---
description: SSH, Mikrotik, deploy scripts, dan konfigurasi server
globs: scripts/**/*,server/**/*
alwaysApply: false
---

# Infrastructure & Scripts

## PowerShell scripts (`scripts/`)

| Script | Fungsi |
|--------|--------|
| `setup-ssh-mikrotik.ps1` | Daftar SSH key ke Mikrotik (default RSA) |
| `ssh-mikrotik.ps1` | Login Mikrotik tanpa password |
| `ssh-remote.ps1` | SSH ke reverse proxy 10.100.1.24 |
| `deploy-geonet-console.ps1` | Build + deploy geonet-console |
| `deploy-databaselist.ps1` | Build + deploy databaselist |
| `apply-*-mikrotik.ps1` | Terapkan konfig RouterOS |

## Mikrotik

- Port SSH: **255**, MAC: `hmac-sha1`
- RouterOS 7.5: user key **RSA** (`id_rsa_mikrotik`), ed25519 butuh 7.12+
- Import key: upload `.pub` via SCP lalu `/user ssh-keys import`
- Konfig: `server/mikrotik-*.rsc`, checklist: `server/mikrotik-*-checklist.txt`
- Backup sebelum apply: simpan di `server/`

## SSH Key-based Access (tanpa password)

SSH private key sudah dikonfigurasi di laptop user. Agent BOLEH propose SSH command untuk setup/deploy — WAJIB minta persetujuan user, tidak boleh auto-run SSH yang bersifat destructive.

| Server | SSH Command |
|--------|-------------|
| Reverse proxy `10.100.1.24` | `ssh -m hmac-sha1 root@10.100.1.24 -p 22` |
| Main Database `10.100.1.25` | `ssh -m hmac-sha1 root@10.100.1.25 -p 22` |
| AD-LDAP `10.100.1.40` | `ssh -m hmac-sha1 Administrator@10.100.1.40 -p 22` |
| Zabbix `10.100.1.42` | `ssh -m hmac-sha1 root@10.100.1.42 -p 22` |
| Ollama `10.100.1.26` | `ssh -i "$env:USERPROFILE\.ssh\id_rsa_geonet_laptop" -o IdentitiesOnly=yes -m hmac-sha1 root@10.100.1.26 -p 22` |
| NAS QNAP `10.100.1.10` | `ssh -i "$env:USERPROFILE\.ssh\id_ed25519" -o IdentitiesOnly=yes admin@10.100.1.10 -p 22` |

> Ollama & QNAP: Wajib PowerShell (bukan CMD).
> Remote command: `ssh -m hmac-sha1 root@10.100.1.24 -p 22 "perintah"` — single line.

## Server audit

- Simpan hasil audit ke `server/<hostname>_audit.txt`
- Referensi host: `server/host.txt`, `readme.txt`

## Deploy remote

1. Sync kode ke server (tanpa `.env`)
2. `docker compose build` + `up -d` di `/opt/stacks/<app>/`
3. Verifikasi: `docker ps`, curl URL produksi

## Safety

- Backup `.rsc` sebelum ubah Mikrotik
- Rollback script tersedia: `rollback-single-wan-mikrotik.ps1`, `restore-failover-phase1-mikrotik.ps1`
- Jangan commit secret, key private, atau password