Infrastructure Audit Report - DEEP AUDIT

Server: srv759970.hstgr.cloud Date: 2025-12-09 17:45:00 Auditor: julien-infra-hostinger-audit v1.0.0 Type: Deep Audit (comprehensive scan)

---

Executive Summary

Metric	Count	Status
Docker Containers	50	25 non documentés
Running	49	OK
Unhealthy	6	INVESTIGATE
Restarting	1	CRITICAL
Registry Match	50%	NEEDS UPDATE
Scripts Discovered	150+	100+ non documentés
Custom Systemd Services	15	5 non documentés
Systemd Timers	11	3 non documentés
PM2 Processes	3	2 non documentés
Cron Jobs	12	2 DUPLICATES
Nginx Sites	67	12 orphelins
SSL Certificates	60	8 expirent < 35j
Orphan Volumes	35	~4-8GB
Reclaimable Space	~12GB	MEDIUM

Health Score: 52/100 (decreased from initial due to deeper findings)

Principales decouvertes : 1. 150+ scripts repartis sur 8 locations differentes 2. Scripts mal places : /root/scripts/, /root/.sh (devraient etre dans /opt/) 3. **Scripts dupliques* : backup-configs.sh, backup-dbs.sh, ollama-idle-stop.sh 4. Cron jobs dupliques : backup-wordpress-full.sh, backup-infrastructure.sh 5. Media Stack complet non documente : 11 services (Jellyfin, Sonarr, etc.) 6. Services MCP non documentes : mcp-nodejs, mcp-python 7. PM2 processes non documentes : incluzhact, jokers-hockey

---

Issues Critiques (5)

1. Container en boucle de redemarrage

rq-exporter-whisperx: Restarting (1) 33 seconds ago

Action : docker logs rq-exporter-whisperx pour diagnostiquer

2. 6 Containers Unhealthy

Container	Status	Action
discord-voice-bot	unhealthy	Check logs
human-chain-backend	unhealthy	API issues
paperflow-flower	unhealthy	Celery issues
paperflow-worker	unhealthy	Worker issues
wordpress-test-themes	unhealthy	Test - remove?
nginx-test-themes	unhealthy	Test - remove?

3. Scripts dans mauvais emplacements

/root/scripts/ (5 scripts) - SHOULD BE in /opt/scripts/
/root/*.sh (4 scripts) - ARCHIVE or MOVE

4. Cron Jobs Dupliques

Job	Locations
backup-wordpress-full.sh	root crontab, automation crontab
backup-infrastructure.sh	root crontab, automation crontab

Action : Consolider - garder une seule copie

5. 2 Images Dangling en Utilisation

# Images sans tag mais utilisees par des containers
d39037f5b4df  6.65GB  -> paperflow (api, worker, flower)
2acb7da3552b  278MB   -> postgresql-shared

Action : Tagger ces images pour eviter suppression accidentelle

---

Scripts Inventory (150+)

/opt/scripts/ (12 scripts) - MAIN LOCATION

Script	Purpose	Cron
backup-infrastructure.sh	Monthly backup	0 4 1 * *
backup-to-dropbox.sh	Daily Dropbox backup	0 3 * * *
backup-wordpress-full.sh	Daily WP backup	0 3 * * *
check-dropbox-mount.sh	Verify mount	* * * * *
deploy-bot-protection.sh	Fail2ban rules	-
docker-audit-complete.sh	Full Docker audit	-
generate-server-status.sh	Status report	-
mount-dropbox-music.sh	Mount Dropbox	-
mount-onedrive-music.sh	Mount OneDrive	systemd
restore-wordpress.sh	WP restore	-

/usr/local/bin/ (9 scripts)

Script	Purpose
container-auto-start.sh	Auto-start containers
nginx-auto-docker-v3.sh	Auto-start on Nginx request
paperless-backup-dropbox.sh	Paperless backup
purge-wordpress-cache.sh	WP cache purge

/root/scripts/ (5 scripts) - SHOULD BE MOVED

Script	Issue
backup-configs.sh	DUPLICATE of server-config copy
backup-dbs.sh	DUPLICATE
backup-uploads.sh	DUPLICATE
install-wpcli.sh	ONE-TIME - archive
ollama-idle-stop.sh	Used by timer - KEEP but MOVE

/home/automation/scripts/ (12 scripts)

Script	Purpose
backup-media-stack-dropbox.sh	Media backup
cleanup-broken-torrents.sh	RD cleanup (timer)
sync-calibre-onedrive.sh	Calibre sync
sync-jellyfin-sonarr.py	Jellyfin/Sonarr sync

Application Scripts (100+)

Location	Count	Documented
/opt/audioguides/	20+	NO
/opt/downto40/scripts/	25+	NO
/opt/memvid/	4	Partially
/opt/whisperx/	4	YES
/opt/impro-manager/	4	NO
/opt/human-chain/	3	NO
/var/www/mcp-servers/	2	NO

---

Systemd Services & Timers

Custom Services Running

Service	Port	Documented
docker-autostart.service	-	YES
nginx-auto-docker.service	-	NO
mcp-nodejs.service	3100	NO
mcp-python.service	3101	NO
rclone-music-mount.service	-	NO

Custom Timers

Timer	Schedule	Documented
cleanup-rd-torrents.timer	daily	NO
ollama-idle-stop.timer	5min	NO
docker-autostart-cleanup.timer	15min	YES
certbot.timer	12h	YES

PM2 Processes (automation user)

Process	Port	Documented
incluzhact	3050	NO
incluzhact-preview	3051	NO
jokers-hockey	3060	Partially

