path: root/COMMAND_LOG.md

# Phase 1: Command Execution Log

**Session Date:** 2026-10-29  
**Target Host:** `root@miguelpedro.xyz.br`

---

## 1. Local Workspace Inspection
**Command:**
```bash
ls -la /home/mpedro/Repos/my-infra
```
**Output:**
```text
total 8
drwxr-xr-x  2 mpedro mpedro 4096 Oct 29 11:48 .
drwxr-xr-x 18 mpedro mpedro 4096 Oct 29 11:48 ..
```

---

## 2. VPS OS & Connectivity Check
**Command:**
```bash
ssh -o BatchMode=yes -o ConnectTimeout=10 root@miguelpedro.xyz.br "uname -a; cat /etc/os-release; uptime"
```
**Output:**
```text
Linux dd.vps-kinghost.net 6.12.63+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.63-1 (2025-12-30) x86_64 GNU/Linux
PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
NAME="Debian GNU/Linux"
VERSION_ID="13"
VERSION="13 (trixie)"
VERSION_CODENAME=trixie
DEBIAN_VERSION_FULL=13.7
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT="https://bugs.debian.org/"
 11:49:36 up 53 days, 19:30,  2 users,  load average: 0.01, 0.01, 0.00
```

---

## 3. Nginx Configuration Inspection
**Command:**
```bash
ssh root@miguelpedro.xyz.br '
echo "=== NGINX FILES ==="
find /etc/nginx -maxdepth 3 -ls
echo "=== NGINX CONF ==="
cat /etc/nginx/nginx.conf
echo "=== NGINX SITES-ENABLED ==="
head -n 200 /etc/nginx/sites-enabled/* /etc/nginx/conf.d/* 2>/dev/null
'
```
**Output:**
```text
=== NGINX FILES ===
   397806      4 drwxr-xr-x  10 root     root         4096 Sep 25 22:13 /etc/nginx
   397811      4 -rw-r--r--   1 root     root         2223 Jun 27 17:25 /etc/nginx/koi-win
   397820      4 drwxr-xr-x   2 root     root         4096 Sep 25 22:12 /etc/nginx/sites-enabled
   398212      0 lrwxrwxrwx   1 root     root           45 Sep  7 22:19 /etc/nginx/sites-enabled/miguelpedro.xyz.br -> /etc/nginx/sites-available/miguelpedro.xyz.br
   397993      0 lrwxrwxrwx   1 root     root           34 Sep  7 17:30 /etc/nginx/sites-enabled/default -> /etc/nginx/sites-available/default
   413109      0 lrwxrwxrwx   1 root     root           39 Sep 25 19:52 /etc/nginx/sites-enabled/searxng.conf -> /etc/nginx/sites-available/searxng.conf
   397808      4 -rw-r--r--   1 root     root         1125 Jun 27 17:25 /etc/nginx/fastcgi.conf
   397815      4 -rw-r--r--   1 root     root         1545 Jun 27 17:25 /etc/nginx/nginx.conf
   397814      4 drwxr-xr-x   2 root     root         4096 Jun 27 17:33 /etc/nginx/modules-enabled
   397821      4 drwxr-xr-x   2 root     root         4096 Sep 25 19:28 /etc/nginx/snippets
   397823      4 -rw-r--r--   1 root     root          217 Jun 27 17:25 /etc/nginx/snippets/snakeoil.conf
   397822      4 -rw-r--r--   1 root     root          423 Jun 27 17:25 /etc/nginx/snippets/fastcgi-php.conf
   397812      8 -rw-r--r--   1 root     root         5527 Jun 27 17:25 /etc/nginx/mime.types
   397809      4 -rw-r--r--   1 root     root         2460 Jun 27 17:25 /etc/nginx/fastcgi_params
   413451      4 drwxr-xr-x   2 root     root         4096 Sep 25 22:00 /etc/nginx/default.apps-available
   413452      4 -rw-r--r--   1 root     root          647 Sep 25 22:00 /etc/nginx/default.apps-available/searxng.conf
   397810      4 -rw-r--r--   1 root     root         2837 Jun 27 17:25 /etc/nginx/koi-utf
   397813      4 drwxr-xr-x   2 root     root         4096 Jun 27 17:33 /etc/nginx/modules-available
   397818      4 drwxr-xr-x   2 root     root         4096 Sep 25 22:17 /etc/nginx/sites-available
   398211      4 -rw-r--r--   1 root     root          227 Sep  7 22:18 /etc/nginx/sites-available/miguelpedro.xyz.br
   397819      8 -rw-r--r--   1 root     root         4543 Sep 25 22:11 /etc/nginx/sites-available/default
   413455      4 -rw-r--r--   1 root     root         1570 Oct 27 21:21 /etc/nginx/sites-available/searxng.conf
