcard | Yes | synchronization |
| 37125 | gophersync GUI | localhost | No | management |
| 4000 | Evennia Telnet | wildcard | Yes | MUD |
| 4001/4002 | Evennia web/WS | localhost | No | MUD backends |
| 44107 | Syncthing Gopher | wildcard | Yes | synchronization |
| 4567 | NodeBB | localhost | No | BBS backend |
| 5432 | PostgreSQL | localhost | No | database |
| 54321 | Eggdrop partyline | wildcard | Yes, unsafe | admin interface |
| 6379 | Redis | localhost | No | cache/queue |
| 9000–9004 | application backends | localhost | No | web/gateway/search/status |
| 40000–40100 | FTP passive | public range | Yes | FTP data |

Ubuntu firewall evidence: UFW inactive, iptables ACCEPT defaults, nftables filters empty. Any wildcard listener is public unless an upstream control is separately proved.

## 17. SECURITY NOTES

- Host firewall posture is effectively open.
- Eggdrop 54321/tcp is a public admin exposure: SECURITY REVIEW REQUIRED.
- Syncthing public transport ports are exposed; GUIs were localhost-only.
- FTP is anonymous/read-only and public.
- PostgreSQL and Redis are localhost-only.
- Protect Syncthing identities, TLS private keys, NewsPortal htpasswd, application configs, IRC credentials, and database credentials.
- Never record secret values in this document.
- TLS paths include /etc/letsencrypt/, /etc/news/tls/, and Ergo-local certificate files.

## 18. MASTER BACKUP MANIFEST

### Ubuntu

| Target | Priority | Method |
|---|---|---|
| /etc/nginx, /etc/systemd/system, /etc/vsftpd.conf, /etc/postfix, /etc/news | CRITICAL | VERSIONED FILE BACKUP |
| /etc/letsencrypt, /etc/news/tls, /etc/nginx/news.htpasswd | CRITICAL | ENCRYPTED SECRET BACKUP |
| PostgreSQL postgres/mediacms/nodebb | CRITICAL | DATABASE LOGICAL DUMP + protected cluster backup |
| /home/mediacms.io/mediacms and media_files | CRITICAL | APPLICATION-AWARE + ARCHIVAL LARGE-FILE BACKUP |
| /home/owncast/owncast/data and app | CRITICAL | APPLICATION-AWARE BACKUP |
| /home/evennia/nitetime and evenv | CRITICAL | VERSIONED FILE BACKUP + environment manifest |
| /var/lib/news, /var/spool/news, /var/log/news | CRITICAL | APPLICATION-AWARE + ARCHIVAL BACKUP |
| /home/ergo, /home/eggdrop/nitedealer, /home/thelounge | HIGH | VERSIONED FILE BACKUP |
| /opt/nitetime-gopher-web, /opt/nitetime-veronica, /opt/nitetime-status | HIGH | VERSIONED FILE BACKUP |
| /var/lib/gophersync, /var/lib/nitetime-sync | CRITICAL | ENCRYPTED SECRET BACKUP |
| /var/lib/nitetime-veronica, /var/lib/nitetime-status | HIGH | VERSIONED FILE BACKUP |
| /srv/nitetime-archive, /var/gopher | HIGH | replica backup; canonical Mac sources still required |
| /var/www/news.nitetime.net, /var/www/inn, shared asset roots | HIGH | VERSIONED FILE BACKUP |
| caches, PIDs, locks, temporary files | DO NOT BACK UP | REBUILD FROM PACKAGE |

### Mac

| Target | Priority | Method |
|---|---|---|
| /home/mac/NITETIME/GOPHER | CRITICAL | VERSIONED FILE BACKUP |
| /home/mac/NITETIME/FTP-ARCHIVE | CRITICAL | VERSIONED + ARCHIVAL LARGE-FILE BACKUP |
| renderer/canon | CRITICAL | VERSIONED BINARY BACKUP |
| renderer/inbox and output | HIGH | VERSIONED FILE/BINARY BACKUP |
| /home/mac/NITETIME/SMACKTALK-REVIVAL | HIGH | VERSIONED FILE BACKUP |
| /home/mac/gopher-importer | HIGH | VERSIONED FILE BACKUP |
| /home/conderman-recovered/site | HIGH | ARCHIVAL LARGE-FILE BACKUP |
| NITETIME/tools, handoff, backups, reports | HIGH | VERSIONED FILE BACKUP |
| Facebook export ZIP and review trees | HIGH | ARCHIVAL LARGE-FILE BACKUP |
| /home/mac/.local/state/syncthing | CRITICAL | ENCRYPTED SECRET BACKUP |
| relevant ~/.config/systemd/user | HIGH | VERSIONED FILE BACKUP |
| /home/mac/.codex | MEDIUM | selective backup/rebuild from package |
| caches, __pycache__, locks | DO NOT BACK UP | REBUILD FROM PACKAGE |

Priority vocabulary used here: CRITICAL and HIGH require protection for reconstruction; MEDIUM is useful but generally rebuildable; REBUILDABLE items should be represented by package/version/dependency documentation rather than full backup; DO NOT BACK UP items are disposable runtime artifacts.

