igodwin
6589082317
The ops -> godwinsystems org move would have made every hand-typed onsite command 10 characters longer, against the whole reason filenames here are short. A redirect host makes them shorter than they ever were: irm https://gitea.ivangodwin.com/ops/rb/raw/branch/main/od-smb-cred.md irm rb.godwinsystems.com/od-smb-cred.md Flips all 6 hardcoded URLs and documents what the hostname is, where the route is defined, and that removing it means updating these commands in the same change. Verified before committing: the short and canonical URLs return byte-identical content for 5 files, the scheme-less http:// form resolves through 301 -> 302 -> 200, bare / lands on the repo page, and a missing file still 404s at the right path. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
110 lines
4.9 KiB
Markdown
110 lines
4.9 KiB
Markdown
# rb — runbooks
|
|
|
|
Generic, reusable IT procedures and scripts for MSP field work. Fetched onto
|
|
client workstations during on-site work with short, hand-typeable commands.
|
|
|
|
> [!WARNING]
|
|
> **This repository is PUBLIC-READ.** It must never contain client-identifying
|
|
> information — no client names, hostnames, IPs, usernames, credentials, or
|
|
> screenshots. Procedures with placeholders **only**. See
|
|
> [CONTRIBUTING.md](CONTRIBUTING.md) for the sanitization rule.
|
|
|
|
> Provided as-is, no warranty. Running any script is at your own risk. Contains
|
|
> no client-identifying data by policy.
|
|
|
|
## Using a runbook
|
|
|
|
Fetch and read on the target workstation:
|
|
|
|
```powershell
|
|
irm rb.godwinsystems.com/<file> | more
|
|
```
|
|
|
|
Run an executable runbook script directly (scripts live under `scripts/`):
|
|
|
|
```powershell
|
|
irm rb.godwinsystems.com/scripts/<file>.ps1 | iex
|
|
```
|
|
|
|
Scripts prompt for anything client-specific via `Read-Host` — nothing to edit
|
|
before running. See [`scripts/_template.ps1`](scripts/_template.ps1) for the
|
|
convention.
|
|
|
|
No scheme is needed: PowerShell defaults a scheme-less URI to `http://`, and
|
|
`rb.godwinsystems.com` answers on :80 with a 301 to HTTPS.
|
|
|
|
### About that hostname
|
|
|
|
`rb.godwinsystems.com` is a 302 redirect to this repo's raw path on Gitea. It
|
|
exists because these commands are hand-typed on client machines, often
|
|
mid-incident — the canonical URL is 63 characters before the filename. The
|
|
canonical form still works and is what the redirect targets:
|
|
|
|
```
|
|
https://gitea.ivangodwin.com/godwinsystems/rb/raw/branch/main/<file>
|
|
```
|
|
|
|
The redirect is a backendless Gateway API `HTTPRoute` defined in
|
|
`kubernetes-gitops` at `manifests/apps/rb-redirect/`, with a listener on the
|
|
public gateway and a DNS-only A record for `rb`. **If that route is ever
|
|
removed, update the commands above in the same change** — otherwise every
|
|
runbook here documents a dead URL.
|
|
|
|
## Layout & naming
|
|
|
|
- **Runbooks** (`.md`) live flat at the repo root with short, hand-typeable
|
|
filenames and light category prefixes.
|
|
- **Scripts** (`.ps1`) live under [`scripts/`](scripts/). `_template.ps1`
|
|
sorts first and is the convention reference, not a runnable runbook.
|
|
- **Meta** (`README.md`, `CONTRIBUTING.md`) stays at the root.
|
|
|
|
Runbook prefixes:
|
|
|
|
| Prefix | Domain |
|
|
|---|---|
|
|
| `win-` | Windows workstation / server |
|
|
| `m365-` | Microsoft 365 / Entra |
|
|
| `od-` | Open Dental |
|
|
| `net-` | Networking |
|
|
| `sec-` | Security / incident response |
|
|
|
|
## Placeholder conventions
|
|
|
|
Fill these from the private tier (private repo or Bitwarden secure note) at
|
|
run time — never commit filled-in values.
|
|
|
|
| Placeholder | Meaning |
|
|
|---|---|
|
|
| `<CLIENT>` | Client / site identifier |
|
|
| `<SERVER>` | Server hostname |
|
|
| `<SHARE>` | Share name |
|
|
| `<SHARE_USER>` | Local account used for share access |
|
|
| `<USER>` | End-user account |
|
|
| `<PASSWORD>` | From password manager — never written to a file |
|
|
|
|
## Contents
|
|
|
|
| File | Purpose |
|
|
|---|---|
|
|
| [`od-smb-cred.md`](od-smb-cred.md) | Open Dental SMB share — stored-credential fix |
|
|
| [`od-cfg-persist.md`](od-cfg-persist.md) | Open Dental — persist "Do not show this window on startup" (writable FreeDentalConfig.xml) |
|
|
| [`od-scan-duplex.md`](od-scan-duplex.md) | Open Dental — duplex ADF scanner captures only one side (TWAIN, Show TWAIN UI branches) |
|
|
| [`od-db-backup.md`](od-db-backup.md) | Open Dental — rock-solid cold backup of the database + images (stop/copy/start MySQL/MariaDB) |
|
|
| [`od-backup-verify.md`](od-backup-verify.md) | Open Dental — verify a backup by test-restoring into an isolated Hyper-V VM (health checklist) |
|
|
| [`od-backup-schedule.md`](od-backup-schedule.md) | Open Dental — schedule the backup + off-site upload and monitor it (dead-man's-switch heartbeat) |
|
|
| [`sec-google-compromise.md`](sec-google-compromise.md) | Incident response — suspected compromise of a **consumer** Google/Gmail account (AiTM session theft; no Workspace admin console) |
|
|
| [`sec-google-evidence.md`](sec-google-evidence.md) | Google/Gmail account — evidence capture before changes + re-entry check after a password reset (numbered, field-usable) |
|
|
| [`scripts/cg-disable.ps1`](scripts/cg-disable.ps1) | Disable Credential Guard, then reboot (prompts to confirm) |
|
|
| [`scripts/od-cfg-acl.ps1`](scripts/od-cfg-acl.ps1) | Grant Users Modify on FreeDentalConfig.xml (Option B of od-cfg-persist) |
|
|
| [`scripts/od-db-backup.ps1`](scripts/od-db-backup.ps1) | Cold backup: stop MySQL/MariaDB, copy whole data dir + OpenDentImages, always restart (od-db-backup) |
|
|
| [`scripts/od-backup-check.ps1`](scripts/od-backup-check.ps1) | Read-only backup health check: freshness/completeness/size + heartbeat ping (od-backup-schedule) |
|
|
|
|
## Tiers
|
|
|
|
- **This repo (public):** generic procedures, placeholders only.
|
|
- **Private tier:** filled-in, client-specific versions — private repo or
|
|
Bitwarden secure notes. Never here.
|
|
|
|
This repo also serves as the raw source for Intune remediation scripts and as
|
|
documented-procedures evidence for E&O / cyber insurance.
|