CHAT_OUTPUT_BEGIN
COMMAND_ID=SUPPORT-261005-HOME-GRAM1-HTTP403-TOPOLOGY-RCA-99593R1
STATUS=OK
RC=0
HOST=pve01
MODE=read-only
COMPONENT=home-gram1-http403-topology-rca
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
COMMAND_SHA256=aaaeca49d0fbf9246a46cb3d73283a4569d6422b267b1751abb7ff84108e2a5d
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=17eb3c30f0b452dca55cba4d33e06205714ba648378996a1ae318bf0662aeb42
SANITIZED_OUTPUT_SHA256=17eb3c30f0b452dca55cba4d33e06205714ba648378996a1ae318bf0662aeb42
OUTPUT_BEGIN
HOME_GRAM1_HTTP403_TOPOLOGY_RCA=V1
NO_MAIL_SEND=true
NO_SERVICE_RESTART=true
NO_TIMER_MUTATION=true
NO_NETWORK_MUTATION=true
NO_SOURCE_MUTATION=true
NO_DNS_MUTATION=true
NO_PROXY_MUTATION=true
NO_CONTAINER_MUTATION=true
MODE=read-only
HOST_PVE01=true
HTTPS_CURL_RC=0
HTTPS_HTTP_STATUS=200
HTTPS_CONTENT_TYPE=text/html; charset=utf-8
HTTPS_CONTENT_LENGTH=71651
HTTPS_BODY_BYTES=71651
HTTPS_BODY_SHA=dfac996d8d5743682137e74e417866dd905f6c3ee3a6511c1342ccf2b5fe060b
HTTPS_BODY_HAS_FORBIDDEN=false
HTTPS_BODY_HAS_CLOUDFLARE=true
HTTPS_BODY_HAS_HOMEPAGE=true
HTTPS_BODY_HAS_HOMARR=false
HTTPS_BODY_HAS_NGINX=true
HTTPS_BODY_HAS_CADDY=true
HTTPS_BODY_HAS_TRAEFIK=true
HTTPS_BODY_HAS_HOST_VALIDATION=false
HTTPS_BODY_HAS_ALLOWED_HOSTS=false
HTTPS_BODY_HAS_INVALID_HOST=false
HTTPS_TITLE=Homelab
HTTP_CURL_RC=0
HTTP_HTTP_STATUS=301
HTTP_CONTENT_TYPE=text/html
HTTP_CONTENT_LENGTH=140
HTTP_LOCATION=https://home.gram1.ru/
HTTP_BODY_BYTES=133
HTTP_BODY_SHA=33405a226a7a7c73d67c73cf635296a9b11b95b6f9fb0dc83e43f9ad47ef09e7
HTTP_BODY_HAS_FORBIDDEN=false
HTTP_BODY_HAS_CLOUDFLARE=false
HTTP_BODY_HAS_HOMEPAGE=false
HTTP_BODY_HAS_HOMARR=false
HTTP_BODY_HAS_NGINX=false
HTTP_BODY_HAS_CADDY=false
HTTP_BODY_HAS_TRAEFIK=false
HTTP_BODY_HAS_HOST_VALIDATION=false
HTTP_BODY_HAS_ALLOWED_HOSTS=false
HTTP_BODY_HAS_INVALID_HOST=false
HTTP_TITLE=301 Moved Permanently
DNS_ADDRESS_COUNT=1
DNS_1_CLASS=private
DNS_1_SHA=bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834
TLS_RC=0
TLS_SUBJECT=CN=home.gram1.ru
TLS_ISSUER=C=US, O=Let's Encrypt, CN=YE2
TLS_NOTBEFORE=Aug 14 16:08:49 2026 GMT
TLS_NOTAFTER=Nov 12 16:08:48 2026 GMT
TLS_SAN_HAS_DOMAIN=true
GIT_REPO_COUNT=44
REPO_MATCH_1_REPO_SHA=58c56c4f28c229efb3ca4d09891e4070e176e047f78342121c8b9ce639a4291a
REPO_MATCH_1_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
REPO_MATCH_1_PATTERN=homepage
REPO_MATCH_1_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
REPO_MATCH_2_REPO_SHA=58c56c4f28c229efb3ca4d09891e4070e176e047f78342121c8b9ce639a4291a
REPO_MATCH_2_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
REPO_MATCH_2_PATTERN=homepage
REPO_MATCH_2_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          "name": "homepage",
REPO_MATCH_3_REPO_SHA=58c56c4f28c229efb3ca4d09891e4070e176e047f78342121c8b9ce639a4291a
