Remote Cleanup Preflight

Date: 2026-06-13. Updated 2026-06-14 for archive and permission hardening. Scope: preflight and reversible archive log for legacy-looking remote directories. Result: final actions were reversible archive moves and permission hardening; no deprecated directory has been deleted.

Rules

• Do not clean by directory name alone.
• Distinguish the same path on different hosts. For example, /opt/biof3-r-server is active on Dell but a legacy candidate on ECS.
• Treat any directory containing .env, database files, or old application data as sensitive until a root-only archive / redact / delete plan is written.
• A cleanup candidate still needs a final command review immediately before any action.

Evidence Checked

The preflight used only metadata and file names:

ssh aliyun 'pm2 jlist; docker inspect ...; crontab -l; systemctl list-units ...'
ssh dell 'pm2 jlist; docker inspect ...; crontab -l; systemctl list-units ...'
ssh aliyun 'find /opt/<candidate> -maxdepth 2 ...'
ssh dell 'find /opt/<candidate> -maxdepth 2 ...'
rg -n --fixed-strings '/opt/<candidate>' .kiro docs deploy.sh infra scripts platform-server py-server r-server src test

No secret file contents were read or printed.

Current Classifications

ECS

Path	Classification	Evidence	Action
/opt/biof3-r-server	archive candidate, ECS only	No ECS PM2 owner, no Docker bind, no cron/systemd reference found. Contains old Node backend copy, node_modules, demo data/results, tool scripts.	Can be considered for ECS-only root-owned archive after one final ref check. Do not confuse with active Dell path.
/opt/biof3-py-server	sensitive archive candidate, ECS only	No ECS PM2 owner, no Docker bind, no cron/systemd reference found. Contains old Python server copy and .env marker.	Do not inspect env contents. Archive/delete plan must explicitly handle secrets. Do not confuse with active Dell path.
/opt/old_biof3	hold, sensitive historical bundle	Contains .env markers, old postgres-data, halo-data, waline-data, docker-compose.yml, and app content. Older notes used its compose as an nginx reference; current guidance now points to versioned repo docs/config.	Do not clean yet. First confirm no unique nginx/compose knowledge remains only there, then plan sensitive archive.
/opt/halo	archived legacy candidate	Initially held because frps ran under /opt/halo/frp_0.58.0_linux_amd64. On 2026-06-13 frps was migrated to /opt/frp-server + systemd, then /opt/halo was moved to /opt/_deprecated-20260613/halo.	Reversible archive only; do not delete until after a normal monitoring cycle.
/opt/proxy	active/system hold	Running process found: /opt/proxy/mihomo; system proxy tooling present.	Do not touch. It is not BioF3 app clutter.
/opt/biof3-oss	archive candidate	No PM2/Docker/cron/systemd/process reference found. Contains small Node/Express OSS helper from 2026-05-13.	Can be considered for root-owned archive after final reference check.

Dell

Path	Classification	Evidence	Action
/opt/biof3	archived sensitive historical bundle	No active BioF3 PM2/Docker bind, process cwd, cron, or systemd owner found for this exact path before archive. It contained .env, .env.bak, .git, postgres-data, halo-data, app content, nginx files, and compose files.	Moved 2026-06-14 to /opt/_deprecated-20260613/biof3; archive is root-only. Do not delete until after monitoring.
/opt/biof3-frontend	archive candidate	Empty or near-empty directory (4K), no refs found.	Low-risk candidate for rename/archive after final check.
/opt/clash-for-linux	system hold	mihomo.service is active on Dell; proxy tooling and .env marker exist.	Leave alone unless doing system proxy maintenance.
/opt/htslib	dependency hold	Bioinformatics source/dependency tree with .git; no active process found, but may be used by tools or environment.	Do not remove without checking PATH, tool scripts, and installed packages.
/opt/quarto	dependency hold	Quarto install tree; no active process found, but may be used for report rendering.	Do not remove without checking PATH and report workflows.

Recommended Next Actions

1. Keep nginx maintenance anchored in versioned repo files such as infra/nginx/biof3.conf; do not reintroduce /opt/old_biof3 as an operational source of truth.
2. Prepare a root-only archive plan for any remaining low-risk candidate.
3. Keep these out of cleanup scope for now:
   • ECS /opt/biof3-py-server
   • ECS /opt/old_biof3
   • ECS /opt/proxy
   • Dell /opt/biof3
   • Dell /opt/clash-for-linux
   • Dell /opt/htslib
   • Dell /opt/quarto
4. Before any archive/rename/delete action, run npm run ops:smoke-platform and repeat the reference checks from this document.

Archive Actions Taken

2026-06-13: reversible moves only; no deletion.

Pre-check:

• npm run ops:smoke-platform passed 31 checks with 0 slow checks.
• Final PM2/Docker/cron/systemd preflight found no references for the moved low-risk paths.