   413447      8 -rw-r--r--   1 root     root         4432 Sep 25 22:00 /etc/nginx/sites-available/default.bak
   397825      4 -rw-r--r--   1 root     root         3071 Jun 27 17:25 /etc/nginx/win-utf
   397824      4 -rw-r--r--   1 root     root         2067 Jun 27 17:25 /etc/nginx/uwsgi_params
   397816      4 -rw-r--r--   1 root     root         1545 Jun 27 17:25 /etc/nginx/proxy_params
   413453      4 drwxr-xr-x   2 root     root         4096 Sep 25 22:00 /etc/nginx/default.d
   413454      0 lrwxrwxrwx   1 root     root           46 Sep 25 22:00 /etc/nginx/default.d/searxng.conf -> /etc/nginx/default.apps-available/searxng.conf
   397807      4 drwxr-xr-x   2 root     root         4096 Jun 27 17:33 /etc/nginx/conf.d
   397817      4 -rw-r--r--   1 root     root         2038 Jun 27 17:25 /etc/nginx/scgi_params
=== NGINX CONF ===
user www-data;
worker_processes auto;
worker_cpu_affinity auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {
	sendfile on;
	tcp_nopush on;
	types_hash_max_size 2048;
	server_tokens off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_prefer_server_ciphers off;

	access_log /var/log/nginx/access.log;

	gzip on;

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}
=== NGINX SITES-ENABLED ===
==> /etc/nginx/sites-enabled/default <==
server {
        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

	listen 80 default_server;
	listen [::]:80 default_server;

	root /var/www/html;
	index index.html index.htm index.nginx-debian.html;
	server_name _;

	location / {
		try_files $uri $uri/ =404;
	}
}

server {
	root /var/www/html;
	index index.html index.htm index.nginx-debian.html;
    server_name www.miguelpedro.xyz.br miguelpedro.xyz.br; # managed by Certbot

	location / {
		try_files $uri $uri/ =404;
	}

    listen 443 ssl; # managed by Certbot
    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/miguelpedro.xyz.br/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/miguelpedro.xyz.br/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
    if ($host = www.miguelpedro.xyz.br) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    if ($host = miguelpedro.xyz.br) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

	listen 80 ;
	listen [::]:80 ;
    server_name www.miguelpedro.xyz.br miguelpedro.xyz.br;
    return 404; # managed by Certbot
}

==> /etc/nginx/sites-enabled/miguelpedro.xyz.br <==
server {
    listen 80;
    listen [::]:80;

    server_name example.com www.example.com;

    root /var/www/miguelpedro.xyz.br/html;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }
}

==> /etc/nginx/sites-enabled/searxng.conf <==
server {
    server_name searx.miguelpedro.xyz.br;

    # Disable logging for user privacy
    access_log /dev/null;
    error_log  /dev/null;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        uwsgi_pass unix:///usr/local/searxng/run/socket;

        include uwsgi_params;

        uwsgi_param    HTTP_HOST             $host;
        uwsgi_param    HTTP_CONNECTION       $http_connection;

        # see flaskfix.py
        uwsgi_param    HTTP_X_SCHEME         $scheme;

        # see limiter.py
        uwsgi_param    HTTP_X_REAL_IP        $remote_addr;
        uwsgi_param    HTTP_X_FORWARDED_FOR  $proxy_add_x_forwarded_for;
    }

    listen 443 ssl; # managed by Certbot
    listen [::]:443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/searx.miguelpedro.xyz.br/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/searx.miguelpedro.xyz.br/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = searx.miguelpedro.xyz.br) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    listen [::]:80;
    server_name searx.miguelpedro.xyz.br;
    return 404; # managed by Certbot
}
```

