Plans of hetziner-46 improvements.md Server: 46.62.228.173 (Hetzner, Debian 12, 16GB RAM) Date: 2026-04-28 This bot-telegram for coach and diet apps, Name of bot: t.me/newbothelpingmeBot api bot tokens: 8259336570:AAFTdY3Il-HuK801BdwBkSSXf9HMJtF-Q0w chat id: 7674461942 ———--------- The following telegram bot is for ielts app Bot name: t.me/THE_IELTS_FAST_111Bot. The token bot API: 8632182251:AAG338J2hjVR1GESos04VfT9Z1QdqbmBgMk Chat_ID = 7674461942 ——— For the following issues, you have to understand the whole plan and fixation code patterns and follow them, keeping your memory well and perform well according to the context without hallucination or without making errors. Make phases specs and act ase expert developer, with the following guide: Part 1: Coach.promedic1.com — Cascading Issues Chain The coach app has a chain of interconnected issues where one problem triggers or masks others. Issue Chain Diagram 🔴 #1: Systemd Port CollisionNo ExecStartPre kill Services crash-loop~19,400 restarts in 7 days 🔴 #2: Multiple Health ScriptsALL restart simultaneously Race condition:4 scripts fight to restartthe same service 🟠 #3: Service Worker CacheStale cache-name 'v1' Users see old codeafter deployments 🟠 #4: Registration 400 ErrorPB validation rules Users can't create accounts 🟠 #5: Redeem-code 403Called on page loadwithout auth token Console error spamon every page visit 🟡 #6: .bak file in /assets/Served publicly Source code leakage 🟡 #7: .git exposedin webroot Full repo historydownloadable 🔴 Issue #1: Systemd Port Collision Crash Loop (Root Cause of Instability) What happens: When the service restarts (via cron, weekly restart, or hook file change), the old PocketBase process doesn't release port 8092 fast enough. The new process tries to bind → fails → systemd retries every 5 seconds → infinite crash loop. Evidence: Error: listen tcp 127.0.0.1:8092: bind: address already in use 19,404 restarts in 7 days for Coach alone. Fix: Add ExecStartPre to kill orphan processes: ini ExecStartPre=/bin/sh -c 'fuser -k 8092/tcp 2>/dev/null; sleep 2 || true' RestartSec=15 # was 5 KillMode=mixed TimeoutStopSec=15 🔴 Issue #2: 4 Health Scripts Fight Over the Same Services This is a massive problem. Four independent scripts all check PocketBase health every 3-5 minutes, and ALL of them attempt systemctl restart if health fails: Script Schedule Action /usr/local/bin/pb-health-check.sh */5 * * * * (crontab) Restarts PB if health fails /root/monitoring-agent/check-pocketbase.sh */3 * * * * (crontab) Restarts PB if health fails /usr/local/bin/service-guardian.sh */5 * * * * (/etc/cron.d/) Restarts PB if health fails /usr/local/bin/promedic-monitor */5 * * * * (/etc/cron.d/) Runs fix if status fails CAUTION When PB is momentarily down (e.g., during a hot-reload), up to 4 scripts simultaneously try to restart it. This creates the exact port collision that causes Issue #1. Each script issues systemctl restart, which kills the process and tries to start a new one — but another script already started one 30 seconds ago. Fix: Consolidate into ONE monitoring script. Delete the other three. 🟠 Issue #3: Service Worker Caches Stale Content The service worker ( sw.js ) has a hardcoded cache name coach-app-v1 that never changes between deployments: javascript const CACHE_NAME = "coach-app-v1"; // ← Never updated This means after a deployment, users continue seeing the old cached version. The service worker caches /index.html and all /assets/* files aggressively. Combined with Caddy's Cache-Control: public, max-age=31536000, immutable on assets, users may need to manually clear their browser data to see updates. Fix: Use a build hash in the cache name: coach-app-v${BUILD_HASH} or implement a cache-busting strategy in the activate handler. 