CHAT_OUTPUT_BEGIN
COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-INGRESS-FORENSIC2
STATUS=OK
RC=0
HOST=pve01
MODE=read-only
COMPONENT=newfi-staging-public-443-ingress-forensic-readonly
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
COMMAND_SHA256=627e2c5bff84ac5d6ca6855bda07fd58088edf061222d1069b924c06daa8c364
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=151ca785d837c0d62cb62c856abbed2074c0b6285fc8cd4bee7c781194815b4c
SANITIZED_OUTPUT_SHA256=fca3c6da6ab54936eeeeac7b1e3c1bd269b3a3a884a3746c826316dc7bc53417
OUTPUT_BEGIN
FORENSIC2_BEGIN=true
COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-INGRESS-FORENSIC2
MODE=read-only
MUTATIONS_PERFORMED=NO
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
REFERENCE_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
AUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED
PRIOR_APPLY13_GATE=PASS
PRIOR_APPLY13_HISTORY_SHA256=262a6f490465046fc68f61b072bb3e3bfe95d5685c88cda5f4cf7326eb58cd17
PRIOR_APPLY13_FAILURE=ChangeError:PUBLIC_TLS_503_PROOF_FAIL:60:000:False:curl: (60) SSL: no alternative certificate subject name matches target hostname 'newfi-staging.gram1.ru'\nMore details here: https://curl.se/docs/sslcerts.html\n\ncurl failed to verify the legitimacy of the server and therefore could not\nestablish a secure connection to it. To learn more about this situation and\nhow to fix it, please visit the webpage mentioned above.\n
PVE01_PUBLIC_CERT_GIT={"err":"","out":"subject=CN=git.gram1.ru\nissuer=C=US, O=Let's Encrypt, CN=YE1\nserial=0668B385C8D6C5BBB0435761F84FADD0DB23\nnotBefore=Aug 17 02:03:29 2026 GMT\nnotAfter=Nov 15 02:03:28 2026 GMT\nX509v3 Subject Alternative Name: \n    DNS:git-read.gram1.ru, DNS:git.gram1.ru","rc":0}
PVE01_PUBLIC_CERT_STAGING={"err":"","out":"subject=CN=chat.gram1.ru\nissuer=C=US, O=Let's Encrypt, CN=YE2\nserial=05CCB33370771F433AE4E9AD47F2DB574672\nnotBefore=Aug 17 02:54:43 2026 GMT\nnotAfter=Nov 15 02:54:42 2026 GMT\nX509v3 Subject Alternative Name: \n    DNS:chat.gram1.ru, DNS:groups.chat.gram1.ru, DNS:share.chat.gram1.ru","rc":0}
PVE01_PUBLIC_CURL_GIT={"err":"","headers":["Server: nginx/1.28.3 (Ubuntu)"],"http":"200","rc":0}
PVE01_PUBLIC_CURL_STAGING={"err":"curl: (60) SSL: no alternative certificate subject name matches target hostname 'newfi-staging.gram1.ru'\nMore details here: https://curl.se/docs/sslcerts.html\n\ncurl failed to verify the legitimacy of the server and therefore could not\nestablish a secure connection to it. To learn more about this situation and\nhow to fix it, please visit the webpage mentioned above.\n","headers":[],"http":"000","rc":60}
PVE01_ROUTE_TO_PUBLIC_IP={"err":"","out":"185.225.35.6 via [PRIVATE_IP] dev vmbr0 src [PRIVATE_IP] uid 0 \n    cache","rc":0}
PVE01_PUBLIC_IP_EDGE_REFERENCES={"err":"","out":"/etc/pve/.rrd:12:pve-vm-9.0/130:928486:edge-vm:running:0:1788852539:4:0.0289438433950161:12884901888:12119961600:103079215104:0:24825980598:19777637197:17988949090:194319329792:12949573632:0:0:0.01:0.01:0:0\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:1208:- edge-vm container `cadvisor`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:1235:- edge-vm\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:1399:- edge-vm primary `dockge`, bind `127.0.0.1:5001`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:2119:## 4.3. pve03-loss / edge-vm restore drill\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:2122:- VM130 `edge-vm` on pve03 was backed up.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:2128:  - `/mnt/staging/offhost/edge-vm-vzdump-from-pve03/...`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:2138:  - Debian 13 hostname `edge-vm-restore-drill-9130`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:2142:STATUS=OK TYPE=pve03-edge-vm-restore-drill BAD=0 TEST_VM_CLEANED=YES\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:2147:  - `/usr/local/sbin/homelab-edge-vm-offhost-freshness`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:2150:  - `/var/lib/homelab-health/pve03-edge-vm-offhost-freshness.txt`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:2291:- VM130 edge-vm running on pve03\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:2450:- VM130/150/160/170/171 ping and SSH\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:2777:pve03-loss / edge-vm restore drill\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:2807:External independent runner on a verified external host; edge-vm is not independent.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:2902:5. Do not treat edge-vm as an independent external runner.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:2931:FAILED_UNITS=pve01:0,pve02:0,pve03:0,edge-vm:0\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:3128:edge-vm: adguard/netbox/cluster/p2/paperless guard legacy/superseded failures\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:3306:TRUSTED_NETBIRD_IDENTITY=edge-vm\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:3317:- `debian@[PRIVATE_IP]`, `debian@100.100.60.182`, and `debian@netbird.vpn.gram1.ru` all resolve to the same `edge-vm`.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:3318:- edge-vm is trusted internal/NetBird path, not an independent public external runner.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:3324:STATUS=OK TS=2026-07-08T09:17:06Z TYPE=independent-external-runner BAD=0 WARN=0 MODE=NO_DEPLOY_SEAL NO_DEPLOY_SEAL_OK=YES AUDIT_STATUS=OK AUDIT_OK=YES INDEPENDENT_RUNNER_READY=NO DEPLOY_DECISION=NO_DEPLOY CURRENT_INDEPENDENT_RUNNER_AVAILABLE=no TRUSTED_NETBIRD_IDENTITY=edge-vm PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH PUBLIC_VPS_SSH_OK=0 PUBLIC_VPS_REJECTED_HOSTKEY=YES EDGE_LAN_SSH_OK=2 EDGE_NETBIRD_SSH_OK=2 EDGE_DNS_SSH_OK=1 PUBLIC_OVERALL_OK=1 LOCAL_FAILED=0 PVE02_FAILED=0 PVE03_FAILED=0 EDGE_FAILED=0 DUTY_V2_STATUS=OK DUTY_V2_GATED_NONOK=0 DUTY_V2_UNGATED_ERROR_REVIEW=0 DUTY_V2_UNGATED_WARN_REVIEW=0 DUTY_V2_UNGATED_REVIEW_ITEM=0 DUTY_V2_LEGACY_OR_PHASE_REVIEW=0 OVERALL_STATUS=OK OVERALL_BAD=0 FINAL_STATUS=OK FINAL_FAIL=0 CLOSEOUT_OK=YES RECOVERY_SEAL_OK=YES RESTORE_CHECK_OK=YES GOLDEN_MATCH=YES LATEST_CONTROL_PLANE=homelab-pve01-app-safety-net-control-plane-20260708T090905Z GOLDEN_CONTROL_PLANE=homelab-pve01-app-safety-net-control-plane-20260708T090905Z DIRTY_COUNT=0 REPORT=/var/lib/homelab-independent-external-runner/no-deploy-seal-latest.md\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:3333:Do not deploy external-probe scripts to edge-vm and call it independent.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:3412:- Do not call edge-vm an independent external runner.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:3685:## edge-vm\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:4148:homelab-edge-vm-vzdump-backup.timer\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:4246:   - pve03 loss / edge-vm recovery.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:4433:  - роль: Proxmox node, ранее основной host edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:4437:- `edge-vm`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:4488:- Exit route распределён на группу `edge-vm`.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:4530:- На `edge-vm` были stale Homepage configs, но live Homepage там не работал.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:4555:На `edge-vm`:\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:4597:- edge-vm\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:4695:- Current Dockge был только на `edge-vm`.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:4784:  - edge-vm `dockge` project `dockge-compose` from `/opt/stacks/dockge-compose/compose.yaml`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:4785:  - edge-vm `npmplus` project `npmplus` from `/opt/stacks/npmplus/compose.yaml`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:4897:  - edge-vm=11\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:4903:  - edge-vm `homelab-registry-cache`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:5177:  - NPMplus on edge-vm;\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:5348:- edit stale Homepage config on edge-vm while live Homepage is on core-apps.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:5770:- NPMplus на edge-vm;\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:6100:2. Проверить edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:6577:  - edge-vm `[PRIVATE_IP]`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:6773:   - `router-moscow-health.service` active на edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:6799:- line 539: `### VM130 edge-vm`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:6804:- line 844: `### Edge VM / VM130 full-image protection`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:6959:- line 539: `### VM130 edge-vm`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:6965:- line 844: `### Edge VM / VM130 full-image protection`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:7187:| 539 | `### VM130 edge-vm` |\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:7210:| 844 | `### Edge VM / VM130 full-image protection` |\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:7575:- `/mnt/staging/offhost/edge-vm-vzdump-from-pve03.`\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8023:NOTE edge-vm disk scsi1 backup=0 risk must be documented\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8097:- У VM130 edge-vm есть риск: дополнительный диск backup=0.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8114:- VM130 edge-vm pve03 [PRIVATE_IP] Docker ingress/app host.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8133:- VM130 backup: closed, scsi1 backup=1, manual backup ZSTD_OK, exact offhost ZSTD_OK, old local backup removed.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8260:- [PRIVATE_IP] -> bc:24:11:e1:f3:3c NPMplus / edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8314:- edge-vm: no UPS/NUT/APCUPSD integration discovered.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8319:- NetBird service is active on pve01, pve02, pve03 and edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8324:- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 100.100.60.182/16.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8343:- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8403:- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening and NPMplus admin bind.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8404:- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBird VPS backup/offhost, Authentik/Gitea/Vaultwarden backup, SOPS secret coverage, mail cloud upload/restore, Immich/Memos/Paperless backup/offhost/restore, auto backup, edge-vm vzdump, secret sanity.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8407:- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8435:- pve03 local-lvm is the most constrained active VM storage because VM130 has 96G OS disk plus 150G media disk.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8479:- Main active workload: VM130 edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8545:### VM130 edge-vm\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8548:- Name: edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8562:- Important note: VM130 has exact offhost backup proof after scsi1 backup=1.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8631:- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8634:- NPMplus admin listener is bound to localhost on edge-vm, 127.0.0.1:81; public disabled legacy host npm.gram1.ru exists but enabled=0.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8637:- Host: edge-vm, [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8642:- Public listen ports on edge-vm: 0.0.0.0:80 and 0.0.0.0:443 by nginx/NPMplus.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8717:- Host: edge-vm, IP [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8843:- VM130 edge-vm: included in homelab-nightly-all, local backup on pve03.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8846:- VM130 also has dedicated edge-vm-vzdump backup/offhost/restore health proofs.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8848:- VM130 scsi1 backup flag is enabled after correction: scsi1 backup=1.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8850:### Edge VM / VM130 full-image protection\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8851:- edge-vm-vzdump-backup: STATUS=OK, archive size about 28.2G, SHA256 recorded.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8852:- edge-vm-vzdump-offhost: STATUS=OK, destination pve02 /mnt/staging/offhost/edge-vm-vzdump-from-pve03.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8853:- edge-vm-vzdump-restore: STATUS=OK, zstd and vma verification OK.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8854:- mail-cloud-edge-vm: STATUS=OK, recurring chunked upload, 53 parts, download verification enabled.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8855:- Retention for edge-vm cloud upload: RETENTION_KEEP=4.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8951:- Disk retention policy: STATUS=OK, root used pct observed 70 on edge-vm, removed dirs 0, Docker volume prune NO.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8952:- App backup retention dry-run timer exists on edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8975:- Primary monitoring host: edge-vm, [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:8987:- Node exporter on edge-vm: node-exporter, local port 127.0.0.1:9100.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9032:- HomelabP0WeeklyEdgeVmVzdumpHealthStale: weekly edge-vm vzdump health older than 8d.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9051:- Alloy relabels container, compose_project, compose_service and host=edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9085:- Main health dir on edge-vm: /var/lib/homelab-health.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9157:- edge-vm is reached as debian@[PRIVATE_IP] with sudo.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9166:- edge-vm root key observed: id_ed25519; debian authorized_keys observed.