CHAT_OUTPUT_BEGIN
COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-MAP30
STATUS=OK
RC=0
HOST=pve01
MODE=read-only
COMPONENT=newfi-stagingedge-public-ingress-trust-map-readonly
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
COMMAND_SHA256=436785a925d06f61d21e9be0e8066d4526bf56d00ec9be281942c9e1ae4eead3
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=485b29398e8eb5737271b17c773d9f955e991d8df921f5ec38e36c61ba02f1fa
SANITIZED_OUTPUT_SHA256=806f0c25261bffd91398a8b09f3374f58bc99fa759567a15539f3d715003bd8d
OUTPUT_BEGIN
MAP30_BEGIN=true
COMMAND_ID=NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-MAP30
MODE=read-only
MUTATIONS_PERFORMED=NO
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
REFERENCE_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
RUNNER_SHA_MATCH=true
PUBLIC_IP_SHA_MATCH=true
TRUSTED_EDGEVM_MARKER=true
PUBLIC_VPS_REJECT_MARKER=true
AUTHORITY_EVIDENCE_COUNT=61
AUTHORITY_EVIDENCE_JSON=[{"file":"31_HOMELAB_REFERENCE.md","line":672,"text":"- git.gram1.ru -> [PRIVATE_IP]."},{"file":"31_HOMELAB_REFERENCE.md","line":705,"text":"- git.gram1.ru -> http://127.0.0.1:3002, cert=29, ssl_forced=1, enabled=1."},{"file":"31_HOMELAB_REFERENCE.md","line":754,"text":"- cert=29: git.gram1.ru, expires 2026-09-13 17:36:55."},{"file":"31_HOMELAB_REFERENCE.md","line":774,"text":"- Public ingress terminates through NPMplus on ports 80/443."},{"file":"31_HOMELAB_REFERENCE.md","line":864,"text":"- NPMplus public ingress: 0.0.0.0:80 and 0.0.0.0:443."},{"file":"31_HOMELAB_REFERENCE.md","line":1058,"text":"- https://git.gram1.ru"},{"file":"31_HOMELAB_REFERENCE.md","line":1114,"text":"- external canary checks include nc.gram1.ru, git.gram1.ru, auth.gram1.ru, backup.gram1.ru."},{"file":"31_HOMELAB_REFERENCE.md","line":1356,"text":"- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm [PRIVATE_IP]."},{"file":"31_HOMELAB_REFERENCE.md","line":1371,"text":"| git.gram1.ru | http://127.0.0.1:3002 | edge-vm / gitea | gitea backup/offhost/restore |"},{"file":"31_HOMELAB_REFERENCE.md","line":2872,"text":"- Primary domain: chat.gram1.ru."},{"file":"31_HOMELAB_REFERENCE.md","line":2873,"text":"- groups.chat.gram1.ru and share.chat.gram1.ru are Snikket service domains."},{"file":"31_HOMELAB_REFERENCE.md","line":2902,"text":"- chat.gram1.ru public A is 185.225.35.6; groups.chat.gram1.ru and share.chat.gram1.ru continue through chat.gram1.ru."},{"file":"31_HOMELAB_REFERENCE.md","line":2905,"text":"- VM150 Internet default path is via [PRIVATE_IP] and verified public egress is 185.225.35.6."},{"file":"31_HOMELAB_REFERENCE.md","line":2906,"text":"- Effective coturn external address uses 185.225.35.6 and no longer advertises 95.84.154.183."},{"file":"31_HOMELAB_REFERENCE.md","line":2912,"text":"- Public DNS observed at release: 185.225.35.6; DNS was not changed during forum cutover."},{"file":"31_HOMELAB_REFERENCE.md","line":2913,"text":"- Public ingress remains through the existing protected external/edge path; VM160 is not intentionally published directly."},{"file":"HOMELAB_ASSISTANT_ERROR_REGISTER.md","line":1730,"text":"- public_dns_root: 185.225.35.6"},{"file":"HOMELAB_ASSISTANT_ERROR_REGISTER.md","line":1731,"text":"- public_dns_www: 185.225.35.6"},{"file":"HOMELAB_ASSISTANT_ERROR_REGISTER.md","line":3035,"text":"CERT38_NARROW_MIGRATION_20260904 | CLOSED_COMMITTED_PASS | Cert38 meta/runtime credential migrated to verified narrow gram1 token; stock npm-38 renewal dry-run succeeded for chat.gram1.ru, groups.chat.gram1.ru and share.chat.gram1.ru."