🟠 Issue #4: User Registration Returns 400 Bad Request Browser test confirmed: Creating an account via the registration form fails with HTTP 400. The PocketBase users collection likely has validation rules (required fields like phone, country_code) that the registration form doesn't send. The cascade: This blocks new users → they can't log in → they can't use premium features → the approval workflow never triggers. 🟠 Issue #5: Redeem-Code API Called on Page Load (403) The frontend calls /pb/api/custom/redeem-code automatically on page load, but the user isn't authenticated yet (no Bearer token). The hook correctly returns 403, but this: Spams the browser console with errors on every visit Wastes server resources Creates false positives in monitoring logs Fix: The frontend should only call this endpoint when the user explicitly submits an activation code. 🟡 Issue #6: .bak File Served Publicly A backup file exists in the assets directory and is publicly accessible: /var/www/coach.promedic1.com/assets/SocialHub-Bmb5I9MX.js.bak (8.9KB) This exposes source code. Caddy serves it because it's inside the webroot. Fix: Delete it or add a Caddy rule to block *.bak files. 🟡 Issue #7: .git Directory Exposed in Webroot The .git directory is present inside the coach webroot: /var/www/coach.promedic1.com/.git While Caddy has a rule blocking /.git/*, the pattern may not cover all git-related access patterns (e.g., /.git/config vs /.git). Fix: Remove .git from webroot or add explicit Caddy block. Part 2: Server-Wide Audit — Bad Practices & Future Bugs 🔴 Critical Issues A. Telegram Bot Tokens Hardcoded in PocketBase Hooks All three apps have Telegram bot tokens hardcoded directly in the JavaScript hook files: javascript // coach & diet hooks: url: "https://api.telegram.org/bot8640574098:AAHmn7SCskmlx0M1YUwAy9SaNZyA9qjHkpM/sendMessage" // ielts hooks: url: "https://api.telegram.org/bot8632182251:AAG338J2hjVR1GESos04VfT9Z1QdqbmBgMk/sendMessage" CAUTION If anyone gains read access to the hooks directory (or if it's backed up to git), they get your Telegram bot tokens. These tokens allow sending messages as your bot and potentially reading updates. Fix: Move tokens to environment variables or a secrets file (/etc/default/pocketbase-secrets). B. IELTS Database Files Are World-Readable -rw-r--r-- 1 root root data.db ← world-readable! -rw-r--r-- 1 root root auxiliary.db ← world-readable! Compare with Coach/Diet which are correctly rw------- (owner-only). Any process on the server can read the IELTS database. Fix: chmod 600 /root/ielts-pocketbase/data/*.db* C. .git Directories in 5 Webroots /var/www/coach.promedic1.com/.git /var/www/diet-plans/.git /var/www/promedic1.com/.git /var/www/clinical/.git /var/www/super/.git Even with Caddy blocking /.git/*, this exposes commit history, emails, and potentially secrets if someone finds a bypass. Fix: Remove all .git from /var/www/ directories. Deploy code without git history. D. Everything Runs as Root All PocketBase services, Docker containers, Node.js services, and Python services run as root. If any of these are compromised, the attacker has full server control. ini User=root # in all service files Group=root Fix: Create dedicated service users (pocketbase, nodeapp, etc.) and run each service under its own user with minimal permissions. 