CHAT_OUTPUT_BEGIN
COMMAND_ID=SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1
STATUS=OK
RC=0
HOST=pve01
MODE=read-only
COMPONENT=spb-home-wan-router-snikket-audit
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
COMMAND_SHA256=e8cf489f5c96585a16ddf42ca05d7f8f60a72b6f41cb180c370c54028398971a
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=ab2409f5a0b922cddc2c05b1fa06f012701bfee81045a413e48a6f9ef4f8cab4
SANITIZED_OUTPUT_SHA256=ab2409f5a0b922cddc2c05b1fa06f012701bfee81045a413e48a6f9ef4f8cab4
OUTPUT_BEGIN
WAN9213_BEGIN=true
MODE=READ_ONLY_TRUE_WAN_ROUTER_SNIKKET_AUDIT
MUTATION_BOUNDARY=NONE;NO_ROUTER_WRITE;NO_SPB_WRITE;NO_GUEST_WRITE;NO_DNS_WRITE;NO_SHUTDOWN
LOCAL9209_BEGIN=true
CID=SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1
PLINK_PRESENT=true
SPB_CANDIDATE_COUNT=1
SPB_CANDIDATE_SHA16=6d6149f42864ce03
HOME_CANDIDATE_COUNT=1
HOME_CANDIDATE_SHA16=bc517b4af3298846
SPB_HASH_MATCH=true
SPB_PINNED_PROBE_RC=0
DPAPI_DECRYPTABLE_COUNT=1
OLD9208_LOCAL_ERR_SHA16=5a00a4ad6f6ef637
LOCAL_ACCESS_STATUS=PASS
LOCAL9209_END=true
SPB_PINNED_ACCESS=PASS
SPB_EXTRACT_RC=0
PVE_TRUE_WAN_AUDIT_RC=0
VM130_QGA_TRANSPORT_RC=0
VM150_QGA_TRANSPORT_RC=0
SPB_TRUE_WAN_PROBE_RC=0
TRUE_WAN9213={"dns":{"chat.gram1.ru":{"1.1.1.1":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]},"8.8.8.8":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]}},"git.gram1.ru":{"1.1.1.1":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]},"8.8.8.8":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]}},"groups.chat.gram1.ru":{"1.1.1.1":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]},"8.8.8.8":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]}},"share.chat.gram1.ru":{"1.1.1.1":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]},"8.8.8.8":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]}}},"evidence":[{"line":234,"text":"- WAN DHCP observed in router log: <IP:26ac437d63a8bcf2>, gateway <IP:29948130c37b10e3>."},{"line":315,"text":"### NAT / port forwarding"},{"line":316,"text":"- ISP tcp/80 -> bc:24:11:e1:f3:3c, NPMplus."},{"line":317,"text":"- ISP tcp/443 -> bc:24:11:e1:f3:3c, NPMplus."},{"line":318,"text":"- ISP tcpudp/3478 -> bc:24:11:e1:9a:25, Nextcloud Talk TURN."},{"line":319,"text":"- Home tcp/51820 -> bc:24:11:f4:c5:d8, WireGuard vpn1."},{"line":378,"text":"- WireGuard port: 51820."},{"line":683,"text":"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, <IP:bc517b4af3298846>."},{"line":684,"text":"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on <IP:4e29a2729bbc4066>."},{"line":685,"text":"- Router forwards Home TCP/51820 to WireGuard host <IP:6e3573c5557733db>."},{"line":1356,"text":"- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm <IP:bc517b4af3298846>."},{"line":1420,"text":"- Router forwards TCP/UDP 3478 to Nextcloud <IP:4e29a2729bbc4066>."},{"line":1421,"text":"- Router forwards TCP/UDP 51820 for WireGuard on the Home bridge, not to edge-vm."