How the TJFACT Employee Portal is built — as deployed.

Modules

Roles × modules

Shared lists

Service routes

Configuration rows

Pages, deploy targets and environment

Flows and background jobs

Finance data flow

1. A Finance tracker row entered on the portal wins (tag tracker). 2. Otherwise, when the Costpoint bridge is on the API route, the read-only REST snapshot is used (tag live · Costpoint API, refreshed every 10 minutes). 3. Otherwise the newest report export on OneDrive whose name matches the kind (tag onedrive · date, re-read every 30 minutes). The kinds and the file-name phrases the finder uses:

Runbook

Health

curl -s https://tjfact.paintyourheaven.com/gov/health
systemctl status tjfact-config --no-pager
journalctl -u tjfact-config -n 100 --no-pager
# integration probes (admin token or super-admin session)
curl -s -H "X-Admin-Token: $(cat /opt/hbf/tjfact/admin.token)" https://tjfact.paintyourheaven.com/gov/costpoint/status
curl -s -H "X-Admin-Token: $(cat /opt/hbf/tjfact/admin.token)" "https://tjfact.paintyourheaven.com/gov/ai/status?probe=1"
curl -s -H "X-Admin-Token: $(cat /opt/hbf/tjfact/admin.token)" https://tjfact.paintyourheaven.com/gov/ukg/probe

Restart

systemctl restart tjfact-config        # ~60–100 s: the finance snapshot warms on start
systemctl reload caddy                 # after a Caddyfile change only

Back up the state

# everything the portal knows that is not in Microsoft 365: configuration (+history), lists (+history), HR files, sessions key, token, audit
tar -czf /root/tjfact-state-$(date +%F).tar.gz -C /opt/hbf tjfact
# keep the archive off the host (it holds the admin token and HR files); restore = stop service, untar to /opt/hbf, start service

Deploy and roll back

# deploy: gzipped content + its sha256 to an allow-listed target; Python must compile; previous copy kept
python3 - <<'EOF'
import gzip, base64, hashlib, json, urllib.request
tok = open('/opt/hbf/tjfact/admin.token').read().strip()
target, path = 'page', '/path/to/prototype.html'        # targets: page, service, delivered, guides, asbuilt, agreement, it-agreement, mainsite, ...
raw = open(path, 'rb').read()
body = json.dumps({'target': target, 'sha256': hashlib.sha256(raw).hexdigest(), 'gz_b64': base64.b64encode(gzip.compress(raw)).decode()}).encode()
req = urllib.request.Request('https://tjfact.paintyourheaven.com/gov/deploy', data=body, headers={'Content-Type': 'application/json', 'X-Admin-Token': tok})
print(urllib.request.urlopen(req).read().decode())
EOF
# verify the bytes that are live equal the file you sent
curl -s --compressed https://tjfact.paintyourheaven.com/prototype | cmp - /path/to/prototype.html && echo verified
# roll back the last deploy of a target
curl -s -X POST -H "X-Admin-Token: $(cat /opt/hbf/tjfact/admin.token)" -H 'Content-Type: application/json' -d '{"target":"page"}' https://tjfact.paintyourheaven.com/gov/deploy/rollback
# what is deployed right now
curl -s https://tjfact.paintyourheaven.com/gov/deploy/status

Stage a deploy (no token) and approve it in the portal

# from any machine: the file is checked (allow-listed target, sha256, Python compiles) and parked - nothing live changes
python3 - <<'EOF'
import gzip, base64, hashlib, json, urllib.request
target, path, note = 'page', '/path/to/prototype.html', 'what changed, in one line'
raw = open(path, 'rb').read()
body = json.dumps({'target': target, 'sha256': hashlib.sha256(raw).hexdigest(), 'gz_b64': base64.b64encode(gzip.compress(raw)).decode(), 'note': note}).encode()
req = urllib.request.Request('https://tjfact.paintyourheaven.com/gov/deploy/stage', data=body, headers={'Content-Type': 'application/json'})
print(urllib.request.urlopen(req).read().decode())
EOF
# then sign in as a super admin: Admin → Deploys waiting for you → Approve (or Reject).
# a service deploy restarts the service by itself; /gov/health answers again in about 30 s
curl -s https://tjfact.paintyourheaven.com/gov/health

Rotate the admin token

# generate on the host, write it to the token file, restart. Never send the value anywhere.
python3 -c "import secrets; print(secrets.token_hex(24))" > /opt/hbf/tjfact/admin.token.new
chmod 600 /opt/hbf/tjfact/admin.token.new && mv /opt/hbf/tjfact/admin.token.new /opt/hbf/tjfact/admin.token
systemctl restart tjfact-config
# any tool that deploys must read the new file; browsers holding the old token lose admin access on their next call

Rotate a vendor key (Dash, SAM.gov, UKG, Costpoint)

# from the Checklist as an admin: paste the new key on the row and Save (write-only; the old value is replaced), then Test connection.
# or from the host: POST /gov/config with the row key and only the secret field — public fields you omit are kept.

Unlock / lock writes, enforcement

# configuration writes: touch /opt/hbf/tjfact/writes.locked to lock; remove it to open
# sign-in enforcement: the Entra row on the Checklist (admin-only); break-glass file acl.off opens modules without un-terminating anyone

Where things are

Governance — owners and review schedule

Handoff kit