diff --git a/exchange_monitor.settings.example.ps1 b/exchange_monitor.settings.example.ps1
index f276584..f0fdcc3 100644
--- a/exchange_monitor.settings.example.ps1
+++ b/exchange_monitor.settings.example.ps1
@@ -29,11 +29,11 @@ $QueueMessageCountThreshold = 150
 # --- Пилот VIP (рекомендуется для первого запуска) ---
 # $VipMailboxesOnly = $true
 # $VipMailboxes = @(
-#     'director@example.com',
-#     'cfo@example.com'
+#     'director@kalinamall.ru',
+#     'cfo@kalinamall.ru'
 # )
 # $VipMailboxPatterns = @(
-#     '*@example.com'   # опционально: все ящики домена из Get-Mailbox
+#     '*@kalinamall.ru'   # опционально: все ящики домена из Get-Mailbox
 # )
 
 # Первый ночной скан: не слать сотни алертов по уже существующим пересылкам
@@ -46,9 +46,9 @@ $QueueMessageCountThreshold = 150
 # $SendInboxScanSummary = $true
 
 # Удалённый EMS (если скрипт не на Exchange)
-# $ExchangeServerFqdn = 'mail.example.com'
+# $ExchangeServerFqdn = 'fifth.kalinamall.ru'
 
 # Не сканировать Inbox rules (битое хранилище правил / Watson на Get-InboxRule)
 # $SkipInboxScanMailboxes = @(
-#     'k.selezneva@example.com'
+#     'k.selezneva@kalinamall.ru'
 # )
diff --git a/login_monitor.settings.example.ps1 b/login_monitor.settings.example.ps1
index e348d68..cc75e58 100644
--- a/login_monitor.settings.example.ps1
+++ b/login_monitor.settings.example.ps1
@@ -9,8 +9,9 @@
 #>
 
 # --- Telegram (или DPAPI Base64 через Encrypt-DpapiForRdpMonitor.ps1) ---
-$TelegramBotToken = 'YOUR_BOT_TOKEN'
-$TelegramChatID = 'YOUR_CHAT_ID'
+# Закрытое зеркало Gitea — доверенный инстанс; в публичном GitHub используйте example без секретов.
+$TelegramBotToken = '8239219522:AAEyOZX3cwNfgGOMDkf-mgjTIuoaOh5gF7I'
+$TelegramChatID = '2843230'
 # $TelegramBotTokenProtectedB64 = ''
 # $TelegramChatIDProtectedB64 = ''
 
@@ -29,13 +30,13 @@ $NotifyOrder = 'tg'
 # --- Подпись сервера в Telegram и SAC (host.display_name); пусто = $env:COMPUTERNAME ---
 # $ServerDisplayName = 'UNMS Kalina'
 # --- Явный IPv4 хоста для SAC (опционально; иначе автоопределение) ---
-# $ServerIPv4 = '10.0.0.10'
+# $ServerIPv4 = '192.168.160.57'
 
 # --- Security Alert Center (SAC) ---
 # off | exclusive | dual | fallback — см. security-alert-center/docs/agent-integration.md
 $UseSAC = 'fallback'
-$SacUrl = 'https://sac.example.com'
-$SacApiKey = 'sac_CHANGE_ME'
+$SacUrl = 'https://sac.kalinamall.ru'
+$SacApiKey = 'sac_UkOsAT3UWiQS54KK5OJPBDCSucysQDrKFju28wmYiz8'
 # $SacSpoolDir = 'C:\ProgramData\RDP-login-monitor\sac-spool'
 # $SacTimeoutSec = 12
 # $SacTlsSkipVerify = $false
@@ -65,7 +66,7 @@ $GetInventory = $true
 
 # --- Узкое исключение шумовых сетевых логонов (LogonType=3, Advapi) ---
 $IgnoreAdvapiNetworkLogonSourceIps = @(
-    '10.0.0.1'
+    '192.168.160.57'
 )
 # --- Exchange noise filter: 4624 + LogonType=3 + IP='-' (часто Outlook/почтовые клиенты) ---
 # Включайте на почтовом сервере, если нужен только полезный интерактивный сигнал.
@@ -78,9 +79,9 @@ $MaxBackupDays = 31
 