},{"file":"HOMELAB_ASSISTANT_ERROR_REGISTER.md","line":3100,"text":"EDGE01_SSH_HOSTKEY_UNKNOWN_20260904 | OPEN | Strict SSH to 185.225.35.6 stopped before authentication because no pinned ED25519 host key exists for the IP; no remote state changed and no unverified key was accepted."},{"file":"HOMELAB_ASSISTANT_ERROR_REGISTER.md","line":3112,"text":"PUBLIC_SERVER_VERSION_HARDENING_RUNTIME_MISMATCH_20260904 | CLOSED_PARTIAL_BLOCKED_EXTERNAL_INGRESS | VM130 NPMplus now has server_tokens off on all 13 public manual vhosts and direct-edge responses expose no Server header; public nginx/1.28.3 (Ubuntu) is emitted by EDGE01 185.225.35.6. kingofwolk.ru proves EDGE01 supports per-vhost server_tokens off, but external mutation is blocked until an authorized EDGE01 management credential is restored."},{"file":"HOMELAB_ASSISTANT_ERROR_REGISTER.md","line":3165,"text":"STATIC_PUBLIC_HEADER_HARDENING_20260904 | CLOSED_COMMITTED_PASS | VM130 and public ingress verified HSTS and Permissions-Policy on newfilya.ru, pvepro.ru, hapusya.ru and newfi.ru."},{"file":"HOMELAB_ASSISTANT_ERROR_REGISTER.md","line":3172,"text":"NEWFILYA_HEADERS_MORE_LOCATION_20260904 | CLOSED_SUPERSEDED_PASS | Failed headers-more attempt was rolled back; final delayed location add_header deployment later verified HSTS/Permissions-Policy on both paths and public ingress 4/4."},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":951,"text":"URL=https://git.gram1.ru"},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":2817,"text":"Do not accept public VPS 188.127.235.6 changed SSH host key without provider-console fingerprint."},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":2903,"text":"6. Do not accept the changed public VPS SSH host key for `188.127.235.6` until independently verified from provider console."},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":3306,"text":"TRUSTED_NETBIRD_IDENTITY=edge-vm"},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":3307,"text":"PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH"},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":3308,"text":"PUBLIC_VPS_SSH_OK=0"},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":3309,"text":"PUBLIC_VPS_REJECTED_HOSTKEY=YES"},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":3319,"text":"- public VPS `188.127.235.6` is rejected due SSH host-key mismatch."},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":3324,"text":"STATUS=OK TS=2026-07-08T09:17:06Z TYPE=independent-external-runner BAD=0 WARN=0 MODE=NO_DEPLOY_SEAL NO_DEPLOY_SEAL_OK=YES AUDIT_STATUS=OK AUDIT_OK=YES INDEPENDENT_RUNNER_READY=NO DEPLOY_DECISION=NO_DEPLOY CURRENT_INDEPENDENT_RUNNER_AVAILABLE=no TRUSTED_NETBIRD_IDENTITY=edge-vm PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH PUBLIC_VPS_SSH_OK=0 PUBLIC_VPS_REJECTED_HOSTKEY=YES EDGE_LAN_SSH_OK=2 EDGE_NETBIRD_SSH_OK=2 EDGE_DNS_SSH_OK=1 PUBLIC_OVERALL_OK=1 LOCAL_FAILED=0 PVE02_FAILED=0 PVE03_FAILED=0 EDGE_FAILED=0 DUTY_V2_STATUS=OK DUTY_V2_GATED_NONOK=0 DUTY_V2_UNGATED_ERROR_REVIEW=0 DUTY_V2_UNGATED_WARN_REVIEW=0 DUTY_V2_UNGATED_REVIEW_ITEM=0 DUTY_V2_LEGACY_OR_PHASE_REVIEW=0 OVERALL_STATUS=OK OVERALL_BAD=0 FINAL_STATUS=OK FINAL_FAIL=0 CLOSEOUT_OK=YES RECOVERY_SEAL_OK=YES RESTORE_CHECK_OK=YES GOLD"},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":3332,"text":"Do not run ssh-keygen -R or accept changed key for 188.127.235.6 until that fingerprint is independently confirmed."},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":3411,"text":"- Do not deploy anything to public VPS 188.127.235.6 until provider-console fingerprint confirms the changed SSH host key."