Prepared for: Netlink migration team (Saurabh, Aditya)
Prepared and verified by: Premnath D (8939720893)
Date prepared: 2026-09-11
Objective: Establish a verified baseline of the application, database, and hosting environment ahead of the Hostinger → Azure VM migration, and record the gaps between the current state and the assumptions in the migration plan.
Source of truth: live server inspection via SSH (port 65002, u419061541@195.35.4.69), live API calls, and decompiled Unity WebGL WebAssembly/framework bundles.
Headline correction: The hosting is NOT Ubuntu. It is AlmaLinux 9.7 (RHEL 9 compatible), a Hostinger shared-hosting environment (Phusion Passenger + LiteSpeed). The "Ubuntu 24 LTS" target assumption needs to be revisited — see Migration Implications.
| Item | Value |
|---|---|
| Public URL | https://effetechnology.in/AndritzDemo_V34/ |
| App title | Andritz |
| Engine | Unity 6000.0 (Unity 6) — confirmed via framework bundle referencing docs.unity3d.com/6000.0/ |
| Build size | 306 MB total (Build/ alone is 306 MB) |
| Loader | Build/AndritzDemo_V34.loader.js (117,893 bytes) |
| Framework | Build/AndritzDemo_V34.framework.js.unityweb (84,141 bytes, Brotli) |
| WebAssembly | Build/AndritzDemo_V34.wasm.unityweb (11,520,629 bytes, Brotli) |
| Asset data | Build/AndritzDemo_V34.data.unityweb (308,840,479 bytes, Brotli) |
| Streaming assets | StreamingAssets/markers.csv, StreamingAssets/Icons/{marker-pin,sharepoint-icon,logo}.png (132 KB) |
| Server path | /home/u419061541/domains/effetechnology.in/public_html/AndritzDemo_V34/ |
| Last deployed | 2026-09-08 07:15 |
Version history on the server (many parallel builds — no build pipeline):
AndritzDemo_89, AndritzDemo_Final, AndritzDemo_V31, AndritzDemo_V32, AndritzDemo_V34, AndritzDemo_V35, Andritz_videos, Andritz_Lobby, AndritzMap, Andriz, Andriz_Lab, Andriz_Scorm, plus AndritzDemo_V3.rar (194 MB, dated 2026-05-06).
V35 exists on disk (2026-09-09) but V34 is the one referenced/linked. Versions appear to be uploaded manually as new folders.
index.html + decompiled framework)<redacted — see local-only report>6e57e216dbbe0dd2b097559emarker, v=weeklyStreamingAssets/markers.csv.POST https://hotpink-shrew-796888.hostingersite.com/upload-model
Headers: Authorization: Bearer <sessionToken>
Body: FormData { slot_number, model } (max 4 MB)
AndritzDemo_V34.framework.js.)Critical for migration: this backend URL is compiled into the Unity WebGL build. Changing the backend host requires either (a) recompiling/re-exporting the Unity build, or (b) DNS/proxy interception of the existing hostname. Editing it in the
.unitywebfiles is not a supported path.
effetechnology.in (the primary domain) is a WordPress site (wp-config.php, wp-content, index.php, LiteSpeed, Hostinger MU-plugins, Jetpack/WAF). It serves as the container for the Unity demo folders.
| Item | Value |
|---|---|
| Name / version | andritz-2.0-backend v1.0.0 |
| Base URL | https://hotpink-shrew-796888.hostingersite.com/ |
| Runtime | Node.js 22 (/opt/alt/alt-nodejs22/root/bin/node) |
| Framework | Express 5.2.1 |
| DB driver | mysql2 3.23.3 (connection pool, limit 10) |
| App root | /home/u419061541/domains/hotpink-shrew-796888.hostingersite.com/hbuilds/current/nodejs |
| Deploy model | Hostinger Node.js hosting "hbuilds" — git-based build, release on git push |
| Startup file | server.js (Passenger) |
| Port | 5000 (internal; public via Passenger/LiteSpeed) |
| Git repo | https://github.com/Siva-ra/Testing-Andritz.git |
| Branch / commit | main @ d642ae5 — "Add incoming friend requests" |
| Env file | hbuilds/config/.env (plaintext, chmod 600) |
Dependencies: bcryptjs, cors, dotenv, express, fluent-ffmpeg, multer, mysql2, pdf-poppler, pdfkit.