---

## 4. Containers, Systemd Services, and SearXNG Processes
**Command:**
```bash
ssh root@miguelpedro.xyz.br '
echo "=== DOCKER / PODMAN ==="
which docker podman 2>&1
docker ps -a 2>/dev/null || true
podman ps -a 2>/dev/null || true
echo "=== SYSTEMD SERVICES (RUNNING) ==="
systemctl list-units --type=service --state=running --no-pager
echo "=== SEARXNG PROCESSES & USERS ==="
ps aux | grep -iE "searx|uwsgi|gunicorn|valkey|redis|nginx"
grep -i searx /etc/passwd /etc/group 2>/dev/null || true
'
```
**Output:**
```text
=== DOCKER / PODMAN ===
=== SYSTEMD SERVICES (RUNNING) ===
  UNIT                          LOAD   ACTIVE SUB     DESCRIPTION
  cron.service                  loaded active running Regular background program processing daemon
  dbus.service                  loaded active running D-Bus System Message Bus
  getty@tty1.service            loaded active running Getty on tty1
  nginx.service                 loaded active running A high performance web server and a reverse proxy server
  serial-getty@hvc0.service     loaded active running Serial Getty on hvc0
  ssh.service                   loaded active running OpenBSD Secure Shell server
  systemd-journald.service      loaded active running Journal Service
  systemd-logind.service        loaded active running User Login Management
  systemd-timesyncd.service     loaded active running Network Time Synchronization
  systemd-udevd.service         loaded active running Rule-based Manager for Device Events and Files
  user@0.service                loaded active running User Manager for UID 0
  uwsgi.service                 loaded active running LSB: Start/stop uWSGI server instance(s)
  valkey-server.service         loaded active running Advanced key-value store
  xe-linux-distribution.service loaded active running LSB: Virtual Machine daemon providing host integration services

14 loaded units listed.
=== SEARXNG PROCESSES & USERS ===
root      790020  0.0  0.0   7176  2684 ?        Ss   Sep25   0:00 SCREEN -S searx -- sudo -H -u searxng -i
root      790021  0.0  0.2  22076  9852 pts/1    Ss+  Sep25   0:00 sudo -H -u searxng -i
root      790023  0.0  0.0  22076  2872 pts/2    Ss   Sep25   0:00 sudo -H -u searxng -i
searxng   790024  0.0  0.1   9040  6176 pts/2    S+   Sep25   0:00 -bash
valkey    791257  0.2  0.4  82992 17544 ?        Ssl  Sep25 114:21 /usr/bin/valkey-server 127.0.0.1:6379
root      792532  0.0  0.2  26324  8596 ?        Ss   Sep25   0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
searxng  1976899  0.0  0.3  33392 14516 ?        S    Oct27   0:07 /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/searxng.ini --daemonize /var/log/uwsgi/app/searxng.log
searxng  1976907  0.5  5.7 1120264 230328 ?      Sl   Oct27  12:41 /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/searxng.ini --daemonize /var/log/uwsgi/app/searxng.log
searxng  1976909  0.6  5.3 1177624 215760 ?      Sl   Oct27  14:07 /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/searxng.ini --daemonize /var/log/uwsgi/app/searxng.log
www-data 1976915  0.0  0.3  30464 15108 ?        S    Oct27   0:02 nginx: worker process
www-data 1976916  0.0  0.3  30064 14700 ?        S    Oct27   0:02 nginx: worker process
/etc/passwd:searxng:x:988:988:Privacy-respecting metasearch engine:/usr/local/searxng:/bin/bash
/etc/group:sudo:x:27:searxng
/etc/group:searxng:x:988:
```