---

Docker Services Non Documentes (25 containers)

Media Stack (11) - NOUVEAU

Service	Port	Nginx	SSL
jellyfin	8096	jellyfin.srv759970	84j
sonarr	8989	sonarr.srv759970	84j
radarr	7878	radarr.srv759970	84j
bazarr	6767	bazarr.srv759970	84j
prowlarr	9696	prowlarr.srv759970	84j
jellyseerr	5055	jellyseerr.srv759970	84j
flaresolverr	8191	-	-
rdtclient	6500	rdtclient.srv759970	84j
zurg	9999	zurg.srv759970	84j
rclone	-	-	-
kavita	5001	kavita.srv759970	82j

Nouveaux Services (6)

Service	Port	Description
calcom	3002	Calendrier/Reservations
piper-tts	8880	TTS (remplace neutts?)
doku	9091	Docker disk usage
dive-web	8002	Docker image explorer
langchain-service	5000	Langchain API
audioguides	8095	Site statique

Human Chain (2)

• human-chain-frontend (port 3333)
• human-chain-backend (port 8888, unhealthy)

Paperflow (3)

• paperflow-api (port 9520)
• paperflow-worker (unhealthy)
• paperflow-flower (port 9522, unhealthy)

---

Certificats SSL Expirant Bientot

Domaine	Expiration	Jours restants
sharepoint.srv759970.hstgr.cloud	2026-01-08	29
cristina.srv759970.hstgr.cloud	2026-01-09	30
whisper.srv759970.hstgr.cloud	2026-01-10	31
blog.cristina.srv759970.hstgr.cloud	2026-01-10	31
strapi.srv759970.hstgr.cloud	2026-01-11	32
clemence.srv759970.hstgr.cloud	2026-01-13	34
ollama.srv759970.hstgr.cloud	2026-01-13	34
tika.srv759970.hstgr.cloud	2026-01-13	34

Action : sudo certbot renew (renouvellement auto devrait se declencher)

---

Volumes Orphelins (35)

Safe to Delete (6)

docker volume rm invidious_invidious-db-data
docker volume rm nextcloud_onlyoffice-log
docker volume rm open-webui
docker volume rm rag-anything_rag-cache
docker volume rm downto40_caddy_config
docker volume rm downto40_caddy_data

Gain estime : ~500MB-1GB

---

Actions Recommandees

Immediat (Aujourd'hui)

1. Fixer le container en restart loop

   docker logs rq-exporter-whisperx --tail 50
   docker stop rq-exporter-whisperx  # si non critique
   

2. Tagger les images dangling

   docker tag d39037f5b4df paperflow:latest
   docker tag 2acb7da3552b postgresql-shared:latest
   

3. Consolider les cron jobs dupliques

4. Choisir root OU automation pour backup-wordpress-full.sh
5. Choisir root OU automation pour backup-infrastructure.sh

Cette Semaine

1. Deplacer les scripts de /root/

   # Deplacer les scripts fonctionnels
   mv /root/scripts/ollama-idle-stop.sh /opt/scripts/
   
   # Archiver les scripts one-time
   mkdir -p /opt/scripts/archived
   mv /root/install-wpcli.sh /opt/scripts/archived/
   mv /root/install_whisper.sh /opt/scripts/archived/
   mv /root/setup-dropbox-rclone.sh /opt/scripts/archived/
   

2. Supprimer les scripts dupliques

   # Garder /root/server-config/scripts/ comme reference
   rm /root/scripts/backup-configs.sh
   rm /root/scripts/backup-dbs.sh
   rm /root/scripts/backup-uploads.sh
   

3. Mettre a jour registry.yml avec :

4. Media stack (11 services)
5. calcom, piper-tts, doku, dive, langchain-service
6. human-chain, paperflow
7. MCP servers (nodejs, python)

8. PM2 processes (incluzhact, jokers)

9. Documenter les services manquants

10. audioguides scripts (20+)
11. downto40 scripts (25+)
12. impro-manager scripts

Ce Mois

1. Reduire frequence check-dropbox-mount.sh (chaque minute -> chaque 5 min)
2. Auditer les 29 volumes orphelins restants
3. Creer documentation backup strategy
4. Ajouter monitoring cron a Grafana

---

Fichiers Generes

Fichier	Description
audit/inventory/containers.yml	50 containers inventories
audit/inventory/images.yml	45 images analysees
audit/inventory/scripts.yml	150+ scripts documentes
audit/inventory/systemd.yml	15 services + 11 timers + 3 PM2
audit/inventory/cron.yml	12 cron jobs avec duplicates
audit/orphans/orphans-report.yml	Ressources orphelines
audit/diff/registry-diff.yml	Comparaison registry vs realite
audit/reports/audit-report.md	Ce rapport

---

Metriques de Drift

Category	In Registry	Actual	Drift
Docker Containers	45	50	+5 new, 20 stopped
Scripts	0	150+	+150 (never tracked)
Systemd Services	0	15	+15 (never tracked)
Systemd Timers	0	11	+11 (never tracked)
PM2 Processes	0	3	+3 (never tracked)
Cron Jobs	0	12	+12 (never tracked)

Conclusion : Le drift principal n'est pas Docker (50% match) mais les scripts, services et crons qui n'ont jamais ete suivis dans registry.yml.

---

Prochain Audit

Recommande : Mensuel ou apres ajout/suppression de services majeurs.

"Run infrastructure audit"

---

Generated by: julien-infra-hostinger-audit skill Audit duration: ~30 minutes (deep mode)