From bf217889c69b3a2240f8d66bd6d36eb60851399d Mon Sep 17 00:00:00 2001 From: homelab-runtime-publisher Date: Wed, 23 Sep 2026 15:40:19 +0000 Subject: [PATCH] runtime: publish SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1 --- ...-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1.json | 38 +++++++++ ...B-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1.txt | 77 +++++++++++++++++ runtime/latest.json | 22 ++--- runtime/latest.txt | 84 ++++++++++++------- 4 files changed, 179 insertions(+), 42 deletions(-) create mode 100644 runtime/history/SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1.json create mode 100644 runtime/history/SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1.txt diff --git a/runtime/history/SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1.json b/runtime/history/SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1.json new file mode 100644 index 00000000..2cb146a7 --- /dev/null +++ b/runtime/history/SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1.json @@ -0,0 +1,38 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1", + "status": "OK", + "rc": 0, + "host": "pve01", + "mode": "read-only", + "component": "spb-home-wan-router-snikket-audit", + "started_at_utc": "2026-09-23T15:39:27Z", + "finished_at_utc": "2026-09-23T15:40:18Z", + "reference_register_checked": true, + "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66", + "error_register_checked": true, + "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0", + "command_sha256": "e8cf489f5c96585a16ddf42ca05d7f8f60a72b6f41cb180c370c54028398971a", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "change_declared": false, + "result_contract_valid": true, + "result_contract_status": null, + "result_contract_error": null, + "command_rc": 0, + "changes_made": false, + "rollback_started": false, + "rollback_restored": null, + "mutation_outcome": "NO_MUTATION", + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "ab2409f5a0b922cddc2c05b1fa06f012701bfee81045a413e48a6f9ef4f8cab4", + "sanitized_output_sha256": "ab2409f5a0b922cddc2c05b1fa06f012701bfee81045a413e48a6f9ef4f8cab4", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "WAN9213_BEGIN=true\nMODE=READ_ONLY_TRUE_WAN_ROUTER_SNIKKET_AUDIT\nMUTATION_BOUNDARY=NONE;NO_ROUTER_WRITE;NO_SPB_WRITE;NO_GUEST_WRITE;NO_DNS_WRITE;NO_SHUTDOWN\nLOCAL9209_BEGIN=true\nCID=SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1\nPLINK_PRESENT=true\nSPB_CANDIDATE_COUNT=1\nSPB_CANDIDATE_SHA16=6d6149f42864ce03\nHOME_CANDIDATE_COUNT=1\nHOME_CANDIDATE_SHA16=bc517b4af3298846\nSPB_HASH_MATCH=true\nSPB_PINNED_PROBE_RC=0\nDPAPI_DECRYPTABLE_COUNT=1\nOLD9208_LOCAL_ERR_SHA16=5a00a4ad6f6ef637\nLOCAL_ACCESS_STATUS=PASS\nLOCAL9209_END=true\nSPB_PINNED_ACCESS=PASS\nSPB_EXTRACT_RC=0\nPVE_TRUE_WAN_AUDIT_RC=0\nVM130_QGA_TRANSPORT_RC=0\nVM150_QGA_TRANSPORT_RC=0\nSPB_TRUE_WAN_PROBE_RC=0\nTRUE_WAN9213={\"dns\":{\"chat.gram1.ru\":{\"1.1.1.1\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]},\"8.8.8.8\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]}},\"git.gram1.ru\":{\"1.1.1.1\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]},\"8.8.8.8\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]}},\"groups.chat.gram1.ru\":{\"1.1.1.1\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]},\"8.8.8.8\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]}},\"share.chat.gram1.ru\":{\"1.1.1.1\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]},\"8.8.8.8\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]}}},\"evidence\":[{\"line\":234,\"text\":\"- WAN DHCP observed in router log: , gateway .\"},{\"line\":315,\"text\":\"### NAT / port forwarding\"},{\"line\":316,\"text\":\"- ISP tcp/80 -> bc:24:11:e1:f3:3c, NPMplus.\"},{\"line\":317,\"text\":\"- ISP tcp/443 -> bc:24:11:e1:f3:3c, NPMplus.\"},{\"line\":318,\"text\":\"- ISP tcpudp/3478 -> bc:24:11:e1:9a:25, Nextcloud Talk TURN.\"},{\"line\":319,\"text\":\"- Home tcp/51820 -> bc:24:11:f4:c5:d8, WireGuard vpn1.\"},{\"line\":378,\"text\":\"- WireGuard port: 51820.\"},{\"line\":683,\"text\":\"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, .\"},{\"line\":684,\"text\":\"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on .\"},{\"line\":685,\"text\":\"- Router forwards Home TCP/51820 to WireGuard host .\"},{\"line\":1356,\"text\":\"- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm .\"},{\"line\":1420,\"text\":\"- Router forwards TCP/UDP 3478 to Nextcloud .\"},{\"line\":1421,\"text\":\"- Router forwards TCP/UDP 51820 for WireGuard on the Home bridge, not to edge-vm.\"}],\"router\":{\"artifact_hits\":[{\"basename\":\"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md\",\"path_sha16\":\"7c0a71546dbaf313\"},{\"basename\":\"31_HOMELAB_REFERENCE.md\",\"path_sha16\":\"b6a8564938774058\"},{\"basename\":\"HOMELAB_FULL_HANDOFF_CURRENT.md\",\"path_sha16\":\"aff2edacfd1256cd\"},{\"basename\":\"HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z\",\"path_sha16\":\"36bb80fe9818f709\"},{\"basename\":\"HOMELAB_ASSISTANT_ERROR_REGISTER.md\",\"path_sha16\":\"035234526670966e\"},{\"basename\":\"HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-proof-repair-20260630T215529Z\",\"path_sha16\":\"4cddf80b93b25b32\"}],\"gateway_sha16\":\"4f9da1283166a1e9\",\"ports\":{\"22\":\"TIMEOUT\",\"23\":\"TIMEOUT\",\"2323\":\"TIMEOUT\",\"443\":\"TIMEOUT\",\"80\":\"TIMEOUT\"}},\"wan\":{\"hashes\":[\"26ac437d63a8bcf2\"],\"source_count\