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9185:- edge-vm exposes public :80/:443 through NPMplus.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9186:- edge-vm NPMplus admin :81 and socket-proxy :2375 are bound to 127.0.0.1.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9187:- edge-vm registry cache :5000 is bound to [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9188:- edge-vm Home Assistant :8123 is intentionally LAN-exposed.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9231:- edge-vm runs Docker application stacks.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9304:- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9305:- Reverse proxy: NPMplus on edge-vm, container npmplus, host networking, admin bound to 127.0.0.1:81.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9306:- Edge runtime host: VM130 edge-vm, [PRIVATE_IP], Docker Compose projects count 43.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9314:| uptime.gram1.ru | http://127.0.0.1:3001 | edge-vm / uptime-kuma | npmplus-kuma backup/restore, Kuma health |\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9315:| gotify.gram1.ru | http://127.0.0.1:8082 | edge-vm / gotify | gotify health, alert-routing proof |\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9316:| vault.gram1.ru | http://127.0.0.1:8083 | edge-vm / vaultwarden | vaultwarden backup/offhost/restore |\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9317:| dockge.gram1.ru | http://127.0.0.1:5001 | edge-vm / dockge | stack inventory |\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9318:| home.gram1.ru | http://127.0.0.1:3000 | edge-vm / homepage | homepage container, dashboard route |\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9319:| git.gram1.ru | http://127.0.0.1:3002 | edge-vm / gitea | gitea backup/offhost/restore |\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9320:| dozzle.gram1.ru | http://127.0.0.1:9999 | edge-vm / dozzle | docker stack inventory |\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9321:| paper.gram1.ru | http://127.0.0.1:8010 | edge-vm / paperless | paperless backup/offhost/restore |\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9322:| memos.gram1.ru | http://127.0.0.1:5230 | edge-vm / memos | memos backup/offhost/restore |\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9323:| photos.gram1.ru | http://127.0.0.1:2283 | edge-vm / immich | immich media/full consistency proof |\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9324:| auth.gram1.ru | http://127.0.0.1:9000 | edge-vm / authentik | authentik backup/offhost/restore |\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9369:- Router forwards TCP/UDP 51820 for WireGuard on the Home bridge, not to edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9376:- If edge-vm is broken, VM130 full-image backup/offhost/restore proofs are authoritative.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9427:- Rewrites include public routes for git, dozzle, paper, memos, photos, auth and backup to edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9432:- Edge VM is VM130 at [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9440:- VM130 is the Docker runtime host.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9442:- Then use VM130 full-image vzdump/offhost/restore proofs.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9443:- Current authoritative edge-vm backup/offhost/restore evidence is in backup catalog and VM130 proofs.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9452:- For VM130 and VM160, use their dedicated closure proofs.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9455:- Prometheus is on edge-vm at 127.0.0.1:9090.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9584:- P2 small-stack backup and restore dry-run is installed on edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9639:- VM150 Nextcloud, router startup/running config, P0 critical and edge-vm backup directories are present on crypt remotes.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9641:- Retention shape observed: P0 critical has 10 visible dirs with keep 14, edge-vm has 3 visible dirs with keep 4, new VM150/router jobs have initial dirs.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9654:- edge-vm units checked: P2 small-stacks backup/restore, backup dashboard and restore drill index.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9655:- Proof records LoadState, ActiveState, UnitFileState and failed-unit counts for pve01 and edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9684:- edge-vm services checked: P2 small-stacks backup/restore, backup dashboard and restore drill index.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9689:- Corrected integrity proof was generated because one edge-vm executable required sudo for sha256sum.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9690:- Corrected proof records hashes for pve01 and edge-vm unit fragments and executable scripts without printing script contents.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9702:- edge-vm timers checked: P2 small-stacks backup/restore, backup dashboard and restore drill index.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:9778:- edge-vm services checked: P2 small-stacks backup/restore, backup dashboard and restore drill index.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10049:- Homepage External card/link for relay.pvepro.ru was removed because relay.pvepro.ru had DNS but no reachable HTTP/HTTPS endpoint from edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10068:- Remaining blocker for Homepage green dot is HTTP/HTTPS 403 from router web service to edge-vm/Bridge1, not network reachability.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10074:- Health endpoint service on edge-vm: homelab-router-moscow-health-http.service.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10087:- Health endpoint service: homelab-router-moscow-health-http.service on edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10137:- Backup location: /opt/npmplus/manual-backups/forum-public-ok-*.tar.gz on edge-vm [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10141:- Edge certificate renewal configured on edge-vm [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10437:CHECK-8: для edge-vm использовать debian@[PRIVATE_IP] и sudo.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10446:VM130 edge-vm has secondary disk backup=0 risk.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10470:edge-vm: ssh debian@[PRIVATE_IP], внутри использовать sudo.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10588:41. Ошибка: post-backup-pass-slo-reconciliation checked pve01 router health on edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10589:Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10590:Fix: build reconciliation from pve01 and edge-vm health files by correct owner.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10668:- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10673:- Context: installing edge-vm Moscow router health endpoint.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10682:- Impact: do not use [PRIVATE_IP] directly as Homepage siteMonitor from edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10683:- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10955:* pve03 cloud: edge-vm, ingress, NPMplus, monitoring, homepage, часть critical configs.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10988:* VM130 edge-vm: обязательно daily local + cloud + offhost.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:10992:VM130 уже имеет dedicated backup/offhost/restore и cloud chunked upload, это хороший образец.  Его нужно сделать стандартом для остальных P0/P1 VM.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:11017:cloud: daily 7 / weekly 8 / monthly 6 для VM130/150/160.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:11025:## 4. Главная железная проблема — edge-vm сидит на самом спорном узле\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:11033:А самая критичная VM130 edge-vm находится на pve03 и держит reverse proxy, monitoring, backup automation и Docker application host.  При этом pve03 — самый ограниченный по диску: local-lvm уже был самым constrained, потому что VM130 имеет 96G OS + 150G media/data, а pve03 staging доходил до 77% при WARN 80%.  \n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:11037:1. **pve03 расширить диском.** Минимум 1–2 ТБ SSD вместо 500 GB. Иначе edge-vm будет постоянно ограничивать развитие.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:11039:3. **edge-vm либо перенести на pve01, либо разделить.** Идеальный вариант — не одна огромная edge-vm, а:\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:11044:4. Если не переносить сейчас, то минимум сделать **cold standby edge-vm** на pve01 или pve02: восстановленная из последнего backup, выключенная, с понятным runbook переключения IP/NPMplus/router port forward.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:11058:* pve03-loss drill: восстановить VM130 на другой ноде в изолированном режиме, проверить nginx config, cert files, Homepage, Prometheus, NPMplus config.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:11119:5. Ввести cloud-копии exact vzdump для VM130/150/160 и маленьких CT.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:11127:3. Разгрузить или перенести edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md:11128:4. Сделать cold standby edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:14:- VM130 edge-vm | pve03 | running | KEEP\n/etc/pve/31_HOMELAB_REFERENCE.md:75:NOTE edge-vm disk scsi1 backup=0 risk must be documented\n/etc/pve/31_HOMELAB_REFERENCE.md:149:- У VM130 edge-vm есть риск: дополнительный диск backup=0.\n/etc/pve/31_HOMELAB_REFERENCE.md:166:- VM130 edge-vm pve03 [PRIVATE_IP] Docker ingress/app host.\n/etc/pve/31_HOMELAB_REFERENCE.md:185:- VM130 backup: closed, scsi1 backup=1, manual backup ZSTD_OK, exact offhost ZSTD_OK, old local backup removed.\n/etc/pve/31_HOMELAB_REFERENCE.md:312:- [PRIVATE_IP] -> bc:24:11:e1:f3:3c NPMplus / edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:366:- edge-vm: no UPS/NUT/APCUPSD integration discovered.\n/etc/pve/31_HOMELAB_REFERENCE.md:371:- NetBird service is active on pve01, pve02, pve03 and edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:376:- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 100.100.60.182/16.\n/etc/pve/31_HOMELAB_REFERENCE.md:395:- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs.\n/etc/pve/31_HOMELAB_REFERENCE.md:455:- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening and NPMplus admin bind.\n/etc/pve/31_HOMELAB_REFERENCE.md:456:- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBird VPS backup/offhost, Authentik/Gitea/Vaultwarden backup, SOPS secret coverage, mail cloud upload/restore, Immich/Memos/Paperless backup/offhost/restore, auto backup, edge-vm vzdump, secret sanity.\n/etc/pve/31_HOMELAB_REFERENCE.md:459:- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03.\n/etc/pve/31_HOMELAB_REFERENCE.md:487:- pve03 local-lvm is the most constrained active VM storage because VM130 has 96G OS disk plus 150G media disk.\n/etc/pve/31_HOMELAB_REFERENCE.md:531:- Main active workload: VM130 edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:597:### VM130 edge-vm\n/etc/pve/31_HOMELAB_REFERENCE.md:600:- Name: edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:614:- Important note: VM130 has exact offhost backup proof after scsi1 backup=1.\n/etc/pve/31_HOMELAB_REFERENCE.md:683:- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP].\n/etc/pve/31_HOMELAB_REFERENCE.md:686:- NPMplus admin listener is bound to localhost on edge-vm, 127.0.0.1:81; public disabled legacy host npm.gram1.ru exists but enabled=0.\n/etc/pve/31_HOMELAB_REFERENCE.md:689:- Host: edge-vm, [PRIVATE_IP].\n/etc/pve/31_HOMELAB_REFERENCE.md:694:- Public listen ports on edge-vm: 0.0.0.0:80 and 0.0.0.0:443 by nginx/NPMplus.\n/etc/pve/31_HOMELAB_REFERENCE.md:769:- Host: edge-vm, IP [PRIVATE_IP].\n/etc/pve/31_HOMELAB_REFERENCE.md:895:- VM130 edge-vm: included in homelab-nightly-all, local backup on pve03.\n/etc/pve/31_HOMELAB_REFERENCE.md:898:- VM130 also has dedicated edge-vm-vzdump backup/offhost/restore health proofs.\n/etc/pve/31_HOMELAB_REFERENCE.md:900:- VM130 scsi1 backup flag is enabled after correction: scsi1 backup=1.\n/etc/pve/31_HOMELAB_REFERENCE.md:902:### Edge VM / VM130 full-image protection\n/etc/pve/31_HOMELAB_REFERENCE.md:903:- edge-vm-vzdump-backup: STATUS=OK, archive size about 28.2G, SHA256 recorded.\n/etc/pve/31_HOMELAB_REFERENCE.md:904:- edge-vm-vzdump-offhost: STATUS=OK, destination pve02 /mnt/staging/offhost/edge-vm-vzdump-from-pve03.\n/etc/pve/31_HOMELAB_REFERENCE.md:905:- edge-vm-vzdump-restore: STATUS=OK, zstd and vma verification OK.\n/etc/pve/31_HOMELAB_REFERENCE.md:906:- mail-cloud-edge-vm: STATUS=OK, recurring chunked upload, 53 parts, download verification enabled.\n/etc/pve/31_HOMELAB_REFERENCE.md:907:- Retention for edge-vm cloud upload: RETENTION_KEEP=4.\n/etc/pve/31_HOMELAB_REFERENCE.md:1003:- Disk retention policy: STATUS=OK, root used pct observed 70 on edge-vm, removed dirs 0, Docker volume prune NO.\n/etc/pve/31_HOMELAB_REFERENCE.md:1004:- App backup retention dry-run timer exists on edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:1027:- Primary monitoring host: edge-vm, [PRIVATE_IP].\n/etc/pve/31_HOMELAB_REFERENCE.md:1039:- Node exporter on edge-vm: node-exporter, local port 127.0.0.1:9100.\n/etc/pve/31_HOMELAB_REFERENCE.md:1084:- HomelabP0WeeklyEdgeVmVzdumpHealthStale: weekly edge-vm vzdump health older than 8d.\n/etc/pve/31_HOMELAB_REFERENCE.md:1103:- Alloy relabels container, compose_project, compose_service and host=edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:1137:- Main health dir on edge-vm: /var/lib/homelab-health.\n/etc/pve/31_HOMELAB_REFERENCE.md:1209:- edge-vm is reached as debian@[PRIVATE_IP] with sudo.\n/etc/pve/31_HOMELAB_REFERENCE.md:1218:- edge-vm root key observed: id_ed25519; debian authorized_keys observed.\n/etc/pve/31_HOMELAB_REFERENCE.md:1237:- edge-vm exposes public :80/:443 through NPMplus.\n/etc/pve/31_HOMELAB_REFERENCE.md:1238:- edge-vm NPMplus admin :81 and socket-proxy :2375 are bound to 127.0.0.1.