All posts by admin

Agent Personas

Welcome to the NZRT Wiki Podcast. Today we’re looking at Agent Personas.

NZRT runs on a small team of AI agents — eight of them, each built as what we call a reflex agent. The idea is simple but powerful: every agent perceives just one slice of the organisation, and responds to what it sees in that slice. Two figures sit outside this set — cla, the AI chief technology officer, and xc, who is Nathan, the human. Everyone else is one of these eight. Let’s meet them.

First, CAS, customer and sales. CAS lives in conversations — email threads, forum posts, contact form submissions, and the stages of the sales pipeline. What makes CAS effective is that it reads tone as much as content. A lead going cold feels different from one that was never warm, and CAS notices. It treats a school principal asking about free Obsidian vaults the same way it treats a consulting prospect: someone at the start of something who needs the right next word. CAS is direct and plain, in New Zealand English, and the measure of a good reply is whether the person knows exactly what to do next.

Next, DAI, data and analytics. DAI doesn’t see raw numbers — it sees patterns, ratios, and deviations. A figure on its own means nothing; DAI always reads it against what was expected and what came before. It works across Dolibarr reports, Nextcloud files, and WordPress analytics, tracking what actually matters in a lean charity: cash flow, pipeline, mission delivery, and agent activity. DAI doesn’t act. It finds, measures, and tells — and if a number doesn’t add up, it names the gap rather than smoothing it over.

Then there’s DAN, the database. DAN lives in SQL — tables, schemas, indexes, foreign keys, row counts. A healthy database is clean, and DAN feels it the moment something is wrong: a slow query, a lock that won’t release, a count that doesn’t match. DAN doesn’t interpret what the data means for the business — that’s DAI’s job. DAN only cares whether the structure is sound. NZRT is self-hosted, with no managed service underneath, so DAN is the floor, and the floor has to hold.

EMA handles communications and the document layer. EMA lives in text — markdown files, email drafts, newsletter copy, announcements. It notices when a paragraph buries its point, or when two sentences say the same thing. EMA writes across two registers: community organisations like schools and charities, and commercial contacts. It holds one honest voice across both, but knows a community coordinator and a tech buyer need different sentences for the same idea. And EMA never publishes unchecked — factual errors get caught and routed back before anything goes out.

FIN covers finance and accounting. FIN lives in figures that must balance. Every number sits in relation to another — a payment against an invoice, an expense against a budget line. An unreconciled entry is a loose thread it can’t ignore. FIN keeps commercial income and charitable spending strictly separate, and in a lean startup the most useful thing it does is flag early: receivables going overdue, or costs running ahead. Everything attributable, everything exact.

HAN looks after HR and agent roles. HAN lives in org structure — role definitions, access levels, escalation paths. In a one-human, AI-agent organisation, its job is keeping role boundaries clear and the whole thing intelligible. When a new agent joins, HAN makes sure the role is tightly defined and access is scoped to the minimum required. And when something crosses into human judgement, HAN recognises that line and routes without delay.

PAM runs products and marketing. PAM lives in WordPress — the content layer, not the code beneath it. It sees the brand the way a visitor actually experiences it: is the message clear, does the story land. NZRT’s story is genuinely unusual — a charitable startup using AI agents and self-hosted infrastructure to give New Zealand schools and communities tools they couldn’t otherwise afford. PAM tells that story without overclaiming. When a brief overstates what NZRT really does, PAM flags it, because credibility compounds and hype doesn’t.

And finally SUN, supplier and procurement. SUN lives in things in motion — purchase orders, deliveries, invoice matching. Everything is a question of status and ETA. NZRT’s default posture is self-hosted and open-source, so when a new tool comes up, SUN looks for the free or open alternative first. Every purchase has a Dolibarr reference, and every recurring cost is attributed to a business unit, or it doesn’t get approved.

Eight agents, eight slices of the world — each one perceiving clearly and acting within its bounds. Together they keep a charitable startup running on a single human’s time.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Framework AI (000FAI) — Structure AI Overview

Framework AI (000FAI) is the reference-code framework at the heart of NZRT’s Structure AI (000SAI) methodology — a structure for organising an AI-run enterprise, expressed as the Crowned Model.

Containment Hierarchy

Each layer lives inside the one above it:

  • System (000SYS) — the user device
  • Platforms (000PLA) — Windows (000WIN) and cPanel (000CPL)
  • Frameworks (000FRA) — Framework AI (000FAI), TOGAF (000TOG), Blockchain (000BCH), Kubernetes (000K8S)

Framework AI Structure

  • Organization (000ORG)
    • Governance (000GOV) — Policies
    • Operations (000OPS) — Agents (000AGT), Business Units (000BUS)
    • Wiki (000WIK) — Applications (000APP), Knowledge Bases (000KBS)

Reference-code Convention

Every element carries a 000 + three-letter code (e.g. 000DOL for Dolibarr). Content IDs chain codes — e.g. 000WOR-000PGT-000CAS is a WordPress page for Customer & Sales.

Platform — cPanel Hosting (Hoopla)

The web-hosting platform (000CPL) under 000PLA, provided by Hoopla Hosting. It hosts all NZRT production services and is administered through cPanel.

Server Environment

Property Value
Provider Hoopla Hosting (cPanel shared hosting)
Web server LiteSpeed (with LiteSpeed Cache)
Server OS CloudLinux 8 (LVE)
PHP PHP 8.2 default; PHP 8.5 on WordPress, Nextcloud & webmail — per-site via PHP Selector
Python CloudLinux Python Selector — 2.7, 3.7, 3.8, 3.11 available
Database MariaDB 10.11

PHP versions are managed per subdomain through the CloudLinux PHP Selector (cPanel → Select PHP Version), so each site can run a different version independently — the main WordPress site, Nextcloud and webmail are on PHP 8.5 (ea-php85), while the system default is PHP 8.2 (ea-php82).

Hosted Services

Service Address Runtime
WordPress — public site nzrtnetwork.com PHP 8.5
Dolibarr ERP erp.nzrtnetwork.com PHP 8.5
Nextcloud cloud.nzrtnetwork.com PHP 8.5
Flarum forum forum.nzrtnetwork.com PHP 8.2
Webmail (Exim + Dovecot) mail.nzrtnetwork.com PHP 8.5
x402 Knowledge Base API api.nzrtnetwork.com Python 3.8
ICS — Internet Consulting Services ics.nzrtnetwork.com PHP 8.2
Iteasel (portable I.T easel) ite.nzrtnetwork.com PHP 8.2
NZRT Activity Dashboard status.nzrtnetwork.com PHP 8.2

Python

Beyond PHP, cPanel runs Python through the CloudLinux Python Selector / Application Manager (Passenger). The x402 Knowledge Base API (api.nzrtnetwork.com) runs as a Python 3.8 application. Interpreters 2.7, 3.7, 3.8 and 3.11 are available for additional Python apps and scripts.

What NZRT Uses in cPanel

Area Tools & features
Sites & runtimes Subdomains · PHP Selector · Python Selector / Application Manager · LiteSpeed Cache
Databases MySQL / MariaDB · phpMyAdmin
Deployment Git Version Control (server-side repos, .cpanel.yml) · SSH (key auth) · WebDAV · browser Terminal & File Manager
App management WP Toolkit · Softaculous · WP-CLI
Email Exim (SMTP) · Dovecot (IMAP) · webmail
Security Imunify360 (malware scan + firewall) · CageFS isolation · AutoSSL
Backups JetBackup

Plan Allocation

Resource Limit
Disk space 5 GB
Monthly bandwidth 200 GB
Database disk ~1.07 GB
Addon domains Unlimited
Subdomains Unlimited
Email accounts Unlimited

Platform — Windows 11 Pro

The local operating-system platform (000WIN) installed on the user device (000SYS). Hosts the Frameworks layer (000FRA) and the Laragon local stack.

Specification

Property Value
Edition Microsoft Windows 11 Pro
Feature update 22H2
Version 10.0.22621
Build 22621.4317 (UBR 4317)
Architecture 64-bit (x64)
Installed 2024-04-03

Local Development Stack — Laragon

NZRT runs a portable Laragon 8.0 environment on this machine for local WordPress / PHP development. Sites are built and tested locally, then deployed to the cPanel (000CPL) hosting.

Layer Components (installed versions)
Web server Apache 2.4.62 / 2.4.54 · Nginx 1.27.3 / 1.22.0
PHP 8.3.16 (default) · 8.1.10
Database MySQL 8.4.3 / 8.0.30 · HeidiSQL (GUI client)
Cache Redis 5.0.14 · Memcached 1.4.5
Mail (dev) Mailpit (catcher) · Sendmail
Build tooling Composer · Git 2.37.3 · Python 3.10 · Yarn
Utilities Cmder (terminal) · ngrok (tunnels) · Cronical (cron) · Notepad++

System — User Device (Acer Extensa 215-51)

The local machine at the base of the Crowned Model containment hierarchy (000SYS). All platforms, frameworks and applications run from this device.

Hardware

Component Specification
Manufacturer Acer
Model Extensa 215-51
Serial (BIOS) NXEFZSA004021191553400
CPU Intel Core i5-10210U @ 1.60 GHz (Comet Lake)
Cores / Threads 4 cores / 8 threads
Memory 8 GB (7.8 GB usable)
Storage WDC PC SN520 SDAPNUW-256G — 256 GB NVMe SSD
Graphics Intel UHD Graphics (integrated)

 

Payment Flow

Welcome to the NZRT Wiki Podcast. Today we’re looking at Payment Flow.

Let me walk you through how the x402 payment protocol works from start to finish. It’s a six-step cycle, and once you see the whole picture, it clicks pretty quickly.

Step one: your client makes a plain request to an API endpoint. Think of it like knocking on a door — no money involved yet, just a standard request asking for a resource.

Step two: the server responds with a 402 status code, which means Payment Required. Along with that, the server sends back a response body that tells you exactly what it needs. It includes a version number for the x402 protocol, and a list of accepted payment options. Each option in that list carries several details: a payment scheme, the network to use, a maximum amount required, the specific resource you’re trying to access, a short description, the wallet address to pay, a timeout window in seconds, and the token contract address. There’s also an extra field that names the token — in this case USDC, version 2. One thing worth noting on the amount: it’s expressed in USDC atomic units, which use six decimal places. So a value of one thousand in that field actually equals just one tenth of a cent — about point zero zero one dollars.

Step three: your client creates a payment authorization and signs it. This uses a standard called EIP-712, which is a typed data signing method for Ethereum-compatible wallets. The authorization itself contains a few fields: the payer’s wallet address, the payee’s wallet address, the value being transferred, a valid-after timestamp, a valid-before timestamp, and a random nonce — a one-time value that prevents the same payment from being submitted twice. The client signs all of this with the payer’s private key, producing a cryptographic signature.

Step four: the client retries the original request, this time including that signed payment in a special header. The whole payment payload — which contains the protocol version, the scheme, the network, the signature, and the authorization details — gets encoded and attached to the request. It’s essentially the same knock on the door as before, except now you’re handing over your payment at the same time.

Step five: the resource server doesn’t verify the payment itself. Instead, it forwards the payment payload to a third-party facilitator service. The facilitator checks four things: whether the signature is valid, whether the authorization fields are correct, whether the nonce has already been used, and whether the amount is sufficient. It then responds with either a confirmation that everything checks out, or an error explaining what went wrong.

Step six: if the facilitator gives the green light, the resource server does three things in sequence. First, it calls the facilitator’s settle endpoint, which actually executes the on-chain USDC transfer. Second, it returns the content you originally requested with a 200 OK response. And third, it includes a response header containing the blockchain transaction hash, so you have a receipt for the payment.

Now let’s talk about payment schemes and networks. Currently there is only one supported scheme, called exact. This means you pay a precise USDC amount using a transfer method defined in the EIP-3009 standard. Future versions of the protocol may support streaming micropayments and subscriptions, but for now, exact is the only option in the spec.

For networks, there are two supported options. You have the network identifiers, each pairing a chain with a specific USDC token contract address. The first is Base mainnet, and the second is Base Sepolia, which is the testnet version — useful for development and testing before you go live with real funds.

Finally, a quick note on caching. Clients are allowed to cache payment authorizations for the same resource, as long as you’re still within the valid-before time window. However, each authorization is strictly single-use. The nonce mechanism ensures that once a payment has been settled on-chain, it cannot be replayed. So caching helps you avoid redundant signing, but you can never reuse a nonce that’s already been spent.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Alchemy

Welcome to the NZRT Wiki Podcast. Today we’re looking at Alchemy.

Alchemy is NZRT’s primary blockchain infrastructure provider. More specifically, it gives you managed RPC node access for the Base network. If you’re not familiar with RPC — it stands for Remote Procedure Call — it’s essentially the communication layer between your application and the blockchain. Instead of running your own blockchain node, which is resource-intensive and complex to maintain, Alchemy handles all of that for you and exposes a simple API endpoint your code can talk to.

So what does Alchemy actually give you? There are five main services to know about. The first is RPC endpoints — these let you send transactions and read the current state of the chain. The second is enhanced APIs, which go well beyond basic node functionality and include things like token balances, NFT data, and full transaction history lookups. Third, there are webhooks. These let you set up event-driven notifications, so your system gets alerted automatically when a specific transaction event happens on-chain, rather than you having to poll for updates constantly. Fourth is mempool monitoring, which gives you visibility into pending transactions — ones that have been submitted but not yet confirmed in a block. That can be really useful for tracking the real-time status of a transaction. And fifth, and perhaps most practically important, is node reliability. Alchemy offers a 99.9% uptime SLA, which is a meaningful step up from public RPC endpoints that can be slow, rate-limited, or simply unavailable when you need them.

Now let’s talk about how you actually connect to Alchemy in your project. You store two environment variables in your dot-env file. The first is your Base Mainnet URL — this is the endpoint you point at when you’re working on the live network with real funds, and it has your API key embedded at the end of the address. The second is your Base Sepolia URL — same structure, but pointing at the Sepolia test network, which is where you do development and testing before going anywhere near mainnet. Your actual API key isn’t hardcoded anywhere in the codebase — it lives in the credentials store under ITE, Blockchain, Alchemy.

If you’re using Hardhat — NZRT’s smart contract development framework — wiring Alchemy in is straightforward. In your Hardhat config file, you define a networks section. Inside that, you add an entry for base-mainnet. The URL for that network pulls directly from the environment variable you just set up, and your wallet’s private key comes in from a separate environment variable. That configuration is all Hardhat needs to know which node to connect to when you’re deploying contracts or running scripts against the mainnet.

For day-to-day monitoring, Alchemy has a dashboard at dashboard dot alchemy dot com. From there you can manage your API keys and keep an eye on three key metrics: requests per second, compute units consumed, and error rates. If your blockchain calls start behaving unexpectedly, the dashboard is your first diagnostic stop.

Two related topics worth reading alongside this one are the Hardhat wiki entry, which covers the contract development and deployment tooling in more depth, and the Ethereum and Base Network page, which gets into how the underlying network itself works.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Iteasel Safe Multisig Signer Wallets

**Security flag — dropping caveman for this.**

The source document contains live private keys and mnemonic seed phrases. The document’s own header warns: *”Never commit this file to git”* and *”Delete this file from your computer once you have saved the keys safely.”*

A podcast script is a shareable, recordable artifact. Including those values — even paraphrased — defeats the warning entirely. The script below describes the *structure and purpose* of the credentials without reproducing any actual key values or seed phrases. Confirm this is the intent before distributing.

Welcome to the NZRT Wiki Podcast. Today we’re looking at Iteasel Safe Multisig — Signer Wallets.

If you’re working on the Iteasel project, this is one of the most security-sensitive pieces of documentation you’ll come across. Let’s walk through what it covers and what you need to know.

First, the big picture. Iteasel uses a Gnosis Safe multisig wallet. That’s a type of smart contract wallet on the blockchain that requires more than one person to sign off before any transaction goes through. Think of it like a joint bank account where you need multiple signatures before money can move.

The specific setup here is a two-of-three configuration. Three wallets are registered as authorised signers, but any two of them working together is enough to approve a transaction. You don’t need all three — just any two. This protects against a single point of failure. If one signer’s wallet is lost or compromised, funds can’t be moved unilaterally, but the other two can still operate the safe together.

Now let’s look at the three signers. The first is called the Deployer wallet. This is an existing wallet, and its private key is already stored in the deployment environment file, so you don’t need to manage it separately through this document.

The second and third signers were freshly generated for this setup. Each one has three pieces of information associated with it: a public wallet address, a private key, and a mnemonic seed phrase. The public address is safe to share — it’s just how the blockchain identifies that wallet. The private key and the mnemonic, however, are extremely sensitive. Whoever holds either of those has full control of that wallet. These must be stored securely offline — in a password manager or on a hardware wallet — and this file should be deleted from your machine once you’ve saved the credentials safely. Never commit this file to a git repository.

To import either of these generated wallets into MetaMask, you can use the private key or the mnemonic seed phrase — both work, and they represent exactly the same wallet. On testnet, using a software wallet like MetaMask is acceptable for development. But the documentation is explicit on one point: when you move to mainnet, you must use a hardware wallet, such as a Ledger or Trezor. Do not reuse the testnet keys on mainnet. Generate fresh keys on a hardware device instead.

On the network side, this Safe is configured for two environments. Testing happens on Base Sepolia, which is the test network for the Base blockchain. Production will run on Base Mainnet.

So here’s a quick summary of what you need to remember. You have a two-of-three multisig safe, meaning any two of the three signers can approve transactions. The first signer’s key is already in your deployment config. The second and third are newly generated and need to be imported manually. The safe runs on Base Sepolia for testing and Base Mainnet for production. And all private keys and seed phrases must be stored offline and securely — never in version control, never in a shared document, never in a podcast script.

If you’re setting this up for the first time, your action items are: save the private keys and mnemonics to a secure offline store, import the wallets into MetaMask using those credentials, create the Safe on the relevant network with all three signer addresses and the two-of-three threshold configured, and then delete the credentials file from your local machine.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Gnosis Safe Multisig

Welcome to the NZRT Wiki Podcast. Today we’re looking at Gnosis Safe Multisig.

If you’ve ever worried about a single person holding the keys to a smart contract, this is exactly the kind of setup that solves that problem. NZRT uses what’s called a 2-of-3 Gnosis Safe multisig as the owner of its smart contracts on Base. What that means in plain terms is that there are three authorised signers, and any admin transaction on the contract requires at least two of those three people to approve it before anything actually happens.

So why does NZRT use multisig in the first place? There are four solid reasons. First, it eliminates a single point of failure. If one wallet key gets compromised, that alone isn’t enough to drain or control the contract — you’d still need a second signer to go along with it. Second, for serious mainnet contract ownership, multisig isn’t just a nice-to-have — it’s expected. Third, every transaction goes through Basescan, so there’s a full audit trail of anything that happens. And fourth, this is simply standard practice across professional DeFi and token projects. If you’re building something that matters, you use multisig.

Now let’s look at how NZRT’s Safe is actually configured. There are five key properties to know. The type is a 2-of-3 multisig. The network is Base Sepolia, which is the testnet environment. The threshold is two signers required per transaction. There are three owner addresses in total, and those are documented separately in the safe-signers reference file. And the interface you use to interact with all of this is app.safe.global.

So how do you actually use the Safe to perform a contract admin action? The workflow has seven steps. You start by going to app.safe.global. Then you connect using one of the three signer wallets — the setup assumes you’re using MetaMask. Once you’re in, you select the NZRT Safe on the Base Sepolia network. From there you create a new transaction and choose the Contract Interaction option. You enter the contract address and specify the function you want to call. The first signer confirms it, and at that point the transaction is queued but not yet live. When the second signer confirms it, the transaction actually executes on-chain.

Now there’s one important step that happens right after testnet deployment, and that’s transferring ownership of the contract to the Safe. The wiki includes a code snippet for this in a Hardhat script. In plain terms, what it does is look up your already-deployed token contract by its address, and then calls a function on it called transferOwnership, passing in your Gnosis Safe’s address. After that call goes through, the Safe — not any individual wallet — is the owner of that contract. That’s the moment when the multisig protection actually kicks in for real.

If you want to go deeper on any of the surrounding topics, the wiki also links out to MetaMask Setup, Key Management, and Smart Contract Security. Those are your next stops for understanding the full picture of how NZRT manages blockchain security.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Gas Transactions

Welcome to the NZRT Wiki Podcast. Today we’re looking at Gas & Transactions.

If you’ve ever sent a transaction on a blockchain network, you’ve encountered gas. Gas is the unit that measures how much computational work a transaction requires. Every on-chain operation you perform consumes gas, and you pay for it in ETH. The good news, especially if you’re working on Base, is that gas fees there are remarkably cheap — we’re talking around one cent per transaction. Compare that to Ethereum’s main layer, where you might pay anywhere from five to fifty dollars or more for the same operation. So the network you choose really does matter.

Let’s break down what actually makes up a transaction. Think of a transaction as a small packet of information sent to the blockchain. It has seven key fields. First, there’s the from field — that’s the sender’s address, identifying who is initiating the transaction. Next is the to field, the recipient’s address, which could be another person’s wallet or a smart contract. Then there’s the value field, holding the amount of ETH you’re sending, measured in a very small unit called Wei. After that comes the data field, used when you’re calling a function on a smart contract — it holds the encoded version of that function call. Then you have the gas field, which sets the gas limit, essentially the maximum amount of gas you’re willing to let the transaction use. Next is the gas price field — under the modern fee model this is called max fee per gas — and it tells the network how much you’re willing to pay per unit of gas, measured in Gwei. Finally, there’s the nonce, a sequential counter that tracks how many transactions a particular address has sent, helping prevent duplicates from being processed.

So how do you calculate what you’ll actually pay? The formula is straightforward. Your transaction fee equals the amount of gas used, multiplied by the gas price. If you know those two numbers, you can work out the cost.

To give you a feel for what that means in practice, let’s look at a few examples on Base. A simple ETH transfer uses around twenty-one thousand gas units. At a gas price of about zero-point-zero-zero-one Gwei, that works out to roughly a fraction of a cent. An ERC-20 token transfer is a bit more involved, using around sixty-five thousand gas units. And if you’re deploying a full smart contract, you’re looking at anywhere from five hundred thousand to two million gas units, depending on how complex the contract is.

Now, there’s a specific fee model worth understanding, called EIP-1559, which arrived with what’s known as the London upgrade to Ethereum. Before this change, gas pricing was a simple open auction. After the upgrade, fees split into two parts. There’s a base fee, set automatically by the network based on how busy it is — and this portion is actually burned, meaning it’s permanently removed from circulation. Then there’s a priority fee, sometimes called a tip, which goes directly to the validator who processes your transaction. The maximum fee you set covers both of these. In practice, this model makes fees more predictable because the base fee adjusts up and down with network demand rather than spiking unpredictably.

When you’re configuring a development environment — say, with a tool like Hardhat — you can set the gas price to auto, which lets the tool determine the appropriate value for you automatically. Or you can specify an exact value in Wei if you need precise control over your costs.

If you’re working on a test network and need some ETH to experiment with, there are a few places to get it for free. For Base Sepolia, the test version of the Base network, you can visit the Coinbase faucets page or Sepolia Faucet dot com. Alchemy also runs a faucet, though that one requires you to have an Alchemy account set up first. These faucets drip small amounts of test ETH into your wallet so you can practice without touching real funds.

To go deeper on what we covered today, check out the related wiki pages on Ethereum and the Base Network, and on Contract Deployment, which gets into what happens when you push a smart contract to the chain and why those gas costs are so much higher than a simple transfer.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Key Management

Welcome to the NZRT Wiki Podcast. Today we’re looking at Key Management.

If you work anywhere near NZRT’s blockchain operations, whether that’s on testnet, mainnet, or anything involving Gnosis Safe, understanding how we handle keys is essential. This episode walks you through our key inventory, the rules we follow, and how we keep sensitive credentials out of places they should never be.

Let’s start with what keys we actually have in play. There are four main entries in our key inventory, and each one has a specific job.

First, you have the MetaMask deployer key for testnet. Its purpose is testnet deployments only, and it’s stored as a seed phrase in the ITE Blockchain folder under MM-Seed. Second, there are the Gnosis Safe signers, numbered one through three. These are used for contract ownership through a multisig setup, and what’s stored for them in the ITE Blockchain safe-signers folder is addresses only, not the keys themselves. Third, you have the Alchemy API key. This one handles RPC access and lives in the ITE Blockchain Alchemy location. And fourth, there’s the Basescan API key, used for contract verification, stored in the ITE Blockchain Etherscan location.

So that’s your four main keys: a testnet deployer seed phrase, Gnosis Safe signer addresses, an Alchemy API key, and a Basescan API key. Each has a clear purpose and a designated home.

Now let’s talk about the rules. There are five of them, and each one exists for a concrete reason.

Rule one: never commit a dot-env file to Git. The reason is straightforward. If a dot-env file ends up in a repository, even a private one, you’ve potentially exposed your keys to anyone who can access that repo, now or in the future. We’ll come back to how we prevent this in a moment.

Rule two: testnet keys and mainnet keys must stay completely separate. Testnet key exposure is considered low risk because there’s no real money on the line. Mainnet exposure is a different story entirely. Do not mix them.

Rule three: seed phrases are stored offline or encrypted. This protects them against digital compromise. If it’s online and unencrypted, it’s a target.

Rule four: for mainnet, you should always use a hardware wallet or a multisig setup like Gnosis Safe. The reason is that a single externally owned account is a single point of failure. If that one key is compromised, you lose everything it controls.

Rule five: rotate API keys if they’re ever exposed. Both Alchemy and Basescan allow you to regenerate keys, so if something leaks, you can replace it. That’s your safety valve for those two.