":2,\"unique_count\":1}}\nVM130_EDGE_AUDIT={\"addresses\":[{\"iface\":\"lo\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"12ca17b49af22894\"},{\"iface\":\"eth0\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"bc517b4af3298846\"},{\"iface\":\"wg-taftauto\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"d1d4b6abdd6b1971\"},{\"iface\":\"wg-edge01\",\"is_egress_source\":false,\"is_target\":true,\"sha16\":\"0b7870e2230336f5\"},{\"iface\":\"br-4d894f9e427b\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"fbd57f0145e15cc8\"},{\"iface\":\"br-5f66e1018bdd\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"5db063f47c3859a0\"},{\"iface\":\"br-8122fec51f39\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"93449cac351e054d\"},{\"iface\":\"docker0\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"346840d5a3d9fe9b\"},{\"iface\":\"br-915a81681c3e\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"bc41ed840e460923\"},{\"iface\":\"br-a4e31561a8d5\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"c138df8d3b53b190\"},{\"iface\":\"br-d41b3e918fbc\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"f9bcbcb71ab0bfd4\"},{\"iface\":\"br-f43db13d76c4\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"885dfc9b72d2209e\"}],\"config_hits\":[{\"basename\":\"cloud-init-network.service\",\"lines\":[{\"line\":28,\"text\":\"# stage can start, and then wait on a return socket until the cloud-init\"},{\"line\":29,\"text\":\"# process has completed this stage. The output from the return socket is piped\"},{\"line\":32,\"text\":\"ExecStart=sh -c 'echo \\\"start\\\" | nc -Uu -W1 /run/cloud-init/share/network.sock -s /run/cloud-init/share/network-return.sock | sh'\"}],\"path_sha16\":\"d00cb9850586513a\"},{\"basename\":\"snikket-edge-ingress.nft\",\"lines\":[{\"line\":1,\"text\":\"table ip snikket_edge_prod {\"},{\"line\":4,\"text\":\" iifname \\\"wg-edge01\\\" ip saddr ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } dnat to \"},{\"line\":5,\"text\":\" iifname \\\"wg-edge01\\\" ip saddr ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } dnat to \"},{\"line\":9,\"text\":\" oifname \\\"eth0\\\" ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } snat to \"},{\"line\":10,\"text\":\" oifname \\\"eth0\\\" ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } snat to \"}],\"path_sha16\":\"70fb445de6996d23\"},{\"basename\":\"p2-22-health-surface-response-validation-return-packet-20260626T023040Z.json\",\"lines\":[{\"line\":128,\"text\":\" \\\"return_packet_flow\\\": [\"},{\"line\":160,\"text\":\" \\\"return_rows\\\": [\"},{\"line\":178,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":215,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_01\\\",\"},{\"line\":241,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":278,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_02\\\",\"},{\"line\":304,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":341,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_03\\\",\"},{\"line\":367,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":404,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_04\\\",\"},{\"line\":430,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":467,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_05\\\",\"},{\"line\":493,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":530,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_06\\\",\"},{\"line\":556,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":593,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_07\\\",\"},{\"line\":619,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":656,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_08\\\",\"},{\"line\":682,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":719,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_09\\\",\"}],\"path_sha16\":\"fe6950b250508445\"},{\"basename\":\"p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json\",\"lines\":[{\"line\":348,\"text\":\" \\\"Monitor proxy reachability and verify no direct socket mounts return for migrated clients.\\\"\"}],\"path_sha16\":\"8733d16ab518b1f6\"},{\"basename\":\"p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json\",\"lines\":[{\"line\":217,\"text\":\" \\\"Monitor proxy reachability and verify no direct socket mounts return for migrated clients.\\\"\"}],\"path_sha16\":\"048ed578a90e647c\"},{\"basename\":\"composer.py\",\"lines\":[{\"line\":22,\"text\":\" return not self.check_event(StreamEndEvent)\"},{\"line\":27,\"text\":\" return self.compose_document()\"},{\"line\":48,\"text\":\" return document\"},{\"line\":61,\"text\":\" return node\"},{\"line\":70,\"text\":\" return self.anchors[anchor]\"},{\"line\":86,\"text\":\" return node\"},{\"line\":97,\"text\":\" return node\"},{\"line\":115,\"text\":\" return node\"},{\"line\":138,\"text\":\" return node\"}],\"path_sha16\":\"c73308fe0d2115d3\"},{\"basename\":\"composer.py\",\"lines\":[{\"line\":22,\"text\":\" return not self.check_event(StreamEndEvent)\"},{\"line\":27,\"text\":\" return self.compose_document()\"},{\"line\":48,\"text\":\" return document\"},{\"line\":61,\"text\":\" return node\"},{\"line\":70,\"text\":\" return self.anchors[anchor]\"},{\"line\":86,\"text\":\" return node\"},{\"line\":97,\"text\":\" return node\"},{\"line\":115,\"text\":\" return node\"},{\"line\":138,\"text\":\" return