REPO_MATCH_3_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
REPO_MATCH_3_PATTERN=homepage
REPO_MATCH_3_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          "image": "ghcr.io/gethomepage/homepage:latest",
REPO_MATCH_4_REPO_SHA=2a829b2765d95641aac83ee239582027e35fb801358950022c180f08f6b3d9bb
REPO_MATCH_4_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
REPO_MATCH_4_PATTERN=homepage
REPO_MATCH_4_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
REPO_MATCH_5_REPO_SHA=2a829b2765d95641aac83ee239582027e35fb801358950022c180f08f6b3d9bb
REPO_MATCH_5_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
REPO_MATCH_5_PATTERN=homepage
REPO_MATCH_5_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          "name": "homepage",
REPO_MATCH_6_REPO_SHA=2a829b2765d95641aac83ee239582027e35fb801358950022c180f08f6b3d9bb
REPO_MATCH_6_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
REPO_MATCH_6_PATTERN=homepage
REPO_MATCH_6_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          "image": "ghcr.io/gethomepage/homepage:latest",
REPO_MATCH_7_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_7_PATH=README.md
REPO_MATCH_7_PATTERN=home.gram1.ru
REPO_MATCH_7_LINE=README.md:9:- Homepage: https://home.gram1.ru
REPO_MATCH_8_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_8_PATH=README.md
REPO_MATCH_8_PATTERN=home.gram1.ru
REPO_MATCH_8_LINE=README.md:53:- https://home.gram1.ru
REPO_MATCH_9_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_9_PATH=configs/sanitized/edge-vm/homepage-compose.yaml
REPO_MATCH_9_PATTERN=home.gram1.ru
REPO_MATCH_9_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:9:      HOMEPAGE_ALLOWED_HOSTS: home.gram1.ru,homepage.vpn.gram1.ru
REPO_MATCH_10_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_10_PATH=configs/sanitized/edge-vm/homepage-services.yaml
REPO_MATCH_10_PATTERN=home.gram1.ru
REPO_MATCH_10_LINE=configs/sanitized/edge-vm/homepage-services.yaml:3:      href: https://home.gram1.ru
REPO_MATCH_11_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_11_PATH=docs/05-service-catalog.md
REPO_MATCH_11_PATTERN=home.gram1.ru
REPO_MATCH_11_LINE=docs/05-service-catalog.md:67:- Domain: https://home.gram1.ru
REPO_MATCH_12_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_12_PATH=docs/06-certificates-troubleshooting.md
REPO_MATCH_12_PATTERN=home.gram1.ru
REPO_MATCH_12_LINE=docs/06-certificates-troubleshooting.md:62:Observed with home.gram1.ru and git.gram1.ru before certificate completion.
REPO_MATCH_13_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_13_PATH=docs/06-certificates-troubleshooting.md
REPO_MATCH_13_PATTERN=home.gram1.ru
REPO_MATCH_13_LINE=docs/06-certificates-troubleshooting.md:96:- home.gram1.ru: Lets Encrypt via Cloudflare DNS challenge.