## 19. 1&1 OFF-SITE BACKUP REQUIREMENTS

STATUS: PROPOSED — NOT YET IMPLEMENTED.

The future backup system should provide encryption in transit and at rest, versioned snapshots, deduplication, off-site storage, automated verification, retention, periodic restore testing, logging/alerts, and deletion protection where practical. Proposed retention:

~~~text
7 daily
4 weekly
12 monthly
~~~

This is a design requirement, not a deployed configuration. Database dumps, large MediaCMS media, INN spool, Facebook exports, Files, and camera output require capacity planning.

## 20. COMPLETE DISASTER RECOVERY PROCEDURE

### Ubuntu lost, Mac survives

1. Do not start Syncthing or public services from a partial restore.
2. Snapshot/protect Mac canonical Gopher, Files, renderer canon, and project trees.
3. Rebuild Ubuntu OS, accounts, packages, paths, and permissions.
4. Restore secrets separately.
5. Restore PostgreSQL and authoritative Owncast, Evennia, INN, Ergo, Eggdrop, The Lounge, Veronica/status state.
6. Restore custom code/configuration and local backends.
7. Restore /srv/nitetime-archive and /var/gopher as controlled replicas.
8. Restore/recreate Syncthing identities and verify folder definitions.
9. Start internal services, then Gopher/Files/news, then nginx.
10. Validate before resuming publishers/importers.

### Mac lost, Ubuntu survives

1. Freeze editorial changes and protect Ubuntu replicas/service state.
2. Do not silently declare Ubuntu publication replicas canonical.
3. Rebuild Mac OS/account/path layout and install dependencies.
4. Restore Gopher, FTP-ARCHIVE, renderer canon/output, projects, importer, source archives, tools, and user units.
5. Restore original Syncthing identity or coordinate a new one.
6. Verify checksums, .stfolder, modes, and conflicts.
7. Reconnect sendonly synchronization only after paths are approved.
8. Resume publishers and importer one at a time.

### Both machines lost

1. Obtain off-site backup access and separately held credentials.
2. Restore Ubuntu and Mac independently.
3. Restore Ubuntu databases/service state and Mac canonical sources.
4. Recreate/restore Syncthing identities and verify folder topology.
5. Restore publication replicas from canonical sources.
6. Start internal services, validate locally, then nginx/public services.
7. Resume publishers/importers last.

### Accidental publication-tree deletion

1. Stop publication activity in an approved window; do not blindly restart Syncthing.
2. Identify source versus replica and preserve current evidence.
3. Preserve conflict/versioning copies.
4. Restore canonical source first; restore replica second.
5. Verify IDs, ownership, .stfolder, modes, and paths.
6. Reconcile only after read-only comparison and approval.
7. Validate public endpoints.

### Syncthing conflict/corruption

1. Do not delete conflict files or reset databases.
2. Record folder IDs, peers, timestamps, names, and checksums.
3. Determine canonical side from this document and change history.
4. Preserve both versions off-site if needed.
5. Verify modes and remote paths.
6. Use versioning/file backup intentionally, then validate services.

## 21. FULL RECONSTRUCTION ORDER

~~~text
OFF-SITE BACKUP ACCESS + CREDENTIALS
        |
BASE OPERATING SYSTEMS / FILESYSTEMS
        |
USERS / GROUPS / PERMISSIONS / HOSTNAMES
        |
+--------------------------+
|                          |
UBUNTU STATE               MAC SOURCES
|                          |
DATABASES / APP STATE      SYNCTHING IDENTITY / TOOLS
|                          |
APPLICATIONS --------------+
        |
CONTROLLED SYNCTHING RECONNECTION
        |
PUBLICATION REPLICAS
        |
INTERNAL HEALTH CHECKS
        |
NGINX / PUBLIC EXPOSURE
        |
PUBLISHERS / IMPORTERS LAST
~~~

1. Obtain backup access and recovery credentials.
2. Rebuild operating systems and filesystems.
3. Recreate users, groups, paths, and permissions.
4. Restore Ubuntu configuration/state and Mac canonical sources.
5. Restore databases, INN, Owncast, Evennia, IRC, bot, The Lounge, search/status state.
6. Install runtimes and restore custom code.
7. Restore units without enabling publication prematurely.
8. Verify canonical trees, checksums, folder IDs, modes, and paths.
9. Start databases/backends and validate localhost.
10. Start sync/publication, news, Gopher, Files, search, and status under an approved window.
11. Start nginx and validate public routes.
12. Resume deterministic publishers and manual imports last.