---

## 5. Firewall, Listening Ports, and TLS Certificates
**Command:**
```bash
ssh root@miguelpedro.xyz.br '
echo "=== UFW / IPTABLES / NFTABLES ==="
which ufw iptables nft 2>&1
ufw status verbose 2>/dev/null || true
iptables -L -n -v 2>/dev/null || true
nft list ruleset 2>/dev/null || true
echo "=== PORTS LISTENING ==="
ss -tulpn
echo "=== CERTBOT / LETSENCRYPT ==="
which certbot acme.sh 2>&1
certbot certificates 2>/dev/null || true
ls -la /etc/letsencrypt/live/ 2>/dev/null || true
systemctl list-timers --no-pager
'
```
**Output:**
```text
=== UFW / IPTABLES / NFTABLES ===
/usr/sbin/nft
=== PORTS LISTENING ===
Netid State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
tcp   LISTEN 0      511        127.0.0.1:6379      0.0.0.0:*    users:(("valkey-server",pid=791257,fd=8))
tcp   LISTEN 0      128          0.0.0.0:22        0.0.0.0:*    users:(("sshd",pid=8328,fd=6))
tcp   LISTEN 0      511          0.0.0.0:80        0.0.0.0:*    users:(("nginx",pid=1976916,fd=6),("nginx",pid=1976915,fd=6),("nginx",pid=792532,fd=6))
tcp   LISTEN 0      511          0.0.0.0:443       0.0.0.0:*    users:(("nginx",pid=1976916,fd=8),("nginx",pid=1976915,fd=8),("nginx",pid=792532,fd=8))
tcp   LISTEN 0      128             [::]:22           [::]:*    users:(("sshd",pid=8328,fd=7))
tcp   LISTEN 0      511             [::]:80           [::]:*    users:(("nginx",pid=1976916,fd=7),("nginx",pid=1976915,fd=7),("nginx",pid=792532,fd=7))
tcp   LISTEN 0      511             [::]:443          [::]:*    users:(("nginx",pid=1976916,fd=9),("nginx",pid=1976915,fd=9),("nginx",pid=792532,fd=9))
tcp   LISTEN 0      511            [::1]:6379         [::]:*    users:(("valkey-server",pid=791257,fd=9))
=== CERTBOT / LETSENCRYPT ===
/usr/bin/certbot

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: miguelpedro.xyz.br
    Serial Number: 6a472cb5bc749aaaee4dfa3e4c3b0853061
    Key Type: ECDSA
    Domains: miguelpedro.xyz.br www.miguelpedro.xyz.br
    Expiry Date: 2026-12-07 00:29:40+00:00 (VALID: 38 days)
    Certificate Path: /etc/letsencrypt/live/miguelpedro.xyz.br/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/miguelpedro.xyz.br/privkey.pem
  Certificate Name: searx.miguelpedro.xyz.br
    Serial Number: 56f57df7717f294cc377199fce636ebca33
    Key Type: ECDSA
    Domains: searx.miguelpedro.xyz.br
    Expiry Date: 2026-12-25 00:14:43+00:00 (VALID: 56 days)
    Certificate Path: /etc/letsencrypt/live/searx.miguelpedro.xyz.br/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/searx.miguelpedro.xyz.br/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
total 20
drwx------ 4 root root 4096 Sep 25 22:13 .
drwxr-xr-x 7 root root 4096 Oct 29 11:49 ..
drwxr-xr-x 2 root root 4096 Sep  7 22:28 miguelpedro.xyz.br
-rw-r--r-- 1 root root  740 Sep  7 22:28 README
drwxr-xr-x 2 root root 4096 Sep 25 22:13 searx.miguelpedro.xyz.br
NEXT                            LEFT LAST                              PASSED UNIT                         ACTIVATES
Thu 2026-10-29 14:22:48 -03 2h 32min Thu 2026-10-29 05:12:54 -03       6h ago apt-daily.timer              apt-daily.service
Thu 2026-10-29 16:25:12 -03 4h 35min Thu 2026-10-29 01:34:23 -03      10h ago certbot.timer                certbot.service
Thu 2026-10-29 16:47:14 -03 4h 57min Wed 2026-10-28 16:47:14 -03      19h ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Fri 2026-10-30 00:00:00 -03      12h Thu 2026-10-29 00:00:11 -03      11h ago dpkg-db-backup.timer         dpkg-db-backup.service
Fri 2026-10-30 00:25:43 -03      12h Thu 2026-10-29 00:13:23 -03      11h ago logrotate.timer              logrotate.service
Fri 2026-10-30 06:02:52 -03      18h Thu 2026-10-29 06:28:46 -03 5h 21min ago apt-daily-upgrade.timer      apt-daily-upgrade.service
Fri 2026-10-30 11:09:18 -03      23h Thu 2026-10-29 10:31:41 -03 1h 18min ago man-db.timer                 man-db.service
Sun 2026-11-01 03:10:31 -03   2 days Sun 2026-10-25 03:10:14 -03   4 days ago e2scrub_all.timer            e2scrub_all.service
Mon 2026-11-02 00:12:12 -03   3 days Mon 2026-10-26 01:17:14 -03   3 days ago fstrim.timer                 fstrim.service
```