\n/etc/pve/31_HOMELAB_REFERENCE.md:1239:- edge-vm registry cache :5000 is bound to [PRIVATE_IP].\n/etc/pve/31_HOMELAB_REFERENCE.md:1240:- edge-vm Home Assistant :8123 is intentionally LAN-exposed.\n/etc/pve/31_HOMELAB_REFERENCE.md:1283:- edge-vm runs Docker application stacks.\n/etc/pve/31_HOMELAB_REFERENCE.md:1356:- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm [PRIVATE_IP].\n/etc/pve/31_HOMELAB_REFERENCE.md:1357:- Reverse proxy: NPMplus on edge-vm, container npmplus, host networking, admin bound to 127.0.0.1:81.\n/etc/pve/31_HOMELAB_REFERENCE.md:1358:- Edge runtime host: VM130 edge-vm, [PRIVATE_IP], Docker Compose projects count 43.\n/etc/pve/31_HOMELAB_REFERENCE.md:1366:| uptime.gram1.ru | http://127.0.0.1:3001 | edge-vm / uptime-kuma | npmplus-kuma backup/restore, Kuma health |\n/etc/pve/31_HOMELAB_REFERENCE.md:1367:| gotify.gram1.ru | http://127.0.0.1:8082 | edge-vm / gotify | gotify health, alert-routing proof |\n/etc/pve/31_HOMELAB_REFERENCE.md:1368:| vault.gram1.ru | http://127.0.0.1:8083 | edge-vm / vaultwarden | vaultwarden backup/offhost/restore |\n/etc/pve/31_HOMELAB_REFERENCE.md:1369:| dockge.gram1.ru | http://127.0.0.1:5001 | edge-vm / dockge | stack inventory |\n/etc/pve/31_HOMELAB_REFERENCE.md:1370:| home.gram1.ru | http://127.0.0.1:3000 | edge-vm / homepage | homepage container, dashboard route |\n/etc/pve/31_HOMELAB_REFERENCE.md:1371:| git.gram1.ru | http://127.0.0.1:3002 | edge-vm / gitea | gitea backup/offhost/restore |\n/etc/pve/31_HOMELAB_REFERENCE.md:1372:| dozzle.gram1.ru | http://127.0.0.1:9999 | edge-vm / dozzle | docker stack inventory |\n/etc/pve/31_HOMELAB_REFERENCE.md:1373:| paper.gram1.ru | http://127.0.0.1:8010 | edge-vm / paperless | paperless backup/offhost/restore |\n/etc/pve/31_HOMELAB_REFERENCE.md:1374:| memos.gram1.ru | http://127.0.0.1:5230 | edge-vm / memos | memos backup/offhost/restore |\n/etc/pve/31_HOMELAB_REFERENCE.md:1375:| photos.gram1.ru | http://127.0.0.1:2283 | edge-vm / immich | immich media/full consistency proof |\n/etc/pve/31_HOMELAB_REFERENCE.md:1376:| auth.gram1.ru | http://127.0.0.1:9000 | edge-vm / authentik | authentik backup/offhost/restore |\n/etc/pve/31_HOMELAB_REFERENCE.md:1421:- Router forwards TCP/UDP 51820 for WireGuard on the Home bridge, not to edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:1428:- If edge-vm is broken, VM130 full-image backup/offhost/restore proofs are authoritative.\n/etc/pve/31_HOMELAB_REFERENCE.md:1479:- Rewrites include public routes for git, dozzle, paper, memos, photos, auth and backup to edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:1484:- Edge VM is VM130 at [PRIVATE_IP].\n/etc/pve/31_HOMELAB_REFERENCE.md:1492:- VM130 is the Docker runtime host.\n/etc/pve/31_HOMELAB_REFERENCE.md:1494:- Then use VM130 full-image vzdump/offhost/restore proofs.\n/etc/pve/31_HOMELAB_REFERENCE.md:1495:- Current authoritative edge-vm backup/offhost/restore evidence is in backup catalog and VM130 proofs.\n/etc/pve/31_HOMELAB_REFERENCE.md:1504:- For VM130 and VM160, use their dedicated closure proofs.\n/etc/pve/31_HOMELAB_REFERENCE.md:1507:- Prometheus is on edge-vm at 127.0.0.1:9090.\n/etc/pve/31_HOMELAB_REFERENCE.md:1636:- P2 small-stack backup and restore dry-run is installed on edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:1691:- VM150 Nextcloud, router startup/running config, P0 critical and edge-vm backup directories are present on crypt remotes.\n/etc/pve/31_HOMELAB_REFERENCE.md:1693:- Retention shape observed: P0 critical has 10 visible dirs with keep 14, edge-vm has 3 visible dirs with keep 4, new VM150/router jobs have initial dirs.\n/etc/pve/31_HOMELAB_REFERENCE.md:1706:- edge-vm units checked: P2 small-stacks backup/restore, backup dashboard and restore drill index.\n/etc/pve/31_HOMELAB_REFERENCE.md:1707:- Proof records LoadState, ActiveState, UnitFileState and failed-unit counts for pve01 and edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:1736:- edge-vm services checked: P2 small-stacks backup/restore, backup dashboard and restore drill index.\n/etc/pve/31_HOMELAB_REFERENCE.md:1741:- Corrected integrity proof was generated because one edge-vm executable required sudo for sha256sum.\n/etc/pve/31_HOMELAB_REFERENCE.md:1742:- Corrected proof records hashes for pve01 and edge-vm unit fragments and executable scripts without printing script contents.\n/etc/pve/31_HOMELAB_REFERENCE.md:1754:- edge-vm timers checked: P2 small-stacks backup/restore, backup dashboard and restore drill index.\n/etc/pve/31_HOMELAB_REFERENCE.md:1830:- edge-vm services checked: P2 small-stacks backup/restore, backup dashboard and restore drill index.\n/etc/pve/31_HOMELAB_REFERENCE.md:2101:- Homepage External card/link for relay.pvepro.ru was removed because relay.pvepro.ru had DNS but no reachable HTTP/HTTPS endpoint from edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:2120:- Remaining blocker for Homepage green dot is HTTP/HTTPS 403 from router web service to edge-vm/Bridge1, not network reachability.\n/etc/pve/31_HOMELAB_REFERENCE.md:2126:- Health endpoint service on edge-vm: homelab-router-moscow-health-http.service.\n/etc/pve/31_HOMELAB_REFERENCE.md:2139:- Health endpoint service: homelab-router-moscow-health-http.service on edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:2189:- Backup location: /opt/npmplus/manual-backups/forum-public-ok-*.tar.gz on edge-vm [PRIVATE_IP].\n/etc/pve/31_HOMELAB_REFERENCE.md:2193:- Edge certificate renewal configured on edge-vm [PRIVATE_IP].\n/etc/pve/31_HOMELAB_REFERENCE.md:2468:- Local placeholder service on edge-vm: homelab-parked-domains-http.service, enabled/active, serves marker PARKED_PAGE_OK on http://127.0.0.1:18088.\n/etc/pve/31_HOMELAB_REFERENCE.md:2473:- Certificate names on edge-vm: parked-newfi.ru, parked-hapusya.ru and parked-kingofwolk.ru; observed expiry during setup: 2026-09-29.\n/etc/pve/31_HOMELAB_REFERENCE.md:2481:- gram1.ru root and www.gram1.ru are routed to the existing parked placeholder page on edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:2485:- Certificate name on edge-vm: parked-gram1.ru.\n/etc/pve/31_HOMELAB_REFERENCE.md:2498:- Landing service on edge-vm: homelab-pvepro-landing-http.service on http://127.0.0.1:18089.\n/etc/pve/31_HOMELAB_REFERENCE.md:2500:- Certificate name on edge-vm: landing-pvepro.ru.\n/etc/pve/31_HOMELAB_REFERENCE.md:2551:- DNS-01 certificate issued on edge-vm for taftauto.ru and www.taftauto.ru.\n/etc/pve/31_HOMELAB_REFERENCE.md:2668:- edge-vm CrowdSec CAPI is registered and enabled through NetBird exit route.\n/etc/pve/31_HOMELAB_REFERENCE.md:2669:- Client peer: edge-vm.netbird.selfhosted / 100.100.60.182.\n/etc/pve/31_HOMELAB_REFERENCE.md:2672:- NetBird exit route proof on edge-vm: wg allowed-ips includes 0.0.0.0/0 via relay; ip route get 1.1.1.1 uses wt0 table 7120.\n/etc/pve/31_HOMELAB_REFERENCE.md:2701:- NPMplus admin is intentionally localhost-bound on edge-vm, so monitoring VM should not check the admin UI directly.\n/etc/pve/31_HOMELAB_REFERENCE.md:2734:- Dockge is currently present only on edge-vm.\n/etc/pve/31_HOMELAB_REFERENCE.md:2737:- No stopped containers were found across edge-vm, core-apps and monitoring during analysis.\n/etc/pve/31_HOMELAB_REFERENCE.md:2742:- Dockge main instance runs on edge-vm [PRIVATE_IP].\n/etc/pve/31_HOMELAB_REFERENCE.md:2751:- Dockge main instance: edge-vm [PRIVATE_IP].\n/etc/pve/31_HOMELAB_REFERENCE.md:2753:- Stale moved edge stack folders archived under /opt/dockge-stale-archive/20260702T230442Z on edge-vm; no runtime containers were deleted.\n/etc/pve/31_HOMELAB_REFERENCE.md:2902:- chat.gram1.ru public A is 185.225.35.6; groups.chat.gram1.ru and share.chat.gram1.ru continue through chat.gram1.ru.\n/etc/pve/31_HOMELAB_REFERENCE.md:2904:- edge-vm policy priority 101 routes source [PRIVATE_IP]/32 through table 17777 / wg-edge01.\n/etc/pve/31_HOMELAB_REFERENCE.md:2905:- VM150 Internet default path is via [PRIVATE_IP] and verified public egress is 185.225.35.6.\n/etc/pve/31_HOMELAB_REFERENCE.md:2906:- Effective coturn external address uses 185.225.35.6 and no longer advertises 95.84.154.183.\n/etc/pve/31_HOMELAB_REFERENCE.md:2912:- Public DNS observed at release: 185.225.35.6; DNS was not changed during forum cutover.\n/etc/pve/31_HOMELAB_REFERENCE.md:2914:- Edge runtime: VM130 edge-vm [PRIVATE_IP], NPMplus route /opt/npmplus/nginx/proxy_host/996.conf.\n/etc/pve/31_HOMELAB_REFERENCE.md:3219:VM130 config: /opt/npmplus/nginx/proxy_host/996.conf\n/etc/pve/31_HOMELAB_REFERENCE.md:3220:VM130 config SHA256: dad350a66f7d051db541e9407eace3bf4e91a271294fc60dac49c17c8bdf08a8\n/etc/pve/31_HOMELAB_REFERENCE.md:3230:VM130 config: /opt/npmplus/nginx/proxy_host/996.conf\n/etc/pve/31_HOMELAB_REFERENCE.md:3231:VM130 config SHA256: 89853114b9d3995613de8efb7fe370b208c5ec7587fce3fa2028eba523d73ba2\n/etc/pve/priv/authorized_keys:6:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMuM93V8UI1g3ki5MM/oIOBhC4+0pPSl+32EuBsfvss edge-vm-root-to-pve02-backup\n/etc/pve/priv/authorized_keys:14:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMuM93V8UI1g3ki5MM/oIOBhC4+0pPSl+32EuBsfvss edge-vm-root-to-pve02-backup\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z:19:CHECK-8: для edge-vm использовать debian@[PRIVATE_IP] и sudo.\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z:28:VM130 edge-vm has secondary disk backup=0 risk.\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z:52:edge-vm: ssh debian@[PRIVATE_IP], внутри использовать sudo.\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z:170:41. Ошибка: post-backup-pass-slo-reconciliation checked pve01 router health on edge-vm.\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z:171:Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm.\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z:172:Fix: build reconciliation from pve01 and edge-vm health files by correct owner.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:178:edge-vm.gram1.ru -> debian with sudo -n, normally reached from pve01\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:197:edge-vm.gram1.ru\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:301:mail.pvepro.ru -> NetBird wt0 -> edge-vm 100.100.60.182\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:417:edge-vm.netbird.selfhosted\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:464:ip static tcp ISP 80 -> edge-vm MAC\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:465:ip static tcp ISP 443 -> edge-vm MAC\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:786:NetBird route to edge-vm through wt0\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:787:edge-vm peer Connected/P2P\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:2088:- edge-vm container `cadvisor`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:2115:- edge-vm\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:2279:- edge-vm primary `dockge`, bind `127.0.0.1:5001`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:2999:## 4.3. pve03-loss / edge-vm restore drill\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:3002:- VM130 `edge-vm` on pve03 was backed up.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:3008:  - `/mnt/staging/offhost/edge-vm-vzdump-from-pve03/...`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:3018:  - Debian 13 hostname `edge-vm-restore-drill-9130`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:3022:STATUS=OK TYPE=pve03-edge-vm-restore-drill BAD=0 TEST_VM_CLEANED=YES\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:3027:  - `/usr/local/sbin/homelab-edge-vm-offhost-freshness`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:3030:  - `/var/lib/homelab-health/pve03-edge-vm-offhost-freshness.txt`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:3171:- VM130 edge-vm running on pve03\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:3330:- VM130/150/160/170/171 ping and SSH\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:3657:pve03-loss / edge-vm restore drill\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:3687:External independent runner on a verified external host; edge-vm is not independent.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:3782:5. Do not treat edge-vm as an independent external runner.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:3811:FAILED_UNITS=pve01:0,pve02:0,pve03:0,edge-vm:0\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:4008:edge-vm: adguard/netbox/cluster/p2/paperless guard legacy/superseded failures\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:4186:TRUSTED_NETBIRD_IDENTITY=edge-vm\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:4197:- `debian@[PRIVATE_IP]`, `debian@100.100.60.182`, and `debian@netbird.vpn.gram1.ru` all resolve to the same `edge-vm`.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:4198:- edge-vm is trusted internal/NetBird path, not an independent public external runner.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:4204:STATUS=OK TS=2026-07-08T09:17:06Z TYPE=independent-external-runner BAD=0 WARN=0 MODE=NO_DEPLOY_SEAL NO_DEPLOY_SEAL_OK=YES AUDIT_STATUS=OK AUDIT_OK=YES INDEPENDENT_RUNNER_READY=NO DEPLOY_DECISION=NO_DEPLOY CURRENT_INDEPENDENT_RUNNER_AVAILABLE=no TRUSTED_NETBIRD_IDENTITY=edge-vm PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH PUBLIC_VPS_SSH_OK=0 PUBLIC_VPS_REJECTED_HOSTKEY=YES EDGE_LAN_SSH_OK=2 EDGE_NETBIRD_SSH_OK=2 EDGE_DNS_SSH_OK=1 PUBLIC_OVERALL_OK=1 LOCAL_FAILED=0 PVE02_FAILED=0 PVE03_FAILED=0 EDGE_FAILED=0 DUTY_V2_STATUS=OK DUTY_V2_GATED_NONOK=0 DUTY_V2_UNGATED_ERROR_REVIEW=0 DUTY_V2_UNGATED_WARN_REVIEW=0 DUTY_V2_UNGATED_REVIEW_ITEM=0 DUTY_V2_LEGACY_OR_PHASE_REVIEW=0 OVERALL_STATUS=OK OVERALL_BAD=0 FINAL_STATUS=OK FINAL_FAIL=0 CLOSEOUT_OK=YES RECOVERY_SEAL_OK=YES RESTORE_CHECK_OK=YES GOLDEN_MATCH=YES LATEST_CONTROL_PLANE=homelab-pve01-app-safety-net-control-plane-20260708T090905Z GOLDEN_CONTROL_PLANE=homelab-pve01-app-safety-net-control-plane-20260708T090905Z DIRTY_COUNT=0 REPORT=/var/lib/homelab-independent-external-runner/no-deploy-seal-latest.md\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:4213:Do not deploy external-probe scripts to edge-vm and call it independent.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:4292:- Do not call edge-vm an independent external runner.