Mounted routes (from server.js):
| Mount path | Router |
|---|---|
/api/roles |
roleRoutes |
/api/role-management |
roleManagementRoutes |
/api/admins |
adminRoutes |
/api/users |
userRoutes |
/api/login |
loginRoutes |
/api/user-management |
userManagementRoute |
/api/tickets |
ticketRoutes |
/api/documents |
documentRoutes |
/api/dashboard |
dashboardRoutes |
/api/content-management |
contentManagementRoutes |
/api/user-dashboard/recent-uploads |
userDashboardRecentUploadRoutes |
/notifications |
notificationRoutes |
| (root) | modelRoutes, photoRoutes, videoRoutes, webLinkRoutes |
Static assets served:
/uploads → ../../../../../public_html/uploads (3D models/documents)/uploads/documents, /uploads/document_previews/photos, /thumbnails (CORS *)Utility endpoints:
GET / → status JSON ("Andritz 2.0 Backend is running 🚀")GET /test-db → MySQL connectivity check (currently returns success)GET /api/role-management-test[VERIFIED] from routes/loginRoutes.js + config/auth.js:
POST /api/login with { email }). There is no password check on this endpoint, despite bcryptjs being installed.account_type = "super_admin".accounts joined to admin_types / roles; unknown email → 404 "Email not registered".crypto.randomBytes(32)), stored in the sessions table, 24-hour expiry, passed as Authorization: Bearer <token>.requireSuperAdmin() gates super-admin actions, checking both account_type and the email allow-list.Security note for the migration: email-only auth means anyone who knows a registered address can obtain a session. Password/OTP flows exist in the other backend (Section 4). Flag this before it is exposed more widely or moved behind a public DNS name.
andritz_db)[VERIFIED] from hbuilds/config/.env and live GET /test-db → {"success":true,"message":"MySQL connected successfully ✅"}.
| Item | Value |
|---|---|
| Engine | MySQL |
| Host | srv1646.hstgr.io (resolves to in-mum-web1646.hstgr.io — the same shared server) |
| Port | 3306 |
| Database | u419061541_andritz_db |
| User | u419061541_andritz_user |
| Password | <redacted> |
| Panel | phpMyAdmin — auth-db1646.hstgr.io |
accounts, activity_logs, admin_types, content_items, documents, image_slots, models, notifications, notification_logs, notification_recipients, roles, sessions, tickets, videos, web_links.
accounts table — live data (9 rows, matches phpMyAdmin screenshot)| id | account_type | admin_type | role | created_at | last_login | status | |
|---|---|---|---|---|---|---|---|
| 1 | shaginjose@gmail.com | admin | Backend Developer | — | 2026-08-20 | 2026-09-10 10:49 | active |
| 2 | shaginjosejose@gmail.com | user | Backend Developer | MySql | 2026-08-20 | 2026-08-25 10:13 | active |
| 3 | tntamil182@gmail.com | user | 3D Team | Model DEsigner | 2026-08-20 | — | active |
| 4 | sivaram@effeindia.com | admin | siva | — | 2026-08-20 | 2026-08-25 10:13 | active |
| 5 | vijay@effeindia.com | user | siva | Intern | 2026-08-20 | — | active |
| 6 | julianedwarddaniel3dzone@gmail.com | admin | Program | — | 2026-08-21 | — | active |
| 7 | gowriptrt1988@gmail.com | user | 3D Team | Model DEsigner | 2026-08-25 | 2026-08-25 09:40 | active |
| 8 | vinoraj057@gmail.com | admin | Backend Developer | — | 2026-09-03 | — | active |
| 9 | vinorai@gmail.com | user | Frontend Developer | javascript | 2026-09-03 | — | active |
From SUPER_ADMIN_EMAIL in the backend .env:
SUPER_ADMIN_EMAIL='<effe-vendor-address>,<andritz-client-address>'
<effe-vendor-address> — Effe / Effeverse (vendor side)<andritz-client-address> — Andritz (client side, external contractor)These two addresses bypass the accounts table entirely and receive super_admin sessions on email entry alone.