Moved:

Host	From	To
ECS	/opt/biof3-r-server	/opt/_deprecated-20260613/biof3-r-server
ECS	/opt/biof3-oss	/opt/_deprecated-20260613/biof3-oss
Dell	/opt/biof3-frontend	/opt/_deprecated-20260613/biof3-frontend

Post-check:

• npm run ops:smoke-platform passed 31 checks with 0 slow checks.
• ECS biof3-platform, biof3-nginx, biof3-pg, Waline, Halo, and generator containers remained online.
• Dell biof3-r-server, biof3-r-worker, biof3-py-server, biof3-py-worker, R Docker, and Python Docker remained online.

Do not delete the deprecated directories yet. Leave them through at least one normal backup/monitoring cycle, then decide whether to tar, snapshot, or remove.

Remaining Holds And Completed Sensitive Archives

• Completed sensitive archives:
  • completed for ECS /opt/biof3-py-server
  • completed for ECS /opt/old_biof3
  • completed for Dell /opt/biof3
• Remaining system/dependency holds:
  • ECS /opt/proxy
  • Dell /opt/clash-for-linux
  • Dell /opt/htslib
  • Dell /opt/quarto

Historical candidate list before the 2026-06-13 archive action:

- ECS /opt/biof3-r-server
- ECS /opt/biof3-py-server
- ECS /opt/biof3-oss
- Dell /opt/biof3-frontend

Candidate Archive Shape

If a later session decides to archive a low-risk candidate, prefer a reversible root-owned move first:

# Example only. Do not run without final confirmation.
ssh aliyun 'mkdir -p /opt/_deprecated-20260613 && mv /opt/biof3-oss /opt/_deprecated-20260613/biof3-oss'

For directories with .env or database files, use a separate plan that records sha256/size/path only and does not expose contents.

Halo / Generator Stop Action

2026-06-13: the old Halo/generator website stack was stopped to keep ECS focused on the current BioF3 production surface.

Changed:

• infra/nginx/biof3.conf and ECS /opt/biof3/app/nginx/biof3.conf now return 410 for /blog-old/ instead of proxying to halo:8090.
• ECS containers biof3-generator, halo, and halo-db were changed to restart=no and stopped.
• ECS cron line for /opt/biof3/backup.sh was commented as DISABLED_20260613_HALO.

Kept:

• biof3-nginx, biof3-pg, and biof3-waline remain running.
• /opt/biof3 remains in place because it still holds active nginx/Waline data and stopped Halo/generator data that needs a sensitive archive plan.
• /opt/frp-server is now the active frps path. /opt/halo was later moved to /opt/_deprecated-20260613/halo after frps was migrated and revalidated.

Verification:

• npm run ops:smoke-platform passed 31 checks with 0 slow checks.
• https://biof3.com/ returned 200.
• https://biof3.com/blog-old/ returned 410.
• https://biof3.com/api/comment returned 403, confirming Waline is still reachable but rejects unauthenticated comment listing as expected.
• https://biof3.com/ui/ returned 200.

FRP Server Path Normalization

2026-06-13: frps was moved out of the historical /opt/halo tree.

Before:

• Process cwd/exe: /opt/halo/frp_0.58.0_linux_amd64.
• Command: ./frps -c ./frps.ini.
• Not managed by a valid systemd unit; frps.service showed not-found.

After:

• Active path: /opt/frp-server.
• systemd unit: /etc/systemd/system/frps.service.
• Command: /opt/frp-server/frps -c /opt/frp-server/frps.ini.
• Unit state: enabled and active.
• Dell frpc.service reconnected and initially registered active ports 6022, 3001, 3002, 8787, plus historical 5433, 8090, 5173, and 18789.

Then /opt/halo had no process, Docker bind, cron, or systemd references, so it was moved reversibly:

/opt/halo -> /opt/_deprecated-20260613/halo

Verification after migration and archive:

• npm run ops:smoke-platform passed 31 checks with 0 slow checks.
• https://biof3.com/ returned 200.
• https://biof3.com/blog-old/ returned 410.
• https://biof3.com/api/r/health returned 200.
• https://biof3.com/api/py/health returned 200.

FRP Exposure Convergence

2026-06-13: after frps was normalized to /opt/frp-server, the Dell frpc exposure surface was reduced to the current production set.

Removed from Dell /opt/frp_0.58.0_linux_amd64/frpc.ini:

• [halo] / remote 8090: no Dell listener and /blog-old/ now returns 410.
• [frontend] / remote 5173: no Dell listener and no current nginx route.
• [openclaw] / remote 18789: no Dell listener and no current nginx route.
• [biof3-local-pg] / remote 5433: Dell still uses local 127.0.0.1:5433 via biof3-pg-tunnel.service; it does not need a public frp listener on ECS.

Kept:

• 6022: Dell SSH via frp.
• 3001: Dell R compute API.
• 3002: Dell Python compute API.
• 8787: R replot / Plumber service path.

Operational notes:

• A timestamped backup of frpc.ini was created on Dell before editing.
• frpc.service was enabled and restarted. The SSH session dropped during restart because ssh dell itself uses the 6022 frp tunnel; reconnecting confirmed the service was active.
• ECS ss -tlnp showed only 7000, 6022, 3001, 3002, and 8787 from frps; historical 8090, 5173, 18789, and public frp 5433 disappeared.

