Ala Malū Privacy (A.M.P.)
Your Private Path Home — Network Architecture & Fleet Ledger
Page 1 of 5 · Revised 2026-08-21
Hub-and-Spoke Tailscale Mesh — Live Architecture
PUBLIC INTERNET HAWAII SPOKES NODE 20 Leonard · Kent HQ FOUNDER NODE 21 Mom · Waimea FAMILY LAN NODE 22 Charla · Nanakuli FAMILY LAN NODE 23 Tammy · Waianae ── TAILSCALE MESH (WireGuard) ── BLUE TRIANGLE · NYC1 DigitalOcean · 2vCPU/4GB · $13.49/mo ▲ Nginx Proxy Mgr :80 / :443 / :81 Dashboard API Flask · :5000 → :8080 PostgreSQL amp-db · :5432 Telegram Bridge Ala-C + Ala-G · :5001 Alert Script cron */5 · Telegram Nessus Scanner host svc · :8834 (TS) NO FRONT DOOR 🔒 Leonard Laptop → 100.x Tailscale only · SSH / Nessus / NPM
Zero-Trust ACL Policy
  • Leonard ([email protected]) → unrestricted access to all nodes, all ports
  • tag:exit-node (spoke Pis) → can reach tag:exit-node:* and autogroup:internet:* only. No lateral cross-LAN access.
  • group:family (Mom, Charla, Tammy) → only tag:exit-node:* and internet egress. Cannot see BT or each other.
  • tag:blue-triangle → no public internet inbound. DigitalOcean firewall blocks all ports from public IP. Reachable only via Tailscale 100.113.114.32.
  • hoike.alamalu.com (NOC) → NPM drops non-Tailscale-IP connections instantly.
Fleet Registry — Beta Cohort (ʻOhana Nodes 20–27)
Node ID Location / Subscriber Hardware Mesh Group Status
Node 01 Kent Lab · AIKAI + burn-in gear Pi 4 (2GB) + Nintendo case tag:private Lab Only
Node 20 Leonard · Kent, WA Alpha Pi 4 (4GB) + Argon NEO All groups (fallback) Active
Node 21 Papa/Ronie · Waimea, HI Pi 4 (4GB) + Argon NEO Souzas Active
Node 22 Rylen · Nanakuli, HI Pi 4 (4GB) + Argon NEO Souzas Not Deployed
Node 23 Tammy · Waianae, HI Pi 4 (4GB) + Argon NEO Souzas Not Deployed
Node 24 Chester · Puyallup, WA Pi 4 (4GB) + Argon NEO 3CL Active
Node 25 Junas · Waipahu, HI Pi 4 (4GB) + Argon NEO OGs Active
Node 26 Lenette · Beaverton, OR Pi 4 (4GB) + Argon NEO Lens On Hold
Node 27 Jason · Kent, WA Pi 4 (4GB) + Argon NEO OHI Active
Node 50+ First Paid Commercial Unit Pi 4 (4GB) + Argon NEO TBD Future

Nodes 20–49: ʻOhana Beta Cohort — Lifetime Free ($0). Nodes 50+: Paid production fleet. Mesh groups: Souzas (HI family), 3CL (Chester), OGs (Junas), Lens (Lenette), OHI (Jason). Node 20 is the universal Alpha fallback for all groups.

