{
  "captured_utc": "2026-09-12T18:20:00Z",
  "host": "2280104-www0402/0403",
  "rce_user": "uid=1020(wahlkampf.afd.de)",
  "mail_cluster_admin_api": {
    "base": "https://mail-management.afd.de/api",
    "auth_header": "Authorization: <MAIL_API_KEY>",
    "MAIL_API_KEY": "ZEA4R2sEkegRafwLsLPyqnpVAz2EwNnOUb9HscWqZV6TaXejfScxXPOG5ubxzRIhfBfMTBhMWcE7HD95frJt7OXO1b4s8G59z8MqeuCxMP5CiJJpTkdCtsnrZmzsBsxj",
    "verified": true,
    "source": "/var/www/vhosts/mail-mgmt.afd.tools/htdocs/.env",
    "endpoints": ["/v1/domains", "/v1/users", "/v1/aliases", "/v1/dkim-keys", "/v1/user-recipient-specific-bcc-maps"],
    "counts": {"domains": 10, "mailboxes": 50, "aliases": 51, "dkim_keys": 2, "bcc_maps": 50}
  },
  "site_mgmt_wp_connect": {
    "env": "/var/www/vhosts/site-mgmt.afd.tools/htdocs/.env",
    "APP_KEY": "base64:1NsGTPmw4mjI2cyiRUxcTJXO+GdpJtQdRPR3tzGZFW8=",
    "db": {"host": "10.12.51.254", "port": 3306, "database": "site_mgmt_afd_tools", "user": "sql_site_mgmt_afd_tools", "password": "nA0QNKbcSanFHAWHkWM6"},
    "jwt_private_key_path": "/var/www/vhosts/site-mgmt.afd.tools/htdocs/storage/app/private/jwt-private.pem",
    "jwt_public_key_path": "/var/www/vhosts/site-mgmt.afd.tools/htdocs/storage/app/private/jwt-public.pem",
    "sso": {"wp_sso_iss": "205608746105259304454917060053", "orcus_iss": "xjndkqwertyplzmsocvbgahruieowmxnclakfzqp", "orcus_aud": "https://orcus.mgmt.afd.tools/api/wp-connect/sites"}
  },
  "mail_mgmt": {
    "env": "/var/www/vhosts/mail-mgmt.afd.tools/htdocs/.env",
    "APP_KEY": "base64:DrchtHjgtThrPm0MP9RkrtnwbPfgJNaCaixeNFeGRS4=",
    "db": {"host": "10.12.51.254", "port": 3306, "database": "mail_mgmt_afd_tools", "user": "sql_mail_mgmt_afd_tools", "password": "mjqa3Y4DYR2SqGSFMgTq"},
    "report_email": "reporting@ganzrund.at"
  },
  "wordpress_db_creds": {
    "wahlkampf.afd.de": {"db": "wahlkampf_afd_de", "user": "sql_wahlkampf_afd_de", "pw": "bF73Lsv0P845ZsfoVvXw", "prefix": "em0mia_"},
    "afd.de": {"db": "afd_de", "user": "sql_afd_de", "pw": "YXVA7b1fP5KOHpS3hhO7MNX4C", "prefix": "m7p4b7f_"},
    "afd.berlin": {"db": "afd_berlin", "user": "sql_afd_berlin", "pw": "5yqPoCQizdEr3aUn", "prefix": "SvzcaU_"},
    "afdkompakt.de": {"db": "afdkompakt_de", "user": "sql_afdkompakt_de", "pw": "HIbV2mKJgHAKtNQEFfcvHcSDV", "prefix": "zokPq_"},
    "alice-weidel.de": {"db": "alice_weidel_de", "user": "sql_alice_weidel_de", "pw": "a8HvRX9GvJ3aH2fpGDyf", "prefix": "5LYArfEhd_"},
    "bestellung.alternita.de": {"db": "bestellung_alternita_de", "user": "sql_bestellung_alternita_de", "pw": "g9UaLJnRehTeA4fYxvbL", "prefix": "8M7My_"},
    "bilddatenbank.afd.de": {"db": "bilddatenbank_afd_de", "user": "sql_bilddatenbank_afd_de", "pw": "MqxuP4Vi7NXVjRrTeVvt", "prefix": "mU83a9o_"},
    "deine-wahl.afd.de": {"db": "deine_wahl_afd_de", "user": "sql_deine_wahl_afd_de", "pw": "LxcmolLE2e8Mry60TyTqUZ2ahP05AtpxbMmq", "prefix": "wp_"},
    "gemeinsam-fuer-das-grundgesetz.de": {"db": "grundgesetz_de", "user": "sql_grundgesetz_de", "pw": "XCJoBPmnaZOeHAXlrYfXy3kIo", "prefix": "ZECRR9h_"},
    "generationdeutschland.de": {"db": "generationdeutschland_de", "user": "sql_generationdeutschland_de", "pw": "Tgn7c82HCTyp7q!tAdTL", "prefix": "XTGEX54_"},
    "mitmachen.afd.de": {"db": "mitmachen_afd_de", "user": "sql_mitmachen_afd_de", "pw": "e7grsygTaZd9piUenIFxp8S1U", "prefix": "V2nqyVI_"},
    "sachsen-anhalt.afd.de": {"db": "sachsen_anhalt_afd_de", "user": "sql_sachsen_anhalt_afd_de", "pw": "qmUnfyXjRV9Bd2bb79mY", "prefix": "vcMyCle9ww_"},
    "spenden.afd.de": {"db": "spenden_afd_de", "user": "sql_spenden_afd_de", "pw": "5FOr9AvkyHT8aHLUIBk8te74U", "prefix": "axhcA8_"},
    "linksrutsch.com": {"db": "linksrutsch_com", "user": "sql_linksrutsch_com", "pw": "xzWDLnefk2oheylLVJ3pVbEUr", "prefix": "6kPHNw_"}
  },
  "legacy_creds_from_bak": {
    "mitmachen_old": "wp_niiiv / 77xjp6EQS4WQ?o!% (db wp_fszs3)",
    "linksrutsch_old": "wp_a7u2x / VVamkTYd~MN6*X73 (db wp_97fpv)",
    "spenden_old": "wp_5a6lw / ^q2#46IxKwgTdT7D (db wp_z18hh)"
  },
  "ssh_private_key": "/var/www/vhosts/wahlkampf.afd.de/.ssh/id_rsa (saved in logs/_artifacts/rcepost/wahlkampf_id_rsa)",
  "internal": {
    "web_subnet": "10.12.51.0/24",
    "db_mysql": "10.12.51.254:3306",
    "nfs_web": "10.12.51.101:/NFS_2280104_web_0401",
    "nfs_backup": "10.12.51.244:/NFS_2280104_backup0401",
    "orcus_mgmt": "orcus.mgmt.afd.tools = 10.108.1.192",
    "anx_noc_ranges": "10.102.x.x + public ranges (see /etc/apache2/anx_default_allowlist.conf)"
  }
}