🟠 High Priority Issues E. Cron Job Chaos — 12+ Overlapping Jobs The cron configuration is a mess of overlapping, competing scripts from different "sessions": Frequency Scripts Running Every 3 min check-pocketbase.sh Every 5 min pb-health-check.sh + service-guardian.sh + promedic-monitor + system-alerts.sh + health-check.sh Every 15 min monitor.js --app=all Every 30 min tts-memory-manager.sh Weekly (Sun 3AM) server-maintenance.sh Weekly (Sun 4AM) restart diet + coach PocketBase ← conflicts with maintenance above! WARNING The weekly Sunday 4AM restart (systemctl restart diet-pocketbase coach-pocketbase) runs RIGHT AFTER the 3AM maintenance. This is likely the trigger for the 19,400+ crash loops — the maintenance script may not fully stop the services before the cron restart hits. Fix: Consolidate all monitoring into ONE script. Remove duplicates. F. Weekly PocketBase Restart Cron Only Restarts 2 of 3 cron 0 4 * * 0 root systemctl restart diet-pocketbase coach-pocketbase IELTS PocketBase is not included in the weekly restart. If the restart is needed for memory leak prevention, all three should be restarted. If it's not needed, remove the cron entirely. G. WAL Checkpoint Only Runs on data.db, Not auxiliary.db The WAL checkpoint script only checkpoints data.db: bash for db in .../data.db .../data.db .../data.db; do sqlite3 "$db" "PRAGMA wal_checkpoint(TRUNCATE);" done But the auxiliary.db WAL files are actively growing (up to 113KB). Over time, these will bloat. Fix: Add auxiliary.db to the checkpoint script. H. Restic Backup Backs Up a Non-Existent Path bash restic backup /root/pb_data/ # ← This directory doesn't exist The actual PB data is in /root/coach-pocketbase/pb_data/, /root/diet-pocketbase/pb_data/, and /root/ielts-pocketbase/data/. The script does backup these correct paths later (under "live PocketBase"), but the /root/pb_data/ line silently fails. I. No IELTS PocketBase Log Rotation The IELTS service writes logs to a file: ini StandardOutput=append:/root/ielts-pocketbase/pocketbase.log StandardError=append:/root/ielts-pocketbase/pocketbase.log But Coach and Diet don't have this (they log to journald). The IELTS log file will grow unbounded with no rotation configured. 🟡 Medium Priority Issues J. CSP Policy Has Unnecessary Allowances All apps have script-src 'unsafe-inline' https://cdn.tailwindcss.com in CSP, but Coach uses a pre-built Vite bundle — it doesn't load TailwindCSS from CDN. This is a leftover that weakens the security policy. K. Docker Containers Running Two Docker containers are running: webapp_ielts (Node.js app on port 8093) uptime-kuma (monitoring on port 3002) Uptime-Kuma duplicates the monitoring already done by the 5+ cron scripts. This is resource waste. L. Certbot Installed but Caddy Handles TLS A certbot cron job runs every 12 hours, but Caddy manages all TLS certificates automatically. Certbot is unnecessary bloat and could potentially conflict. M. PHP Session Cleaner Running but No PHP Apps A PHP session cleanup cron runs every 30 minutes, but there are no PHP applications on the server. Summary Table # Issue Severity Category Effort 1 Port collision crash loop (no ExecStartPre) 🔴 Critical Stability 10 min 2 4 competing health scripts cause restarts 🔴 Critical Stability 30 min A Telegram tokens hardcoded in hooks 🔴 Critical Security 20 min B IELTS DB world-readable 🔴 Critical Security 2 min C .git in 5 webroots 🔴 Critical Security 5 min D