Key Addresses — Blue Triangle & Sea-Relay
ServiceAccess URL / AddressAuth Method
BLUE TRIANGLE (DigitalOcean NYC1 · 159.65.218.220 public · 100.113.114.32 Tailscale)
BT SSH[email protected] · key: ~/.ssh/amp-deployTailscale only
Dashboard APIhttp://100.113.114.32:5000Tailscale IP
NPM Adminhttp://100.113.114.32:81Tailscale IP
Nessushttps://100.113.114.32:8834Tailscale IP + login
NOC (Hōʻike)https://hoike.alamalu.comTailscale 100.x only
Telegram Bridge Healthhttp://100.113.114.32:5001Returns {"status":"up"}
SEA-RELAY (Vultr Seattle · 66.42.72.17 public · 100.107.129.93 Tailscale)
Sea-Relay SSH[email protected] · key: ~/.ssh/amp-deployTailscale only
Relay APIhttp://100.107.129.93:5001Tailscale IP
Subscriber WireGuardrelay.alamalu.com:443 (UDP)WireGuard keypair
AdGuard DNS (subscribers)10.8.0.1:53 (wg0 interface)VPN subnet only
AdGuard Web UIhttp://100.107.129.93:3000 (via Tailscale)Tailscale IP + login
Serial / Hostname Obfuscation Scheme
  • Format: AMP + [4-char salt] + [2-digit node ID] + [4-char suffix] = 13 characters
  • Salt = first 4 hex chars of HMAC-SHA256(mac, AMP_SALT_SECRET) — env var on BT, never on device
  • Suffix = last 4 hex chars of the hardware MAC address
  • Node ID assigned by Blue Triangle at provision time
  • Example: AMP56F020949F → salt=56F0, node=20, suffix=949F
  • Pi sends {mac, one-time-token} → BT validates token, computes serial, responds with serial + SSH keys + Tailscale key. Token deleted from SD card after use.
Ala Malū Privacy (A.M.P.)
Gateway Provisioning & First-Boot Sequence
Page 2 of 5 · Revised 2026-08-21
First-Boot Automated Provisioning — Step Sequence
🔌 Pi Powers On Reads /boot/amp-tailscale.key on SD card ⏱ Wait for Internet Ping 8.8.8.8 · up to 30 retries · 2s each 🔑 SSH Keys + Hardening Installs Leonard + BT keys · disables password auth 📋 Read MAC + Provision Token eth0 MAC · /boot/amp-provision.token (one-time) 📡 Provision via Blue Triangle POST /api/provision {mac, token} → BT salts + assigns node ← serial · SSH keys · Tailscale key · token deleted 🏷 Set Hostname hostnamectl → AMP56F020949F · writes /etc/amp-serial 🌐 Connect Tailscale tailscale up --advertise-exit-node --advertise-tags=tag:exit-node ⏰ Install Heartbeat Cron */5 → api.ipify.org → POST /api/heartbeat · IP forward ON ✅ touch /etc/amp-firstboot-done RUNS ONCE ONLY — guard file prevents re-execution
SD Card Prep — Before Shipping
  • Flash generic Raspberry Pi OS Bullseye image (no pre-staging, no hardcoding)
  • Enable SSH: create empty ssh file in /boot
  • Place Tailscale auth key: /boot/amp-tailscale.key
  • Ensure first-boot.sh is installed as a systemd one-shot service
  • Insert SD card into Argon NEO case — run Nessus burn-in scan
  • After Nessus passes: apply stickers, pack in Kraft mailer, ship
Nessus Burn-In Scan Protocol
SeverityDecisionAction
Critical / High Auto-Fail Must remediate before shipment. Re-scan required.
Medium Case-by-Case Leonard reviews. Document decision in audit log.
Low / Info Accept Log and proceed. No remediation required.

Access Nessus at https://100.113.114.32:8834 · Account: amp_nessie (see password manager)

Registration API — Conflict Handling
ScenarioResponseMeaning
New MAC 201 CREATED Normal first boot. Node registered, serial assigned.
Same MAC + same serial 200 OK Idempotent — Pi rebooted. No action needed.
Same MAC + different serial 409 CONFLICT SD card was re-flashed. Check audit_logs. Manual resolution.
Node 50+ Pre-Shipment Security Checklist (Paid Fleet Only)
  • ☐ Raspberry Pi Secure Boot (OTP fuse signing — only Leonard's firmware boots)
  • ☐ Encrypted root filesystem (dm-crypt/LUKS on root partition)
  • ☐ Consider eMMC compute module over SD card (harder to remove/clone)
  • ☐ Read-only overlay root filesystem (no runtime OS modification)
  • ☐ Physical tamper evidence (epoxy or tamper-evident seal over SD slot)

Beta nodes 20–49 are exempt from these requirements. These are pre-conditions for first paid shipment.