node\"}],\"path_sha16\":\"7d17ddfec624c826\"}],\"docker\":[{\"image_sha16\":\"5aa369fb5eaf7c46\",\"name\":\"kopia\",\"ports_safe\":\"\"},{\"image_sha16\":\"8112a294af79d305\",\"name\":\"homelab-registry-cache\",\"ports_safe\":\"\"},{\"image_sha16\":\"ef95d2f35b4f5848\",\"name\":\"npmplus\",\"ports_safe\":\"\"},{\"image_sha16\":\"31e555942da7f897\",\"name\":\"crowdsec\",\"ports_safe\":\":7422->7422/tcp, :8088->8080/tcp\"},{\"image_sha16\":\"cdfb05c4b7a8150a\",\"name\":\"dozzle\",\"ports_safe\":\":9999->8080/tcp\"},{\"image_sha16\":\"f4704b71a591a53d\",\"name\":\"cadvisor\",\"ports_safe\":\":8081->8080/tcp\"},{\"image_sha16\":\"4a0705d1136ed8bf\",\"name\":\"alloy\",\"ports_safe\":\":12345->12345/tcp\"},{\"image_sha16\":\"5ef8646c3bb0fb15\",\"name\":\"diun\",\"ports_safe\":\"\"},{\"image_sha16\":\"33d259476c8fec4b\",\"name\":\"socket-proxy\",\"ports_safe\":\":2375->2375/tcp\"},{\"image_sha16\":\"1ad7e04d49dec6a4\",\"name\":\"loki\",\"ports_safe\":\":3100->3100/tcp\"}],\"egress_source_owned\":false,\"hostname\":\"edge-vm\",\"listeners\":[{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":51824,\"process\":\"\",\"proto\":\"udp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":55808,\"process\":\"\",\"proto\":\"udp\"},{\"port\":51824,\"process\":\"\",\"proto\":\"udp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":55808,\"process\":\"\",\"proto\":\"udp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":22,\"process\":\"sshd\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"},{\"port\":12345,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":18083,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":18091,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":18092,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":9221,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":8081,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":8088,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":8014,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":7422,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":9050,\"process\":\"tor\",\"proto\":\"tcp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"},{\"port\":81,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":81,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":81,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":81,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":9999,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":18088,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":18089,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":18090,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":18093,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"},{\"port\":9221,\"process\":\"pve_exporter\",\"proto\":\"tcp\"},{\"port\":51515,\"process\":\"kopia\",\"proto\":\"tcp\"},{\"port\":2375,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":5000,\"process\":\"registry\",\"proto\":\"tcp\"},{\"port\":3100,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":22,\"process\":\"sshd\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"}],\"nft\":[\"table ip snikket_edge_prod {\",\"iifname \\\"wg-edge01\\\" ip saddr ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } dnat to \",\"iifname \\\"wg-edge01\\\" ip saddr ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } dnat to \",\"oifname \\\"eth0\\\" ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } snat to \",\"oifname \\\"eth0\\\" ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } snat to \"],\"routes\":[\"default dev wg-edge01 table 17777 scope link \",\"default via dev eth0 proto static \",\" dev wg-taftauto proto kernel scope link src \",\" dev wg-edge01 proto kernel scope link src \",\"local dev wg-taftauto table local proto kernel scope host src \",\"broadcast dev wg-taftauto table local proto kernel scope link src \",\"local dev wg-edge01 table local proto kernel scope host src \",\"broadcast dev wg-edge01 table local proto kernel scope link src \",\"multicast ff00::/8 dev wg-edge01 table local proto kernel metric 256 pref medium\",\"multicast ff00::/8 dev wg-taftauto table local proto kernel metric 256 pref medium\"],\"target_owned\":true,\"uid\":0}\nVM150_SNIKKET_AUDIT={\"addresses\":[{\"iface\":\"lo\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"12ca17b49af22894\"},{\"iface\":\"eth0\",\"is_egress_source\":true,\"is_target\":false,\"sha16\":\"4e29a2729bbc4066\"},{\"iface\":\"docker0\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"346840d5a3d9fe9b\"}],\"config_hits\":[{\"basename\":\"docker-compose.yml\",\"lines\":[{\"line\":4,\"text\":\" snikket_proxy:\"},{\"line\":5,\"text\":\" container_name: snikket-proxy\"},{\"line\":6,\"text\":\" image: snikket/snikket-web-proxy@sha256:e2c22746c19489d2723c6ccebb15f2f14e4e35431cabbc7318d9ee33a48566e1\"},{\"line\":7,\"text\":\" env_file: snikket.conf\"},{\"line\":10,\"text\":\" - snikket_data:/snikket\"},{\"line\":13,\"text\":\" snikket_certs:\"},{\"line\":14,\"text\":\" container_name: snikket-certs\"},{\"line\":15,\"text\":\" image: snikket/snikket-cert-manager@sha256:3920d6d6ad0ff7775d80fba034cf08fe246ff3548f192621cf3be6366a17d530\"},{\"line\":17,\"text\":\" env_file: snikket.conf\"},{\"line\":19,\"text\":\" - snikket_data:/snikket\"},{\"line\":22,\"text\":\" snikket_portal:\"},{\"line\":23,\"text\":\" container_name: snikket-portal\"},{\"line\":24,\"text\":\" image: snikket/snikket-web-portal@sha256:d67ff498c44bcabc6eee0379d030870004cc37ccf445aa5450d891d4ce02e136\"},{\"line\":26,\"text\":\" env_file: snikket.conf\"},{\"line\":29,\"text\":\" snikket_server:\"},{\"line\":30,\"text\":\" container_name: snikket\"},{\"line\":31,\"text\":\" image: snikket/snikket-server@sha256:311c076e06ec0fdb182900577a936cdc8d15da50bcc6ccd6707b743a13a162f3\"},{\"line\":34,\"text\":\" - snikket_data:/snikket\"},{\"line\":35,\"text\":\" env_file: snikket.conf\"},{\"line\":40,\"text\":\" snikket_data:\"}],\"path_sha16\":\"469462f29cd9bad5\"},{\"basename\":\"snikket.conf\",\"lines\":[{\"line\":1,\"text\":\"SNIKKET_DOMAIN=chat.gram1.ru\"},{\"line\":2,\"text\":\"SNIKKET_ADMIN_EMAIL=noreply@pvepro.ru\"},{\"line\":3,\"text\":\"SNIKKET_TWEAK_TURNSERVER_MIN_PORT=60000\"},{\"line\":4,\"text\":\"SNIKKET_TWEAK_TURNSERVER_MAX_PORT=60199\"},{\"line\":6,\"text\":\"SNIKKET_TWEAK_TURNSERVER_INTERNAL_IP=\"}],\"path_sha16\":\"82259917e6cb2726\"},{\"basename\":\"docker-compose.override.yml\",\"lines\":[{\"line\":2,\"text\":\" snikket_server:\"},{\"line\":8,\"text\":\" source: /etc/snikket/turnfix/coturn-run\"},{\"line\":9,\"text\":\" target: /etc/sv/coturn/run\"},{\"line\":12,\"text\":\" source: /etc/snikket/turnfix/coturn-run.upstream\"},{\"line\":13,\"text\":\" target: /etc/sv/coturn/run.upstream\"}],\"path_sha16\":\"370d0aff3f71ce75\"},{\"basename\":\"coturn-run\",\"lines\":[{\"line\":3,\"text\":\"CRT=\\\"$CERTDIR/$SNIKKET_DOMAIN_ASCII.crt\\\"\"},{\"line\":4,\"text\":\"KEY=\\\"$CERTDIR/$SNIKKET_DOMAIN_ASCII.key\\\"\"},{\"line\":10,\"text\":\"chgrp turnserver \\\"$CERTDIR\\\" \\\"$CRT\\\" \\\"$KEY\\\"\"},{\"line\":15,\"text\":\"sed -i 's#^userdb=/snikket/prosody/turndb$#userdb=/var/lib/turn/turndb#' /etc/turnserver.conf\"},{\"line\":16,\"text\":\"install -d -o turnserver -g turnserver -m 0775 /var/lib/turn\"},{\"line\":18,\"text\":\"exec /etc/sv/coturn/run.upstream\"}],\"path_sha16\":\"b77d42082a9cc138\"},{\"basename\":\"coturn-run.upstream\",\"lines\":[{\"line\":3,\"text\":\"if [ \\\"$SNIKKET_TWEAK_TURNSERVER\\\" = \\\"0\\\" ]; then\"},{\"line\":4,\"text\":\"\\techo \\\"TURN server disabled by environment, not launching.\\\";\"},{\"line\":8,\"text\":\"CERTFILE=\\\"/etc/prosody/certs/$SNIKKET_DOMAIN_ASCII.crt\\\";\"},{\"line\":9,\"text\":\"KEYFILE=\\\"/etc/prosody/certs/$SNIKKET_DOMAIN_ASCII.key\\\";\"},{\"line\":17,\"text\":\"TURN_EXTERNAL_IP=\\\"$(snikket-turn-addresses \\\"$SNIKKET_DOMAIN_ASCII\\\")\\\"\"},{\"line\":19,\"text\":\"min_port=\\\"${SNIKKET_TWEAK_TURNSERVER_MIN_PORT:-49152}\\\"\"},{\"line\":20,\"text\":\"max_port=\\\"${SNIKKET_TWEAK_TURNSERVER_MAX_PORT:-65535}\\\"\"},{\"line\":22,\"text\":\"exec s6-setuidgid turnserver /usr/bin/turnserver -c /etc/turnserver.conf --prod \\\\\"},{\"line\":23,\"text\":\" --static-auth-secret= /snikket/prosody/turn-auth-secret-v2)\\\" \\\\\"},{\"line\":24,\"text\":\" --cert=\\\"$CERTFILE\\\" --pkey \\\"$KEYFILE\\\" -r \\\"$SNIKKET_DOMAIN_ASCII\\\" \\\\\"},{\"line\":26,\"text\":\" --listening-port \\\"${SNIKKET_TWEAK_TURNSERVER_PORT-3478}\\\" \\\\\"},{\"line\":27,\"text\":\" -X \\\"$TURN_EXTERNAL_IP\\\"\"}],\"path_sha16\":\"b6e1eb9791801900\"},{\"basename\":\"snikket-edge-egress.service\",\"lines\":[{\"line\":2,\"text\":\"Description=Snikket Internet egress via edge-vm\"}],\"path_sha16\":\"ff8de9e3bc6968cf\"},{\"basename\":\"snikket-turn-reconcile.service\",\"lines\":[{\"line\":2,\"text\":\"Description=Reconcile Snikket TURN certificate permissions and listeners\"},{\"line\":8,\"text\":\"ExecStart=/usr/local/sbin/snikket-turn-reconcile\"}],\"path_sha16\":\"b3c0283f7af1bd61\"},{\"basename\":\"snikket-turn-reconcile.timer\",\"lines\":[{\"line\":2,\"text\":\"Description=Periodic Snikket TURN durability reconciliation\"},{\"line\":9,\"text\":\"Unit=snikket-turn-reconcile.service\"}],\"path_sha16\":\"130e65f40043e8f2\"},{\"basename\":\"snikket-turn-reconcile.timer\",\"lines\":[{\"line\":2,\"text\":\"Description=Periodic Snikket TURN durability reconciliation\"},{\"line\":9,\"text\":\"Unit=snikket-turn-reconcile.service\"}],\"path_sha16\":\"e9b69f6136ce9691\"},{\"basename\":\"cloud-init-network.service\",\"lines\":[{\"line\":28,\"text\":\"# stage can start, and then wait on a return socket until the cloud-init\"},{\"line\":29,\"text\":\"# process has completed this stage. The output from the return socket is piped\"},{\"line\":32,\"text\":\"ExecStart=sh -c 'echo \\\"start\\\" | nc -Uu -W1 /run/cloud-init/share/network.sock -s /run/cloud-init/share/network-return.sock | sh'\"}],\"path_sha16\":\"d00cb9850586513a\"},{\"basename\":\"snikket-edge-egress.service\",\"lines\":[{\"line\":2,\"text\":\"Description=Snikket Internet egress via edge-vm\"}],\"path_sha16\":\"01d7d6f52fe7a474\"}],\"docker\":[{\"image_sha16\":\"0c2eab14269992f7\",\"name\":\"snikket\",\"ports_safe\":\"\"},{\"image_sha16\":\"196c632b7cd3d6fe\",\"name\":\"snikket-portal\",\"ports_safe\":\"\"},{\"image_sha16\":\"afdc9a1e6d2b82c1\",\"name\":\"snikket-certs\",\"ports_safe\":\"\"},{\"image_sha16\":\"f2e47aabc41c5e2d\",\"name\":\"snikket-proxy\",\"ports_safe\":\"\"}],\"egress_source_owned\":true,\"hostname\":\"snikket\",\"listeners\":[{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5280,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":46313,\"process\":\"containerd\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"},{\"port\":5765,\"process\":\"hypercorn\",\"proto\":\"tcp\"},{\"port\":22,\"process\":\"sshd\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":5000,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5223,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5222,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5269,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":22,\"process\":\"sshd\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":5280,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":5000,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5223,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5222,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5269,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"}],\"nft\":[],\"routes\":[\"default