Shared infrastructure

Topology at a glance

Mailcow on DigitalOcean

Email for every SPS-owned domain (sandpointstudios.ltd, onecutshop.app, wyrdlyre.app, rightbower.app, agogedev.com, dev.finishops.com, casaops.{mx,app}) runs on a single Mailcow instance hosted on a DigitalOcean droplet at mail.sandpointstudios.ltd (167.71.174.187). Outbound mail relays through Amazon SES on port 2587 as a deliverability smarthost.

The help@sandpointstudios.ltd mailbox is the centralized contributor intake — every product's outbound system email defaults to this address, with the relevant help@<product-domain> as the override for product-specific channels.

Apex domains NOT on Mailcow: finishops.com and sshomefinishes.com stay on Microsoft 365 (Dusty's existing setup; not migrated).

vigil-server

The primary production AI server. ASUS TUF X570-PLUS, Ubuntu 24.04, on the team Tailnet as vigil-server (100.98.48.21) and on the LAN at 192.168.0.21. Hosts the heaviest workloads in the portfolio: Vigil Steward, the NWZ helpdesk stack, Homer, the intranet (Homepage), Ollama, Grafana/Prometheus, code-server containers, the centralized cloudflared tunnel, and more.

Containers + ports (representative subset)

The multi-tenant cloudflared tunnel

A single cloudflared container on vigil-server fronts 21+ public hostnames despite its historical name being vigil-ledger. New public hostnames are added by appending an ingress rule — not by spinning up a new tunnel. This is the path every CF-Access-gated service uses to surface from vigil-server's private network to the Cloudflare edge.

Cloudflare account

All 19 zones live in a single Cloudflare account under twistedyeti@gmail.com (account ID e61960da9bb822bb27cac40b7284c76b). Includes sandpointstudios.ltd, sandpointstudios.net, teaganwins.net, onecutshop.app, wyrdlyre.app, rightbower.app, sshomefinishes.com, stierpainting.com, and more.

The vigil-ops-primary API token at the primary account has broad scopes — DNS Write, Pages Write, Workers Write, Routes Write, Single Redirects Write, Page Rules Write, Tunnel R/W, R2/KV/D1 Write, Access policy R/W, SSL/Certs Write, and the ability to mint/patch other tokens. This drives flarectl, wrangler, and direct API calls in agent contexts.

Cloudflare Access — Google IdP

Every self-hosted service that needs identity-gated access uses Cloudflare Access with Google as the upstream IdP. Policies allow @sandpointstudios.ltd emails by domain, plus explicit allowlists for externals (Bert's bakerbert7@gmail.com, Dusty's dstier@sshomefinishes.com, Lewis's lewis.ellwanger@gmail.com).

This is what makes "sign in once with your SPS Google account, get the intranet + onboarding site + code-server + NWZ + Agoge + TimeKeep all at once" actually work. Contributors only have to authenticate one provider.

Bitwarden — SPS LLC organization

The Sand Point Studios LLC Bitwarden organization is the primary credential store for everything an agent or contributor might need to reach. The SPS Service collection holds 77+ migrated agent-reachable creds: Mailcow mailboxes, Cloudflare/AWS/GitHub/Anthropic API keys, NWZ secrets, DB passwords.

GitHub — teaganwins-dev

The primary GitHub identity for the SPS portfolio is teaganwins-dev (personal account, not an organization). Repos are private by default; contributor access is granted per-repo as a write collaborator. Contributors authenticate via personal access tokens stored as GITHUB_TOKEN environment variables inside their code-server containers, with a credential helper bridging the token to HTTPS git operations.

Anthropic Team plan

Five seats on the SPS Team plan (Lewis Premium, Bert + Arthur + Phoenix + Dusty Standard, plus Raghav inbound 2026-06-08). Each contributor's Claude Code instance — both on their laptop and in their code-server container — should authenticate against their SPS-email-bound Anthropic account so usage rolls up against the Team plan, not against Teagan's personal API key.

Vigil TeamCode (VTC)

A metering proxy at code.sandpointstudios.ltd fronts a fleet of code-server containers, one per contributor. Each container has the SPS toolchain pre-installed and a /shared/dev-context/ bind mount that surfaces the team's conventions, decisions log, and active-projects index inside every contributor's workspace.

Document map

Cross-references for "where does X live?"