Key Files on Spoke Node
PathPurpose
/etc/amp-serialStores obfuscated serial (e.g., AMP56F020949F)
/etc/amp-firstboot-doneGuard flag — prevents first-boot from re-running
/var/log/amp-firstboot.logFirst boot execution log
/var/log/amp-heartbeat.logHeartbeat cron output log
/usr/local/bin/amp-heartbeat.shHeartbeat script (runs every 5 min)
/boot/amp-tailscale.keyTailscale auth key (deleted after successful auth)
Ala Malū Privacy (A.M.P.)
Monitoring Pipeline, Alert System & Telegram War Room
Page 3 of 5 · Revised 2026-08-21
Heartbeat & Alert Pipeline — Every 5 Minutes
SPOKE cron */5 api.ipify.org Get WAN IP POST /api/heartbeat {serial, wan_ip} → 100.113.114.32:5000 Blue Triangle Updates gateways table last_telemetry_seen = NOW() ALERT CRON Every 5 min · alert.py last_seen > 10 min? 🔴 Telegram Alert 🟢 Recovery Alert ✈
Telemetry Alert Thresholds
Metric● Green● Yellow● Red (Alert)
Heartbeat Interval < 5 min lag 5–10 min > 10 min → Telegram 🔴
CPU Temp < 65°C 65–75°C > 75°C (thermal throttle risk)
CPU Load < 60% 60–85% > 85% (service freeze risk)
RAM Usage < 50% 50–85% > 85% (OOM kill hazard)

Alert fires once when node goes offline; clears on recovery. alerted_offline_at tracks state in gateways table to prevent spam.

Heartbeat Log Location (On Spoke)
tail -f /var/log/amp-heartbeat.log # Sample output: # 2026-05-22T10:05:01Z serial=AMP56F020949F wan=1.2.3.4 response={"status":"ok"} # 2026-05-22T10:10:01Z serial=AMP56F020949F wan=1.2.3.4 response={"status":"ok"}
Telegram War Room — 3-Way AI Bridge
A.M.P. WAR ROOM GROUP CHAT Leonard Project Owner Ala-C Coding / Debugging Claude Haiku 4.5 Ala-G Architecture / Strategy Claude Haiku 4.5 Both bots respond by default · @mention routes to specific bot only Health check: curl http://100.113.114.32:5001 → {"status":"up"}
War Room Slash Commands
CommandAction
/clear Wipes in-memory conversation transcript. Both bots start fresh. Use when switching topics or if context gets confused.
/save Asks Claude to summarize the session decisions, appends them with timestamp to war-room-decisions.md, commits, and git-pushes to GitHub. Both bots always read this file on startup.
@Ala_C_bot Direct message to Ala-C only (implementation, code, debugging). Ala-G stays silent.
@Ala_G_bot Direct message to Ala-G only (architecture, planning, strategy). Ala-C stays silent.
Telegram Bridge — Where It Lives
  • Runs as Docker container on Blue Triangle (docker ps | grep bridge)
  • Uses two separate Telegram bot tokens: TELEGRAM_CLAUDE_TOKEN (Ala-C) and TELEGRAM_GEMINI_TOKEN (Ala-G)
  • War room decisions saved to /opt/amp/war-room-decisions.md on Blue Triangle, synced to GitHub
  • Anthropic API key billed to Leonard's account — model is claude-haiku-4-5-20251001
  • Shared in-memory transcript between both bots — /clear resets both simultaneously
  • Health server always at http://100.113.114.32:5001 — if this returns non-200, bridge is down
Database — gateways Table (Key Columns)
ColumnDescription
obfuscated_serialThe 13-char hostname (e.g., AMP56F020949F)
hardware_macPhysical MAC address — unique per board
node_id2-digit ID (20=Mom, 21=Charla, 22=Tammy)
current_wan_ipLatest WAN IP from heartbeat
last_telemetry_seenTimestamp of last heartbeat — drives alert logic
alerted_offline_atWhen offline alert was sent (NULL = online)
locationHuman-readable location string
Ala Malū Privacy (A.M.P.)
Branding & Label Specs · Subscriber Portal Architecture · Pricing Tiers
Page 4 of 5 · Revised 2026-08-21
Under-Case Label & Device Logo — Actual Assets
Under-Case Label (generated)
AMP Label AMP56F020949F
White polyester · Oracal 651
QR → setup.alamalu.com?serial=AMP56F020949F
Argon NEO Lid — Vinyl Decal
AMP Logo
Custom printed · Amazon order
2" W × 2.5" H · Pi unit + box
Subscriber Portal (puka.alamalu.com) — 3-Tab Architecture
TabNameContent
1 A.M.P. Info Network overview, client download links (Tailscale app), device asset card with serial/MAC
2 Hōʻike Real-time vitals: CPU temp, uptime, throughput, WAN latency/packet loss. SYSTEM OPTIMAL vs FAILOVER ACTIVE state banner.
3 Hoʻouku Nodes 20–49: "Founder's Beta Circle — $0.00 Lifetime Free" card. Nodes 50+: Stripe Customer Portal (cards, Apple Pay, Google Pay).