via dev eth0 proto static \",\" dev eth0 proto kernel scope link src \",\"local dev eth0 table local proto kernel scope host src \",\"broadcast dev eth0 table local proto kernel scope link src \"],\"target_owned\":false,\"uid\":0}\nSPB_TO_TRUE_WAN_PROBE={\"tcp\":{\"3478\":\"TIMEOUT\",\"3479\":\"TIMEOUT\",\"443\":\"OPEN\",\"5000\":\"TIMEOUT\",\"5222\":\"TIMEOUT\",\"5349\":\"TIMEOUT\",\"5350\":\"TIMEOUT\",\"80\":\"OPEN\"},\"udp_stun\":{\"3478\":{\"ok\":false,\"result\":\"TIMEOUT\"},\"3479\":{\"ok\":false,\"result\":\"TIMEOUT\"}},\"wan_sha16\":\"26ac437d63a8bcf2\"}\nTRUE_WAN_CONSENSUS=true\nTRUE_WAN_SHA16=26ac437d63a8bcf2\nROUTER_MANAGEMENT_OPEN_PORTS=\nROUTER_AUTOMATION_ARTIFACT_COUNT=6\nPUBLIC_CHAT_DNS_ALREADY_HOME_WAN=false\nVM130_OWNS_SNIKKET_DNAT_TARGET=true\nVM150_OWNS_SNIKKET_DNAT_TARGET=false\nVM130_OWNS_SNIKKET_EGRESS_SOURCE=false\nVM150_OWNS_SNIKKET_EGRESS_SOURCE=true\nVM130_REQUIRED_LISTENER_COUNT=1\nVM150_REQUIRED_LISTENER_COUNT=6\nTRUE_WAN_TCP_OPEN_COUNT=2\nTRUE_WAN_STUN_OK_COUNT=0\nNEXT_ACTION=BUILD_ROUTER_SNIKKET_NAT_MIGRATION_FROM_PROVEN_TOPOLOGY\nTASK_COMPLETE=true\nTASK_RESULT=PASS_SPB_HOME_WAN_ROUTER_SNIKKET_AUDIT\nDECISION=READ_EXACT_9213_THEN_BUILD_ROUTER_MIGRATION_ONLY_FROM_PROVEN_TOPOLOGY\nNEXT_GATE=EXACT_9213_TRUE_WAN_ROUTER_SNIKKET\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n" +} diff --git a/runtime/history/SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1.txt b/runtime/history/SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1.txt new file mode 100644 index 00000000..3de7dcce --- /dev/null +++ b/runtime/history/SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1.txt @@ -0,0 +1,77 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1 +STATUS=OK +RC=0 +HOST=pve01 +MODE=read-only +COMPONENT=spb-home-wan-router-snikket-audit +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66 +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0 +COMMAND_SHA256=e8cf489f5c96585a16ddf42ca05d7f8f60a72b6f41cb180c370c54028398971a +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGE_DECLARED=false +RESULT_CONTRACT_VALID=true +RESULT_CONTRACT_STATUS=NOT_APPLICABLE +RESULT_CONTRACT_ERROR=NONE +COMMAND_RC=0 +CHANGES_MADE=false +ROLLBACK_STARTED=false +ROLLBACK_RESTORED=null +MUTATION_OUTCOME=NO_MUTATION +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=ab2409f5a0b922cddc2c05b1fa06f012701bfee81045a413e48a6f9ef4f8cab4 +SANITIZED_OUTPUT_SHA256=ab2409f5a0b922cddc2c05b1fa06f012701bfee81045a413e48a6f9ef4f8cab4 +OUTPUT_BEGIN +WAN9213_BEGIN=true +MODE=READ_ONLY_TRUE_WAN_ROUTER_SNIKKET_AUDIT +MUTATION_BOUNDARY=NONE;NO_ROUTER_WRITE;NO_SPB_WRITE;NO_GUEST_WRITE;NO_DNS_WRITE;NO_SHUTDOWN +LOCAL9209_BEGIN=true +CID=SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1 +PLINK_PRESENT=true +SPB_CANDIDATE_COUNT=1 +SPB_CANDIDATE_SHA16=6d6149f42864ce03 +HOME_CANDIDATE_COUNT=1 +HOME_CANDIDATE_SHA16=bc517b4af3298846 +SPB_HASH_MATCH=true +SPB_PINNED_PROBE_RC=0 +DPAPI_DECRYPTABLE_COUNT=1 +OLD9208_LOCAL_ERR_SHA16=5a00a4ad6f6ef637 +LOCAL_ACCESS_STATUS=PASS +LOCAL9209_END=true +SPB_PINNED_ACCESS=PASS +SPB_EXTRACT_RC=0 +PVE_TRUE_WAN_AUDIT_RC=0 +VM130_QGA_TRANSPORT_RC=0 +VM150_QGA_TRANSPORT_RC=0 +SPB_TRUE_WAN_PROBE_RC=0 +TRUE_WAN9213={"dns":{"chat.gram1.ru":{"1.1.1.1":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]},"8.8.8.8":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]}},"git.gram1.ru":{"1.1.1.1":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]},"8.8.8.8":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]}},"groups.chat.gram1.ru":{"1.1.1.1":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]},"8.8.8.8":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]}},"share.chat.gram1.ru":{"1.1.1.1":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]},"8.8.8.8":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]}}},"evidence":[{"line":234,"text":"- WAN DHCP observed in router log: , gateway ."},{"line":315,"text":"### NAT / port forwarding"},{"line":316,"text":"- ISP tcp/80 -> bc:24:11:e1:f3:3c, NPMplus."},{"line":317,"text":"- ISP tcp/443 -> bc:24:11:e1:f3:3c, NPMplus."},{"line":318,"text":"- ISP tcpudp/3478 -> bc:24:11:e1:9a:25, Nextcloud Talk TURN."},{"line":319,"text":"- Home tcp/51820 -> bc:24:11:f4:c5:d8, WireGuard vpn1."},{"line":378,"text":"- WireGuard port: 51820."},{"line":683,"text":"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, ."},{"line":684,"text":"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on ."},{"line":685,"text":"- Router forwards Home TCP/51820 to WireGuard host ."},{"line":1356,"text":"- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm ."},{"line":1420,"text":"- Router forwards TCP/UDP 3478 to Nextcloud ."},{"line":1421,"text":"- Router forwards TCP/UDP 51820 for WireGuard on the Home bridge, not to edge-vm."