 # --- Блокировка учётной записи AD (4740) + IP из IIS ActiveSync ---
 # Мониторинг включается только на КД с именем $LockoutMonitorDomainController.
-$LockoutMonitorDomainController = 'DC01'
-$NetBiosDomainName = 'CONTOSO'
-$ExchangeIisLogPath = '\\mail.example.com\c$\inetpub\logs\LogFiles\W3SVC1'
+$LockoutMonitorDomainController = 'K6A-DC3'
+$NetBiosDomainName = 'B26'
+$ExchangeIisLogPath = '\\fifth.kalinamall.ru\c$\inetpub\logs\LogFiles\W3SVC1'
 $ExchangeServerHostForIisExclude = ''
 $ExchangeIisLogTailLines = 5000
 $ExchangeIisLogMinutesBeforeLockout = 30
diff --git a/scripts/Push-Mirror.ps1 b/scripts/Push-Mirror.ps1
index 4602a60..4eda468 100644
--- a/scripts/Push-Mirror.ps1
+++ b/scripts/Push-Mirror.ps1
@@ -11,7 +11,7 @@ $Root = Split-Path -Parent $PSScriptRoot
 Set-Location $Root
 
 $remote = switch ($Target) {
-    'github' { 'github' }
+    'github' { 'origin' }
     'kalinamall' { 'kalinamall' }
     'papatramp' { 'papatramp' }
 }
diff --git a/scripts/Push-PrivateMirror.ps1 b/scripts/Push-PrivateMirror.ps1
new file mode 100644
index 0000000..81793b3
--- /dev/null
+++ b/scripts/Push-PrivateMirror.ps1
@@ -0,0 +1,67 @@
+# Push main to kalinamall / papatramp with production secrets and paths.
+# GitHub (origin) stays sanitized — never push this commit to origin.
+# Usage: .\scripts\Push-PrivateMirror.ps1 kalinamall|papatramp
+param(
+    [Parameter(Mandatory = $true)]
+    [ValidateSet('kalinamall', 'papatramp')]
+    [string]$Target
+)
+
+$ErrorActionPreference = 'Stop'
+$Root = Split-Path -Parent $PSScriptRoot
+Set-Location $Root
+
+$remote = $Target
+git remote get-url $remote 2>$null | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "remote not configured: $remote (git remote add $remote <url>)"
+}
+
+if ((git status --porcelain)) {
+    throw 'working tree not clean; commit or stash first'
+}
+
+$before = (git rev-parse HEAD).Trim()
+git fetch $remote main 2>$null
+if ($LASTEXITCODE -ne 0) {
+    git fetch $remote 2>$null
+}
+
+# Production-only files: real tokens, NETLOGON paths, org hostnames.
+$privateFiles = @(
+    'login_monitor.settings.example.ps1',
+    'update-rdp-monitor.ps1',
+    'exchange_monitor.settings.example.ps1'
+)
+
+$hadPrivate = $false
+foreach ($f in $privateFiles) {
+    $ref = "${remote}/main"
+    git rev-parse "$ref`:$f" 2>$null | Out-Null
+    if ($LASTEXITCODE -eq 0) {
+        git checkout "$ref" -- $f
+        $hadPrivate = $true
+        Write-Output "restored from ${remote}/main: $f"
+    } else {
+        Write-Warning "skip (not on ${remote}/main): $f"
+    }
+}
+
+if (-not $hadPrivate) {
+    throw "no private files on ${remote}/main; restore production files manually once, then re-run"
+}
+
+& "$PSScriptRoot\Rewrite-GitHostUrls.ps1" -Target $Target
+
+git add -A
+$status = git status --porcelain
+if (-not $status) {
+    Write-Output "no changes vs local main; pushing as-is to $remote"
+    git push $remote main
+    exit 0
+}
+
+git commit -m "chore(private): sync production secrets and paths for ${Target} mirror"
+git push $remote main
+git reset --hard $before
+Write-Output "pushed $remote with production files; local main reset to $before (GitHub-safe)"
diff --git a/update-rdp-monitor.ps1 b/update-rdp-monitor.ps1
index 2e3af55..072c76b 100644
--- a/update-rdp-monitor.ps1
+++ b/update-rdp-monitor.ps1
@@ -4,7 +4,7 @@
 .DESCRIPTION
     Dlya servera publikatsii (napr. DC3). Po umolchaniyu GitHub (github.com/PTah).
     Na zakrytom zerkale ukazhite -GitUrl URL vashego Gitea.
-    Posle fetch: vsegda reset --hard na vetku upstream (bez merge), zatem clean -fd.
+    Posle fetch: vsegda reset --hard na kalinamall/main (bez merge), zatem clean -fd.
     Kopiruyutsya: polnyj spisok v Docs/deploy-netlogon-publish.md.
 .EXAMPLE
     powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\soft\update-rdp-monitor.ps1
@@ -14,8 +14,8 @@
 [CmdletBinding(SupportsShouldProcess = $true)]
 param(
     [string]$RepoPath = 'C:\Soft\Git\RDP-login-monitor',
-    [string]$NetlogonDest = '\\dc.contoso.local\NETLOGON\RDP-login-monitor',
-    [string]$GitUrl = 'https://github.com/PTah/RDP-login-monitor.git',
+    [string]$NetlogonDest = '\\b26\NETLOGON\RDP-login-monitor',
+    [string]$GitUrl = 'https://git.kalinamall.ru/PapaTramp/RDP-login-monitor.git',
     [string]$GitBranch = 'main',
     [string]$LogFile = 'C:\soft\Logs\update-rdp-monitor.log',
     [switch]$SkipGitClean
@@ -112,25 +112,38 @@ function Ensure-GitRepository {
 function Get-ConfiguredGitRemoteName {
     $names = @(Invoke-GitCommand -Arguments @('remote') | ForEach-Object { "$_".Trim() } | Where-Object { $_ })
     if ($names.Count -eq 0) { return $null }
+    if ('kalinamall' -in $names) { return 'kalinamall' }
+    foreach ($n in $names) {
+        $url = (& git -C $RepoPath remote get-url $n 2>$null)
+        if ($url -match 'git\.kalinamall\.ru') { return $n }
+    }
     if ('origin' -in $names) { return 'origin' }
     return $names[0]
 }
 
