VM Naming Rename Audit (NAMING-1)¶

Status: NAMING-2 executed 2026-08-29. See R940_NAMING_CONVENTION_v1.md.

Target convention (Ryan, Option A — full rename): Documented in pending R940_NAMING_CONVENTION_v1.md (NAMING-3). Summary:

Layer	Old pattern	New pattern
App VM	`{product}-r940`, `{product}-supabase`	`{product}-app`, `{product}-db`
BWS app secrets	`{PRODUCT}_R940_PROD_*`	`{PRODUCT}_APP_PROD_*`
BWS db secrets (future split)	mixed in `_R940_PROD_`	`{PRODUCT}_DB_PROD_*`
Infra VMs	`auth-last1id`, `observability`, …	unchanged
Edge tunnels	`lastvet-edge`, `last1id-edge`	unchanged (dedicated tunnels)
Product edge tunnels	`realoutcomes-edge`, `admin-edge`, `onset-edge`	unchanged (tunnel name ≠ VM name)

Executive summary¶

Metric	Count
VMs in rename scope	6 (VMIDs 112, 115–119)
Files matching old VM hostnames (`-r940`, `-supabase`)	~70 in lastvet-gates
Files matching `_R940_` / `-r940` broadly	~100+ in lastvet-gates
Scripts with `-r940` in filename	25 (admin 9, realoutcomes 11, onset 5)
BWS keys to migrate (live, estimated)	~113 (36 admin + 38 RO prod + 3 RO edge + 39 onset)
Prometheus alert rules affected	6 (3 RealOutcomes + 3 Admin)
Observability runbooks affected	12 (6 n8n + 3 admin + 3 realoutcomes)
Staging hostnames (`*-r940.last1.enterprises`)	2 patterns

Live prod impact if renamed without coordinated refresh: n8n (n8n.last1.enterprises via lastvet-edge), RealOutcomes (realoutcomes.app via realoutcomes-edge). Admin paused (warm soak only). Onset pre-cutover (idle app VM).

Onset T-3: Blocked until NAMING-2 complete (Ryan directive).

1. Rename mapping (authoritative)¶

VMID	Current Proxmox / hostname	New hostname	LAN IP	Prod status
112	`n8n-app`	`n8n-app`	192.168.1.94	LIVE (n8n.last1.enterprises)
115	`admin-app`	`admin-app`	192.168.1.97	Paused warm soak
116	`realoutcomes-app`	`realoutcomes-app`	192.168.1.99	LIVE (realoutcomes.app)
117	`realoutcomes-db`	`realoutcomes-db`	192.168.1.98	LIVE (LAN stack)
118	`onset-app`	`onset-app`	192.168.1.101	Running, idle
119	`onset-db`	`onset-db`	192.168.1.102	Running, stack deployed

IPs unchanged. Only names, labels, MagicDNS, and doc/script references move.

LAN inventory: R940_LAN_NETWORK_INVENTORY.md — 192.168.1.100 is Dell iDRAC/BMC; do not assign to VMs.

BWS prefix mapping¶

Current prefix	New prefix	BWS project	Est. keys
`LAST1ADMIN_APP_PROD_*`	`LAST1ADMIN_APP_PROD_*`	`last1-admin`	36
`REALOUTCOMES_APP_PROD_*`	`REALOUTCOMES_APP_PROD_*`	`realoutcomes`	38
`REALOUTCOMES_APP_EDGE_*`	`REALOUTCOMES_APP_EDGE_` (proposed)*	`realoutcomes`	3
`ONSET_APP_PROD_*`	`ONSET_APP_PROD_*`	`onset`	39

DB secret split (NAMING-2 decision): Keys like REALOUTCOMES_DB_PROD_DATABASE_URL and ONSET_DB_PROD_SUPABASE_URL logically belong on REALOUTCOMES_DB_PROD_* / ONSET_DB_PROD_* per v2 convention. Recommend splitting during BWS rename, not deferring to Tier 6.

N8N BWS: No N8N_R940_* keys found in repo inventory. Historical keys may live in last1-platform BWS (N8N_APP_PROD_* from Tier 1). Include in NAMING-2 live BWS scan → rename to N8N_APP_PROD_* if present.