Note: because login is email-only (no password — see Section 2.2), these addresses are effectively credentials. The full values are held in the local-only report and must be treated as secrets.
/api/roles): 8 admin types — Backend Developer, 3D Team, siva, Frontend Developer, Developer, Program, Laptop, CEO — with 36 roles (node.js, express.js, MySql, Server, Animation, Model DEsigner, Manager, TL, Intern, react.js, HTML, javascript, css, unity, Full Stack, java, python, c++, c, c#, js, sql, hp, lenovo, asus, rog, MANAGER, ADMIN MANAGER, ASSTAINT, manger, …)./api/dashboard): totalUsers = 9, activeSessions = 3, totalContent = 3; recent activity includes uploaded models (1784023334535_Duck.glb, highpoly_info_sign_3d_icon.glb) with user_email = "Unknown" (logging gap — uploads are not attributing a user)./api/tickets): 2 open, 0 closed (100% open) — both from account_id 1 (shaginjose@gmail.com): "network issue", "i have a issuess"./api/users returns 404 — the route is mounted but has no GET / handler. The working listing is /api/user-management.userdata DB)There is a second, independent Node app on the same Hostinger account. It must be included in migration scope.
| Item | Value |
|---|---|
| URL | https://lightgreen-cheetah-775075.hostingersite.com/ |
| App root | /home/u419061541/domains/lightgreen-cheetah-775075.hostingersite.com/nodejs |
| Package | node-js (default name) |
| Framework | Express 4.18.2 |
| Extra deps | jsonwebtoken, nodemailer (vs. the other backend) |
| Git repo | https://github.com/Siva-ra/Hostinger-Testing.git |
| Branch / commit | main @ bd43bbd — "Update full thumbnail code" |
| Handles | Forgot-password OTP flow (routes/forgotPassword.js), thumbnails, uploads |
Its .env:
DB_HOST=srv1646.hstgr.io
DB_USER=u419061541_root
DB_PORT=3306
DB_PASSWORD=<redacted>
DB_NAME=u419061541_userdata
EMAIL_USER=<redacted>
EMAIL_PASS=<redacted> # Gmail app password
Notes:
root MySQL user — broader privileges than the primary backend.users table (SELECT id FROM users WHERE email=?) — a different schema from andritz_db.accounts. The two databases are not obviously synchronised.[VERIFIED] via SSH and /proc/version.
| Item | Value |
|---|---|
| Provider | Hostinger (shared hosting) — main-hosting.eu |
| Node | in-mum-web1646.main-hosting.eu (Mumbai) |
| OS | AlmaLinux 9.7 — kernel 5.14.0-611.45.1.el9_7.x86_64, built by mockbuild@x64-builder02.almalinux.org |
| Web server | LiteSpeed (HTTP/2, HTTP/3), panel: hpanel, platform: hostinger |
| App server | Phusion Passenger (Node) |
| SSH | port 65002, user u419061541, key auth |
| Account home | /home/u419061541 |
| PHP (CLI) | 8.2.33 |
| Node (shared) | 22.x |
| Uptime | 161 days |
| Nodes/host resources | 64 cores, 502 GiB RAM (310 used), 251 GiB swap, /dev/sda4 21 TB (66% used) — shared pool, not dedicated to this app |
| Note | lsb_release, rpm, gcc, python3 unavailable in the jailed shell; /etc/os-release unreadable |
Domains on the account: effetechnology.in, effeanimation.com, effeconsultancy.com, effeindia.com, effemarketing.com, effeverse.com, 3danimation.in, dsimilar.in, filmyads.com, illusee.com, mentoplearning.com, vfxstudio.in, plus Hostinger preview hostnames (hotpink-shrew-796888, lightgreen-cheetah-775075, darkgreen-yak-162922, lime-dunlin-724972).