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:4565:## edge-vm\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:5028:homelab-edge-vm-vzdump-backup.timer\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:5126:   - pve03 loss / edge-vm recovery.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:5313:  - роль: Proxmox node, ранее основной host edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:5317:- `edge-vm`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:5368:- Exit route распределён на группу `edge-vm`.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:5410:- На `edge-vm` были stale Homepage configs, но live Homepage там не работал.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:5435:На `edge-vm`:\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:5477:- edge-vm\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:5575:- Current Dockge был только на `edge-vm`.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:5664:  - edge-vm `dockge` project `dockge-compose` from `/opt/stacks/dockge-compose/compose.yaml`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:5665:  - edge-vm `npmplus` project `npmplus` from `/opt/stacks/npmplus/compose.yaml`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:5777:  - edge-vm=11\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:5783:  - edge-vm `homelab-registry-cache`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:6057:  - NPMplus on edge-vm;\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:6228:- edit stale Homepage config on edge-vm while live Homepage is on core-apps.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:6650:- NPMplus на edge-vm;\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:6980:2. Проверить edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:7457:  - edge-vm `[PRIVATE_IP]`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:7653:   - `router-moscow-health.service` active на edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:7679:- line 539: `### VM130 edge-vm`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:7684:- line 844: `### Edge VM / VM130 full-image protection`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:7839:- line 539: `### VM130 edge-vm`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:7845:- line 844: `### Edge VM / VM130 full-image protection`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:8067:| 539 | `### VM130 edge-vm` |\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:8090:| 844 | `### Edge VM / VM130 full-image protection` |\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:8455:- `/mnt/staging/offhost/edge-vm-vzdump-from-pve03.`\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:8903:NOTE edge-vm disk scsi1 backup=0 risk must be documented\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:8977:- У VM130 edge-vm есть риск: дополнительный диск backup=0.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:8994:- VM130 edge-vm pve03 [PRIVATE_IP] Docker ingress/app host.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9013:- VM130 backup: closed, scsi1 backup=1, manual backup ZSTD_OK, exact offhost ZSTD_OK, old local backup removed.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9140:- [PRIVATE_IP] -> bc:24:11:e1:f3:3c NPMplus / edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9194:- edge-vm: no UPS/NUT/APCUPSD integration discovered.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9199:- NetBird service is active on pve01, pve02, pve03 and edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9204:- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 100.100.60.182/16.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9223:- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9283:- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening and NPMplus admin bind.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9284:- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBird VPS backup/offhost, Authentik/Gitea/Vaultwarden backup, SOPS secret coverage, mail cloud upload/restore, Immich/Memos/Paperless backup/offhost/restore, auto backup, edge-vm vzdump, secret sanity.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9287:- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9315:- pve03 local-lvm is the most constrained active VM storage because VM130 has 96G OS disk plus 150G media disk.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9359:- Main active workload: VM130 edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9425:### VM130 edge-vm\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9428:- Name: edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9442:- Important note: VM130 has exact offhost backup proof after scsi1 backup=1.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9511:- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9514:- NPMplus admin listener is bound to localhost on edge-vm, 127.0.0.1:81; public disabled legacy host npm.gram1.ru exists but enabled=0.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9517:- Host: edge-vm, [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9522:- Public listen ports on edge-vm: 0.0.0.0:80 and 0.0.0.0:443 by nginx/NPMplus.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9597:- Host: edge-vm, IP [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9723:- VM130 edge-vm: included in homelab-nightly-all, local backup on pve03.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9726:- VM130 also has dedicated edge-vm-vzdump backup/offhost/restore health proofs.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9728:- VM130 scsi1 backup flag is enabled after correction: scsi1 backup=1.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9730:### Edge VM / VM130 full-image protection\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9731:- edge-vm-vzdump-backup: STATUS=OK, archive size about 28.2G, SHA256 recorded.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9732:- edge-vm-vzdump-offhost: STATUS=OK, destination pve02 /mnt/staging/offhost/edge-vm-vzdump-from-pve03.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9733:- edge-vm-vzdump-restore: STATUS=OK, zstd and vma verification OK.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9734:- mail-cloud-edge-vm: STATUS=OK, recurring chunked upload, 53 parts, download verification enabled.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9735:- Retention for edge-vm cloud upload: RETENTION_KEEP=4.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9831:- Disk retention policy: STATUS=OK, root used pct observed 70 on edge-vm, removed dirs 0, Docker volume prune NO.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9832:- App backup retention dry-run timer exists on edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9855:- Primary monitoring host: edge-vm, [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9867:- Node exporter on edge-vm: node-exporter, local port 127.0.0.1:9100.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9912:- HomelabP0WeeklyEdgeVmVzdumpHealthStale: weekly edge-vm vzdump health older than 8d.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9931:- Alloy relabels container, compose_project, compose_service and host=edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:9965:- Main health dir on edge-vm: /var/lib/homelab-health.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10037:- edge-vm is reached as debian@[PRIVATE_IP] with sudo.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10046:- edge-vm root key observed: id_ed25519; debian authorized_keys observed.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10065:- edge-vm exposes public :80/:443 through NPMplus.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10066:- edge-vm NPMplus admin :81 and socket-proxy :2375 are bound to 127.0.0.1.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10067:- edge-vm registry cache :5000 is bound to [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10068:- edge-vm Home Assistant :8123 is intentionally LAN-exposed.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10111:- edge-vm runs Docker application stacks.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10184:- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10185:- Reverse proxy: NPMplus on edge-vm, container npmplus, host networking, admin bound to 127.0.0.1:81.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10186:- Edge runtime host: VM130 edge-vm, [PRIVATE_IP], Docker Compose projects count 43.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10194:| uptime.gram1.ru | http://127.0.0.1:3001 | edge-vm / uptime-kuma | npmplus-kuma backup/restore, Kuma health |\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10195:| gotify.gram1.ru | http://127.0.0.1:8082 | edge-vm / gotify | gotify health, alert-routing proof |\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10196:| vault.gram1.ru | http://127.0.0.1:8083 | edge-vm / vaultwarden | vaultwarden backup/offhost/restore |\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10197:| dockge.gram1.ru | http://127.0.0.1:5001 | edge-vm / dockge | stack inventory |\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10198:| home.gram1.ru | http://127.0.0.1:3000 | edge-vm / homepage | homepage container, dashboard route |\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10199:| git.gram1.ru | http://127.0.0.1:3002 | edge-vm / gitea | gitea backup/offhost/restore |\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10200:| dozzle.gram1.ru | http://127.0.0.1:9999 | edge-vm / dozzle | docker stack inventory |\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10201:| paper.gram1.ru | http://127.0.0.1:8010 | edge-vm / paperless | paperless backup/offhost/restore |\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10202:| memos.gram1.ru | http://127.0.0.1:5230 | edge-vm / memos | memos backup/offhost/restore |\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10203:| photos.gram1.ru | http://127.0.0.1:2283 | edge-vm / immich | immich media/full consistency proof |\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10204:| auth.gram1.ru | http://127.0.0.1:9000 | edge-vm / authentik | authentik backup/offhost/restore |\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10249:- Router forwards TCP/UDP 51820 for WireGuard on the Home bridge, not to edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10256:- If edge-vm is broken, VM130 full-image backup/offhost/restore proofs are authoritative.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10307:- Rewrites include public routes for git, dozzle, paper, memos, photos, auth and backup to edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10312:- Edge VM is VM130 at [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10320:- VM130 is the Docker runtime host.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10322:- Then use VM130 full-image vzdump/offhost/restore proofs.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10323:- Current authoritative edge-vm backup/offhost/restore evidence is in backup catalog and VM130 proofs.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10332:- For VM130 and VM160, use their dedicated closure proofs.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10335:- Prometheus is on edge-vm at 127.0.0.1:9090.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10464:- P2 small-stack backup and restore dry-run is installed on edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10519:- VM150 Nextcloud, router startup/running config, P0 critical and edge-vm backup directories are present on crypt remotes.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10521:- Retention shape observed: P0 critical has 10 visible dirs with keep 14, edge-vm has 3 visible dirs with keep 4, new VM150/router jobs have initial dirs.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10534:- edge-vm units checked: P2 small-stacks backup/restore, backup dashboard and restore drill index.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10535:- Proof records LoadState, ActiveState, UnitFileState and failed-unit counts for pve01 and edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10564:- edge-vm services checked: P2 small-stacks backup/restore, backup dashboard and restore drill index.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10569:- Corrected integrity proof was generated because one edge-vm executable required sudo for sha256sum.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10570:- Corrected proof records hashes for pve01 and edge-vm unit fragments and executable scripts without printing script contents.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10582:- edge-vm timers checked: P2 small-stacks backup/restore, backup dashboard and restore drill index.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10658:- edge-vm services checked: P2 small-stacks backup/restore, backup dashboard and restore drill index.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10929:- Homepage External card/link for relay.pvepro.ru was removed because relay.pvepro.ru had DNS but no reachable HTTP/HTTPS endpoint from edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10948:- Remaining blocker for Homepage green dot is HTTP/HTTPS 403 from router web service to edge-vm/Bridge1, not network reachability.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10954:- Health endpoint service on edge-vm: homelab-router-moscow-health-http.service.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:10967:- Health endpoint service: homelab-router-moscow-health-http.service on edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11017:- Backup location: /opt/npmplus/manual-backups/forum-public-ok-*.tar.gz on edge-vm [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11021:- Edge certificate renewal configured on edge-vm [PRIVATE_IP].\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11317:CHECK-8: для edge-vm использовать debian@[PRIVATE_IP] и sudo.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11326:VM130 edge-vm has secondary disk backup=0 risk.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11350:edge-vm: ssh debian@[PRIVATE_IP], внутри использовать sudo.