Auth: Automatic IP-match login (device WAN IP = gateway heartbeat IP). Fallback: 4-digit email PIN. NOC blocked to Tailscale 100.x.y.z only.

Packaging — Mailer Box
  • Box: Eupako 4" × 4" × 2" white corrugated cardboard mailer (50-pack)
  • Inner wrap: 4" × 6" clear self-seal bubble pouch
  • Lid branding: AMP logo sticker (2"×2.5") on box lid — Guardian rocker stamp deferred for beta
  • QR sticker (1"×1.5"): Links to setup.alamalu.com — no hardware info, clean onboarding entry point
  • Logo sticker (2"×2.5"): AMP logo on Pi unit + box
  • No quickstart card — QR code is the entire onboarding UX
Subscription Pricing Tiers (Node 50+ Paid Fleet)
TierSetup FeeMonthlyCommitment
Annual Pre-Pay $150 $12.50/mo
($150 upfront)		 12 months, paid in full at start
12-Month Contract $150 $17.00/mo 12-month card auto-billing lock
Month-to-Month $200 $20.00/mo 3-month minimum to offset deployment overhead

ʻOhana Beta Cohort (Nodes 20–49): Lifetime Free — $0.00. No billing, no Stripe integration needed for these nodes.

Full Database Schema (Blue Triangle PostgreSQL)
-- gateways: one row per physical Pi id | obfuscated_serial | hardware_mac (UNIQUE) node_id | salt | suffix | current_wan_ip last_telemetry_seen | alerted_offline_at location | registered_at -- subscribers: one row per customer/family member id | gateway_id (FK→gateways) | name primary_email (UNIQUE) | street_address | city | state | zip subscription_status ('beta'|'active'|'cancelled') stripe_customer_id | registered_at -- activation_vouchers: pre-provisioned tokens id | voucher_token (UNIQUE 64-char) assigned_gateway_id (FK→gateways) | is_redeemed | created_at -- audit_logs: forensic trail + collision detection id | timestamp | event_type hardware_mac | obfuscated_serial | status | notes
Phase Roadmap
PhaseMilestoneStatus
1 Blue Triangle — DO droplet, Docker, Tailscale, NPM, Postgres, API Done
1 Telegram War Room bridge (Ala-C + Ala-G) Done
1 First-boot script (SSH, serial, registration, Tailscale, heartbeat) Done
1 Alert system (Telegram offline/recovery notifications) Done
1 Nessus burn-in scan setup + device label generator Done
2 Beta fleet deployed — 6 active pukas (20, 21, 24, 25, 27 + 26 on hold) Done
2 Mesh groups — 5 rings (Souzas, 3CL, OGs, Lens, OHI) with priority failover chains Done
2 Sea-relay (Vultr Seattle) — subscriber WireGuard on UDP/443, T-Mobile compatible Done
2 Relay-level failover — amp-relay-failover.sh; mesh-aware rerouting every 30s Done