---

## 6. SearXNG, uWSGI, and Git Installation Details
**Command:**
```bash
ssh root@miguelpedro.xyz.br '
echo "=== /etc/nginx/default.apps-available/searxng.conf ==="
cat /etc/nginx/default.apps-available/searxng.conf
echo "=== /etc/searxng ==="
ls -la /etc/searxng 2>/dev/null || true
cat /etc/searxng/* 2>/dev/null || true
echo "=== /etc/uwsgi ==="
find /etc/uwsgi -ls 2>/dev/null || true
cat /etc/uwsgi/apps-available/* /etc/uwsgi/apps-enabled/* 2>/dev/null || true
echo "=== /usr/local/searxng ==="
ls -la /usr/local/searxng /usr/local/searxng/* 2>/dev/null || true
echo "=== SEARXNG GIT INFO ==="
git -C /usr/local/searxng/searxng-src status 2>/dev/null || true
git -C /usr/local/searxng/searxng-src remote -v 2>/dev/null || true
git -C /usr/local/searxng/searxng-src log -n 1 2>/dev/null || true
'
```
**Output:**
```text
=== /etc/nginx/default.apps-available/searxng.conf ===
location /searxng {

    uwsgi_pass unix:///usr/local/searxng/run/socket;

    include uwsgi_params;

    uwsgi_param    HTTP_HOST             $host;
    uwsgi_param    HTTP_CONNECTION       $http_connection;

    # see flaskfix.py
    uwsgi_param    HTTP_X_FORWARDED_PROTO  $scheme;
    uwsgi_param    HTTP_X_SCRIPT_NAME    /searxng;

    # see botdetection/trusted_proxies.py
    uwsgi_param    HTTP_X_REAL_IP        $remote_addr;
    uwsgi_param    HTTP_X_FORWARDED_FOR  $proxy_add_x_forwarded_for;
}

=== /etc/searxng ===
total 16
drwxr-xr-x  2 root    root    4096 Oct 27 21:21 .
drwxr-xr-x 78 root    root    4096 Sep 25 22:00 ..
-rw-r--r--  1 searxng searxng 1458 Oct 27 21:21 limiter.toml
-rw-r-----  1 searxng searxng  486 Oct 27 21:21 settings.yml

# limiter.toml:
[botdetection]
ipv4_prefix = 32
ipv6_prefix = 48
trusted_proxies = [
  '127.0.0.0/8',
  '::1',
]
[botdetection.ip_limit]
filter_link_local = false
link_token = false
[botdetection.ip_lists]
block_ip = []
pass_ip = []
pass_searxng_org = true

# settings.yml:
use_default_settings: true

general:
  debug: false
  instance_name: "SearXNG"

search:
  safe_search: 0
  autocomplete: "duckduckgo"
  formats:
    - html
    - json

server:
  # Is overwritten by ${SEARXNG_SECRET}
  secret_key: "5e12306a0b0172e7b1c417f0b65320ac"
  limiter: true
  image_proxy: true
  base_url: https://searx.miguelpedro.xyz.br/

valkey:
  # URL to connect valkey database. Is overwritten by ${SEARXNG_VALKEY_URL}.
  url: valkey://localhost:6379/0

=== /etc/uwsgi ===
/etc/uwsgi/apps-enabled/searxng.ini -> /etc/uwsgi/apps-available/searxng.ini
[uwsgi]
uid = searxng
gid = searxng
env = LANG=C.UTF-8
env = LANGUAGE=C.UTF-8
env = LC_ALL=C.UTF-8
chdir = /usr/local/searxng/searxng-src/searx
env = SEARXNG_SETTINGS_PATH=/etc/searxng/settings.yml
disable-logging = true
chmod-socket = 666
single-interpreter = true
master = true
lazy-apps = true
plugin = python3,http
enable-threads = true
workers = %k
threads = 4
module = searx.webapp
virtualenv = /usr/local/searxng/searx-pyenv
pythonpath = /usr/local/searxng/searxng-src
socket = /usr/local/searxng/run/socket
buffer-size = 8192
offload-threads = %k

=== /usr/local/searxng ===
drwxr-xr-x 2 searxng searxng 4096 Oct 27 21:21 run (contains srw-rw-rw- 1 www-data root 0 socket)
drwxrwxr-x 15 searxng searxng 4096 Oct 27 21:20 searxng-src
drwxrwxr-x 5 searxng searxng 4096 Sep 25 21:58 searx-pyenv

=== SEARXNG GIT INFO ===
On branch master (origin: https://github.com/searxng/searxng)
commit b5ed73fcb6c6bda5d4e8b13d1472aa3917f784dc (Tue Oct 27 21:33:35 2026 +0100)
```

