runtime: publish SUPPORT-260925-BEGET-DNS-NORMAL-GHOST-AUDIT-P1-9230R1
This commit is contained in:
homelab-runtime-publisher
+18
-82
@@ -1,22 +1,22 @@
|
||||
CHAT_OUTPUT_BEGIN
|
||||
COMMAND_ID=SUPPORT-260925-SKLADCHIK-USA-MIGRATION-AUTHORITY-MINIREAD-73276R1
|
||||
STATUS=OK
|
||||
RC=0
|
||||
COMMAND_ID=SUPPORT-260925-BEGET-DNS-NORMAL-GHOST-AUDIT-P1-9230R1
|
||||
STATUS=FAIL
|
||||
RC=47
|
||||
HOST=pve01
|
||||
MODE=read-only
|
||||
COMPONENT=skladchik-usa-migration-authority-miniread
|
||||
COMPONENT=beget-dns-d02-reconcile
|
||||
REFERENCE_REGISTER_CHECK=OK
|
||||
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
|
||||
ERROR_REGISTER_CHECK=OK
|
||||
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
|
||||
COMMAND_SHA256=50e4c7308ff3d4c751750cc63eee7536aa985f884c94b84ffcc1180c5eb60b05
|
||||
COMMAND_SHA256=7333a33e8778bca60cef501d5049b1981e107d08db1413316c77af44105d65b9
|
||||
DUPLICATE_FAILED_COMMAND_BLOCKED=false
|
||||
EXECUTION_STARTED=true
|
||||
CHANGE_DECLARED=false
|
||||
RESULT_CONTRACT_VALID=true
|
||||
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
|
||||
RESULT_CONTRACT_ERROR=NONE
|
||||
COMMAND_RC=0
|
||||
COMMAND_RC=47
|
||||
CHANGES_MADE=false
|
||||
ROLLBACK_STARTED=false
|
||||
ROLLBACK_RESTORED=null
|
||||
@@ -24,83 +24,19 @@ MUTATION_OUTCOME=NO_MUTATION
|
||||
SANITIZED=yes
|
||||
SECRETS_INCLUDED=no
|
||||
PRIVATE_ADDRESSES_INCLUDED=no
|
||||
RAW_EVIDENCE_SHA256=f9810e721990dfc12c47863f23a39ad78582eaaf2cf212ac359cfbff17121390
|
||||
SANITIZED_OUTPUT_SHA256=f9810e721990dfc12c47863f23a39ad78582eaaf2cf212ac359cfbff17121390
|
||||
RAW_EVIDENCE_SHA256=c39107ec7e13b2caf7fbfa048c901b65aade5cf997565b4dab7346f64ec20d0c
|
||||
SANITIZED_OUTPUT_SHA256=c39107ec7e13b2caf7fbfa048c901b65aade5cf997565b4dab7346f64ec20d0c
|
||||
OUTPUT_BEGIN
|
||||
RCA_VERSION=73276_V1
|
||||
MODE=read-only
|
||||
MIGRATION_DOC_EXISTS=true
|
||||
MIGRATION_DOC_SHA256=12fe079849346352315aac76fae82d00cbd17f88a3553270ca2c5f2749840552
|
||||
RUNBOOK_EXISTS=true
|
||||
RUNBOOK_SHA256=725e2068337b379ebdf47822d5871aa5f4d5ec5956546674b2cf55b3250fb7a3
|
||||
MIGRATION_DOC_SHA_MATCH=true
|
||||
RUNBOOK_SHA_MATCH=true
|
||||
FILE_BEGIN=20_NETBIRD_USA_MIGRATION_2026-08-18.md
|
||||
1:# NETBIRD USA MIGRATION — FINAL CURRENT RECORD
|
||||
5:Old USA mail/NetBird VPS:
|
||||
11:Host-level NetBird client left running for rollback/peer observation.
|
||||
54:- [TOKEN_OR_KEY] startup
|
||||
56:- Moldova synthetic check passes
|
||||
57:- edge peer works
|
||||
61:- `:9000/health` 503 in combined relay/server mode
|
||||
70:- narrow TrustedPeers
|
||||
71:- fix Traefik Compose network warning
|
||||
FILE_END=20_NETBIRD_USA_MIGRATION_2026-08-18.md
|
||||
FILE_BEGIN=04_NETBIRD_USA.md
|
||||
1:# Runbook: NetBird USA
|
||||
5:Do not use `/api/health` or combined `:9000/health` as generic readiness gates for this exact deployment; they were 404/503 and caused a false rollback. Use repeated Dashboard 200 + OIDC 200 + expected listeners + real client/peer connectivity.
|
||||
14:7. retain migration key only until old USA is no longer needed.