}],"router":{"artifact_hits":[{"basename":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","path_sha16":"7c0a71546dbaf313"},{"basename":"31_HOMELAB_REFERENCE.md","path_sha16":"b6a8564938774058"},{"basename":"HOMELAB_FULL_HANDOFF_CURRENT.md","path_sha16":"aff2edacfd1256cd"},{"basename":"HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z","path_sha16":"36bb80fe9818f709"},{"basename":"HOMELAB_ASSISTANT_ERROR_REGISTER.md","path_sha16":"035234526670966e"},{"basename":"HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-proof-repair-20260630T215529Z","path_sha16":"4cddf80b93b25b32"}],"gateway_sha16":"4f9da1283166a1e9","ports":{"22":"TIMEOUT","23":"TIMEOUT","2323":"TIMEOUT","443":"TIMEOUT","80":"TIMEOUT"}},"wan":{"hashes":["26ac437d63a8bcf2"],"source_count":2,"unique_count":1}} +VM130_EDGE_AUDIT={"addresses":[{"iface":"lo","is_egress_source":false,"is_target":false,"sha16":"12ca17b49af22894"},{"iface":"eth0","is_egress_source":false,"is_target":false,"sha16":"bc517b4af3298846"},{"iface":"wg-taftauto","is_egress_source":false,"is_target":false,"sha16":"d1d4b6abdd6b1971"},{"iface":"wg-edge01","is_egress_source":false,"is_target":true,"sha16":"0b7870e2230336f5"},{"iface":"br-4d894f9e427b","is_egress_source":false,"is_target":false,"sha16":"fbd57f0145e15cc8"},{"iface":"br-5f66e1018bdd","is_egress_source":false,"is_target":false,"sha16":"5db063f47c3859a0"},{"iface":"br-8122fec51f39","is_egress_source":false,"is_target":false,"sha16":"93449cac351e054d"},{"iface":"docker0","is_egress_source":false,"is_target":false,"sha16":"346840d5a3d9fe9b"},{"iface":"br-915a81681c3e","is_egress_source":false,"is_target":false,"sha16":"bc41ed840e460923"},{"iface":"br-a4e31561a8d5","is_egress_source":false,"is_target":false,"sha16":"c138df8d3b53b190"},{"iface":"br-d41b3e918fbc","is_egress_source":false,"is_target":false,"sha16":"f9bcbcb71ab0bfd4"},{"iface":"br-f43db13d76c4","is_egress_source":false,"is_target":false,"sha16":"885dfc9b72d2209e"}],"config_hits":[{"basename":"cloud-init-network.service","lines":[{"line":28,"text":"# stage can start, and then wait on a return socket until the cloud-init"},{"line":29,"text":"# process has completed this stage. The output from the return socket is piped"},{"line":32,"text":"ExecStart=sh -c 'echo \"start\" | nc -Uu -W1 /run/cloud-init/share/network.sock -s /run/cloud-init/share/network-return.sock | sh'"}],"path_sha16":"d00cb9850586513a"},{"basename":"snikket-edge-ingress.nft","lines":[{"line":1,"text":"table ip snikket_edge_prod {"},{"line":4,"text":" iifname \"wg-edge01\" ip saddr ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } dnat to "},{"line":5,"text":" iifname \"wg-edge01\" ip saddr ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } dnat to "},{"line":9,"text":" oifname \"eth0\" ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } snat to "},{"line":10,"text":" oifname \"eth0\" ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } snat to "}],"path_sha16":"70fb445de6996d23"},{"basename":"p2-22-health-surface-response-validation-return-packet-20260626T023040Z.json","lines":[{"line":128,"text":" \"return_packet_flow\": ["},{"line":160,"text":" \"return_rows\": ["},{"line":178,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":215,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_01\","},{"line":241,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":278,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_02\","},{"line":304,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":341,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_03\","},{"line":367,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":404,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_04\","},{"line":430,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":467,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_05\","},{"line":493,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":530,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_06\","},{"line":556,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":593,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_07\","},{"line":619,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":656,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_08\","},{"line":682,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":719,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_09\","}],"path_sha16":"fe6950b250508445"},{"basename":"p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json","lines":[{"line":348,"text":" \"Monitor proxy reachability and verify no direct socket mounts return for migrated clients.\""}],"path_sha16":"8733d16ab518b1f6"},{"basename":"p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json","lines":[{"line":217,"text":" \"Monitor proxy reachability and verify no direct socket mounts return for migrated clients.