}],"router":{"artifact_hits":[{"basename":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","path_sha16":"7c0a71546dbaf313"},{"basename":"31_HOMELAB_REFERENCE.md","path_sha16":"b6a8564938774058"},{"basename":"HOMELAB_FULL_HANDOFF_CURRENT.md","path_sha16":"aff2edacfd1256cd"},{"basename":"HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z","path_sha16":"36bb80fe9818f709"},{"basename":"HOMELAB_ASSISTANT_ERROR_REGISTER.md","path_sha16":"035234526670966e"},{"basename":"HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-proof-repair-20260630T215529Z","path_sha16":"4cddf80b93b25b32"}],"gateway_sha16":"4f9da1283166a1e9","ports":{"22":"TIMEOUT","23":"TIMEOUT","2323":"TIMEOUT","443":"TIMEOUT","80":"TIMEOUT"}},"wan":{"hashes":["26ac437d63a8bcf2"],"source_count":2,"unique_count":1}}
VM130_EDGE_AUDIT={"addresses":[{"iface":"lo","is_egress_source":false,"is_target":false,"sha16":"12ca17b49af22894"},{"iface":"eth0","is_egress_source":false,"is_target":false,"sha16":"bc517b4af3298846"},{"iface":"wg-taftauto","is_egress_source":false,"is_target":false,"sha16":"d1d4b6abdd6b1971"},{"iface":"wg-edge01","is_egress_source":false,"is_target":true,"sha16":"0b7870e2230336f5"},{"iface":"br-4d894f9e427b","is_egress_source":false,"is_target":false,"sha16":"fbd57f0145e15cc8"},{"iface":"br-5f66e1018bdd","is_egress_source":false,"is_target":false,"sha16":"5db063f47c3859a0"},{"iface":"br-8122fec51f39","is_egress_source":false,"is_target":false,"sha16":"93449cac351e054d"},{"iface":"docker0","is_egress_source":false,"is_target":false,"sha16":"346840d5a3d9fe9b"},{"iface":"br-915a81681c3e","is_egress_source":false,"is_target":false,"sha16":"bc41ed840e460923"},{"iface":"br-a4e31561a8d5","is_egress_source":false,"is_target":false,"sha16":"c138df8d3b53b190"},{"iface":"br-d41b3e918fbc","is_egress_source":false,"is_target":false,"sha16":"f9bcbcb71ab0bfd4"},{"iface":"br-f43db13d76c4","is_egress_source":false,"is_target":false,"sha16":"885dfc9b72d2209e"}],"config_hits":[{"basename":"cloud-init-network.service","lines":[{"line":28,"text":"# stage can start, and then wait on a return socket until the cloud-init"},{"line":29,"text":"# process has completed this stage. The output from the return socket is piped"},{"line":32,"text":"ExecStart=sh -c 'echo \"start\" | nc -Uu -W1 /run/cloud-init/share/network.sock -s /run/cloud-init/share/network-return.sock | sh'"}],"path_sha16":"d00cb9850586513a"},{"basename":"snikket-edge-ingress.nft","lines":[{"line":1,"text":"table ip snikket_edge_prod {"},{"line":4,"text":"        iifname \"wg-edge01\" ip saddr <IP:6b522461298cdde4> ip daddr <IP:0b7870e2230336f5> tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } dnat to <IP:4e29a2729bbc4066>"},{"line":5,"text":"        iifname \"wg-edge01\" ip saddr <IP:6b522461298cdde4> ip daddr <IP:0b7870e2230336f5> udp dport { 3478-3479, 5349-5350, 60000-60199 } dnat to <IP:4e29a2729bbc4066>"},{"line":9,"text":"        oifname \"eth0\" ip daddr <IP:4e29a2729bbc4066> tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } snat to <IP:bc517b4af3298846>"},{"line":10,"text":"        oifname \"eth0\" ip daddr <IP:4e29a2729bbc4066> udp dport { 3478-3479, 5349-5350, 60000-60199 } snat to <IP:bc517b4af3298846>"}],"path_sha16":"70fb445de6996d23"},{"basename":"p2-22-health-surface-response-validation-return-packet-20260626T023040Z.json","lines":[{"line":128,"text":"  \"return_packet_flow\": ["},{"line":160,"text":"  \"return_rows\": ["},{"line":178,"text":"      \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":215,"text":"      \"return_row_id\": \"P2_22_RETURN_ROW_01\","},{"line":241,"text":"      \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":278,"text":"      \"return_row_id\": \"P2_22_RETURN_ROW_02\","},{"line":304,"text":"      \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":341,"text":"      \"return_row_id\": \"P2_22_RETURN_ROW_03\","},{"line":367,"text":"      \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":404,"text":"      \"return_row_id\": \"P2_22_RETURN_ROW_04\","},{"line":430,"text":"      \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":467,"text":"      \"return_row_id\": \"P2_22_RETURN_ROW_05\","},{"line":493,"text":"      \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":530,"text":"      \"return_row_id\": \"P2_22_RETURN_ROW_06\","},{"line":556,"text":"      \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":593,"text":"      \"return_row_id\": \"P2_22_RETURN_ROW_07\","},{"line":619,"text":"      \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":656,"text":"      \"return_row_id\": \"P2_22_RETURN_ROW_08\","},{"line":682,"text":"      \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":719,"text":"      \"return_row_id\": \"P2_22_RETURN_ROW_09\","}],"path_sha16":"fe6950b250508445"},{"basename":"p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json","lines":[{"line":348,"text":"          \"Monitor proxy reachability and verify no direct socket mounts return for migrated clients.\""}],"path_sha16":"8733d16ab518b1f6"},{"basename":"p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json","lines":[{"line":217,"text":"        \"Monitor proxy reachability and verify no direct socket mounts return for migrated clients.\""}],"path_sha16":"048ed578a90e647c"},{"basename":"composer.py","lines":[{"line":22,"text":"        return not self.check_event(StreamEndEvent)"},{"line":27,"text":"            return self.compose_document()"},{"line":48,"text":"        return document"},{"line":61,"text":"        return node"},{"line":70,"text":"            return self.anchors[anchor]"},{"line":86,"text":"        return node"},{"line":97,"text":"        return node"},{"line":115,"text":"        return node"},{"line":138,"text":"        return node"}],"path_sha16":"c73308fe0d2115d3"},{"basename":"composer.py","lines":[{"line":22,"text":"        return not self.check_event(StreamEndEvent)"},{"line":27,"text":"            return self.compose_document()"},{"line":48,"text":"        return document"},{"line":61,"text":"        return node"},{"line":70,"text":"            return self.anchors[anchor]"},{"line":86,"text":"        return node"},{"line":97,"text":"        return node"},{"line":115,"text":"        return node"},{"line":138,"text":"        return