Staging DNS (proposed)¶

Current	Proposed
`admin-app.last1.enterprises`	`admin-app.last1.enterprises`
`realoutcomes-app.last1.enterprises`	`realoutcomes-app.last1.enterprises`

Requires Cloudflare DNS + tunnel ingress updates. Obsolete staging via lastvet-edge (cloudflared-config-t3-4-staging.preview.yml) should be deleted or updated during NAMING-2.

2. Proxmox VM names¶

Source of truth today: docs/architecture/R940_PRODUCT_ISOLATION_PRINCIPLES_v1.md §5 (partial table; missing n8n, onset).

Proxmox cloud-init snippets on pve-r940 (rename in NAMING-2):

Snippet file	Current hostname
`admin-app-user.yaml`	admin-app
`realoutcomes-app-user.yaml`	realoutcomes-app
`onset-app-user.yaml`	onset-app
`onset-db-user.yaml`	onset-db

Provision scripts (create VMs + snippets):

Script	VMID	NAME var
`scripts/last1-admin/provision-vm.sh`	115	`admin-app`
`scripts/realoutcomes/provision-vm-app.sh`	116	`realoutcomes-app`
`scripts/realoutcomes/provision-vm-supabase.sh`	117	`realoutcomes-db`
`scripts/onset/provision-vm-app.sh`	118	`onset-app`
`scripts/onset/provision-vm-supabase.sh`	119	`onset-db`

n8n (112): No provision script in lastvet-gates repo. VM provisioned manually (Tier 1). Proxmox name + guest hostname both n8n-app.

3. Guest OS: `/etc/hostname`, `/etc/hosts`, hostnamectl¶

Live state (expected = Proxmox cloud-init hostname):

VM	Expected `/etc/hostname`	SSH / MagicDNS today
112	`n8n-app`	`ssh ryan@192.168.1.94`, Tailscale `n8n-app.*`
115	`admin-app`	`ssh ryan@192.168.1.97`, Tailscale `admin-app.*` (`100.76.87.21`)
116	`realoutcomes-app`	hostname guard in `install-realoutcomes-edge-cloudflared.sh`
117	`realoutcomes-db`	runbook `ssh realoutcomes-db`
118	`onset-app`	cloud-init + `STUDIO_DEFAULT_PROJECT "onset-app"`
119	`onset-db` → currently `onset-db`	UFW comments reference `onset-app-kong`

/etc/hosts: No centralized repo copy. NAMING-2 step: audit each VM for stale short-name entries after rename.

Docker / systemd names using old hostnames:

Artifact	Current	File
Docker image tag	`last1admin-app:prod`	`scripts/last1-admin/deploy-last1admin-app.sh`
Docker image tag	`realoutcomes-app:prod`	`scripts/realoutcomes/deploy-realoutcomes-app.sh`, IRS timer
systemd unit	`n8n-app.service`	Referenced in `infra/observability/loki/rules/n8n.yml`
Supabase Studio label	`realoutcomes-app`	`scripts/realoutcomes/setup-supabase-stack.sh`
Supabase Studio label	`onset-app`	`scripts/onset/setup-supabase-stack.sh`

4. Tailscale device names¶

VM	Current Tailscale name	MagicDNS impact
112	`n8n-app`	`n8n-app.tailc3bbdc.ts.net`
115	`admin-app`	`admin-app.tailc3bbdc.ts.net`
116–119	joined (names match hostname)	`*.tailc3bbdc.ts.net`

NAMING-2: tailscale up --hostname=<new-name> --reset or Tailscale admin console rename. May require brief reconnect. Reuse LAST1_TAILSCALE_API_KEY in last1-admin BWS or LASTVET_R940_TAILSCALE_AUTH_KEY in lastvet project (do not infer across projects for unrelated secrets).

Docs referencing Tailscale old names: HIPAA_ARCHITECTURE.md, n8n runbooks, muster migrate-n8n-railway-to-r940.

