CHAT_OUTPUT_BEGIN
COMMAND_ID=SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1
STATUS=OK
RC=0
HOST=pve01
MODE=read-only
COMPONENT=spb-snikket-home-topology-preflight
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
COMMAND_SHA256=8b782274900f6bc9aa802887320595dc8daddda038b74f5bb47d7037e275cc95
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=4647a1f838f614aee3bb390bbb1a36f357f9a8bf88e819fbd5f9d977f7cda299
SANITIZED_OUTPUT_SHA256=4647a1f838f614aee3bb390bbb1a36f357f9a8bf88e819fbd5f9d977f7cda299
OUTPUT_BEGIN
SNIKKET9212_BEGIN=true
MODE=READ_ONLY_TOPOLOGY_PREFLIGHT
MUTATION_BOUNDARY=NONE;NO_SPB_WRITE;NO_HOME_WRITE;NO_DNS_WRITE;NO_SHUTDOWN
LOCAL9209_BEGIN=true
CID=SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1
PLINK_PRESENT=true
SPB_CANDIDATE_COUNT=1
SPB_CANDIDATE_SHA16=6d6149f42864ce03
HOME_CANDIDATE_COUNT=1
HOME_CANDIDATE_SHA16=bc517b4af3298846
SPB_HASH_MATCH=true
SPB_PINNED_PROBE_RC=0
DPAPI_DECRYPTABLE_COUNT=1
OLD9208_LOCAL_ERR_SHA16=5a00a4ad6f6ef637
LOCAL_ACCESS_STATUS=PASS
LOCAL9209_END=true
SPB_PINNED_ACCESS=PASS
SPB_SNIKKET_EXTRACT_RC=0
SPB_SNIKKET_EXTRACT_STDERR_SHA16=01ba4719c80b6fe9
HOME_TOPOLOGY_AUDIT_RC=0
SPB_TO_HOME_PORT_PROBE_RC=0
SPB_TO_HOME_PORT_PROBE_STDERR_SHA16=e3b0c44298fc1c14
SPB_SNIKKET_RAW_SAFE={"dnat_target_count":1,"dnat_target_sha16":"0b7870e2230336f5","egress_exists":true,"egress_sha16":"6f95765c03a345c9","egress_source_count":1,"egress_source_sha16":"4e29a2729bbc4066","ingress_exists":true,"ingress_sha16":"a195c34384dd7b2c","wg_exists":true,"wg_listen_port":51820,"wg_peer_count":1,"wg_sha16":"445cd0dd63bffe31"}
HOME_TOPOLOGY9212={"classification":{"automatable_direct_edge":true,"home_public_owner_count":1,"home_public_owners":[{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":true,"name":"edge-vm","node":"pve03","owns_home_ip":true,"rc":0,"type":"qemu","vmid":130}],"needs_router_specific_migration":false,"snikket_egress_source_owner_count":2,"snikket_egress_source_owners":[{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":true,"name":"edge-vm","node":"pve03","owns_home_ip":true,"rc":0,"type":"qemu","vmid":130},{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":false,"name":"snikket","node":"pve01","owns_home_ip":false,"rc":0,"type":"qemu","vmid":150}],"snikket_target_owner_count":1,"snikket_target_owners":[{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":true,"name":"edge-vm","node":"pve03","owns_home_ip":true,"rc":0,"type":"qemu","vmid":130}],"wg_home_owner_count":0,"wg_home_owners":[]},"config_hits":[],"guests":[{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":true,"name":"edge-vm","node":"pve03","owns_home_ip":true,"rc":0,"type":"qemu","vmid":130},{"has_wg_home":false,"mentions_egress_source":true,"mentions_target":false,"name":"snikket","node":"pve01","owns_home_ip":false,"rc":0,"type":"qemu","vmid":150}],"hosts":[{"has_wg_home":false,"mentions_egress_source":false,"mentions_target":false,"node":"pve01","owns_home_ip":false,"rc":0},{"has_wg_home":false,"mentions_egress_source":false,"mentions_target":false,"node":"pve02","owns_home_ip":false,"rc":0},{"has_wg_home":false,"mentions_egress_source":false,"mentions_target":false,"node":"pve03","owns_home_ip":false,"rc":0}],"reference_lines":[{"line":14,"text":"- VM130 edge-vm | pve03 | running | KEEP"},{"line":15,"text":"- VM150 snikket | pve01 | running | KEEP"},{"line":20,"text":"- VM9130 