REPO_MATCH_14_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_14_PATH=docs/99-current-state-summary.md
REPO_MATCH_14_PATTERN=home.gram1.ru
REPO_MATCH_14_LINE=docs/99-current-state-summary.md:113:- URL: https://home.gram1.ru
REPO_MATCH_15_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_15_PATH=docs/99-current-state-summary.md
REPO_MATCH_15_PATTERN=home.gram1.ru
REPO_MATCH_15_LINE=docs/99-current-state-summary.md:147:- https://home.gram1.ru
REPO_MATCH_16_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_16_PATH=docs/operations/p0-healthchecks-restore-proof-preflight-20260624T190801Z.md
REPO_MATCH_16_PATTERN=home.gram1.ru
REPO_MATCH_16_LINE=docs/operations/p0-healthchecks-restore-proof-preflight-20260624T190801Z.md:65:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru
REPO_MATCH_17_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_17_PATH=docs/operations/p0-restore-drill-matrix-edge-index-20260624T183747Z.md
REPO_MATCH_17_PATTERN=home.gram1.ru
REPO_MATCH_17_LINE=docs/operations/p0-restore-drill-matrix-edge-index-20260624T183747Z.md:112:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru
REPO_MATCH_18_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_18_PATH=docs/operations/p0-restore-drill-matrix-quality-offhost-20260624T183931Z.md
REPO_MATCH_18_PATTERN=home.gram1.ru
REPO_MATCH_18_LINE=docs/operations/p0-restore-drill-matrix-quality-offhost-20260624T183931Z.md:126:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru
REPO_MATCH_19_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_19_PATH=docs/operations/p0-vikunja-restore-proof-preflight-20260624T191408Z.md
REPO_MATCH_19_PATTERN=home.gram1.ru
REPO_MATCH_19_LINE=docs/operations/p0-vikunja-restore-proof-preflight-20260624T191408Z.md:63:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru
REPO_MATCH_20_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_20_PATH=docs/operations/p1-exposure-matrix-npmplus-route-inventory-20260625T212426Z.json
REPO_MATCH_20_PATTERN=home.gram1.ru
REPO_MATCH_20_LINE=docs/operations/p1-exposure-matrix-npmplus-route-inventory-20260625T212426Z.json:123:        "home.gram1.ru"
REPO_MATCH_21_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_21_PATH=docs/operations/p1-exposure-matrix-npmplus-route-inventory-20260625T212426Z.md
REPO_MATCH_21_PATTERN=home.gram1.ru
REPO_MATCH_21_LINE=docs/operations/p1-exposure-matrix-npmplus-route-inventory-20260625T212426Z.md:34:| 8 | public_or_unknown | home.gram1.ru | yes | http | [PRIVATE_IP]:3000 | present | 8 |
REPO_MATCH_22_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_22_PATH=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.json
REPO_MATCH_22_PATTERN=home.gram1.ru
REPO_MATCH_22_LINE=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.json:103:      "domain": "home.gram1.ru",
REPO_MATCH_23_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_23_PATH=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.json
REPO_MATCH_23_PATTERN=home.gram1.ru
REPO_MATCH_23_LINE=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.json:105:        "home.gram1.ru"
REPO_MATCH_24_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_24_PATH=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.md
REPO_MATCH_24_PATTERN=home.gram1.ru
REPO_MATCH_24_LINE=docs/operations/p1-exposure-ownership-matrix-20260625T212704Z.md:39:| 8 | home.gram1.ru | public-domain | homepage | edge-local | http://[PRIVATE_IP]:3000 | yes | present | OK_PUBLIC_INTENTIONAL | keep_monitoring |
REPO_MATCH_25_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_25_PATH=docs/operations/p2-dependency-risk-classification-20260625T221747Z.json
REPO_MATCH_25_PATTERN=home.gram1.ru
REPO_MATCH_25_LINE=docs/operations/p2-dependency-risk-classification-20260625T221747Z.json:905:      "domain": "home.gram1.ru",
REPO_MATCH_26_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_26_PATH=docs/operations/p2-dependency-risk-classification-20260625T221747Z.md
REPO_MATCH_26_PATTERN=home.gram1.ru
REPO_MATCH_26_LINE=docs/operations/p2-dependency-risk-classification-20260625T221747Z.md:68:| 8 | home.gram1.ru | http://[PRIVATE_IP]:3000 | homepage | PUBLIC_OR_UNKNOWN_ROUTE, ACCESS_HINT_REVIEW |
REPO_MATCH_27_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_27_PATH=docs/operations/p2-service-dependency-graph-20260625T221552Z.json
REPO_MATCH_27_PATTERN=home.gram1.ru
REPO_MATCH_27_LINE=docs/operations/p2-service-dependency-graph-20260625T221552Z.json:1278:      "domain": "home.gram1.ru",