Everything runs as root 🔴 Critical Security 1 hour 3 Service worker stale cache 🟠 High Functionality 15 min 4 Registration 400 error 🟠 High Functionality 20 min 5 Redeem-code 403 on page load 🟠 High UX/Performance Frontend fix E 12+ overlapping cron jobs 🟠 High Stability 45 min F Weekly restart skips IELTS 🟠 High Consistency 2 min G WAL checkpoint misses auxiliary.db 🟠 High Data 5 min H Restic backs up non-existent path 🟠 High Backup 5 min I IELTS log no rotation 🟠 High Operations 10 min 6 .bak file publicly served 🟡 Medium Security 2 min J CSP has unused TailwindCDN rule 🟡 Medium Security 5 min K Uptime-Kuma duplicates monitoring 🟡 Medium Resources 10 min L Certbot unnecessary (Caddy handles TLS) 🟡 Medium Bloat 5 min M PHP cron but no PHP apps 🟡 Medium Bloat 2 min Live Browser Test Recording ============================================================= priority order: Fix systemd port collision (Issues #1) — prevents the 19K crash loops Consolidate monitoring (Issue #2/E) — stops competing scripts from fighting Fix security (A, B, C) — Telegram tokens, DB perms, .git removal Clean up cron (E, F, G, H) — remove duplicates and fix gaps Fix Guide Part 1: Stability & Crash Prevention **Server:** `46.62.228.173` | **SSH:** `ssh -i ~/.ssh/hetzner_dokploy root@46.62.228.173` --- ## Fix #1: Systemd Port Collision (Critical) > [!CAUTION] > This is the ROOT CAUSE of 19,400+ crash loops. The service tries to start before the old process releases the port. ### Current (Broken) ```ini # /etc/systemd/system/coach-pocketbase.service [Service] ExecStart=/root/coach-pocketbase/pocketbase serve --http=127.0.0.1:8092 ... Restart=always RestartSec=5 # Too fast — port not released yet TimeoutStopSec=30 # Too long — delays cleanup ``` ### Fixed Version ```ini # /etc/systemd/system/coach-pocketbase.service [Service] # ✅ Kill any orphan process holding the port BEFORE starting ExecStartPre=/bin/sh -c 'fuser -k 8092/tcp 2>/dev/null; sleep 1 || true' ExecStart=/root/coach-pocketbase/pocketbase serve --http=127.0.0.1:8092 \ --dir=/root/coach-pocketbase/pb_data \ --migrationsDir=/root/coach-pocketbase/pb_migrations \ --hooksDir=/root/coach-pocketbase/pb_hooks \ --origins="https://coach.promedic1.com" Restart=always RestartSec=15 # ✅ Give port 15s to release (was 5) TimeoutStopSec=15 # ✅ Don't wait 30s to kill KillMode=mixed # ✅ SIGTERM main, SIGKILL children KillSignal=SIGTERM # ✅ Graceful shutdown first ``` ### Apply to all 3 services: ```bash # Coach (port 8092) sed -i '/^\[Service\]/a ExecStartPre=/bin/sh -c '\''fuser -k 8092/tcp 2>/dev/null; sleep 1 || true'\''' \ /etc/systemd/system/coach-pocketbase.service # Diet (port 8091) sed -i '/^\[Service\]/a ExecStartPre=/bin/sh -c '\''fuser -k 8091/tcp 2>/dev/null; sleep 1 || true'\''' \ /etc/systemd/system/diet-pocketbase.service # IELTS (port 8090) sed -i '/^\[Service\]/a ExecStartPre=/bin/sh -c '\''fuser -k 8090/tcp 2>/dev/null; sleep 1 || true'\''' \ /etc/systemd/system/ielts-pocketbase.service ``` > [!TIP] > **Better approach:** Replace each service file entirely with the corrected version (shown in Fix #1 complete files below) rather than using sed. ### Complete Fixed Service Files #### coach-pocketbase.service ```ini [Unit] Description=Coach PocketBase (coach.promedic1.com) After=network.target StartLimitIntervalSec=300 StartLimitBurst=5 [Service] Type=simple User=root Group=root WorkingDirectory=/root/coach-pocketbase # Kill orphan port holder before start ExecStartPre=/bin/sh -c 'fuser -k 8092/tcp 2>/dev/null; sleep 1 || true' ExecStart=/root/coach-pocketbase/pocketbase serve \ --http=127.0.0.1:8092 \ --dir=/root/coach-pocketbase/pb_data \ --migrationsDir=/root/coach-pocketbase/pb_migrations \ --hooksDir=/root/coach-pocketbase/pb_hooks \ --origins="https://coach.promedic1.com" Restart=always RestartSec=15 TimeoutStopSec=15 KillMode=mixed KillSignal=SIGTERM # Resource Limits MemoryMax=1G MemoryHigh=512M CPUQuota=100% LimitNOFILE=65536 TasksMax=512 # Security Hardening NoNewPrivileges=yes ProtectSystem=strict ProtectHome=read-only ReadWritePaths=/root/coach-pocketbase PrivateTmp=yes ProtectKernelTunables=yes ProtectKernelModules=yes ProtectControlGroups=yes RestrictSUIDSGID=yes RestrictRealtime=yes RestrictNamespaces=yes LockPersonality=yes [Install] WantedBy=multi-user.target ``` #### diet-pocketbase.service ```ini [Unit] Description=Diet PocketBase (diet.promedic1.com) After=network.target StartLimitIntervalSec=300 StartLimitBurst=5 [Service] Type=simple User=root Group=root WorkingDirectory=/root/diet-pocketbase ExecStartPre=/bin/sh -c 'fuser -k 8091/tcp 2>/dev/null; sleep 1 || true' ExecStart=/root/diet-pocketbase/pocketbase serve \ --http=127.0.0.1:8091 \ --dir=/root/diet-pocketbase/pb_data \ --migrationsDir=/root/diet-pocketbase/pb_migrations \ --hooksDir=/root/diet-pocketbase/pb_hooks \ --origins="https://diet.promedic1.com" Restart=always RestartSec=15 TimeoutStopSec=15 KillMode=mixed KillSignal=SIGTERM MemoryMax=1G MemoryHigh=512M CPUQuota=100% LimitNOFILE=65536 TasksMax=512 NoNewPrivileges=yes ProtectSystem=strict ProtectHome=read-only ReadWritePaths=/root/diet-pocketbase PrivateTmp=yes ProtectKernelTunables=yes ProtectKernelModules=yes ProtectControlGroups=yes RestrictSUIDSGID=yes RestrictRealtime=yes RestrictNamespaces=yes LockPersonality=yes [Install] WantedBy=multi-user.target ``` #### ielts-pocketbase.service ```ini [Unit] Description=IELTS PocketBase (ielts.fast) After=network.target StartLimitIntervalSec=300 StartLimitBurst=5 [Service] Type=simple User=root Group=root WorkingDirectory=/root/ielts-pocketbase ExecStartPre=/bin/sh -c 'fuser -k 8090/tcp 2>/dev/null; sleep 1 || true' ExecStart=/root/ielts-pocketbase/pocketbase serve \ --http=127.0.0.1:8090 \ --dir=/root/ielts-pocketbase/data \ --hooksDir=/root/ielts-pocketbase/data/pb_hooks \ --origins="https://ielts.fast" Restart=always RestartSec=15 TimeoutStopSec=15 KillMode=mixed KillSignal=SIGTERM MemoryMax=1G MemoryHigh=512M CPUQuota=100% LimitNOFILE=65536 TasksMax=512 NoNewPrivileges=yes ProtectSystem=strict ProtectHome=read-only ReadWritePaths=/root/ielts-pocketbase PrivateTmp=yes ProtectKernelTunables=yes ProtectKernelModules=yes ProtectControlGroups=yes RestrictSUIDSGID=yes RestrictRealtime=yes RestrictNamespaces=yes LockPersonality=yes # Logging (consistent with coach/diet via journald) SyslogIdentifier=ielts-pocketbase [Install] WantedBy=multi-user.target ``` ### Reload after applying: ```bash systemctl daemon-reload systemctl restart coach-pocketbase diet-pocketbase ielts-pocketbase sleep 5 systemctl status coach-pocketbase diet-pocketbase ielts-pocketbase --no-pager ``` --- ## Fix #2: Consolidate 4 Competing Health Scripts Into 1 > [!WARNING] > Four scripts all restart PocketBase when health fails. They race each other, causing the port collisions in Fix #1. ### Delete the duplicates: ```bash # Remove from root crontab crontab -l | grep -v 'check-pocketbase.sh' | grep -v 'pb-health-check.sh' | crontab - # Remove duplicate cron.d entries sed -i '/promedic-monitor/d' /etc/cron.d/promedic rm -f /etc/cron.d/service-guardian # Keep ONLY one unified script ``` ### The ONE monitoring script to rule them all: ```bash #!