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11468:41. Ошибка: post-backup-pass-slo-reconciliation checked pve01 router health on edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11469:Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11470:Fix: build reconciliation from pve01 and edge-vm health files by correct owner.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11548:- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11553:- Context: installing edge-vm Moscow router health endpoint.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11562:- Impact: do not use [PRIVATE_IP] directly as Homepage siteMonitor from edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11563:- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11835:* pve03 cloud: edge-vm, ingress, NPMplus, monitoring, homepage, часть critical configs.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11868:* VM130 edge-vm: обязательно daily local + cloud + offhost.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11872:VM130 уже имеет dedicated backup/offhost/restore и cloud chunked upload, это хороший образец.  Его нужно сделать стандартом для остальных P0/P1 VM.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11897:cloud: daily 7 / weekly 8 / monthly 6 для VM130/150/160.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11905:## 4. Главная железная проблема — edge-vm сидит на самом спорном узле\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11913:А самая критичная VM130 edge-vm находится на pve03 и держит reverse proxy, monitoring, backup automation и Docker application host.  При этом pve03 — самый ограниченный по диску: local-lvm уже был самым constrained, потому что VM130 имеет 96G OS + 150G media/data, а pve03 staging доходил до 77% при WARN 80%.  \n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11917:1. **pve03 расширить диском.** Минимум 1–2 ТБ SSD вместо 500 GB. Иначе edge-vm будет постоянно ограничивать развитие.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11919:3. **edge-vm либо перенести на pve01, либо разделить.** Идеальный вариант — не одна огромная edge-vm, а:\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11924:4. Если не переносить сейчас, то минимум сделать **cold standby edge-vm** на pve01 или pve02: восстановленная из последнего backup, выключенная, с понятным runbook переключения IP/NPMplus/router port forward.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11938:* pve03-loss drill: восстановить VM130 на другой ноде в изолированном режиме, проверить nginx config, cert files, Homepage, Prometheus, NPMplus config.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:11999:5. Ввести cloud-копии exact vzdump для VM130/150/160 и маленьких CT.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:12007:3. Разгрузить или перенести edge-vm.\n/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md:12008:4. Сделать cold standby edge-vm.\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z:19:CHECK-8: для edge-vm использовать debian@[PRIVATE_IP] и sudo.\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z:28:VM130 edge-vm has secondary disk backup=0 risk.\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z:52:edge-vm: ssh debian@[PRIVATE_IP], внутри использовать sudo.\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z:170:41. Ошибка: post-backup-pass-slo-reconciliation checked pve01 router health on edge-vm.\n/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z:171:Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm.\n/etc/pve/HOME...<truncated>
EDGE_HOSTNAME={"err":"","out":"edge-vm","rc":0}
EDGE_RUNTIME_NETWORK={"err":"","out":"--- IP_ADDR ---\n[{\"ifindex\":1,\"ifname\":\"lo\",\"flags\":[\"LOOPBACK\",\"UP\",\"LOWER_UP\"],\"mtu\":65536,\"xdp\":{\"mode\":2,\"prog\":{\"id\":60,\"name\":\"nb_xdp_prog\",\"tag\":\"127663dc089f4523\",\"jited\":1},\"attached\":[{\"mode\":2,\"prog\":{\"id\":60,\"name\":\"nb_xdp_prog\",\"tag\":\"127663dc089f4523\",\"jited\":1}}]},\"qdisc\":\"noqueue\",\"operstate\":\"UNKNOWN\",\"group\":\"default\",\"txqlen\":1000,\"addr_info\":[{\"family\":\"inet\",\"local\":\"127.0.0.1\",\"prefixlen\":8,\"scope\":\"host\",\"label\":\"lo\",\"valid_life_time\":4294967295,\"preferred_life_time\":4294967295}]},{\"ifindex\":2,\"ifname\":\"eth0\",\"flags\":[\"BROADCAST\",\"MULTICAST\",\"UP\",\"LOWER_UP\"],\"mtu\":1500,\"qdisc\":\"fq_codel\",\"operstate\":\"UP\",\"group\":\"default\",\"txqlen\":1000,\"altnames\":[\"enp0s18\",\"enxbc2411e1f33c\"],\"addr_info\":[{\"family\":\"inet\",\"local\":\"[PRIVATE_IP]\",\"prefixlen\":24,\"broadcast\":\"[PRIVATE_IP]\",\"scope\":\"global\",\"label\":\"eth0\",\"valid_life_time\":4294967295,\"preferred_life_time\":4294967295}]},{\"ifindex\":3,\"ifname\":\"wg-taftauto\",\"flags\":[\"POINTOPOINT\",\"NOARP\",\"UP\",\"LOWER_UP\"],\"mtu\":1420,\"qdisc\":\"noqueue\",\"operstate\":\"UNKNOWN\",\"group\":\"default\",\"txqlen\":1000,\"addr_info\":[{\"family\":\"inet\",\"local\":\"[PRIVATE_IP]\",\"prefixlen\":24,\"scope\":\"global\",\"label\":\"wg-taftauto\",\"valid_life_time\":4294967295,\"preferred_life_time\":4294967295}]},{\"ifindex\":4,\"ifname\":\"wg-edge01\",\"flags\":[\"POINTOPOINT\",\"NOARP\",\"UP\",\"LOWER_UP\"],\"mtu\":1420,\"qdisc\":\"noqueue\",\"operstate\":\"UNKNOWN\",\"group\":\"default\",\"txqlen\":1000,\"addr_info\":[{\"family\":\"inet\",\"local\":\"[PRIVATE_IP]\",\"prefixlen\":30,\"scope\":\"global\",\"label\":\"wg-edge01\",\"valid_life_time\":4294967295,\"preferred_life_time\":4294967295}]},{\"ifindex\":5,\"ifname\":\"br-4d894f9e427b\",\"flags\":[\"NO-CARRIER\",\"BROADCAST\",\"MULTICAST\",\"UP\"],\"mtu\":1500,\"qdisc\":\"noqueue\",\"operstate\":\"DOWN\",\"group\":\"default\",\"addr_info\":[{\"family\":\"inet\",\"local\":\"[PRIVATE_IP]\",\"prefixlen\":16,\"broadcast\":\"[PRIVATE_IP]\",\"scope\":\"global\",\"label\":\"br-4d894f9e427b\",\"valid_life_time\":4294967295,\"preferred_life_time\":4294967295}]},{\"ifindex\":6,\"ifname\":\"br-5f66e1018bdd\",\"flags\":[\"BROADCAST\",\"MULTICAST\",\"UP\",\"LOWER_UP\"],\"mtu\":1500,\"qdisc\":\"noqueue\",\"operstate\":\"UP\",\"group\":\"default\",\"addr_info\":[{\"family\":\"inet\",\"local\":\"[PRIVATE_IP]\",\"prefixlen\":20,\"broadcast\":\"[PRIVATE_IP]\",\"scope\":\"global\",\"label\":\"br-5f66e1018bdd\",\"valid_life_time\":4294967295,\"preferred_life_time\":4294967295}]},{\"ifindex\":7,\"ifname\":\"br-8122fec51f39\",\"flags\":[\"BROADCAST\",\"MULTICAST\",\"UP\",\"LOWER_UP\"],\"mtu\":1500,\"qdisc\":\"noqueue\",\"operstate\":\"UP\",\"group\":\"default\",\"addr_info\":[{\"family\":\"inet\",\"local\":\"[PRIVATE_IP]\",\"prefixlen\":20,\"broadcast\":\"[PRIVATE_IP]\",\"scope\":\"global\",\"label\":\"br-8122fec51f39\",\"valid_life_time\":4294967295,\"preferred_life_time\":4294967295}]},{\"ifindex\":8,\"ifname\":\"docker0\",\"flags\":[\"NO-CARRIER\",\"BROADCAST\",\"MULTICAST\",\"UP\"],\"mtu\":1500,\"qdisc\":\"noqueue\",\"operstate\":\"DOWN\",\"group\":\"default\",\"addr_info\":[{\"family\":\"inet\",\"local\":\"[PRIVATE_IP]\",\"prefixlen\":16,\"broadcast\":\"[PRIVATE_IP]\",\"scope\":\"global\",\"label\":\"docker0\",\"valid_life_time\":4294967295,\"preferred_life_time\":4294967295}]},{\"ifindex\":9,\"ifname\":\"br-915a81681c3e\",\"flags\":[\"BROADCAST\",\"MULTICAST\",\"UP\",\"LOWER_UP\"],\"mtu\":1500,\"qdisc\":\"noqueue\",\"operstate\":\"UP\",\"group\":\"default\",\"addr_info\":[{\"family\":\"inet\",\"local\":\"[PRIVATE_IP]\",\"prefixlen\":28,\"broadcast\":\"[PRIVATE_IP]\",\"scope\":\"global\",\"label\":\"br-915a81681c3e\",\"valid_life_time\":4294967295,\"preferred_life_time\":4294967295}]},{\"ifindex\":10,\"ifname\":\"br-a4e31561a8d5\",\"flags\":[\"BROADCAST\",\"MULTICAST\",\"UP\",\"LOWER_UP\"],\"mtu\":1500,\"qdisc\":\"noqueue\",\"operstate\":\"UP\",\"group\":\"default\",\"addr_info\":[{\"family\":\"inet\",\"local\":\"[PRIVATE_IP]\",\"prefixlen\":16,\"broadcast\":\"[PRIVATE_IP]\",\"scope\":\"global\",\"label\":\"br-a4e31561a8d5\",\"valid_life_time\":4294967295,\"preferred_life_time\":4294967295}]},{\"ifindex\":11,\"ifname\":\"br-d41b3e918fbc\",\"flags\":[\"BROADCAST\",\"MULTICAST\",\"UP\",\"LOWER_UP\"],\"mtu\":1500,\"qdisc\":\"noqueue\",\"operstate\":\"UP\",\"group\":\"default\",\"addr_info\":[{\"family\":\"inet\",\"local\":\"[PRIVATE_IP]\",\"prefixlen\":16,\"broadcast\":\"[PRIVATE_IP]\",\"scope\":\"global\",\"label\":\"br-d41b3e918fbc\",\"valid_life_time\":4294967295,\"preferred_life_time\":4294967295}]},{\"ifindex\":12,\"ifname\":\"br-f43db13d76c4\",\"flags\":[\"BROADCAST\",\"MULTICAST\",\"UP\",\"LOWER_UP\"],\"mtu\":1500,\"qdisc\":\"noqueue\",\"operstate\":\"UP\",\"group\":\"default\",\"addr_info\":[{\"family\":\"inet\",\"local\":\"[PRIVATE_IP]\",\"prefixlen\":20,\"broadcast\":\"[PRIVATE_IP]\",\"scope\":\"global\",\"label\":\"br-f43db13d76c4\",\"valid_life_time\":4294967295,\"preferred_life_time\":4294967295}]},{\"ifindex\":13,\"ifname\":\"wt0\",\"flags\":[\"POINTOPOINT\",\"NOARP\",\"UP\",\"LOWER_UP\"],\"mtu\":1280,\"qdisc\":\"noqueue\",\"operstate\":\"UNKNOWN\",\"group\":\"default\",\"txqlen\":1000,\"addr_info\":[{\"family\":\"inet\",\"local\":\"100.100.60.182\",\"prefixlen\":16,\"broadcast\":\"100.100.255.255\",\"scope\":\"global\",\"label\":\"wt0\",\"valid_life_time\":4294967295,\"preferred_life_time\":4294967295}]}]\n--- ROUTES ---\ndefault via [PRIVATE_IP] dev eth0 proto static \n10.77.24.0/24 dev wg-taftauto proto kernel scope link src [PRIVATE_IP] \n10.77.77.0/30 dev wg-edge01 proto kernel scope link src [PRIVATE_IP] \n10.253.250.0/28 dev br-915a81681c3e proto kernel scope link src [PRIVATE_IP] \n100.100.0.0/16 dev wt0 proto kernel scope link src 100.100.60.182 \n172.17.0.0/16 dev docker0 proto kernel scope link src [PRIVATE_IP] linkdown \n172.21.0.0/16 dev br-4d894f9e427b proto kernel scope link src [PRIVATE_IP] linkdown \n172.22.0.0/16 dev br-d41b3e918fbc proto kernel scope link src [PRIVATE_IP] \n172.31.0.0/16 dev br-a4e31561a8d5 proto kernel scope link src [PRIVATE_IP] \n185.225.35.6 via [PRIVATE_IP] dev eth0 src [PRIVATE_IP] \n192.168.50.0/24 dev eth0 proto kernel scope link src [PRIVATE_IP] \n192.168.80.0/20 dev br-f43db13d76c4 proto kernel scope link src [PRIVATE_IP] \n192.168.224.0/20 dev br-8122fec51f39 proto kernel scope link src [PRIVATE_IP] \n192.168.240.0/20 dev br-5f66e1018bdd proto kernel scope link src [PRIVATE_IP] \n--- LISTENERS ---\nState  Recv-Q Send-Q  Local Address:Port  Peer Address:PortProcess                                                                                                                                          \nLISTEN 0      511           0.0.0.0:443        0.0.0.0:*    users:((\"nginx\",pid=2172946,fd=16),(\"nginx\",pid=2172924,fd=16),(\"nginx\",pid=2172915,fd=16),(\"nginx\",pid=2172914,fd=16),(\"nginx\",pid=3096,fd=16))\nLISTEN 0      511           0.0.0.0:443        0.0.0.0:*    users:((\"nginx\",pid=2172946,fd=15),(\"nginx\",pid=2172924,fd=15),(\"nginx\",pid=2172915,fd=15),(\"nginx\",pid=2172914,fd=15),(\"nginx\",pid=3096,fd=15))\nLISTEN 0      511           0.0.0.0:443        0.0.0.0:*    users:((\"nginx\",pid=2172946,fd=14),(\"nginx\",pid=2172924,fd=14),(\"nginx\",pid=2172915,fd=14),(\"nginx\",pid=2172914,fd=14),(\"nginx\",pid=3096,fd=14))\nLISTEN 0      511           0.0.0.0:443        0.0.0.0:*    users:((\"nginx\",pid=2172946,fd=7),(\"nginx\",pid=2172924,fd=7),(\"nginx\",pid=2172915,fd=7),(\"nginx\",pid=2172914,fd=7),(\"nginx\",pid=3096,fd=7))     \nLISTEN 0      128           0.0.0.0:22         0.0.0.0:*    users:((\"sshd\",pid=769,fd=6))                                                                                                                   \nLISTEN 0      511           0.0.0.0:80         0.0.0.0:*    users:((\"nginx\",pid=2172946,fd=13),(\"nginx\",pid=2172924,fd=13),(\"nginx\",pid=2172915,fd=13),(\"nginx\",pid=2172914,fd=13),(\"nginx\",pid=3096,fd=13))\nLISTEN 0      511           0.0.0.0:80         0.0.0.0:*    users:((\"nginx\",pid=2172946,fd=12),(\"nginx\",pid=2172924,fd=12),(\"nginx\",pid=2172915,fd=12),(\"nginx\",pid=2172914,fd=12),(\"nginx\",pid=3096,fd=12))\nLISTEN 0      511           0.0.0.0:80         0.0.0.0:*    users:((\"nginx\",pid=2172946,fd=11),(\"nginx\",pid=2172924,fd=11),(\"nginx\",pid=2172915,fd=11),(\"nginx\",pid=2172914,fd=11),(\"nginx\",pid=3096,fd=11))\nLISTEN 0      511           0.0.0.0:80         0.0.0.0:*    users:((\"nginx\",pid=2172946,fd=6),(\"nginx\",pid=2172924,fd=6),(\"nginx\",pid=2172915,fd=6),(\"nginx\",pid=2172914,fd=6),(\"nginx\",pid=3096,fd=6))     \nLISTEN 0      4096       127.0.0.54:53         0.0.0.0:*    users:((\"systemd-resolve\",pid=363,fd=21))                                                                                                       \nLISTEN 0      4096        127.0.0.1:12345      0.0.0.0:*    users:((\"docker-proxy\",pid=2201,fd=8))                                                                                                          \nLISTEN 0      5             0.0.0.0:18083      0.0.0.0:*    users:((\"python3\",pid=719,fd=3))                                                                                                                \nLISTEN 0      5       [PRIVATE_IP]:18091      0.0.0.0:*    users:((\"python3\",pid=723,fd=3))                                                                                                                \nLISTEN 0      128     [PRIVATE_IP]:18092      0.0.0.0:*    users:((\"python3\",pid=2395,fd=3))                                                                                                               \nLISTEN 0      128     [PRIVATE_IP]:9221       0.0.0.0:*    users:((\"python3\",pid=712,fd=3))                                                                                                                \nLISTEN 0      4096        127.0.0.1:8081       0.0.0.0:*    users:((\"docker-proxy\",pid=2107,fd=8))                                                                                                          \nLISTEN 0      4096        127.0.0.1:8088       0.0.0.0:*    users:((\"docker-proxy\",pid=2180,fd=8))                                                                                                          \nLISTEN 0      5           127.0.0.1:8014       0.0.0.0:*    users:((\"python3\",pid=710,fd=3))                                                                                                                \nLISTEN 0      4096   