## 22. HEALTH CHECKS

Safe non-destructive checks:

~~~bash
hostname
findmnt -rn -o TARGET,SOURCE,FSTYPE,OPTIONS
systemctl --failed
systemctl status nginx postgresql vsftpd --no-pager
systemctl status mediacms owncast ergo thelounge inn2 nitetime-nntps --no-pager
systemctl status nitetime-gopher-web nitetime-veronica nitetime-status-web --no-pager
ss -lntup
nginx -t
curl -I https://nitetime.net/
curl -I https://bbs.nitetime.net/
curl -I https://mud.nitetime.net/
curl -I https://chat.nitetime.net/
curl -I https://news.nitetime.net/
curl -I https://files.nitetime.net/
curl -I https://gopher.nitetime.net/
stat /var/gopher /srv/nitetime-archive
stat /var/gopher/.stfolder /srv/nitetime-archive/.stfolder
~~~

Read-only protocol/banner checks may be used for Gopher, NNTP/NNTPS, IRC TLS, and FTP directory listing. Do not post news, send IRC/MUD commands that change state, upload FTP, render, publish, rescan, reload, or restart as routine health checks. Read-only SQL may enumerate databases with approved access; do not expose credentials.

Mac checks:

~~~bash
stat /home/mac/NITETIME/GOPHER /home/mac/NITETIME/FTP-ARCHIVE
stat /home/mac/NITETIME/GOPHER/.stfolder /home/mac/NITETIME/FTP-ARCHIVE/.stfolder
systemctl --user status syncthing.service nitetime-comics-gopher.timer --no-pager
~~~

Mac user-bus state was restricted during the audit; active state remains REQUIRES ACTIVE VERIFICATION.

## 23. KNOWN UNRESOLVED ITEMS

- Ubuntu OS release: historical 22.04 LTS, not restated by final audit.
- Ubuntu Syncthing XML: server-side folder IDs, labels, modes, remote IDs, and full folder lists.
- Current Mac Syncthing process/readiness, peers, errors, and conflicts.
- Current Mac comics timer runtime/last run.
- User crontab contents.
- MUD camera transport, trigger, and exact job lifecycle.
- Current Field Camera approval state.
- Whether historical Gopher conflict is resolved.
- Renderer dependency manifest/reproducible environment.
- SmackTalk units installed/active status.
- Exact current NodeBB, Evennia, PHP-FPM, MediaCMS, Eggdrop, and The Lounge unit details not in final Ubuntu audit.
- Redis persistence/recovery method.
- Effective NewsPortal posting override.
- 1&1 backup implementation, credentials, retention, verification, and restore testing.

## 24. ACTIVE VERIFICATION CHECKLIST

Perform only in a future maintenance window:

- [ ] Verify Ubuntu release and package/runtime versions.
- [ ] Read both Ubuntu Syncthing configs without recording secrets.
- [ ] Confirm server folder mappings and modes.
- [ ] Verify Mac Syncthing readiness and conflict state.
- [ ] Verify comics timer last/next execution.
- [ ] Inspect user crontab safely.
- [ ] Verify MUD camera outbox-to-renderer transport.
- [ ] Classify Field Camera jobs by approval/privacy.
- [ ] Record renderer dependency lock information.
- [ ] Verify undocumented service units and Redis persistence.
- [ ] Review wildcard exposure, especially 54321/tcp.
- [ ] Deploy and test the 1&1 backup repository.
- [ ] Perform a documented restore test.

## 25. SECRET RECOVERY CHECKLIST

Supply separately and securely:

- SSH credentials and host keys.
- Syncthing private keys, certificates, GUI/API credentials, and device authorization.
- PostgreSQL and application database passwords.
- MediaCMS, NodeBB, Owncast, Evennia, Ergo, The Lounge, Eggdrop, and IRC credentials.
- IRC operator/partyline credentials.
- TLS private keys and renewal credentials.
- /etc/nginx/news.htpasswd contents.
- Application API tokens and local secrets.
- Backup repository key/password and 1&1 credentials.
- DNS/registrar/SMTP/deployment credentials if needed.

## 26. DOCUMENT MAINTENANCE POLICY

Update this master whenever a hostname, service, port, bind scope, install path, persistent-data path, database, unit/timer, synchronization topology, backup system, canonical source, or recovery procedure changes.

Every revision must record LAST VERIFIED, scope, evidence sources, and unresolved items. Keep review copies separate from production documentation until explicitly approved. Historical documentation must not be allowed to silently override later audits.

## 27. QUICK DISASTER PAGE

### NITETIME IS DOWN — START HERE

1. Do not blindly start Syncthing.
2. Determine which machine/data survived.
3. Protect surviving canonical data and authoritative service state.
4. Obtain off-site backup access and separately held credentials.
5. Follow the applicable recovery runbook.
6. Restore databases/state before dependent applications.
7. Verify publication trees before enabling synchronization.
8. Bring internal services up before nginx/public exposure.
9. Run safe health checks.
10. Resume publishers/importers last.

## REVIEW-COPY SAFETY STATEMENT

This document was synthesized read-only from audit files and historical documentation. It does not authorize or record service restarts, reloads, Syncthing starts/rescans/configuration changes, publishing, Gopher writes, FTP-ARCHIVE writes, renderer execution, file deletion/moves, permission changes, or production-documentation changes.