Databases on the account (Hostinger panel, auth-db1646.hstgr.io): u419061541_andritz_db, u419061541_userdata.
Content storage reality check:
effetechnology.in/public_html/ — ~306 MB each, with ~12+ versions retained (several GB).public_html/uploads folders are currently near-empty (4–136 KB). The ">100 GB of data" figure, if accurate, is not on this account — it is likely external (SharePoint/other) and needs to be located. Confirm the real data footprint before sizing Azure disks.These are the points where the assumptions in the migration email do not match the actual environment.
| Netlink assumption | Reality (verified) |
|---|---|
| "Hostinger (Ubuntu)" | AlmaLinux 9.7 (RHEL 9). No Ubuntu anywhere. |
| "OS: Ubuntu 24 LTS — match exact patch version from Hostinger" | There is no Ubuntu patch version to match. Target should be a deliberate choice (Ubuntu 24 LTS is fine as a target, but it is a technology change, not a like-for-like match). |
| "All services on a single server, no containers, no microservices" | Partly true (no Docker), but this is shared hosting with two separate Node apps, WordPress, multiple vhosts, and a shared MySQL host. It is not one self-contained server. |
| "Currently via IP address (no DNS)" | Access is via domain (effetechnology.in) and HTTPS, plus two *.hostingersite.com preview hosts. DNS is in use. |
| "MySQL ~500 MB, co-located on same server" | DB host srv1646.hstgr.io is the same shared server. Schema is small; file/asset storage is the large part. |
| "7–8 IT users" | accounts has 9 rows; plus 2 super-admin emails that are not in the table. |
hotpink-shrew-796888.hostingersite.com/upload-model). Plan to either re-export the Unity project with the new URL, or keep/repoint the hostname via DNS. Get the Unity source project (not just the built output) from the FA team — otherwise future changes are impossible.andritz_db.accounts (9 users) vs userdata.users (OTP flow). Decide whether both migrate, and whether the user stores are consolidated.index.html. Re-issue/restrict it for the new domain in Google Cloud Console (HTTP-referrer restriction to the Azure hostname/IP)..env files committed to GitHub repos. Rotate: both DB passwords, the Gmail app password, the Maps key, and the root DB credential before cutover.multer + fluent-ffmpeg/pdf-poppler. Azure VM needs Node 22, FFmpeg, and Poppler binaries installed — these are Hostinger-provided today and will not exist on a bare Azure image.full_backups_2026-02-03, backups/, .dbdumps/, All-in-One-WP wpress files). Establish which backup is authoritative before the freeze window.mysqldump of the two DBs (user u419061541_root has access). Restoration on Azure via mysql < dump.sql and file copy. Provide the process, not just the archive.| What | Value |
|---|---|
| SSH | u419061541@195.35.4.69:65002 (key-based) |
| MySQL host / port | srv1646.hstgr.io : 3306 |
andritz_db |
user u419061541_andritz_user / <redacted> |
userdata DB |
user u419061541_root / <redacted> |
| phpMyAdmin | auth-db1646.hstgr.io |
| Super admins | <effe-vendor-address>, <andritz-client-address> |
| SMTP (OTP emails) | <redacted> / app password <redacted> |
| Google Maps key | <redacted> (Map ID 6e57e216dbbe0dd2b097559e) |
| Backend repos | github.com/Siva-ra/Testing-Andritz, github.com/Siva-ra/Hostinger-Testing |
Full credential values are held only in
andritz-migration-report.local.md(gitignored, never committed).
server.js, routes/, config/db.js, config/auth.js, routes/loginRoutes.js), .env contents, MySQL connectivity (/test-db), live API reads (/, /api/roles, /api/user-management, /api/dashboard, /api/tickets, /notifications), Unity framework JS backend URL, index.html Google Maps config.andritz_db.accounts and userdata.users.userdata is actively used in production; full DB row counts per table (read-only API access was used, not direct SQL).Report generated from live inspection — treat credentials above as compromised-adjacent and rotate before migration.