Verification:

• npm run ops:smoke-platform passed 31 checks with 0 slow checks.
• The previously timed-out admin endpoints passed quickly: /api/platform/ai/admin/users-overview, /api/platform/admin/oss/stats, and /api/platform/admin/backup/list.
• Dell local checks passed for 127.0.0.1:3001, 127.0.0.1:3002, and 127.0.0.1:5433.

Waline Data Normalization And Old Bundle Archive

2026-06-13: while preparing to archive /opt/old_biof3, active Docker mountinfo showed biof3-waline still using /opt/old_biof3/waline-data -> /app/data. The old bundle was therefore not safe to move as a whole until Waline data was normalized.

Actions:

• Copied Waline SQLite data from /opt/old_biof3/waline-data to /opt/biof3/waline-data.
• Recreated biof3-waline on Docker network biof3_default with alias waline, using the same image and env values, but mounting /opt/biof3/waline-data.
• Kept the previous container as biof3-waline-pre-data-move-20260613-211653 for rollback and set its restart policy to no.
• Reloaded biof3-nginx after the container IP changed, so nginx resolved the new waline upstream.
• Restored /opt/biof3/waline-backup.sh from the archived bundle and confirmed a manual backup to /opt/biof3-backups/waline.
• After confirming no active mount/process/config references to /opt/old_biof3, moved it reversibly:

/opt/old_biof3 -> /opt/_deprecated-20260613/old_biof3

Verification:

• npm run ops:smoke-platform passed 31 checks with 0 slow checks.
• https://biof3.com/ returned 200.
• https://biof3.com/api/comment returned a normal Waline auth response.
• Active Docker mounts reference /opt/biof3/waline-data, not /opt/old_biof3.
• /opt/old_biof3 no longer exists; archived path exists and is 1.7G.

Security note:

• Alibaba Cloud reported PID 3905829 as a worm-like command. The command line matched the operator-initiated Waline retry check: docker exec biof3-nginx ... wget http://waline:8360/api/ ... curl https://biof3.com/api/comment. PID was short-lived under sshd; no persistence or network residue was found. Treat this instance as an ops false positive, while continuing to review new alerts normally.
• A separate orphaned manual benchmark process node /opt/biof3-platform/r-server/test-db-perf2.js had been running since 2026-06-11 and consuming about one CPU core. It was not managed by PM2, systemd, or cron, and was stopped on 2026-06-13. Platform smoke passed after stopping it.

ECS Python Legacy Path Archive

2026-06-14: ECS /opt/biof3-py-server was checked before archive.

Evidence:

• No ECS process, Docker mount, PM2 app, cron, or systemd unit owned the path.
• The only current local health response on 127.0.0.1:3002 came from frps, forwarding to Dell Python compute, not from this ECS directory.
• The path contained sensitive legacy markers (.env, pyserver.db), so it was treated as a sensitive archive.

Action:

/opt/biof3-py-server -> /opt/_deprecated-20260613/biof3-py-server

Verification:

• npm run ops:smoke-platform passed 31 checks with 0 slow checks.
• https://biof3.com/api/py/health returned 200.
• /opt/biof3-py-server no longer exists; archived path exists and is 35M.

Non-BioF3 system note:

• /opt/proxy is not part of the BioF3 production stack, but it is active: mihomo runs from /opt/proxy/mihomo and listens on 9981 plus 198.18.0.1:2143. It was therefore left in place and should not be grouped with BioF3 legacy directories without an explicit system-proxy retirement decision.

Dell Sensitive Legacy Path Archive And Permission Hardening

2026-06-14: Dell /opt/biof3 was checked and archived as a sensitive historical bundle.

Evidence before archive:

• No active Docker mount owned exact path /opt/biof3.
• No active PM2 app, process cwd, cron line, or systemd unit owned the path.
• Active Dell compute remained under /opt/biof3-r-server and /opt/biof3-py-server, not /opt/biof3.
• The path contained old .env markers and historical app/database data, so it was treated as sensitive.

Action:

/opt/biof3 -> /opt/_deprecated-20260613/biof3

Permission hardening:

• /etc/biof3.env remains root-owned 600.
• /opt/biof3-py-server/.env was tightened to root-owned 600.
• /root/.pm2/dump.pm2, /root/.pm2/pm2.log, /root/.pm2/module_conf.json, and PM2 logs were tightened to root-only permissions.
• /opt/_deprecated-20260613 was tightened to 700, and archived children had group/other permissions removed.

Verification:

• /opt/biof3 no longer exists; /opt/_deprecated-20260613/biof3 exists.
• Dell local 127.0.0.1:3001/api/health and 127.0.0.1:3002/api/health passed.
• Dell pg_isready -h 127.0.0.1 -p 5433 passed.
• Dell PM2 apps biof3-r-server, biof3-r-worker, biof3-py-server, and biof3-py-worker remained online.
• Docker containers omichub_react_backend_1 and biof3_python_1 remained online.
• frpc.service and biof3-pg-tunnel.service remained active.
• npm run ops:smoke-platform passed 31 checks with 0 slow checks.