Initial docs: alpha.jayfield.org server documentation

Records the host's service inventory, setup runbook, mail account list,
sync plan, package diff vs. clean install, and hardening TODOs, including
today's SSH hardening (key-only, no root login) and the fail2ban sshd
findtime fix for a low-and-slow brute-force evasion pattern.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RdTyvEJkfNLDVAWt8WQ6X9

SYNC-PLAN.md

@@ -0,0 +1,111 @@
+# alpha.jayfield.org — Intranet Sync Plan (vlda-01 → alpha)
+
+**Status: planning only, nothing implemented yet.** This is a point-in-time
+plan for later reference, not a live inventory (`README.md` is the live
+inventory) and not a build runbook (`SETUP.md` is that). Update this file
+as decisions get made and pieces get built; move finished work into
+`README.md` once it's live, the way the KeePass/Nextcloud migration did.
+
+## Problem
+
+`vlda-01` (home intranet server, behind a home LAN, not 24/7 online) hosts
+four things the household wants reliably available: plain files, Gitea,
+Jellyfin, and a Dogecoin node/wallet used for daily transaction catchup.
+Goal: use `alpha.jayfield.org` (public, 24/7, already running Docker +
+Nextcloud) as the always-available side, without reproducing the failure
+mode that got the old setup removed.
+
+**Why not just revive the old WireGuard tunnel + CIFS mount** (see
+`README.md`'s "Previously resolved" history — `alpha_at_moon` tunnel +
+`192.168.22.0/24` CIFS mount, purged 2026-07-19, configs backed up to
+`/root/removed-configs-backup/` if ever needed as a reference): that setup
+required `vlda-01` to be reachable *at the moment alpha wanted the data* —
+a live mount. That's structurally incompatible with "not 24/7 online." Each
+service below instead either pulls data to alpha ahead of time or migrates
+outright, so alpha's availability stops depending on vlda-01's.
+
+## Per-service plan
+
+### 1. Files → Syncthing
+
+- Syncthing container on alpha, data lands at `/srv/intranet-data/<folder>`
+  (host-inspectable, matching the `/srv/nextcloud/data` pattern). Admin GUI
+  bound to `127.0.0.1:8384`, reverse-proxied through Apache like
+  Portainer/Nextcloud — never expose the setup UI directly.
+- Syncthing client on `vlda-01` dials **out** to alpha — no inbound port
+  forwarding needed at home, unlike the old tunnel. Catches up automatically
+  whenever vlda-01 gets power + internet.
+- Direction: start **send-only from vlda-01 → receive-only on alpha**
+  (vlda-01 stays authoritative, alpha is a live mirror). Revisit bidirectional
+  later once trusted.
+- Firewall: open `22000/tcp` + `21027/udp` on alpha for Syncthing.
+- Expose via Nextcloud: enable the built-in `files_external` app, mount
+  `/srv/intranet-data/<folder>` as local external storage — same web UI
+  (`cloud.jayfield.org`) already used for the KeePass vaults.
+
+**Status: not started.**
+
+### 2. Gitea → full migration, not sync
+
+Just repos + a small DB — no reason to keep this tied to vlda-01's uptime.
+
+- Stop the Gitea container on vlda-01, copy its data volume (repos + DB +
+  config) to alpha.
+- Bring it up on alpha as a permanent container, following the exact
+  pattern already used for `web`/`cloud.jayfield.org`: publish to
+  `127.0.0.1:<port>` → Apache vhost (`git.jayfield.org`) → `certbot --apache`.
+- Decommission or keep vlda-01's copy as a cold backup, admin's choice.
+
+**Status: not started. No open questions — ready to build when wanted.**
+
+### 3. Jellyfin → scoping question, not yet planned
+
+Media libraries are often hundreds of GB to multiple TB, and local hardware
+transcoding at home may not have an equivalent on the VPS. Before sketching
+an approach, need:
+
+- Approximate library size.
+- Is the actual goal *remote* streaming (away from home), or is Jellyfin
+  only ever watched on the home LAN? If the latter, migrating buys nothing —
+  Jellyfin only needs to be up when someone's actually watching, which is
+  whenever vlda-01 would be on anyway. If remote access is wanted, next step
+  is sizing alpha's disk/bandwidth budget for it.
+
+**Status: blocked on the above — no plan yet.**
+
+### 4. Dogecoin node/wallet → security-conscious split, needs sign-off
+
+**Do not migrate the wallet wholesale without explicit confirmation.** Per
+the attacker report (`SendUserFile`'d 2026-07-19), this host takes on the
+order of 10,000 automated SSH/scan attempts a month. Putting spending keys
+on the same public, constantly-probed box is a materially different risk
+than at home.
+
+Recommended design:
+- Run `dogecoind` on alpha as a Docker container with **`disablewallet=1`**
+  — blockchain sync only, no private keys, no funds at risk. Stays
+  permanently caught up with the network regardless of vlda-01's uptime.
+- Keep the actual wallet (`wallet.dat`, spending keys) only on vlda-01.
+  Point vlda-01's `dogecoin-cli`/GUI at alpha's node as its backend
+  (`-connect=`), with RPC reachable **only** over an authenticated tunnel
+  (SSH-forwarded or WireGuard) — never bind RPC to a public interface; an
+  open Dogecoin RPC port is exactly the kind of thing scanners probe for.
+- Result: "daily transaction catchup" becomes near-instant once vlda-01
+  turns on, since the chain is already synced — without private keys ever
+  touching the internet-facing box.
+
+**Open question, needs the user's explicit answer before implementing**:
+go with the wallet-split design above, or is the fund exposure small enough
+to just run the wallet on alpha too, for simplicity? Do not proceed with
+either without confirmation — this is the one piece of this plan with real
+financial/security stakes.
+
+## Suggested build order
+
+1. Gitea (no open questions, most self-contained, validates the general
+   "migrate a dockerized service to alpha + Apache vhost" pattern).
+2. Files via Syncthing (validates the intermittent-sync approach before
+   trusting it with anything else).
+3. Dogecoin node — **only after explicit sign-off on the wallet-split
+   question above.**
+4. Jellyfin — **only after the scoping question above is answered.**