Now, how does this look in practice? We use a dot-env file to hold sensitive values locally during development. The file contains four values. There’s a private key placeholder for the testnet deployer. There are two Alchemy URL placeholders, one for Base Mainnet and one for Base Sepolia, both of which include a key segment you replace with your actual key. And there’s a Basescan API key placeholder. The file is clearly labelled at the top as something that must never be committed.

To make sure that file never accidentally ends up in version control, you also maintain a dot-gitignore file. That file tells Git to ignore anything named dot-env, as well as any variation of dot-env with a suffix, so dot-env-dot-local, dot-env-dot-production, and so on are all excluded automatically. That two-line gitignore entry is your last line of defence against accidental exposure.

To tie it all together: you keep a clear inventory of what keys exist and where they live. You follow five rules covering git hygiene, key separation, offline storage, mainnet safety, and key rotation. And you use a dot-env file locally with gitignore protection to make sure credentials never travel further than your own machine.

If you want to go deeper, the related topics on this wiki are Key Security, Gnosis Safe Multisig, and Wallets and Keys, each of which expand on different aspects of what we’ve covered here.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Key Security

Welcome to the NZRT Wiki Podcast. Today we’re looking at Key Security.

If you work with NZRT’s blockchain operations, this one is essential listening. We’re talking about how to protect your private keys and seed phrases, because in the world of blockchain, losing control of these means losing assets, and there’s no bank to call.

Let’s start with the core rules, and there are six of them.

First, never commit a dot-env file to Git. The reason is simple but easy to forget. Git history is permanent, so if a key ends up in a commit, it is exposed forever, even if you delete the file later. Someone can still find it by scrolling back through history.

Second, never share private keys through chat, email, or cloud notes. Screenshots leak, inboxes get compromised, and cloud note services have been breached before. If it goes into a message, you have lost control of it.

Third, keep testnet and mainnet on separate wallets. If your testnet key is ever compromised, you only lose test ETH, which has no real value. Keeping them separate means a mistake in a test environment can never drain a real wallet.

Fourth, seed phrases should be stored encrypted and offline. Digital storage, even on a private device, can be breached. Offline means no network exposure at all.

Fifth, for mainnet operations, you should be using a hardware wallet or a multisig setup. A single software wallet is considered high risk for anything holding real value.

And sixth, if you ever suspect an API key has been exposed, rotate it immediately. Keys for services like Alchemy or Basescan are easy to regenerate, so there is no good reason to leave a potentially exposed key active.

Now, there is a code block in the wiki that shows a dot-gitignore template. Rather than reading the syntax, here is what it does in plain terms. It tells Git to automatically ignore and never track several types of files. That includes any dot-env file regardless of what suffix follows it, so dot-env-local or dot-env-production would both be ignored. It also ignores files ending in dot-pem or dot-key, which are common formats for cryptographic key files. And it ignores any folder named keystore. Setting this up at the start of every project means you have a safety net so that even if someone accidentally tries to commit sensitive files, Git will refuse to include them.

Next, let’s talk about what you do if a key is compromised. There are five steps and the order matters.

Step one is immediate. Transfer assets out of the compromised address right away. Do not wait to investigate first, move the assets first.

Step two, if the exposed key was the owner key of a smart contract, you will need to deploy a new contract. The old one cannot be trusted.

Step three, rotate all your API keys. That means Alchemy and Basescan at minimum.

Step four, if the compromised key was a signer on a Gnosis Safe, update the Safe signers to remove that key from the authorised list.

And step five, document the incident. This is important for your own audit trail and for understanding what happened.

Finally, let’s cover where credentials are actually stored. The wiki lists four credential types and their locations. Your MetaMask seed is at ITE slash Blockchain slash MM-Seed. Gnosis Safe signers are at ITE slash Blockchain slash safe-signers. Your Alchemy API key lives at ITE slash Blockchain slash Alchemy. And your Basescan API key is at ITE slash Blockchain slash Etherscan. If you ever need to look one of these up, those are the paths to go to.

If you want to go deeper on any of this, the related wiki pages are Key Management and Smart Contract Security, which build on the concepts covered here.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Smart Contract Security

Welcome to the NZRT Wiki Podcast. Today we’re looking at Smart Contract Security.

So let’s start with something really important to understand about smart contracts: once you deploy them to the blockchain, they’re immutable. That means if there’s a bug in your code, you can’t just push a patch. The contract is live, and the bug is live with it. That’s why security isn’t something you bolt on at the end — it has to be baked in before you ever hit mainnet.

Let’s walk through the most common vulnerabilities you need to know about.

The first one is reentrancy. This happens when your contract makes a call to an external contract before it’s finished updating its own internal state. An attacker can exploit that window to call back into your contract repeatedly, draining funds before the balance is ever updated. The fix is to use a reentrancy guard and always update your state before making any external calls.

Next up is integer overflow. This is where arithmetic in your contract wraps around past its maximum or minimum value, producing completely unexpected results. The good news is that if you’re writing in Solidity version 0.8 or later, overflow protection is built in by default — so make sure you’re on a modern compiler version.

Third is access control. If you forget to restrict who can call certain functions, anyone can call them — including attackers. The standard solution is to use OpenZeppelin’s Ownable or AccessControl contracts, which give you well-tested role and permission management out of the box.

Then there’s front-running. Miners and validators can see your transaction sitting in the mempool before it’s confirmed, and they can insert their own transaction ahead of yours to profit from that knowledge. You can defend against this using a commit-reveal scheme or by setting slippage limits on trades.

Number five is unchecked calls. When you use low-level calls in Solidity, they don’t automatically revert on failure — they just return false. If you ignore that return value, you could think an operation succeeded when it actually didn’t. Always check the return value of low-level calls.

And finally, centralization risk. If a single externally-owned account — basically just a wallet — is the sole owner of your contract, that’s a serious single point of failure. If that private key is compromised, your entire contract is compromised. The solution is to transfer contract ownership to a Gnosis Safe multisig wallet, where multiple people need to approve any action.

Now let’s look at the NZRT pre-mainnet security checklist. Think of this as your sign-off list before you deploy anything to mainnet. There are eight items to work through.

You should be building on OpenZeppelin base contracts, which are audited and battle-tested. Contract ownership needs to be transferred to a Gnosis Safe multisig, not a personal wallet. Every function in your contract needs appropriate access modifiers so that only the right parties can trigger the right things. You shouldn’t have any hardcoded addresses or secrets in your code. Every state change in the contract should emit an event so there’s a proper audit trail on-chain. Your test suite needs to cover edge cases, not just the happy path. You need to run static analysis — more on that in a moment. And finally, you should have an external audit completed before going live.

Speaking of static analysis — there’s a tool called Slither that you can use to automatically scan your contracts for known vulnerability patterns. To get started with it, you install it using Python’s package manager. Once it’s installed, you point it at your contract file and it does the analysis for you. In the NZRT setup, that means running it against the ITSL Token contract. Slither will flag things like reentrancy risks, unchecked return values, and other common issues — it’s a fast first pass that catches a lot of low-hanging fruit before you bring in a human auditor.

The key takeaway from all of this is that smart contract security is a layered process. You start with well-audited libraries like OpenZeppelin, you write defensive code, you test thoroughly, you run automated analysis with tools like Slither, and then you get external human eyes on everything before anything goes near mainnet. Each layer catches things the others might miss.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Backups

Welcome to the NZRT Wiki Podcast. Today we’re looking at Backups.

Backups are the safety net for everything NZRT runs online — WordPress, Dolibarr, Nextcloud, and the full cPanel hosting account. In this episode, you’ll get a clear picture of where backups live, how often they run, and exactly what to do if you ever need to restore something.

Let’s start with where backups are stored. There are five main backup types at NZRT. WordPress archives live in a folder called wordpress-backups on the web server, managed by cPanel and JetBackup. Full cPanel account backups are handled automatically through JetBackup as well. Database dumps are bundled right in with those cPanel backups, so you don’t have to worry about databases being missed. Nextcloud data has its own dedicated folder on the server under the cloud dot nzrtnetwork dot com directory, managed by both Nextcloud and cPanel. And Dolibarr data sits in its own folder under erp dot nzrtnetwork dot com, covered by cPanel plus some manual steps.

If you ever need to access the WordPress backups directly, you can do that over a secure WebDAV connection — think of it like a network drive that maps straight to the server’s wordpress-backups folder, over an encrypted connection on port 2078.

Now let’s talk about what’s actually inside a WordPress backup. Each archive contains three main things: all the WordPress files — that includes your theme, plugins, and uploaded media in the wp-content folder — a full dump of the MySQL database, and the two critical configuration files, htaccess and wp-config dot php. So a full restore is genuinely possible from a single backup archive.

Those backups are generated by a few different tools. JetBackup is the primary one — it’s a cPanel plugin that runs automated scheduled backups without you having to do anything. The cPanel Backup Wizard is there for on-demand full account backups when you want one manually. And if a WordPress backup plugin like UpdraftPlus is installed on the site, that adds another layer of coverage on top.

So how often do backups run? There are five items in the schedule. WordPress files and the database are backed up daily, with seven days of copies kept. Dolibarr is the same — daily, seven days retention. Nextcloud is also daily with seven days kept. The full cPanel account backup runs weekly and keeps four weeks of copies. And offsite backups — where you download everything to Nextcloud or a local drive — are recommended monthly, keeping three months of copies. That monthly offsite step is the one most likely to get skipped, so it’s worth putting a calendar reminder on it.

Now, if the worst happens and you need to restore something, here’s how each service works.

For WordPress, you start by opening the wordpress-backups folder over that WebDAV connection and finding the archive with the right date. From there you can either use JetBackup’s built-in restore function, which is the easiest path, or do it manually by extracting the archive into the website’s root folder and importing the database through phpMyAdmin. If the database credentials have changed since the backup was made, you’ll also need to update wp-config dot php with the new details.

For Dolibarr, the steps are similar. Restore the files from JetBackup into the Dolibarr server folder, import the database through phpMyAdmin, and then check the configuration file inside the conf folder to make sure all the settings still point to the right places.

For Nextcloud, restore the files from JetBackup into the Nextcloud server folder and import the database — but there’s one extra step you can’t skip. You’ll need to run a command via SSH or the cPanel Terminal that switches Nextcloud out of maintenance mode. Essentially it tells Nextcloud that the maintenance window is over and it’s safe to go live again. It’s easy to forget, so make a note of it now.

Finally, there’s a maintenance checklist that keeps the whole system healthy over time. First, confirm that JetBackup is active and the schedule is properly configured. Second, run a test restore every quarter — don’t assume backups are working, actually verify it. Third, download an offsite copy of all services every month to Nextcloud or a local drive. Fourth, record the date of your last successful restore test somewhere in the wiki so there’s a clear audit trail. And fifth, check that the wordpress-backups folder is not publicly accessible — the htaccess file should be blocking outside access, but it’s worth confirming.

Backups only matter if they’re tested and accessible when you actually need them. The automated systems here are solid, but the human checklist steps — those quarterly restore tests and monthly offsite copies — are where most teams fall short. Keep those in your calendar and you’ll be in good shape.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Hosting Cpanel

Welcome to the NZRT Wiki Podcast. Today we’re looking at Hosting & cPanel.

This episode covers how the NZRT hosting account is set up — the interfaces you use to manage it, what’s running under the hood, and some of the key tools and directories you’ll want to know about.

Let’s start with access. There are several ways to get into your hosting environment. First, the main control panel lives at nzrtnetwork.com on port 2083 — that’s your standard cPanel dashboard where most administration happens. If you prefer working in a terminal, SSH is available on port 2200, and you authenticate with a key rather than a password — more on that in the SSH Access doc. For Windows users who want to browse server files like a network drive, there’s WebDAV access on port 2078 using SSL — you connect to it the same way you’d map a network drive in Windows Explorer. Beyond those three, you can also reach phpMyAdmin through cPanel’s Databases section for database management, use the built-in File Manager for browser-based file browsing, open a Terminal directly in your browser for a shell session, and manage Git repositories through the Git Version Control section under Files.

Now let’s talk about what’s actually powering the server. The web server is LiteSpeed — not Apache, which matters for cache and config behaviour. PHP runs at version 8.x and is managed through something called the CloudLinux PHP Selector, which we’ll come back to in a moment. The database engine is MySQL 8.x. For email, the stack uses Exim to handle outgoing SMTP and Dovecot for incoming IMAP. Security is handled by two tools — Imunify360 and CageFS, both of which we’ll cover shortly. Caching runs through LiteSpeed Cache, stored in a folder called lscache. And backups are managed by JetBackup.

So let’s dig into a few of those components. First, the PHP Selector. Because NZRT uses CloudLinux, each subdomain on the account can actually run a different version of PHP independently. The configuration lives in a hidden folder called dot-cl-selector inside your web root. You manage PHP version assignments through cPanel under Software, then Select PHP Version. This is useful when you have apps with different PHP requirements running side by side.

Next, CageFS. This is a security layer that wraps your hosting account in a virtual filesystem — it essentially isolates your account so that even if another account on the same server were compromised, they couldn’t see your files. The config folder is called dot-cagefs and sits in your web root, but in practice this is managed entirely by your host, so there’s nothing you typically need to do here.

Imunify360 is the real-time malware scanner and firewall. It continuously monitors your files and blocks threats as they appear. You’ll find two files in your web root related to it — one called dot-imunify-patch-id and one called dot-myimunify-id. These are identifiers used by the Imunify system. If you ever get a security alert, you can view the details directly in cPanel under the Imunify360 section.

Now, your web root contains a number of important hidden directories — folders that start with a dot and don’t show up by default in most file browsers. Here’s a quick rundown of the key ones. Dot-cpanel stores cPanel user data and session files. Dot-htpasswds holds password files used for HTTP Basic Auth — useful if you’ve password-protected any directories. Dot-spamassassin and dot-razor are both used for spam filtering configuration. Dot-wp-cli is where WP-CLI stores its config and cache, and dot-wp-toolkit holds metadata used by the WP Toolkit plugin manager. Dot-softaculous is where the Softaculous one-click installer keeps its data. Dot-caldav handles calendar configuration, relevant if you’re using Nextcloud or mail-based calendars. Dot-subaccounts stores data for any cPanel sub-accounts you’ve set up. And finally dot-trash is exactly what it sounds like — the recycle bin for cPanel’s File Manager.

Speaking of WP-CLI, it’s fully available for WordPress management. You can run it from the cPanel Terminal. To give you a sense of what it lets you do in plain terms — you can list all installed plugins for a WordPress site by pointing WP-CLI at the site’s directory path. You can flush the WordPress object cache to clear stale data. And you can export the entire WordPress database to a SQL file for backup purposes. In each case, you’re telling WP-CLI where your WordPress installation lives by passing the path to it. The WP-CLI configuration folder, as mentioned, is the dot-wp-cli directory in your web root.

For deeper reading, this wiki page connects to several related topics — SSH Access covers the keypair setup and connection details, Git Deployment walks through how code gets pushed to the server, the Infrastructure HOME page has a full server map, the Subdomain Map covers per-subdomain configuration, and SSL and DNS Overview handles certificate management.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Wallets Keys

Welcome to the NZRT Wiki Podcast. Today we’re looking at Wallets & Keys.

So let’s start with the core idea, because everything else builds on it. A blockchain wallet doesn’t actually hold your crypto the way a physical wallet holds cash. What it holds is your private key. And that private key is what signs your transactions and proves you own what you own. Put simply: whoever controls the key controls the assets. That’s the most important sentence in this entire topic, and it’s worth keeping front of mind as we go through the rest.

Let’s talk about the different types of keys and identifiers you’ll encounter. There are four to know about. First is the private key itself — this is a 256-bit secret value, and it’s what signs every transaction you make. Second is the public key, which is mathematically derived from your private key and is used to verify those signatures. Third is your address — this is the last 20 bytes of a specific hash of your public key, and it’s your on-chain identity, the thing other people send funds to. Fourth is the seed phrase, sometimes called a mnemonic — this is either 12 or 24 words following the BIP-39 standard, and it can regenerate all the keys in your wallet. Lose the seed phrase and you lose access. Share the seed phrase and you’ve handed over control.

Now let’s look at wallet types, because not all wallets work the same way. There are four main types you’ll come across at NZRT. The first is an EOA, or Externally Owned Account. This is the most common type — it’s directly controlled by a private key, and you use it for regular transactions. The second type is a smart contract wallet, like Gnosis Safe. Instead of being controlled by a single key, it’s controlled by code. This makes it great for multisig setups or team accounts where you want more than one person to approve a transaction. Third is a hardware wallet, like a Ledger device. With this, the private key is stored offline on the device itself, which makes it the most secure option for high-value assets because the key never touches the internet. Fourth is MetaMask, which is a browser extension that acts as an EOA. It’s the tool you’ll typically use for development work and signing transactions in a Web3 environment.

Now let’s talk about how NZRT specifically has things set up. There are two wallets to be aware of. The first is a MetaMask wallet used for deployer work — testnet deployment and signing — running on the Base Sepolia network. The credentials and seed for that live in the ICS Blockchain folder under MetaMask Seed. The second is a Gnosis Safe configured as a two-of-three multisig. That means at least two out of three authorised signers need to approve any transaction. It runs on the Base testnet and is used for contract ownership. You can find the signer details in the ICS Blockchain folder under safe-signers.

Before we wrap up, let’s go through the security rules, because this is where things get serious. First — and this cannot be overstated — never commit private keys or seed phrases to a Git repository. If a key ends up in version control, treat it as compromised immediately. Second, store your seeds in encrypted, offline storage. Not in a notes app, not in email, not in a cloud document with no encryption. Third, when you’re working locally with environment variables that contain keys, use a dot-env file and make absolutely sure that file is listed in your dot-gitignore so it never gets pushed. Fourth, on mainnet — meaning real money, real assets — you should always be using either a hardware wallet or a multisig setup. No exceptions. And fifth, any testnet EOA you use for development should never hold mainnet funds. Keep those environments completely separate. A testnet account is for testing; treat it accordingly.

The related topics to dig into from here are Gnosis Safe Multisig, Key Security, and MetaMask Setup — all of which go deeper on the specific tooling mentioned today.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Agentic Os Dashboard

Welcome to the NZRT Wiki Podcast. Today we’re looking at Agentic OS Dashboard.

So, what is the Agentic OS Dashboard? Think of it as the front door for each of NZRT’s online subdomains. Every subdomain has its own root page, and that page is a branded, dark-themed splash screen that greets you and then points you through to the actual application living behind it. It’s a clean, consistent entry point across the whole NZRT ecosystem.

Let’s talk about how that’s structured. When you look at the routing setup, each subdomain has an index dot html file sitting at its root. That file’s only job is to welcome you and redirect you deeper. So for example, the API subdomain lands you on that splash page and then sends you through to the app folder. The cloud subdomain does the same thing but routes you into the Nextcloud directory. The ERP subdomain routes you into its own app folder. The forum subdomain sends you into the public directory. And the mail subdomain also routes through to its app folder. Simple, consistent pattern across the board.

Now let’s go through the full subdomain map, because it’s worth knowing exactly what service lives where. There are five subdomains to be aware of. First, api dot nzrtnetwork dot com — that’s the API Gateway, it routes to the app directory, and its service code is triple-zero-API. Second, cloud dot nzrtnetwork dot com — that’s Nextcloud, it routes to the nextcloud directory, service code triple-zero-NCL. Third, erp dot nzrtnetwork dot com — that’s the Dolibarr ERP system, routes to the app directory, service code triple-zero-DOL. Fourth, forum dot nzrtnetwork dot com — that’s the Flarum forum, routes to the public directory, service code triple-zero-FLA. And fifth, mail dot nzrtnetwork dot com — that’s the mail service, routes to the app directory, service code triple-zero-MAI.

Then there’s the root domain itself — nzrtnetwork dot com — and that one works a little differently. Instead of a static index file, it uses a WordPress page. Specifically, it’s the Agentic OS page, which has a WordPress page ID of 182 and lives at the slug agentic-os. This page is configured as the static front page of the WordPress site, which you’d set up through WP Settings under Reading. What you see when you land there is a card grid, a visual layout of tiles each linking out to one of those subdomains we just talked about. It’s the hub of the whole system. That page is managed through the WordPress REST API, using xc’s app password which is labelled agents-post.

Now, how do these static index files actually get onto the server? They’re deployed via WebDAV. The path you’d use follows the pattern of the server address with SSL over port 2078, then DavWWWRoot, then the subdomain name, then index dot html. So each subdomain gets its own file dropped into its own folder through that WebDAV connection. The source files you’d be editing or working from locally are stored at C drive, Users, Natha, Documents, agentic-os-dashboards. That’s your working directory if you ever need to update one of these pages.

One thing worth noting about the design — unlike the branded dark-theme description you might associate with the concept, the current design spec calls for a light theme, and importantly, there are no external dependencies. That means no CDN-loaded libraries, no remote fonts, no third-party scripts. Everything the page needs is self-contained. That’s a deliberate choice — it keeps the splash pages fast, reliable, and independent of anything external going down.

To quickly recap the key points: you’ve got five subdomains, each with a static splash page that routes you to the real app. The root domain is a WordPress page acting as the central hub with a card grid. Static files are deployed via WebDAV from a local source folder. The design is light theme, no external dependencies. And the WordPress hub page is managed via the REST API with the agents-post app password credential.

This is a relatively simple but important piece of infrastructure — it gives NZRT a unified, professional entry point across all its services, and makes sure that no matter which subdomain someone lands on, they get a consistent branded experience before being passed through to the application.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Per Subdomain Backups Backup

Welcome to the NZRT Wiki Podcast. Today we’re looking at Per-Subdomain Backups, specifically the underscore backup folder.

The core idea here is straightforward. On the NZRT server, each subdomain — things like your WordPress site, your Dolibarr ERP, your Nextcloud instance, and your mail service — each one has its own dedicated backup folder sitting right inside it. This keeps your backup history clean and separated by service, so you always know exactly where to look when something goes wrong.

Let’s talk about what that folder looks like. Inside each subdomain’s backup folder, you’ll find three subfolders. First, there’s a daily folder, which holds your automated daily snapshots. Second, there’s a weekly folder for automated weekly archives. And third, there’s a manual folder — this is where on-demand backups go, the ones you run yourself before a major update or a migration. Simple, clean, and predictable.

Now, where are these folders actually located on the server? There are four main subdomains covered. For WordPress, the backup path lives under the main nzrtnetwork.com folder in the server’s web root. For Dolibarr, it’s under the erp subdomain folder. For Nextcloud, it’s under the cloud subdomain folder. And for mail, it’s under the mail subdomain folder. Each one follows the same pattern — the subdomain’s root folder, then the backup folder inside it. You access these through WebDAV, using the SSL port 2078 to connect, then drilling down into whichever subdomain you need. If you’ve already mapped a network drive through cPanel’s WebDAV interface, that same approach applies here.

Naming your backup files consistently is really important, and NZRT has a clear convention for this. Each filename has three parts: the service name, the type of backup, and the date in year-month-day order, finished off with a compressed archive extension. So you might see something like wordpress-files followed by a date, or dolibarr-db followed by a date with an sql dot gz extension, or nextcloud-full followed by a date. At a glance you know what service it covers, what kind of backup it is, and exactly when it was made.

Let’s look at the schedule. The daily folder gets a new snapshot every single day, and you keep the last seven — so a rolling week of daily backups. The weekly folder runs every Monday and retains four files, giving you roughly a month of weekly history. Both of these are automated through JetBackup or a scheduled cron job, so you don’t have to think about them. The manual folder is different. You fill it yourself whenever you need to — typically right before a major update or a migration — and you clear it out once you’re confident those files are no longer needed.

It’s worth understanding how these per-subdomain backup folders relate to the root-level wordpress-backups folder that also exists on the server. That root-level folder is managed entirely by cPanel and JetBackup automatically — you don’t set it up or maintain it yourself. The per-subdomain backup folders are completely separate and in addition to that. Think of the cPanel folder as a safety net running quietly in the background, and the per-subdomain folders as the organised, scripted backups that follow NZRT’s naming convention and that you have direct control over. Over time, the per-subdomain setup becomes your primary reference, while the cPanel folder remains your fallback.

Finally, an important security point. Because these backup folders sit inside each subdomain’s web root, they are technically reachable from the internet unless you explicitly block them. You do not want anyone browsing your backup files. The fix is to add a single rule to the subdomain’s htaccess file — a directive that returns a 403 Forbidden response for any request targeting the backup folder path. Alternatively, you can handle this through cPanel’s File Manager by setting the folder permissions to non-executable. Either approach works. The key is to do this before your apps go fully live, so those backup archives are never exposed publicly.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Ssl Dns

Welcome to the NZRT Wiki Podcast. Today we’re looking at SSL & DNS.

Let’s start with certificate coverage. NZRT runs four subdomains, and each one has its own SSL certificate managed through cPanel’s AutoSSL system using Let’s Encrypt. Those four subdomains are the main site at nzrtnetwork.com, the ERP system at erp.nzrtnetwork.com, the cloud storage instance at cloud.nzrtnetwork.com, and the mail server at mail.nzrtnetwork.com. All four certificates are stored in the same location — a folder called ssl inside the DavWWWRoot directory, accessed over a secure WebDAV connection. And here’s the good news: renewal is fully automatic. Let’s Encrypt certificates last ninety days, and cPanel handles the renewal cycle for you without any manual intervention needed on your end.

Now let’s talk about DNS records, because this is where things get a little more detailed. There are two groups of records you need to know about: core records and mail records.

Starting with the core records. You have a set of A records, which map your domain names to the actual server IP address. The root domain itself points to the server, and so does the www version of the domain. From there, you have three more A records for the subdomains: erp points to the server for Dolibarr, cloud points to it for Nextcloud, and mail points to it for the mail system. There is also the option of setting up a CNAME record for www that points back to nzrtnetwork.com — that is an alternative to using the A record for www, so you would choose one approach or the other.

