igodwin
f2a979f047
The repo is public and files are fetched by raw URL, so a reader who lands on one runbook never sees the README -- the repo's context does not travel with the file. Each .md now carries two lines under the title, each .ps1 the equivalent at the end of its .NOTES block. Deliberately two lines, not a paragraph. These files are read through `| more` on a client console mid-incident, and the top of the file is where the procedure-specific warnings live -- never a live chart, stop the service before copying, confirm authorization before acting. A legal preamble above those competes with them and trains people to skip past. Wording aims at a stranger who found the repo, not at the quality of the procedure: these double as documented-procedure evidence for E&O, and language implying the content is unreliable works against that. MIT rather than no license: the warranty and liability disclaimer is the part that does the work, and leaving it unlicensed makes reuse ambiguous rather than disclaimed. Also fixes 5 stale ops/rb URLs in scripts/*.ps1 that the previous commit missed -- it only swept the .md files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HwcG1jLs1T425QRMxtjxP7
rb — runbooks
Generic, reusable IT procedures and scripts for MSP field work. Fetched onto client workstations during on-site work with short, hand-typeable commands.
Warning
This repository is PUBLIC-READ. It must never contain client-identifying information — no client names, hostnames, IPs, usernames, credentials, or screenshots. Procedures with placeholders only. See CONTRIBUTING.md for the sanitization rule.
For qualified IT professionals, on systems they are authorized to administer. Provided as-is, without warranty — verify anything here fits your environment before running it. Scripts execute in your own session via
iex; read them first. Licensed under MIT. Contains no client-identifying data by policy.
Using a runbook
Fetch and read on the target workstation:
irm rb.godwinsystems.com/<file> | more
Run an executable runbook script directly (scripts live under scripts/):
irm rb.godwinsystems.com/scripts/<file>.ps1 | iex
Scripts prompt for anything client-specific via Read-Host — nothing to edit
before running. See scripts/_template.ps1 for the
convention.
No scheme is needed: PowerShell defaults a scheme-less URI to http://, and
rb.godwinsystems.com answers on :80 with a 301 to HTTPS.
About that hostname
rb.godwinsystems.com is a 302 redirect to this repo's raw path on Gitea. It
exists because these commands are hand-typed on client machines, often
mid-incident — the canonical URL is 63 characters before the filename. The
canonical form still works and is what the redirect targets:
https://gitea.ivangodwin.com/godwinsystems/rb/raw/branch/main/<file>
The redirect is a backendless Gateway API HTTPRoute defined in
kubernetes-gitops at manifests/apps/rb-redirect/, with a listener on the
public gateway and a DNS-only A record for rb. If that route is ever
removed, update the commands above in the same change — otherwise every
runbook here documents a dead URL.
Layout & naming
- Runbooks (
.md) live flat at the repo root with short, hand-typeable filenames and light category prefixes. - Scripts (
.ps1) live underscripts/._template.ps1sorts first and is the convention reference, not a runnable runbook. - Meta (
README.md,CONTRIBUTING.md) stays at the root.
Runbook prefixes:
| Prefix | Domain |
|---|---|
win- |
Windows workstation / server |
m365- |
Microsoft 365 / Entra |
od- |
Open Dental |
net- |
Networking |
sec- |
Security / incident response |
Placeholder conventions
Fill these from the private tier (private repo or Bitwarden secure note) at run time — never commit filled-in values.
| Placeholder | Meaning |
|---|---|
<CLIENT> |
Client / site identifier |
<SERVER> |
Server hostname |
<SHARE> |
Share name |
<SHARE_USER> |
Local account used for share access |
<USER> |
End-user account |
<PASSWORD> |
From password manager — never written to a file |
Contents
| File | Purpose |
|---|---|
od-smb-cred.md |
Open Dental SMB share — stored-credential fix |
od-cfg-persist.md |
Open Dental — persist "Do not show this window on startup" (writable FreeDentalConfig.xml) |
od-scan-duplex.md |
Open Dental — duplex ADF scanner captures only one side (TWAIN, Show TWAIN UI branches) |
od-db-backup.md |
Open Dental — rock-solid cold backup of the database + images (stop/copy/start MySQL/MariaDB) |
od-backup-verify.md |
Open Dental — verify a backup by test-restoring into an isolated Hyper-V VM (health checklist) |
od-backup-schedule.md |
Open Dental — schedule the backup + off-site upload and monitor it (dead-man's-switch heartbeat) |
sec-google-compromise.md |
Incident response — suspected compromise of a consumer Google/Gmail account (AiTM session theft; no Workspace admin console) |
sec-google-evidence.md |
Google/Gmail account — evidence capture before changes + re-entry check after a password reset (numbered, field-usable) |
scripts/cg-disable.ps1 |
Disable Credential Guard, then reboot (prompts to confirm) |
scripts/od-cfg-acl.ps1 |
Grant Users Modify on FreeDentalConfig.xml (Option B of od-cfg-persist) |
scripts/od-db-backup.ps1 |
Cold backup: stop MySQL/MariaDB, copy whole data dir + OpenDentImages, always restart (od-db-backup) |
scripts/od-backup-check.ps1 |
Read-only backup health check: freshness/completeness/size + heartbeat ping (od-backup-schedule) |
Tiers
- This repo (public): generic procedures, placeholders only.
- Private tier: filled-in, client-specific versions — private repo or Bitwarden secure notes. Never here.
This repo also serves as the raw source for Intune remediation scripts and as documented-procedures evidence for E&O / cyber insurance.