100.100.60.182:53         0.0.0.0:*    users:((\"netbird\",pid=720,fd=38))                                                                                                               \nLISTEN 0      4096        127.0.0.1:7422       0.0.0.0:*    users:((\"docker-proxy\",pid=2160,fd=8))                                                                                                          \nLISTEN 0      4096        127.0.0.1:9050       0.0.0.0:*    users:((\"tor\",pid=839,fd=6))                                                                                                                    \nLISTEN 0      4096    127.0.0.53%lo:53         0.0.0.0:*    users:((\"systemd-resolve\",pid=363,fd=19))                                                                                                       \nLISTEN 0      511         127.0.0.1:81         0.0.0.0:*    users:((\"nginx\",pid=2172946,fd=19),(\"nginx\",pid=2172924,fd=19),(\"nginx\",pid=2172915,fd=19),(\"nginx\",pid=2172914,fd=19),(\"nginx\",pid=3096,fd=19))\nLISTEN 0      511         127.0.0.1:81         0.0.0.0:*    users:((\"nginx\",pid=2172946,fd=18),(\"nginx\",pid=2172924,fd=18),(\"nginx\",pid=2172915,fd=18),(\"nginx\",pid=2172914,fd=18),(\"nginx\",pid=3096,fd=18))\nLISTEN 0      511         127.0.0.1:81         0.0.0.0:*    users:((\"nginx\",pid=2172946,fd=17),(\"nginx\",pid=2172924,fd=17),(\"nginx\",pid=2172915,fd=17),(\"nginx\",pid=2172914,fd=17),(\"nginx\",pid=3096,fd=17))\nLISTEN 0      511         127.0.0.1:81         0.0.0.0:*    users:((\"nginx\",pid=2172946,fd=8),(\"nginx\",pid=2172924,fd=8),(\"nginx\",pid=2172915,fd=8),(\"nginx\",pid=2172914,fd=8),(\"nginx\",pid=3096,fd=8))     \nLISTEN 0      4096        127.0.0.1:9999       0.0.0.0:*    users:((\"docker-proxy\",pid=2332,fd=8))                                                                                                          \nLISTEN 0      5           127.0.0.1:18088      0.0.0.0:*    users:((\"python3\",pid=711,fd=3))                                                                                                                \nLISTEN 0      5           127.0.0.1:18089      0.0.0.0:*    users:((\"python3\",pid=713,fd=3))                                                                                                                \nLISTEN 0      5           127.0.0.1:18090      0.0.0.0:*    users:((\"python3\",pid=709,fd=3))                                                                                                                \nLISTEN 0      5           127.0.0.1:18093      0.0.0.0:*    users:((\"python3\",pid=703,fd=3))                                                                                                                \nLISTEN 0      4096          0.0.0.0:5355       0.0.0.0:*    users:((\"systemd-resolve\",pid=363,fd=12))                                                                                                       \nLISTEN 0      2048     [PRIVATE_IP]:9221       0.0.0.0:*    users:((\"pve_exporter\",pid=1394,fd=3),(\"pve_exporter\",pid=721,fd=3))                                                                            \nLISTEN 0      4096        127.0.0.1:51515      0.0.0.0:*    users:((\"kopia\",pid=1700545,fd=8))                                                                                                              \nLISTEN 0      4096        127.0.0.1:2375       0.0.0.0:*    users:((\"docker-proxy\",pid=2031,fd=8))                                                                                                          \nLISTEN 0      4096    [PRIVATE_IP]:5000       0.0.0.0:*    users:((\"registry\",pid=1905,fd=7))                                                                                                              \nLISTEN 0      4096        127.0.0.1:3100       0.0.0.0:*    users:((\"docker-proxy\",pid=2223,fd=8))                                                                                                          \nLISTEN 0      511              [::]:443           [::]:*    users:((\"nginx\",pid=2172946,fd=10),(\"nginx\",pid=2172924,fd=10),(\"nginx\",pid=2172915,fd=10),(\"nginx\",pid=2172914,fd=10),(\"nginx\",pid=3096,fd=10))\nLISTEN 0      128              [::]:22            [::]:*    users:((\"sshd\",pid=769,fd=7))                                                                                                                   \nLISTEN 0      511              [::]:80            [::]:*    users:((\"nginx\",pid=2172946,fd=9),(\"nginx\",pid=2172924,fd=9),(\"nginx\",pid=2172915,fd=9),(\"nginx\",pid=2172914,fd=9),(\"nginx\",pid=3096,fd=9))     \nLISTEN 0      4096             [::]:5355          [::]:*    users:((\"systemd-resolve\",pid=363,fd=14))                                                                                                       \n--- DOCKER_PS ---\n{\"Command\":\"\\\"/bin/kopia server sâ¦\\\"\",\"CreatedAt\":\"2026-09-03 11:15:13 +0300 MSK\",\"HealthStatus\":\"none\",\"ID\":\"daf172831b99\",\"Image\":\"kopia/kopia:latest\",\"Labels\":\"com.docker.compose.config-hash=8f52164c1ad6bb3cfcde89342b77997b5607d42c6cce56a478ac2994f94ed1e0,com.docker.compose.container-number=1,com.docker.compose.depends_on=,com.docker.compose.image=sha256:89fd95ee2942880ca00eae964266958a394421ddbdf69bca62e38afc55f5900e,com.docker.compose.oneoff=False,com.docker.compose.project.config_files=/opt/stacks/kopia/compose.yaml,com.docker.compose.project.working_dir=/opt/stacks/kopia,com.docker.compose.project=kopia,com.docker.compose.replace=kopia,com.docker.compose.service=kopia,com.docker.compose.version=5.1.4,org.opencontainers.image.version=22.04\",\"LocalVolumes\":\"0\",\"Mounts\":\"/var/lib/kopiaâ¦,/var/lib/kopiaâ¦,/var/lib/kopiaâ¦\",\"Names\":\"kopia\",\"Networks\":\"host\",\"Platform\":{\"architecture\":\"amd64\",\"os\":\"linux\"},\"Ports\":\"\",\"RunningFor\":\"4 days ago\",\"Size\":\"1.66MB (virtual 236MB)\",\"State\":\"running\",\"Status\":\"Up 4 days\"}\n{\"Command\":\"\\\"/entrypoint.sh /etcâ¦\\\"\",\"CreatedAt\":\"2026-07-03 02:44:19 +0300 MSK\",\"HealthStatus\":\"none\",\"ID\":\"32fe4b81458c\",\"Image\":\"registry:2\",\"Labels\":\"com.docker.compose.config-hash=31793b5fc1341e6235f727941c5ff6becbeb69d5864bcd469fa21f550301f521,com.docker.compose.container-number=1,com.docker.compose.depends_on=,com.docker.compose.image=sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373,com.docker.compose.oneoff=False,com.docker.compose.project.config_files=/opt/stacks/registry-cache/compose.yaml,com.docker.compose.project.working_dir=/opt/stacks/registry-cache,com.docker.compose.project=registry-cache,com.docker.compose.replace=homelab-registry-cache,com.docker.compose.service=registry-cache,com.docker.compose.version=5.1.4\",\"LocalVolumes\":\"0\",\"Mounts\":\"/opt/stacks/reâ¦,/opt/stacks/reâ¦\",\"Names\":\"homelab-registry-cache\",\"Networks\":\"host\",\"Platform\":{\"architecture\":\"amd64\",\"os\":\"linux\"},\"Ports\":\"\",\"RunningFor\":\"2 months ago\",\"Size\":\"20.5kB (virtual 27.1MB)\",\"State\":\"running\",\"Status\":\"Up 10 days\"}\n{\"Command\":\"\\\"tini -- entrypoint.â¦\\\"\",\"CreatedAt\":\"2026-07-03 02:15:05 +0300 MSK\",\"HealthStatus\":\"healthy\",\"ID\":\"2f18b3d7f386\",\"Image\":\"zoeyvid/npmplus:2026-06-17-b1\",\"Labels\":\"com.centurylinklabs.watchtower.monitor-only=true,com.docker.compose.config-hash=3c289a3eb787a27fee3e84d3bc60b516ce18a1f7b054faa4a9a0b36ae74d9671,com.docker.compose.container-number=1,com.docker.compose.depends_on=,com.docker.compose.image=sha256:058637924fae1dbf161d1d78c84b738d86804e9a0ddad66cf7c87cbe33337834,com.docker.compose.oneoff=False,com.docker.compose.project.config_files=/opt/stacks/npmplus/compose.yaml,com.docker.compose.project.working_dir=/opt/stacks/npmplus,com.docker.compose.project=npmplus,com.docker.compose.replace=npmplus,com.docker.compose.service=npmplus,com.docker.compose.version=5.1.4,wud.watch.digest=false,wud.watch=false\",\"LocalVolumes\":\"0\",\"Mounts\":\"/opt/npmplus\",\"Names\":\"npmplus\",\"Networks\":\"host\",\"Platform\":{\"architecture\":\"amd64\",\"os\":\"linux\"},\"Ports\":\"\",\"RunningFor\":\"2 months ago\",\"Size\":\"146MB (virtual 413MB)\",\"State\":\"running\",\"Status\":\"Up 10 days (healthy)\"}\n{\"Command\":\"\\\"/bin/bash /docker_sâ¦\\\"\",\"CreatedAt\":\"2026-07-02 22:05:11 +0300 MSK\",\"HealthStatus\":\"none\",\"ID\":\"7418a69d796c\",\"Image\":\"crowdsecurity/crowdsec:v1.7.8-slim\",\"Labels\":\"com.docker.compose.config-hash=34e61fcdceeebf9217b771db0cf744de368eeb85431f224560ed3888c415599c,com.docker.compose.container-number=1,com.docker.compose.depends_on=,com.docker.compose.image=sha256:6e64b36b49a48d415504e979a7cb76eeaba46749beba64bb939f9accfa34368d,com.docker.compose.oneoff=False,com.docker.compose.project.config_files=/opt/stacks/crowdsec/compose.yaml,/opt/stacks/crowdsec/compose.override.yaml,/opt/stacks/crowdsec/compose.homelab-stability.yaml,com.docker.compose.project.working_dir=/opt/stacks/crowdsec,com.docker.compose.project=crowdsec,com.docker.compose.replace=crowdsec,com.docker.compose.service=crowdsec,com.docker.compose.version=5.1.4,org.opencontainers.image.created=2026-05-11T13:53:13Z,org.opencontainers.image.revision=632274597a88a6b01ed41c0e6affca0f87ff26df,org.opencontainers.image.source=https://github.com/crowdsecurity/crowdsec\",\"LocalVolumes\":\"0\",\"Mounts\":\"/opt/stacks/crâ¦,/opt/stacks/crâ¦,/opt/stacks/crâ¦\",\"Names\":\"crowdsec\",\"Networks\":\"crowdsec_default,socket-proxy_net\",\"Platform\":{\"architecture\":\"amd64\",\"os\":\"linux\"},\"Ports\":\"127.0.0.1:7422-\\u003e7422/tcp, 127.0.0.1:8088-\\u003e8080/tcp\",\"RunningFor\":\"2 months ago\",\"Size\":\"63.5MB (virtual 316MB)\",\"State\":\"running\",\"Status\":\"Up 10 days\"}\n{\"Command\":\"\\\"/dozzle\\\"\",\"CreatedAt\":\"2026-07-02 08:15:27 +0300 MSK\",\"HealthStatus\":\"none\",\"ID\":\"2ae500cf90ec\",\"Image\":\"2e14180fa14c\",\"Labels\":\"com.docker.compose.config-hash=7a1a48bc22c0351ffd2d4d41574d6c52c32b395d03580c0bdbdbc60b3ce2b4c6,com.docker.compose.container-number=1,com.docker.compose.depends_on=,com.docker.compose.image=sha256:2e14180fa14c195b8e86705b7ab2234b87599215bcf06f7f56396cb45f57f963,com.docker.compose.oneoff=False,com.docker.compose.project.config_files=/opt/stacks/dozzle/compose.yaml,/opt/stacks/dozzle/compose.override.yaml,com.docker.compose.project.working_dir=/opt/stacks/dozzle,com.docker.compose.project=dozzle,com.docker.compose.service=dozzle,com.docker.compose.version=5.1.4,org.opencontainers.image.created=2026-06-16T13:37:36.621Z,org.opencontainers.image.description=Realtime log viewer for containers.  Supports Docker, Swarm and K8s.,org.opencontainers.image.licenses=MIT,org.opencontainers.image.revision=38b851104296c6cff5e9f0d48feb98e7dbbc0107,org.opencontainers.image.source=https://github.com/amir20/dozzle,org.opencontainers.image.title=dozzle,org.opencontainers.image.url=https://github.com/amir20/dozzle,org.opencontainers.image.version=v10.6.6\",\"LocalVolumes\":\"0\",\"Mounts\":\"/opt/stacks/doâ¦\",\"Names\":\"dozzle\",\"Networks\":\"dozzle_default,socket-proxy_net\",\"Platform\":{\"architecture\":\"amd64\",\"os\":\"linux\"},\"Ports\":\"127.0.0.1:9999-\\u003e8080/tcp\",\"RunningFor\":\"2 months ago\",\"Size\":\"4.1kB (virtual 68.1MB)\",\"State\":\"running\",\"Status\":\"Up 10 days\"}\n{\"Command\":\"\\\"/usr/bin/cadvisor -â¦\\\"\",\"CreatedAt\":\"2026-06-24 03:45:08 +0300 MSK\",\"HealthStatus\":\"healthy\",\"ID\":\"c94dc7e48b04\",\"Image\":\"gcr.io/cadvisor/cadvisor:latest\",\"Labels\":\"com.docker.compose.config-hash=390b7c17fd31404acdbd0ca67a0ebf5688324939daf122a0337896a8a00450e5,com.docker.compose.container-number=1,com.docker.compose.depends_on=,com.docker.compose.image=sha256:3de2bd5203120b866d74a9b283b2ffb8ec382fbf9dc321814700c6ea6f44ec57,com.docker.compose.oneoff=False,com.docker.compose.project.config_files=/opt/stacks/cadvisor/compose.yaml,com.docker.compose.project.working_dir=/opt/stacks/cadvisor,com.docker.compose.project=cadvisor,com.docker.compose.service=cadvisor,com.docker.compose.version=5.1.4\",\"LocalVolumes\":\"0\",\"Mounts\":\"/dev/disk,/,/sys,/var/lib/docker\",\"Names\":\"cadvisor\",\"Networks\":\"observability-lite_default,socket-proxy_net\",\"Platform\":{\"architecture\":\"amd64\",\"os\":\"linux\"},\"Ports\":\"127.0.0.1:8081-\\u003e8080/tcp\",\"RunningFor\":\"2 months ago\",\"Size\":\"36.9kB (virtual 76.3MB)\",\"State\":\"running\",\"Status\":\"Up 10 days (healthy)\"}\n{\"Command\":\"\\\"/bin/alloy run --seâ¦\\\"\",\"CreatedAt\":\"2026-06-24 03:00:32 +0300 MSK\",\"HealthStatus\":\"none\",\"ID\":\"df7d2d861c0d\",\"Image\":\"grafana/alloy:v1.17.0\",\"Labels\":\"com.docker.compose.config-hash=92e0020f61b888e3ee61ee9f35e2470cfc2731509aca5d312f06a7d0fc74cd70,com.docker.compose.container-number=1,com.docker.compose.depends_on=loki:service_started:false,com.docker.compose.image=sha256:41c41849989b7e054ccbadc17938ee1e5592fe26bfbc56ef3ffc109c0b0b2739,com.docker.compose.oneoff=False,com.docker.compose.project.config_files=/opt/stacks/loki-alloy/compose.yaml,/opt/stacks/loki-alloy/compose.override.yaml,com.docker.compose.project.working_dir=/opt/stacks/loki-alloy,com.docker.compose.project=loki-alloy,com.docker.compose.replace=alloy,com.docker.compose.service=alloy,com.docker.compose.version=5.1.4,org.opencontainers.image.source=https://github.com/grafana/alloy,org.opencontainers.image.version=24.04\",\"LocalVolumes\":\"0\",\"Mounts\":\"/opt/stacks/loâ¦,/opt/stacks/loâ¦\",\"Names\":\"alloy\",\"Networks\":\"loki-alloy_default,socket-proxy_net\",\"Platform\":{\"architecture\":\"amd64\",\"os\":\"linux\"},\"Ports\":\"127.0.0.1:12345-\\u003e12345/tcp\",\"RunningFor\":\"2 months ago\",\"Size\":\"20.5kB (virtual 548MB)\",\"State\":\"running\",\"Status\":\"Up 10 days\"}\n{\"Command\":\"\\\"diun serve\\\"\",\"CreatedAt\":\"2026-06-24 02:59:09 +0300 MSK\",\"HealthStatus\":\"none\",\"ID\":\"df8678f48721\",\"Image\":\"crazymax/diun:latest\",\"Labels\":\"com.docker.compose.config-hash=2bb8d48880f762ac53759cdbc02550700f4465e8da2b7955e0f413bbc5246765,com.docker.compose.container-number=1,com.docker.compose.depends_on=,com.docker.compose.image=sha256:e324b793eb32dfb7f74d3a39421ebf090141caaadee69b8f78da63112408ee25,com.docker.compose.oneoff=False,com.docker.compose.project.config_files=/opt/stacks/diun/compose.yaml,/opt/stacks/diun/compose.override.yaml,com.docker.compose.project.working_dir=/opt/stacks/diun,com.docker.compose.project=diun,com.docker.compose.replace=diun,com.docker.compose.service=diun,com.docker.compose.version=5.1.4,org.opencontainers.image.created=2026-05-30T18:47:22.960Z,org.opencontainers.image.description=Docker image update notifier,org.opencontainers.image.licenses=MIT,org.opencontainers.image.revision=00cf2319392aba30ab6b64c62414a4ba37c7cc15,org.opencontainers.image.source=https://github.com/crazy-max/diun,org.opencontainers.image.title=Diun,org.opencontainers.image.url=https://github.com/crazy-max/diun,org.opencontainers.image.vendor=CrazyMax,org.opencontainers.image.version=4.33.0\",\"LocalVolumes\":\"0\",\"Mounts\":\"/opt/stacks/diâ¦\",\"Names\":\"diun\",\"Networks\":\"diun_default,socket-proxy_net\",\"Platform\":{\"architecture\":\"amd64\",\"os\":\"linux\"},\"Ports\":\"\",\"RunningFor\":\"2 months ago\",\"Size\":\"8.19kB (virtual 64.1MB)\",\"State\":\"running\",\"Status\":\"Up 10 days\"}\n{\"Command\":\"\\\"/docker-entrypoint.