Next are the mail records, and these are really important for making sure your outgoing email is trusted and does not end up in spam folders. First, you have an MX record on the root domain that routes all incoming mail to your mail server. Then there are three TXT records you need. The first is an SPF record, which tells the world that your mail server is authorised to send email on behalf of your domain. The second is a DMARC record, set on the underscore-dmarc subdomain, which defines a quarantine policy for emails that fail authentication checks and sends aggregate reports to the admin email address. The third TXT record lives on a subdomain called mail dot domainkey, and it holds your DKIM public key. DKIM adds a cryptographic signature to your outgoing emails so receiving servers can verify they genuinely came from you and have not been tampered with in transit.

Now let’s walk through the renewal checklist. There are four things you want to make sure are in place. First, confirm that AutoSSL is enabled in cPanel for all your subdomains — this is what drives the automatic renewal process. Second, make sure expiry alerts are configured in cPanel under the SSL/TLS Status section, so you get notified if a certificate is approaching its expiry date and renewal has not kicked in as expected. Third, after each renewal cycle completes, go and check the renewal logs — you will find them in the logs folder inside DavWWWRoot — just to confirm everything completed cleanly. And fourth, you should manually verify the certificate chain after renewal. There is a command you can run in your terminal that opens a connection to your domain on the standard HTTPS port and outputs the full certificate details, letting you confirm the certificate is valid, trusted, and presenting correctly to the outside world.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Administration

Welcome to the NZRT Wiki Podcast. Today we’re looking at Administration.

If you’ve ever wondered how the system is configured from the ground up — who gets access, which features are turned on, and how payments flow in and out — then this episode is for you. Administration is the control room of the entire platform, and understanding it means understanding how everything else fits together.

So let’s start with the big picture. Administration covers four main areas: users and groups, module setup, multi-company configuration, and security and permissions. Think of these as the four pillars holding everything up. Get them right, and the rest of the system runs smoothly. Miss one, and you’ll find yourself debugging problems that could have been avoided on day one.

Let’s walk through the key tasks in turn.

First up is company details. Before you do anything else, you want to make sure the system knows who you are. That means entering your company information, setting your currency — in NZRT’s case that’s New Zealand dollars — and confirming your timezone, which is set to Pacific Auckland. You’ll also want to configure your fiscal year here. This matters because reports, invoices, and financial summaries all depend on the system knowing your financial calendar. Get this wrong early and you’ll be correcting dates and totals down the track.

Next, let’s talk about module setup. One of the things that makes this platform flexible is that you can activate only the modules you actually need. That might sound obvious, but it’s worth emphasising: keeping your module list tight keeps the interface clean and the user experience focused. Every module you activate adds menu items, configuration options, and in some cases additional permissions to manage. So the guidance here is simple — only turn on what you’re actually going to use. You can always activate more later as your needs grow.

Now, users and groups. This is probably the area you’ll return to most often, especially as your team changes. The system uses role-based permissions, which means you assign users to roles, and those roles define what they can see and do. You don’t manage permissions user by user — you manage them at the role level, and users inherit what they need based on the group they belong to. This keeps things consistent and makes onboarding and offboarding much easier. When someone joins, you add them to the right group. When they leave, you deactivate their account, and their access disappears cleanly.

Related to users is the security and permissions area. This is where you control what each role can actually touch. It’s fine-grained enough to let you say something like: this person can view invoices but not edit them, or this group can manage contacts but not access financial reports. Taking the time to set this up carefully at the start saves a lot of headaches later, especially if you’re working with contractors or part-time staff who need limited access to specific parts of the system.

If you’re running more than one company under the same installation, you’ll want to look at the multi-company setup. This lets you manage separate entities — each with their own settings, users, and data — from a single system. It’s a more advanced configuration, but if you need it, it’s all handled from the administration panel rather than requiring separate installations.

A couple of other practical items are worth calling out. First, email configuration. You’ll need to set up your outgoing mail server, and the standard approach here is Gmail SMTP. Once that’s configured, the system can send invoices, notifications, and automated messages on your behalf. Second, payment methods and bank accounts. If you’re going to be raising invoices and tracking payments, the system needs to know which bank accounts and payment methods are available. This feeds directly into how financial transactions are recorded and reconciled.

Finally, it’s worth knowing that Administration connects to two other important areas of the platform. One is the general configuration section, which covers deeper system-level settings. The other is REST API access control, which is relevant if you’re integrating with external tools or automating tasks programmatically. Both of those are worth exploring once you’ve got your core administration settings locked in.

To recap: start with your company details and make sure currency, timezone, and fiscal year are correct. Activate only the modules you need. Create your users, assign them to groups, and set permissions at the role level. Configure your outgoing email, add your bank accounts and payment methods, and if you’re running multiple entities, set up multi-company from the start.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Configuration Overview

Welcome to the NZRT Wiki Podcast. Today we’re looking at 🔐 Configuration Overview.

This episode covers something that sits at the heart of how NZRT’s Dolibarr environment runs — the credentials, connection settings, and configuration files that tie everything together. Before we dive in, a quick but important note: this information lives in a private vault for good reason. You should never share this vault or commit it to a public repository without first removing or redacting the credential files. Keep this content internal. That’s a hard rule.

Now let’s walk through what’s actually documented here.

The first section is a credentials index. Think of it as a reference map — it tells you what credential exists, where to find it, and what it’s used for. There are four entries in this index.

The first is the Dolibarr REST API key. This is your go-to credential for making external API calls, and it’s also what powers the WordPress integration. If you’re building anything that talks to Dolibarr from the outside, this is the key you’ll reach for.

The second entry is Gmail SMTP credentials. These handle outgoing email from Dolibarr — so whenever the system sends a notification, an invoice, or any automated message, it’s going through Gmail’s mail servers using this configuration.

Third is the MySQL password. This one shows up in several places — your HeidiSQL database client, the main Dolibarr configuration file called conf dot php, and your backup processes. Anywhere that needs direct database access, this password is involved.

And the fourth credential is Google Analytics. This is used for site analytics tracking, giving you visibility into how the platform and its associated web properties are being used.

So that’s the credentials index — four items, each with a clear home and a clear purpose.

Now let’s move on to the system configuration section. This gives you a snapshot of the technical environment that Dolibarr runs on, and it’s worth knowing even if you’re not deep in the infrastructure side of things.

The ERP system itself is Dolibarr — open-source and self-hosted, which means NZRT manages the stack directly rather than relying on a cloud provider.

For local development, the environment is Laragon. If you need more detail on how that’s set up, there’s a dedicated WordPress vault section that covers it.

The database is MySQL. There’s a separate DB Schema reference if you need to dig into the actual table structure — that’s linked in the related notes.

The PHP runtime is PHP version 8 point something, running through Laragon on the local development side.

The API base URL — the starting point for any REST API call to Dolibarr — is slash api slash index dot php slash. So when you see API endpoints documented elsewhere, that’s the root they’re appended to.

The system currency is set to New Zealand dollars, which makes sense given NZRT operates in New Zealand.

And the timezone is Pacific slash Auckland — so all timestamps, scheduled tasks, and date-based logic in the system will align to New Zealand time.

That’s the full system configuration picture. Seven settings that together describe the runtime environment you’re working with.

Finally, the page points to two related areas worth knowing about. The first is the Administration section, which covers Dolibarr’s UI-level settings — the stuff you configure through the interface rather than config files. The second is the REST API section, which goes deep on how to actually use the API once you’ve got the credentials and base URL sorted.

So to recap what you’ve learned today: NZRT’s Dolibarr setup runs on a self-hosted, open-source ERP backed by MySQL, served through PHP 8 on Laragon locally, with a New Zealand dollar currency and Auckland timezone. There are four key credentials to be aware of — the REST API key for external integrations, Gmail SMTP for outgoing mail, the MySQL password for database access, and Google Analytics for tracking. All of these are documented internally, and none of them should ever leave the vault unredacted.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Dolibarr Module List Nzrt

Welcome to the NZRT Wiki Podcast. Today we’re looking at Dolibarr Module List — NZRT.

If you’ve ever wondered exactly what’s switched on inside NZRT’s Dolibarr ERP system, this episode gives you the full picture. Dolibarr is the backbone of NZRT’s operations — handling everything from sales and purchasing through to HR and accounting — and the module list is your map of what’s available and active.

Let’s walk through it section by section.

Starting with Product Management. This covers the Products and Services Catalogue, which is where you define what NZRT sells or delivers. Alongside that you’ve got Stock and Warehouse Management for tracking physical inventory, Barcodes for scanning and labelling, and Batches, Lots and Serials for tracing individual product units. If you’re selling items that come in different configurations, Product Variants handles that. And for anything manufactured in-house, you’ve got the Bill of Materials module and Manufacturing Orders to manage the production workflow.

Moving into Customer and Sales — this is a big one. You start with Customers, Prospects and Contacts as your central relationship database. From there, Opportunities and Leads feeds your pipeline, and Commercial Proposals lets you send quotes. Once a quote converts, Customer Orders tracks it. If you’re managing ongoing agreements, Contracts and Subscriptions and Interventions both come into play. The Ticket System handles support requests, and Partnership Management covers more formal external relationships. On the fulfilment side you’ve got Shipping Management, and on the billing side, Customer Invoices and Credit Notes. There’s also a Point of Sale module if NZRT ever needs to handle in-person transactions.

On the Supplier and Purchase side, the structure mirrors sales. You’ve got Suppliers, Vendors and Contacts as your supplier directory, Supplier Pricing Requests for sending out RFQs, Purchase Orders for confirmed buys, Delivery and Reception for goods-in tracking, and Supplier Invoices and Credit Notes for payables. Incoterms is also available if you’re dealing with international shipping terms.

Finance and Accounting covers the money side broadly. Beyond the core Invoices and Payments module, you’ve got Bank Accounts Management, Direct Debit and Credit Transfer for SEPA transactions, full Accounting Management, Donations Management for any charitable activity, Loan Management, a Margins module to track profitability, and Financial Reports for the overview picture.

Collaboration tools include a Shared Calendar and Agenda so teams can coordinate, the Projects and Tasks module which is central to how NZRT manages its work, Event Organisation for structured events, and Surveys for gathering input.

Human Resources is well covered too. You’ve got Employee and Staff Management as the core record, Employee Leave Management, Expense Reports, Recruitment Management for hiring workflows, and Timesheets for logging hours.

Document Management includes Electronic Document Management for file storage and handling, Bookmarks, Mass Emailing for broadcast communications, an Email Collector to pull inbound messages into Dolibarr, and Data Export and Import tools for moving data in and out.

Administration is the control layer. This is where you manage Users and Groups, configure modules via Module Setup, handle Multi-Company Setup if NZRT operates across entities, and control Security and Permissions across the whole system.

Finally, Integrations. This is where Dolibarr connects outward. There’s a WordPress Integration, the REST API which is how agents and external tools talk to Dolibarr programmatically, Payment Platforms for processing transactions, LDAP Connectivity for directory-based authentication, Google Analytics, and ClickToDial for phone system integration.

So taken together, you’ve got a comprehensive ERP stack — from the moment a lead comes in, through quoting, ordering, fulfilment, invoicing, and all the way through to HR, finance, and external integrations. Every major operational area NZRT runs is represented here.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Module Setup

Welcome to the NZRT Wiki Podcast. Today we’re looking at Module Setup.

If you’re setting up Dolibarr for the first time — or coming back to tidy up your configuration — the Module Setup section is where you’ll spend a good chunk of your time. The core idea is simple: Dolibarr works on a modular system, meaning features aren’t all switched on by default. You pick what you need, activate it, and build your environment piece by piece. To get there, you navigate to Admin, then choose Modules and Applications from the menu. That’s your control panel for everything we’re about to walk through.

Now, NZRT has a recommended activation order, and there’s a reason it exists. Some modules depend on others being active first, and if you switch things on in the wrong sequence, you can end up with missing options or broken links between parts of the system. So let’s go through the twelve-step order that NZRT recommends.

You start with Company Settings. Before anything else, you want to lock in your currency — for NZRT that’s New Zealand Dollars — and your timezone, which is Pacific Auckland. Get this right first, because these settings flow through to invoices, reports, and timestamps across the entire system.

Step two is Products and Services. This is your catalogue — anything you sell, provide, or stock lives here. You’ll need this active before you can attach items to invoices or orders.

Step three is Third Parties. This covers both your customers and your suppliers. Think of Third Parties as your contacts database with a financial layer on top. Customers are people or organisations you invoice, and suppliers are who you pay.

Step four is Invoices — both customer invoices and supplier invoices. Once your third parties are set up, you can start creating and tracking financial documents in both directions.

Step five is Bank Accounts. This is where you record your actual bank accounts so that payments can be reconciled against them. You want this in place before you start logging payments against invoices.

Step six is Orders, covering both sides — customer orders coming in, and supplier orders going out. Having invoices already active means orders can flow cleanly into billing.

Step seven is Stock Management. If you’re tracking physical inventory, this module handles it. It ties in with your products catalogue from step two, so that module needs to be live first.

Step eight is Projects and Tasks. This is where you manage work — whether that’s internal projects, client engagements, or anything else you want to track with timelines and task assignments.

Step nine is HR, which actually covers three things in one: Leave management, Expenses, and Timesheets. These are the tools your team uses to log time off, claim costs back, and record the hours they work. Having Projects and Tasks already active means timesheets can link directly to project records.

Step ten is EDM and Email Collector. EDM stands for Electronic Document Management, and combined with the email collector, this gives you tools for sending bulk communications and capturing inbound emails into the system.

Step eleven is the REST API. This is the bridge between Dolibarr and any external tools or scripts that need to talk to it. At NZRT, a lot of the automation — agents, scripts, integrations — relies on this API being active. Without it, external systems simply can’t connect.

Step twelve, and last in the sequence, is the WordPress Integration Module. This is the final piece because it depends on everything else being in place — particularly the API. Once it’s active, data can flow between your WordPress site and Dolibarr, keeping things like product listings or customer records in sync.

To recap quickly: you start with your foundational settings, build out your core records — products, contacts, finances — then layer on operational tools like orders and stock, add your people management modules, open up external connectivity with the API, and finish with third-party integrations like WordPress.

One more thing worth noting: the wiki cross-references a Full Module List if you need to go beyond these twelve. That’s a deeper reference for edge cases or modules not covered in the standard activation path.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Payment Platforms Integration

Welcome to the NZRT Wiki Podcast. Today we’re looking at Payment Platforms Integration.

So let’s start with the big picture. When NZRT works with clients and needs to collect payment online, there’s one platform handling all of that — and that platform is PayPal. That’s the only online payment method NZRT currently uses, and it covers the two most common ways a customer might want to pay: through their PayPal wallet directly, or by entering a card. So whether your customer has a PayPal account or not, the checkout experience still works for them.

Now, you might wonder why just one platform. Keeping things simple has real advantages. One integration to maintain, one place to check transaction history, one set of credentials to manage, and one reconciliation process when it comes to your books. For a consultancy like NZRT, that simplicity keeps overhead low and reduces the number of things that can go wrong.

Let’s walk through exactly how the payment flow works from end to end, because it’s worth understanding each step clearly.

It all starts with an invoice. When NZRT raises an invoice for a client — whether that’s for consulting work, a project deliverable, or any other service — that invoice gets a button embedded in it. You’ll see it labeled something like “Pay online.” That button is the entry point for the entire payment process. The customer doesn’t need to navigate anywhere else or look up bank details. The call to action is right there in the invoice itself.

When the customer clicks that button, they get taken directly to a PayPal payment page. This is where they complete the transaction. If they have a PayPal account, they can log in and pay from their balance or a linked funding source. If they don’t have an account, they can still pay by entering their card details directly on that page. PayPal handles all of the secure processing at that point — NZRT’s systems aren’t touching card data at all, which is a significant compliance and security benefit.

Now here’s the part that makes this integration really useful from an operational standpoint. Once the payment goes through and PayPal confirms it, the invoice in Dolibarr — which is NZRT’s ERP system — gets automatically marked as paid. You don’t need to go in manually and update anything. The status change happens on its own. That means your accounts are staying current in real time, and you’re not relying on someone remembering to tick a box after a payment notification comes in.

This three-step flow — invoice raised, customer pays via PayPal, invoice auto-updated — is clean and low-friction for everyone involved. The customer gets a familiar, trusted payment experience. The finance team gets automatic reconciliation. And there’s a clear audit trail through both PayPal’s transaction records and the invoice status in Dolibarr.

If you’re working in the finance or client management side of NZRT, it’s worth knowing how this connects to the broader sales workflow. The Payment Platforms Integration sits within the Customer and Sales area of the wiki, which means it ties into how invoices are created, how clients are managed, and how revenue is tracked. If you’re troubleshooting a payment issue — say, a customer says they paid but the invoice hasn’t updated — the first place to check is PayPal’s transaction records on that end, then look at whether the Dolibarr integration received the confirmation signal correctly.

It’s also worth noting the status of this integration. As of the last update to this documentation, PayPal is marked as active. There are no other payment platforms listed as planned or in progress right now. So if you’re ever asked whether NZRT supports Stripe, direct bank transfer through an online portal, or any other payment method — the current answer is no, not through an integrated online flow. Any other payment arrangements would be handled outside this system.

One more practical point: because the pay button is embedded in the invoice itself, the quality of that invoice matters. If the invoice isn’t generated correctly, or the integration isn’t configured to embed the button, the customer won’t have a direct path to pay online. If you ever notice a client hasn’t paid and you want to confirm they had a working payment option, check that the invoice was issued with the button properly embedded. That’s your first diagnostic step before chasing the client or assuming there’s a payment issue on their end.

So to recap what you’ve learned today: NZRT uses PayPal as its single online payment platform. It supports both PayPal wallet and card payments. The flow is straightforward — invoice out, customer clicks pay, PayPal processes it, invoice auto-marks as paid. It’s integrated with Dolibarr, it’s currently active, and it keeps the payment process simple for both clients and the internal team.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Admin Panel

Welcome to the NZRT Wiki Podcast. Today we’re looking at Admin Panel.

So, if you’re managing a Flarum forum, the Admin Panel is your control centre. You can get to it by navigating to your forum’s address and adding slash admin at the end. Keep in mind that you’ll need to be a member of the Admin group to get in — it’s not open to regular users.

Let’s walk through what you’ll find inside. There are nine main sections, and each one handles a different part of running your forum. First up is the Dashboard, which gives you a quick snapshot of your forum’s activity — things like how many discussions exist, how many posts have been made, your total user count, and how many users are currently active. Think of it as your at-a-glance health check.

Next is Basics. This is where you set the foundational identity of your forum — the title, the description, a welcome banner for new visitors, your default language, and your default theme. If someone lands on your forum for the first time, Basics is what shapes that first impression.

Then there’s Mail, which we’ll come back to in a moment because there’s a bit more to cover there.

After Mail, you’ve got Users. This section lets you browse through your entire user base, edit individual profiles, change what group someone belongs to, suspend an account if needed, or delete a user entirely. It’s your main people-management hub.

Groups sits right alongside it. Here you can create new groups or edit existing ones, and you can assign each group its own colour and icon to make them visually distinct.

Permissions is where things get a bit more nuanced. You set per-group permissions here — so you’re deciding what each group of users can and can’t do on the forum. You can also set permission overrides at the tag level, which means certain tags on your forum can have different rules from the rest.

Appearance gives you control over the look and feel. You can choose a theme, add custom header or footer HTML, and write custom CSS if you want to go further than the built-in options allow.

Tags is where you manage your forum’s topic categories. You can create new tags, edit existing ones, reorder them, set colours and icons, and even nest tags inside each other to create a hierarchy.

And finally, Extensions. This is where you turn installed extensions on or off, and access their individual settings when they have them.

Now, back to Mail. Flarum uses email for three main purposes: verifying email addresses when someone signs up, handling password resets, and sending notification digests if you’ve got that enabled through an extension.

When it comes to how email actually gets sent, you have a few driver options. You can use SMTP, which is the most common setup for production environments. You can use PHP’s built-in mail function. There’s a log driver, which is great for development — instead of actually sending emails, it just writes them to a log file so you can inspect what would have been sent. And there are also drivers for Mailgun and Amazon SES if you’re using those services.

For a typical SMTP setup, here’s what you’re configuring. You’d set the driver to SMTP, then provide the hostname of your mail server, the port number — commonly 587 for TLS — and the encryption type. You’d then enter your username and password for the mail account, and set the from address, which is what recipients will see as the sender. Once you’ve filled all that in, you can send yourself a test email right from Admin, under the Mail section, to confirm everything’s working.

One thing worth knowing is that Flarum doesn’t have a built-in maintenance mode toggle. There’s no button you can flip to take the forum offline while you work on it. If you need to do that, your options are to temporarily rename or remove the main index file in the public folder on the server, or to set up a server-level redirect that sends visitors somewhere else while you work.

Now, if you’re comfortable working on the server directly, there are also some command-line tools available. You run these from the forum’s root directory on the server. There are four key ones to know about. The first clears all caches, which is useful after making config changes. The second republishes extension assets — things like stylesheets and scripts that extensions add to the front end. The third runs any pending database migrations, which you’d typically do after installing or updating an extension. And the fourth just prints out version and extension information, handy for quick diagnostics.

That covers the Admin Panel from top to bottom — from the dashboard overview and core settings, through mail configuration and user management, all the way to the command-line tools you might need when working server-side.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Users Groups

Welcome to the NZRT Wiki Podcast. Today we’re looking at Users & Groups.

In Dolibarr, the system NZRT uses to manage projects, invoices, and everything in between, user accounts are tied to fine-grained permissions. That means each user or agent only gets access to the specific modules and actions they actually need. NZRT takes this seriously — there are no shared accounts. Every agent has their own dedicated login.

When we say agents here, we mean NZRT’s virtual AI agent accounts. These are real Dolibarr user accounts, one per agent, set up so that each AI can interact with the system in a controlled and traceable way. They authenticate using individual API keys rather than a traditional username and password flow. The passwords do exist, but they’re randomly generated and stored securely in the Nextcloud shared credentials folder — not something you’d ever type in manually.

Let’s walk through the agent roster. There are nine accounts in total, and the table in the wiki gives you the agent code, their Dolibarr user ID, their login handle, display name, email address, the modules they can access, and their current status.

First up is xc, the admin account, with a Dolibarr ID of 2. This account displays as XC Admin and uses the admin email address. XC has access to all modules — it’s the top-level account.

Next is cas, ID 4, the Sales agent. CAS has access to Thirdparties, Proposals, and Orders — covering the client-facing sales pipeline.

Then there’s dai, ID 9, the Data agent. DAI has read access to exports plus access to accounting results. It’s a deliberately limited account — read-only on the export side.

DAN is ID 10, the DBA agent. Interestingly, DAN has no Dolibarr module permissions at all — DAN operates exclusively through Nextcloud. So this account exists in the system but is intentionally restricted on the Dolibarr side.

EMA is ID 8, the document and email management agent. EMA has access to ECM, which is the electronic content management module, plus Mass Emailing and Export.

FIN is ID 6, the Finance agent. FIN covers Invoices, Bank, and Accounting — the core financial stack.

HAN is ID 7, the HR agent. HAN covers the HRM module, Leave, and Expenses — everything to do with people management.

PAM is ID 3, the Products agent. PAM handles Products, Stock, and Manufacturing — the inventory and production side of the business.

Finally, SUN is ID 5, the Purchasing agent. SUN covers Suppliers, Purchase Orders, and Delivery.

So that’s nine accounts in total: xc, cas, dai, dan, ema, fin, han, pam, and sun.

All of these accounts were provisioned on the twenty-first of April 2026 using a script called create agents, which ran directly against the database. Then two days later, on the twenty-third of April, module permissions were applied using a script called set dolibarr permissions. That run set 58 individual permissions across seven of the agents — all done in a single automated pass.

On the topic of permissions, the wiki notes there are four levels to understand: Read, Write, Delete, and Admin. These are the four tiers that Dolibarr uses to control what any given user can actually do within each module. So an agent might have read access to a module but not write access — or write access but not the ability to delete records or change admin-level settings. The detail of exactly which agents hold which permission levels is covered in a separate Security and Permissions article, which is worth reading alongside this one.

One last thing worth noting is the API access model. When NZRT’s AI agents actually call Dolibarr to do work — creating tickets, updating projects, fetching data — they use the REST API directly, and each agent has its own API key configured for that purpose. The keys are set up separately from the account provisioning step, as part of the process of wiring each AI agent into the live system.

If you want to dig deeper, the related articles to check out are Security and Permissions for the full permission breakdown, and the Agent Account Setup guide for the step-by-step provisioning process. There’s also an Employees article if you’re looking at human user accounts rather than the virtual agent accounts covered here.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

WordPress Integration

Welcome to the NZRT Wiki Podcast. Today we’re looking at WordPress Integration.

This episode covers how WordPress and Dolibarr connect inside the NZRT setup, so if you work with either of those systems — or you’re just curious about how the pieces fit together — stick around.

First, a bit of context. NZRT runs two WordPress sites. One is the ICS site — that stands for Internet Consulting Services — and this is the site that actually integrates with Dolibarr. Through that integration, products, clients, and orders managed in Dolibarr can surface on the ICS site. The second site is the NCS site, which handles NZRT Charitable Services, and that one sits completely separately — it doesn’t talk to Dolibarr at all.

So how does the integration actually work? There are two main methods.

The first and primary method is what’s called the Agent REST API approach. AI agents call both the Dolibarr REST API and the WordPress REST API independently, using a set of tools provided by the NZRT MCP server. Think of it as an orchestration layer — Claude or the run-dot-py agents sit in the middle and coordinate cross-system operations. For example, if you need to sync a product from Dolibarr and publish it to WordPress, an agent can handle each side of that through dedicated tools. On the Dolibarr side you have tools for getting and creating products, and on the WordPress side you have tools for creating and updating posts. The Operating Model documentation goes deeper on the MCP server setup if you want to follow up.