node"}],"path_sha16":"7d17ddfec624c826"}],"docker":[{"image_sha16":"5aa369fb5eaf7c46","name":"kopia","ports_safe":""},{"image_sha16":"8112a294af79d305","name":"homelab-registry-cache","ports_safe":""},{"image_sha16":"ef95d2f35b4f5848","name":"npmplus","ports_safe":""},{"image_sha16":"31e555942da7f897","name":"crowdsec","ports_safe":"<IP:12ca17b49af22894>:7422->7422/tcp, <IP:12ca17b49af22894>:8088->8080/tcp"},{"image_sha16":"cdfb05c4b7a8150a","name":"dozzle","ports_safe":"<IP:12ca17b49af22894>:9999->8080/tcp"},{"image_sha16":"f4704b71a591a53d","name":"cadvisor","ports_safe":"<IP:12ca17b49af22894>:8081->8080/tcp"},{"image_sha16":"4a0705d1136ed8bf","name":"alloy","ports_safe":"<IP:12ca17b49af22894>:12345->12345/tcp"},{"image_sha16":"5ef8646c3bb0fb15","name":"diun","ports_safe":""},{"image_sha16":"33d259476c8fec4b","name":"socket-proxy","ports_safe":"<IP:12ca17b49af22894>:2375->2375/tcp"},{"image_sha16":"1ad7e04d49dec6a4","name":"loki","ports_safe":"<IP:12ca17b49af22894>:3100->3100/tcp"}],"egress_source_owned":false,"hostname":"edge-vm","listeners":[{"port":53,"process":"systemd-resolve","proto":"udp"},{"port":53,"process":"systemd-resolve","proto":"udp"},{"port":51824,"process":"","proto":"udp"},{"port":5355,"process":"systemd-resolve","proto":"udp"},{"port":55808,"process":"","proto":"udp"},{"port":51824,"process":"","proto":"udp"},{"port":5355,"process":"systemd-resolve","proto":"udp"},{"port":55808,"process":"","proto":"udp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":22,"process":"sshd","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":53,"process":"systemd-resolve","proto":"tcp"},{"port":12345,"process":"docker-proxy","proto":"tcp"},{"port":18083,"process":"python3","proto":"tcp"},{"port":18091,"process":"python3","proto":"tcp"},{"port":18092,"process":"python3","proto":"tcp"},{"port":9221,"process":"python3","proto":"tcp"},{"port":8081,"process":"docker-proxy","proto":"tcp"},{"port":8088,"process":"docker-proxy","proto":"tcp"},{"port":8014,"process":"python3","proto":"tcp"},{"port":7422,"process":"docker-proxy","proto":"tcp"},{"port":9050,"process":"tor","proto":"tcp"},{"port":53,"process":"systemd-resolve","proto":"tcp"},{"port":81,"process":"nginx","proto":"tcp"},{"port":81,"process":"nginx","proto":"tcp"},{"port":81,"process":"nginx","proto":"tcp"},{"port":81,"process":"nginx","proto":"tcp"},{"port":9999,"process":"docker-proxy","proto":"tcp"},{"port":18088,"process":"python3","proto":"tcp"},{"port":18089,"process":"python3","proto":"tcp"},{"port":18090,"process":"python3","proto":"tcp"},{"port":18093,"process":"python3","proto":"tcp"},{"port":5355,"process":"systemd-resolve","proto":"tcp"},{"port":9221,"process":"pve_exporter","proto":"tcp"},{"port":51515,"process":"kopia","proto":"tcp"},{"port":2375,"process":"docker-proxy","proto":"tcp"},{"port":5000,"process":"registry","proto":"tcp"},{"port":3100,"process":"docker-proxy","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":22,"process":"sshd","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":5355,"process":"systemd-resolve","proto":"tcp"}],"nft":["table ip snikket_edge_prod {","iifname \"wg-edge01\" ip saddr <IP:6b522461298cdde4> ip daddr <IP:0b7870e2230336f5> tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } dnat to <IP:4e29a2729bbc4066>","iifname \"wg-edge01\" ip saddr <IP:6b522461298cdde4> ip daddr <IP:0b7870e2230336f5> udp dport { 3478-3479, 5349-5350, 60000-60199 } dnat to <IP:4e29a2729bbc4066>","oifname \"eth0\" ip daddr <IP:4e29a2729bbc4066> tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } snat to <IP:bc517b4af3298846>","oifname \"eth0\" ip daddr <IP:4e29a2729bbc4066> udp dport { 3478-3479, 5349-5350, 60000-60199 } snat to <IP:bc517b4af3298846>"],"routes":["default dev wg-edge01 table 17777 scope link ","default via <IP:4f9da1283166a1e9> dev eth0 proto static ","<IP:a809b83c24e7478a> dev wg-taftauto proto kernel scope link src <IP:d1d4b6abdd6b1971> ","<IP:fe92bd49514e59d4> dev wg-edge01 proto kernel scope link src <IP:0b7870e2230336f5> ","local <IP:d1d4b6abdd6b1971> dev wg-taftauto table local proto kernel scope host src <IP:d1d4b6abdd6b1971> ","broadcast <IP:ba034a9f5ec6d761> dev wg-taftauto table local proto kernel scope link src <IP:d1d4b6abdd6b1971> ","local <IP:0b7870e2230336f5> dev wg-edge01 table local proto kernel scope host src <IP:0b7870e2230336f5> ","broadcast <IP:29b632df2dc14d2f> dev wg-edge01 table local proto kernel scope link src <IP:0b7870e2230336f5> ","multicast ff00::/8 dev wg-edge01 table local proto kernel metric 256 pref medium","multicast ff00::/8 dev wg-taftauto table local proto kernel metric 256 pref medium"],"target_owned":true,"uid":0}
VM150_SNIKKET_AUDIT={"addresses":[{"iface":"lo","is_egress_source":false,"is_target":false,"sha16":"12ca17b49af22894"},{"iface":"eth0","is_egress_source":true,"is_target":false,"sha16":"4e29a2729bbc4066"},{"iface":"docker0","is_egress_source":false,"is_target":false,"sha16":"346840d5a3d9fe9b"}],"config_hits":[{"basename":"docker-compose.yml","lines":[{"line":4,"text":"  snikket_proxy:"},{"line":5,"text":"    container_name: snikket-proxy"},{"line":6,"text":"    image: snikket/snikket-web-proxy@sha256:e2c22746c19489d2723c6ccebb15f2f14e4e35431cabbc7318d9ee33a48566e1"},{"line":7,"text":"    env_file: snikket.conf"},{"line":10,"text":"      - snikket_data:/snikket"},{"line":13,"text":"  snikket_certs:"},{"line":14,"text":"    container_name: snikket-certs"},{"line":15,"text":"    image: snikket/snikket-cert-manager@sha256:3920d6d6ad0ff7775d80fba034cf08fe246ff3548f192621cf3be6366a17d530"},{"line":17,"text":"    env_file: snikket.conf"},{"line":19,"text":"      - snikket_data:/snikket"},{"line":22,"text":"  snikket_portal:"},{"line":23,"text":"    container_name: snikket-portal"},{"line":24,"text":"    image: snikket/snikket-web-portal@sha256:d67ff498c44bcabc6eee0379d030870004cc37ccf445aa5450d891d4ce02e136"},{"line":26,"text":"    env_file: snikket.conf"},{"line":29,"text":"  snikket_server:"},{"line":30,"text":"    container_name: snikket"},{"line":31,"text":"    image: snikket/snikket-server@sha256:311c076e06ec0fdb182900577a936cdc8d15da50bcc6ccd6707b743a13a162f3"},{"line":34,"text":"      - snikket_data:/snikket"},{"line":35,"text":"    env_file: snikket.conf"},{"line":40,"text":"  snikket_data:"}],"path_sha16":"469462f29cd9bad5"},{"basename":"snikket.conf","lines":[{"line":1,"text":"SNIKKET_DOMAIN=chat.gram1.ru"},{"line":2,"text":"SNIKKET_ADMIN_EMAIL=noreply@pvepro.ru"},{"line":3,"text":"SNIKKET_TWEAK_TURNSERVER_MIN_PORT=60000"},{"line":4,"text":"SNIKKET_TWEAK_TURNSERVER_MAX_PORT=60199"},{"line":6,"text":"SNIKKET_TWEAK_TURNSERVER_INTERNAL_IP=<IP:4e29a2729bbc4066>"}],"path_sha16":"82259917e6cb2726"},{"basename":"docker-compose.override.yml","lines":[{"line":2,"text":"  snikket_server:"},{"line":8,"text":"        source: /etc/snikket/turnfix/coturn-run"},{"line":9,"text":"        target: /etc/sv/coturn/run"},{"line":12,"text":"        