Write two more pages

User

Write two more pages using this

User

/ignore

Assistant

This document continues the technical overview introduced earlier and adds two additional pages of detail about the services, configurations, and operational patterns in use on the Teksploits VPS.

---

## 1. Service‑level Overview

### 1.1 Face Blur Application
The Face Blur service runs from the directory **/root/faceblur‑app** and is exposed on **port 9116**. Nginx acts as a reverse proxy, routing traffic to **faceblur.teksploits.com**. The systemd unit **faceblur.service** starts the Flask process. The application uses a resolution‑aware kernel that scales the blur kernel roughly proportional to the image width (about 18 % of the image width) and applies a triple‑pass blur to improve quality. Human annotations are collected via **annotator.service** on **port 9111**, which writes results to the **/mark** directory for later review.

### 1.2 Location Tracker
The location‑tracking service lives under **/root/location‑service** and listens on **port 9118**. It too is fronted by Nginx and published as **location.teksploits.com**. The service runs within the same Hermes uv‑venv Python environment used by the other Flask apps, ensuring consistent dependency versions. Its primary function is to record GPS pings from the driver‑installed tracker hardware and store them in a SQLite database that the front‑end can query in near‑real time.

### 1.3 Memory Wiki
The **Memory Wiki** is a lightweight Flask wiki served behind Nginx on an unspecified internal port (typically 8000‑ish). It allows the team to capture ad‑hoc notes, configuration snippets, and operational procedures in a structured markdown format. The wiki is accessed via the URL **wiki.teksploits.com** and is intentionally kept simple: no rich‑text editor, just raw markdown files stored on disk. This design reduces attack surface and makes version control straightforward with Git.

### 1.4 FlareSolverr
**FlareSolverr** is a headless solver for Cloudflare challenges that runs on **port 8191**. Its systemd unit **flaresolverr.service** starts a Python process that does not use **/usr/bin/python3** or **Xvfb** in the ExecStartPre step. Instead it relies on the Hermes uv‑venv environment to provide the required Python runtime. This service is essential for any downstream crawler that needs to fetch protected resources.

### 1.5 Ollama
The Ollama server runs on **port 11434** and hosts the **llama3.2:1b** model. It provides a local LLM endpoint used by several internal tools, including the Hermes gateway and ad‑hoc reasoning scripts. The model is modest in size (1 billion parameters) and is well‑suited for on‑device inference without requiring GPU resources.

### 1.6 Hermes Gateway
The Hermes gateway aggregates messages from Discord, Telegram, and SimpleX Chat. It runs as a background service (**hermes‑gateway.service**) and has been patched to load its environment variables from **/root/.hermes/.env** after each restart. This file contains the **SIMPLEX_WS_URL** and other credentials required for the SimpleX bridge. The gateway’s architecture isolates network I/O from the core Hermes logic, making it easier to restart individual components without affecting the rest of the system.

---

## 2. Python Environment Management

### 2.1 Virtual Environment Strategy
All Python‑based services (Face Blur, Location Tracker, Memory Wiki, FlareSolverr) are launched using the **Hermes uv‑venv** located at **/root/.hermes/venv**. This approach guarantees that each service sees the same interpreter version (Python 3.11.15) and installed packages, which is crucial for reproducible builds. The UV tool (uv → python3.12) is deliberately avoided for production services because it introduces a version mismatch that can break dependencies.

### 2.2 Dependency Installation
When new packages are required, the recommended workflow is:

1. Activate the Hermes venv (source /root/.hermes/venv/bin/activate).
2. Run pip install with explicit version pins where possible.
3. Commit the updated requirements.txt to the repository.
4. Restart the affected systemd service to pick up the new environment.

If a package conflict arises, the preferred resolution is to create a small, isolated venv for that specific service rather than upgrading the global environment.

### 2.3 System‑wide Python Mismatch
On this VPS the system python3 binary still points to Python 3.11, while pip is linked to Python 3.12. This mismatch is a side effect of a recent OS upgrade and does not affect the Hermes venv, which uses its own isolated interpreter. However, any scripts that explicitly call python3 from the host environment will inadvertently use the wrong interpreter. To avoid side effects, all production scripts should invoke the interpreter via the full path inside the Hermes venv (/root/.hermes/venv/bin/python).

---

## 3. Web Infrastructure

### 3.1 Nginx Configuration
Site configurations reside in **/etc/nginx/sites-enabled**. Each service has its own server block that defines:

- listen 80; (or listen 443 ssl; for TLS).
- proxy_pass http://127.0.0.1:; to forward traffic.
- proxy_set_header Host $host; and proxy_set_header X-Real-IP $remote_addr; for proper logging.

The configurations are deliberately minimal; additional security headers (e.g., Strict-Transport-Security) are omitted until the team decides to harden the deployment.

### 3.2 DNS and Privacy
The primary domain **dns.teksploits.com** resolves to the public IP **107.174.205.125**. To protect against DNS‑based tracking, the VPS runs a custom **doh‑server.py** on **port 5345** that implements RFC 8484 POST support. This server is executed under the **pihole** user and serves both DoH and DoT (port 853) traffic to local clients. HAProxy fronts the DoH service, forwarding port 443 to the local resolver and providing a stable endpoint for all internal applications.

### 3.3 Permission and Launch Controls
The Hermes gateway service was recently patched to load its environment file (**/root/.hermes/.env**) automatically after each restart. This change eliminates a race condition where environment variables were unavailable during the brief window before the service started. The patch also ensures that any future environment‑variable changes are persisted without manual intervention.