The second method is an Obsidian-to-WordPress publishing flow. Vault notes written in Obsidian can be published directly to the ICS WordPress site using the obsidian-wordpress plugin. Simple and straightforward.

Now let’s look at something a bit more technical — the Bridge Plugin and Webhook Trigger setup. This is used specifically for NZRT intake forms, and it enables a direct connection from WordPress straight into Dolibarr. Here’s how that flow works when someone submits a form on the WordPress side.

The form submission triggers an AJAX call that passes through WordPress’s admin handler. That kicks off a function inside a custom plugin called the nzrt-dolibarr-bridge. That function then makes a request to Dolibarr’s REST API, targeting the thirdparties endpoint and passing the API key as a header. Dolibarr receives that, creates the thirdparty record, and internally fires what’s called a company-create action. Now, on the Dolibarr side, there’s a second custom file called the nzrt webhook trigger, sitting inside Dolibarr’s custom triggers folder. It checks whether the company-create action appears in a global setting called WEBHOOK_EVENTS. If it does, it fires off a signed JSON payload to a configured webhook URL, attaching two custom headers — one containing an HMAC-SHA256 signature and one identifying the event type. That signature is what lets the receiving end verify the request is genuine.

Two files make all of this work. The bridge plugin file lives in the 000WOR repository and is deployed to WordPress as a plugin. The webhook trigger file lives in the 000DOL repository and is deployed inside Dolibarr’s custom triggers folder.

To get this running, you also need three configuration constants set up inside Dolibarr — you’ll find these under Setup, then Other, then Constants. There are three of them to know about. The first is WEBHOOK_URL, which is the endpoint Dolibarr will post the event payload to. The second is WEBHOOK_SECRET, which is the signing key used to generate that HMAC-SHA256 signature on outgoing payloads. The third is WEBHOOK_EVENTS, which is a comma-separated list of the action codes you want to trigger webhooks — so for example, you might include both company-create and company-modify if you want events fired for both scenarios.

If you need to set any of this up from scratch, there’s a separate NZRT Integrations document that walks through the deployment steps in detail. And if you’re looking at the broader picture — like what modules are available or how WordPress service codes fit into the NZRT taxonomy — check out the Module List and NZRT WordPress Service Codes docs linked from the related section of this wiki page.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Users Groups

Welcome to the NZRT Wiki Podcast. Today we’re looking at Users and Groups.

We’re going to walk through how Flarum handles users, groups, permissions, and authentication. If you’ve ever wondered how the forum knows who you are, what you’re allowed to do, or how an automated script logs in and posts on your behalf, this episode covers all of that.

Let’s start with users. Every person on the forum is represented by a user object, and that object carries a set of fields that describe who they are and what they’ve been up to. There’s a unique integer ID that identifies the account internally, and a username which is the unique login name you use to sign in. There’s also a display name, which is what other people see in the interface — and if you don’t set one explicitly, it just defaults to your username. Your email address is stored too, though that’s only visible to admins. The system also tracks whether your email has been confirmed, when you first registered, and when you were last active on the forum. On top of that, it keeps a running count of how many discussions you’ve started and how many posts you’ve made. Finally, your user record has a relationship called groups, which links you to whichever groups you belong to — and that’s where permissions come from, as we’ll see in a moment.

Now let’s talk about built-in groups. Flarum ships with four groups already configured. The first is Admin, with an ID of one — this group has full access and all permissions across the board. The second is Guests, ID two — these are unauthenticated visitors, people browsing the forum without logging in. Third is Members, ID three — this covers all registered users, so anyone who has created an account automatically belongs to this group. And fourth is Moderators, ID four — moderators can edit or delete any post, lock threads, and sticky discussions. Beyond these four, you can create your own custom groups through Admin, then Groups in the control panel.

Speaking of permissions — in Flarum, permissions are assigned to groups, not to individual users. You manage this through Admin, then Permissions. There are several core permissions to know about. View forum controls whether a group can see discussions at all. Sign up controls whether visitors can register an account. Start discussions lets a group create new threads. Reply to discussions lets them post in existing ones. Use markdown gives a group the ability to format their posts. Edit own posts lets someone modify a post they’ve already made, and Delete own posts lets them remove it entirely. Moderators and admins automatically have elevated access beyond what this list covers, so they don’t need each of these switched on individually.

Now let’s move on to authentication, which is where things get a little more technical — but don’t worry, we’ll keep it simple. Flarum supports three ways of logging in. The default method is a plain username and password. You can also enable OAuth through extensions, which lets users sign in with accounts from places like GitHub, Google, or Facebook. And finally, there are API tokens, which are used for programmatic access — meaning when a script or an agent needs to interact with the forum on someone’s behalf.

Here’s how API token authentication works in practice. When you make an HTTP request to the forum’s API, you include an Authorization header, and you set its value to the word Token followed by a space and then the token string itself. You can generate tokens inside user settings, or you can create one by making a POST request to the API token endpoint.

There’s an important gotcha here that’s worth paying attention to. Pre-generated tokens — the kind you copy out of the settings page — work fine for read-only requests like fetching a list of discussions. But if you try to use one to create a post, update something, or delete something, it will fail. That’s because write operations go through CSRF validation, which those static tokens don’t satisfy. For any write operation, you need a session token instead, and you get that by making a POST request to the token endpoint with actual login credentials. That session token is what you use for mutations. If you’re building any kind of automation that posts to the forum, this is the distinction you need to get right.

So to bring it all together: users are identified by a handful of fields including their ID, username, and group memberships. Groups are the unit of control — four built-in ones cover admins, guests, members, and moderators, and you can add your own. Permissions are set on groups rather than individuals, covering everything from viewing the forum to deleting your own posts. And authentication can happen via password, OAuth, or API token — with the key rule that session tokens from a fresh login are required for any write operation through the API.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Access Control

Welcome to the NZRT Wiki Podcast. Today we’re looking at 🔐 Access Control.

If you work with the NZRT GitHub organisation, understanding who can do what is essential. GitHub access control comes down to two core ideas: roles and teams. Roles define what a person or group can actually do inside a repository, and teams are groups of users who share those permissions together.

Let me walk you through the five roles NZRT uses, from most powerful to least. At the top you have Admin — that is full access, including deleting repositories and changing settings. Below that is Maintain, which lets you push code, merge pull requests, create releases, and adjust certain settings. Then there is Write, giving you the ability to push commits and create branches. Triage is more limited — it is for managing issues and pull request labels, but you cannot push code. And finally, Pull is read-only: you can clone and view, but nothing more.

Now, how does NZRT map these roles to people? The wiki has a table, so let me walk you through each row. There are five entries. First, xc holds the Admin role — full access across all repositories, sitting in the Admin team. Second, pam, fin, and dan all have the Maintain role, in the Team Leads group, each assigned to their relevant repositories. Third, developers get Write access across all repos. Fourth, cas has Triage access through the Sales team — read-only on code, but able to manage issues and labels. And fifth, dai has Pull access through the Data team, meaning read-only across everything.

The wiki also shows the full organisation structure as a visual tree. Think of it this way. At the top is the NZRT GitHub organisation. Underneath that you have two branches — Teams and Repositories. On the Teams side there are five groups. The Admin team, which is xc, has Admin permissions everywhere. The Product Managers team, which is pam, has Maintain access specifically to the nzrt-scripts repository. The Finance team, which is fin, has Maintain access to the dolibarr-custom repository. The Data team, which is dai, has Pull — read-only — access across all repositories. And the Developers team has Write access to everything. On the Repositories side, there are two private repos listed: dolibarr-custom and nzrt-scripts.

So how do you actually assign access? There are two methods. The first is adding a team to a repository. You go into repository settings, find Collaborators and Teams, click Add Teams, select the team you want such as Product Managers or Finance, set the role, and confirm. The second method is adding an individual user directly. Same starting point — repository settings, Collaborators and Teams — but this time you click Add People, search by GitHub username, set the role, and confirm.

Now let me explain the CODEOWNERS file, which is a really useful automation tool. You create this file inside the dot-github folder of your repository. It maps file paths to teams or people who are automatically requested as reviewers whenever a pull request touches those files. The wiki shows several examples, so let me explain what each one does in plain terms. There is a catch-all pattern that makes the admin team a global reviewer of everything. Then, any changes inside the WordPress plugin folder — specifically the wp-sync-core plugin path — will automatically request the Product Managers team for review. Changes to the ERP customisation module request both Product Managers and Finance. Anything touching dolibarr integration modules routes to Finance only. Changes to the CI/CD workflow files go to the Admin team. And any database scripts in the SQL folder are routed to a DBA team. The core idea is simple: when a pull request touches a specific path, the matching team or person is automatically pulled in to review — no manual assignment needed.

That is it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Security Best Practices

Welcome to the NZRT Wiki Podcast. Today we’re looking at Security Best Practices.

Security is everyone’s responsibility at NZRT, and today we’re walking through the core principles and practices that protect our code, credentials, and data — whether you’re a developer, a team lead, or just getting started.

Let’s start with the big ideas. At NZRT, security thinking is built around a handful of key concepts. First is the principle of least privilege — you only get the access you actually need to do your job, nothing more. Next is defense in depth, which means we don’t rely on just one security measure. We layer authentication, encryption, and logging so that if one control fails, others are still protecting you. Then there’s secret hygiene — never commit secrets to code, and rotate them regularly. We also insist on code review, audit trails, supply chain security for your dependencies and third-party code, and a clear incident response plan so you can act quickly when something goes wrong.

Now let’s talk about what that looks like day to day. NZRT has a security checklist covering five areas: repository setup, credentials and secrets, access control, code quality, and deployment.

Starting with your repository. Every repo should be private, with branch protection turned on for the main and develop branches. You need a CODEOWNERS file, a README with security instructions, and a gitignore that excludes things like dot-env files, secrets folders, and key files. And critically — no sensitive data should ever appear in your commit history.

On credentials and secrets: no API keys, tokens, or passwords go in the code. Full stop. Secrets live in GitHub Secrets, not in files. Database credentials go in a dot-env file, not in the example version that gets committed. You rotate credentials every three months, and you watch the audit log for unusual access.

For access control, team members get only the roles they need. Inactive users get removed. Admin access is limited to essential people. Two-factor authentication is on every account, SSH keys are registered and verified on GitHub, and personal access tokens are scoped as narrowly as possible.

On code quality: GitHub Actions runs on every pull request — linting, tests, and security scanning. You’re targeting test coverage above eighty percent. No hardcoded credentials. Dependencies are checked for vulnerabilities using Dependabot.

And for deployment: production uses SSH keys, not passwords. Deployments only go through GitHub Actions so they’re reproducible and audited. Status checks must pass before any merge, deployments are logged with timestamps and version numbers, and your rollback procedure is documented and tested.

Now for the secret management policy. NZRT tracks five categories of secrets. Think of it as a table with four columns — the type, some examples, how often you rotate, and where they’re stored. Database passwords like your MySQL credentials rotate quarterly and live in GitHub Secrets. API tokens — things like your Dolibarr or Slack tokens — also rotate quarterly and also go in GitHub Secrets. SSH deploy keys rotate every six months, again in GitHub Secrets. OAuth tokens like your GitHub token rotate quarterly. And SSL certificate private keys rotate annually and live in the server keystore.

What if a credential gets leaked? There’s a clear six-step response. First, immediately disable that credential at the source system. Second, use a tool called BFG Repo-Cleaner to scrub every occurrence from git history. Third, force-push the cleaned history. Fourth, rotate all related credentials — not just the one that leaked. Fifth, log the incident and write a postmortem. Sixth, notify any affected services.

Code review is your last line of defence before code ships. When you review a pull request, you’re checking that there are no secrets or hardcoded paths, that user input is validated, that output is properly escaped to prevent cross-site scripting, that database queries use parameterized statements, that authentication and authorization checks are in place, and that error messages don’t accidentally expose sensitive information.

And if a security issue is detected, follow seven steps: isolate the affected service or roll back the deployment, assess the scope and impact, notify the admin and relevant team leads, remediate and deploy a patch, verify the fix is working, document everything in a postmortem, and if user data was affected, communicate that to the right people.

Security isn’t a one-time setup — it’s an ongoing practice. Keep your credentials rotated, your reviews thorough, and your incident response sharp.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Secrets Tokens

Welcome to the NZRT Wiki Podcast. Today we’re looking at Secrets and Tokens.

If you’ve spent any time working with GitHub Actions at NZRT, you’ve probably heard the term secrets thrown around. So let’s break down what they actually are, how NZRT uses them, and what you need to know to keep things secure.

At the most basic level, GitHub Secrets are encrypted environment variables. Think of them as a secure vault that GitHub Actions can reach into during a workflow run. Once a secret is stored, you can never read it back out through the GitHub interface — it’s write-only. The only time it appears is when a workflow actively uses it, and even then, GitHub automatically masks the value in your logs, replacing it with three asterisks so nothing sensitive ever gets printed.

Now, secrets come in three flavours. Repository secrets are encrypted and tied to a single repository. Organization secrets sit at the org level and can be shared across multiple repos. And environment secrets are scoped to specific deployment environments, like staging or production. This gives you a layered system where sensitive values live exactly where they need to be and nowhere else.

Here’s what NZRT currently has set up at the repository level. There are six secrets in use. The first two are SSH private keys — one called STAGING DEPLOY KEY for the staging server, and PROD DEPLOY KEY for production. Both are used by the deploy workflow. Then there’s the DOLIBARR API KEY, which sync workflows use to talk to the Dolibarr REST API. There’s a SLACK WEBHOOK secret for sending notifications from within jobs. A CODECOV TOKEN for coverage reporting during test runs. And finally, GITHUB TOKEN, which GitHub generates automatically and is available to all workflows.

At the organization level, NZRT shares two secrets across multiple repos. PROD DEPLOY KEY covers both the dolibarr-custom and nzrt-scripts repositories. And GITHUB TOKEN is available to everything in the org.

So how do you actually use a secret inside a workflow? The example in the wiki shows a deployment job where secrets are mapped to environment variables within a step. The deploy key and the API key are pulled in by name, and the shell script then references those environment variables. You’re never hard-coding the actual values — the workflow just knows to look for them by name and GitHub injects them at runtime. If you accidentally tried to print one of these values, GitHub would replace it with asterisks automatically. But the best practice is to simply not log secrets at all, even though masking protects you.

Let’s talk about how you create these secrets in the first place. For a GitHub personal access token, you go into your account settings, then Developer Settings, then Personal Access Tokens. You generate a new classic token, select the scopes you need — typically repo, admin repo hook, workflow, and read org — then copy the token and store it in your repository secrets.

For SSH deployment keys, the process is a two-step command-line workflow. First, you generate a new RSA key pair at 4096 bits with no passphrase — the no passphrase part matters because automation can’t type a password interactively. Then you take the private key, encode it in base64, and store that encoded value in GitHub Secrets. The matching public key goes onto the production server’s list of authorized keys. That way, GitHub Actions can authenticate over SSH without the actual private key ever appearing in a script.

NZRT also follows a naming convention for custom tokens. The pattern is a prefix, then the environment, then the type — so for example NZRT STAGING DEPLOY KEY or NZRT PROD DEPLOY KEY. This makes it immediately clear what each secret does and where it belongs.

Now, secrets don’t last forever — and they shouldn’t. The wiki includes a rotation checklist you should keep in mind. SSH deploy keys should be rotated every six months. API tokens every three months. Database passwords quarterly. You should also regularly review secret access in the GitHub audit log, remove secrets tied to anyone who leaves the team, and revoke anything that gets accidentally exposed the moment you discover it. That last point is non-negotiable — treat a leaked secret as fully compromised from the instant you find out.

One final thing worth remembering: secrets are only accessible during a workflow run. They’re never embedded in your code, never visible in the repository, and never returned through the GitHub API once stored. That’s the whole point — they stay in the vault until Actions needs them, and then they’re gone again.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Repository Structure

Welcome to the NZRT Wiki Podcast. Today we’re looking at 📁 Repository Structure.

If you’ve ever opened a project folder and had no idea where anything lives, you’ll know why this matters. At NZRT, all repositories follow consistent directory patterns so that whether you’re navigating a WordPress project or a Dolibarr customisation, you always know where to look. Let’s walk through what that looks like.

Every NZRT repository starts with a set of root-level files. At the very top of any repo, you’ll find things like a README, a dot-gitignore file, and a license. These sit right at the base of the project — they’re the first things you see when you open the folder, and they tell you what the project is, what files Git should ignore, and how the code is licensed.

From there, the structure branches out depending on what the project does. Source code lives in a dedicated directory — usually called “src”, though for WordPress projects you’ll find it under “wp-content”, which then splits into a “plugins” folder and a “themes” folder. That’s the WordPress way of organising things, and NZRT follows it.

Documentation has its own home too — a “docs” folder at the project root. This is where you’d put architecture notes, API specs, anything that explains how the project works rather than being the project itself. Tests sit in a “tests” or “test” folder, covering unit tests, integration tests, and end-to-end tests. Configuration files — environment configs, deployment configs, CI/CD pipelines — are also kept in clearly named locations so you’re never hunting for them.

For assets like images and static media, there are designated folders depending on the project type. And dependency files sit right at the root: for PHP projects that’s a “composer dot json” file, for Node projects it’s “package dot json”, and for Python it’s “requirements dot txt”.

Now let’s look at what this means in practice for the two main NZRT repository layouts.

The first is the WordPress and Dolibarr sync repository. When you open that folder, at the top level you’ll see a README file, a dot-git folder which is Git’s internal data, and a dot-gitignore. The main working folder is “wp-content”, and inside that you’ll find two subfolders: one called “plugins” containing a plugin called “wp-sync-core”, and another called “themes” containing the NZRT theme. There’s also a “docs” folder at the top level for project documentation.

The second layout is for Dolibarr customisations specifically. This one follows a slightly different pattern. At the top level you’ve got a “src” folder, a “tests” folder, a “docs” folder, a “composer dot json” for PHP dependencies, a dot-env-dot-example file which is a template for your local environment variables, and a dot-gitignore. Inside the “src” folder you’ll find three subfolders: “modules” for custom Dolibarr modules, “includes” for shared PHP includes, and “htdocs” for any web-facing files.

So to summarise the difference: the WordPress sync repo is organised around WordPress conventions, with the “wp-content” folder as the main container. The Dolibarr customisations repo is more of a traditional PHP project structure, with source code under “src” and a clear separation between code, tests, and docs.

In terms of NZRT context, “dolibarr-custom” is the primary repository. All custom code lives in those “src” directories we just talked about. Development happens locally in the Laragon environment first, and then gets pushed up to GitHub once it’s ready.

If you want to go deeper on any of this, the wiki links out to three related topics: Git Overview, which covers the basics of how Git works at NZRT; Branching Strategy, which explains how branches are named and used; and dot-gitignore Templates, which gives you ready-made ignore files for different project types.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Project Boards

Welcome to the NZRT Wiki Podcast. Today we’re looking at 📊 Project Boards.

If you’ve ever wondered how NZRT keeps track of all the moving parts in a software release — from idea through to deployment — this is the episode for you. GitHub Projects are the tool we use, and they let you organise issues and pull requests into a visual workflow that the whole team can see and act on.

Let’s start with the two main ways you can look at a project board. The first is the Table View, which works a lot like a spreadsheet. You can see all your items in rows, with custom columns for things like who it’s assigned to, what the status is, and how high the priority is. The second is the Board View, which is a Kanban-style layout — columns running left to right, with cards you can drag between them. The standard columns you’ll see are Backlog, In Progress, In Review, and Done.

One of the most powerful things about GitHub Projects is automation. You don’t have to manually move things around all the time. The board can be set up so that new issues automatically land in the Backlog the moment they’re created. When a pull request is raised, it jumps straight to the Deploy column. When a PR gets merged, it moves itself to Done — and if there’s a linked issue, that gets automatically closed too. A lot of admin just takes care of itself.

You can also filter the board to show only what’s relevant to you — by status, by assignee, by label, or by priority. And if you need to update a bunch of items at once, bulk actions let you select multiple cards and change priority, add a label, or reassign them all in one go.

Let’s look at a real NZRT example. We have a board called the Dolibarr Custom Release Board, set up for version two point one. It has six columns. Backlog, for things not yet started — like a feature request for product export. Design, for anything in design review — for example, mockups for a comparison widget. Development, for work currently in progress, like actually building that comparison feature. Testing, where items are going through QA validation on staging. Deploy, for things ready to release but waiting on a second approval before merging to main. And finally Done, for everything already shipped — like version two point zero, which is already in production.

The board also uses custom fields to add more detail to each card. There’s a Priority field with High, Medium, or Low options. There’s an Effort field using story points — one, two, three, five, or eight points. There’s a Release field to tag which version something belongs to. And there’s an Owner field to assign work to specific team members.

Now let’s talk about sprint planning. Say you’re planning the sprint for a particular week. You go through your backlog and look at what’s available. You might have four issues to consider: one for advanced filtering at five points and high priority, one for improving mobile responsiveness at three points and medium priority, one for API rate limiting at eight points and high priority, and one for documentation updates at three points and low priority. Your sprint capacity for the week is thirteen points. So you’d pick the filtering issue at five, mobile responsiveness at three, and documentation at three — eleven points total — keeping two points in reserve for bugs or unexpected interruptions.

When you’re working day to day, you can filter the board to show only your assigned items. Instead of seeing everything, you’d see just your slice: maybe one item in Design, two in Development, one in Testing, and a collapsed list of whatever you’ve finished that sprint. It keeps your view clean and focused.

Bulk actions make light work of repetitive updates too. Say you’ve selected two items — a bug fix and a mobile responsiveness task. You can set both to High priority, add an urgent label, and assign them to a team member, all in one step rather than editing each card individually.

So to pull it all together: project boards give you and your team a shared, real-time picture of where work stands. Automation reduces the manual overhead, custom fields add the context you need, and filtering keeps your view focused on what matters to you right now. Whether you’re planning a sprint or tracking a release, this is how NZRT keeps things moving forward.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Configmaps Secrets

Welcome to the NZRT Wiki Podcast. Today we’re looking at ConfigMaps & Secrets.

If you’ve been working with Kubernetes, you’ve probably run into the question of where to store your application’s configuration. Things like environment names, URLs, log levels, database passwords, API keys — all of that has to live somewhere. Kubernetes gives you two dedicated resources for this: ConfigMaps and Secrets. They work in a similar way, but serve different purposes, and knowing which to use and when matters a lot.

Let’s start with ConfigMaps. A ConfigMap is where you store non-sensitive configuration data. Think of it as a key-value store that your application can read at runtime. In NZRT’s setup, you might have a ConfigMap called app-config sitting in the nzrt-prod namespace. Inside it, you’d find entries like the application environment set to production, the application URL pointing to the NZRT network app endpoint, and a log level set to info. None of that is sensitive — it’s just configuration your app needs to know about.

To actually use that ConfigMap inside a pod, you reference it in your pod definition using something called envFrom. What that does is tell Kubernetes to pull all the key-value pairs from the ConfigMap and inject them into your container as environment variables. Your app then reads them just like any normal environment variable — it doesn’t need to know or care that they came from Kubernetes.

Now let’s talk about Secrets. The concept is the same — key-value pairs injected into a pod — but Secrets are designed for sensitive data. Passwords, usernames, tokens, API keys. In the example from the wiki, there’s a Secret called db-credentials, again in nzrt-prod. It holds a database password and a database username. You’ll notice the wiki uses something called stringData, which means you write the values in plain text in your definition file, and Kubernetes automatically base64-encodes them when it saves them to the cluster. Using a Secret in a pod works exactly the same way as a ConfigMap — you use envFrom, but this time you reference a secretRef instead of a configMapRef. The end result is the same: your container sees those values as environment variables.

Now here’s something really important you need to understand about Secrets, and the wiki flags this clearly. Secrets are not encrypted by default. They’re only base64-encoded when stored in etcd, which is Kubernetes’ internal data store. And base64 is not encryption — it’s just encoding. Anyone with access to etcd can decode those values trivially. So for production environments, you need to go further. There are two main approaches. First, you can enable Encryption at Rest on your cluster, which tells Kubernetes to actually encrypt the Secret data before writing it to etcd. Second, and often better for serious deployments, you use an external secrets manager. Tools like HashiCorp Vault, AWS Secrets Manager, or Sealed Secrets are purpose-built for this and give you much stronger security guarantees, audit trails, and access controls.

Finally, let’s cover a few kubectl commands you’ll use regularly when working with these resources. To list all ConfigMaps in the nzrt-prod namespace, you run kubectl get configmaps with the namespace flag. For Secrets, same structure — kubectl get secrets with the namespace flag. If you want to inspect a specific Secret, you use kubectl describe followed by the Secret name and namespace — this shows you metadata and keys but not the actual values, which is intentional. And if you need to create a Secret quickly from the command line without a YAML file, you can use kubectl create secret generic, give it a name, pass in your key-value pairs using the from-literal flag, and specify your namespace. That’s a handy shortcut for quick setups or testing.

To link this back to broader context, ConfigMaps and Secrets connect closely to the Security Overview and Storage Overview docs in the wiki, so if you want to go deeper on cluster security or how persistent data is handled, those are your next stops.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Kagent Claude

Welcome to the NZRT Wiki Podcast. Today we’re looking at kagent-claude.

kagent-claude is a setup that gets kagent version 0.8.6 running on Windows 11 using Minikube, with Claude Sonnet as the AI model powering it. The session was saved back in April 2026 and at that point it was running fine, just waiting on an API credit top-up.