â¦\\\"\",\"CreatedAt\":\"2026-06-24 02:59:03 +0300 MSK\",\"HealthStatus\":\"none\",\"ID\":\"be5a2016099c\",\"Image\":\"lscr.io/linuxserver/socket-proxy:latest\",\"Labels\":\"build_version=Linuxserver.io version:- 3.4.0-r0-ls86 Build-date:- 2026-06-22T22:25:56+00:00,com.docker.compose.config-hash=3b8d8d8bde3463398345530d51abdcfd9958c1437cb206f47756dc6e8cf4f5c7,com.docker.compose.container-number=1,com.docker.compose.depends_on=,com.docker.compose.image=sha256:cb30b9c279443b461666dba087975e8efe0ad7af03b7c81c053cdcff9aacd531,com.docker.compose.oneoff=False,com.docker.compose.project.config_files=/opt/stacks/socket-proxy/compose.yaml,com.docker.compose.project.working_dir=/opt/stacks/socket-proxy,com.docker.compose.project=socket-proxy,com.docker.compose.service=socket-proxy,com.docker.compose.version=5.1.4,maintainer=thespad,org.opencontainers.image.authors=linuxserver.io,org.opencontainers.image.created=2026-06-22T22:25:56+00:00,org.opencontainers.image.description=The Socket Proxy is a security-enhanced proxy which allows you to apply access rules to the Docker socket, limiting the attack surface for containers such as watchtower or Traefik that need to use it.,org.opencontainers.image.documentation=https://docs.linuxserver.io/images/docker-socket-proxy,org.opencontainers.image.licenses=GPL-3.0-only,org.opencontainers.image.ref.name=29e6d3bac161139fbcec92195e6489d8481c5d8a,org.opencontainers.image.revision=29e6d3bac161139fbcec92195e6489d8481c5d8a,org.opencontainers.image.source=https://github.com/linuxserver/docker-socket-proxy,org.opencontainers.image.title=Socket-proxy,org.opencontainers.image.url=https://github.com/linuxserver/docker-socket-proxy/packages,org.opencontainers.image.vendor=linuxserver.io,org.opencontainers.image.version=3.4.0-r0-ls86\",\"LocalVolumes\":\"0\",\"Mounts\":\"/var/run/dockeâ¦\",\"Names\":\"socket-proxy\",\"Networks\":\"socket-proxy_net\",\"Platform\":{\"architecture\":\"amd64\",\"os\":\"linux\"},\"Ports\":\"127.0.0.1:2375-\\u003e2375/tcp\",\"RunningFor\":\"2 months ago\",\"Size\":\"4.1kB (virtual 17.8MB)\",\"State\":\"running\",\"Status\":\"Up 10 days\"}\n{\"Command\":\"\\\"/usr/bin/loki -confâ¦\\\"\",\"CreatedAt\":\"2026-06-19 09:04:52 +0300 MSK\",\"HealthStatus\":\"none\",\"ID\":\"dcade174cf88\",\"Image\":\"grafana/loki:3.7.2\",\"Labels\":\"com.docker.compose.config-hash=cb094cfe04a7e62d9ced76e2769a0af7591f073bccf983b136c50faeaec6e82b,com.docker.compose.container-number=1,com.docker.compose.depends_on=,com.docker.compose.image=sha256:191d4fdfb7264f16989f0a57f320872620a5a7c2ceeec6229212c4190ec49b86,com.docker.compose.oneoff=False,com.docker.compose.project.config_files=/opt/stacks/loki-alloy/compose.yaml,com.docker.compose.project.working_dir=/opt/stacks/loki-alloy,com.docker.compose.project=loki-alloy,com.docker.compose.service=loki,com.docker.compose.version=5.1.4\",\"LocalVolumes\":\"0\",\"Mounts\":\"/opt/stacks/loâ¦,/opt/stacks/loâ¦\",\"Names\":\"loki\",\"Networks\":\"loki-alloy_default\",\"Platform\":{\"architecture\":\"amd64\",\"os\":\"linux\"},\"Ports\":\"127.0.0.1:3100-\\u003e3100/tcp\",\"RunningFor\":\"2 months ago\",\"Size\":\"20.5kB (virtual 159MB)\",\"State\":\"running\",\"Status\":\"Up 10 days\"}\n--- NPMPLUS_NETWORK_MODE ---\nhost\n--- NPMPLUS_PORT_BINDINGS ---\n{}\n--- NPMPLUS_NETWORKS ---\n{\"host\":{\"IPAMConfig\":null,\"Links\":null,\"Aliases\":null,\"DriverOpts\":null,\"GwPriority\":0,\"NetworkID\":\"9b6302e2dba8b70ca80be5defcb6b2ce7a26ba68370b07d3e22628255e012b69\",\"EndpointID\":\"08b8ad7cc5c70b46ed3b6f666ae1e439b1474f10e7f75b9db923fd27f02b9b89\",\"Gateway\":\"\",\"IPAddress\":\"\",\"MacAddress\":\"\",\"IPPrefixLen\":0,\"IPv6Gateway\":\"\",\"GlobalIPv6Address\":\"\",\"GlobalIPv6PrefixLen\":0,\"DNSNames\":null}}\n--- NPMPLUS_PORTS ---\n{}\n--- NPMPLUS_MOUNTS ---\n[{\"Type\":\"bind\",\"Source\":\"/opt/npmplus\",\"Destination\":\"/data\",\"Mode\":\"rw\",\"RW\":true,\"Propagation\":\"rprivate\"}]\n--- NGINX_TEST ---\nnginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok\nnginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful\n--- TARGET_ROUTE_PRESTATE ---\nABSENT","rc":0}
EDGE_NAT_FIREWALL_READONLY={"err":"","out":"--- NFT_RULESET ---\n# Warning: table ip filter is managed by iptables-nft, do not touch!\ntable ip filter {\n\tchain FORWARD {\n\t\ttype filter hook forward priority filter; policy accept;\n\t\tcounter packets 2675448 bytes 2070750838 jump DOCKER-USER\n\t\toifname \"wt0\" ct state related,established counter packets 816307 bytes 78122807 accept\n\t\tiifname \"wt0\" counter packets 1159555 bytes 1781321407 accept\n\t\tcounter packets 699586 bytes 211306624 jump DOCKER-FORWARD\n\t}\n\n\tchain DOCKER {\n\t\tip daddr [PRIVATE_IP] iifname != \"br-d41b3e918fbc\" oifname \"br-d41b3e918fbc\" tcp dport 8080 counter packets 0 bytes 0 accept\n\t\tip daddr [PRIVATE_IP] iifname != \"br-5f66e1018bdd\" oifname \"br-5f66e1018bdd\" tcp dport 3100 counter packets 0 bytes 0 accept\n\t\tip daddr [PRIVATE_IP] iifname != \"br-5f66e1018bdd\" oifname \"br-5f66e1018bdd\" tcp dport 12345 counter packets 0 bytes 0 accept\n\t\tip daddr [PRIVATE_IP] iifname != \"br-a4e31561a8d5\" oifname \"br-a4e31561a8d5\" tcp dport 8080 counter packets 0 bytes 0 accept\n\t\tip daddr [PRIVATE_IP] iifname != \"br-a4e31561a8d5\" oifname \"br-a4e31561a8d5\" tcp dport 7422 counter packets 0 bytes 0 accept\n\t\tip daddr [PRIVATE_IP] iifname != \"br-f43db13d76c4\" oifname \"br-f43db13d76c4\" tcp dport 8080 counter packets 0 bytes 0 accept\n\t\tip daddr [PRIVATE_IP] iifname != \"br-915a81681c3e\" oifname \"br-915a81681c3e\" tcp dport 2375 counter packets 0 bytes 0 accept\n\t\tiifname != \"br-4d894f9e427b\" oifname \"br-4d894f9e427b\" counter packets 0 bytes 0 drop\n\t\tiifname != \"br-5f66e1018bdd\" oifname \"br-5f66e1018bdd\" counter packets 0 bytes 0 drop\n\t\tiifname != \"br-8122fec51f39\" oifname \"br-8122fec51f39\" counter packets 0 bytes 0 drop\n\t\tiifname != \"br-915a81681c3e\" oifname \"br-915a81681c3e\" counter packets 0 bytes 0 drop\n\t\tiifname != \"br-a4e31561a8d5\" oifname \"br-a4e31561a8d5\" counter packets 0 bytes 0 drop\n\t\tiifname != \"br-d41b3e918fbc\" oifname \"br-d41b3e918fbc\" counter packets 0 bytes 0 drop\n\t\tiifname != \"br-f43db13d76c4\" oifname \"br-f43db13d76c4\" counter packets 0 bytes 0 drop\n\t\tiifname != \"docker0\" oifname \"docker0\" counter packets 0 bytes 0 drop\n\t}\n\n\tchain DOCKER-FORWARD {\n\t\tcounter packets 699586 bytes 211306624 jump DOCKER-CT\n\t\tcounter packets 699386 bytes 211271811 jump DOCKER-INTERNAL\n\t\tcounter packets 699386 bytes 211271811 jump DOCKER-BRIDGE\n\t\tiifname \"br-4d894f9e427b\" counter packets 0 bytes 0 accept\n\t\tiifname \"br-5f66e1018bdd\" counter packets 0 bytes 0 accept\n\t\tiifname \"br-8122fec51f39\" counter packets 1360 bytes 81600 accept\n\t\tiifname \"br-915a81681c3e\" counter packets 0 bytes 0 accept\n\t\tiifname \"br-a4e31561a8d5\" counter packets 1219 bytes 73140 accept\n\t\tiifname \"br-d41b3e918fbc\" counter packets 0 bytes 0 accept\n\t\tiifname \"br-f43db13d76c4\" counter packets 0 bytes 0 accept\n\t\tiifname \"docker0\" counter packets 305 bytes 21196 accept\n\t}\n\n\tchain DOCKER-BRIDGE {\n\t\toifname \"br-4d894f9e427b\" counter packets 0 bytes 0 jump DOCKER\n\t\toifname \"br-5f66e1018bdd\" counter packets 0 bytes 0 jump DOCKER\n\t\toifname \"br-8122fec51f39\" counter packets 0 bytes 0 jump DOCKER\n\t\toifname \"br-915a81681c3e\" counter packets 0 bytes 0 jump DOCKER\n\t\toifname \"br-a4e31561a8d5\" counter packets 0 bytes 0 jump DOCKER\n\t\toifname \"br-d41b3e918fbc\" counter packets 0 bytes 0 jump DOCKER\n\t\toifname \"br-f43db13d76c4\" counter packets 0 bytes 0 jump DOCKER\n\t\toifname \"docker0\" counter packets 0 bytes 0 jump DOCKER\n\t}\n\n\tchain DOCKER-CT {\n\t\toifname \"br-4d894f9e427b\" ct state related,established counter packets 0 bytes 0 accept\n\t\toifname \"br-5f66e1018bdd\" ct state related,established counter packets 0 bytes 0 accept\n\t\toifname \"br-8122fec51f39\" ct state related,established counter packets 0 bytes 0 accept\n\t\toifname \"br-915a81681c3e\" ct state related,established counter packets 0 bytes 0 accept\n\t\toifname \"br-a4e31561a8d5\" ct state related,established counter packets 0 bytes 0 accept\n\t\toifname \"br-d41b3e918fbc\" ct state related,established counter packets 0 bytes 0 accept\n\t\toifname \"br-f43db13d76c4\" ct state related,established counter packets 0 bytes 0 accept\n\t\toifname \"docker0\" ct state related,established counter packets 200 bytes 34813 accept\n\t}\n\n\tchain DOCKER-INTERNAL {\n\t}\n\n\tchain INPUT {\n\t\ttype filter hook input priority filter; policy accept;\n\t\tiifname != \"lo\" tcp dport 81 counter packets 0 bytes 0 drop\n\t\tip saddr 100.100.0.0/16 iifname \"wt0\" ip protocol tcp tcp dport { 80, 443 } counter packets 1363570 bytes 219857148 accept\n\t\tiifname \"wt0\" counter packets 2153138 bytes 2474069147 accept\n\t}\n\n\tchain DOCKER-USER {\n\t}\n}\n# Warning: table ip nat is managed by iptables-nft, do not touch!\ntable ip nat {\n\tchain POSTROUTING {\n\t\ttype nat hook postrouting priority srcnat; policy accept;\n\t\tip saddr [PRIVATE_IP]/16 oifname != \"docker0\" counter packets 303 bytes 21076 masquerade\n\t\tip saddr [PRIVATE_IP]/20 oifname != \"br-f43db13d76c4\" counter packets 46424 bytes 2785440 masquerade\n\t\tip saddr [PRIVATE_IP]/16 oifname != \"br-d41b3e918fbc\" counter packets 0 bytes 0 masquerade\n\t\tip saddr [PRIVATE_IP]/16 oifname != \"br-a4e31561a8d5\" counter packets 1209 bytes 72540 masquerade\n\t\tip saddr [PRIVATE_IP]/28 oifname != \"br-915a81681c3e\" counter packets 0 bytes 0 masquerade\n\t\tip saddr [PRIVATE_IP]/20 oifname != \"br-8122fec51f39\" counter packets 1316 bytes 78960 masquerade\n\t\tip saddr [PRIVATE_IP]/20 oifname != \"br-5f66e1018bdd\" counter packets 0 bytes 0 masquerade\n\t\tip saddr [PRIVATE_IP]/16 oifname != \"br-4d894f9e427b\" counter packets 0 bytes 0 masquerade\n\t}\n\n\tchain DOCKER {\n\t\tip daddr 127.0.0.1 iifname != \"br-915a81681c3e\" tcp dport 2375 counter packets 0 bytes 0 dnat to [PRIVATE_IP]:2375\n\t\tip daddr 127.0.0.1 iifname != \"br-f43db13d76c4\" tcp dport 8081 counter packets 0 bytes 0 dnat to [PRIVATE_IP]:8080\n\t\tip daddr 127.0.0.1 iifname != \"br-a4e31561a8d5\" tcp dport 7422 counter packets 0 bytes 0 dnat to [PRIVATE_IP]:7422\n\t\tip daddr 127.0.0.1 iifname != \"br-a4e31561a8d5\" tcp dport 8088 counter packets 0 bytes 0 dnat to [PRIVATE_IP]:8080\n\t\tip daddr 127.0.0.1 iifname != \"br-5f66e1018bdd\" tcp dport 12345 counter packets 0 bytes 0 dnat to [PRIVATE_IP]:12345\n\t\tip daddr 127.0.0.1 iifname != \"br-5f66e1018bdd\" tcp dport 3100 counter packets 0 bytes 0 dnat to [PRIVATE_IP]:3100\n\t\tip daddr 127.0.0.1 iifname != \"br-d41b3e918fbc\" tcp dport 9999 counter packets 0 bytes 0 dnat to [PRIVATE_IP]:8080\n\t}\n\n\tchain PREROUTING {\n\t\ttype nat hook prerouting priority dstnat; policy accept;\n\t\tfib daddr type local counter packets 820150 bytes 47865029 jump DOCKER\n\t}\n\n\tchain OUTPUT {\n\t\ttype nat hook output priority dstnat; policy accept;\n\t\tip daddr != 127.0.0.0/8 fib daddr type local counter packets 65665 bytes 4003286 jump DOCKER\n\t}\n}\ntable ip snikket_edge_prod {\n\tchain prerouting {\n\t\ttype nat hook prerouting priority dstnat; policy accept;\n\t\tiifname \"wg-edge01\" ip saddr [PRIVATE_IP] ip daddr [PRIVATE_IP] tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } dnat to [PRIVATE_IP]\n\t\tiifname \"wg-edge01\" ip saddr [PRIVATE_IP] ip daddr [PRIVATE_IP] udp dport { 3478-3479, 5349-5350, 60000-60199 } dnat to [PRIVATE_IP]\n\t}\n\n\tchain postrouting {\n\t\ttype nat hook postrouting priority srcnat; policy accept;\n\t\toifname \"eth0\" ip daddr [PRIVATE_IP] tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } snat to [PRIVATE_IP]\n\t\toifname \"eth0\" ip daddr [PRIVATE_IP] udp dport { 3478-3479, 5349-5350, 60000-60199 } snat to [PRIVATE_IP]\n\t}\n}\n# Warning: table ip6 nat is managed by iptables-nft, do not touch!\ntable ip6 nat {\n\tchain DOCKER {\n\t}\n\n\tchain PREROUTING {\n\t\ttype nat hook prerouting priority dstnat; policy accept;\n\t\tfib daddr type local counter packets 0 bytes 0 jump DOCKER\n\t}\n\n\tchain OUTPUT {\n\t\ttype nat hook output priority dstnat; policy accept;\n\t\tip6 daddr != ::1 fib daddr type local counter packets 0 bytes 0 jump DOCKER\n\t}\n}\n# Warning: table ip6 filter is managed by iptables-nft, do not touch!