source: /etc/snikket/turnfix/coturn-run.upstream"},{"line":13,"text":"        target: /etc/sv/coturn/run.upstream"}],"path_sha16":"370d0aff3f71ce75"},{"basename":"coturn-run","lines":[{"line":3,"text":"CRT=\"$CERTDIR/$SNIKKET_DOMAIN_ASCII.crt\""},{"line":4,"text":"KEY=\"$CERTDIR/$SNIKKET_DOMAIN_ASCII.key\""},{"line":10,"text":"chgrp turnserver \"$CERTDIR\" \"$CRT\" \"$KEY\""},{"line":15,"text":"sed -i 's#^userdb=/snikket/prosody/turndb$#userdb=/var/lib/turn/turndb#' /etc/turnserver.conf"},{"line":16,"text":"install -d -o turnserver -g turnserver -m 0775 /var/lib/turn"},{"line":18,"text":"exec /etc/sv/coturn/run.upstream"}],"path_sha16":"b77d42082a9cc138"},{"basename":"coturn-run.upstream","lines":[{"line":3,"text":"if [ \"$SNIKKET_TWEAK_TURNSERVER\" = \"0\" ]; then"},{"line":4,"text":"\techo \"TURN server disabled by environment, not launching.\";"},{"line":8,"text":"CERTFILE=\"/etc/prosody/certs/$SNIKKET_DOMAIN_ASCII.crt\";"},{"line":9,"text":"KEYFILE=\"/etc/prosody/certs/$SNIKKET_DOMAIN_ASCII.key\";"},{"line":17,"text":"TURN_EXTERNAL_IP=\"$(snikket-turn-addresses \"$SNIKKET_DOMAIN_ASCII\")\""},{"line":19,"text":"min_port=\"${SNIKKET_TWEAK_TURNSERVER_MIN_PORT:-49152}\""},{"line":20,"text":"max_port=\"${SNIKKET_TWEAK_TURNSERVER_MAX_PORT:-65535}\""},{"line":22,"text":"exec s6-setuidgid turnserver /usr/bin/turnserver -c /etc/turnserver.conf --prod \\"},{"line":23,"text":"     --static-auth-secret=<REDACTED> /snikket/prosody/turn-auth-secret-v2)\" \\"},{"line":24,"text":"     --cert=\"$CERTFILE\" --pkey \"$KEYFILE\" -r \"$SNIKKET_DOMAIN_ASCII\" \\"},{"line":26,"text":"     --listening-port \"${SNIKKET_TWEAK_TURNSERVER_PORT-3478}\" \\"},{"line":27,"text":"     -X \"$TURN_EXTERNAL_IP\""}],"path_sha16":"b6e1eb9791801900"},{"basename":"snikket-edge-egress.service","lines":[{"line":2,"text":"Description=Snikket Internet egress via edge-vm"}],"path_sha16":"ff8de9e3bc6968cf"},{"basename":"snikket-turn-reconcile.service","lines":[{"line":2,"text":"Description=Reconcile Snikket TURN certificate permissions and listeners"},{"line":8,"text":"ExecStart=/usr/local/sbin/snikket-turn-reconcile"}],"path_sha16":"b3c0283f7af1bd61"},{"basename":"snikket-turn-reconcile.timer","lines":[{"line":2,"text":"Description=Periodic Snikket TURN durability reconciliation"},{"line":9,"text":"Unit=snikket-turn-reconcile.service"}],"path_sha16":"130e65f40043e8f2"},{"basename":"snikket-turn-reconcile.timer","lines":[{"line":2,"text":"Description=Periodic Snikket TURN durability reconciliation"},{"line":9,"text":"Unit=snikket-turn-reconcile.service"}],"path_sha16":"e9b69f6136ce9691"},{"basename":"cloud-init-network.service","lines":[{"line":28,"text":"# stage can start, and then wait on a return socket until the cloud-init"},{"line":29,"text":"# process has completed this stage. The output from the return socket is piped"},{"line":32,"text":"ExecStart=sh -c 'echo \"start\" | nc -Uu -W1 /run/cloud-init/share/network.sock -s /run/cloud-init/share/network-return.sock | sh'"}],"path_sha16":"d00cb9850586513a"},{"basename":"snikket-edge-egress.service","lines":[{"line":2,"text":"Description=Snikket Internet egress via