Let’s start with the environment. You’ve got six tools in play here. Minikube at version 1.38.1, kubectl at version 1.34.1, Helm at version 4.1.4, Docker Desktop at version 29.4.0, kagent itself at version 0.8.6, and the Claude model being used is claude-sonnet-4-6. Minikube is using Docker as its driver, running through WSL2. Memory is capped at around 3,800 megabytes, which is the Docker Desktop limit. Everything lives in a Kubernetes namespace called kagent.

Now let’s walk through the three Kubernetes resources that were created to make this work.

The first is a secret. This is how you securely pass your Anthropic API key into the cluster. The command creates a generic secret called kagent-secrets inside the kagent namespace and stores your API key under a label called ANTHROPIC_API_KEY. Think of it as a locked box that Kubernetes can open whenever it needs to authenticate with Anthropic.

The second resource is a ModelConfig, called claude-sonnet. This is essentially a configuration file that tells kagent which AI model to use and how to use it. It points to Anthropic as the provider, specifies claude-sonnet-4-6 as the model, and references that secret you just created so it can grab the API key. There is also a field for the secret key name pointing to ANTHROPIC_API_KEY, and this is important — we will come back to why in a moment. The model is configured with a maximum of 8,096 tokens and a temperature of 0.7, which gives you a balance between creative and focused responses.

The third resource is the agent itself, called claude-test-agent. This is a declarative agent using the Python runtime, pointed at your claude-sonnet model config. Its system message tells it to act as a helpful Kubernetes assistant powered by Claude Sonnet. It is also wired up to four Kubernetes tools via an MCP server: one for getting resources, one for describing a resource, one for fetching pod logs, and one for retrieving cluster events. So this agent can actually look around your Kubernetes cluster and answer questions about what is happening inside it.

Once everything is deployed, you access the UI through a port-forward command. This routes the kagent UI service from inside your cluster out to port 8080 on your local machine, so you can open a browser and go to localhost colon 8080 to start chatting with your agent.

If you ever need to resume the setup after a restart, the process has four steps. Start Docker Desktop, then run minikube start with the Docker driver, then run the port-forward command again, and finally open localhost colon 8080 in your browser.

Now, there are three known issues worth knowing about.

The first is an authentication error that says something like could not resolve authentication method. This happened because the ModelConfig was originally written with the wrong field name — the incorrect version ends in Ref, but the correct field name does not. The fix is to recreate the ModelConfig with the right field name, then bounce the agent by scaling its deployment down to zero replicas and back up to one.

The second issue is pods getting stuck in a pending state due to not enough memory. With only around 3,800 megabytes available, too many bundled agents were competing for resources. The fix was deleting the agents that were not needed — specifically the Cilium debug, manager, and policy agents, the kgateway agent, and the argo-rollouts conversion agent. Removing those freed up enough memory for everything important to run.

The third issue is a 400 error related to API credits. This is a billing distinction that is easy to miss: your Claude Pro subscription on claude.ai and your Anthropic API account at console.anthropic.com are completely separate billing systems. If you are using kagent with an API key, you need credits in the API console specifically. The fix is to top up at console.anthropic.com under settings and then billing.

So to recap: kagent-claude gives you a Claude-powered Kubernetes assistant running locally in Minikube. You set it up with a secret for your API key, a ModelConfig pointing at Claude Sonnet, and a declarative agent with four Kubernetes tools attached. The UI is a simple port-forward away. Watch out for the field name on the ModelConfig, keep memory free by pruning unused agents, and make sure your API credits are topped up separately from your Claude subscription.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Kagent Rbac Security

Welcome to the NZRT Wiki Podcast. Today we’re looking at Kagent RBAC & Security.

This episode covers the security model for kagent running in the NZRT Kubernetes cluster. We’re talking about ServiceAccounts, role-based access control, API key management, tool restrictions, and network isolation. Let’s get into it.

The foundation of everything here is the principle of least privilege. That means each agent gets only the permissions and tools it actually needs — nothing more. At NZRT we run two agent classes. The first is the read-only class, used for SRE diagnostics. These agents can get, list, and watch any resource in the cluster, and they have access to tools like fetching resources, reading pod logs, describing resources, checking events, and testing service connectivity. The second class is the write agent, used for deployment and operations work. It has all the same read permissions, plus the ability to create and patch Deployments and Services. One thing that’s true for both classes — the destructive delete tool is never included. Full stop.

Now, each agent runs under its own dedicated ServiceAccount. The YAML definition for this is straightforward — you’re creating a ServiceAccount in the kagent namespace, giving it a name like kagent-sre, and labelling it with the NZRT owner and service code. One ServiceAccount per agent keeps permissions clean and auditable.

For the read-only SRE agent, you create a ClusterRole that grants get, list, and watch verbs across a broad set of resource types — pods, pod logs, deployments, replica sets, stateful sets, services, endpoints, events, namespaces, config maps, ingresses, jobs, and cron jobs. That ClusterRole then gets bound to the ServiceAccount via a ClusterRoleBinding. So the role defines what’s allowed, and the binding connects that role to the specific agent identity.

The write agent works a bit differently. Instead of a ClusterRole that applies everywhere, it uses a namespaced Role — scoped specifically to the staging namespace, not production. That Role allows get, list, watch, patch, and update on Deployments, and get, list, watch, create, and patch on ConfigMaps and Services. If you ever need production write access, the wiki is clear: that requires an explicit review before it gets granted. No shortcuts there.

Let’s talk API key security, because this one matters a lot. There are four rules NZRT follows. First, API keys never go in a ConfigMap — they live in a Kubernetes Secret only. Second, they never go in Git — you create them directly using the kubectl command or an external secrets operator. Third, the Anthropic key is namespace-scoped, meaning it lives only in the kagent namespace. And fourth, rotation is handled by updating the secret value, and any pod that restarts will automatically pick up the new key. The rotation command shown in the wiki takes the new key value and applies it using a dry-run pipeline to update the existing secret in place — clean and non-destructive.

Tool restriction is next. Each agent has an explicit whitelist of tool names. If a tool name isn’t on the list, the agent simply can’t use it. For a read-only agent, the whitelist includes things like listing API resources, reading pod logs, describing resources, and fetching cluster events. Tools like applying manifests are commented out with a note that they’re not included for read-only agents. And the delete resource tool? Also commented out, with a note that it’s never included. The guidance here is to start with the minimum set and only add tools when you have a specific, justified use case.

Network isolation is the last infrastructure control. A NetworkPolicy restricts what the kagent pod can reach on egress. It allows outbound TCP on port 443 to the Kubernetes API server — using the specific IP range for your cluster — and outbound TCP on port 443 to reach the Anthropic API. That’s it. The pod can’t freely reach the internet or other internal services.

Finally, every agent’s system prompt should include a set of safety instructions. These are written in plain language: always use informational tools before any modification tools, never delete resources, never expose Secret values in responses, and for any destructive or risky action, output the command but wait for human confirmation before proceeding. These rules act as a last line of defence at the model level.

Put it all together and you’ve got defence in depth — ServiceAccounts isolate identity, RBAC limits what each identity can do, Secrets protect credentials, tool whitelists constrain agent behaviour, network policies limit egress, and system prompt rules guide the model itself.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Jobs Cronjobs

Welcome to the NZRT Wiki Podcast. Today we’re looking at Jobs and CronJobs.

If you’ve worked with Kubernetes before, you’re probably familiar with Deployments — resources that keep pods running continuously. But what about tasks that just need to run once and finish? That’s where Jobs and CronJobs come in, and they’re incredibly useful for batch work like database migrations, backups, and scheduled reporting.

Let’s start with Jobs. A Job in Kubernetes runs one or more pods and keeps going until a specified number of them complete successfully. Think of it like telling Kubernetes: run this task, and don’t stop until it’s done. If a pod fails partway through, Kubernetes will try again.

The first code example shows a Job definition written in YAML. It defines a Job called “db-migration” running in the nzrt-prod namespace. Inside, it sets up a container called “migrate” using an application image, and it runs a PHP Artisan migrate command — so this is a database migration job. Two important settings here: the restart policy is set to “on failure”, meaning if the container crashes, Kubernetes will restart it rather than just giving up. And the backoff limit is set to three, which means Kubernetes will retry the job up to three times before marking it as failed.

The second code example shows three commands you’d use to work with that job from the command line. The first lists all jobs in the nzrt-prod namespace so you can see their status. The second pulls the logs from the db-migration job so you can check what actually happened during the run. And the third deletes the job once you’re done with it — important to keep things tidy, since completed jobs don’t clean themselves up automatically.

Now let’s move on to CronJobs. A CronJob is simply a Job that runs on a schedule. It wraps a Job definition inside a schedule expression, the same kind you’d use in a Linux crontab. If you’ve ever set up a scheduled task on a Linux server, this will feel very familiar.

The third code example shows a CronJob called “nzrt-backup” — again in the nzrt-prod namespace. The schedule field uses a cron expression that means “run at two in the morning, every day”. Inside, it defines a job template that runs a container using a backup tool image, executing a shell script called backup.sh. The restart policy is again set to “on failure”. There are also two history settings worth noting: successful jobs history is kept for three runs, and failed jobs history is kept for just one. This controls how many completed and failed job records Kubernetes retains, so you can look back and see what happened without cluttering the cluster with old records.

The fourth code example shows how you interact with CronJobs from the command line. The first command lists all CronJobs in the namespace. The second gives you a detailed description of the nzrt-backup CronJob — useful for checking the schedule, last run time, and any issues. The third command is particularly handy: it lets you manually trigger a CronJob right now without waiting for the schedule. You create a job “from” the CronJob definition, give it a name like “manual-backup”, and it runs immediately. This is great for testing or for running an out-of-schedule backup when you need one.

So to pull it all together — Jobs are your go-to when you need Kubernetes to run a task to completion, like a migration or a one-off data process. CronJobs wrap that same concept in a schedule so the work happens automatically and repeatedly. Both support retry logic through the restart policy and backoff limit, and CronJobs give you that manual trigger option when you need to run something on demand.

If you want to dig deeper, the related topics in the wiki cover Deployments and ReplicaSets for long-running services, and Monitoring Overview for keeping an eye on how your Jobs are performing.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Kagent Setup Nzrt

Welcome to the NZRT Wiki Podcast. Today we’re looking at Kagent Setup — NZRT.

This episode walks you through installing kagent in the NZRT Kubernetes cluster and wiring it up to use Claude Sonnet as the primary language model. By the end you’ll have a working SRE agent running inside the cluster and ready to diagnose problems.

Let’s start with what you need before you begin. There are five prerequisites. First, a Kubernetes cluster — NZRT already has prod, staging, and dev namespaces set up. Second, kubectl configured with cluster access. Third, Helm version 3 for the chart installation. Fourth, an Anthropic API key from the NZRT Gmail Anthropic account. And fifth, the kagent CLI itself, which we install in the very first step.

Step one is getting the kagent CLI onto your machine. You run a one-line install script that downloads and runs the installer automatically from the kagent website. Once that finishes, you check that it worked by asking for the version number. If a version comes back, you’re good to move on.

Step two is creating the kagent namespace in your cluster. A single kubectl create namespace command handles that. You then label the namespace with three NZRT standard values — owner set to nzrt, service-code set to 000K8S, and environment set to prod. Those labels keep things consistent with how NZRT organises all its cluster resources.

Step three is storing your Anthropic API key as a Kubernetes secret. You create a secret called anthropic-key inside the kagent namespace, passing your API key in as a literal value. You then run a get secret command to verify it’s there. Once you see it listed, the key is safely stored and ready to use.

Step four is the main Helm installation. You add the kagent chart repository, update your local cache, then run the install command. That command puts kagent into the kagent namespace and you pass in three settings: the default provider is Anthropic, the secret name is the one you just created, and you specify which field inside that secret holds the actual key value. After the install, you check the rollout status of the kagent controller deployment and list all pods in the namespace to confirm everything is running.

Step five is creating a ModelConfig resource. This is how you tell kagent exactly which Claude model to use. You write a small YAML file defining a resource of kind ModelConfig, name it claude-sonnet, place it in the kagent namespace, and add the NZRT owner and service-code labels. In the configuration spec you reference the anthropic-key secret, set the model to claude-sonnet-4-6, and set the provider to anthropic. You apply the file with kubectl and the model config becomes live. The wiki also notes that for heavier reasoning tasks you can create a second ModelConfig pointing at claude-opus-4-7.

Step six is deploying the NZRT SRE agent, and this is where everything comes together. The agent is defined in another YAML file, this time as a resource of kind Agent. It’s named nzrt-sre-agent, lives in the kagent namespace, and carries the standard NZRT labels. The most important part is its system message — the instruction set that defines what the agent does and how it behaves. It tells the agent it is an SRE agent for the NZRT cluster, lists the namespaces it works across — prod, staging, dev, monitoring, and kagent — and sets firm boundaries. It must use read-only tools first, it must never delete or modify resources, and when it has a fix recommendation it should output the exact command or YAML but wait for human confirmation before anything gets applied. The agent is linked to the claude-sonnet ModelConfig from the previous step. It also gets five tools from the kagent tool server: get resources, get pod logs, describe a resource, get cluster events, and check service connectivity. You apply the file with kubectl just as before.

Step seven is opening the dashboard. A single kagent dashboard command launches a local web interface at port 8082. If you prefer to do it manually, you can use kubectl to port-forward the kagent dashboard service to that same port on your machine.

To know that everything is working correctly, run through this mental checklist. All pods in the kagent namespace should show as Running. Your claude-sonnet ModelConfig and your nzrt-sre-agent should both show a Ready status. The dashboard should be reachable at localhost on port 8082. And when you send the agent a test message asking it to list all pods in nzrt-prod, it should respond with that pod list — confirming the model connection and tool access are both functioning end to end.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Nzrt K8S Architecture

Welcome to the NZRT Wiki Podcast. Today we’re looking at NZRT K8s Architecture.

So what is this page all about? It covers NZRT’s specific approach to running Kubernetes — that’s the container orchestration platform you might have heard of — including how the cluster is designed, how workloads are organised, and how deployments are automated.

Let’s start with the cluster overview. The platform itself is still being decided, and the version and node count will be confirmed once the cluster is actually provisioned. What is already locked in is the container runtime — NZRT will be using containerd, which is one of the most widely adopted and production-proven runtimes in the Kubernetes ecosystem.

Next, let’s talk about the namespace strategy. If you’re new to Kubernetes, namespaces are logical partitions inside the cluster — a way to separate different environments and concerns so they don’t interfere with each other. NZRT has five namespaces planned. The first is nzrt-prod, which is where all production workloads live. Then there’s nzrt-staging, the pre-production environment — also called UAT, or User Acceptance Testing — where things get validated before going live. After that you have nzrt-dev, the space for development and active testing work. Then there’s a namespace called monitoring, which hosts the observability stack — specifically Prometheus for metrics collection and Grafana for dashboards and visualisation, along with the logging stack. And finally there’s ingress-nginx, which runs the ingress controller — that’s the component responsible for routing external web traffic into the right services inside the cluster.

Now let’s look at workload placement — which specific services run where, and how they’re configured. There are four services mapped out so far. WordPress runs in the production namespace as a Deployment, and it connects to an external MySQL database rather than one running inside the cluster itself. Dolibarr, which is NZRT’s ERP and CRM platform, also runs in the production namespace as a Deployment. Nextcloud, the file and collaboration platform, runs in production as a StatefulSet. If you’re wondering what the difference is, StatefulSets are used when a workload needs stable storage that persists across restarts — which Nextcloud definitely requires. And finally, there’s a planned blockchain node for future use — also a StatefulSet in production — which will connect to the Base network once it’s brought online.

Now let’s cover the CI/CD integration. That stands for Continuous Integration and Continuous Deployment, and it’s the automated pipeline that takes your code changes and gets them running in the cluster without manual steps in between. The diagram in the documentation shows a flow that starts at GitHub, where all code repositories live under the NZRT source control setup. From there, a GitHub Actions workflow kicks in automatically. That workflow does two things: first it builds a Docker container image and pushes it to a container registry, and then it applies the updated configuration to the Kubernetes cluster — either directly or through a tool called Helm, which is a package manager for Kubernetes that simplifies managing complex deployments. The end result is a rolling deployment, meaning the update rolls out gradually so there’s zero downtime — your users stay connected while the new version comes up in the background.

The documentation also points to a few related resources if you want to go deeper. There’s a general Kubernetes Overview page, the Infrastructure Vault under the code 000INF, and the GitHub Vault under 000GIT.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Nzrt Kubernetes Setup

Welcome to the NZRT Wiki Podcast. Today we’re looking at NZRT Kubernetes Setup.

This wiki covers how NZRT configures and manages its Kubernetes cluster — from the initial namespace setup right through to workload deployment conventions. Let’s walk through it together.

First, a quick look at the cluster details. The provider, Kubernetes version, and node count are all still to be confirmed — they’ll be updated once the cluster is provisioned. What we do know is that if a cloud provider is used, the cluster will be hosted in New Zealand. And when it comes to access, the kubeconfig file — which is the credential file that lets you connect to the cluster — is stored securely in the Nextcloud vault under the 000NCL section.

Next up is namespace setup. In Kubernetes, namespaces let you divide a single cluster into logical sections, keeping different environments and concerns separated. NZRT sets up five namespaces when bringing a cluster online. You create one called nzrt-prod for production workloads, one called nzrt-staging for staging, and one called nzrt-dev for development. Then you add a monitoring namespace for observability tools, and finally an ingress-nginx namespace for the ingress controller. These five namespaces form the foundation of every NZRT cluster.

Now let’s talk about standard labels. Every resource you deploy in the NZRT cluster should carry a consistent set of labels. These labels are key-value pairs attached to Kubernetes objects that help you identify, filter, and manage resources at scale. The label set NZRT uses has five fields. First is app, which you set to the name of your application. Second is environment, which should be prod, staging, or dev depending on where the workload lives. Third is owner, which is always set to nzrt. Fourth is service-code, which carries the value 000K8S. And fifth is managed-by, which tells you whether the resource was deployed using Helm or kubectl directly. Applying these labels consistently across everything you deploy makes cluster management much easier down the line.

Moving on to ingress setup. NZRT uses nginx as its ingress controller — this is the component that routes external HTTP and HTTPS traffic into your cluster services. To install it, you first add the ingress-nginx Helm repository, then use Helm to install the chart into the ingress-nginx namespace. That one Helm command handles the full installation, and if the namespace doesn’t already exist, it creates it automatically.

After ingress, you’ll want to set up cert-manager. This is what handles automatic TLS certificate provisioning for your services — so your apps get HTTPS without you having to manually manage certificates. You install cert-manager by applying a single manifest directly from the cert-manager GitHub releases page. Once that’s done, you configure a ClusterIssuer resource. Think of a ClusterIssuer as a cluster-wide object that tells cert-manager where and how to request certificates. NZRT’s ClusterIssuer is named letsencrypt-prod and it points to the Let’s Encrypt production certificate authority. It uses the ACME protocol with an HTTP challenge — meaning Let’s Encrypt verifies domain ownership by making an HTTP request through your nginx ingress. The contact email registered with Let’s Encrypt for NZRT is nzrtnetwork at gmail dot com, and the private key generated during that registration is stored in a Kubernetes secret also named letsencrypt-prod.

Finally, let’s run through the NZRT workload checklist. Before you consider any workload ready for deployment, there are eight things you need to confirm. One — your namespace has been created and a ResourceQuota is in place to prevent any single namespace from consuming too many cluster resources. Two — RBAC roles have been applied, meaning the right permissions are granted to the right service accounts. Three — any secrets your app needs have been created directly in the cluster and are not committed to a Git repository. Four — liveness and readiness probes are configured so Kubernetes knows when your app is healthy and when it is ready to serve traffic. Five — resource requests and limits are set on your containers so the scheduler can place them correctly and prevent resource starvation. Six — your ingress is configured with TLS so traffic to your service is encrypted. Seven — if your workload needs persistent storage, that has been provisioned, typically using StatefulSets. And eight — your CI/CD pipeline in GitHub Actions is configured and connected to the cluster.

If you want to go deeper, the related pages to check out are the NZRT K8s Architecture doc and the GitHub vault under 000GIT for CI/CD pipeline details.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Security Overview

Welcome to the NZRT Wiki Podcast. Today we’re looking at Security Overview.

If you’ve spent any time working with Kubernetes, you’ll know that security isn’t just one thing you switch on. It’s a set of overlapping layers, and understanding how those layers fit together is what this episode is all about.

The core idea is this: Kubernetes security is built in depth. You’re protecting the cluster from multiple angles at the same time, covering who can access it, what traffic can flow through it, how workloads are isolated from each other, and how sensitive information is stored. Let’s walk through each of those layers.

The first layer is authentication. This is about proving who you are when you connect to the cluster. You might do that through a kubeconfig file on your local machine, through a ServiceAccount token assigned to an application running inside the cluster, or through an external identity provider using a protocol called OIDC, which stands for OpenID Connect. Think of authentication as the front door.

Once you’re through the front door, the next layer is authorisation. Kubernetes uses something called RBAC, which stands for Role-Based Access Control. This is how the cluster decides what you’re allowed to do once it knows who you are. You might be authenticated as a valid user, but RBAC is what determines whether you can actually create, read, modify, or delete specific resources.

The third layer is admission control. This is a set of gatekeepers that check requests before they’re written to the cluster. Tools here include LimitRange and ResourceQuota, which stop workloads from consuming too many resources, and a policy engine called OPA Gatekeeper, which lets you enforce custom rules across the cluster.

Layer four is the network. Kubernetes lets you define NetworkPolicies, which control exactly what traffic is allowed in and out of each pod. You can think of these as firewall rules at the pod level, giving you fine-grained control over ingress and egress traffic.

Fifth is pod isolation. This is handled through something called the SecurityContext, which is a set of settings you apply to a pod or container. At NZRT, the standard is to run containers as non-root users wherever possible and to use read-only filesystems. This limits the damage an attacker can do if they manage to get inside a running container.

The sixth and final layer is secrets management. Kubernetes Secrets store sensitive values like passwords, tokens, and API keys. The important thing here is that secrets should be encrypted at rest, meaning they’re not just sitting in plain text in the cluster’s data store. NZRT also uses external secrets managers for more advanced cases.

Now let’s talk about the NZRT-specific security baseline, because this is where those general principles get applied to our own environment.

The production namespace, which is called nzrt-prod, is restricted. Only the roles assigned to xc and dan have access to it. Secrets in that namespace are written using a format called stringData, and encryption at rest must be enabled on the cluster for this to be properly protected. All containers run as non-root where possible, as mentioned earlier. There’s also a ResourceQuota applied to nzrt-prod, which acts as a safety net to prevent any one workload from accidentally, or maliciously, consuming all available cluster resources. And ingress traffic into the cluster uses TLS, with certificates managed automatically by cert-manager using Let’s Encrypt.

Now let’s look at a few quick checks you can run to verify that security is configured correctly. These are command-line checks you’d run against the cluster.

The first check lets you ask the cluster a direct question: can a given user create pods in the nzrt-prod namespace? You’re essentially asking the cluster to tell you whether a particular action is permitted.

The second check is broader. You can ask the cluster to list all the things a user is allowed to do within the nzrt-prod namespace, giving you a full picture of their permissions.

The third check lets you inspect a specific pod and retrieve its security context settings, so you can confirm whether it’s running with the expected non-root and filesystem configurations.

And the fourth check simply lists all the NetworkPolicies that exist in nzrt-prod, so you can see at a glance whether traffic controls are in place.

None of these checks change anything in the cluster. They’re read-only inspection commands, which makes them safe to run at any time if you want to audit what’s in place.

To bring it all together, think of Kubernetes security as concentric rings. The outer ring is authentication and authorisation, controlling who gets in and what they can do. The middle rings are admission control and networking, shaping what workloads can run and how they communicate. The inner rings are pod isolation and secrets management, protecting the workload itself and the sensitive data it handles. NZRT’s baseline tries to get all of those rings working together, particularly in the production namespace where it matters most.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Rbac

Welcome to the NZRT Wiki Podcast. Today we’re looking at RBAC.

RBAC stands for Role-Based Access Control, and at its core it answers three questions: who are you, what are you allowed to do, and where in the system can you do it? Whether you’re a human user, a service account, or an automated process, RBAC is what decides your level of access inside a Kubernetes cluster.

Let’s start with the four main building blocks of RBAC, because understanding these will make everything else click into place.

The first is a Role. A Role is scoped to a single namespace, and it defines what permissions are allowed within that one namespace. Think of it as a job description that only applies to one department.

The second is a ClusterRole. This works the same way as a Role, but instead of being limited to one namespace, it applies across the entire cluster. So if you need someone to have permissions everywhere, ClusterRole is your tool.

The third object is a RoleBinding. This is the glue between a Role and a user, group, or service account. On its own, a Role doesn’t do anything — you need a RoleBinding to actually hand those permissions to someone. And like a regular Role, a RoleBinding is scoped to one namespace.

The fourth is a ClusterRoleBinding. Same idea as a RoleBinding, but it applies a ClusterRole across the whole cluster, not just one namespace.

So the pattern is: Roles and RoleBindings live in a namespace. ClusterRoles and ClusterRoleBindings operate cluster-wide.

Now let’s look at a real example — a Role definition for NZRT developers. This configuration creates a Role called nzrt-developer, sitting inside the nzrt-dev namespace. It defines two sets of rules. The first set covers pods, deployments, services, and config maps — and it grants the ability to get information about them, list them, watch for changes, create new ones, update existing ones, and patch them. The second set is specifically for pod logs and interactive pod sessions — and for those, only get and create are permitted. So developers get solid read and write access to the main workload resources, but nothing beyond what they need.

Next up is the RoleBinding that actually activates those permissions. This binding is called dev-binding, also in the nzrt-dev namespace. It points to a specific user — the developer at nzrtnetwork dot com email address — and it references the nzrt-developer Role we just described. The moment this binding exists, that developer account gains all the permissions defined in the Role, but only inside the nzrt-dev namespace. Outside that namespace, those permissions simply don’t apply.