},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":3690,"text":"role=NPMplus, edge runtime, local health endpoints, registry-cache, public ingress"},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":6683,"text":"| Core | Gitea | https://git.gram1.ru | public | Git |"},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":7540,"text":"- `https://git.gram1.ru`"},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":8620,"text":"- git.gram1.ru -> [PRIVATE_IP]."},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":8653,"text":"- git.gram1.ru -> http://127.0.0.1:3002, cert=29, ssl_forced=1, enabled=1."},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":8702,"text":"- cert=29: git.gram1.ru, expires 2026-09-13 17:36:55."},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":8722,"text":"- Public ingress terminates through NPMplus on ports 80/443."},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":8812,"text":"- NPMplus public ingress: 0.0.0.0:80 and 0.0.0.0:443."},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":9006,"text":"- https://git.gram1.ru"},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":9062,"text":"- external canary checks include nc.gram1.ru, git.gram1.ru, auth.gram1.ru, backup.gram1.ru."},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":9304,"text":"- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm [PRIVATE_IP]."},{"file":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","line":9319,"text":"| git.gram1.ru | http://127.0.0.1:3002 | edge-vm / gitea | gitea backup/offhost/restore |"},{"file":"netbird-vps-trust-clean-seal.txt","line":1,"text":"STATUS=OK TS=2026-07-07T15:55:43Z TYPE=netbird-vps-trust-clean-seal BAD=0 WARN=0 MODE=CLEAN_SEAL_NO_AWK_TAIL TRUSTED_NETBIRD_IDENTITY=edge-vm TRUSTED_NETBIRD_IP=[PRIVATE_IP] PUBLIC_VPS_IP=188.127.235.6 PUBLIC_VPS_DECISION=REJECTED_HOSTKEY_MISMATCH INDEPENDENT_RUNNER_AVAILABLE=no DEPLOY_DECISION=NO_DEPLOY KNOWN_HOSTS_CHANGED=no PRIVATE_KEYS_READ=no PROBE_DEPLOYED=no REPORT=/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md"},{"file":"latest.md","line":14,"text":"public_ip=188.127.235.6"},{"file":"latest.md","line":27,"text":"- Do not use public IP 188.127.235.6 until its host-key mismatch is intentionally resolved."},{"file":"latest.md","line":37,"text":"--- HOST=188.127.235.6"},{"file":"latest.md","line":39,"text":"KNOWN_FP host=188.127.235.6 256 SHA256:syJ4GJ5QOx1vZ7SEIVbj6V2M4dg5/Ll6SjMhk3XXFkk |1|/0oIfigkDxhJFJWj72WrkRkYUqo=|29qT4RhgqPPXt3sOwBqw7QrafBY= (ECDSA)"},{"file":"latest.md","line":40,"text":"KNOWN_FP host=188.127.235.6 3072 SHA256:f4T0y5HHCSsLBikWCH836empU0ed9SoVVVpUQeAR4jA |1|Hmbhg2wXCUS/SDiuLTTgk6Vxhns=|kw5S70w76UhROmk1XT92s4Z757Y= (RSA)"},{"file":"latest.md","line":41,"text":"KNOWN_FP host=188.127.235.6 256 SHA256:78gdfA7x47jLCW67IoXgg2K9v6fIQB+Q0VxwIz/x1Sw |1|q70vtOfl5nR+CvnLuV7OQ3aEFIo=|OJi44TxJaz3cfw57HO19UEkZc/M= (ED25519)"},{"file":"latest.md","line":43,"text":"KEYSCAN_FP host=188.127.235.6 256 SHA256:e2vO2QYVGohhMb5uU7jJUEmxsjVHvicM5bC3+PWuI3I 188.127.235.6 (ED25519)"},{"file":"latest.md","line":44,"text":"KEYSCAN_FP host=188.127.235.6 3072 SHA256:dj1lOcuLgtSi2YyMjc6rlo4KfdeQANMRjE/GpmV2ik4 188.127.235.6 (RSA)"},{"file":"latest.md","line":45,"text":"KEYSCAN_FP host=188.127.235.6 256 SHA256:boxtKJ86odqLnafzITXeaYKXgLlFQxfivpDUuI2ncRg 188.127.235.6 (ECDSA)"},{"file":"latest.md","line":64,"text":"REMOTE_USER=debian"},{"file":"latest.md","line":78,"text":"REMOTE_USER=debian"},{"file":"latest.md","line":102,"text":"PUBLIC_STRICT   ssh-keygen -f '[SENSITIVE_PATH] -R '188.127.235.6'"},{"file":"latest.md","line":103,"text":"PUBLIC_STRICT Host key for 188.127.235.6 has changed and you have requested strict checking."},{"file":"latest.md","line":113,"text":"VPS_IP=188.127.235.6"}]