edge-cold-standby | pve02 | stopped | KEEP_DR"},{"line":73,"text":"NOTE exclude_from_reference_or_delete_later=05_edge_compose_safe.tgz"},{"line":75,"text":"NOTE edge-vm disk scsi1 backup=0 risk must be documented"},{"line":77,"text":"NOTE edge health WARN/ERROR items should be documented as known current states"},{"line":101,"text":"04_edge_vm_basic.txt 34506 bytes"},{"line":102,"text":"05_edge_compose_redacted.txt 24228 bytes"},{"line":103,"text":"05_edge_compose_safe.tgz.QUARANTINED.txt 354 bytes"},{"line":104,"text":"05_edge_compose_tar_errors.txt 166 bytes"},{"line":106,"text":"06_edge_npmplus_routes_safe.txt 17350 bytes"},{"line":107,"text":"07_edge_systemd_backup_audit.txt 20694 bytes"},{"line":108,"text":"08_edge_scripts_redacted.txt 198622 bytes"},{"line":149,"text":"- \u0423 VM130 edge-vm \u0435\u0441\u0442\u044c \u0440\u0438\u0441\u043a: \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0434\u0438\u0441\u043a backup=0."},{"line":157,"text":"- Edge VM: ssh debian@<IP:bc517b4af3298846>, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c sudo, root-login \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c."},{"line":166,"text":"- VM130 edge-vm pve03 <IP:bc517b4af3298846> Docker ingress/app host."},{"line":173,"text":"- Edge VM \u0438\u043c\u0435\u0435\u0442 vzdump/offhost/restore evidence; \u0440\u0438\u0441\u043a backup=0 \u043f\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u043c\u0443 \u0434\u0438\u0441\u043a\u0443 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f."},{"line":199,"text":"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630"},{"line":226,"text":"### WAN \u0438 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442"},{"line":227,"text":"- Main WAN: GigabitEthernet1, renamed ISP, description \u0420\u043e\u0441\u0442\u0435\u043b."},{"line":228,"text":"- WAN security-level: public."},{"line":229,"text":"- WAN addressing: DHCP."},{"line":230,"text":"- WAN MTU: 1500."},{"line":231,"text":"- WAN global priority: 700."},{"line":232,"text":"- WAN ping-check profile: default."},{"line":234,"text":"- WAN DHCP observed in router log: <IP:18d462ba98aa4550>, gateway <IP:29948130c37b10e3>."},{"line":235,"text":"- ISP DNS observed in router log: <IP:009e7a91182f3b0b>, <IP:0c2f3683ba1d821a>."},{"line":236,"text":"- Backup/mobile WAN: CdcEthernet0, description SIM."},{"line":238,"text":"- CdcEthernet0 security-level: public."},{"line":282,"text":"- Default router: <IP:c5eb5a4cc76a5cdb>."},{"line":311,"text":"- <IP:6e3573c5557733db> -> bc:24:11:f4:c5:d8 WireGuard."},{"line":312,"text":"- <IP:bc517b4af3298846> -> bc:24:11:e1:f3:3c NPMplus / edge-vm."},{"line":315,"text":"### NAT / port forwarding"},{"line":318,"text":"- ISP tcpudp/3478 -> bc:24:11:e1:9a:25, Nextcloud Talk TURN."},{"line":319,"text":"- Home tcp/51820 -> bc:24:11:f4:c5:d8, WireGuard vpn1."},{"line":327,"text":"### Router management"},{"line":333,"text":"- Telnet port configured: 2323, security-level private; router log shows Telnet disabled later on 2026-06-26."},{"line":339,"text":"### Router services"},{"line":354,"text":"### Router automation warning"},{"line":357,"text":"- Automation must use router CLI syntax, not bash syntax."},{"line":366,"text":"- edge-vm: no UPS/NUT/APCUPSD integration discovered."},{"line":371,"text":"- NetBird service is active on pve01, pve02, pve03 and edge-vm."