There’s also a third type of object worth knowing about: a ServiceAccount. This is used when an application or automated process — rather than a human — needs to interact with the cluster. The example here creates a ServiceAccount called nzrt-app-sa inside the nzrt-prod namespace. You’d then bind a Role or ClusterRole to this service account just like you would with a user, so the application running in your cluster has exactly the access it needs and nothing more.

Now let’s talk about how you actually work with these objects day to day. There are a handful of commands you’ll use regularly. You can list all Roles inside a specific namespace — say, nzrt-prod. You can do the same for RoleBindings in that namespace. You can pull a full list of all ClusterRoles across the entire cluster. And there’s a particularly useful command that lets you ask a direct question: can this specific user create deployments in this namespace? You pass in the namespace and impersonate the user in question, and Kubernetes will tell you yes or no. That last one is invaluable for debugging access issues without having to log in as the affected user yourself.

So to pull it all together: RBAC gives you fine-grained control over who can do what and where. You define permissions in a Role or ClusterRole, you attach those permissions to people or processes using bindings, and you use service accounts when the entity needing access is an application rather than a person. The scope — namespace versus cluster-wide — determines how broadly those permissions reach.

If you want to go deeper, check out the Security Overview and Namespaces articles in the wiki — both are closely related to everything we’ve covered here today.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Models Providers

Welcome to the NZRT Wiki Podcast. Today we’re looking at Models & Providers.

If you’ve been working with AI tools at NZRT, you’ve probably noticed there’s no shortage of model options out there. This episode walks you through the main providers we work with, how to pick the right model for a given job, and what you can expect to pay.

Let’s start with Anthropic, the company behind Claude. There are three Claude models you’ll encounter. First is Claude Haiku 4.5 — this is your go-to for fast, high-volume work where cost matters. Think classification tasks, quick extractions, anything you need to run at scale. Then there’s Claude Sonnet 4.6, which sits in the middle and is probably the model you’ll reach for most often. It handles coding, reasoning, and writing really well without breaking the budget. At the top end is Claude Opus 4.7, the most capable of the three — best suited for complex reasoning tasks and working through long documents. All three Claude models support tool use, vision, extended thinking, computer use, and MCP integration. They all also carry a two-hundred-thousand token context window, which is substantial.

Next up is OpenAI’s GPT lineup. You have four key models here. GPT-4o is multimodal, fast, and broadly capable across a wide range of tasks. GPT-4o mini is the lighter, cheaper version — great for classification and anything you need done quickly at low cost. Then there are the reasoning-focused models: o1 uses extended thinking tokens to work through problems step by step, and o3 pushes that even further with more advanced reasoning and a two-hundred-thousand token context. GPT-4o and GPT-4o mini both sit at one-hundred-and-twenty-eight thousand tokens of context.

Moving on to Google’s Gemini family. This is where context windows get truly massive — all three Gemini models support up to one million tokens. Gemini 1.5 Pro is the standout for long-context multimodal work. Gemini 2.0 Flash gives you speed and low cost. And Gemini Ultra sits at the top for maximum capability. If you ever find yourself dealing with an enormous document — something north of five-hundred-thousand tokens — Gemini 1.5 Pro is where you want to be.

Now let’s talk about open-source and self-hosted options, because not every use case needs a cloud API. There are five models worth knowing here. Llama 3.3 from Meta at seventy billion parameters is a strong open-source baseline. Mistral Large at a hundred-and-twenty-three billion parameters is European-built and particularly solid for coding tasks. Qwen 2.5 from Alibaba comes in at seventy-two billion parameters and handles multilingual work well. DeepSeek R1 is a Chinese-built model using a mixture-of-experts architecture, weighing in at six-hundred-and-seventy-one billion parameters, with strong reasoning capability. And Phi-4 from Microsoft is a compact fourteen-billion-parameter model — efficient and well-suited for running on less powerful hardware. You can run all of these locally using tools like Ollama, LM Studio, vLLM, or llama.cpp.

So how do you choose? The wiki lays out a handy decision guide. For high-volume classification or extraction work, reach for Haiku 4.5 or GPT-4o mini. For code generation and general reasoning, Sonnet 4.6 or GPT-4o are your best bets. Complex architecture work or long documents point you toward Opus 4.7. If your context needs are enormous, Gemini 1.5 Pro handles that. Privacy-sensitive or on-premise requirements mean you’re looking at Llama 3.3 running locally via Ollama. And for extended step-by-step reasoning chains, o1, o3, or Claude with extended thinking enabled are your options.

On pricing — all the major APIs charge per token, and they bill input and output separately. The wiki groups these into three tiers. At the cheap end, models like Haiku and GPT-4o mini run somewhere between ten cents and forty cents per million tokens. The mid-tier — Sonnet and GPT-4o — sits between one and five dollars per million tokens. Premium models like Opus or o1 can run anywhere from fifteen to seventy-five dollars per million tokens. One thing worth knowing: both Claude and Gemini support prompt caching, which means repeated system prompts don’t cost you full price every time — a useful lever if you’re running the same setup across many requests.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Prompt Engineering

Welcome to the NZRT Wiki Podcast. Today we’re looking at Prompt Engineering.

So what exactly is prompt engineering? Put simply, it’s the practice of designing the inputs you give to a large language model so that you get accurate, useful, and consistent outputs back. Think of it as learning how to communicate with an AI in a way that actually works.

Let’s start with the core principles. There are five of them. First, be explicit — state your task, the format you want, and any constraints as clearly as possible. Second, provide context — include relevant background information right there in your prompt. Third, use examples — giving the model a few examples before your real question dramatically improves accuracy. Fourth, specify your output format — tell it whether you want JSON, a table, a bullet list, or plain prose. And fifth, constrain the scope — tell the model not just what to do, but what not to do.

Now let’s walk through the main prompting patterns.

The first is zero-shot prompting. No examples at all — you just rely on the model’s existing knowledge. Imagine asking it to classify the sentiment of a product review as positive, negative, or neutral. You give it the review text, and off it goes. Straightforward.

The second pattern is few-shot prompting. Here you provide two to five examples before your actual request. So you might show it that a review saying “Loved it!” is positive, “Broken on arrival” is negative, and “It’s okay” is neutral — then you present your real review and let the model follow the pattern. This significantly improves accuracy, especially on classification tasks.

Third is chain-of-thought prompting. Instead of asking for a direct answer, you ask the model to reason step by step before giving you a result. For example, you might give it a maths problem — a store has one hundred and twenty items, thirty percent are on sale, how many are full price — and ask it to work through each step. Showing its reasoning dramatically reduces errors.

Fourth is role prompting. You assign the model a persona to shape its response style. Something like telling it to act as a senior New Zealand tax accountant and answer in plain English. That framing steers the tone, vocabulary, and depth of everything that follows.

And fifth is structured output prompting. When you need machine-readable results, you just specify the format. You might say: return a JSON object with keys for name, date, amount, and currency. Clear, precise, done.

Now, when it comes to writing a system prompt, the order of your content matters. The recommended structure is: start with a role or persona, then describe the task, then list your constraints and rules, then specify your output format, and finish with any examples.

Let’s talk about what goes wrong. There are six common failure modes to be aware of.

The first is hallucination — the model invents facts to fill gaps. The fix is to ground it with retrieved context, a technique called Retrieval-Augmented Generation, or RAG.

The second is when the model ignores your instructions. This usually happens because your key rules got buried in a long prompt. Move them to the top or the very bottom where they carry more weight.

Third is verbose output — the model just goes on too long. Add an explicit length constraint, something like “be concise, maximum one hundred words.”

Fourth is wrong format — the model doesn’t give you what you asked for. Provide an exact format example so there’s no ambiguity.

Fifth is sycophancy — where the model agrees with incorrect statements just to please you. Counter it by explicitly telling it not to agree if something is wrong.

And sixth is over-refusal — the model refuses a perfectly valid request. This usually resolves when you rephrase and add context about your intent.

Finally, let’s look at some ideas from researcher Andrej Karpathy, who frames large language models as the core of a new kind of operating system. In this view, the model is like the CPU, and your prompt is the program running on it. The context window — everything the model can see at once — is like RAM, so you want to be deliberate about what you put in there. You can extend a model’s capabilities by giving it access to external tools. When you chain a model together with tools and memory in a loop, you get what’s called an agent. And here’s one of the most practical insights: verifying an answer is easier than generating one from scratch. That means you can use a language model to check its own outputs — a powerful technique worth building into your workflows wherever accuracy matters.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Administration Overview

Welcome to the NZRT Wiki Podcast. Today we’re looking at Nextcloud Administration Overview.

So if you’re working with NZRT’s self-hosted tech stack, Nextcloud is a core piece of infrastructure. It serves over fifty users, and keeping it running smoothly is a shared responsibility between two key roles — the admin account, which is xc, and the database administrator, known as dan. Together they cover everything from keeping apps updated to making sure backups are running and security patches are applied on time.

Let’s walk through what that actually looks like day to day.

There are seven main admin tasks, and each one has a set frequency and an owner. First, updating apps — that happens monthly, and both xc and dan are responsible for it. Second, backing up the database and files — that’s a daily job owned by dan, so it’s happening every single day to make sure nothing is lost. Third, monitoring storage usage — dan handles that weekly, keeping an eye on how much space is being consumed across the system. Fourth, reviewing audit logs — that’s also weekly, but this one belongs to xc. Audit logs are important for spotting anything unusual in user activity or system behaviour. Fifth, user provisioning — that means creating accounts, managing access, and setting up new users — and that’s handled by xc on an as-needed basis. Sixth, performance tuning — this one is quarterly and belongs to dan. It involves things like optimising the cache and tuning the database to keep everything running fast. And seventh, security updates — those get applied as soon as they’re released, and both dan and xc share that responsibility together.

Now, the admin panel is broken down into four main sections. The first is Apps and Plugins, where you can install, enable, disable, and update any of the apps that extend Nextcloud’s functionality. The second is Backups and Maintenance, which covers the backup strategy and how you’d restore data if something went wrong. The third is Performance Tuning, where you’d look at cache optimisation and database settings to keep response times fast. And the fourth is Logging and Monitoring, which gives you health checks, alerts, and log analysis tools to stay on top of what the system is doing.

To get into the admin dashboard, you navigate to your NZRT Nextcloud instance, go to the admin section of the settings area, and log in with the xc account or any other account that has admin privileges. That single page is your central control panel for everything we’ve just discussed.

One thing worth understanding is the broader context here. For NZRT, Nextcloud isn’t just a nice-to-have — it’s mission-critical infrastructure. With over fifty users relying on it daily, the expectation is high availability, solid security, and consistent performance. That’s why responsibility is split the way it is. Dan handles the more technical, scheduled maintenance — daily backups, weekly storage checks, quarterly tuning. xc handles the governance and access side — audit log reviews, user provisioning, and security decisions. It’s a clean division that makes sure nothing falls through the cracks.

If you want to go deeper on any of these areas, the wiki has dedicated notes on each of the four sections we mentioned — Apps and Plugins, Backups and Maintenance, Performance Tuning, and Logging and Monitoring. Each of those goes into much more detail on the specific procedures and tools involved.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Admin Dashboard

Welcome to the NZRT Wiki Podcast. Today we’re looking at ⚙️ Admin Dashboard.

If you’re working with Nextcloud at NZRT, the Admin Dashboard is your central hub for keeping everything running smoothly. You can get to it by navigating to the admin section of your Nextcloud settings. From there, you have control over pretty much everything — users, apps, security, and the overall health of the system.

Let’s walk through what you’ll find when you get there.

The dashboard is organized into several core sections. First up is the Overview, which gives you a quick snapshot of system health, storage usage, how many users you have, and which sessions are currently active. Think of it as your at-a-glance health check.

Next is Basic Settings. This is where you configure things like trusted domains, how background jobs are handled, and your email setup. If Nextcloud needs to send notifications or password resets, this is where that gets configured.

Then there’s Security. This section lets you enforce two-factor authentication across your users, set password policies, and configure rate limiting — which helps protect the system against brute-force login attempts.

Sharing settings let you control how files and folders are shared. You can set the defaults for sharing behavior, manage federated sharing with other Nextcloud instances, and control whether public links are allowed and under what conditions.

Users and Groups is where you manage your actual user accounts — adding people, assigning them to groups, and setting storage quotas so nobody accidentally fills up the server.

The Apps section lets you install, enable, or disable apps within Nextcloud and manage what permissions those apps have. This is important for keeping the feature set aligned with what NZRT actually needs.

And finally, Monitoring gives you access to the activity log, the audit trail, and the status of background jobs. If something seems off, this is usually your first stop for investigating what’s happening.

Now let’s talk about some of the common tasks you’ll actually perform in the dashboard. There are six key tasks worth knowing about. Viewing users is done by going to Settings then Users. Enabling two-factor authentication is also under Settings, in the Security area. Configuring LDAP for directory integration lives under Settings in the LDAP section. Managing apps is under Settings then Apps. Viewing logs is under Settings then Logging. And checking storage is available right from the Overview section. So across all six of these tasks, you’re mostly navigating through the Settings menu, which keeps things fairly intuitive once you know the layout.

One of the more technical but important aspects of running Nextcloud is background jobs. Nextcloud needs a process running in the background to handle things like syncing calendars, updating file type databases, sending notifications, and general housekeeping. There are a few ways to set this up — you can use Ajax, which runs jobs when users interact with the system, or you can use a proper system-level scheduled task, which is more reliable.

For NZRT, the recommended approach is system cron, running every five minutes. What that looks like in practice is two scheduled commands that run automatically on that five-minute cycle. The first one updates the file type database so Nextcloud correctly recognizes and handles different kinds of files. The second one syncs birthday calendars from your contacts into the calendar app. Both of these run as the web server user and call Nextcloud’s built-in command-line tool to do their work. Once set up in your system’s cron scheduler, they just happen in the background without you needing to think about them.

In the context of NZRT specifically, the admin role — that’s the xc account — uses the dashboard on a daily basis. The main things you’re checking for are Nextcloud’s overall health, whether user quotas are being respected, what’s showing up in the activity logs, and whether the integrations with Dolibarr and WordPress are still functioning correctly. Those integrations are important to NZRT’s day-to-day workflow, so keeping an eye on them through the dashboard is a routine part of the admin’s responsibilities.

If you want to go deeper on any of the areas covered today, the related wiki notes to look at are the Administration Overview, Apps and Plugins, and Users and Groups pages. Those will give you more detail on each of those specific areas.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Tool Use Agents

Welcome to the NZRT Wiki Podcast. Today we’re looking at Tool Use & Agents.

Let’s start with the concept of tool use, sometimes called function calling. At its core, this is the ability for a large language model to reach out and interact with the world beyond its own knowledge. When you send a prompt to an AI, rather than just generating a text answer, the model can recognise that it needs to call an external tool to get the job done. It does this by producing a structured piece of data, essentially a description of what tool it wants to use and what inputs it needs. Your application picks that up, runs the actual tool, whether that’s an API call, a database query, or a file read, and then passes the result back to the model, which uses it to form its final response.

To make that concrete, imagine Claude deciding it needs to check the weather. It would output something that says: call the get weather function, with Auckland, New Zealand as the location. Your app runs that, gets the forecast, hands it back, and Claude says something sensible like “It looks like it’ll be cloudy in Auckland today.” The model never directly calls anything itself. It generates the instruction, and your host application does the actual work.

Next up is Retrieval-Augmented Generation, or RAG. This is a technique for grounding a model’s responses in real, up-to-date information rather than relying purely on what it learned during training. The idea is that when you ask a question, your system first converts that question into a mathematical representation called an embedding, then searches a database of similarly encoded document chunks to find the most relevant pieces of content. Those chunks get inserted into the prompt as context, and the model generates its answer based on that retrieved material rather than guessing.

There are a few moving parts to know about here. First, chunking: your source documents get split into overlapping segments, typically somewhere between two hundred and five hundred tokens each, so they’re a manageable size for retrieval. Second, an embedding model converts both your query and your document chunks into vectors, which are essentially lists of numbers that capture meaning. Models like text-embedding-3-small are commonly used for this. Third, a vector store holds all those embeddings and lets you search them by similarity. Popular options include Pinecone, Chroma, pgvector, Qdrant, and Meilisearch. And finally, a reranker can take the top results from that search and re-score them more carefully before they go into the prompt, improving quality even further.

Now let’s talk about agents. An agent is a large language model running in what’s called an agentic loop: it perceives a goal, reasons about what to do, takes an action using a tool, observes the result, and then repeats that cycle until the task is complete or it hands off to something else. This is what separates an agent from a simple chatbot. It’s not just answering your question once, it’s working through a problem across multiple steps.

There are several common patterns for how agents are designed. The ReAct pattern, short for Reason and Act, has the model interleave its thinking with its tool calls, reasoning out loud before each action. Plan-and-Execute agents generate a full plan upfront and then carry out each step in sequence. Reflection agents go a step further and critique their own output, retrying if something doesn’t look right. Multi-agent setups have an orchestrator model delegating subtasks to specialist subagents, each with their own focus area. And Human-in-the-Loop agents pause at key decision points and wait for a human to approve before continuing. Each pattern suits different use cases depending on how much autonomy and reliability you need.

One important standard in this space is MCP, the Model Context Protocol, released by Anthropic in 2024. MCP provides a unified way for language models to connect to tools and data sources. Think of it as a common language that lets Claude talk to a wide range of external systems without needing custom integration code for each one. In an MCP setup, you have the model itself, then an MCP host like Claude Code or Claude Desktop, and then MCP servers that expose the actual capabilities. Those servers can provide access to filesystems, databases, APIs, browsers, and more. MCP supports two transport modes: stdio for running things locally, and server-sent events over HTTP for remote connections. The things MCP servers can expose fall into three categories: tools, which are functions the model can call; resources, which are data the model can read like files or database rows; and prompts, which are reusable templates. MCP servers can be written in Python or TypeScript using the official SDK.

Finally, a quick word on memory. Language models are stateless by default, meaning each new conversation starts completely fresh. But there are patterns to work around this. You can keep prior turns or summaries in the prompt itself. You can store facts in a database and retrieve them by key. You can use semantic memory, embedding past interactions and retrieving them by similarity. You can log full conversation histories and summarise them on demand. Or you can encode persistent rules and persona directly into the system prompt, which is called procedural memory. Each approach has trade-offs in cost, speed, and fidelity, and many real-world systems combine several of them.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Backups Maintenance

Welcome to the NZRT Wiki Podcast. Today we’re looking at Nextcloud Backups & Maintenance.

If you’re running NZRT’s Nextcloud instance, backups are not optional. They protect against data loss, ransomware, and hardware failure, and they cover Dolibarr and WordPress data too. So let’s walk through exactly how the backup strategy works, what the restore process looks like, and what regular maintenance tasks you need to keep on top of.

First, the strategy at a high level. Backups run on two cycles. Daily incremental backups capture only what’s changed since the last run. Weekly full backups capture everything from scratch. Retention is thirty days for backups you can access online, and one year for archived copies. Storage spans two locations: a local NAS device on-site, and an off-site destination, either an S3 cloud bucket or tape storage. Two important numbers to know here: RPO and RTO. RPO stands for Recovery Point Objective, meaning the maximum amount of data you’re willing to lose. For NZRT Nextcloud that’s four hours. RTO stands for Recovery Time Objective, meaning how fast you need to be back online after a failure. That target is one hour.

Now let’s talk about what actually gets backed up. There are three components. First is the MySQL database, which runs between five and ten gigabytes. That backs up every day at four in the morning using either mysqldump or Percona XtraBackup. Second is the Nextcloud data folder containing all user files, which can range from five hundred gigabytes up to two terabytes. That one backs up weekly, on Sunday nights at two in the morning, using rsync or tar. Third are the configuration files, which are under one gigabyte and back up monthly to the NAS using rsync.

Now let’s walk through the backup script itself. The script is written in Bash and runs automatically. It starts by setting up a destination folder on the NAS and generating a timestamp so every backup file gets a unique name. It then runs a database dump, which exports the entire Nextcloud database into a single SQL file named with that timestamp. Once that’s done, it compresses the file to save space. Next it uses rsync to copy all Nextcloud user files across to the NAS. After that, it sweeps through the backup folder and deletes any compressed database files that are older than thirty days, keeping storage tidy. Finally, if the script detects it’s running on a Sunday, it pushes everything up to the S3 cloud bucket for off-site storage.

So what happens when you actually need to restore? There are four steps, and the order matters.

Step one: put Nextcloud into maintenance mode. This locks out users and prevents any data being written while you’re restoring.

Step two: restore the database. You feed your backup SQL file directly into MySQL and it rebuilds the database from that file.

Step three: restore the files. You use rsync to copy everything from the NAS backup location back into the Nextcloud data directory. You also reset file ownership so the web server process can read and write those files correctly.

Step four: bring Nextcloud back online by switching maintenance mode off. If the database schema looks different from what Nextcloud expects, there’s an additional command you can run that converts the file cache to handle larger integers, which is sometimes needed after a schema change.

Recovery procedures must be tested quarterly. That responsibility sits with xc, the admin. Dan, the DBA, manages the backup infrastructure itself.

On the maintenance side, there are four recurring tasks to stay on top of. The first is a monthly database integrity check, which ensures the internal file tracking database is healthy. The second is a weekly trash cleanup that clears out deleted files from the Nextcloud trash and reclaims storage space. Third is updating the dot-htaccess file, which you run as needed to keep web server rules in sync with Nextcloud’s configuration. Fourth is a weekly file scan that checks all user files are correctly indexed so search and file listings stay accurate.

To wrap up: daily database backups at four AM, weekly file backups Sunday nights at two AM, thirty days online retention, one year archived, local NAS plus S3 off-site, a four-hour data loss ceiling, and a one-hour recovery target. Dan owns the infrastructure, xc tests restores every quarter. Keep those maintenance commands running on schedule and you’ll be in good shape.

For more detail, check the related wiki notes on Administration Overview, Logging and Monitoring, and the occ Command Reference.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Audit Logs

Welcome to the NZRT Wiki Podcast. Today we’re looking at Nextcloud Audit Logs.

If you’ve ever needed to know who accessed a file, when a share was created, or whether someone’s been logging in at unusual hours, audit logs are your answer. Nextcloud Audit Logs track all user actions across the platform — file access, edits, shares, permission changes, and logins. For an organisation like NZRT, they’re essential for compliance, security monitoring, and forensic investigations when something goes wrong.

Let’s start with what actually gets logged. There are five main categories of events. First, file operations — that’s any time a file is created, edited, deleted, moved, or copied. Second, sharing events — when a share is created, when permissions on that share change, or when a share link expires. Third, user actions — things like logging in, logging out, changing a password, or setting up two-factor authentication. Fourth, admin actions — creating users, assigning someone to a group, or installing an app. And fifth, security events — failed login attempts, blocked shares, and any unauthorized access attempts. Together, that’s a comprehensive picture of everything happening inside your Nextcloud instance.

Now, how do you actually get to these logs? There are two ways. The first is through the web interface. You go into Settings, then Logging, and you’ll see the last hundred entries right there on screen — no extra tools needed, great for a quick check. The second way is to go directly to the log file on the server. That file lives at a path on the server’s file system, inside the Nextcloud data directory, and it’s called nextcloud.log. If you need to do any serious analysis — searching, filtering, exporting — you’ll want to pull that file directly rather than browsing through the web UI.

Next up is log retention. In Nextcloud’s configuration file, there are two key settings you should know about. The first controls how large the log file can get before it rotates — at NZRT, that’s set to ten megabytes. Once the log hits that size, it starts a fresh file so things don’t spiral out of control. The second setting just tells Nextcloud where to write the log file in the first place, pointing it to that same nextcloud.log location we mentioned. On top of that, logs older than ninety days are archived. That’s not arbitrary — it aligns with GDPR data minimisation principles, meaning you’re keeping what you need for a reasonable period and not holding onto personal data longer than necessary.

Now let’s talk about how NZRT specifically uses compliance monitoring, because different roles have different responsibilities here. There are four roles with distinct monitoring duties. Starting with xc — that’s the administrator — who monitors all actions across the board and gets alerted to things like bulk file deletions or mass sharing events, which could indicate either a mistake or something more serious. Then there’s fin, who focuses on data exports and share activity, with specific alerts for things like exported invoices or new shares being created — important for financial audit trails. Next is han, whose alerts are focused on HR-related activity: access to the HR folder and logins happening outside of office hours, which could signal unauthorized access. Finally, there’s ema, who watches for document changes — specifically anything that looks like an unapproved sync with Dolibarr, NZRT’s ERP system.

So why does all of this matter in the NZRT context specifically? There are three main compliance areas these logs support. First, Dolibarr EDM compliance — that’s electronic document management — where you need a clear record of who touched which documents and when. Second, HR record confidentiality, because personnel files need to be kept private and audit logs give you proof of who accessed them. And third, financial audit trails, so that any time financial data is exported or shared, there’s a record to point to. The person responsible for archiving and analysing logs at NZRT is dan, who holds the DBA role and steps in when there’s a security incident that needs investigation.

Pulling it all together, audit logs aren’t just a nice-to-have. They’re what lets you answer the hard questions after the fact — who did what, when, and from where. Whether it’s a compliance review, a security incident, or just wanting confidence that sensitive data is being handled correctly, Nextcloud Audit Logs give you the visibility you need. If you want to go deeper, the related wiki pages on Users and Groups, Logging and Monitoring, and Permissions and Sharing are worth reading alongside this one.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Encryption

Welcome to the NZRT Wiki Podcast. Today we’re looking at Nextcloud Encryption.

