first commit

dogfood/references/server-inspection.md

@@ -0,0 +1,69 @@
+# Server Inspection Reference
+
+When asked to inspect a server without a URL, assume the **local machine Hermes runs on**.
+
+## Quick Checklist
+
+### System Resources
+```bash
+# CPU, load, uptime
+uptime && top -bn1 | head -3 && nproc
+
+# Memory
+free -h
+
+# Disk
+df -h
+```
+
+### Running Services & Processes
+```bash
+# All listening ports
+ss -tlnp | grep LISTEN
+
+# Top processes by CPU
+ps aux --sort=-%cpu | head -10
+
+# Docker containers
+docker ps -a
+```
+
+### Service Manager
+```bash
+systemctl list-units --type=service | grep running
+# or
+service --status-all
+```
+
+### Network
+```bash
+# All LISTEN ports (not just common ones)
+ss -tlnp
+
+# DNS resolution test
+nslookup example.com
+```
+
+### Security
+```bash
+# fail2ban status
+fail2ban-client status
+
+# UFW firewall (if enabled)
+ufw status
+```
+
+## Scope Signals
+
+| User says | Means |
+|-----------|-------|
+| "服务器巡检" / "server inspection" | Local machine (no URL given) |
+| "巡检 ephron.ren" | Remote web service at that domain |
+| "check the service on port 8000" | Likely remote host:port |
+| "你的服务器" / "this machine" | Local machine explicitly |
+
+## Anti-Patterns
+
+- **Don't** default to checking remote web services when no URL is provided
+- **Don't** assume the remote service is on the same machine as Hermes
+- **Do** ask for clarification if "server" could mean local or remote