From f2a979f047b4fe6fefb78511feb11c9a13d08a25 Mon Sep 17 00:00:00 2001 From: Ivan Godwin Date: Wed, 2 Sep 2026 23:06:44 -0700 Subject: [PATCH] Add MIT LICENSE and a per-file as-is notice The repo is public and files are fetched by raw URL, so a reader who lands on one runbook never sees the README -- the repo's context does not travel with the file. Each .md now carries two lines under the title, each .ps1 the equivalent at the end of its .NOTES block. Deliberately two lines, not a paragraph. These files are read through `| more` on a client console mid-incident, and the top of the file is where the procedure-specific warnings live -- never a live chart, stop the service before copying, confirm authorization before acting. A legal preamble above those competes with them and trains people to skip past. Wording aims at a stranger who found the repo, not at the quality of the procedure: these double as documented-procedure evidence for E&O, and language implying the content is unreliable works against that. MIT rather than no license: the warranty and liability disclaimer is the part that does the work, and leaving it unlicensed makes reuse ambiguous rather than disclaimed. Also fixes 5 stale ops/rb URLs in scripts/*.ps1 that the previous commit missed -- it only swept the .md files. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7 --- CONTRIBUTING.md | 19 +++++++++++++++++++ LICENSE | 21 +++++++++++++++++++++ README.md | 7 +++++-- od-backup-schedule.md | 3 +++ od-backup-verify.md | 3 +++ od-cfg-persist.md | 3 +++ od-db-backup.md | 3 +++ od-scan-duplex.md | 3 +++ od-smb-cred.md | 3 +++ scripts/_template.ps1 | 6 +++++- scripts/cg-disable.ps1 | 6 +++++- scripts/od-backup-check.ps1 | 6 +++++- scripts/od-cfg-acl.ps1 | 6 +++++- scripts/od-db-backup.ps1 | 6 +++++- sec-google-compromise.md | 3 +++ sec-google-evidence.md | 3 +++ 16 files changed, 94 insertions(+), 7 deletions(-) create mode 100644 LICENSE diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 18c569a..eb31541 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -51,3 +51,22 @@ Scripts live under `scripts/`. Follow [`scripts/_template.ps1`](scripts/_templat - Safe to run via `irm | iex` from our own server. - Confirm before anything destructive or that reboots. - Check for admin explicitly (`#Requires` is not enforced under `iex`). + +## The as-is notice + +Every runbook and script carries a short as-is notice — two lines under the `#` +title in a `.md`, or at the end of the `.NOTES` block in a `.ps1`. Copy it when +you add a file. + +It is per-file rather than README-only for one reason: these are fetched by raw +URL, so a reader who lands on a single runbook never sees the README or the +LICENSE. The repo's context does not travel with the file. + +Keep it to those two lines. It sits above genuinely important, procedure-specific +warnings — never a live chart, stop the service before copying, confirm +authorization before acting — and a longer legal preamble would train people to +skip the top of the file, which is exactly where those warnings live. + +Aim it at a stranger who found the repo, not at the quality of the procedure. +These runbooks double as documented-procedure evidence; wording that implies the +content is unreliable works against that. diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..8aa1ef2 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Godwin Systems LLC + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index f40b941..cb1be3c 100644 --- a/README.md +++ b/README.md @@ -9,8 +9,11 @@ client workstations during on-site work with short, hand-typeable commands. > screenshots. Procedures with placeholders **only**. See > [CONTRIBUTING.md](CONTRIBUTING.md) for the sanitization rule. -> Provided as-is, no warranty. Running any script is at your own risk. Contains -> no client-identifying data by policy. +> For qualified IT professionals, on systems they are authorized to administer. +> Provided as-is, without warranty — verify anything here fits your environment +> before running it. Scripts execute in your own session via `iex`; read them +> first. Licensed under [MIT](LICENSE). Contains no client-identifying data by +> policy. ## Using a runbook diff --git a/od-backup-schedule.md b/od-backup-schedule.md index 21db678..acab298 100644 --- a/od-backup-schedule.md +++ b/od-backup-schedule.md @@ -1,5 +1,8 @@ # Runbook: Open Dental — Schedule & monitor backups (Windows) +> For qualified IT professionals, on systems they are authorized to administer. +> Provided as-is, without warranty — verify it fits your environment. See LICENSE. + **Applies to:** The Open Dental database server, once [`od-db-backup.md`](od-db-backup.md) is proven to run by hand. **Goal:** Make the backup run **automatically every day**, replicate it **off-site**, and **monitor** it so a silent failure gets noticed within a day — not the day you need a restore. diff --git a/od-backup-verify.md b/od-backup-verify.md index 816ccc7..eb42a93 100644 --- a/od-backup-verify.md +++ b/od-backup-verify.md @@ -1,5 +1,8 @@ # Runbook: Open Dental — Verify a backup by test-restoring into an isolated Hyper-V VM +> For qualified IT