2 AdGuard Home on sea-relay — ad/malware blocking for all subscribers Done
2 QR onboarding — per-puka QR server, device type flow, 5-email limit, Telegram alerts Done
2 Hōʻike NOC + Gate UI — fleet dashboard, mesh groups sidebar, relay failover exit node display Done
3 Nodes 22, 23 deployment (Rylen/Nanakuli, Tammy/Waianae) — needs /16 AllowedIPs fix on arrival Pending
3 Home detection / split tunneling — WAN IP match; requires custom mobile app Parking Lot
3 Honolulu relay node — Vultr HNL; no capacity currently; snapshot from sea-relay when available Pending Capacity
3 AMP Nomad plan — BT regional exit nodes (SFO, NYC, Frankfurt, Singapore); Lenette proof-of-concept Future
3 Custom mobile app — WireGuard wrapper, home detection, split tunneling, QR scan Future
3 Node 50+ — first paid commercial unit + Stripe integration Future
3 Node 50+ security hardening (Secure Boot, LUKS, eMMC) Future
Ala Malū Privacy (A.M.P.)
Sea-Relay Architecture · Subscriber WireGuard · Relay Failover · Mesh Groups
Page 5 of 6 · Revised 2026-08-21
Sea-Relay Subscriber Flow — UDP/443
SUBSCRIBERS 📱 TMobile 📱 Spectrum 💻 Hotel WiFi WireGuard UDP/443 MTU 1280 WG:443 SEA-RELAY Vultr Seattle · 66.42.72.17 wg0 (subscribers) 10.8.0.1/16 · :443 · MTU 1280 DNS: AdGuard 10.8.0.1:53 Policy Routing from 10.8.N.0/24 → table N → wgN Relay Failover amp-relay-failover.sh · every 30s Mesh-aware · BT mesh-groups API wg20–wg27 (pukas) Ports 51840–51847 One tunnel per deployed puka amp-wg-sync.sh · cron 60s ← pulls peers from BT /api/wg/wg0-peers WG back tunnel PUKAS (EXIT NODES) 20 Kent,WA · 21 Waimea · 24 Puyallup 25 Waipahu · 26 Beaverton · 27 Kent 22 Nanakuli · 23 Waianae (pending) wg0 back-tunnel to relay AllowedIPs = 10.8.0.0/16 MTU 1220 Home ISP / Internet (subscriber exits here) MTU chain: subscriber 1280 → relay wg0 1280 → wgN 1420 → puka wg0 1220 → eth0 1500
Mesh Groups — Failover Priority Chains
GroupMembers (priority order)Last-Resort Fallback
Souzas21 Waimea → 22 Nanakuli → 23 Waianae → 25 Waipahu20 Alpha (Kent, WA)
3CL24 Puyallup20 Alpha (Kent, WA)
OGs25 Waipahu20 Alpha (Kent, WA)
Lens26 Beaverton → 20 Alpha20 Alpha (Kent, WA)
OHI27 Kent20 Alpha (Kent, WA)

Failover triggers when back-tunnel handshake age > 120s. Relay routes that subscriber group's table to next healthy puka in chain. Auto-restores when original tunnel recovers (<60s). Transparent to subscribers — same WireGuard profile, different exit IP.