REPO_MATCH_28_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_28_PATH=docs/operations/p2-service-dependency-graph-20260625T221552Z.json
REPO_MATCH_28_PATTERN=home.gram1.ru
REPO_MATCH_28_LINE=docs/operations/p2-service-dependency-graph-20260625T221552Z.json:1870:        "home.gram1.ru",
REPO_MATCH_29_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_29_PATH=docs/operations/p2-service-dependency-graph-20260625T221552Z.md
REPO_MATCH_29_PATTERN=home.gram1.ru
REPO_MATCH_29_LINE=docs/operations/p2-service-dependency-graph-20260625T221552Z.md:112:| homepage | homepage | home.gram1.ru, homepage.vpn.gram1.ru |
REPO_MATCH_30_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_30_PATH=docs/operations/postp1-fix-inputs-npm-sops-inspect-20260624T182227Z.md
REPO_MATCH_30_PATTERN=home.gram1.ru
REPO_MATCH_30_LINE=docs/operations/postp1-fix-inputs-npm-sops-inspect-20260624T182227Z.md:200:8	1	27	1	["home.gram1.ru"]	[PRIVATE_IP]	3000
REPO_MATCH_31_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_31_PATH=docs/service-url-catalog.md
REPO_MATCH_31_PATTERN=home.gram1.ru
REPO_MATCH_31_LINE=docs/service-url-catalog.md:16:| home.gram1.ru | http://[PRIVATE_IP]:3000 | yes | LAN only | home.gram1.ru | enabled |
REPO_MATCH_32_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_32_PATH=docs/service-url-catalog.md
REPO_MATCH_32_PATTERN=home.gram1.ru
REPO_MATCH_32_LINE=docs/service-url-catalog.md:48:| home.gram1.ru | letsencrypt | 2026-09-13 16:43:44 |
REPO_MATCH_33_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_33_PATH=docs/service-url-catalog.md
REPO_MATCH_33_PATTERN=home.gram1.ru
REPO_MATCH_33_LINE=docs/service-url-catalog.md:75:| `home.gram1.ru` | `http://[PRIVATE_IP]:3000` | cert id 27 | yes | Homepage |
REPO_MATCH_34_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_34_PATH=evidence/p0-restore-drill-20260624T122122Z/edge-health-redacted.txt
REPO_MATCH_34_PATTERN=home.gram1.ru
REPO_MATCH_34_LINE=evidence/p0-restore-drill-20260624T122122Z/edge-health-redacted.txt:34:id=16 active=1 interval=300 type=http name=Homepage HTTPS target=https://home.gram1.ru
REPO_MATCH_35_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_35_PATH=inventory/domains.csv
REPO_MATCH_35_PATTERN=home.gram1.ru
REPO_MATCH_35_LINE=inventory/domains.csv:5:home.gram1.ru,[PRIVATE_IP],[PRIVATE_IP],http://[PRIVATE_IP]:3000,LAN-only,cloudflare-dns-challenge
REPO_MATCH_36_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_36_PATH=inventory/ports.md
REPO_MATCH_36_PATTERN=home.gram1.ru
REPO_MATCH_36_LINE=inventory/ports.md:42:| Homepage | [PRIVATE_IP]:3000 | https://home.gram1.ru |
REPO_MATCH_37_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_37_PATH=configs/sanitized/edge-vm/homepage-compose.yaml
REPO_MATCH_37_PATTERN=HOMEPAGE_ALLOWED_HOSTS
REPO_MATCH_37_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:9:      HOMEPAGE_ALLOWED_HOSTS: home.gram1.ru,homepage.vpn.gram1.ru
REPO_MATCH_38_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_38_PATH=baselines/README.md
REPO_MATCH_38_PATTERN=homepage
REPO_MATCH_38_LINE=baselines/README.md:14:- `/root/homepage-post-install-baseline-20260615T145851Z.tar.gz`
REPO_MATCH_39_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_39_PATH=configs/sanitized/edge-vm/homepage-compose.yaml
REPO_MATCH_39_PATTERN=homepage
REPO_MATCH_39_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:2:  homepage:
REPO_MATCH_40_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_40_PATH=configs/sanitized/edge-vm/homepage-compose.yaml
REPO_MATCH_40_PATTERN=homepage
REPO_MATCH_40_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:3:    image: ghcr.io/gethomepage/homepage:latest
REPO_MATCH_41_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_41_PATH=configs/sanitized/edge-vm/homepage-compose.yaml
REPO_MATCH_41_PATTERN=homepage
REPO_MATCH_41_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:4:    container_name: homepage
REPO_MATCH_42_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_42_PATH=configs/sanitized/edge-vm/homepage-compose.yaml
REPO_MATCH_42_PATTERN=homepage
REPO_MATCH_42_LINE=configs/sanitized/edge-vm/homepage-compose.yaml:9:      HOMEPAGE_ALLOWED_HOSTS: home.gram1.ru,homepage.vpn.gram1.ru
REPO_MATCH_43_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_43_PATH=configs/sanitized/edge-vm/homepage-services.yaml
REPO_MATCH_43_PATTERN=homepage
REPO_MATCH_43_LINE=configs/sanitized/edge-vm/homepage-services.yaml:5:      icon: homepage.png
