The internal MSP division building and operating the automation that manages, backs up, and secures every other Cherwood property.
Isolated segment, narrow SSH+SNMP policies, explicit logged DENY backstop.
svc-automation — independently revocable, no shared admin login. Also caught and fixed a real gap: it briefly shared a password hash with the admin account on the Cisco devices, closed with unique credentials.
12-year-old open-source compatibility bug, root-caused and fixed.
Every pull committed, real changes flagged accurately.
Internal Flask page, Trusted-VLAN-only access.
Pushed to GitHub, GitHub Pages mirror enabled, self-hosted at this domain via the existing DMZ container and Cloudflare Tunnel. Two real deployment bugs found and fixed along the way — see below.
LLDP-based mapping across Cisco IOS and FortiOS, reconciled into one graph and rendered nightly via Graphviz. See the live diagram →
Legacy Cisco IOS SSH servers don't strictly follow the public-key handshake spec — asking for the signature twice, even after it was already sent. Traced via debug-level analysis and a decade of GitHub issue history. Fixed with ios_compat_patch.py, not a workaround.
FortiGate re-encrypts fields with a random salt on every pull — real ciphertext, zero real change. Would have buried every genuine alert forever. Fixed with normalization before comparison, verified against an empty diff.
After deploying this site, the public URL intermittently showed Cherwood Health's page instead. DNS, Cloudflare's cache, the file on disk, and nginx's config all checked out individually correct — the real cause was localhost resolving to either 127.0.0.1 or ::1 depending on the connecting process, and this site's nginx block only listened on the IPv4 address. Whichever loopback path the tunnel happened to use decided which site got served. Fixed by adding listen [::]:80; alongside the existing listener — found the identical gap on a second, unrelated port serving tarunc.com shortly after.
The FortiGate's DNS filter redirected this domain to its own block page. A brand-new throwaway test hostname hit the identical block, ruling out anything specific to this project's name. The category grid didn't show an age-based rule either — the exact trigger stayed unconfirmed. What's proven: static domain-filter allow entries fix it, but the GUI silently failed to save them twice; only a CLI write followed by a CLI read-back reliably worked.