|
||||
FILE_END=04_NETBIRD_USA.md
|
||||
FILE_BEGIN=771z_after_manual_netbird_egress_capi.sh
|
||||
3:if ! test -s [TOKEN_OR_KEY].md || ! test -s [TOKEN_OR_KEY].md; then echo [TOKEN_OR_KEY]; exit 1; fi
|
||||
8:PROOF="[TOKEN_OR_KEY]${TS}_PROOF.txt"
|
||||
14: echo "[TOKEN_OR_KEY]"
|
||||
17: echo "[TOKEN_OR_KEY]"
|
||||
18: echo "TARGETS=edge-vm:[IP] relay-moldova:[IP] mail-usa:[IP]"
|
||||
67: networks:
|
||||
71:networks:
|
||||
94: networks:
|
||||
98:networks:
|
||||
180: raise SystemExit("api.server block not found")
|
||||
201:echo "PEERS_RELAY_MAIL_EDGE"
|
||||
209: for peer in data.get("peers",{}).get("details",[]):
|
||||
210: fqdn=peer.get("fqdn","")
|
||||
211: ip=peer.get("netbirdIp","")
|
||||
212: if ip in {"[IP]","[IP]","[IP]"} or any(x in fqdn for x in ["relay","mail","edge-vm"]):
|
||||
213: print("PEER", fqdn, ip, "status="+str(peer.get("status")), "handshake="+str(peer.get("lastWireguardHandshake")), "conn="+str(peer.get("connectionType")))
|
||||
216:echo "RELAY_MAIL_CONNECTIVITY"
|
||||
219: ip route get "$ip" 2>&1 || true
|
||||
224:echo "WG_ALLOWED_IPS_RELAY_MAIL"
|
||||
226: wg show wt0 allowed-ips 2>/dev/null | sed -E 's/^[A-Za-z0-9+\/=]{20,}/PEERKEY_REDACTED/' | grep -E '100\.100\.19\.1|100\.100\.147\.204|0\.0\.0\.0/0|100\.100\.0\.0/16' || echo [TOKEN_OR_KEY]
|
||||
229:echo "[TOKEN_OR_KEY]"
|
||||
239: wait_lapi "CAPI_ROUTE_NOT_READY_SAFE" || true
|
||||
240: write_health "[TOKEN_OR_KEY]" "After manual NetBird setup, edge still cannot reach api.crowdsec.net; CrowdSec remains LAPI-only no-capi"
|
||||
241: echo "[TOKEN_OR_KEY]"
|
||||
243: exit 70
|
||||
246:echo "[TOKEN_OR_KEY]"
|
||||
247:cd "$STACK" || exit 71
|
||||
248:mkdir -p "manual-backups/771z-$TS"
|
||||
249:test -f config/config.yaml && cp -a config/config.yaml "manual-backups/771z-$TS/config.yaml.before" || true
|
||||
250:test -f config/user.yaml && cp -a config/user.yaml "manual-backups/771z-$TS/user.yaml.before" || true
|
||||
251:test -f [TOKEN_OR_KEY].yaml && mv [TOKEN_OR_KEY].yaml "manual-backups/771z-$TS/online_api_credentials.yaml.before" || true
|
||||
257: write_health "[TOKEN_OR_KEY]" "Direct CAPI route works, but compose CAPI enable failed"
|
||||
258: exit 72
|
||||
262:wait_lapi "REGISTER_MODE" || exit 73
|
||||
284: write_health "[TOKEN_OR_KEY]" "Direct CAPI route works, but cscli capi register failed; restored no-capi"
|
||||
287: exit 74
|
||||
290:stat -c 'ONLINE_CREDS path=%n mode=%a owner=%U group=%G size=%s' [TOKEN_OR_KEY].yaml || true
|
||||
294:enable_capi_compose || exit 75
|
||||
315: write_health "[TOKEN_OR_KEY]" "CrowdSec CAPI registered and stable after manual NetBird egress via relay/mail"
|
||||
318: exit 0
|
||||
326:exit 76
|
||||
329: echo "POST_ROUTE_SMOKE"
|
||||
337: echo [TOKEN_OR_KEY]
|
||||
FILE_END=771z_after_manual_netbird_egress_capi.sh
|
||||
AUTHORITY_CANONICAL_READY=true
|
||||
DECISION=PASS_USA_MIGRATION_AUTHORITY_COLLECTED
|
||||
NEXT_GATE=BUILD_USA_EGRESS_AND_LOCAL_STACK_REPAIR
|
||||
TASK_RESULT=PASS_USA_MIGRATION_AUTHORITY_RCA
|
||||
HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260925-SKLADCHIK-USA-MIGRATION-AUTHORITY-MINIREAD-73276R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
|
||||
DNS9230_BEGIN=true
|
||||
TASK_COMPLETE=true
|
||||
TASK_RESULT=FAIL_9230_PRESTATE_SUBDOMAIN_MODEL
|
||||
DECISION=STOP_NO_MUTATION
|
||||
DNS_MUTATION_BY_9230=0
|
||||
PUBLIC_DNS_CHANGED=0
|
||||
PUBLIC_NS_CHANGED=0
|
||||
PVEPRO_MUTATED=0
|
||||
HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260925-BEGET-DNS-NORMAL-GHOST-AUDIT-P1-9230R1","status":"FAIL","changes_made":false,"rollback_started":false,"rollback_restored":null}
|
||||
DNS9230_END=true
|
||||
|
||||
OUTPUT_END
|
||||
CHAT_OUTPUT_END
|
||||
|
||||
Reference in New Issue
Block a user