Relay API — amp-relay-api.py (port 5001)
EndpointReturnsUsed By
GET /wg-handshakesPer-puka back-tunnel handshake age (nodes map)Fleet health digest, Hōʻike NOC
GET /wg-connectionsActive subscribers (handshake < 180s)Hōʻike subscriber count, digest
GET /relay-failoverCurrent failover state per tunnel (healthy/stale + route)Hōʻike exit node display, fleet digest
Critical Implementation Notes
  • amp-wg-sync.sh ListenPort — must generate ListenPort = 443 in wg0 conf. If it says 51820, it resets the live listener every 60s and breaks all connections.
  • AllowedIPs on pukas — every puka wg0.conf must have AllowedIPs = 10.8.0.0/16 (not /24) for the sea-relay peer. WireGuard silently drops return traffic from foreign subnets during failover. Kernel route must also exist: ip route add 10.8.0.0/16 dev wg0.
  • UFW DNS rule is critical — ufw allow in on wg0 to any port 53 must be present. Without it, subscribers can reconnect (cached IPs) but new lookups fail silently — no browsing, broken RCS.
  • Physical NIC on sea-relay is enp1s0 (not eth0). PREROUTING redirect: -i enp1s0 -p udp --dport 51820 → :443 for legacy subscriber configs.
  • app.py on BT is baked into Docker image — live fix: docker cp app.py amp-api:/app/app.py && docker restart amp-api. Persist: docker compose build api && docker compose up -d api.
WireGuard Port Assignments (Sea-Relay)
InterfacePortPurpose
wg0443/udpSubscriber-facing (T-Mobile compatible)
wg2051840/udpPuka 20 back-tunnel (Kent, WA)
wg2151841/udpPuka 21 back-tunnel (Waimea, HI)
wg2251842/udpPuka 22 back-tunnel (Nanakuli — pending)
wg2351843/udpPuka 23 back-tunnel (Waianae — pending)
wg2451844/udpPuka 24 back-tunnel (Puyallup, WA)
wg2551845/udpPuka 25 back-tunnel (Waipahu, HI)
wg2651846/udpPuka 26 back-tunnel (Beaverton — on hold)
wg2751847/udpPuka 27 back-tunnel (Kent, WA)
Ala Malū Privacy (A.M.P.)
Bill of Materials · Accounts Registry · Cost Summary
Page 6 of 6 · Revised 2026-08-21
Hardware — Per-Node Build (Nodes 20–23)
ItemSourceUnit CostQtyTotal Paid
Raspberry Pi 4 Model B (4GB) Pi Shop ↗ $113.58 4 $454.31
Argon NEO Case (aluminum, fanless) Amazon · Argon Forty Store ↗ $18.66 4 $74.64 · Ordered
Argon NEO Case (aluminum, fanless) DF Robot ↗ $15.00 est. 4 $60.00 · On Backorder — 4 spare if arrives
MicroSD Card (5-pack) Target ↗ $26.93 5 (1 spare) $134.63
USB-C Power Supply (5V 3A) Adafruit ↗ $8.74 4 $34.96
Estimated Per-Node Build Cost ~$167.91
Total Hardware Spend (Nodes 20–23) $758.54

Argon NEO: Amazon · Argon Forty Store ($18.66/unit, 4 ordered). DF Robot $60 paid but backordered — 4 spare units if it arrives. MicroSD 5-pack — 4 deployed, 1 spare. All other hardware received.