---

## 7. Valkey, Web Roots, Certbot Renewal, Systemd Units, and Packages
**Command:**
```bash
ssh root@miguelpedro.xyz.br '
echo "=== VALKEY CONFIG ==="
grep -vE "^#|^$" /etc/valkey/valkey.conf 2>/dev/null || true
echo "=== /var/www ==="
find /var/www -maxdepth 3 -ls 2>/dev/null || true
echo "=== /etc/letsencrypt/renewal ==="
head -n 100 /etc/letsencrypt/renewal/* /etc/letsencrypt/options-ssl-nginx.conf 2>/dev/null || true
echo "=== CRONTABS & SYSTEMD CUSTOM UNITS ==="
crontab -l 2>/dev/null || true
ls -la /etc/cron* /var/spool/cron/crontabs 2>/dev/null || true
find /etc/systemd/system -maxdepth 2 -ls 2>/dev/null || true
echo "=== APT MANUAL PACKAGES ==="
apt-mark showmanual
'
```
**Output:**
```text
=== VALKEY CONFIG ===
bind 127.0.0.1 -::1
protected-mode yes
port 6379
daemonize yes
pidfile /run/valkey/valkey-server.pid
logfile /var/log/valkey/valkey-server.log
dir /var/lib/valkey
(standard Debian Valkey configuration)

=== /var/www ===
     1922      4 drwxr-xr-x   4 root     root         4096 Sep  7 22:19 /var/www
      805      4 drwxr-xr-x   3 root     root         4096 Sep  7 22:19 /var/www/miguelpedro.xyz.br
      888      4 drwxr-sr-x   2 root     www-data     4096 Sep  7 22:19 /var/www/miguelpedro.xyz.br/html
     1925      4 drwxr-xr-x   2 root     root         4096 Sep  7 17:30 /var/www/html
     1928      4 -rw-r--r--   1 root     root          615 Sep  7 17:30 /var/www/html/index.nginx-debian.html

=== /etc/letsencrypt/renewal ===
- miguelpedro.xyz.br.conf (authenticator = nginx, installer = nginx, key_type = ecdsa)
- searx.miguelpedro.xyz.br.conf (authenticator = nginx, installer = nginx, key_type = ecdsa)

=== APT MANUAL PACKAGES (Key Non-Base Packages) ===
build-essential, certbot, git, libffi-dev, libssl-dev, libxslt1-dev, nftables, nginx,
python-is-python3, python3, python3-babel, python3-certbot-nginx, python3-dev,
python3-venv, screen, shellcheck, uwsgi, uwsgi-plugin-python3, valkey-server, zlib1g-dev
```

