# logship-template-3 (VM 115) — clean LogShip golden VM

Built 2026-10-01 from a PBS backup of VM 105 (logship-production,
snapshot 2026-10-01T16:00Z, frontend build GITHASH 8fdc65f85 / 29.09.2026).
Production was never touched. Supersedes VM 113 `logship-template-2`
(built 2026-07-26; destroyed after sign-off).

## What this VM is
Full LogShip stack, data-free: iDempiere (:8443, REST via nginx /api/v1),
PostgreSQL 17 (idempiere / strapi), Nuxt frontend (:3001), Strapi
(:1337, media via nginx :80), PostgREST (:3000), ES 9 + Kibana + sync
(docker, 127.0.0.1 only), whisper-cpp, Check_MK agent (unregistered).
IP 192.168.12.67 via Proxmox cloud-init.

## What was removed / changed vs production
- All transactional data of client 1000000: orders, invoices, shipments,
  payments, accounting posts, stock, requests, logs, attachments, contact
  activities, payment selections, bank statements, AP/Amazon invoice inboxes,
  serial/Charge/MHD attribute instances.
- All customer orgs — only org 1000000 (LogYou) remains.
- All business partners/products except config-referenced ones
  (3 partners, ~18 billing products). Staff users + roles kept,
  passwords identical to production at clone time.
- Kept config: doc types, price lists, taxes, warehouses/locators of org
  1000000, `cust_commissiontable`, `cust_printer`, `cust_labeltemplate`,
  `cust_nonworkingdays`, `cust_shippingcost_default`, the 4 `LogShip …`
  attribute sets, Jasper print processes, bank 1000001 + charges.
- Strapi content + uploads wiped (admin login + API tokens kept).
- ES indices rebuilt empty. DocumentNo sequences reset.
- root crontab REMOVED (backup: /root/crontab.production.bak).
- postfix disabled. Frontend runtime data (`data/` SQLite DBs + dirs:
  chat, push, contract signing, legal docs, amazon-ads, bank imports, call
  transcripts, mobile APK releases) cleared; `/root/storage` PDFs wiped;
  stale deploy copies pruned; Check_MK registration removed.
- /opt/erp-nuxt-frontend/.env NEUTRALIZED: LARAVEL, Sentry, DHL/DPD/
  Sendcloud/Amazon/Amazon-Ads/JTL credentials, Synology, VAPID/FCM keys,
  FreePBX (AMI/CDR/recordings/caller-id), IVR, landing-page + Laravel
  service tokens, mobile download secret, SEPA creditor id blanked;
  CLICK_TO_DIAL_ENABLED=false; STRAPIPUBLIC/WEBAUTHN/MOBILE_APP_PUBLIC_BASE
  point at 192.168.12.67; fresh CREDENTIAL_ENCRYPTION_KEY.
  GardenWorld demo client untouched.

## Turning a clone of this template into a real instance

ONE COMMAND on prox2 (staged at /root/clone-logship-instance.sh, source in
repo reference/template-cleanup/) — clones, sets IP, boots, rebrands:

    /root/clone-logship-instance.sh <NEWID> <IP> "<ClientName>" \
        ["<OrgName>"] ["<CompanyLegalName>"] [--name x] [--memory MB] [--cores N] [--domain fqdn]

It performs steps 1–2 below; 3–8 stay manual per instance.

1. prox2: qm clone 115 <ID> --name <name> --full; qm set <ID>
   --ipconfig0 ip=<IP>/24,gw=192.168.12.1; start.
2. Rebrand the tenant (client/org/linked partner/warehouse/roles +
   .env COMPANYNAME — the template says "LogYou" everywhere):
     /root/template-cleanup/04-set-instance-identity.sh \
       "<ClientName>" "<OrgName>" "<CompanyLegalName>"
   (--dry-run first to preview; restarts iDempiere + frontend itself.
   Staff users/emails stay — replace them in the app.)
3. Fill /opt/erp-nuxt-frontend/.env: endpoints + credentials as needed;
   pm2 restart erpfrontend --update-env.
4. Rotate the iDempiere REST secret — it lives in AD_SysConfig, NOT in
   idempiere.properties. The cloned one equals production's, so prod
   tokens would be valid here:
     sudo -u postgres psql -d idempiere -c "UPDATE adempiere.ad_sysconfig
       SET value='$(openssl rand -hex 32)' WHERE name='REST_TOKEN_SECRET'"
     systemctl restart idempiere
   then re-issue IDEMPIERETOKEN (.env) via POST /api/v1/auth/tokens.
5. Re-enable wanted cron jobs from /root/crontab.production.bak.
6. Create orgs/partners/products via the app (Initial Org Setup).
7. If mail is needed: systemctl enable --now postfix + iDempiere SMTP config.
8. Monitoring: cmk-agent-ctl register ... against the monitoring site.
9. Public access: DNS A record → 5.9.170.82, then on edge-proxy-1 (192.168.12.52)
     /root/edge-proxy/add-instance.sh <fqdn> <IP> --letsencrypt info@logyou.de
   (standard LogShip host incl. REST/ZK/Strapi/SSE/websocket routes, see reference/edge-proxy/README.md).

## Cleanup tooling
/root/template-cleanup/ (also in ERP repo reference/template-cleanup/):
re-runnable on a fresh prod clone: 00-defuse.sh -> 03-neutralize-env.sh
-> run-cleanup.sh [--dry-run]. All scripts refuse to run on production
(guarded). The iDempiere/Strapi truncation has a dynamic catch-all for
tables that did not exist when the explicit lists were written.