REPO_MATCH_44_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_44_PATH=configs/sanitized/edge-vm/homepage-services.yaml
REPO_MATCH_44_PATTERN=homepage
REPO_MATCH_44_LINE=configs/sanitized/edge-vm/homepage-services.yaml:7:      href: https://homepage.vpn.gram1.ru
REPO_MATCH_45_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_45_PATH=configs/sanitized/edge-vm/homepage-services.yaml
REPO_MATCH_45_PATTERN=homepage
REPO_MATCH_45_LINE=configs/sanitized/edge-vm/homepage-services.yaml:9:      icon: homepage.png
REPO_MATCH_46_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_46_PATH=docs/03-proxmox-layout.md
REPO_MATCH_46_PATTERN=homepage
REPO_MATCH_46_LINE=docs/03-proxmox-layout.md:53:- homepage
REPO_MATCH_47_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_47_PATH=docs/05-service-catalog.md
REPO_MATCH_47_PATTERN=homepage
REPO_MATCH_47_LINE=docs/05-service-catalog.md:64:- Compose path: /opt/stacks/homepage/compose.yaml
REPO_MATCH_48_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_48_PATH=docs/05-service-catalog.md
REPO_MATCH_48_PATTERN=homepage
REPO_MATCH_48_LINE=docs/05-service-catalog.md:65:- Config path: /opt/stacks/homepage/config
REPO_MATCH_49_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_49_PATH=docs/99-current-state-summary.md
REPO_MATCH_49_PATTERN=homepage
REPO_MATCH_49_LINE=docs/99-current-state-summary.md:114:- Config path: /opt/stacks/homepage/config
REPO_MATCH_50_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_50_PATH=docs/99-current-state-summary.md
REPO_MATCH_50_PATTERN=homepage
REPO_MATCH_50_LINE=docs/99-current-state-summary.md:441:- `filebrowser, gitea, homebox, homepage, karakeep-chrome, karakeep-meilisearch, minio, node-exporter, prometheus`
REPO_MATCH_51_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_51_PATH=docs/99-current-state-summary.md
REPO_MATCH_51_PATTERN=homepage
REPO_MATCH_51_LINE=docs/99-current-state-summary.md:2333:- `homepage.vpn.gram1.ru`: HTTP `200`
REPO_MATCH_52_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_52_PATH=docs/ERRORS-LESSONS-20260618.md
REPO_MATCH_52_PATTERN=homepage
REPO_MATCH_52_LINE=docs/ERRORS-LESSONS-20260618.md:61:Correct value: only https://homepage.vpn.gram1.ru.
REPO_MATCH_53_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_53_PATH=docs/ERRORS-LESSONS-20260618.md
REPO_MATCH_53_PATTERN=homepage
REPO_MATCH_53_LINE=docs/ERRORS-LESSONS-20260618.md:90:Cause: command authentik_homepage_application_cli_created returned SSH_RC=0 but produced no expected stdout, so local verification could not confirm provider/application state.
REPO_MATCH_54_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_54_PATH=docs/ERRORS-LESSONS-20260618.md
REPO_MATCH_54_PATTERN=homepage
REPO_MATCH_54_LINE=docs/ERRORS-LESSONS-20260618.md:108:Correction: use local direct Authentik outpost checks with homepage.vpn.gram1.ru forwarded headers before enabling NPMplus auth. Do not require the public auth.vpn outpost auth endpoint to match the Homepage provider.
REPO_MATCH_55_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_55_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
REPO_MATCH_55_PATTERN=homepage
REPO_MATCH_55_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:11:homepage.vpn.gram1.ru    proxy id 17 cert id 32 access 1 ssl forced
REPO_MATCH_56_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_56_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
REPO_MATCH_56_PATTERN=homepage
REPO_MATCH_56_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:31:Slug or Identifier: homepage-vpn
REPO_MATCH_57_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_57_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
REPO_MATCH_57_PATTERN=homepage
REPO_MATCH_57_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:33:Launch URL: https://homepage.vpn.gram1.ru
REPO_MATCH_58_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_58_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
REPO_MATCH_58_PATTERN=homepage
REPO_MATCH_58_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:34:Provider: homepage-vpn-forward-auth
REPO_MATCH_59_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_59_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
REPO_MATCH_59_PATTERN=homepage
REPO_MATCH_59_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:42:Only after provider and outpost verification, enable npmplus_auth_request authentik for homepage.vpn.gram1.ru. Keep rollback ready by setting it back to none.
