igodwin
6589082317
The ops -> godwinsystems org move would have made every hand-typed onsite command 10 characters longer, against the whole reason filenames here are short. A redirect host makes them shorter than they ever were: irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/od-smb-cred.md irm rb.godwinsystems.com/od-smb-cred.md Flips all 6 hardcoded URLs and documents what the hostname is, where the route is defined, and that removing it means updating these commands in the same change. Verified before committing: the short and canonical URLs return byte-identical content for 5 files, the scheme-less http:// form resolves through 301 -> 302 -> 200, bare / lands on the repo page, and a missing file still 404s at the right path. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
4.9 KiB
rb — runbooks
Generic, reusable IT procedures and scripts for MSP field work. Fetched onto client workstations during on-site work with short, hand-typeable commands.
Warning
This repository is PUBLIC-READ. It must never contain client-identifying information — no client names, hostnames, IPs, usernames, credentials, or screenshots. Procedures with placeholders only. See CONTRIBUTING.md for the sanitization rule.
Provided as-is, no warranty. Running any script is at your own risk. Contains no client-identifying data by policy.
Using a runbook
Fetch and read on the target workstation:
irm rb.godwinsystems.com/<file> | more
Run an executable runbook script directly (scripts live under scripts/):
irm rb.godwinsystems.com/scripts/<file>.ps1 | iex
Scripts prompt for anything client-specific via Read-Host — nothing to edit
before running. See scripts/_template.ps1 for the
convention.
No scheme is needed: PowerShell defaults a scheme-less URI to http://, and
rb.godwinsystems.com answers on :80 with a 301 to HTTPS.
About that hostname
rb.godwinsystems.com is a 302 redirect to this repo's raw path on Gitea. It
exists because these commands are hand-typed on client machines, often
mid-incident — the canonical URL is 63 characters before the filename. The
canonical form still works and is what the redirect targets:
https://gitea.ivangodwin.com/godwinsystems/rb/raw/branch/main/<file>
The redirect is a backendless Gateway API HTTPRoute defined in
kubernetes-gitops at manifests/apps/rb-redirect/, with a listener on the
public gateway and a DNS-only A record for rb. If that route is ever
removed, update the commands above in the same change — otherwise every
runbook here documents a dead URL.
Layout & naming
- Runbooks (
.md) live flat at the repo root with short, hand-typeable filenames and light category prefixes. - Scripts (
.ps1) live underscripts/._template.ps1sorts first and is the convention reference, not a runnable runbook. - Meta (
README.md,CONTRIBUTING.md) stays at the root.
Runbook prefixes:
| Prefix | Domain |
|---|---|
win- |
Windows workstation / server |
m365- |
Microsoft 365 / Entra |
od- |
Open Dental |
net- |
Networking |
sec- |
Security / incident response |
Placeholder conventions
Fill these from the private tier (private repo or Bitwarden secure note) at run time — never commit filled-in values.
| Placeholder | Meaning |
|---|---|
<CLIENT> |
Client / site identifier |
<SERVER> |
Server hostname |
<SHARE> |
Share name |
<SHARE_USER> |
Local account used for share access |
<USER> |
End-user account |
<PASSWORD> |
From password manager — never written to a file |
Contents
| File | Purpose |
|---|---|
od-smb-cred.md |
Open Dental SMB share — stored-credential fix |
od-cfg-persist.md |
Open Dental — persist "Do not show this window on startup" (writable FreeDentalConfig.xml) |
od-scan-duplex.md |
Open Dental — duplex ADF scanner captures only one side (TWAIN, Show TWAIN UI branches) |
od-db-backup.md |
Open Dental — rock-solid cold backup of the database + images (stop/copy/start MySQL/MariaDB) |
od-backup-verify.md |
Open Dental — verify a backup by test-restoring into an isolated Hyper-V VM (health checklist) |
od-backup-schedule.md |
Open Dental — schedule the backup + off-site upload and monitor it (dead-man's-switch heartbeat) |
sec-google-compromise.md |
Incident response — suspected compromise of a consumer Google/Gmail account (AiTM session theft; no Workspace admin console) |
sec-google-evidence.md |
Google/Gmail account — evidence capture before changes + re-entry check after a password reset (numbered, field-usable) |
scripts/cg-disable.ps1 |
Disable Credential Guard, then reboot (prompts to confirm) |
scripts/od-cfg-acl.ps1 |
Grant Users Modify on FreeDentalConfig.xml (Option B of od-cfg-persist) |
scripts/od-db-backup.ps1 |
Cold backup: stop MySQL/MariaDB, copy whole data dir + OpenDentImages, always restart (od-db-backup) |
scripts/od-backup-check.ps1 |
Read-only backup health check: freshness/completeness/size + heartbeat ping (od-backup-schedule) |
Tiers
- This repo (public): generic procedures, placeholders only.
- Private tier: filled-in, client-specific versions — private repo or Bitwarden secure notes. Never here.
This repo also serves as the raw source for Intune remediation scripts and as documented-procedures evidence for E&O / cyber insurance.