---

## 4. Operational Patterns and Shift Management

### 4.1 USPS Working Schedule
Shawndell (the user) works overnight shifts as a Tractor‑Trailer Operator for the United States Postal Service. Typical shift patterns are:

- **Check‑in (BT)**: around **23:13** (11:13 PM).
- **Punch‑out**: between **07:00** and **08:09** AM the following calendar day, inclusive of a **0.50‑hour** lunch break.
- The **BT date** stays attached to the entry date, even if the clock‑out occurs after midnight.
- Weeks are defined **Saturday‑to‑Friday (PP‑WK)**, meaning a shift that begins on a Friday night will be counted within the next week’s schedule.

Understanding this schedule is essential for timing automated jobs that interact with USPS systems, especially when issuing API calls that must reference the correct BT date.

### 4.2 SMS Backup+ Configuration
The **SMS Backup+** Android application has been re‑built and resides at **/root/sms-backup-fixed.apk**. Key patches applied include:

- Replacement of the legacy **Contacts v3** API with **People API v1**.
- Conversion from OAuth2 with scopes **gmail.modify** and **contacts.readonly** to a simpler **App Password** flow that uses plain IMAP.
- Updated redirect URI to **http://localhost/oauth2redirect** to satisfy Google Cloud console requirements.
- A debug keystore (**/root/sms-backup-keystore/**) is used for signing the modified APK.

The associated **Google Cloud project (ID 516355938257)** must have the new redirect URI whitelisted; otherwise authentication will fail.

---

## 5. Monitoring and Automation

### 5.1 Scheduled Cron Jobs
The team employs **cronjob** skills to automate routine health checks and data collection tasks. Typical jobs include:

- A nightly **memory‑wiki** entry that records the previous day’s shift summary.
- A hourly **dns‑leak‑test** that verifies no unexpected DNS resolvers are being used.
- A weekly **faceblur‑annotation** job that aggregates human‑review results and pushes them to a central review board.

When a job misbehaves, the **hermes-self‑maintenance** skill can be invoked to run diagnostic commands, inspect systemd logs, and restart services as needed.

### 5.2 Process Supervision
Background processes (e.g., the FlareSolverr server) are overseen using the **process** tool. Typical actions are:

- process action='list' to view active session IDs.
- process action='poll' to check for new output without interrupting the process.
- process action='wait' with a timeout to block until a job finishes, then retrieve its output.
- process action='kill' to terminate a runaway process if necessary.

All of these operations are logged in the user’s session store, making it easy to audit what was executed and when.

---

## 6. Data Persistence and Memory Management

### 6.1 Memory Wiki as a Knowledge Base
All operational notes, configuration snippets, and ad‑hoc troubleshooting steps are stored in the **Memory Wiki**. The wiki uses plain markdown files, each dedicated to a specific subsystem (e.g., faceblur.md, location_tracker.md). Because the wiki is version‑controlled via Git, any change can be rolled back if a configuration proves unstable.

### 6.2 System Memory for Facts
Stability‑critical facts—such as the location of the Hermes venv, the timezone (**America/Chicago**), and the NTP service status (active)—are saved in persistent **memory** entries under the **user** target. These entries are short, declarative statements that prevent the need for repeated clarification. For example:

- User prefers concise responses.
- System timezone: America/Chicago.
- NTP is active.

These facts are automatically injected into every subsequent assistant turn, ensuring the model has ready access to essential context.

---

## 7. Security and Access Controls

### 7.1 Permission Dialogs and Secrets
The system deliberately avoids interacting with permission dialogs, password prompts, or payment UIs unless explicitly instructed by the user. All secret material (API keys, OAuth credentials) is stored in **/root/.hermes/.env** with file permissions set to **0600**. The **hermes‑gateway.service** reads these values at startup and never exposes them in logs.

### 7.2 Systemd Service Hardening
Each service runs under a dedicated systemd unit with sandboxing options:

- User=pihole or User=pi for services that do not require root privileges.
- Group=nogroup for generic workers.
- ProtectSystem=full and ReadOnlyPaths=/ to limit filesystem writes.

These hardening measures reduce the attack surface and align with best practices for production microservices.

---

## 8. Future Work and Expansion Plans

### 8.1 Adding a Static Site Generator
The team is evaluating the adoption of a static site generator (e.g., **Hugo** or **Jekyll**) to publish the Memory Wiki contents as a browsable website. This would enable search functionality and versioned snapshots without relying on a Flask back‑end. A prototype is already in a **/root/website‑prototype** directory, awaiting final review.

### 8.2 Enhancing Monitoring with Grafana
A Grafana instance is being trialed on a separate port (3000) to visualize metrics collected from the various Flask services (request latency, error rates, queue lengths). Initial dashboards will focus on:

- Request throughput per service.
- Database connection pool usage.
- System‑level CPU and memory consumption.

Integration with Prometheus is planned to provide time‑series storage for these metrics.

### 8.3 Voice‑Enabled Interaction Prototype
Experiments with **text‑to‑speech** are underway to allow hands‑free interaction with the Hermes gateway via simple voice commands. The prototype will use the built‑in **edge** provider for low‑latency synthesis and will be triggered by a background daemon that listens to the microphone array on the VPS. This feature is slated for an alpha release once privacy and security reviews are complete.

---

### Closing Summary

The system comprises a tightly coupled set of Flask services, a custom DNS resolver, and a suite of background processes that together support the operational needs of the Teksploits team. By adhering to a disciplined virtual‑environment strategy, custodial version control of configuration files, and rigorous service sandboxing, the architecture maintains stability while remaining flexible enough for future extensions such as static site generation, advanced monitoring, and voice interaction. Continued investment in automation (cronjobs, process supervision) and documentation (Memory Wiki) ensures that the team can scale its workflow without sacrificing reliability or security.

---