/bin/bash # /usr/local/bin/unified-health-monitor.sh # ═══════════════════════════════════════════════════════ # Unified Health Monitor — SINGLE source of truth # Replaces: pb-health-check.sh, check-pocketbase.sh, # service-guardian.sh, promedic-monitor # ═══════════════════════════════════════════════════════ set -uo pipefail LOG="/var/log/unified-health.log" LOCK="/tmp/health-monitor.lock" MAX_LOG_SIZE=5242880 # 5MB # ─── Prevent concurrent runs ─── if [ -f "$LOCK" ]; then pid=$(cat "$LOCK" 2>/dev/null) if kill -0 "$pid" 2>/dev/null; then exit 0 # Another instance running, skip silently fi fi echo $$ > "$LOCK" trap 'rm -f "$LOCK"' EXIT log() { echo "[$(date -Iseconds)] $1" >> "$LOG"; } # ─── Rotate log if too large ─── if [ -f "$LOG" ] && [ "$(stat -f%z "$LOG" 2>/dev/null || stat -c%s "$LOG" 2>/dev/null)" -gt "$MAX_LOG_SIZE" ]; then mv "$LOG" "${LOG}.old" log "Log rotated" fi # ─── Check systemd services ─── SERVICES=("caddy" "ielts-pocketbase" "diet-pocketbase" "coach-pocketbase" "ielts-tts" "ielts-analysis" "telegram-notifier") ISSUES=0 for svc in "${SERVICES[@]}"; do if ! systemctl is-active --quiet "$svc" 2>/dev/null; then log "⚠️ $svc is DOWN. Attempting restart..." systemctl restart "$svc" 2>/dev/null sleep 5 if systemctl is-active --quiet "$svc"; then log "✅ $svc recovered" else log "❌ $svc FAILED to restart" ((ISSUES++)) fi fi done # ─── Check PocketBase HTTP health ─── PB_INSTANCES="8090:ielts-pocketbase 8091:diet-pocketbase 8092:coach-pocketbase" for entry in $PB_INSTANCES; do IFS=':' read -r port service <<< "$entry" HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" \ --max-time 10 "http://127.0.0.1:${port}/api/health" 2>/dev/null || echo "000") if [ "$HTTP_CODE" != "200" ]; then # Don't restart if systemd already restarted above if systemctl is-active --quiet "$service" 2>/dev/null; then log "⚠️ $service running but HTTP $HTTP_CODE on port $port. Restarting..." systemctl restart "$service" 2>/dev/null sleep 8 # ✅ Wait longer than RestartSec (15s would be ideal) fi fi done # ─── Check Docker containers ─── for container in webapp_ielts uptime-kuma; do if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${container}$"; then continue fi log "⚠️ Container $container is down. Restarting..." docker restart "$container" 2>/dev/null ((ISSUES++)) done if [ "$ISSUES" -eq 0 ]; then # Only log OK every 30 minutes (not every 5 min) MINUTE=$(date +%M) if [ "$((MINUTE % 30))" -lt 5 ]; then log "✅ All services healthy" fi fi ``` ### Install the unified script: ```bash # Make executable chmod +x /usr/local/bin/unified-health-monitor.sh # Single crontab entry replaces all 4 cat > /etc/cron.d/unified-monitor << 'EOF' # Unified Health Monitor — runs every 5 minutes # Replaces: pb-health-check, check-pocketbase, service-guardian, promedic-monitor */5 * * * * root /usr/local/bin/unified-health-monitor.sh EOF # Clean up old scripts (don't delete, archive) mkdir -p /root/archived-scripts mv /usr/local/bin/pb-health-check.sh /root/archived-scripts/ 2>/dev/null mv /usr/local/bin/service-guardian.sh /root/archived-scripts/ 2>/dev/null mv /usr/local/bin/health-check.sh /root/archived-scripts/ 2>/dev/null ``` --- ## Fix #3: Fix Weekly Restart Race Condition ### Current (Broken) ```cron # /etc/cron.d/promedic — line 12 0 4 * * 0 root systemctl restart diet-pocketbase coach-pocketbase ``` **Problems:** (1) Runs right after 