---

## 8. Nftables, Web Root Files, uWSGI Defaults, and Sudoers
**Command:**
```bash
ssh root@miguelpedro.xyz.br '
echo "=== /etc/nftables.conf ==="
cat /etc/nftables.conf 2>/dev/null || true
systemctl status nftables 2>/dev/null || true
echo "=== /var/www files ==="
head -n 50 /var/www/html/* /var/www/miguelpedro.xyz.br/html/* 2>/dev/null || true
echo "=== /etc/default/uwsgi ==="
cat /etc/default/uwsgi 2>/dev/null || true
echo "=== /usr/local/searxng/.profile ==="
cat /usr/local/searxng/.profile 2>/dev/null || true
echo "=== /etc/sudoers.d ==="
ls -la /etc/sudoers.d/
cat /etc/sudoers.d/* 2>/dev/null || true
'
```
**Output:**
```text
=== /etc/nftables.conf ===
Default empty filter chains (input, forward, output).
nftables.service is loaded but inactive (dead).

=== /var/www files ===
/var/www/html/index.nginx-debian.html (standard Nginx welcome page)
/var/www/miguelpedro.xyz.br/html (empty directory)

=== /etc/default/uwsgi ===
VERBOSE=yes
PRINT_CONFNAMES_IN_INITD_SCRIPT_OUTPUT=no
INHERITED_CONFIG=/usr/share/uwsgi/conf/default.ini

=== /usr/local/searxng/.profile ===
Standard ~/.profile with `source /usr/local/searxng/searx-pyenv/bin/activate` appended at the end.

=== /etc/sudoers.d ===
Only README present.
```


---

## 9. Phase 3: Ansible IaC Verification Dry-Run (`--check --diff`)
**Command:**
```bash
.venv/bin/ansible-playbook site.yml --check --diff
```
**Output Summary:**
```text
PLAY RECAP *********************************************************************
vps : ok=28 changed=3 unreachable=0 failed=0 skipped=6 rescued=0 ignored=0
```
- **Verified 1:1 match (`ok`):** `common` packages, `certbot` timer & certs, `valkey` service, `searxng` user/group/dirs/git/settings.yml/limiter.toml/uwsgi.ini, `nginx.conf`, `default.apps-available/searxng.conf`, and `sites-available/searxng.conf`.
- **Expected cleanups flagged (`changed`):** Removing unused `/etc/nginx/sites-enabled/miguelpedro.xyz.br` stub symlink (`example.com`) and trailing blank lines in `/etc/nginx/sites-available/default`.


---

## 10. cgit & fcgiwrap Deployment and Verification (2026-10-29)
**Pre-flight Check:**
```bash
.venv/bin/ansible-playbook site.yml --check --diff
```
**Output:** `ok=27 changed=0 failed=0`

**Apply `cgit` Role:**
```bash
.venv/bin/ansible-playbook site.yml --tags "cgit" --diff
```
**Output:** `ok=18 changed=16 failed=0` (Installed `cgit`, `fcgiwrap`, `python3-docutils`, `python3-markdown`, `python3-pygments`; created `git` user/group `999:989`; added `www-data` to `git` group; configured `/srv/git` with `02750` and `git-shell-commands`; deployed `/etc/cgitrc` and `/etc/nginx/sites-available/cgit.conf`; reloaded `nginx` and restarted `fcgiwrap`).

**Health & SSH Verification:**
```bash
ssh root@miguelpedro.xyz.br '
curl -s -i -H "Host: git.miguelpedro.xyz.br" http://127.0.0.1/ | head -n 35
curl -s -I -H "Host: git.miguelpedro.xyz.br" http://127.0.0.1/cgit-css/cgit.css
id git; id www-data
'
ssh -o BatchMode=yes git@miguelpedro.xyz.br list
```
**Output:**
- `http://127.0.0.1/` (`Host: git.miguelpedro.xyz.br`) returned `cgit v1.2.3` HTML (`Miguel Pedro Git Repositories`).
- `/cgit-css/cgit.css` returned `HTTP/1.1 200 OK` (`text/css`, `15112` bytes).
- `uid=999(git) gid=989(git)`, `uid=33(www-data) gid=33(www-data) groups=33(www-data),989(git)`.
- `ssh git@miguelpedro.xyz.br list` connected cleanly via `git-shell` with exit code `0`.

**Post-Apply Idempotency Check:**
```bash
.venv/bin/ansible-playbook site.yml --check --diff
```
**Output:** `ok=42 changed=0 unreachable=0 failed=0 skipped=0`