edge-vm"}],"path_sha16":"01d7d6f52fe7a474"}],"docker":[{"image_sha16":"0c2eab14269992f7","name":"snikket","ports_safe":""},{"image_sha16":"196c632b7cd3d6fe","name":"snikket-portal","ports_safe":""},{"image_sha16":"afdc9a1e6d2b82c1","name":"snikket-certs","ports_safe":""},{"image_sha16":"f2e47aabc41c5e2d","name":"snikket-proxy","ports_safe":""}],"egress_source_owned":true,"hostname":"snikket","listeners":[{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":53,"process":"systemd-resolve","proto":"udp"},{"port":53,"process":"systemd-resolve","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5355,"process":"systemd-resolve","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5355,"process":"systemd-resolve","proto":"udp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5280,"process":"lua5.4","proto":"tcp"},{"port":46313,"process":"containerd","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":53,"process":"systemd-resolve","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":53,"process":"systemd-resolve","proto":"tcp"},{"port":5765,"process":"hypercorn","proto":"tcp"},{"port":22,"process":"sshd","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":5000,"process":"lua5.4","proto":"tcp"},{"port":5223,"process":"lua5.4","proto":"tcp"},{"port":5222,"process":"lua5.4","proto":"tcp"},{"port":5269,"process":"lua5.4","proto":"tcp"},{"port":5355,"process":"systemd-resolve","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":22,"process":"sshd","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":5280,"process":"lua5.4","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":5000,"process":"lua5.4","proto":"tcp"},{"port":5223,"process":"lua5.4","proto":"tcp"},{"port":5222,"process":"lua5.4","proto":"tcp"},{"port":5269,"process":"lua5.4","proto":"tcp"},{"port":5355,"process":"systemd-resolve","proto":"tcp"}],"nft":[],"routes":["default via <IP:4f9da1283166a1e9> dev eth0 proto static ","<IP:b648532ec9f5b7d9> dev eth0 proto kernel scope link src <IP:4e29a2729bbc4066> ","local <IP:4e29a2729bbc4066> dev eth0 table local proto kernel scope host src <IP:4e29a2729bbc4066> ","broadcast <IP:0a8d9c215ba2ebf5> dev eth0 table local proto kernel scope link src <IP:4e29a2729bbc4066> "],"target_owned":false,"uid":0}
SPB_TO_TRUE_WAN_PROBE={"tcp":{"3478":"TIMEOUT","3479":"TIMEOUT","443":"OPEN","5000":"TIMEOUT","5222":"TIMEOUT","5349":"TIMEOUT","5350":"TIMEOUT","80":"OPEN"},"udp_stun":{"3478":{"ok":false,"result":"TIMEOUT"},"3479":{"ok":false,"result":"TIMEOUT"}},"wan_sha16":"26ac437d63a8bcf2"}
TRUE_WAN_CONSENSUS=true
TRUE_WAN_SHA16=26ac437d63a8bcf2
ROUTER_MANAGEMENT_OPEN_PORTS=
ROUTER_AUTOMATION_ARTIFACT_COUNT=6
PUBLIC_CHAT_DNS_ALREADY_HOME_WAN=false
VM130_OWNS_SNIKKET_DNAT_TARGET=true
VM150_OWNS_SNIKKET_DNAT_TARGET=false
VM130_OWNS_SNIKKET_EGRESS_SOURCE=false
VM150_OWNS_SNIKKET_EGRESS_SOURCE=true
VM130_REQUIRED_LISTENER_COUNT=1
VM150_REQUIRED_LISTENER_COUNT=6
TRUE_WAN_TCP_OPEN_COUNT=2
TRUE_WAN_STUN_OK_COUNT=0
NEXT_ACTION=BUILD_ROUTER_SNIKKET_NAT_MIGRATION_FROM_PROVEN_TOPOLOGY
TASK_COMPLETE=true
TASK_RESULT=PASS_SPB_HOME_WAN_ROUTER_SNIKKET_AUDIT
DECISION=READ_EXACT_9213_THEN_BUILD_ROUTER_MIGRATION_ONLY_FROM_PROVEN_TOPOLOGY
NEXT_GATE=EXACT_9213_TRUE_WAN_ROUTER_SNIKKET
HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}

OUTPUT_END
CHAT_OUTPUT_END