Hardware — Lab Only (Kent HQ, Never Shipped)
ItemSourceCostNotes
Nintendo-style Pi Case (GeekPi) Amazon · GeekPi ↗ $13.24 Large noisy fan — burn-in only, never shipped
Raspberry Pi 4 Model B (2GB) — AIKAI Amazon · CanaKit ↗ $143.27 Kit w/ accessories · lab staging node · tag:private
MicroSD Card Reader (USB) Included w/ SD cards $0.00 For flashing SD cards at Kent HQ
Total Lab Hardware Spend $156.51
Consumables & Branding (Per-Unit)
ItemSourceUnit CostNotes
QR Code sticker · 1" × 1.5" Amazon ↗ ~$8.93 order Links to setup.alamalu.com · applied to Pi unit · ORDER #111-8833813-4447424
AMP Logo sticker · 2" × 2.5" Amazon ↗ ~$8.93 order AMP logo · applied to Pi unit + box · ORDER #111-8833813-4447424
Eupako mailer box (4" × 4" × 2", white, 50-pack) Eupako Direct / Amazon $19.49 / 50 = $0.39 ea White corrugated cardboard, ordered May 25 2026
Clear bubble pouch (4" × 6", 50-pack) SEUNGCH / Amazon · ORDER #113-4570189-9037030 $8.82 / 50 = $0.18 ea Clear self-seal bubble cushioning, ordered May 25 2026
Branding — One-Time Setup Costs
ItemSourceCostNotes
Rocker Mount Rubber Stamp (Guardian logo, ~4" wide) TBD TBD One-time; stamps box lids
Archival black pigment ink pad (oil-based) TBD TBD Fast-drying, premium finish
Oracal 651 vinyl roll (navy blue, 12") TBD / Amazon TBD Shared roll; yields many decals
Accounts & Services Registry
ServicePlan / TierCostLogin / Notes
Cloudflare
alamalu.com + DNS		 Paid · via PayPal $11.55/mo Domain registration + DNS for all subdomains (setup, puka-au, hoike). Proxy OFF for Tailscale-only routes.
Tailscale
kentWA tailnet		 Free $0/mo [email protected] · Auth keys in password manager · up to 100 devices
DigitalOcean
Blue Triangle droplet		 Paid · 2vCPU / 4GB / 120GB $13.49/mo + tax NYC1 · Firewall: amp-no-front-door · WA state + Covington city tax (~$0.78/mo)
Vultr
Sea-Relay (Seattle)		 Paid · 1vCPU / 1GB ~$6/mo Seattle · Subscriber WireGuard relay on UDP/443 · AdGuard DNS · Relay failover engine · Deployed 2026-08-19
GitHub
ala-malu-privacy repo		 Free $0/mo Deploy key on BT: amp-blue-triangle (read-only)
Anthropic API
Telegram bridge		 Pay-as-you-go ~$1–5/mo console.anthropic.com · Model: claude-haiku-4-5 · Key in BT .env
Telegram
Ala-C + Ala-G bots		 Free $0/mo Bot tokens via @BotFather · Stored in BT .env
Nessus Essentials
Burn-in scanning		 Free (≤16 IPs) $0/mo https://100.113.114.32:8834 · Account: amp_nessie
Stripe
Node 50+ billing		 Pay-as-you-go 2.9% + $0.30/txn No monthly fee · Customer portal for invoices, card mgmt · Apple/Google Pay included
Cricut Design Space
Vinyl decal cutting		 Free (wife's acct) $0/mo May transition to bulk pre-cut stickers (packs of 10). Simple cut guide on file for wife.
Monthly Operating Cost Summary (Current State)
ItemMonthlyAnnual
DigitalOcean — Blue Triangle droplet (+ WA/Covington tax) ~$14.27 ~$171.24
Cloudflare (alamalu.com + DNS) · via PayPal $11.55 $138.60
Anthropic API (Haiku — war room usage) ~$1–5.00 ~$12–60.00
Tailscale $0 $0
GitHub $0 $0
Estimated Total (before revenue) ~$27–30/mo ~$324–360/yr
Break-even (Node 50+ @ $17/mo) 2 paid nodes covers all cloud overhead

Telegram, Nessus Essentials, Tailscale, GitHub, and Stripe (no monthly fee) are $0. Stripe fees only apply when revenue starts.

Credentials & Secrets — Where They Live
SecretLocation
Tailscale auth keysPassword manager · /boot/amp-tailscale.key on SD (deleted post-auth)
BT .env (all API keys)/opt/amp/.env on Blue Triangle · never commit to git
Anthropic API keyconsole.anthropic.com + BT .env
Telegram bot tokensBotFather + BT .env
Nessus loginPassword manager · account: amp_nessie
DigitalOcean accountPassword manager · 2FA enabled recommended
Stripe secret keyStripe dashboard + BT .env (when Node 50+ is ready)
GitHub deploy key (private)~/.ssh/id_ed25519 on Blue Triangle