3AM maintenance, (2) skips IELTS, (3) restarts both simultaneously. ### Fixed Version ```cron # /etc/cron.d/promedic — Weekly graceful restart (staggered) # Restart one at a time with 30s gaps to avoid port collisions 0 5 * * 0 root systemctl restart ielts-pocketbase && sleep 30 && systemctl restart diet-pocketbase && sleep 30 && systemctl restart coach-pocketbase ``` --- ## Fix #4: WAL Checkpoint — Include auxiliary.db ### Current (Incomplete) ```bash # /usr/local/bin/pb-wal-checkpoint.sh for db in .../data.db .../data.db .../data.db; do sqlite3 "$db" "PRAGMA wal_checkpoint(TRUNCATE);" done ``` ### Fixed Version ```bash #!/bin/bash # /usr/local/bin/pb-wal-checkpoint.sh # Checkpoint ALL SQLite databases (data + auxiliary) DATABASES=( "/root/ielts-pocketbase/data/data.db" "/root/ielts-pocketbase/data/auxiliary.db" "/root/diet-pocketbase/pb_data/data.db" "/root/diet-pocketbase/pb_data/auxiliary.db" "/root/coach-pocketbase/pb_data/data.db" "/root/coach-pocketbase/pb_data/auxiliary.db" ) for db in "${DATABASES[@]}"; do if [ -f "$db" ]; then sqlite3 "$db" "PRAGMA wal_checkpoint(TRUNCATE);" 2>/dev/null fi done ``` Fix Guide Part 2: Security & Cleanup **Server:** `46.62.228.173` | **SSH:** `ssh -i ~/.ssh/hetzner_dokploy root@46.62.228.173` --- ## Fix #5: Extract Telegram Bot Tokens from Hooks > [!CAUTION] > Bot tokens are hardcoded in JS files that get backed up to git and restic. Anyone with access sees them. ### Current (Insecure) ```javascript // /root/coach-pocketbase/pb_hooks/premium-features.pb.js $http.send({ url: "https://api.telegram.org/bot8640574098:AAHmn7SCskmlx0M1YUwAy9SaNZyA9qjHkpM/sendMessage", method: "POST", // ... }); ``` ### Step 1: Create secrets file ```bash cat > /etc/default/pocketbase-secrets << 'EOF' # Telegram Bot Configuration COACH_DIET_BOT_TOKEN=8640574098:AAHmn7SCskmlx0M1YUwAy9SaNZyA9qjHkpM COACH_DIET_CHAT_ID=7674461942 IELTS_BOT_TOKEN=8632182251:AAG338J2hjVR1GESos04VfT9Z1QdqbmBgMk IELTS_CHAT_ID=7674461942 EOF chmod 600 /etc/default/pocketbase-secrets ``` ### Step 2: Add EnvironmentFile to each service ```ini # Add to [Service] section of all 3 PocketBase services: EnvironmentFile=/etc/default/pocketbase-secrets ``` ### Step 3: Update hooks to read from environment ```javascript // /root/coach-pocketbase/pb_hooks/premium-features.pb.js // ✅ Read token from environment variable const BOT_TOKEN = $os.getenv("COACH_DIET_BOT_TOKEN"); const CHAT_ID = $os.getenv("COACH_DIET_CHAT_ID"); $http.send({ url: `https://api.telegram.org/bot${BOT_TOKEN}/sendMessage`, method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ chat_id: CHAT_ID, text: text, parse_mode: "Markdown" }) }); ``` > [!NOTE] > PocketBase v0.25 supports `$os.getenv()` in hooks. This reads the environment variables injected by systemd's `EnvironmentFile`. ### Same pattern for IELTS: ```javascript // /root/ielts-pocketbase/data/pb_hooks/premium-features.pb.js const BOT_TOKEN = $os.getenv("IELTS_BOT_TOKEN"); const CHAT_ID = $os.getenv("IELTS_CHAT_ID"); ``` --- ## Fix #6: IELTS Database Permissions (2-minute fix) ### Current (World-readable) ``` -rw-r--r-- root root data.db ← ANY process can read user data -rw-r--r-- root root auxiliary.db ← ANY process can read sessions ``` ### Fix ```bash chmod 600 /root/ielts-pocketbase/data/*.db* # Verify: ls -la /root/ielts-pocketbase/data/*.db* # Should show: -rw------- (owner only) ``` --- ## Fix #7: Remove .git from All Webroots ### Current (5 exposed repos) ``` /var/www/coach.promedic1.com/.git ← commit history, emails, secrets /var/www/diet-plans/.git /var/www/promedic1.com/.git /var/www/clinical/.git /var/www/super/.git ``` ### Fix ```bash # Remove .git from all web-accessible directories for dir in /var/www/coach.promedic1.com \ /var/www/diet-plans \ /var/www/promedic1.com \ /var/www/clinical \ /var/www/super; do if [ -d "$dir/.git" ]; then rm -rf "$dir/.git" echo "Removed .git from $dir" fi # Also remove .gitignore rm -f "$dir/.gitignore" done ``` ### Also add global Caddy block (defense in depth): Add to the **top** of `/etc/caddy/Caddyfile` before any site blocks: ```caddyfile # Global options — block dangerous files across ALL sites (security_blocks) { @blocked { path /.git /.git/* /.gitignore path /.env /.env.* path /*.bak /*.sql /*.tar /*.tar.gz /*.zip path /docker-compose* /Dockerfile } respond @blocked 404 } ``` Then in each site block add: ```caddyfile coach.promedic1.com { import security_blocks # ... rest of config } ``` --- ## Fix #8: Remove .bak File from Coach Assets ```bash rm -f /var/www/coach.promedic1.com/assets/SocialHub-Bmb5I9MX.js.bak rm -f /var/www/html/index.nginx-debian.html.bak ``` --- ## Fix #9: Fix Restic Backup Non-Existent Path ### Current (Silent failure) ```bash # /usr/local/bin/restic-backup.sh — line referencing ghost path restic backup /root/pb_data/ # ← DOES NOT EXIST ``` ### Fix — Remove the ghost path ```bash # Edit the script and remove/comment the /root/pb_data/ line sed -i 's|/root/pb_data/|# REMOVED: /root/pb_data/ (does not exist)|g' \ /usr/local/bin/restic-backup.sh ``` The correct paths (`/root/ielts-pocketbase/`, `/root/diet-pocketbase/`, `/root/coach-pocketbase/`) are already backed up later in the same script under "live PocketBase." --- ## Fix #10: IELTS Log Rotation ### Current — No rotation, log grows forever ```ini # ielts-pocketbase.service StandardOutput=append:/root/ielts-pocketbase/pocketbase.log StandardError=append:/root/ielts-pocketbase/pocketbase.log ``` ### Fix — Remove file logging, use journald (consistent with Coach/Diet) The fixed service file in Part 1 already removes `StandardOutput` and `StandardError` directives, so logs go to journald like Coach and Diet. ### Alternative — If you want to keep file logging, add logrotate: ```bash cat > /etc/logrotate.d/ielts-pocketbase << 'EOF' /root/ielts-pocketbase/pocketbase.log { daily rotate 7 compress delaycompress missingok notifempty copytruncate size 10M } EOF ``` --- ## Fix #11: Clean Up Unnecessary Bloat ### Remove certbot (Caddy handles TLS) ```bash # Check if certbot is actually managing any certs certbot certificates 2>/dev/null # If empty or all handled by Caddy: apt remove --purge certbot -y 2>/dev/null rm -f /etc/cron.d/certbot ``` ### Disable PHP session cleaner (no PHP apps) ```bash rm -f /etc/cron.d/php ``` --- ## Fix #12: CSP Policy Cleanup for Coach ### Current (Allows unused CDN) ```caddyfile Content-Security-Policy "... script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com; ... connect-src 'self'; ..." ``` Coach uses pre-built Vite bundles — no CDN TailwindCSS needed. Also `connect-src 'self'` is correct since all API calls go to same origin via `/pb/api/`. ### Fixed ```caddyfile Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; connect-src 'self'; img-src 'self' data: https:; frame-ancestors 'none'; base-uri 'self';" ``` > [!TIP] > Remove `https://cdn.tailwindcss.com` from ALL site blocks that don't actually use CDN Tailwind. Only keep it for sites that genuinely load Tailwind from CDN (check each site's `index.html` for `