\ntable ip6 filter {\n\tchain DOCKER {\n\t}\n\n\tchain DOCKER-FORWARD {\n\t\tcounter packets 0 bytes 0 jump DOCKER-CT\n\t\tcounter packets 0 bytes 0 jump DOCKER-INTERNAL\n\t\tcounter packets 0 bytes 0 jump DOCKER-BRIDGE\n\t}\n\n\tchain DOCKER-BRIDGE {\n\t}\n\n\tchain DOCKER-CT {\n\t}\n\n\tchain DOCKER-INTERNAL {\n\t}\n\n\tchain FORWARD {\n\t\ttype filter hook forward priority filter; policy accept;\n\t\tcounter packets 0 bytes 0 jump DOCKER-USER\n\t\toifname \"wt0\" ct state related,established counter packets 0 bytes 0 accept\n\t\tiifname \"wt0\" counter packets 0 bytes 0 accept\n\t\tcounter packets 0 bytes 0 jump DOCKER-FORWARD\n\t}\n\n\tchain INPUT {\n\t\ttype filter hook input priority filter; policy accept;\n\t\tiifname != \"lo\" tcp dport 81 counter packets 0 bytes 0 drop\n\t\tiifname \"wt0\" counter packets 1 bytes 128 accept\n\t}\n\n\tchain DOCKER-USER {\n\t}\n}\ntable ip raw {\n\tchain PREROUTING {\n\t\ttype filter hook prerouting priority raw; policy accept;\n\t\tip daddr [PRIVATE_IP] iifname != \"br-f43db13d76c4\" counter packets 0 bytes 0 drop\n\t\tip daddr [PRIVATE_IP] iifname != \"br-915a81681c3e\" counter packets 0 bytes 0 drop\n\t\tip daddr [PRIVATE_IP] iifname != \"br-a4e31561a8d5\" counter packets 0 bytes 0 drop\n\t\tip daddr [PRIVATE_IP] iifname != \"br-8122fec51f39\" counter packets 0 bytes 0 drop\n\t\tip daddr [PRIVATE_IP] iifname != \"br-5f66e1018bdd\" counter packets 0 bytes 0 drop\n\t\tip daddr [PRIVATE_IP] iifname != \"br-915a81681c3e\" counter packets 0 bytes 0 drop\n\t\tip daddr 127.0.0.1 iifname != \"lo\" tcp dport 2375 counter packets 0 bytes 0 drop\n\t\tip daddr 127.0.0.1 iifname != \"lo\" tcp dport 8081 counter packets 0 bytes 0 drop\n\t\tip daddr [PRIVATE_IP] iifname != \"br-5f66e1018bdd\" counter packets 0 bytes 0 drop\n\t\tip daddr 127.0.0.1 iifname != \"lo\" tcp dport 7422 counter packets 0 bytes 0 drop\n\t\tip daddr 127.0.0.1 iifname != \"lo\" tcp dport 8088 counter packets 0 bytes 0 drop\n\t\tip daddr [PRIVATE_IP] iifname != \"br-915a81681c3e\" counter packets 0 bytes 0 drop\n\t\tip daddr [PRIVATE_IP] iifname != \"br-915a81681c3e\" counter packets 0 bytes 0 drop\n\t\tip daddr 127.0.0.1 iifname != \"lo\" tcp dport 12345 counter packets 0 bytes 0 drop\n\t\tip daddr [PRIVATE_IP] iifname != \"br-915a81681c3e\" counter packets 0 bytes 0 drop\n\t\tip daddr 127.0.0.1 iifname != \"lo\" tcp dport 3100 counter packets 0 bytes 0 drop\n\t\tip daddr [PRIVATE_IP] iifname != \"br-915a81681c3e\" counter packets 0 bytes 0 drop\n\t\tip daddr [PRIVATE_IP] iifname != \"br-d41b3e918fbc\" counter packets 0 bytes 0 drop\n\t\tip daddr 127.0.0.1 iifname != \"lo\" tcp dport 9999 counter packets 0 bytes 0 drop\n\t}\n}\ntable ip netbird {\n\tset nb0000001 {\n\t\ttype ipv4_addr\n\t\tflags dynamic\n\t\telements = { 100.100.7.2, 100.100.19.1,\n\t\t\t     100.100.34.141, 100.100.123.213,\n\t\t\t     100.100.125.70, 100.100.131.41,\n\t\t\t     100.100.147.204, 100.100.178.43,\n\t\t\t     100.100.183.106 }\n\t}\n\n\tchain netbird-rt-fwd {\n\t\tct state established,related counter packets 1159555 bytes 1781321407 accept\n\t}\n\n\tchain netbird-rt-postrouting {\n\t\ttype nat hook postrouting priority srcnat - 1; policy accept;\n\t\tmeta mark 0x0001bd21 oifname != \"lo\" counter packets 0 bytes 0 masquerade\n\t\tmeta mark 0x0001bd22 oifname \"wt0\" counter packets 0 bytes 0 masquerade\n\t}\n\n\tchain netbird-rt-redirect {\n\t\ttype nat hook prerouting priority dstnat; policy accept;\n\t}\n\n\tchain netbird-mangle-postrouting {\n\t\ttype filter hook postrouting priority mangle; policy accept;\n\t\toifname \"wt0\" ct state new ct mark set 0x0001bd11\n\t}\n\n\tchain netbird-mangle-prerouting {\n\t\ttype filter hook prerouting priority mangle; policy accept;\n\t\tiifname \"wt0\" ct state new ct mark set 0x0001bd10\n\t\tiifname \"wt0\" ip saddr @nb0000001 fib daddr type local meta mark set 0x0001bd20\n\t}\n\n\tchain netbird-mangle-forward {\n\t\ttype filter hook forward priority mangle; policy accept;\n\t\toifname \"wt0\" tcp flags syn counter packets 7981 bytes 478860 tcp option maxseg size > 1240 tcp option maxseg size set 1240\n\t}\n\n\tchain netbird-acl-input-rules {\n\t\tct state established,related counter packets 3364801 bytes 2684740651 accept\n\t\tip saddr @nb0000001 accept\n\t}\n\n\tchain netbird-acl-input-filter {\n\t\ttype filter hook input priority filter; policy accept;\n\t\tiifname \"wt0\" jump netbird-acl-input-rules\n\t\tiifname \"wt0\" drop\n\t}\n\n\tchain netbird-acl-forward-filter {\n\t\ttype filter hook forward priority filter; policy accept;\n\t\tmeta mark 0x0001bd20 accept\n\t\tiifname \"wt0\" jump netbird-rt-fwd\n\t\tiifname \"wt0\" drop\n\t}\n\n\tchain netbird-raw-out {\n\t\ttype filter hook output priority raw; policy accept;\n\t\toifname \"lo\" ip saddr 127.0.0.1 ip daddr 127.0.0.1 udp sport 51820 counter packets 17392 bytes 2932576 notrack\n\t\toifname \"lo\" ip saddr 127.0.0.1 ip daddr 127.0.0.1 udp dport 51820 counter packets 41592 bytes 4186812 notrack\n\t}\n\n\tchain netbird-raw-pre {\n\t\ttype filter hook prerouting priority raw; policy accept;\n\t\tiifname \"lo\" ip saddr 127.0.0.1 ip daddr 127.0.0.1 udp dport 51820 counter packets 32743 bytes 2310824 notrack\n\t\tiifname \"lo\" ip saddr 127.0.0.1 ip daddr 127.0.0.1 udp dport 3128 counter packets 17392 bytes 2932576 notrack\n\t}\n}\ntable ip6 netbird {\n\tset nb0000001 {\n\t\ttype ipv6_addr\n\t\tflags dynamic\n\t\telements = { [PRIVATE_IPV6],\n\t\t\t     [PRIVATE_IPV6],\n\t\t\t     [PRIVATE_IPV6],\n\t\t\t     [PRIVATE_IPV6],\n\t\t\t     [PRIVATE_IPV6],\n\t\t\t     [PRIVATE_IPV6],\n\t\t\t     [PRIVATE_IPV6],\n\t\t\t     [PRIVATE_IPV6],\n\t\t\t     [PRIVATE_IPV6] }\n\t}\n\n\tchain netbird-rt-fwd {\n\t\tct state established,related counter packets 0 bytes 0 accept\n\t}\n\n\tchain netbird-rt-postrouting {\n\t\ttype nat hook postrouting priority srcnat - 1; policy accept;\n\t\tmeta mark 0x0001bd21 oifname != \"lo\" counter packets 0 bytes 0 masquerade\n\t\tmeta mark 0x0001bd22 oifname \"wt0\" counter packets 0 bytes 0 masquerade\n\t}\n\n\tchain netbird-rt-redirect {\n\t\ttype nat hook prerouting priority dstnat; policy accept;\n\t}\n\n\tchain netbird-mangle-postrouting {\n\t\ttype filter hook postrouting priority mangle; policy accept;\n\t\toifname \"wt0\" ct state new ct mark set 0x0001bd11\n\t}\n\n\tchain netbird-mangle-prerouting {\n\t\ttype filter hook prerouting priority mangle; policy accept;\n\t\tiifname \"wt0\" ct state new ct mark set 0x0001bd10\n\t\tiifname \"wt0\" ip6 saddr @nb0000001 fib daddr type local meta mark set 0x0001bd20\n\t}\n\n\tchain netbird-mangle-forward {\n\t\ttype filter hook forward priority mangle; policy accept;\n\t\toifname \"wt0\" tcp flags syn counter packets 0 bytes 0 tcp option maxseg size > 1220 tcp option maxseg size set 1220\n\t}\n\n\tchain netbird-acl-input-rules {\n\t\tct state established,related counter packets 1 bytes 128 accept\n\t\tip6 saddr @nb0000001 accept\n\t}\n\n\tchain netbird-acl-input-filter {\n\t\ttype filter hook input priority filter; policy accept;\n\t\tiifname \"wt0\" jump netbird-acl-input-rules\n\t\tiifname \"wt0\" drop\n\t}\n\n\tchain netbird-acl-forward-filter {\n\t\ttype filter hook forward priority filter; policy accept;\n\t\tmeta mark 0x0001bd20 accept\n\t\tiifname \"wt0\" jump netbird-rt-fwd\n\t\tiifname \"wt0\" drop\n\t}\n}\n--- IPTABLES_SAVE ---\n# Generated by iptables-save v1.8.11 (nf_tables) on Tue Sep  8 10:29:09 2026\n*raw\n:PREROUTING ACCEPT [49463194:31228505566]\n:OUTPUT ACCEPT [0:0]\n-A PREROUTING -d [PRIVATE_IP]/32 ! -i br-f43db13d76c4 -j DROP\n-A PREROUTING -d [PRIVATE_IP]/32 ! -i br-915a81681c3e -j DROP\n-A PREROUTING -d [PRIVATE_IP]/32 ! -i br-a4e31561a8d5 -j DROP\n-A PREROUTING -d [PRIVATE_IP]/32 ! -i br-8122fec51f39 -j DROP\n-A PREROUTING -d [PRIVATE_IP]/32 ! -i br-5f66e1018bdd -j DROP\n-A PREROUTING -d [PRIVATE_IP]/32 ! -i br-915a81681c3e -j DROP\n-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 2375 -j DROP\n-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8081 -j DROP\n-A PREROUTING -d [PRIVATE_IP]/32 ! -i br-5f66e1018bdd -j DROP\n-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 7422 -j DROP\n-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 8088 -j DROP\n-A PREROUTING -d [PRIVATE_IP]/32 ! -i br-915a81681c3e -j DROP\n-A PREROUTING -d [PRIVATE_IP]/32 ! -i br-915a81681c3e -j DROP\n-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 12345 -j DROP\n-A PREROUTING -d [PRIVATE_IP]/32 ! -i br-915a81681c3e -j DROP\n-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 3100 -j DROP\n-A PREROUTING -d [PRIVATE_IP]/32 ! -i br-915a81681c3e -j DROP\n-A PREROUTING -d [PRIVATE_IP]/32 ! -i br-d41b3e918fbc -j DROP\n-A PREROUTING -d 127.0.0.1/32 ! -i lo -p tcp -m tcp --dport 9999 -j DROP\nCOMMIT\n# Completed on Tue Sep  8 10:29:09 2026\n# Generated by iptables-save v1.8.11 (nf_tables) on Tue Sep  8 10:29:09 2026\n*filter\n:INPUT ACCEPT [43073477:26402762275]\n:FORWARD ACCEPT [691201:210777815]\n:OUTPUT ACCEPT [0:0]\n:DOCKER - [0:0]\n:DOCKER-BRIDGE - [0:0]\n:DOCKER-CT - [0:0]\n:DOCKER-FORWARD - [0:0]\n:DOCKER-INTERNAL - [0:0]\n:DOCKER-USER - [0:0]\n-A INPUT ! -i lo -p tcp -m tcp --dport 81 -j DROP\n-A INPUT -s 100.100.0.0/16 -i wt0 -p tcp -m multiport --dports 80,443 -j ACCEPT\n-A INPUT -i wt0 -j ACCEPT\n-A FORWARD -j DOCKER-USER\n-A FORWARD -o wt0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\n-A FORWARD -i wt0 -j ACCEPT\n-A FORWARD -j DOCKER-FORWARD\n-A DOCKER -d [PRIVATE_IP]/32 ! -i br-d41b3e918fbc -o br-d41b3e918fbc -p tcp -m tcp --dport 8080 -j ACCEPT\n-A DOCKER -d [PRIVATE_IP]/32 ! -i br-5f66e1018bdd -o br-5f66e1018bdd -p tcp -m tcp --dport 3100 -j ACCEPT\n-A DOCKER -d [PRIVATE_IP]/32 ! -i br-5f66e1018bdd -o br-5f66e1018bdd -p tcp -m tcp --dport 12345 -j ACCEPT\n-A DOCKER -d [PRIVATE_IP]/32 ! -i br-a4e31561a8d5 -o br-a4e31561a8d5 -p tcp -m tcp --dport 8080 -j ACCEPT\n-A DOCKER -d [PRIVATE_IP]/32 ! -i br-a4e31561a8d5 -o br-a4e31561a8d5 -p tcp -m tcp --dport 7422 -j ACCEPT\n-A DOCKER -d [PRIVATE_IP]/32 ! -i br-f43db13d76c4 -o br-f43db13d76c4 -p tcp -m tcp --dport 8080 -j ACCEPT\n-A DOCKER -d [PRIVATE_IP]/32 ! -i br-915a81681c3e -o br-915a81681c3e -p tcp -m tcp --dport 2375 -j ACCEPT\n-A DOCKER ! -i br-4d894f9e427b -o br-4d894f9e427b -j DROP\n-A DOCKER ! -i br-5f66e1018bdd -o br-5f66e1018bdd -j DROP\n-A DOCKER ! -i br-8122fec51f39 -o br-8122fec51f39 -j DROP\n-A DOCKER ! -i br-915a81681c3e -o br-915a81681c3e -j DROP\n-A DOCKER ! -i br-a4e31561a8d5 -o br-a4e31561a8d5 -j DROP\n-A DOCKER ! -i br-d41b3e918fbc -o br-d41b3e918fbc -j DROP\n-A DOCKER ! -i br-f43db13d76c4 -o br-f43db13d76c4 -j DROP\n-A DOCKER ! -i docker0 -o docker0 -j DROP\n-A DOCKER-BRIDGE -o br-4d894f9e427b -j DOCKER\n-A DOCKER-BRIDGE -o br-5f66e1018bdd -j DOCKER\n-A DOCKER-BRIDGE -o br-8122fec51f39 -j DOCKER\n-A DOCKER-BRIDGE -o br-915a81681c3e -j DOCKER\n-A DOCKER-BRIDGE -o br-a4e31561a8d5 -j DOCKER\n-A DOCKER-BRIDGE -o br-d41b3e918fbc -j DOCKER\n-A DOCKER-BRIDGE -o br-f43db13d76c4 -j DOCKER\n-A DOCKER-BRIDGE -o docker0 -j DOCKER\n-A DOCKER-CT -o br-4d894f9e427b -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\n-A DOCKER-CT -o br-5f66e1018bdd -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\n-A DOCKER-CT -o br-8122fec51f39 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\n-A DOCKER-CT -o br-915a81681c3e -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\n-A DOCKER-CT -o br-a4e31561a8d5 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\n-A DOCKER-CT -o br-d41b3e918fbc -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\n-A DOCKER-CT -o br-f43db13d76c4 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\n-A DOCKER-CT -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT\n-A DOCKER-FORWARD -j DOCKER-CT\n-A DOCKER-FORWARD -j DOCKER-INTERNAL\n-A DOCKER-FORWARD -j DOCKER-BRIDGE\n-A DOCKER-FORWARD -i br-4d894f9e427b -j ACCEPT\n-A DOCKER-FORWARD -i br-5f66e1018bdd -j ACCEPT\n-A DOCKER-FORWARD -i br-8122fec51f39 -j ACCEPT\n-A DOCKER-FORWARD -i br-915a81681c3e -j ACCEPT\n-A DOCKER-FORWARD -i br-a4e31561a8d5 -j ACCEPT\n-A DOCKER-FORWARD -i br-d41b3e918fbc -j ACCEPT\n-A DOCKER-FORWARD -i br-f43db13d76c4 -j ACCEPT\n-A DOCKER-FORWARD -i docker0 -j ACCEPT\nCOMMIT\n# Completed on Tue Sep  8 10:29:09 2026\n# Generated by iptables-save v1.8.11 (nf_tables) on Tue Sep  8 10:29:09 2026\n*nat\n:PREROUTING ACCEPT [1025145:106645986]\n:INPUT ACCEPT [0:0]\n:OUTPUT ACCEPT [2348164:144047289]\n:POSTROUTING ACCEPT [2302599:141328613]\n:DOCKER - [0:0]\n-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER\n-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER\n-A POSTROUTING -s [PRIVATE_IP]/16 ! -o docker0 -j MASQUERADE\n-A POSTROUTING -s [PRIVATE_IP]/20 ! -o br-f43db13d76c4 -j MASQUERADE\n-A POSTROUTING -s [PRIVATE_IP]/16 ! -o br-d41b3e918fbc -j MASQUERADE\n-A POSTROUTING -s [PRIVATE_IP]/16 ! -o br-a4e31561a8d5 -j MASQUERADE\n-A POSTROUTING -s [PRIVATE_IP]/28 ! -o br-915a81681c3e -j MASQUERADE\n-A POSTROUTING -s [PRIVATE_IP]/20 ! -o br-8122fec51f39 -j MASQUERADE\n-A POSTROUTING -s [PRIVATE_IP]/20 ! -o br-5f66e1018bdd -j MASQUERADE\n-A POSTROUTING -s [PRIVATE_IP]/16 ! -o br-4d894f9e427b -j MASQUERADE\n-A DOCKER -d 127.0.0.1/32 ! -i br-915a81681c3e -p tcp -m tcp --dport 2375 -j DNAT --to-destination [PRIVATE_IP]:2375\n-A DOCKER -d 127.0.0.1/32 ! -i br-f43db13d76c4 -p tcp -m tcp --dport 8081 -j DNAT --to-destination [PRIVATE_IP]:8080\n-A DOCKER -d 127.0.0.1/32 ! -i br-a4e31561a8d5 -p tcp -m tcp --dport 7422 -j DNAT --to-destination [PRIVATE_IP]:7422\n-A DOCKER -d 127.0.0.1/32 ! -i br-a4e31561a8d5 -p tcp -m tcp --dport 8088 -j DNAT --to-destination [PRIVATE_IP]:8080\n-A DOCKER -d 127.0.0.1/32 ! -i br-5f66e1018bdd -p tcp -m tcp --dport 12345 -j DNAT --to-destination [PRIVATE_IP]:12345\n-A DOCKER -d 127.0.0.1/32 ! -i br-5f66e1018bdd -p tcp -m tcp --dport 3100 -j DNAT --to-destination [PRIVATE_IP]:3100\n-A DOCKER -d 127.0.0.1/32 ! -i br-d41b3e918fbc -p tcp -m tcp --dport 9999 -j DNAT --to-destination [PRIVATE_IP]:8080\nCOMMIT\n# Completed on Tue Sep  8 10:29:09 2026\n--- IP_FORWARD ---\nnet.ipv4.ip_forward = 1","rc":0}
EDGE_LOCAL_REFERENCE_PROBES={"err":"","out":"--- HOST_LOCAL_GIT_CURL ---\nHTTP=200\n--- HOST_LOCAL_GIT_CERT ---\nsubject=CN=git.gram1.ru\nissuer=C=US, O=Let's Encrypt, CN=YE1\nserial=05499CF6D49C49CDFC8DBF28C4B9F9FBC55A\nX509v3 Subject Alternative Name: \n    DNS:git.gram1.ru\n--- CONTAINER_LOCAL_GIT_CURL ---\nHTTP=200\n--- CONTAINER_LOCAL_GIT_CERT ---\nsubject=CN=git.gram1.ru\nissuer=C=US, O=Let's Encrypt, CN=YE1\nserial=05499CF6D49C49CDFC8DBF28C4B9F9FBC55A\nX509v3 Subject Alternative Name: \n    DNS:git.gram1.ru","rc":0}
EDGE_PUBLIC_HAIRPIN_PROBES={"err":"","out":"{\"git.gram1.ru\":{\"rc\":0,\"http\":\"200\",\"err\":\"\"},\"newfi-staging.gram1.ru\":{\"rc\":60,\"http\":\"000\",\"err\":\"curl: (60) SSL: no alternative certificate subject name matches target hostname 'newfi-staging.gram1.ru'\\nMore details here: https://curl.se/docs/sslcerts.html\\n\\ncurl failed to verify the legitimacy of the server and therefore could not\\nestablish a secure connection to it. To learn more about this situation and\\nhow to fix it, please visit the webpage mentioned above.\\n\"}}","rc":0}
FINAL_DECISION=INGRESS_FORENSIC2_COMPLETE_NO_MUTATION
FORENSIC2_END=true

OUTPUT_END
CHAT_OUTPUT_END