5. BWS keys¶

5.1 Prefix families in scope¶

Scripts reading prefixes (must update in NAMING-2):

Script	PREFIX / pattern
`scripts/last1-admin/render-last1admin-env-app.sh`	`LAST1ADMIN_APP_PROD_`
`scripts/last1-admin/sync-app-bws-from-railway.py`	`LAST1ADMIN_APP_PROD_`
`scripts/realoutcomes/render-realoutcomes-env-app.sh`	`REALOUTCOMES_APP_PROD_`
`scripts/realoutcomes/sync-app-bws-from-railway.py`	`REALOUTCOMES_APP_PROD_`
`scripts/realoutcomes/push-db-stack-bws.py`	`REALOUTCOMES_R940_*`
`scripts/onset/sync-app-bws-from-railway.py`	`ONSET_APP_PROD_`
`scripts/onset/push-db-stack-bws.py`	`ONSET_R940_*`

5.2 Documented key inventories (names only)¶

LAST1ADMIN — see TIER_3_ADMIN_* reports; 36 live keys. Notable override: LAST1ADMIN_APP_PROD_LAST1_ID_API_BASE.

REALOUTCOMES — full table in REALOUTCOMES_MIGRATION_PLAN.md § BWS (~20 documented + Stripe/SendGrid variants). Edge keys: REALOUTCOMES_APP_EDGE_TUNNEL_ID, _EDGE_TUNNEL_CNAME, _EDGE_CLOUDFLARED_TUNNEL_CREDENTIALS.

ONSET — full table in ONSET_MIGRATION_PLAN.md § BWS (~20 documented). Includes ONSET_APP_PROD_EDGE_CLOUDFLARED_TUNNEL_ID.

5.3 BWS values referencing old hostnames¶

Audit during NAMING-2 (copy keys, do not infer values from other projects):

*_PUBLIC_URL, *_PUBLIC_APP_URL if set to staging *-r940.last1.enterprises
REALOUTCOMES_DB_PROD_SUPABASE_URL → http://192.168.1.98:8000 (IP OK; hostname N/A)
ONSET_DB_PROD_SUPABASE_URL → http://192.168.1.102:8000
Any DATABASE_URL containing hostname instead of IP (verify)

5.4 Explicitly OUT OF SCOPE (BWS)¶

Prefix / project	Reason
`LAST1_ID_R940_` / `LAST1ID_R940_`	Identity infra (`auth-last1id`); separate naming (`LAST1ID_`)
`LASTVET_R940_*`	LastVet platform, not product migration rename
`N8N_R940_*` in last1-platform	Platform ops; rename to `N8N_APP_*` only if Ryan includes in scope

6. Prometheus, Alertmanager, metrics labels¶

Observability VM: 192.168.1.93 (observability) — not renamed.

Scrape targets (node_exporter by IP — stable)¶

IP	VM	Comment in prometheus.yml
192.168.1.94:9100	n8n-app	Tier 1
192.168.1.97:9100	admin-app	T3-3
192.168.1.99:9100	realoutcomes-app	T3-3

Alert rules (text references old hostnames)¶

Alert	Severity	Metric / expr	Config source
`RealOutcomesHostDown`	critical	`up{instance="192.168.1.99:9100"}`	`configure-prometheus-realoutcomes-app.sh`
`RealOutcomesHealthProbeFailed`	warning	`realoutcomes_app_probe_success == 0`	same
`RealOutcomesSupabaseUnreachable`	warning	`realoutcomes_app_supabase_reachable == 0`	same
`AdminHostDown`	critical	`.97:9100` down	T3-3 report (on observability VM)
`AdminHealthProbeFailed`	warning	`admin_app_probe_success == 0`	same
`AdminAuth5xxRateHigh`	warning	`admin_app_probe_auth_5xx == 1`	same
`N8nHostDown`	critical	`.94:9100`	muster / Tier 1

Metrics labels to rename (NAMING-2)¶

RealOutcomes (scripts/realoutcomes/soak-health-probe.sh):

realoutcomes_app_probe_success, _root_http_code, _auth_http_code, _directory_http_code, _auth_5xx
realoutcomes_app_supabase_reachable
File: realoutcomes_app_probe.prom

Proposed: realoutcomes_app_probe_* (or realoutcomes_probe_* without location suffix).

Admin (scripts/last1-admin/soak-health-probe.sh):

admin_app_probe_success, _root_http_code, _auth_http_code, _auth_5xx
File: admin_app_probe.prom

Proposed: admin_app_probe_*.