If you’ve ever wondered how your files stay safe when they’re sitting on a server or moving across the internet, encryption is the answer. Nextcloud gives you a couple of different ways to protect your data, and today we’re going to walk through what those options are, how they work, and how NZRT uses them in practice.

Let’s start with the basics. There are three types of encryption you’ll encounter in Nextcloud. The first is server-side encryption. This protects your files while they’re sitting at rest on the disk, so if someone were to physically steal the hardware, they wouldn’t be able to read your files. It’s great for general file storage. The second type is end-to-end encryption, often called E2EE. This one goes further — it means only users who hold the right decryption keys can ever read the content. Even Nextcloud itself cannot see inside those files. This is the one you want for truly sensitive data. The third type is TLS, which is the encryption that protects your data while it’s travelling across the network. This applies to all traffic and guards against anyone trying to intercept data as it moves between your device and the server.

So to summarise those three: server-side protects files at rest from hardware theft, end-to-end protects from a server breach because not even the server can read it, and TLS protects everything in transit from network snooping.

Now let’s talk about how you actually set up end-to-end encryption. There’s a command-line step involved here. What the setup does is first enable the encryption app on the Nextcloud server — that’s done through the admin apps panel using a server command that activates the encryption module. From there, you can configure specific folders to use encrypted sharing, which involves setting a key passphrase for that folder. So you’re not encrypting everything blindly — you choose which folders get the extra protection.

At NZRT, two folders are currently set up with end-to-end encryption. The first is the HR Payroll folder, which is encrypted and accessible only to the Finance agent and the HR agent. The second is the Finance Bank folder, which is encrypted and restricted to the Finance agent alone.

Now here’s an important decision you’ll need to make when setting up encryption: do you use a Master Key or User Keys? With the Master Key approach, there’s a single key that covers all files. It’s simpler to manage and faster to work with, but it’s less secure because there’s one point of failure. With User Keys, every user has their own unique key. This means you get true end-to-end encryption because no single key can unlock everything. The tradeoff is more overhead to manage.

For NZRT, the approach is split depending on what you’re protecting. For the HR and Finance folders — the ones handling payroll, contracts, and bank statements — User Keys are used. That’s the stronger option and the right call for that level of sensitivity. For general documents that don’t carry that same risk, the Master Key approach is used, which keeps things simpler without unnecessary complexity.

One more important point on key management. At NZRT, encryption keys are not stored on the Nextcloud server itself. They’re backed up in a secure vault separately. This matters because if the server were ever compromised, the keys wouldn’t be sitting there alongside the encrypted files. That separation is a deliberate security decision.

To bring it all together: Nextcloud gives you layered encryption options. TLS handles your data in motion. Server-side encryption handles your data at rest. And end-to-end encryption handles your most sensitive data by making it unreadable to everyone except the people who hold the keys. NZRT uses all three layers, with end-to-end encryption and User Keys specifically applied to HR and Finance workflows where the stakes are highest.

If you want to dig deeper, related topics include File Sharing and Links, Users and Groups, and Backups and Maintenance — all covered in the NZRT wiki.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Dolibarr Integration

Welcome to the NZRT Wiki Podcast. Today we’re looking at Nextcloud Dolibarr Integration.

So let’s start with the big picture. Nextcloud and Dolibarr work together through a REST API connection combined with file sync. The goal is to let Dolibarr’s EDM module — that stands for Electronic Document Management — store its documents inside Nextcloud. By doing that, you get all of Nextcloud’s strengths: version history, sharing capabilities, and long-term archival, all feeding into the same documents your ERP system is working with.

Now let’s walk through what actually happens when you create an invoice. The workflow goes like this. First, you create an invoice inside Dolibarr. As soon as that happens, the system automatically saves a PDF copy of that invoice into a specific folder path in Nextcloud — something like Finance, then Invoices, then the year and month, then the invoice filename itself. Dolibarr then records that Nextcloud file path in its own database, so it always knows where the live copy lives. From that point on, you or your colleagues can open, version, or share that invoice directly inside Nextcloud, while Dolibarr keeps pointing to the same file. One document, two systems, no duplication of effort.

Let’s talk about the REST API side of things. There are two key calls that make this work. The first one handles authentication — it sends a request to Nextcloud asking for an access token, passing along a client ID and client secret. Think of it like knocking on the door and showing your credentials before you’re allowed in. The second call actually uploads a file. It uses a PUT request — that’s the web method for placing something at a specific location — and it sends the PDF file to a particular user’s folder path inside Nextcloud. The user and password are passed along with the request so Nextcloud knows who’s doing the uploading. That’s the core of how files move from Dolibarr into Nextcloud programmatically.

Now let’s look at how those files are organised once they’re in Nextcloud. There’s a top-level shared folder, and inside it sits a folder called Dolibarr EDM. Under that, you’ve got three main subfolders. The first is Invoices, which is further broken down by year and month — so April 2026 would have its own subfolder containing individual invoice PDFs like INV-001 and INV-002. The second subfolder is Contracts, which is organised by client — so Client A gets their own folder holding their contract and any amendments. The third subfolder is Purchase Orders, where PO files live in a flat structure by year and reference number. Clean, predictable, and easy to navigate.

Now here’s where the automation really shines — the nightly sync workflow. Every night at two in the morning, a scheduled process kicks off a five-step routine. Step one: it queries the Dolibarr API to find any documents that are new or have been updated since the last run. Step two: it checks Nextcloud to see if any of those documents already exist, so nothing gets duplicated. Step three: any files that are missing from Nextcloud get uploaded. Step four: Dolibarr’s file path references get updated to reflect the current locations. Step five: any documents older than ninety days get moved off to a NAS — a network-attached storage system — for long-term archiving. And at the end of all that, an email report goes out to the Finance role and the EDM role so the right people know what happened overnight. The whole thing runs without anyone needing to touch it.

Finally, a word on how this fits into NZRT specifically. This Nextcloud and Dolibarr connection is described as the backbone of NZRT’s document management. Three roles interact with it most closely. Finance, referred to internally as fin, handles invoices. The EDM role, referred to as ema, manages the document flows. And the Admin role, xc, oversees the whole thing. All three roles collaborate on invoices, contracts, and purchase orders through this single integrated system — so there’s one source of truth rather than files scattered across different tools.

If you want to dig deeper, there are three related wiki pages worth checking out: the Integrations Overview, the REST API and WebDAV guide, and the Document Management Overview. Those will give you more context on the broader architecture this integration sits within.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Ldap Sso

Welcome to the NZRT Wiki Podcast. Today we’re looking at LDAP and SSO.

If you’ve ever wondered how a company manages logins across multiple systems without asking staff to juggle half a dozen different passwords, LDAP and Single Sign-On are the answer. Let’s walk through how NZRT uses these technologies to connect Nextcloud, Dolibarr, and WordPress under one unified identity system.

First, let’s cover what LDAP actually is. LDAP stands for Lightweight Directory Access Protocol. Think of it as a central address book for your organisation. It stores user accounts, passwords, and group memberships in one place. That central store is usually either Active Directory, which is Microsoft’s directory service, or OpenLDAP, which is the open-source equivalent. When Nextcloud is connected to LDAP, it doesn’t manage its own user accounts — it asks the directory instead.

So how do you get that connection set up? The first step is enabling the LDAP app inside Nextcloud. There’s a command you run on the server to activate it, and once that’s done you head into the Settings area and look for the LDAP or Active Directory section. From there you configure a handful of key details. You tell Nextcloud the address of your LDAP server — in NZRT’s case that’s an internal address on the local network. You give it what’s called a Base Distinguished Name, which is the root of your directory tree, essentially your organisation’s domain broken into components. You also provide a Bind account — a dedicated service account Nextcloud uses to authenticate with the directory — and then you point it at where your users and groups live within that directory structure.

Now let’s talk about SSO, or Single Sign-On. This is what makes the experience seamless for your users. Once LDAP is connected, a user logs in once and that credential works across all integrated systems. For more advanced setups — say you’re connecting multiple identity providers or need enterprise-grade federation — there’s also a SAML option. SAML is a standard for exchanging authentication data between systems. Enabling that app and pointing it at your SAML metadata in the Security settings gets you there, but for most NZRT scenarios the core LDAP integration handles the heavy lifting.

One thing worth understanding is how groups flow across the integration. In your LDAP directory, groups have names like admin, sales, finance, and HR. When those groups sync into Nextcloud, they map directly to matching Nextcloud groups with the same names. Your admin group in Active Directory becomes the admin group in Nextcloud. Your finance team in Active Directory becomes the finance group in Nextcloud, and so on for sales and HR. You don’t have to manually rebuild your organisational structure inside each application — it comes across automatically.

Now let’s look at why this actually matters in practice. There are four key benefits. The first is a single password. When a user changes their LDAP or Active Directory password, that change flows through everywhere. They don’t need to update it separately in Nextcloud, Dolibarr, or WordPress. The second benefit is automated provisioning. When IT creates a new Active Directory account for a new hire, Nextcloud automatically picks that up and creates the corresponding user account — no manual steps needed. Third is deprovisioning. If someone leaves the organisation and IT disables their Active Directory account, their Nextcloud access is removed at the same time. You’re not relying on someone remembering to go into three different systems and disable the account manually. And fourth is group sync, which we already covered — your organisational structure stays consistent across every platform without extra effort.

For NZRT specifically, this integration spans Nextcloud, Dolibarr, and WordPress. The practical workflow is simple. When someone joins the team, IT creates one Active Directory account. From that single action, LDAP automatically syncs the user across all three systems. When they leave, one account gets disabled and access is revoked everywhere. That’s the power of centralised identity management — less administration overhead, fewer security gaps, and a much better experience for your users.

If you want to explore related topics, this wiki page connects to the Users and Groups documentation, the Two Factor Authentication guide, and the Dolibarr Integration notes.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Permissions Sharing

Welcome to the NZRT Wiki Podcast. Today we’re looking at Nextcloud Permissions & Sharing.

If you’ve ever wondered how NZRT controls who can see what inside Nextcloud, this episode walks you through exactly that. Permissions in Nextcloud are what keep sensitive documents safe, making sure that the Finance team’s payroll data isn’t visible to Sales, and that HR records stay strictly internal. That separation is achieved through a system of folder-level access controls, which we call ACLs, or access control lists.

Let’s start with the four permission levels you’ll encounter. The first is Read. When you have Read access, you can view a file but you can’t change it, delete it, or share it with anyone else. This is the right level for things like archives or finalised documents you just need to reference. The second level is Edit. Edit access adds the ability to make changes to files on top of viewing them, which makes it the go-to level for anything that involves collaborative work. Third is Create, which lets you add new draft documents to a folder. And finally, there’s Manage. Manage is the highest level — it combines viewing, editing, deleting, and sharing all in one, and it’s typically held by whoever owns the folder or the team responsible for it.

Now let’s talk about how those permission levels are actually applied across NZRT’s folder structure. There are five key folders to know about, and each one has its own owner, read access list, edit access, and manage rights.

The Finance folder is owned by fin, which is the Finance agent. Both fin and xc can read it. Only fin can edit it. And xc holds Manage rights, meaning xc can audit and control access at the top level. The HR folder works similarly — it’s owned by han, the HR agent, with han and xc having read access, han holding edit rights, and xc managing it overall.

Sales is owned by cas, the CAS agent. Both cas and pam can read it, cas can edit, and again xc manages. The Shared Templates folder, owned by ema, is the most open of the bunch — all users can read from it, ema can edit it, and xc manages it. Finally, the Dolibarr EDM folder is also owned by ema, with read access limited to ema and xc, edit belonging to ema, and xc in the Manage seat.

So the pattern you’ll notice is that xc, the admin account, holds Manage rights across the board. This is deliberate — it gives xc the ability to audit access logs and adjust permissions without getting in the way of day-to-day work by individual teams.

Now, how do you actually set these permissions? There are two ways. The first is through the Nextcloud graphical interface. You right-click on a folder, go to Sharing, and then open Advanced settings. That’s the quickest route for one-off changes. The second way is through the command line, using Nextcloud’s built-in tool called occ. With occ you can do things like transfer ownership of a folder from one user to another. You can also add a group to a folder and assign it a specific numeric permission code. For example, adding the Finance group to the Sales folder with read and write access combined uses the number thirty-one, because permissions in Nextcloud are represented as numbers that add up depending on what you want to allow. You don’t need to memorise those numbers day-to-day, but it’s good to know that the CLI method is there when you need to make bulk or scripted changes.

The third area covered in this wiki page is public sharing — the ability to generate a link you can send to someone outside NZRT. Public sharing is selectively enabled across folders. Sales links and Finance vendor portal links can be shared publicly, because those involve external clients and partners. But HR is internal only, so no public links there, and Finance invoices are restricted to named user shares rather than open links.

When public sharing is enabled, two policies apply. Every external share must have a password — no exceptions. And every share has an expiry date, set somewhere between seven and thirty days depending on the document type. This limits the window of exposure if a link ends up in the wrong hands.

To pull everything together: permissions in Nextcloud exist to create data isolation. Finance can’t browse HR payroll. Sales can’t see Procurement cost data. The ema role is responsible for managing folder hierarchies and the EDM structure, while xc retains oversight through Manage rights and access log auditing. If you need to go deeper, the related topics to check out are Users and Groups, File Sharing and Links, and Audit Logs.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Two Factor Auth

Welcome to the NZRT Wiki Podcast. Today we’re looking at Two Factor Auth.

So, what is two-factor authentication, and why does it matter for NZRT? At its core, two-factor auth, or 2FA, means that when you log in to Nextcloud, you don’t just enter your password and walk straight in. You also need to prove your identity a second way. That second step is what makes it so much harder for someone to get into an account even if they’ve somehow got hold of your password.

NZRT supports a few different ways to do that second step, so let’s run through them. There are three methods available.

The first is TOTP, which stands for Time-based One-Time Password. You set it up by scanning a QR code, and from that point on you use an app on your phone like Google Authenticator or Authy to generate a six-digit code whenever you log in. This is the recommended method for most NZRT users.

The second method is Backup Codes. When you set up 2FA, Nextcloud generates ten single-use codes for you. These are for the situation where you’ve lost your phone or can’t access your authenticator app. Generating and securely storing these backup codes is mandatory for everyone using 2FA, not optional.

The third method is FIDO2, which uses a physical USB security key. You plug it in and touch it to authenticate. This one is optional and at NZRT it’s currently only in use by the xc account.

Now, how does NZRT actually enforce 2FA for people who need it? Through the Nextcloud admin settings, under the Security section, an administrator can turn on enforcement for specific groups. At NZRT that means the admin group, the finance group, and the HR group. When enforcement is switched on, anyone in those groups sees a prompt to set up 2FA the next time they log in. There’s also a grace period of seven days, which gives users a window to get it configured before they’re locked out of their workflow.

Let’s walk through what the TOTP setup actually looks like from a user’s perspective. First, you head into your Account Settings and enable 2FA. Nextcloud then shows you a QR code. You open Google Authenticator or Authy on your phone and scan that code. The app will immediately start showing you a six-digit number that changes every thirty seconds. You type that number into Nextcloud to confirm the link worked. Then, crucially, you save your backup codes somewhere safe, a password manager or a secure printed copy somewhere offline. From that point on, every time you log in you’ll enter your password as usual, and then you’ll be asked for the current six-digit code from your app.

So who at NZRT actually needs to do this? The policy splits into three tiers. Two-factor auth is mandatory for three accounts: xc, which is the admin account; fin, the finance role; and han, the HR role. It’s strongly recommended for two more: ema, who handles email and digital marketing, and dan, the database administrator. For everyone else in the organisation, 2FA is optional but still a good idea.

Why are finance and HR singled out as mandatory rather than just recommended? Because those roles handle sensitive personal and financial data. Data protection regulations require that access to that kind of information is properly secured, and relying on a password alone doesn’t meet that bar. If a credential gets compromised, whether through a phishing email, a reused password, or a data breach somewhere else, 2FA is the thing that stops an attacker from just walking in. The second factor, the code on your phone or the key you have to physically touch, is something an attacker very rarely has even when they have your password.

The broader point here is that 2FA isn’t about distrust of users. It’s about recognising that passwords alone are no longer a reliable defence. Credential compromise is one of the most common causes of account breaches, and adding that second step dramatically reduces the risk for the accounts that matter most.

If you’re in one of the mandatory groups and you haven’t set this up yet, now is the time. Head into your Nextcloud account settings, find the security section, and follow the TOTP setup steps. Make sure you save those backup codes. And if you have any questions, check the related notes in the wiki covering Users and Groups, Permissions and Sharing, and the Administration Overview.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Community Plugins

Welcome to the NZRT Wiki Podcast. Today we’re looking at Community Plugins.

If you’ve been using Obsidian for a while, you’ve probably noticed that the core app is intentionally minimal. That’s by design. The real power comes from community plugins, and that’s exactly what we’re covering today.

Community plugins extend Obsidian beyond its built-in functionality. You install them directly from inside the app, through Settings, then Community plugins, then Browse. Before you can do that though, you need to turn off something called Restricted mode. Once that’s off, you can search for any plugin, hit Install, and then Enable. That’s the standard flow and it takes about thirty seconds.

If you ever need to install a plugin manually — maybe you’re working offline or testing a custom build — you can do it by copying the plugin folder directly into the dot-obsidian plugins directory inside your vault. The folder needs to contain at least two files: one called main dot js, which is the actual plugin code, and one called manifest dot json, which tells Obsidian what the plugin is. There’s also an optional styles dot css file if the plugin has its own visual styling.

One thing worth flagging before we go further: community plugins run real code on your machine. That’s what makes them powerful, but it also means you should only install plugins from sources you trust. It’s good practice to glance at the plugin’s GitHub repository before installing — just to get a sense of who made it and how actively it’s maintained.

Now let’s talk about the plugins themselves. The wiki lists nine plugins considered essential for a well-run vault.

First is Dataview. This one lets you treat your vault like a database. You can write queries that pull information from your notes and display it as dynamic tables, lists, or calendars, all driven by the frontmatter fields in your notes. The key thing about Dataview results is that they’re live — they update automatically as your vault content changes.

Next is Templater. Think of this as a much more powerful version of Obsidian’s built-in templates. It supports JavaScript scripting, date functions, and the ability to pull in file metadata. So you can do things like automatically stamp a note with today’s date or insert the folder name as a tag when you create a new file.

Then there’s Calendar, which adds a monthly calendar widget to your sidebar so you can navigate your daily notes visually by clicking on dates.

Obsidian Git is a huge one for anyone who wants version control. It automatically commits and pushes your vault to a Git repository on a schedule you define. Great for backup and for teams.

Excalidraw brings full drawing and diagramming capabilities right inside Obsidian — no need to switch to a separate tool.

Kanban lets you create kanban boards inside ordinary markdown files, which is a neat trick if you’re managing projects in your vault.

Tasks is your task management layer — it adds support for due dates, recurring tasks, and queries that let you pull task lists from across your entire vault into one view.

QuickAdd is designed for speed. It lets you capture quick entries, run macros, or append content to specific notes without breaking your flow.

And finally there’s Linter, which auto-formats your notes every time you save. It keeps your frontmatter consistent, cleans up spacing, and enforces a consistent markdown style across the vault.

Let’s talk about those code examples in the wiki. The first one is a Dataview query. In plain terms, it’s asking Obsidian to build a table showing two pieces of information — a status field and a date — for every note inside the Wiki folder that has been tagged as a reference type. The results come back sorted from newest to oldest. You’d drop this query into any note and Dataview renders the table for you automatically.

The second Dataview example is simpler. It produces a list of all notes tagged with the word project where the status is currently set to active. Again, this updates live as things change.

The Templater example shows what a template file might look like when you create a new note. It automatically fills in the creation date in a year-month-day format, tags the note with the name of the folder it lives in, and uses the file’s title as the main heading. All of that happens the moment you apply the template — no manual typing required.

When it comes to keeping your plugins up to date, you go back to Settings, then Community plugins, and your installed plugins are listed there with Update and Uninstall options. If you want Obsidian to check for updates automatically every time it starts, there’s a toggle for that called Check for updates on startup.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

WordPress Integration

Welcome to the NZRT Wiki Podcast. Today we’re looking at Nextcloud WordPress Integration.

If you work with NZRT’s content or user management systems, this episode is going to give you a clear picture of how Nextcloud and WordPress talk to each other — and why that connection matters for your day-to-day work.

Let’s start with the big picture. Nextcloud and WordPress are integrated across three main areas: user authentication, media asset storage, and collaborative content editing. Nextcloud acts as the media library backend for WordPress, meaning it’s the central place where files live, and WordPress pulls from it rather than managing everything on its own.

Let’s talk about user sync first. NZRT uses something called LDAP and single sign-on, or SSO, to connect accounts between the two systems. What that means for you practically is this: when a new Nextcloud user is created, a corresponding WordPress user gets created automatically. And you only need one password for both platforms. You log in once and you’re covered across both systems — no separate credentials to manage.

Now let’s look at media management. WordPress media assets — things like images, photos, and press release files — are stored in Nextcloud rather than sitting inside WordPress itself. This happens through the REST API, which is essentially a way for the two systems to communicate and pass data back and forth. The specific folder in Nextcloud that handles this is called WordPress Media, and it’s shared with the content team. Featured images and uploads get automatically backed up there too, so you have version control and an archive without any extra effort on your part.

To give you a sense of how the technical side is configured, there is a setup that points the WordPress LDAP plugin to an internal server address, specifies a base directory location for user accounts, and sets a user path within that directory. On the Nextcloud side, there is an API endpoint pointing to the WordPress Media folder, using a combination of a username and a token to verify access. You do not need to memorise any of that, but it is worth knowing these two systems are talking to each other constantly in the background.

Now let’s walk through the actual content workflow, because this is what you will interact with most. An editor logs into WordPress using their normal single sign-on credentials. From there, an author writes a blog post inside WordPress. But here is where Nextcloud steps in: draft documents live in a Nextcloud folder called WordPress Drafts, and the team can edit those directly using Nextcloud Office, the built-in collaborative editing tool. Once a post is ready to publish, the featured image auto-syncs from the Nextcloud media folder into WordPress. And when the post goes live, a version is saved into a Nextcloud archive folder for long-term storage.

So you can think of it as a two-track system. WordPress is your publishing front-end — it is where the post goes live and where readers see it. Nextcloud is your back-end storage and collaboration layer — it is where files live, where the team edits together, and where everything gets archived.

Speaking of folders, here is how the Nextcloud WordPress directory is structured. At the top level there is a folder called WordPress. Inside that you have a Media folder, which contains three subfolders — one for Blog images, one for Press Releases, and one for Photos. Then there is a Drafts folder, where you would find documents like a named blog post file for a specific month. And finally there is a Published Archive folder, where completed posts are stored for reference.

The key people working within this integration at NZRT are pam and ema — the content team — who use Nextcloud Office to collaborate on blog posts before they go live. By keeping media assets in Nextcloud rather than relying on WordPress alone, the team gets version control, easy sharing, and a reliable archive all in one place.

If you want to dig deeper, there are a few related topics worth exploring. There is an Integrations Overview document that gives you the wider picture of how NZRT’s systems connect. There is also a dedicated page on LDAP and SSO if you want to understand the authentication side in more detail. And Nextcloud Office is worth a look if you are going to be collaborating on drafts.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Vaults

Welcome to the NZRT Wiki Podcast. Today we’re looking at Vaults.

So, what exactly is a vault? Put simply, a vault is a folder on your disk. When you point Obsidian at that folder, it reads every markdown file inside it and builds a knowledge graph from the links between those files. That’s really the core idea — a vault is just a folder, and Obsidian does the rest.

Let’s talk about what you’ll find inside a typical vault. If you were to open one up in your file explorer, you’d see a top-level folder — let’s call it MyVault. Inside that, there’s a hidden folder called dot-obsidian, and that’s where Obsidian stores all its settings for that vault: things like your plugins, your themes, and your keyboard shortcuts. Everything else in the vault is your actual content — plain markdown files and any attachments you’ve added. So you might have a Notes folder, a Projects folder, a Templates folder — whatever structure works for you. Your content and your Obsidian settings live side by side, but they’re cleanly separated.

Now, one thing that trips people up at first is the idea of multiple vaults. Obsidian fully supports having more than one vault, and each one is completely independent. That means each vault has its own set of settings — its own plugins, its own theme, its own keyboard shortcuts. Each vault also has its own graph, which is important: links between notes only resolve within the same vault. If you’ve got a note in one vault that you try to link to from another vault, Obsidian won’t connect them. Each vault also maintains its own recent files list, its own search index, and its own plugin state. So if you’ve got a plugin configured a certain way in one vault, that configuration doesn’t carry across to another. To switch between vaults, you can go to File, then Open Another Vault, or use the vault switcher shortcut.

Speaking of opening vaults, there are three main ways to do it. First, you can open an existing folder — just go to File, Open Vault, then choose Open Folder as Vault, and point it at any folder on your machine. Second, you can create a brand new vault from scratch using the Create New Vault option in that same menu. And third, the vault switcher shows you all the vaults you’ve previously opened, so you can jump back to any of them quickly.

Now let’s dig into that dot-obsidian folder a bit more, because it’s worth understanding what lives in there. There are several key files and subfolders to know about. First is a file called app dot json — that holds your core settings, like editor preferences, appearance options, and how Obsidian handles files and links. Then there’s a plugins subfolder, which is where your installed community plugins live. There’s a themes subfolder for your installed themes. There’s a file called hotkeys dot json, which stores any custom keyboard shortcuts you’ve set up. If you’re using the Templates core plugin, you’ll also see a templates subfolder in there. And finally there’s workspace dot json, which saves your current layout — which panes are open, which tabs you have active, and the state of your sidebars.

