Phase 5: sanitize private-infra references

.env.example

@@ -1,9 +1,9 @@
 # StackDeploy — server config
-# Tailscale IP of this server
-SERVER_IP=REPLACE_WITH_YOUR_TAILSCALE_IP
+# Mesh-VPN IP of this server
+SERVER_IP=REPLACE_WITH_YOUR_MESH_VPN_IP
 
 # Obsidian vault path on the host
-OBSIDIAN_VAULT_PATH=/home/j1admin/ObsidianVault
+OBSIDIAN_VAULT_PATH=/home/<user>/ObsidianVault
 
 # Services
 HONCHO_TOKEN=REPLACE_WITH_YOUR_HONCHO_TOKEN

.github/workflows/ci-cd.yml

@@ -90,7 +90,7 @@ jobs:
           key: ${{ secrets.DEPLOY_SSH_KEY }}
           port: ${{ secrets.DEPLOY_PORT }}
           script: |
-            cd /home/j1admin/StackDeploy
+            cd /home/<user>/StackDeploy
             git pull origin main
             cp .env.example .env 2>/dev/null || true
             docker compose pull

CODE_OF_CONDUCT.md

@@ -35,7 +35,7 @@ Examples of unacceptable behavior:
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the project team at j1admin@onebyjorah.com. All complaints will
+reported to the project team at security@jorahone.com. All complaints will
 be reviewed and investigated and will result in a response that is deemed
 necessary and appropriate to the circumstances.
 

README.md

@@ -1,6 +1,6 @@
 # StackDeploy Dashboard
 
-Self-hosted all-in-one API platform — deploy SearXNG, Qdrant, Honcho, Ollama, Camofox, and Obsidian behind a single gateway with auto-discoverable APIs, Tailscale mesh, and optional Cloudflare Tunnel for public HTTPS. Choose between local LLM inference (Ollama) or cloud API (OpenRouter) for Honcho's AI features.
+Self-hosted all-in-one API platform — deploy SearXNG, Qdrant, Honcho, Ollama, Camofox, and Obsidian behind a single gateway with auto-discoverable APIs, Mesh-VPN mesh, and optional Cloudflare Tunnel for public HTTPS. Choose between local LLM inference (Ollama) or cloud API (OpenRouter) for Honcho's AI features.
 
 [![CI](https://github.com/OneByJorah/StackDeploy-Dashboard/actions/workflows/ci.yml/badge.svg)](https://github.com/OneByJorah/StackDeploy-Dashboard/actions/workflows/ci.yml)
 ![Version](https://img.shields.io/badge/version-2.0.0-FFB300?style=flat-square)
@@ -35,7 +35,7 @@ Open **http://localhost:9090** for the onboarding dashboard or **http://localhos
 - **Interactive Setup** — `./setup.sh` prompts for passwords, generates `.env`, no manual editing
 - **Local LLM (Ollama)** — Run Honcho entirely offline with local model inference (opt-in via `--with-local-llm` or `--auto`)
 - **Cloud or Local** — Choose between local Ollama or cloud OpenRouter during setup; `.env.honcho` configured automatically
-- **Tailscale Mesh** — Each service gets its own Tailscale identity for secure mesh networking
+- **Mesh-VPN Mesh** — Each service gets its own Mesh-VPN identity for secure mesh networking
 - **Cloudflare Tunnel** — Optional public HTTPS access via Cloudflare Tunnel (no open firewall ports)
 - **Auto-Discovery** — Gateway aggregates health and connection info for all backend services
 
@@ -46,7 +46,7 @@ graph TB
     subgraph Public
         A[Cloudflare Tunnel]
     end
-    subgraph Tailscale_Mesh
+    subgraph Mesh-VPN_Mesh
         B[Gateway :9090]
         C[SearXNG :8080]
         D[Qdrant :6333]
@@ -89,7 +89,7 @@ StackDeploy Dashboard is the control-plane island in the JorahOne archipelago 
 
 This interactive script will prompt for:
 1. **Admin credentials** — username/password for the gateway dashboard
-2. **Tailscale auth key** — optional, for mesh networking (get one from https://login.tailscale.com/admin/settings/keys)
+2. **Mesh-VPN auth key** — optional, for mesh networking (get one from https://login.mesh-vpn.com/admin/settings/keys)
 3. **Cloudflare Tunnel token** — optional, for public HTTPS access (create a tunnel at https://one.dash.cloudflare.com/)
 4. **LLM Provider** — choose between:
    - **(L)ocal Ollama** — runs entirely on-device, no API key needed. You pick a default model (default: `llama3.2`)
@@ -107,8 +107,8 @@ sudo ./bootstrap.sh --auto
 # With a different model
 sudo ./bootstrap.sh --auto --model llama3.2:1b
 