Loki (infra/observability/loki/rules/n8n.yml):

{host="n8n-app"}, unit="n8n-app.service"

Grafana dashboards:

infra/observability/grafana/dashboards/n8n-app.json (uid n8n-app-prod)
9628-r940-postgres.json, 15141-r940-loki-logs.json, etc. — hypervisor/R940 fleet dashboards; not product VM renames (optional cosmetic only)

7. Runbooks (`docs/observability/runbooks/`)¶

Runbook	Old hostname refs
`n8n-host-down.md`	n8n-app, `.94`
`n8n-metrics-down.md`	n8n-app
`n8n-high-memory.md`	n8n-app
`n8n-service-silent.md`	n8n-app.service
`n8n-workflow-execution-failed.md`	n8n-app
`n8n-active-workflows-low.md`	(check)
`admin-host-down.md`	admin-app, `.97`
`admin-health-probe-failed.md`	admin_app_probe_*
`admin-auth-5xx-rate-high.md`	admin_app_probe_*
`realoutcomes-host-down.md`	realoutcomes-app, `.99`
`realoutcomes-health-probe-failed.md`	realoutcomes_app_probe_*
`realoutcomes-db-unreachable.md`	realoutcomes-db, `.98`

Not in product rename scope: r940-host-cpu-critical.md (hypervisor), LastVet API runbooks, minio/postgres generic runbooks.

8. Deploy / install / setup scripts¶

8.1 Filename renames required (25 files)¶

last1-admin/

deploy-last1admin-app.sh → deploy-last1admin-app.sh
render-last1admin-env-app.sh → render-last1admin-env-app.sh
sync-app-bws-from-railway.py → sync-app-bws-from-railway.py
configure-tunnel-staging-app.sh, configure-tunnel-route-app.sh, stage-tunnel-prep-app.sh
install-node-exporter-app.sh, install-soak-cron-app.sh

realoutcomes/

deploy-realoutcomes-app.sh, render-realoutcomes-env-app.sh
configure-prometheus-realoutcomes-app.sh
configure-tunnel-staging-app.sh, configure-tunnel-staging-db.sh
sync-app-bws-from-railway.py, push-db-stack-bws.py
install-node-exporter-app.sh, install-soak-cron-app.sh

onset/

sync-app-bws-from-railway.py, push-db-stack-bws.py

8.2 Hard hostname guards (break on rename if not updated)¶

# scripts/realoutcomes/install-realoutcomes-edge-cloudflared.sh
[[ "$(hostname -s)" != "realoutcomes-app" ]]

8.3 Env / LAN vars in scripts¶

Var	Files	Current value
`ONSET_APP_LAN_IP`	onset provision scripts	`.101`
`ONSET_DB_LAN_IP`	onset provision scripts	`.102`
`AUTH_HOST` / `ADMIN_HOST`	last1-admin scripts	`192.168.1.97`

IPs stay; variable names should drop _R940_ → ONSET_APP_LAN_IP, etc.

9. Cloudflare tunnels¶

Tunnel name	VM / connector	Rename tunnel?
lastvet-edge	VM 110	NO (constraint)
last1id-edge	VM 114	NO (constraint)
realoutcomes-edge	VM 116 cloudflared	NO (tunnel name stays; connector host becomes realoutcomes-app)
admin-edge	VM 115 (planned)	NO
onset-edge	VM 118 (planned T-4)	NO

Routes referencing old staging hostnames:

infra/lastvet-edge/cloudflared-config-t3-4-staging.preview.yml — admin-app.last1.enterprises, realoutcomes-app.last1.enterprises (superseded; delete or update)
scripts/last1-admin/configure-tunnel-staging-app.sh
scripts/realoutcomes/configure-tunnel-staging-app.sh

Production routes unaffected: realoutcomes.app, n8n.last1.enterprises (custom domains, not *-r940 hostnames).

10. Architecture / session / migration docs¶

High reference density (update in NAMING-2):

Document cluster	~refs
Tier 3 RealOutcomes T3-* reports + test plans	50+
Tier 3 Admin T3-* reports + paused status	40+
Tier 4 Onset T-* + ONSET_MIGRATION_PLAN	40+
SPRINT-2/3 RealOutcomes + edge execution	30+
R940_PRODUCT_ISOLATION_PRINCIPLES_v1.md	5
PRODUCTS_ISOLATION_ARCHITECTURE_2026-08-29.md	12
REALOUTCOMES_MIGRATION_PLAN.md	21
HIPAA_ARCHITECTURE.md	14 (n8n-app, VMIDs)

Session state docs with VMID/IP tables:

SOVEREIGN_V2_SESSION{1,2,3}_*.md — reference R940 VMs generically; spot-check only

Superseded / archive (low priority):

backups/realoutcomes-teardown-2026-08-28/MANIFEST.json — historical dump_host: realoutcomes-db (immutable archive)

11. Muster tracker¶

Item	Relevant old names
`infra-bw-naming-r940-products-approve`	Tier 0 gate; approve v2 convention
`migrate-n8n-railway-to-r940`	n8n-app, `.94`, lastvet-edge route
`migrate-last1-admin-railway-to-r940`	admin-app, VM 115, `LAST1ADMIN_R940_*`
`migrate-realoutcomes-railway-supabase-to-r940`	`REALOUTCOMES_R940_*`, VM 116/117
`migrate-onset-clinic-supabase-to-r940`	`ONSET_R940_`, VM 118/119 — T-3 blocked until NAMING-2*
`sprint-3-realoutcomes-edge-dns`	realoutcomes-edge (tunnel name unchanged)

Recommendation: Add explicit naming-v2-vm-and-bws-rename muster item at NAMING-2 kickoff; close infra-bw-naming-r940-products-approve when v1 convention doc lands (NAMING-3).

12. Explicitly excluded from rename¶

Item	VMID / name	Reason
auth-last1id	114	Infrastructure identity VM
sovereign-db-last1id	113	Infrastructure DB
lastvet-edge	110	Dedicated tunnel (constraint)
last1id-edge	114 tunnel	Dedicated tunnel (constraint)
observability	111	Platform monitoring
lastvet-api, lastvet-db, …	107–109	LastVet product (separate naming)
pve-r940	hypervisor	Not a guest VM

Note: lastvet-edge routes to n8n (.94:5678) and historically staged admin/realoutcomes. Updating origin IPs is not part of VM rename; only update if staging config still references old MagicDNS hostnames.

13. NAMING-2 execution order (proposed — not executed)¶

Per Ryan's sequence, with dependency notes:

Approve this audit + publish NAMING-3 convention doc
Repo first: rename scripts, metrics label names, docs (PR to lastvet-gates)
BWS: create *_APP_PROD_* (+ *_DB_PROD_* where applicable); update render scripts; redeploy
Observability: Prometheus rules + Loki labels + Grafana dashboard uids
Non-prod / paused: admin-app (115), onset-app/db (118–119)
Prod maintenance window: realoutcomes-app (116) + realoutcomes-db (117)
Prod maintenance window: n8n-app (112) — lastvet-edge route uses IP (stable)
Tailscale + Proxmox + guest hostname per VM (steps 1–4 from Ryan list)
Delete old BWS keys after soak verification
Resume Onset T-3 on clean convention

Suggested VM order (lowest risk first): onset-db → onset-app → admin-app → realoutcomes-db → realoutcomes-app → n8n-app

14. Risk summary¶

Risk	Mitigation
RealOutcomes edge install script hostname guard	Update script before VM rename
Prometheus alert silence during metric rename	Dual-write metrics briefly or maintenance window
BWS render script mismatch	Create new keys before deleting old; one product at a time
Tailscale MagicDNS broken SSH habits	Document new names in runbooks; keep LAN IPs in scripts
Admin paused state preserved	Rename only; no Railway/DNS cutover
Onset mid-migration	Block T-3 until NAMING-2 complete

15. Ryan approval checklist (NAMING-1 → NAMING-2 gate)¶

[ ] Confirm VM rename mapping table (§1)
[ ] Confirm BWS prefix mapping including EDGE keys and DB split (*_DB_PROD_*)
[ ] Confirm staging DNS pattern (*-app.last1.enterprises)
[ ] Confirm N8N / last1-platform BWS keys in scope
[ ] Confirm execution order (§13)
[ ] Authorize NAMING-2 execution

After approval: Execute NAMING-2, then NAMING-3 (R940_NAMING_CONVENTION_v1.md), then resume Onset T-3.

References¶

R940_PRODUCT_ISOLATION_PRINCIPLES_v1.md
TIER_3_ADMIN_PAUSED_STATUS.md
REALOUTCOMES_MIGRATION_PLAN.md
ONSET_MIGRATION_PLAN.md
Pending: R940_NAMING_CONVENTION_v1.md (NAMING-3)