REPO_MATCH_60_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_60_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
REPO_MATCH_60_PATTERN=homepage
REPO_MATCH_60_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:54:The public check through auth.vpn.gram1.ru returned 404 for /outpost.goauthentik.io/auth/nginx, while the local direct outpost check for homepage.vpn.gram1.ru returned a valid auth response. Treat the public auth.vpn auth endpoint as a wrong validation path for Homepage. Next safe step: enable npmplus_auth_request=authentik only for homepage proxy id 17 with rollback ready.
REPO_MATCH_61_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_61_PATH=docs/HANDOFF-20260618-authentik-npmplus.md
REPO_MATCH_61_PATTERN=homepage
REPO_MATCH_61_LINE=docs/HANDOFF-20260618-authentik-npmplus.md:73:host: homepage.vpn.gram1.ru
REPO_MATCH_62_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_62_PATH=docs/RUNBOOK-PRIVATE-VPN-HOSTS-20260618.md
REPO_MATCH_62_PATTERN=homepage
REPO_MATCH_62_LINE=docs/RUNBOOK-PRIVATE-VPN-HOSTS-20260618.md:22:homepage.vpn.gram1.ru    -> [PRIVATE_IP] -> NPMplus -> [PRIVATE_IP]:3000
REPO_MATCH_63_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_63_PATH=docs/RUNBOOK-PRIVATE-VPN-HOSTS-20260618.md
REPO_MATCH_63_PATTERN=homepage
REPO_MATCH_63_LINE=docs/RUNBOOK-PRIVATE-VPN-HOSTS-20260618.md:55:EDGE_HOST=edge-vm;DOCKER_IMAGES=actual-budget=actualbudget/actual-server:latest;authentik-postgresql-1=postgres:16-alpine;authentik-server-1=ghcr.io/goauthentik/server:2026.5.3;authentik-worker-1=ghcr.io/goauthentik/server:2026.5.3;beszel=henrygd/beszel:latest;crowdsec=crowdsecurity/crowdsec:latest;dockge=louislam/dockge:1;dozzle=amir20/dozzle:latest;filebrowser=filebrowser/filebrowser:latest;gitea=docker.gitea.com/gitea:1.26.2;gotify=gotify/server:latest;grafana=grafana/grafana:latest;homeassistant=ghcr.io/home-assistant/home-assistant:stable;homebox=ghcr.io/sysadminsmedia/homebox:latest-rootless;homepage=ghcr.io/gethomepage/homepage:latest;immi
REPO_MATCH_64_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_64_PATH=docs/SERVICES-BOOTSTRAP-20260617.md
REPO_MATCH_64_PATTERN=homepage
REPO_MATCH_64_LINE=docs/SERVICES-BOOTSTRAP-20260617.md:15:STACKS=/opt/stacks/ntfy;/opt/stacks/filebrowser;/opt/stacks/searxng;/opt/stacks/mealie;/opt/stacks/homeassistant;/opt/stacks/homebox;/opt/stacks/it-tools;/opt/stacks/minio;/opt/stacks/crowdsec;/opt/stacks/linkding;/opt/stacks/observability-lite;/opt/stacks/gitea;/opt/stacks/memos;/opt/stacks/node-red;/opt/stacks/paperless;/opt/stacks/karakeep;/opt/stacks/beszel;/opt/stacks/actual-budget;/opt/stacks/dozzle;/opt/stacks/homepage;/opt/stacks/syncthing;/opt/stacks/n8n;
REPO_MATCH_65_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_65_PATH=docs/SERVICES-BOOTSTRAP-20260617.md
REPO_MATCH_65_PATTERN=homepage
