MYKOS Infrastructure Administration

Documentation index

Reference edition of the Word guide dated 21 October 2026. The original wording, examples, and qualifications are retained. For maintained procedures, use the documentation index; this conversion does not verify historical commands against a running host.

Operations and recovery guide | API-first deployment | 21 October 2026

Scope: deployed MYKOS web/API services on prod.mykol.com. Instructions below reflect the configuration discussed and must be checked against the running host before relying on them during a disaster recovery.

Contents

• 1. Service overview
• 2. Create users and reset passwords
• 3. Roles and permissions
• 4. API v2
• 5. API key management
• 6. Collectors and refresh
• 7. Complete backup and recovery
• 8. Post-recovery verification
• 9. Troubleshooting commands

1. Service overview

Browser UI development is frozen. New functionality should be introduced through API v2. The web UI remains supported for operations.

2. Create users and reset passwords

Use the existing account script. Run the same command to create a username or reset that user’s password:

sudo /opt/mykos-web/create-admin.sh mgreen
sudo /opt/mykos-web/create-admin.sh kpugh

The currently verified script prompts for a password of at least 8 characters. Both app.py and create-admin.sh use salted hashlib.scrypt with n=16384, r=8, p=1. The user database stores name, salt, and hash; it does not store plaintext passwords.

Confirm login at https://mykol.com/mykos/ after any password reset. Password resetting does not require an application restart. Existing sessions may remain valid until they expire or are revoked.

3. Roles and permissions

Important: the previously installed web application used an explicit list of admin usernames. There is no independently verified general-purpose role table for browser users. Confirm current administrator membership in app.py and api_v2.py before promising a new account admin access. Do not manually edit auth.db to grant privileges.

4. API v2

Interactive documentation: https://mykol.com/mykos/api/v2/docs. The /mykos prefix is required externally because Apache proxies /mykos/ to the internal FastAPI app. The OpenAPI servers base should be /mykos so Swagger “Execute” uses the correct URL.

All paths in the table are relative to /mykos/api/v2. Availability is version-dependent; Swagger documentation generated by the running application is authoritative.

curl -H "X-MYKOS-API-Key: YOUR_KEY" \
  https://mykol.com/mykos/api/v2/overview

5. API key management

The previously prepared API key installer adds a command-line manager at /usr/local/sbin/mykos-api-keys. Confirm this file is installed before following the commands. Keys begin mykos2_, are shown only at creation, and are stored as SHA-256 digests. Use HTTPS and avoid pasting actual keys into tickets or logs.

test -x /usr/local/sbin/mykos-api-keys && echo "Key manager installed"
sudo runuser -u mykosweb -- /usr/bin/python3 \
  /usr/local/sbin/mykos-api-keys create monitoring read
sudo runuser -u mykosweb -- /usr/bin/python3 \
  /usr/local/sbin/mykos-api-keys list
sudo runuser -u mykosweb -- /usr/bin/python3 \
  /usr/local/sbin/mykos-api-keys revoke KEY_ID

For integrations use read-scoped keys wherever possible. Use an admin key only for allowlisted write operations. Revocation is immediate for subsequent key checks. Keep secrets in a restricted secrets manager; rotate them after suspected exposure. API keys are not equivalent to browser/terminal session credentials.

6. Collectors and refresh

sudo systemctl list-timers --all | grep mykos
sudo systemctl cat mykos-collector.timer mykos-extended.timer
sudo systemctl status mykos-web.service --no-pager

If the dashboard appears stale, distinguish the collector timestamp from browser polling before adjusting either. The last UI timer edits were not independently verified against a new production snapshot.

7. Complete backup and recovery

Use mykos-full-backup-restore.sh from this delivery. It captures actual production source, installed MYKOS helper files, systemd units, inventory, runtime data files, authentication/key databases, and reference copies of Apache/POS configuration. It records file checksums and Python dependency versions. The script does not silently substitute an older installer.

sudo bash mykos-full-backup-restore.sh capture /root/mykos-backups
sudo bash mykos-full-backup-restore.sh inspect /root/mykos-backups/mykos-full-TIMESTAMP.tar.gz

Store the resulting .tar.gz and .sha256 off-host in encrypted, restricted storage. The archive can contain credentials and user information. Keep an additional independent backup of Podman images, OS package repos, TLS certificates, and POS application data: these are external dependencies, not covered by this bundle.

On a compatible replacement system, install and configure the RHEL prerequisites (Python, Podman, Apache, systemd, SELinux, required Python packages). Review the archive and restore only after accepting the current-host safety backup:

sudo bash mykos-full-backup-restore.sh restore /root/mykos-backups/mykos-full-TIMESTAMP.tar.gz --confirm

Default restore preserves existing auth.db and api_keys.db. Add --restore-auth ONLY when intentionally recovering the archived identities and keys; this can replace current passwords and revoke newer API keys. Review the archived Apache virtual-host configuration manually rather than overwriting a shared ssl.conf.

8. Post-recovery verification

• Check systemctl status for mykos-web.service and all MYKOS timers/sockets.
• Verify login using an existing authorized account.
• Open /mykos/api/v2/docs and confirm Swagger Execute URLs include /mykos.
• Call a read-only API v2 endpoint using a known read-scoped key.
• Confirm node counts and eth1 IP values; check collector timestamps.
• Verify container helper socket and non-destructive API operations before testing staging/stopping.
• Confirm terminal access only for intended authorized users.
• Verify Apache proxy, TLS, firewall and SELinux labels on the target host.

9. Troubleshooting commands

sudo journalctl -u mykos-web.service -n 80 --no-pager
sudo systemctl list-timers --all | grep mykos
curl -I https://mykol.com/mykos/
curl -sS http://127.0.0.1:8000/api/v2/host/os

Never roll back the entire deployment to fix a single UI issue. Create and inspect a production bundle first, then make surgical changes with a known-good rollback point.