},{"line":376,"text":"- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 <IP:8ffeea43651fd0fa>."},{"line":378,"text":"- WireGuard port: 51820."},{"line":395,"text":"- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs."},{"line":455,"text":"- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening and NPMplus admin bind."},{"line":456,"text":"- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBird VPS backup/offhost, Authentik/Gitea/Vaultwarden backup, SOPS secret coverage, mail cloud upload/restore, Immich/Memos/Paperless backup/offhost/restore, auto backup, edge-vm vzdump, secret sanity."},{"line":459,"text":"- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03."},{"line":531,"text":"- Main active workload: VM130 edge-vm."},{"line":545,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":560,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":575,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":590,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":597,"text":"### VM130 edge-vm"},{"line":600,"text":"- Name: edge-vm."},{"line":604,"text":"- Role: edge application host / reverse proxy / monitoring / backup automation host."},{"line":608,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":626,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":643,"text":"- Network: vmbr0, gateway <IP:4f9da1283166a1e9>."},{"line":682,"text":"### Router ingress"},{"line":683,"text":"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, <IP:bc517b4af3298846>."},{"line":684,"text":"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on <IP:4e29a2729bbc4066>."},{"line":685,"text":"- Router forwards Home TCP/51820 to WireGuard host <IP:6e3573c5557733db>."},{"line":686,"text":"- NPMplus admin listener is bound to localhost on edge-vm, <IP:12ca17b49af22894>:81; public disabled legacy host npm.gram1.ru exists but enabled=0."},{"line":689,"text":"- Host: edge-vm, <IP:bc517b4af3298846>."},{"line":694,"text":"- Public listen ports on edge-vm: <IP:19e36255972107d4>:80 and <IP:19e36255972107d4>:443 by nginx/NPMplus."},{"line":698,"text":"### Public NPMplus proxy hosts"},{"line":766,"text":"## EDGE_DOCKER_STACKS_REFERENCE_20260630"},{"line":769,"text":"- Host: edge-vm, IP <IP:bc517b4af3298846>."},{"line":774,"text":"- Public ingress terminates through NPMplus on ports 80/443."},{"line":864,"text":"- NPMplus public ingress: <IP:19e36255972107d4>:80 and <IP:19e36255972107d4>:443."},{"line":869,"text":"- Full path inventory is in 133_EDGE_DOCKER_STACKS_SAFE_INVENTORY.txt."},{"line":870,"text":"- Normalized runtime map is in 134_EDGE_DOCKER_CONTAINER_NORMALIZED_MAP.txt."},{"line":873,"text":"- Raw Docker/stacks inventory: 133_EDGE_DOCKER_STACKS_SAFE_INVENTORY.txt."},{"line":874,"text":"- Normalized container map: 134_EDGE_DOCKER_CONTAINER_NORMALIZED_MAP.txt."},{"line":895,"text":"- VM130 edge-vm: included in homelab-nightly-all, local backup on pve03."},{"line":898,"text":"- VM130 also has dedicated edge-vm-vzdump backup/offhost/restore health proofs."},{"line":902,"text":"### Edge VM / VM130 full-image protection"},{"line":903,"text":"- edge-vm-vzdump-backup: STATUS=OK, archive size about 28.2G, SHA256 recorded."},{"line":904,"text":"- edge-vm-vzdump-offhost: STATUS=OK, destination pve02 /mnt/staging/offhost/edge-vm-vzdump-from-pve03."},{"line":905,"text":"- edge-vm-vzdump-restore: STATUS=OK, zstd and vma verification OK."