Status: Completed 2026-08-11 — SSH-based monitoring replaced with SIAAS port probes; canonical DB target confirmed (VPS2 container); backup pipeline restored; monitoring generalised to all client tenants.
Created: 2026-08-11 (investigation only — no changes made)
Related: SIAAS Remaining Tasks, Client VPS Setup, Client VPS Backups
The tenant app is fine: test-client.gp.veripath.co.uk resolves to VPS1 nginx → VPS2 app, and its app DB (dsp_clinic_dev) lives in the client_vps_postgres container on VPS2 (reached via tun-apps-vps2 → 172.18.0.1:5435). Tunnel-health reports HEALTHY for this canonical path.
Decision (2026-08-11): The VPS2 client_vps_postgres container is the canonical DB target for monitoring. The client VPS (77.68.97.101) remains a live client resource and is monitored for availability via a TCP port-22 probe (SIAAS no-SSH model). SSH key access to the client VPS is currently revoked (key no longer in authorized_keys; Fasthosts remote console not usable) and is not required for monitoring.
/usr/local/bin/check-client-uptime.sh rewritten to probe TCP 22 (the client VPS's only public exposure per UFW). Runs every 15 min for 77.68.97.101 and dental 194.164.18.33. Logs to /var/log/client-vps-uptime.log, alerts via logger.check-tunnel-health.py now accepts --tenant-slug + --credentials; per-tenant credential files created (/root/client-credentials.json, client-credentials-dental.json, client-credentials-dev-client.json). Cron now covers test-client (5435), test-client-dental (5436), dev-client (5437) for tunnel-health, capacity, and uptime.backup-client.py + backup-healthcheck.sh restored from /root/cleanup-quarantine-20260811/ (they had been disabled 2026-08-11 10:29). Cron (/etc/cron.d/practice-backup 02:30 daily, /etc/cron.d/backup-health every 2h) reinstated. Config /etc/practice-backup.conf corrected to the canonical target (dsp_clinic_dev via 172.18.0.1:5435). Backups are GPG-encrypted and stored in /var/backups/practice/daily/./opt/check-backup-status.py scans infrastructure_clientbackuplog for failures/stale (>30h) backups across all client tenants and alerts via logger (runs every 2h)./root/client-credentials.json updated to reflect the canonical VPS2-container DB, tunnel path, and backup location; reconciliation note added to /root/client-handover.md. client-credentials-dental.json / client-credentials-dev-client.json created for the other tenants.ubuntuPer the (now-superseded) handover doc it hosted PostgreSQL practice_app_db, pgAdmin4, daily DB backups, UFW, and pg-tunnel.service. The canonical tenant DB is now on VPS2.
| Check | Result |
|---|---|
| Port 22 reachable from primary | ✅ SSH banner responds (SSH-2.0-OpenSSH_10.2p1) |
SSH login clientadmin@77.68.97.101 with /root/clientadmin-key |
❌ Permission denied (publickey,password) — key no longer in authorized_keys |
| Key matches handover doc | ✅ Same fingerprint SHA256:v+9cxPAkDVTEVCP7SQ7W9xSkJtgTT7sb3uSUP15kUpE |
Reverse tunnel pg-tunnel.service → 127.0.0.1:15432 |
❌ Not established — legacy path, superseded by VPS2 container |
check-client-uptime.sh (cron */15) |
❌ Was failing continuously since ~2026-07-16 → now OK (port probe) |
check-tunnel-health.py for 172.18.0.1:5435 |
✅ HEALTHY (canonical VPS2 container DB) |
| Dental / dev-client tunnels (5436 / 5437) | ✅ Now monitored (were unmonitored) |
| Client backup pipeline | ❌ Was disabled 2026-08-11 → restored, passing |
tenant-gateway@15432 socat on VPS1 has no live target (legacy client-VPS path). Left in place; not used.client_monitor/tasks.py exist but are not in CELERY_BEAT_SCHEDULE; the cron scripts are the live monitors.tasks/siaas-remaining item 3) — infrastructure-level alerting now wired via cron; app badge still to do.