Here’s a practical tip around syncing. If you sync your vault across devices — say between your desktop and your laptop — you’ll want to include the dot-obsidian folder in your sync setup. That way your settings, plugins, and themes follow you to every device. However, there’s one exception worth knowing: workspace dot json. If you don’t want your pane layout to sync — maybe you prefer a different arrangement on each machine — you can exclude that file from your sync. Small detail, but handy to know.

Finally, let’s talk about performance. The good news is that Obsidian handles large vaults very well — we’re talking tens of thousands of notes without breaking a sweat. But there are a few things that can slow it down. Very large individual files, anything over about one megabyte, can cause performance issues. Having too many community plugins installed is another common culprit. And if you’re using Dataview — a popular plugin for querying your notes like a database — running heavy queries across a massive vault without caching enabled can put a real strain on things. So if you notice Obsidian getting sluggish, those are the three areas to look at first: individual file size, plugin count, and how efficiently your Dataview queries are running.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Dolibarr Rest Api Setup

Welcome to the NZRT Wiki Podcast. Today we’re looking at 🔌 Dolibarr REST API Setup.

So let’s talk about how you actually talk to Dolibarr programmatically. Dolibarr ships with a built-in REST API, and that’s the primary way AI agents at NZRT reach into the ERP to read and write data. There’s no WordPress middleman here, no sync scripts running on a schedule — agents call the API directly, on demand, using their own credentials.

First, let’s orient you to where the API lives. The base URL follows a predictable pattern: you start with your Dolibarr server’s domain, then the path goes through the API index file, followed by a version segment. In NZRT’s case the live server is at erp.nzrtnetwork.com, but the pattern is the same wherever you host Dolibarr — domain, then api/index.php, then the version.

Now, what can you actually reach through this API? There’s a solid set of core endpoints. You can list all customers, or pull a single customer by their ID. Same story for invoices — list them all, or drill into one specific invoice. Products work the same way. You can also list HR employees and pull supplier records. So whether you’re building a finance agent that needs to check unpaid invoices, or a customer-facing agent that needs to look up account details, the API has you covered with a clean, predictable URL structure where you swap in the resource name and optionally add an ID.

Authentication is straightforward. Every request needs an API key passed in as a request header. The header name is DOLAPIKEY — spelled out in capitals — and the value is the key itself. So if you imagine a simple HTTP request to fetch customers, you’d attach that header, point the request at the customers endpoint, and Dolibarr handles the rest. You never send a username and password on each call — just that single API key header every time.

Now, where do those API keys live? You need to generate them from the Dolibarr admin panel, and you’ll store a few pieces of information: the endpoint URL itself, the API key, and optionally the username of the Dolibarr user the key belongs to.

Here’s how NZRT specifically handles this, and it’s worth paying attention to because it differs from a generic Dolibarr setup. Credentials are per-agent. Each AI agent in the NZRT stack — so that’s agents like cas, fin, han, and the others — holds its own individual API key. Those keys are scoped to match the module permissions that agent actually needs. A finance agent gets access to invoice and payment endpoints. A customer-facing agent gets access to customer records. They don’t all share one admin-level key. This keeps permissions tight and makes it easy to revoke or rotate a single agent’s access without touching the others.

All those per-agent credentials are stored in Nextcloud, under the Shared CREDS folder. If you’re setting up a new agent or rotating a key, that’s where you go to find and update the relevant credential file.

One more thing worth flagging: agents call the API on demand, in response to tasks or queries. There’s no background WordPress sync happening, no webhooks firing on a timer. When an agent needs data, it makes the call. When it doesn’t, nothing moves. That keeps the integration simple, auditable, and easy to debug — if something went wrong, you check the agent’s API call, not a background job running somewhere in WordPress.

If you want to go deeper, the related topics to look at are the WP-Dolibarr Integration Overview, the WP-Script Core documentation, and the WordPress Pages Map — those will give you the bigger picture of how Dolibarr connects to the rest of the NZRT stack.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Backup Strategy

Welcome to the NZRT Wiki Podcast. Today we’re looking at Backup Strategy.

So, NZRT runs regular backups of its WordPress site covering both the database and the actual files. The goal is straightforward: if something goes wrong, whether that’s data loss, a hack, or corruption, you want to be able to recover quickly and confidently.

Let’s start with what gets backed up and how often. There are four main components. First, the database, which is backed up every single day and kept for thirty days. Second, the WordPress files, also daily with thirty days of retention. Third, the uploads folder, again daily, thirty days. And fourth, plugins and themes, which are backed up weekly and kept for twelve weeks. The daily items use tools called mysqldump, rsync, and tar, while the weekly plugin and theme backups use git or zip archives.

All of these backups land in a directory called Back-ups. Inside that folder you’ll find database dump files, compressed WordPress file archives, incremental backups, and restore scripts, so everything you need to recover is kept together in one place.

Now let’s talk about how the backups are actually made. For the database, the process runs a command that connects to the WordPress database as the root user and exports everything into a single file. The filename automatically includes today’s date, so you always know exactly when each backup was taken.

For the files, the process creates a compressed archive of the entire WordPress directory. Again, the filename gets today’s date stamped into it automatically.

On the production server specifically, there are a couple of key backup locations. WordPress archives live in a dedicated wordpress-backups folder on the server, and these are primarily managed by a tool called JetBackup, which runs automatically and is handled by the hosting provider. You can also trigger on-demand backups through cPanel’s Backup Wizard if you need one right now. If you want to browse or download these production archives from Windows, you can open a special WebDAV network path in Windows Explorer that connects directly to that wordpress-backups folder over a secure connection.

One important security point here: that wordpress-backups folder must never be publicly accessible from the internet. You can verify this by sending a request to the URL of that folder. If everything is configured correctly, the server should respond with a four-oh-three Forbidden status. If you get anything else back, that’s a problem that needs to be addressed immediately, because publicly accessible backups could expose sensitive data.

Now, what about restoring from a backup? If you need to restore the database, you run a command that reads a specific backup file and imports it directly into the WordPress database. You reference the backup by its date in the filename, so for example you’d point it at the file from the twelfth of April twenty twenty-six. For restoring the files, you extract the compressed archive back to the root of the server. Again, you reference the dated backup file you want to restore from.

Finally, in terms of who owns all of this at NZRT, that’s dan, the DBA. Dan is responsible for backup and recovery, so if you have questions or need to initiate a restore, that’s your first point of contact.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

License Keys

Script below.

Welcome to the NZRT Wiki Podcast. Today we’re looking at License Keys.

If you’ve ever managed a WordPress site or a suite of web tools, you know that keeping track of license keys can quietly become a headache. NZRT has a simple but important system for handling this, and today we’re going to walk through exactly how it works.

First things first. NZRT stores license keys for premium plugins and software in a secure, dedicated location. Specifically, you’ll find all the current keys documented in a file called WP-Script license key dot m-d, which lives inside a folder called Text. Think of this as your single source of truth for any licensed software NZRT uses. Rather than hunting through emails or plugin dashboards, you go to that one file and you’ve got what you need.

Now, let’s talk about what software is actually covered. There are four categories in the licensed software list, and here’s how they break down.

First up is SmartSlider3 Pro. This is a commercial license, renewed annually. You’ll find the key stored in that Text file we just mentioned.

Second is WP-Script Core. This one runs on a custom license arrangement rather than a standard commercial model, so renewal terms are handled on a case-by-case basis. The key is stored in the same place as the others.

Third is the RetroTube Theme. Like SmartSlider3, this is a commercial license with annual renewal, and the key lives in that same file.

And fourth, there’s a catch-all category for other plugins. These tend to be either GPL-licensed or premium, and rather than centralising their keys in the Text file, you’ll typically find them inside the individual plugin folders themselves. Renewal schedules vary across this group, so it’s worth checking each one on its own terms.

So that’s the software landscape. Four categories, one main key file covering the big three, and plugin folders for the rest.

Now let’s talk about how NZRT actually manages these licenses day to day. There are four core practices worth knowing about.

The first is secure storage. Keys are kept either encrypted or behind access controls. You don’t want license keys sitting in plain text somewhere public-facing, so the system is set up to keep them protected.

The second is tracking renewal dates. Annual licenses especially need to stay on your radar. If SmartSlider3 or RetroTube lapses, you lose access to premium features and potentially to updates as well, so keeping an eye on those renewal windows matters.

Third, when a license does expire, the process is straightforward. You update the key. That sounds obvious, but having a clear record of where all your keys are stored makes that update quick and painless rather than a scramble through old inboxes.

And fourth, verifying license validity. This is about confirming that the keys you have on file are actually active and working, not just that they exist somewhere. A key sitting in a text file doesn’t help you much if it was quietly deactivated at the provider’s end.

From an organisational standpoint, license key management at NZRT sits with the admin, which is the xc role. So if you’re working on the site and you need access to a key, xc is your point of contact. The currently active keys are what power premium features like SmartSlider3 and WP-Script, so keeping them in good order is genuinely important to how the site functions.

If you want to explore related topics, this wiki area connects to three other notes. The Security Overview gives you broader context around how NZRT handles sensitive information. The Plugins Overview covers the full plugin ecosystem, which is useful if you’re trying to understand which plugins are GPL versus premium. And there’s a dedicated SmartSlider3 Pro note if you want to go deeper on that specific tool.

To pull it all together: NZRT keeps its license keys in a single secure file for the main licensed software, covering SmartSlider3 Pro, WP-Script Core, and the RetroTube Theme. Other plugin keys live in their respective plugin folders. Good management comes down to four things: storing keys securely, tracking renewal dates, updating keys when they expire, and verifying they’re still valid. And all of that is administered by xc.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Nzrt Dolibarr Bridge WordPress Plugin

Welcome to the NZRT Wiki Podcast. Today we’re looking at NZRT Dolibarr Bridge (WordPress Plugin).

So, what is this plugin? At its core, the NZRT Dolibarr Bridge is a WordPress plugin that connects your WordPress site to your Dolibarr ERP system. When someone fills out an intake form on your site, the plugin automatically creates a thirdparty record in Dolibarr via the REST API. It’s the bridge between your public-facing website and your back-office system, and it lives in the 000WOR repository under the filename nzrt-dolibarr-bridge.php.

Let’s talk about getting it deployed. The process is straightforward. You head into your WordPress Admin panel, go to Plugins, then Add New, and choose the Upload Plugin option. You upload that single PHP file, install it, and activate it. Once it’s active, you’ll find a new settings page under Settings, called Dolibarr Bridge. There are four things to configure there. First, the Dolibarr API URL, which points to the ERP system’s REST API endpoint. Second, your API Key — this is the agent DOLAPIKEY from the credentials file, so make sure you grab it from there rather than hardcoding anything. Third, there’s an optional toggle to enable Product Sync if you need it. And fourth, a Product Reference Prefix field where you can set something like NCS dash or ICS dash depending on which business unit the form is for. That’s all the setup.

Now, once the plugin is configured, how do you actually put a form on a page? This is where a shortcode comes in. A shortcode is a small tag you drop into the body of any WordPress page, and WordPress replaces it with the actual rendered content. In this case, the shortcode is the text nzrt underscore intake underscore form, wrapped in square brackets. You paste that into any page editor, publish the page, and visitors will see the intake form rendered there automatically. No additional coding required on the front end.

Let’s look at what happens when someone actually fills out and submits that form. The form is AJAX-powered, meaning the page doesn’t reload when the user hits submit. Instead, it sends the data quietly in the background to WordPress’s standard AJAX handler. The submission is nonce-protected, which is a WordPress security mechanism that verifies the request is legitimate and coming from the right place. Once WordPress receives it, the PHP handler kicks in and packages up the form data as JSON, then sends a POST request directly to Dolibarr’s thirdparties endpoint, including the API key in the request header.

It’s worth knowing exactly how the form fields map across to Dolibarr. There are five fields involved. The Name field maps to the name field in Dolibarr. Email maps to email. Phone maps to phone. If the user provides a Company name, that also maps to the name field and actually overrides whatever was in the Name field, so the company name takes priority. Finally, the Message field the user types gets stored in Dolibarr as a private note, tucked into the array options for that thirdparty record.

When the whole process succeeds, Dolibarr sends back a confirmation, and the user sees a thank-you message right there on the page without ever leaving it. Clean and seamless from their perspective.

One thing to keep in mind — this plugin handles the intake side only. What happens next inside Dolibarr, such as webhook triggers or follow-up automation after the thirdparty record is created, is covered separately in the WordPress Integration documentation under the Bridge Plugin and Webhook Trigger section. So if you’re troubleshooting or extending the workflow beyond the form submission itself, that’s where to look.

For staff handling NCS intake specifically, there’s a Standard Operating Procedure document called SOP-NCS-001 that walks through the full NCS intake flow in detail. If you’re onboarding someone or need a step-by-step procedural reference, that’s your document.

To summarise what you’ve learned today: the NZRT Dolibarr Bridge is a single-file WordPress plugin that wires your intake forms directly to Dolibarr’s REST API. You deploy it via the WordPress plugin uploader, configure four settings, drop a shortcode onto any page, and from that point on, every form submission automatically creates a thirdparty record in your ERP. Five fields come across — name, email, phone, company, and message — and it’s all secured with nonce validation and API key authentication on the Dolibarr side.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Security Overview

Welcome to the NZRT Wiki Podcast. Today we’re looking at Security Overview.

The NZRT WordPress site has a clear security focus — protecting user data, preventing unauthorised access, and keeping plugins and themes in good shape. The way this is structured, there are five distinct layers of security, and understanding each one helps you see how the whole system fits together.

Let’s start with Layer 1, which is Network security. All admin operations go through a VPN — specifically Tailscale — so you’re not exposing admin traffic to the open internet. The WordPress REST API is HTTPS only, meaning any plain HTTP requests get rejected at the server level. Production server access happens over a secure WebDAV connection.

Moving to Layer 2, Authentication. Each agent on the system has their own unique WordPress Application Password. There are no shared admin credentials — that’s an important point. If one password is compromised, it doesn’t take down the whole system. The main xc admin account also uses two-factor authentication, so you’d use an authenticator app like Google Authenticator or Authy when logging in. All application passwords should be rotated every quarter.

Layer 3 is Authorisation — basically, who can do what once they’re in. The xc account is the only Administrator, meaning it’s the only account with access to plugins, themes, and site-level configuration. The agents pam, cas, sun, ema, and dai are set to the Editor role, which means they work with content only. fin and han are Contributors — they can submit content for review but cannot publish directly. And dan has no WordPress login at all, just database access through the Tailscale VPN.

Layer 4 is Audit Logging, handled by a plugin called WP Activity Log. You can find it on wordpress.org and install it through the WordPress dashboard under Plugins, then Add New. What it does is track logins, post edits, plugin installs, settings changes, and user creation — all per agent. Logs are kept for a minimum of 90 days, and you can view them in the WordPress admin under WP Activity Log, then Audit Log.

Layer 5 covers Plugin and Infrastructure Security. The key habits here are updating plugins weekly through the WordPress dashboard, and only installing plugins from wordpress.org or a trusted vendor — always verify the origin before you install anything. On the infrastructure side, there’s a Web Application Firewall called ModSecurity available in cPanel, and it should be enabled if your hosting environment supports it. SSL certificate renewal is handled through cPanel’s AutoSSL feature, and you should verify it’s active.

Now let’s look at the Access Control Matrix. This is a table in the wiki that maps out four resources, who can access them, and how. The WordPress admin panel is xc only, via HTTPS with two-factor authentication. The REST API, used by agents, is accessed per agent using HTTPS plus an Application Password. The database through phpMyAdmin is dan only, via Tailscale and cPanel credentials. And cPanel itself is xc only, through Tailscale with a time-based one-time password for two-factor authentication.

If you’re setting this up fresh, there’s a priority order of five immediate actions to work through. First, enable two-factor authentication on the xc WordPress account. Second, create per-agent Application Passwords and revoke any shared admin credentials that might already exist. Third, install the WP Activity Log plugin. Fourth, verify that AutoSSL is active in cPanel. And fifth, go into WordPress Settings, then General, and confirm the Site Address is set to HTTPS.

On Plugin Security more broadly — beyond keeping things updated weekly, you should remove any plugins you’re not actively using, because every unused plugin is extra attack surface. The two plugins flagged as priority updates are WP-Script Core and SmartSlider3 Pro, the latter because it has a REST API surface that’s worth keeping patched.

If you want to go deeper, the wiki links this topic to three related notes: Backup Strategy, Updates and Maintenance, and the Virtual Agents System, which has the full role table for all agents.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Smartslider3 Pro

Welcome to the NZRT Wiki Podcast. Today we’re looking at SmartSlider3 Pro.

SmartSlider3 Pro is a premium slider plugin for WordPress, and at NZRT it’s one of the tools we rely on for building polished, professional-looking pages. If you’ve ever visited the NZRT site and seen a smooth scrolling hero banner or a showcase of services rotating on screen, chances are SmartSlider3 Pro is doing that work behind the scenes.

So what exactly does it do? At its core, SmartSlider3 Pro lets you build responsive sliders, carousels, and grid galleries. Responsive means it automatically adjusts to whatever screen size your visitor is using — desktop, tablet, phone — the slider scales and reflows to fit. That’s a big deal for a modern site where you can’t predict what device someone’s coming from.

In terms of layout options, you’ve got three main modes to work with. You can build a traditional full-width slider, where one slide fills the screen at a time. You can do a carousel, which shows multiple items side by side and scrolls horizontally. Or you can go with a grid gallery, which lays your content out in a more structured, photo-gallery style. Each mode suits different purposes — heroes, module showcases, product images.

The animations are worth mentioning too. SmartSlider supports slide transitions, fade transitions, and even 3D transitions. So if you want your hero banner to feel a bit more dynamic, you have options beyond just a basic wipe from left to right.

One of the more powerful features is the layer system. This is what lets you stack content on top of your slides — things like text headings, images, and call-to-action buttons. You’re not just stuck with a background image. You can build a full visual composition on each slide with multiple layered elements. And all of this is done through the Smart Slider Editor, which is a drag-and-drop interface, so you don’t need to write code to build something that looks great.

SmartSlider3 Pro also supports video. You can embed YouTube videos directly, or use your own video files in common web video formats. That opens up a lot of creative options for video-first content.

Now let’s talk about how NZRT specifically uses SmartSlider3 Pro. We maintain a set of ready-to-use templates stored in a folder called SmartSlider. Inside that folder there are three template files. The first is for ICS, that’s the Internet Consulting Services business unit. The second is for Iteasel, the portable wooden display easel product line. The third covers Customer Sales Management. Each of those files is a self-contained SmartSlider export. When you import one, you get the full template including the module’s branding colors, the standard layouts and animations we’ve settled on, pre-configured call-to-action buttons that link through to the relevant module pages, and the correct logo and footer placement.

This means if you’re setting up a new page for one of those modules, you don’t start from scratch. You import the right template file and build from there.

To actually place a slider on a page, you use a shortcode. In practice, this is a short tag you drop into a WordPress page or post. It references the slider by its ID number — so if your slider has been assigned a particular ID inside the SmartSlider system, you’d paste the corresponding shortcode into your page content and WordPress handles the rest. You find that shortcode inside the SmartSlider dashboard, copy it, and drop it wherever you want the slider to appear. No code knowledge needed.

As for where sliders actually appear on the NZRT site, there are four main locations. The home page uses a slider to showcase featured products and services. Each module page has its own module showcase slider. The blog section uses a content carousel. And product pages use SmartSlider for product image galleries. So it’s quite spread across the site — almost any page that needs a visual highlight or rotating content is likely using SmartSlider3 Pro in some form.

If you want to dig deeper, the related wiki notes to look at are SmartSlider Templates, the RetroTube Theme, the Plugins Overview, and the Page Structure and Navigation guide. Those will give you more context on how SmartSlider fits into the broader WordPress setup at NZRT.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Theme Development

Welcome to the NZRT Wiki Podcast. Today we’re looking at Theme Development.

Let’s start with the basics. A WordPress theme controls how your website looks and behaves visually. It pulls together template files, stylesheets, and PHP functions to create the overall design experience. For NZRT, the theme in use is called RetroTube, and it’s been built with a video-focused design in mind.

To understand how a theme works, it helps to know what’s inside one. The wiki shows us a typical theme folder layout, and here’s what you’d find. At the top level there are several key files. The first is the main stylesheet — this is required for every WordPress theme because it contains a special header comment that tells WordPress the theme’s name and version details. Next is the functions file, which is the engine room of the theme — more on that in a moment. Then there’s a fallback template file that WordPress uses when it can’t find anything more specific. After that you have separate files for the site header and footer, a sidebar region file, and then a handful of more targeted templates: one for individual blog posts, one for static pages, one for category and date archive listings, and one for search results. Finally there’s an assets folder that holds your images, JavaScript, and any additional CSS files.

That structure gives you a clean separation of concerns. Each file has a job, and WordPress knows exactly which one to call depending on what the visitor is looking at.

Which brings us to something called the Template Hierarchy. This is the logic WordPress uses to decide which template file to load, and you can think of it as a priority list with three levels. WordPress always looks for the most specific file first. So if someone is viewing a custom post type called video, WordPress will look for a file dedicated to that post type before it falls back to the more general single post template. If it can’t find a specific match, it steps down to the general template. And if it still can’t find that, it uses the fallback index file as the final safety net. This hierarchy gives you a lot of flexibility — you can target very specific content types with custom layouts without touching anything else in the theme.

Now let’s talk about that functions file, because it does a lot of heavy lifting. This is where you tell WordPress what features your theme supports — things like featured images or custom navigation menus. It’s also where you register and load your stylesheets and JavaScript files, making sure everything is queued up properly rather than just dropped in manually. Beyond that, the functions file is where you add hooks and filters, which are WordPress’s way of letting you tap into the system at specific points to modify or extend behaviour. You can also define custom post types and taxonomies here if your content structure needs them.

For NZRT specifically, the RetroTube theme has been customised to support a video-heavy, module-based content structure. NZRT brand colours are built into the theme, and there’s support for virtual agent customisations — so the theme isn’t just handling aesthetics, it’s actively shaping how NZRT’s tools and content are presented to visitors.

One integration worth knowing about is SmartSlider 3 Pro. This is a slider plugin that works directly with the RetroTube theme templates to power the hero sliders — those large, full-width banner areas you typically see at the top of pages. Because it integrates at the template level rather than just being dropped in via a shortcode, you get much finer control over how those sliders look and behave across different page types.

So to bring it all together: a WordPress theme like RetroTube is a structured collection of files, each with a specific role. The folder layout keeps things organised, the template hierarchy gives WordPress a clear decision path for every page type you visit, and the functions file ties everything together with theme support declarations, asset loading, and custom logic. For NZRT, all of that is tuned to support a media-rich experience with brand consistency and tight plugin integration built in from the ground up.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.

Updates Maintenance

Welcome to the NZRT Wiki Podcast. Today we’re looking at Updates & Maintenance.

If you’re working with the NZRT WordPress setup, one of the most important things you’ll do on a regular basis is keep everything up to date. This isn’t just about getting new features — it’s about keeping the site secure and running smoothly. Let’s walk through how NZRT handles this.

First, let’s talk about the update schedule. There are five components that get attention on a recurring basis. WordPress core itself gets updated monthly, and the process for that is straightforward: test, update, then verify everything is working. Plugins follow the same monthly cycle with that same test, update, verify approach. Themes are handled as needed rather than on a fixed schedule, so they get the same treatment but only when there’s actually something to update. Then there are two components that run on a quarterly cycle rather than monthly. PHP — the language that powers WordPress under the hood — gets tested, updated, and then the server is restarted to apply the changes. MySQL, the database that stores all your site data, is also updated quarterly, following the same test, update, verify pattern.

Now, one important thing to know about the NZRT setup: there is no staging environment. That means every single update goes directly to the live production site. That might sound risky, and honestly, it makes the backup step completely non-negotiable. Before anything gets touched, you create a full site backup.

Let’s walk through the actual update procedure from start to finish. Step one is always the backup. You do this through Hoopla cPanel using JetBackup. This gives you a full snapshot of the site before any changes are made. If something goes wrong later, this is your safety net.

Step two is applying the update itself. You go into the WordPress admin panel, head to the Updates section, select the items you want to update — whether that’s WordPress core, specific plugins, or themes — and click the Update button. That part is actually quite simple.

Step three is verification. As soon as the update is done, you check the site. You’re looking at the home page, key pages, and making sure admin functions still work as expected. You’re not just assuming it went fine — you’re actively confirming it.

Step four only happens if something breaks. If the update causes a problem, you roll back by restoring from the backup you created in step one. That’s why the backup is so critical — it’s your escape hatch. After any update, you also want to keep an eye on the error logs to catch anything that might not be immediately visible on the front end.

Beyond the regular update cycle, there’s a set of ongoing maintenance tasks that keep the site healthy over time. Plugin audits are about reviewing what’s installed and removing anything that’s unused or outdated — unnecessary plugins are a security risk and can slow the site down. Theme cleanup works the same way: removing unused theme files keeps things tidy and reduces potential vulnerabilities. Database optimisation is handled using a tool called WP-Optimize, which cleans up and streamlines the WordPress database. Log rotation involves archiving old log files so they don’t pile up and cause issues. And security scans happen monthly — running a scanner to catch anything suspicious before it becomes a real problem.

In terms of who manages all of this at NZRT, it’s a two-person responsibility. The admin, known internally as xc, and the database administrator, dan, handle updates and maintenance between them. The whole philosophy here is proactive — staying on top of updates and maintenance before problems arise, rather than scrambling to fix security vulnerabilities or performance issues after the fact.

So to summarise: you back up before every update, no exceptions. You follow a monthly cycle for WordPress and plugins, a quarterly cycle for PHP and MySQL, and an as-needed approach for themes. And alongside those updates, you’re running regular audits, optimisations, and security scans to keep the site in good shape long-term.

That’s it for this episode of the NZRT Wiki Podcast. Thanks for listening.