-# With custom model + Tailscale + Cloudflare
-sudo ./bootstrap.sh --auto --with-tailscale --with-public
+# With custom model + Mesh-VPN + Cloudflare
+sudo ./bootstrap.sh --auto --with-mesh-vpn --with-public
 ```
 
 `--auto` does everything: generates a secure `.env` with random passwords, generates `.env.honcho` pointing to local Ollama, deploys all services, pulls the default model (`llama3.2:1b`), and restarts Honcho to activate it. The admin password is printed at the end.
@@ -125,14 +125,14 @@ sudo ./bootstrap.sh --with-local-llm
 # With a specific Ollama model
 sudo ./bootstrap.sh --with-local-llm --model qwen2.5:0.5b
 
-# With Tailscale mesh
-sudo ./bootstrap.sh --with-tailscale
+# With Mesh-VPN mesh
+sudo ./bootstrap.sh --with-mesh-vpn
 
-# With Tailscale + Cloudflare Tunnel (public HTTPS)
-sudo ./bootstrap.sh --with-tailscale --with-public
+# With Mesh-VPN + Cloudflare Tunnel (public HTTPS)
+sudo ./bootstrap.sh --with-mesh-vpn --with-public
 
 # With everything
-sudo ./bootstrap.sh --with-tailscale --with-public --with-local-llm
+sudo ./bootstrap.sh --with-mesh-vpn --with-public --with-local-llm
 
 # Skip setup prompt (use existing .env)
 sudo ./bootstrap.sh --skip-setup

SECURITY.md

@@ -12,7 +12,7 @@ for receiving patches depends on the CVSS v3.0 rating:
 
 ## Reporting a Vulnerability
 
-Please report security vulnerabilities to **j1admin@onebyjorah.com**. Do NOT
+Please report security vulnerabilities to **security@jorahone.com**. Do NOT
 report security vulnerabilities through public GitHub issues.
 
 You should receive a response within 48 hours. If for some reason you do not,

docs/HERMES_SETUP.md

@@ -43,7 +43,7 @@ honcho:
 
 obsidian:
   enabled: true
-  vault_path: /home/j1admin/ObsidianVault
+  vault_path: /home/<user>/ObsidianVault
 ```
 
 For local Obsidian, open the vault folder in the desktop app. Hermes reads and writes notes directly through the Obsidian skill.

docs/MAINTENANCE.md

@@ -15,5 +15,5 @@ docker compose up -d llama-server
 ## Backup Honcho memory
 
 ```bash
-tar czf honcho-backup.tgz /home/j1admin/docker/j1-stack-deploy/honcho
+tar czf honcho-backup.tgz /home/<user>/docker/j1-stack-deploy/honcho
 ```

docs/SERVER_SETUP.md

@@ -3,7 +3,7 @@
 ## Prerequisites
 
 - Docker + Docker Compose v2+
-- Tailscale installed
+- Mesh-VPN installed
 
 ## Install
 
@@ -30,7 +30,7 @@ docker compose up -d
 
 | Variable | Purpose | Notes |
 |---|---|---|
-| `SERVER_IP` | Tailscale or local IP used in docs/examples | Required |
+| `SERVER_IP` | Mesh-VPN or local IP used in docs/examples | Required |
 | `HONCHO_TOKEN` | Auth token for Honcho API | Optional |
 | `HONCHO_DB_PASSWORD` | Postgres password for Honcho backend | Required |
 | `POSTGRES_PASSWORD` | Postgres password | Required |
@@ -81,7 +81,7 @@ docker compose logs -f
 ## Troubleshooting
 
 - If services fail to start, inspect `docker compose up -d && docker compose logs -f`.
-- Ensure `SERVER_IP` matches the host address used by other clients (Tailscale recommended).
+- Ensure `SERVER_IP` matches the host address used by other clients (Mesh-VPN recommended).
 