REPO_MATCH_65_LINE=docs/SERVICES-BOOTSTRAP-20260617.md:16:CONTAINERS=actual-budget|actualbudget/actual-server:latest|Up 11 hours|[PRIVATE_IP]:5006->5006/tcp;[redacted] 36 hours (healthy)|5432/tcp;[redacted] 36 hours (healthy)|[PRIVATE_IP]:9000->9000/tcp, [PRIVATE_IP]:9443->9443/tcp;[redacted] 36 hours (healthy)|;beszel|henrygd/beszel:latest|Up 12 hours|[PRIVATE_IP]:8090->8090/tcp;crowdsec|crowdsecurity/crowdsec:latest|Up 11 hours|;dockge|louislam/dockge:1|Up 36 hours (healthy)|[PRIVATE_IP]:5001->5001/tcp;dozzle|amir20/dozzle:latest|Up 36 hours|[PRIVATE_IP]:9999->8080/tcp;filebrowser|filebrowser/filebrowser:latest|Up 10 hours (healthy)|[PRIVATE_IP]:8085->80/tcp;gitea|docker.gitea.com/gitea:1.26.2|Up 36 hours|22
REPO_MATCH_66_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_66_PATH=docs/SERVICES-BOOTSTRAP-20260617.md
REPO_MATCH_66_PATTERN=homepage
REPO_MATCH_66_LINE=docs/SERVICES-BOOTSTRAP-20260617.md:208:homepage.vpn.gram1.ru    -> [PRIVATE_IP] -> [PRIVATE_IP]:3000
REPO_MATCH_67_REPO_SHA=bda448179d6d1f16a6340a95e7cf3b4f963deeb55630695f814993ac8c8ff65e
REPO_MATCH_67_PATH=docs/SERVICES-BOOTSTRAP-20260617.md
REPO_MATCH_67_PATTERN=homepage
REPO_MATCH_67_LINE=docs/SERVICES-BOOTSTRAP-20260617.md:216:BINDING=      - NPM_IPV4_BINDING=[PRIVATE_IP];      - IPV4_BINDING=[PRIVATE_IP];;ACCESS=5|access_list_id=1|address=[PRIVATE_IP]/24|directive=allow;6|access_list_id=1|address=[PRIVATE_IP]/24|directive=allow;7|access_list_id=1|address=[PRIVATE_IP]/16|directive=allow;8|access_list_id=1|address=[PRIVATE_IP]/16|directive=allow;;PROXIES=16|["kuma.vpn.gram1.ru"]|forward=http://[PRIVATE_IP]:3001|cert=32|access=1|enabled=1|ssl_forced=1|hsts=0;17|["homepage.vpn.gram1.ru"]|forward=http://[PRIVATE_IP]:3000|cert=32|access=1|enabled=1|ssl_forced=1|hsts=0;18|["gitea.vpn.gram1.ru"]|forward=http://[PRIVATE_IP]:3002|cert=32|access=1|enabled=1|ssl_forced=1|hsts=0;19|["fi
REPO_MATCH_68_REPO_SHA=b3bd020ee5e776df415b94aee9451ce762c9c91c320a7e6502cf0c1435363c7f
REPO_MATCH_68_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
REPO_MATCH_68_PATTERN=homepage
REPO_MATCH_68_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
REPO_MATCH_69_REPO_SHA=b3bd020ee5e776df415b94aee9451ce762c9c91c320a7e6502cf0c1435363c7f
REPO_MATCH_69_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
REPO_MATCH_69_PATTERN=homepage
REPO_MATCH_69_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          "name": "homepage",
REPO_MATCH_70_REPO_SHA=b3bd020ee5e776df415b94aee9451ce762c9c91c320a7e6502cf0c1435363c7f
REPO_MATCH_70_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
REPO_MATCH_70_PATTERN=homepage
REPO_MATCH_70_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          "image": "ghcr.io/gethomepage/homepage:latest",
REPO_MATCH_71_REPO_SHA=43edb8c759a325850dc949c70678f7d00db21eee7cd62c8909cea8281531314d
REPO_MATCH_71_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
REPO_MATCH_71_PATTERN=homepage
REPO_MATCH_71_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
REPO_MATCH_72_REPO_SHA=43edb8c759a325850dc949c70678f7d00db21eee7cd62c8909cea8281531314d
REPO_MATCH_72_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
REPO_MATCH_72_PATTERN=homepage
REPO_MATCH_72_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          "name": "homepage",
REPO_MATCH_73_REPO_SHA=43edb8c759a325850dc949c70678f7d00db21eee7cd62c8909cea8281531314d
REPO_MATCH_73_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
REPO_MATCH_73_PATTERN=homepage
REPO_MATCH_73_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          "image": "ghcr.io/gethomepage/homepage:latest",
