# ALAI Infrastructure Map & Ops Runbooks

# ALAI Infrastructure Map & Ops Runbooks

**Last updated:** 2026-03-12 | **Author:** John (AI Director)

## 1. Infrastructure Overview

### Azure VM — vm-alai-support

<table id="bkmrk-propertyvalue-ip4.22"><tr><th>Property</th><th>Value</th></tr><tr><td>IP</td><td>4.223.110.181</td></tr><tr><td>Region</td><td>Sweden Central</td></tr><tr><td>Size</td><td>Standard\_B2als\_v2 (2 vCPU, 4GB RAM)</td></tr><tr><td>OS</td><td>Ubuntu 22.04 LTS</td></tr><tr><td>SSH</td><td>`ssh -i ~/.ssh/azure_alai alai-admin@4.223.110.181`</td></tr><tr><td>Resource Group</td><td>rg-alai-support</td></tr><tr><td>Cost</td><td>~$35/mo (Founders Hub credits, expires 2026-11-15)</td></tr><tr><td>Compose</td><td>/opt/alai/docker-compose.yml</td></tr></table>

### ANVIL — Mac Studio M3 Max (Local)

<table id="bkmrk-propertyvalue-roleai"><tr><th>Property</th><th>Value</th></tr><tr><td>Role</td><td>AI inference, product dev, agent orchestration</td></tr><tr><td>Services</td><td>Ollama, Qdrant, Pi-Orchestrator, Telegram, Email, Tool-Shed</td></tr><tr><td>Tunnel</td><td>Cloudflare Tunnel for lobby, api, mc, auth, track, ssh, vnc</td></tr></table>

## 2. Services on Azure VM (16 containers)

<table id="bkmrk-serviceurlcontainer-"><tr><th>Service</th><th>URL</th><th>Container</th></tr><tr><td>BookStack (Wiki)</td><td>docs.basicconsulting.no</td><td>alai-bookstack-1</td></tr><tr><td>Documenso (e-Sign)</td><td>sign.basicconsulting.no</td><td>alai-documenso-1</td></tr><tr><td>Planka (Boards)</td><td>boards.basicconsulting.no</td><td>alai-planka-1</td></tr><tr><td>Vaultwarden</td><td>vault.basicconsulting.no</td><td>alai-vaultwarden-1</td></tr><tr><td>Baikal (CalDAV)</td><td>calendar.basicconsulting.no</td><td>alai-baikal-1</td></tr><tr><td>Grafana</td><td>grafana.basicconsulting.no</td><td>alai-grafana-1</td></tr><tr><td>Prometheus</td><td>prometheus.basicconsulting.no</td><td>alai-prometheus-1</td></tr><tr><td>Paperless-ngx</td><td>archive.basicconsulting.no</td><td>alai-paperless-1</td></tr><tr><td>Caddy (TLS proxy)</td><td>—</td><td>alai-caddy-1</td></tr></table>

## 3. ANVIL Daemons

<table id="bkmrk-daemonlaunchagentscr"><tr><th>Daemon</th><th>LaunchAgent</th><th>Script</th></tr><tr><td>Pi-Orchestrator</td><td>com.john.pi-orchestrator</td><td>~/system/kernel/pi-orchestrator.js</td></tr><tr><td>Telegram Agent</td><td>com.john.telegram-agent</td><td>~/system/tools/telegram-agent.js</td></tr><tr><td>Email Agent</td><td>com.john.email-agent</td><td>~/system/daemons/email-agent.js</td></tr><tr><td>Vault Keeper</td><td>com.john.vault-keeper</td><td>~/system/daemons/vault-keeper.js</td></tr><tr><td>Event Dispatcher</td><td>com.john.event-dispatcher</td><td>~/system/daemons/event-dispatcher.js</td></tr><tr><td>Tool-Shed</td><td>com.john.tool-shed</td><td>~/system/tools/tool-shed.js (:3050)</td></tr></table>

## 4. DNS — Cloudflare

Zone: basicconsulting.no | Zone ID: 4670dbd0acfeab4174ac0d4746d11ea0

<table id="bkmrk-subdomaintargetproxy"><tr><th>Subdomain</th><th>Target</th><th>Proxy</th></tr><tr><td>docs, sign, boards, vault, calendar, grafana, prometheus, archive</td><td>4.223.110.181 (Azure VM)</td><td>Orange cloud</td></tr><tr><td>lobby, lobby-api, api, drop-api, mc, auth, track, ssh, vnc</td><td>Cloudflare Tunnel (ANVIL)</td><td>Orange cloud</td></tr></table>

## 5. Runbooks

### 5.1 Azure VM Full Restart

```
az vm restart -g rg-alai-support -n vm-alai-support
ssh -i ~/.ssh/azure_alai alai-admin@4.223.110.181
cd /opt/alai && docker compose up -d
docker ps  # verify 16 containers
```

### 5.2 Single Service Recovery

```
ssh -i ~/.ssh/azure_alai alai-admin@4.223.110.181
cd /opt/alai && docker compose restart bookstack
docker logs alai-bookstack-1 --tail 50
```

### 5.3 TLS Certificate Issues

Caddy auto-renews. If problems: disable CF proxy temporarily, restart caddy, re-enable proxy.

### 5.4 ANVIL Daemon Recovery

```
launchctl list | grep com.john
launchctl kickstart -k gui/$(id -u)/com.john.pi-orchestrator
tail -50 ~/system/logs/pi-orchestrator.log
```

### 5.5 Database Backup

```
docker exec alai-bookstack-db-1 mysqldump -u bookstack bookstack > bookstack.sql
docker exec alai-planka-db-1 pg_dump -U postgres planka > planka.sql
docker exec alai-documenso-db-1 pg_dump -U documenso documenso > documenso.sql
```

### 5.6 Pi-Orchestrator Not Processing

```
curl http://localhost:8401/status
claude auth status
launchctl kickstart -k gui/$(id -u)/com.john.pi-orchestrator
node ~/system/tools/mc.js list --status open --limit 10
```

### 5.7 Email Agent Not Fetching

```
export NODE_TLS_REJECT_UNAUTHORIZED=0
node ~/system/daemons/email-agent.js --test
tail -20 ~/system/logs/email-agent.log
```

### 5.8 SSH IP Update

```
az network nsg rule update -g rg-alai-support --nsg-name nsg-alai-support \
  -n AllowSSH --source-address-prefixes "NEW_IP"
```

## 6. Security

- All services behind Cloudflare Access (Zero Trust)
- SSH restricted to office IP
- Docker .env (chmod 600) with secrets
- Let's Encrypt TLS on all domains
- Gitleaks pre-commit + CI on all 6 products

## 7. Monthly Cost

<table id="bkmrk-itemcost-azure-vm-%28b"><tr><th>Item</th><th>Cost</th></tr><tr><td>Azure VM (B2als\_v2)</td><td>~$35/mo</td></tr><tr><td>Cloudflare</td><td>Free</td></tr><tr><td>Total</td><td>~$36/mo (Azure Founders Hub credits until Nov 2026)</td></tr></table>