 ---
 

docs/hermes.md

@@ -22,16 +22,16 @@ curl -s -o /dev/null -w 'qdrant=%{http_code}\n' http://localhost:6333/
   - Web UI / REST API root
 - Obsidian
   - Web UI: `http://localhost:8083`
-  - Vault path: `/home/j1admin/ObsidianVault`
+  - Vault path: `/home/<user>/ObsidianVault`
 
 ## BrowserSearch CLI
 ```bash
-cd /home/j1admin/StackDeploy/browser-search
+cd /home/<user>/StackDeploy/browser-search
 node scripts/cloak/cloak-fetch.mjs "https://example.com" --format markdown
 ```
 
 ## Smoke test
 ```bash
-cd /home/j1admin/StackDeploy
+cd /home/<user>/StackDeploy
 bash tests/smoke.sh
 ```

gateway/server.py

@@ -179,13 +179,13 @@ async def discover(credentials: Optional[str] = Depends(verify_admin_optional)):
         result = await check_service_health(name, svc)
         results.append(result)
 
-    # Tailnet info (if available)
-    tailscale_hostname = os.getenv("TS_CERT_DOMAIN", "")
+    # Mesh info (if available)
+    mesh-vpn_hostname = os.getenv("TS_CERT_DOMAIN", "")
 
     return {
         "platform": "StackDeploy Dashboard",
         "version": "2.0.0",
-        "tailnet_hostname": tailscale_hostname,
+        "mesh_hostname": mesh-vpn_hostname,
         "cloudflare_domain": os.getenv("CLOUDFLARE_TUNNEL_DOMAIN", ""),
         "services": results,
         "healthy_count": sum(1 for r in results if r["healthy"]),

gateway/tests/test_gateway.py

@@ -157,9 +157,9 @@ def test_discover_service_details(self, mock_async_client):
             assert svc["description"] == SERVICE_REGISTRY[svc["name"]]["description"]
 
     @patch("server.httpx.AsyncClient")
-    def test_discover_includes_tailnet_hostname(self, mock_async_client):
+    def test_discover_includes_mesh_hostname(self, mock_async_client):
         """TS_CERT_DOMAIN env var should appear in discover response."""
-        os.environ["TS_CERT_DOMAIN"] = "test.tailnet.com"
+        os.environ["TS_CERT_DOMAIN"] = "test.mesh.com"
         mock_async_client.return_value = mock_health_response(healthy=True)
 
         # Re-import app to pick up env var — but lazy approach: just check directly
@@ -168,7 +168,7 @@ def test_discover_includes_tailnet_hostname(self, mock_async_client):
         c2 = TestClient(app2)
         response = c2.get("/api/v1/discover")
         data = response.json()
-        assert data["tailnet_hostname"] == "test.tailnet.com"
+        assert data["mesh_hostname"] == "test.mesh.com"
 
     @patch("server.httpx.AsyncClient")
     def test_discover_includes_cloudflare_domain(self, mock_async_client):

test_results.txt

@@ -8,7 +8,7 @@ name: stackdeploy
 services:
   honcho-api:
     build:
-      context: /home/j1admin/StackDeploy/vendor/honcho
+      context: /home/<user>/StackDeploy/vendor/honcho
       dockerfile: docker/Dockerfile
     depends_on:
       honcho-db:
@@ -41,7 +41,7 @@ services:
     restart: unless-stopped
     volumes:
       - type: bind
-        source: /home/j1admin/StackDeploy/honcho/config.toml
+        source: /home/<user>/StackDeploy/honcho/config.toml
         target: /app/config.toml
         read_only: true
         bind: {}

tests/smoke.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
-cd /home/j1admin/StackDeploy
+cd /home/<user>/StackDeploy
 
 echo '=== Service checks ==='
 curl -s -o /dev/null -w 'searxng=%{http_code}\n' 'http://localhost:8080/search?format=json&q=test'
@@ -17,7 +17,7 @@ curl -s -X POST http://localhost:9377/tabs -H 'Content-Type: application/json' -
 python3 -c 'import json,sys; d=json.load(open("/tmp/sd_camofox_tab.json")); print("tabId=", d.get("tabId")); assert d.get("tabId"), "tabId missing"'
 
 echo '=== CloakBrowser CLI ==='
-node /home/j1admin/StackDeploy/browser-search/scripts/cloak/cloak-fetch.mjs --help > /dev/null 2>&1
+node /home/<user>/StackDeploy/browser-search/scripts/cloak/cloak-fetch.mjs --help > /dev/null 2>&1
 
 echo '=== Obsidian page ==='
 curl -s http://localhost:8083/ | grep -q 'Obsidian v1.7.7'