REPO_MATCH_74_REPO_SHA=23273fcc8384fcaaa64503e3daf9d2ad455c5be24d496dbd4d82bb7bf67f489d
REPO_MATCH_74_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
REPO_MATCH_74_PATTERN=homepage
REPO_MATCH_74_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
REPO_MATCH_75_REPO_SHA=23273fcc8384fcaaa64503e3daf9d2ad455c5be24d496dbd4d82bb7bf67f489d
REPO_MATCH_75_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
REPO_MATCH_75_PATTERN=homepage
REPO_MATCH_75_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          "name": "homepage",
REPO_MATCH_76_REPO_SHA=23273fcc8384fcaaa64503e3daf9d2ad455c5be24d496dbd4d82bb7bf67f489d
REPO_MATCH_76_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
REPO_MATCH_76_PATTERN=homepage
REPO_MATCH_76_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          "image": "ghcr.io/gethomepage/homepage:latest",
REPO_MATCH_77_REPO_SHA=01acf10171d1463b5d9692c69ca3ae04684a26fe7afd5716891c325e80e771bc
REPO_MATCH_77_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
REPO_MATCH_77_PATTERN=homepage
REPO_MATCH_77_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
REPO_MATCH_78_REPO_SHA=01acf10171d1463b5d9692c69ca3ae04684a26fe7afd5716891c325e80e771bc
REPO_MATCH_78_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
REPO_MATCH_78_PATTERN=homepage
REPO_MATCH_78_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1396:          "name": "homepage",
REPO_MATCH_79_REPO_SHA=01acf10171d1463b5d9692c69ca3ae04684a26fe7afd5716891c325e80e771bc
REPO_MATCH_79_PATH=kb/private/archive/2026-08-19/machine/cluster_inventory.json
REPO_MATCH_79_PATTERN=homepage
REPO_MATCH_79_LINE=kb/private/archive/2026-08-19/machine/cluster_inventory.json:1397:          "image": "ghcr.io/gethomepage/homepage:latest",
REPO_MATCH_80_REPO_SHA=6a5d39387f04765b96e1ce0ad8b812560f60db0fdb2f8202d25647714ce7ef81
REPO_MATCH_80_PATH=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md
REPO_MATCH_80_PATTERN=homepage
REPO_MATCH_80_LINE=kb/private/archive/2026-08-19/docs/03_SERVICE_CATALOG.md:154:- `homepage` — `ghcr.io/gethomepage/homepage:latest` — Up 2 weeks (healthy) — `[PRIVATE_IP]:3000->3000/tcp`
REPO_MATCH_COUNT=80
HOMEPAGE_ALLOWED_HOSTS_SOURCE_EVIDENCE=true
CLUSTER_RESOURCES_RC=0
CLUSTER_RESOURCES_JSON=true
CLUSTER_CANDIDATE_COUNT=1
CAND_1_VMID=190
CAND_1_TYPE=qemu
CAND_1_NODE=pve03
CAND_1_STATUS=running
CAND_1_NAME=homelab-ops-worker
ONLINE_NODE_COUNT=3
NODE_PVE02_SEARCH_RC=0
NODE_PVE03_SEARCH_RC=0
NODE_PVE01_SEARCH_RC=0
HOSTCFG_1_NODE=pve01
HOSTCFG_1_PATH=/srv/homelab-ops-worktrees/cr-2026-0017-inventory-foundation/observed/services/index.json
HOSTCFG_2_NODE=pve01
HOSTCFG_2_PATH=/srv/homelab-ops-worktrees/cr-2026-0017-inventory-foundation/inventory/services.json
HOSTCFG_3_NODE=pve01
HOSTCFG_3_PATH=/srv/homelab-desired-state/health/service-readiness-homepage.txt
HOSTCFG_MATCH_COUNT=3
GUEST_190_EXEC_RC=255
GUEST_OBSERVATION_COUNT=0
EXTERNAL_403_REPRODUCED=false
DECISION=ANALYZE_HOME_GRAM1_403_TOPOLOGY
NEXT_GATE=HOME_GRAM1_TARGETED_REPAIR
TASK_RESULT=HOME_GRAM1_HTTP403_TOPOLOGY_RCA
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION

OUTPUT_END
CHAT_OUTPUT_END