professionals, on systems they are authorized to administer. +> Provided as-is, without warranty — verify it fits your environment. See LICENSE. + **Applies to:** Any Open Dental cold backup produced by [`od-db-backup.md`](od-db-backup.md) (an `od-backup-` folder holding `data\`, `OpenDentImages\`, `FreeDentalConfig.xml`, `MANIFEST.txt`). **Goal:** Prove a backup is actually restorable and complete by restoring it into a **throwaway, network-isolated Hyper-V virtual machine** and running a short health checklist. A backup you have never restored is a guess. diff --git a/od-cfg-persist.md b/od-cfg-persist.md index bd634f5..ef640d1 100644 --- a/od-cfg-persist.md +++ b/od-cfg-persist.md @@ -1,5 +1,8 @@ # Runbook: Open Dental — Persist "Do not show this window on startup" +> For qualified IT professionals, on systems they are authorized to administer. +> Provided as-is, without warranty — verify it fits your environment. See LICENSE. + **Applies to:** Windows workstation where Open Dental is run by a standard (non-admin) user. **Symptom:** The **Choose Database** window appears on every launch even though **"Do not show this window on startup (this computer only)"** is checked. The checkbox appears to take but does not survive a restart. **Root cause:** The setting is stored in `FreeDentalConfig.xml` in the Open Dental install directory. Standard users lack write permission to that directory, so the change is never saved. Per Open Dental's docs, saving this window's settings requires the process to write that file. diff --git a/od-db-backup.md b/od-db-backup.md index f398159..df22d67 100644 --- a/od-db-backup.md +++ b/od-db-backup.md @@ -1,5 +1,8 @@ # Runbook: Open Dental — Rock-solid database + images backup (Windows) +> For qualified IT professionals, on systems they are authorized to administer. +> Provided as-is, without warranty — verify it fits your environment. See LICENSE. + **Applies to:** The Windows machine hosting the Open Dental MySQL/MariaDB database (the "server"). **Goal:** A fully consistent, restorable backup of both halves of an Open Dental practice — the **database** and the **A-to-Z images folder** — following Open Dental and MySQL/MariaDB best practice, including cleanly **stopping the database during the copy and restarting it after**. diff --git a/od-scan-duplex.md b/od-scan-duplex.md index 3a19204..efce7f5 100644 --- a/od-scan-duplex.md +++ b/od-scan-duplex.md @@ -1,5 +1,8 @@ # Runbook: Open Dental — Duplex ADF scanner captures only one side +> For qualified IT professionals, on systems they are authorized to administer. +> Provided as-is, without warranty — verify it fits your environment. See LICENSE. + **Applies to:** Any single-pass duplex ADF scanner feeding Open Dental over **TWAIN** on a Windows 11 workstation (standalone / self-enrolled is common). Written against a Canon imageFORMULA DR-series with the combined ISIS/TWAIN/WIA driver package, but the diagnostic tree is model-agnostic. **Symptom:** A double-sided document run through the ADF into the Open Dental **Imaging** module lands as front-only — the back side is missing, blank, or pages come out in the wrong order. **Most likely cause:** Duplex is not enabled on whichever setting is *authoritative*, and which one is authoritative depends on the **Show TWAIN UI** toggle. The classic miss is a checked-but-inert control on the branch that isn't in charge. diff --git a/od-smb-cred.md b/od-smb-cred.md index 3da56db..7ecaf9b 100644 --- a/od-smb-cred.md +++ b/od-smb-cred.md @@ -1,5 +1,8 @@ # Runbook: Open Dental SMB Share Access — Stored Credential Fix +> For qualified IT professionals, on systems they are authorized to administer. +> Provided as-is, without warranty — verify it fits your environment. See LICENSE. + **Applies to:** Entra-joined Windows workstation accessing an Open Dental A-to-Z share on a standalone (non-domain, non-Entra) server via local SAM credentials. **Symptom:** Open Dental cannot reach `\\\` after workstation restart; works after manually connecting via File Explorer. **Root causes covered:** missing/stale stored Windows credential; Credential Guard blocking saved credential replay; elevated process not seeing user-session credentials. diff --git a/scripts/_template.ps1 b/scripts/_template.ps1 index cbe319d..f33c1ce 100644 --- a/scripts/_template.ps1 +++ b/scripts/_template.ps1 @@ -7,7 +7,7 @@ .NOTES Convention for scripts in this repo — designed to run via: - irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/.ps1 | iex + irm rb.godwinsystems.com/scripts/.ps1 | iex Because `irm | iex` runs in the caller's session: - No param() block — you can't pass args through the pipe. Prompt with @@ -17,6 +17,10 @@ PUBLIC REPO: placeholders only. Never hard-code a client, host, user, or secret. Prompt for them at run time. + + Provided as-is, without warranty. This runs in your session via `iex` — + read it before you run it. You are responsible for the systems you run + it on. See LICENSE. #> $ErrorActionPreference = 'Stop' diff --git a/scripts/cg-disable.ps1 b/scripts/cg-disable.ps1 index a901bc7..c972c13 100644 --- a/scripts/cg-disable.ps1 +++ b/scripts/cg-disable.ps1 @@ -11,13 +11,17 @@ Business), not plain Pro. .NOTES - Run via: irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/cg-disable.ps1 | iex + Run via: irm rb.godwinsystems.com/scripts/cg-disable.ps1 | iex Referenced by od-smb-cred.md, Step 3. If Credential Guard is still running after reboot, it was enabled with a UEFI lock (needs the bcdedit / physical-presence removal), or MDM policy is re-enabling it — align with the environment baseline instead of fighting it locally. + + Provided as-is, without warranty. This runs in your session via `iex` — + read it before you run it. You are responsible for the systems you run + it on. See LICENSE. #> $ErrorActionPreference = 'Stop' diff --git a/scripts/od-backup-check.ps1 b/scripts/od-backup-check.ps1 index e955ce5..2b0e180 100644 --- a/scripts/od-backup-check.ps1 +++ b/scripts/od-backup-check.ps1 @@ -22,7 +22,7 @@ .NOTES Manual spot-check: - irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/od-backup-check.ps1 | iex + irm rb.godwinsystems.com/scripts/od-backup-check.ps1 | iex For unattended monitoring, schedule a filled-in LOCAL copy (with and the heartbeat URL baked in) — keep that copy in the private tier, not here. See @@ -30,6 +30,10 @@ iex-safe: uses `return`, never `exit` (which would close an interactive session). PUBLIC REPO: no client specifics hard-coded; prompt at run time. + + Provided as-is, without warranty. This runs in your session via `iex` — + read it before you run it. You are responsible for the systems you run + it on. See LICENSE. #> $ErrorActionPreference = 'Stop' diff --git a/scripts/od-cfg-acl.ps1 b/scripts/od-cfg-acl.ps1 index a158e9a..b9d1f8d 100644 --- a/scripts/od-cfg-acl.ps1 +++ b/scripts/od-cfg-acl.ps1 @@ -15,7 +15,7 @@ fails clearly if FreeDentalConfig.xml isn't found in either. .NOTES - Run via: irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/od-cfg-acl.ps1 | iex + Run via: irm rb.godwinsystems.com/scripts/od-cfg-acl.ps1 | iex Referenced by od-cfg-persist.md, Option B. SECURITY: on direct-connection setups FreeDentalConfig.xml also holds the @@ -23,6 +23,10 @@ not change that exposure, but prefer a limited MySQL user over root for workstation connections, and Middle Tier as the long-term fix that removes per-workstation DB credentials entirely. See the runbook's security note. + + Provided as-is, without warranty. This runs in your session via `iex` — + read it before you run it. You are responsible for the systems you run + it on. See LICENSE. #> $ErrorActionPreference = 'Stop' diff --git a/scripts/od-db-backup.ps1 b/scripts/od-db-backup.ps1 index a1bb6d3..f9f37b3 100644 --- a/scripts/od-db-backup.ps1 +++ b/scripts/od-db-backup.ps1 @@ -28,7 +28,7 @@ .NOTES Run ON THE DATABASE SERVER, elevated, when no one is using Open Dental: - irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/scripts/od-db-backup.ps1 | iex + irm rb.godwinsystems.com/scripts/od-db-backup.ps1 | iex Because `irm | iex` runs in the caller's session: no param() block (prompts via Read-Host), and #Requires is not enforced (admin is checked manually). @@ -38,6 +38,10 @@ PUBLIC REPO: no client specifics hard-coded. All paths are auto-detected or prompted at run time. + + Provided as-is, without warranty. This runs in your session via `iex` — + read it before you run it. You are responsible for the systems you run + it on. See LICENSE. #> $ErrorActionPreference = 'Stop' diff --git a/sec-google-compromise.md b/sec-google-compromise.md index faf57a9..97336a0 100644 --- a/sec-google-compromise.md +++ b/sec-google-compromise.md @@ -1,5 +1,8 @@ # Runbook: Incident response — suspected compromise of a consumer Google (Gmail) account +> For qualified IT professionals, on systems they are authorized to administer. +> Provided as-is, without warranty — verify it fits your environment. See LICENSE. + **Applies to:** A **personal `@gmail.com` account** used for practice business at ``. **Not Google Workspace.** There is no Admin console, no Admin SDK, no GAM, no audit-log export, and no vendor phone support for this account type. Every recovery path is Google's automated self-service flow. **Goal:** Evict an attacker who holds a stolen **session cookie** (not just a password), preserve evidence while doing it, and hand a clean factual record to the people who make the legal calls. **Assume:** the mailbox contains PHI, a breach risk assessment may follow, and **this document may become evidence.** diff --git a/sec-google-evidence.md b/sec-google-evidence.md index fe347a3..84722dd 100644 --- a/sec-google-evidence.md +++ b/sec-google-evidence.md @@ -1,5 +1,8 @@ # Runbook: Google account — evidence capture + re-entry check +> For qualified IT professionals, on systems they are authorized to administer. +> Provided as-is, without warranty — verify it fits your environment. See LICENSE. + **Applies to:** A consumer Google/Gmail account, before or after containment. No Workspace admin console required. **Use it for:** (a) capturing account state **before** you change anything, and (b) checking whether anyone got back in **after** a password reset. **Companion:** [`sec-google-compromise.md`](sec-google-compromise.md) — full containment procedure.