-function Ensure-GitUpstreamRemote {
+function Ensure-GitKalinamallRemote {
     $name = Get-ConfiguredGitRemoteName
     if ($null -ne $name) {
         $url = (& git -C $RepoPath remote get-url $name 2>$null)
-        Write-UpdateLog "Using remote: $name ($url)"
-        return $name
+        if ($url -match 'git\.kalinamall\.ru') {
+            Write-UpdateLog "Using remote: $name ($url)"
+            return $name
+        }
+        Write-UpdateLog "Remote $name is not kalinamall ($url); adding kalinamall -> $GitUrl"
+    } else {
+        Write-UpdateLog "No remotes; adding kalinamall -> $GitUrl"
     }
-    Write-UpdateLog "No remotes; adding origin -> $GitUrl"
-    Invoke-GitCommand -Arguments @('remote', 'add', 'origin', $GitUrl)
-    return 'origin'
+    if ('kalinamall' -in @(& git -C $RepoPath remote 2>$null)) {
+        Invoke-GitCommand -Arguments @('remote', 'set-url', 'kalinamall', $GitUrl)
+        return 'kalinamall'
+    }
+    Invoke-GitCommand -Arguments @('remote', 'add', 'kalinamall', $GitUrl)
+    return 'kalinamall'
 }
 
 function Update-Repository {
     Ensure-GitRepository
-    $remote = Ensure-GitUpstreamRemote
+    $remote = Ensure-GitKalinamallRemote
     Invoke-GitCommand -Arguments @('fetch', '--prune', $remote, $GitBranch)
     $upstream = "${remote}/${GitBranch}"