},{"line":906,"text":"- mail-cloud-edge-vm: STATUS=OK, recurring chunked upload, 53 parts, download verification enabled."},{"line":907,"text":"- Retention for edge-vm cloud upload: RETENTION_KEEP=4."},{"line":908,"text":"- Edge restore proof offhost: STATUS=OK, ITEMS=14, OK=14."},{"line":915,"text":"- mail-cloud-restore-drill: STATUS=OK, CRITICAL_OK=2, EDGE_OK=1."},{"line":934,"text":"- Router self-test config is stored as uploaded/generated reference evidence, not yet automated as recurring router backup."},{"line":999,"text":"- XenForo SMTP rotation has DB backup proof from earlier rotation work; production forum application-level backup catalog should be expanded separately with CodeVipe-specific DB/files/cron/public cutover details."},{"line":1003,"text":"- Disk retention policy: STATUS=OK, root used pct observed 70 on edge-vm, removed dirs 0, Docker volume prune NO."},{"line":1004,"text":"- App backup retention dry-run timer exists on edge-vm."},{"line":1017,"text":"- Router config backup is currently reference/self-test based, not confirmed as recurring automated backup."},{"line":1027,"text":"- Primary monitoring host: edge-vm, <IP:bc517b4af3298846>."},{"line":1033,"text":"- Uptime Kuma container: uptime-kuma, local port <IP:12ca17b49af22894>:3001, public route uptime.gram1.ru and VPN route kuma.vpn.gram1.ru."},{"line":1034,"text":"- Gotify container: gotify, local port <IP:12ca17b49af22894>:8082, public route gotify.gram1.ru."},{"line":1039,"text":"- Node exporter on edge-vm: node-exporter, local port <IP:12ca17b49af22894>:9100."},{"line":1062,"text":"- Edge node exporter scrape target: node-exporter:9100."},{"line":1084,"text":"- HomelabP0WeeklyEdgeVmVzdumpHealthStale: weekly edge-vm vzdump health older than 8d."},{"line":1103,"text":"- Alloy relabels container, compose_project, compose_service and host=edge-vm."},{"line":1137,"text":"- Main health dir on edge-vm: /var/lib/homelab-health."},{"line":1209,"text":"- edge-vm is reached as debian@<IP:bc517b4af3298846> with sudo."},{"line":1215,"text":"- pve01 root keys observed: id_rsa, id_ed25519 and public keys."}],"spb_safe":{"dnat_target_count":1,"dnat_target_sha16":"0b7870e2230336f5","egress_exists":true,"egress_sha16":"6f95765c03a345c9","egress_source_count":1,"egress_source_sha16":"4e29a2729bbc4066","ingress_exists":true,"ingress_sha16":"a195c34384dd7b2c","wg_exists":true,"wg_listen_port":51820,"wg_peer_count":1,"wg_sha16":"445cd0dd63bffe31"}}
SPB_TO_HOME_PORT_PROBE={"tcp":{"3478":"TIMEOUT","3479":"TIMEOUT","5000":"TIMEOUT","5222":"TIMEOUT","5349":"TIMEOUT","5350":"TIMEOUT"},"udp_stun":{"3478":{"ok":false,"result":"TIMEOUT"},"3479":{"ok":false,"result":"TIMEOUT"}}}
HOME_PUBLIC_OWNER_COUNT=1
SNIKKET_TARGET_OWNER_COUNT=1
SNIKKET_EGRESS_SOURCE_OWNER_COUNT=2
WG_HOME_OWNER_COUNT=0
MIGRATION_AUTOMATABLE_ON_KNOWN_HOME_HOST=true
NEEDS_ROUTER_SPECIFIC_MIGRATION=false
DIRECT_HOME_TCP_OPEN_COUNT=0
DIRECT_HOME_STUN_OK_COUNT=0
DIRECT_SNIKKET_INGRESS_APPEARS_READY=false
NEXT_ACTION=APPLY_GUARDED_HOME_NFT_MIGRATION
TASK_COMPLETE=true
TASK_RESULT=PASS_SPB_SNIKKET_HOME_TOPOLOGY_PREFLIGHT
DECISION=READ_EXACT_9212_AND_APPLY_ONLY_PROVEN_HOME_EDGE_PATH
NEXT_GATE=EXACT_9212_HOME_EDGE_TOPOLOGY
HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260923-SPB-SNIKKET-HOME-TOPOLOGY-9212R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}

OUTPUT_END
CHAT_OUTPUT_END