PVE01_PUBLIC_CERTS_JSON={"git.gram1.ru":{"ok":true,"der_sha256":"ecb69d0fa839fed04dc23ee243f9f8673cbfcd0a0088bfd3ef7d8b943314d6cb","subject_sha256":"1b527219d645a7328565ccadd9e832bbcdfe922aaac90c3a809c766df2249cf3","san_names":["git-read.gram1.ru","git.gram1.ru"],"sni_covered":true},"chat.gram1.ru":{"ok":true,"der_sha256":"2ae225abe13b04c25c2cba36332f4de326aec5600552c2acaa2f1d857b4af074","subject_sha256":"da60dd146c2392b5e022f7341848a5c6228bccb7012c0be60ed9eab33aca3876","san_names":["chat.gram1.ru","groups.chat.gram1.ru","share.chat.gram1.ru"],"sni_covered":true},"newfi-staging.gram1.ru":{"ok":true,"der_sha256":"2ae225abe13b04c25c2cba36332f4de326aec5600552c2acaa2f1d857b4af074","subject_sha256":"da60dd146c2392b5e022f7341848a5c6228bccb7012c0be60ed9eab33aca3876","san_names":["chat.gram1.ru","groups.chat.gram1.ru","share.chat.gram1.ru"],"sni_covered":false}}
PUBLIC_SSH_KEYSCAN_RC=0
PUBLIC_SSH_ED25519_COUNT=1
PUBLIC_EXACT_KNOWN_HOSTS_COUNT=0
PUBLIC_SSH_ED25519_SHA256=8c930e3407a94a222d180662fd94ebde906024fec7b4098d23a82e4ddad1d1dd
PUBLIC_SSH_KEY_MATCH_ANY_KNOWN_HOSTS_COUNT=0
EDGEVM_OVERLAY_IP_COUNT=1
EDGEVM_IP_RESOLVED=true
EDGEVM_SSH_HOSTKEY_TRUST_MATCH=true
EDGEVM_SSH_ED25519_SHA256=5fc831914d9aa11857515234e9e9c4476c8ea05cf572062201921a47c94b3eb1
PUBLIC_EDGEVM_SSH_KEY_EQUAL=false
EDGEVM_SUDO_RC=0
EDGEVM_REMOTE_MAP_RC=0
EDGEVM_MAP_JSON={"euid":0,"mutations_performed":"NO","public_ip_assigned_locally":false,"route_to_public_rc":0,"route_to_public_sha256":"901b51b713136a96ad54fddeb04a103a27e3abb4aef2e0a3a180c0f69462f930","local_certs":{"git.gram1.ru":{"ok":true,"der_sha256":"707ed656033c03c4b42fded83f9700c10ceffd2d2e2d98a756c8b19cdf1dab63","subject_sha256":"1b527219d645a7328565ccadd9e832bbcdfe922aaac90c3a809c766df2249cf3","san_names":["git.gram1.ru"],"sni_covered":true},"chat.gram1.ru":{"ok":true,"der_sha256":"17c9572bf00b99ed6ede780a0a0aa9e3d74a6211066b47c9a4d4811a4573e4b3","subject_sha256":"da60dd146c2392b5e022f7341848a5c6228bccb7012c0be60ed9eab33aca3876","san_names":["chat.gram1.ru","groups.chat.gram1.ru","share.chat.gram1.ru"],"sni_covered":true},"newfi-staging.gram1.ru":{"ok":true,"der_sha256":"c14d6f3eda27dcd7e8c8a44c18844f8009b4f23a74ab82d49475f138ddef0b93","subject_sha256":"75d1afd5807c49f5ae655fb6c0a764971a10757edb33bb258f8f032adc3b89f1","san_names":[],"sni_covered":false}},"public_certs_from_edge":{"git.gram1.ru":{"ok":true,"der_sha256":"ecb69d0fa839fed04dc23ee243f9f8673cbfcd0a0088bfd3ef7d8b943314d6cb","subject_sha256":"1b527219d645a7328565ccadd9e832bbcdfe922aaac90c3a809c766df2249cf3","san_names":["git-read.gram1.ru","git.gram1.ru"],"sni_covered":true},"chat.gram1.ru":{"ok":true,"der_sha256":"2ae225abe13b04c25c2cba36332f4de326aec5600552c2acaa2f1d857b4af074","subject_sha256":"da60dd146c2392b5e022f7341848a5c6228bccb7012c0be60ed9eab33aca3876","san_names":["chat.gram1.ru","groups.chat.gram1.ru","share.chat.gram1.ru"],"sni_covered":true},"newfi-staging.gram1.ru":{"ok":true,"der_sha256":"2ae225abe13b04c25c2cba36332f4de326aec5600552c2acaa2f1d857b4af074","subject_sha256":"da60dd146c2392b5e022f7341848a5c6228bccb7012c0be60ed9eab33aca3876","san_names":["chat.gram1.ru","groups.chat.gram1.ru","share.chat.gram1.ru"],"sni_covered":false}},"nginx_T_rc":0,"active_vhost_sources":{"chat.gram1.ru":["/data/nginx/proxy_host/61.conf"],"git.gram1.ru":["/data/nginx/proxy_host/9.conf"]}}
PUBLIC_EDGE_TLS_CERT_EQUAL_JSON={"git.gram1.ru":false,"chat.gram1.ru":false,"newfi-staging.gram1.ru":false}
MAP30_DECISION=PUBLIC_INGRESS_DISTINCT_AND_NO_EXISTING_SSH_TRUST
MAP30_END=true

OUTPUT_END
CHAT_OUTPUT_END