\""}],"path_sha16":"048ed578a90e647c"},{"basename":"composer.py","lines":[{"line":22,"text":" return not self.check_event(StreamEndEvent)"},{"line":27,"text":" return self.compose_document()"},{"line":48,"text":" return document"},{"line":61,"text":" return node"},{"line":70,"text":" return self.anchors[anchor]"},{"line":86,"text":" return node"},{"line":97,"text":" return node"},{"line":115,"text":" return node"},{"line":138,"text":" return node"}],"path_sha16":"c73308fe0d2115d3"},{"basename":"composer.py","lines":[{"line":22,"text":" return not self.check_event(StreamEndEvent)"},{"line":27,"text":" return self.compose_document()"},{"line":48,"text":" return document"},{"line":61,"text":" return node"},{"line":70,"text":" return self.anchors[anchor]"},{"line":86,"text":" return node"},{"line":97,"text":" return node"},{"line":115,"text":" return node"},{"line":138,"text":" return node"}],"path_sha16":"7d17ddfec624c826"}],"docker":[{"image_sha16":"5aa369fb5eaf7c46","name":"kopia","ports_safe":""},{"image_sha16":"8112a294af79d305","name":"homelab-registry-cache","ports_safe":""},{"image_sha16":"ef95d2f35b4f5848","name":"npmplus","ports_safe":""},{"image_sha16":"31e555942da7f897","name":"crowdsec","ports_safe":":7422->7422/tcp, :8088->8080/tcp"},{"image_sha16":"cdfb05c4b7a8150a","name":"dozzle","ports_safe":":9999->8080/tcp"},{"image_sha16":"f4704b71a591a53d","name":"cadvisor","ports_safe":":8081->8080/tcp"},{"image_sha16":"4a0705d1136ed8bf","name":"alloy","ports_safe":":12345->12345/tcp"},{"image_sha16":"5ef8646c3bb0fb15","name":"diun","ports_safe":""},{"image_sha16":"33d259476c8fec4b","name":"socket-proxy","ports_safe":":2375->2375/tcp"},{"image_sha16":"1ad7e04d49dec6a4","name":"loki","ports_safe":":3100->3100/tcp"}],"egress_source_owned":false,"hostname":"edge-vm","listeners":[{"port":53,"process":"systemd-resolve","proto":"udp"},{"port":53,"process":"systemd-resolve","proto":"udp"},{"port":51824,"process":"","proto":"udp"},{"port":5355,"process":"systemd-resolve","proto":"udp"},{"port":55808,"process":"","proto":"udp"},{"port":51824,"process":"","proto":"udp"},{"port":5355,"process":"systemd-resolve","proto":"udp"},{"port":55808,"process":"","proto":"udp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":22,"process":"sshd","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":53,"process":"systemd-resolve","proto":"tcp"},{"port":12345,"process":"docker-proxy","proto":"tcp"},{"port":18083,"process":"python3","proto":"tcp"},{"port":18091,"process":"python3","proto":"tcp"},{"port":18092,"process":"python3","proto":"tcp"},{"port":9221,"process":"python3","proto":"tcp"},{"port":8081,"process":"docker-proxy","proto":"tcp"},{"port":8088,"process":"docker-proxy","proto":"tcp"},{"port":8014,"process":"python3","proto":"tcp"},{"port":7422,"process":"docker-proxy","proto":"tcp"},{"port":9050,"process":"tor","proto":"tcp"},{"port":53,"process":"systemd-resolve","proto":"tcp"},{"port":81,"process":"nginx","proto":"tcp"},{"port":81,"process":"nginx","proto":"tcp"},{"port":81,"process":"nginx","proto":"tcp"},{"port":81,"process":"nginx","proto":"tcp"},{"port":9999,"process":"docker-proxy","proto":"tcp"},{"port":18088,"process":"python3","proto":"tcp"},{"port":18089,"process":"python3","proto":"tcp"},{"port":18090,"process":"python3","proto":"tcp"},{"port":18093,"process":"python3","proto":"tcp"},{"port":5355,"process":"systemd-resolve","proto":"tcp"},{"port":9221,"process":"pve_exporter","proto":"tcp"},{"port":51515,"process":"kopia","proto":"tcp"},{"port":2375,"process":"docker-proxy","proto":"tcp"},{"port":5000,"process":"registry","proto":"tcp"},{"port":3100,"process":"docker-proxy","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":22,"process":"sshd","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":5355,"process":"systemd-resolve","proto":"tcp"}],"nft":["table ip snikket_edge_prod {","iifname \"wg-edge01\" ip saddr ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } dnat to ","iifname \"wg-edge01\" ip saddr ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } dnat to ","oifname \"eth0\" ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } snat to ","oifname \"eth0\" ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } snat to "],"routes":["default dev wg-edge01 table 17777 scope link ","default via dev eth0 proto static "," dev wg-taftauto proto kernel scope link src "," dev wg-edge01 proto kernel scope link src ","local dev wg-taftauto table local proto kernel scope host src ","broadcast dev wg-taftauto table local proto kernel scope link src ","local dev wg-edge01 table local proto kernel scope host src ","broadcast dev wg-edge01 table local proto kernel scope link src ","multicast ff00::/8 dev wg-edge01 table local proto kernel metric 256 pref medium","multicast ff00::/8 dev wg-taftauto table local proto kernel metric 256 pref medium"],"target_owned":true,"uid":0} +VM150_SNIKKET_AUDIT={"addresses":[{"iface":"lo","is_egress_source":false,"is_target":false,"sha16":"12ca17b49af22894"},{"iface":"eth0","is_egress_source":true,"is_target":false,"sha16":"4e29a2729bbc4066"},{"iface":"docker0","is_egress_source":false,"is_target":false,"sha16":"346840d5a3d9fe9b"}],"config_hits":[{"basename":"docker-compose.yml","lines":[{"line":4,"text":" snikket_proxy:"},{"line":5,"text":" container_name: snikket-proxy"},{"line":6,"text":" image: snikket/snikket-web-proxy@sha256:e2c22746c19489d2723c6ccebb15f2f14e4e35431cabbc7318d9ee33a48566e1"},{"line":7,"text":" env_file: snikket.conf"},{"line":10,"text":" - snikket_data:/snikket"},{"line":13,"text":" snikket_certs:"},{"line":14,"text":" container_name: snikket-certs"},{"line":15,"text":" image: snikket/snikket-cert-manager@sha256:3920d6d6ad0ff7775d80fba034cf08fe246ff3548f192621cf3be6366a17d530"},{"line":17,"text":" env_file: snikket.conf"},{"line":19,"text":" - snikket_data:/snikket"},{"line":22,"text":" snikket_portal:"},{"line":23,"text":" container_name: snikket-portal"},{"line":24,"text":" image: snikket/snikket-web-portal@sha256:d67ff498c44bcabc6eee0379d030870004cc37ccf445aa5450d891d4ce02e136"},{"line":26,"text":" env_file: snikket.conf"},{"line":29,"text":" snikket_server:"},{"line":30,"text":" container_name: snikket"},{"line":31,"text":" image: snikket/snikket-server@sha256:311c076e06ec0fdb182900577a936cdc8d15da50bcc6ccd6707b743a13a162f3"},{"line":34,"text":" - snikket_data:/snikket"},{"line":35,"text":" env_file: snikket.conf"},{"line":40,"text":" snikket_data:"}],"path_sha16":"469462f29cd9bad5"},{"basename":"snikket.conf","lines":[{"line":1,"text":"SNIKKET_DOMAIN=chat.gram1.ru"},{"line":2,"text":"SNIKKET_ADMIN_EMAIL=noreply@pvepro.ru"},{"line":3,"text":"SNIKKET_TWEAK_TURNSERVER_MIN_PORT=60000"},{"line":4,"text":"SNIKKET_TWEAK_TURNSERVER_MAX_PORT=60199"},{"line":6,"text":"SNIKKET_TWEAK_TURNSERVER_INTERNAL_IP="}],"path_sha16":"82259917e6cb2726"},{"basename":"docker-compose.override.yml","lines":[{"line":2,"text":" snikket_server:"},{"line":8,"text":" source: /etc/snikket/turnfix/coturn-run"},{"line":9,"text":" target: /etc/sv/coturn/run"},{"line":12,"text":" source: /etc/snikket/turnfix/coturn-run.upstream"},{"line":13,"text":" target: /etc/sv/coturn/run.upstream"}],"path_sha16":"370d0aff3f71ce75"},{"basename":"coturn-run","lines":[{"line":3,"text":"CRT=\"$CERTDIR/$SNIKKET_DOMAIN_ASCII.crt\""},{"line":4,"text":"KEY=\"$CERTDIR/$SNIKKET_DOMAIN_ASCII.key\""},{"line":10,"text":"chgrp turnserver \"$CERTDIR\" \"$CRT\" \"$KEY\""},{"line":15,"text":"sed -i 's#^userdb=/snikket/prosody/turndb$#userdb=/var/lib/turn/turndb#' /etc/turnserver.conf"},{"line":16,"text":"install -d -o turnserver -g turnserver -m 0775 /var/lib/turn"},{"line":18,"text":"exec /etc/sv/coturn/run.upstream"}],"path_sha16":"b77d42082a9cc138"},{"basename":"coturn-run.upstream","lines":[{"line":3,"text":"if [ \"$SNIKKET_TWEAK_TURNSERVER\" = \"0\" ]; then"},{"line":4,"text":"\techo \"TURN server disabled by environment, not launching.\";"},{"line":8,"text":"CERTFILE=\"/etc/prosody/certs/$SNIKKET_DOMAIN_ASCII.crt\";"},{"line":9,"text":"KEYFILE=\"/etc/prosody/certs/$SNIKKET_DOMAIN_ASCII.key\";"},{"line":17,"text":"TURN_EXTERNAL_IP=\"$(snikket-turn-addresses \"$SNIKKET_DOMAIN_ASCII\")\""},{"line":19,"text":"min_port=\"${SNIKKET_TWEAK_TURNSERVER_MIN_PORT:-49152}\""},{"line":20,"text":"max_port=\"${SNIKKET_TWEAK_TURNSERVER_MAX_PORT:-65535}\""},{"line":22,"text":"exec s6-setuidgid turnserver /usr/bin/turnserver -c /etc/turnserver.conf --prod \\"},{"line":23,"text":" --static-auth-secret= /snikket/prosody/turn-auth-secret-v2)\" \\"},{"line":24,"text":" --cert=\"$CERTFILE\" --pkey \"$KEYFILE\" -r \"$SNIKKET_DOMAIN_ASCII\" \\"},{"line":26,"text":" --listening-port \"${SNIKKET_TWEAK_TURNSERVER_PORT-3478}\" \\"},{"line":27,"text":" -X \"$TURN_EXTERNAL_IP\""}],"path_sha16":"b6e1eb9791801900"},{"basename":"snikket-edge-egress.service","lines":[{"line":2,"text":"Description=Snikket Internet egress via edge-vm"}],"path_sha16":"ff8de9e3bc6968cf"},{"basename":"snikket-turn-reconcile.service","lines":[{"line":2,"text":"Description=Reconcile Snikket TURN certificate permissions and listeners"},{"line":8,"text":"ExecStart=/usr/local/sbin/snikket-turn-reconcile"}],"path_sha16":"b3c0283f7af1bd61"},{"basename":"snikket-turn-reconcile.timer","lines":[{"line":2,"text":"Description=Periodic Snikket TURN durability reconciliation"},{"line":9,"text":"Unit=snikket-turn-reconcile.service"}],"path_sha16":"130e65f40043e8f2"},{"basename":"snikket-turn-reconcile.timer","lines":[{"line":2,"text":"Description=Periodic Snikket TURN durability reconciliation"},{"line":9,"text":"Unit=snikket-turn-reconcile.service"}],"path_sha16":"e9b69f6136ce9691"},{"basename":"cloud-init-network.service","lines":[{"line":28,"text":"# stage can start, and then wait on a return socket until the cloud-init"},{"line":29,"text":"# process has completed this stage. The output from the return socket is piped"},{"line":32,"text":"ExecStart=sh -c 'echo \"start\" | nc -Uu -W1 /run/cloud-init/share/network.sock -s /run/cloud-init/share/network-return.sock | sh'"}],"path_sha16":"d00cb9850586513a"},{"basename":"snikket-edge-egress.service","lines":[{"line":2,"text":"Description=Snikket Internet egress via edge-vm"}],"path_sha16":"01d7d6f52fe7a474"}],"docker":[{"image_sha16":"0c2eab14269992f7","name":"snikket","ports_safe":""},{"image_sha16":"196c632b7cd3d6fe","name":"snikket-portal","ports_safe":""},{"image_sha16":"afdc9a1e6d2b82c1","name":"snikket-certs","ports_safe":""},{"image_sha16":"f2e47aabc41c5e2d","name":"snikket-proxy","ports_safe":""}],"egress_source_owned":true,"hostname":"snikket","listeners":[{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":53,"process":"systemd-resolve","proto":"udp"},{"port":53,"process":"systemd-resolve","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5355,"process":"systemd-resolve","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5355,"process":"systemd-resolve","proto":"udp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5280,"process":"lua5.4","proto":"tcp"},{"port":46313,"process":"containerd","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":53,"process":"systemd-resolve","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":53,"process":"systemd-resolve","proto":"tcp"},{"port":5765,"process":"hypercorn","proto":"tcp"},{"port":22,"process":"sshd","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":5000,"process":"lua5.4","proto":"tcp"},{"port":5223,"process":"lua5.4","proto":"tcp"},{"port":5222,"process":"lua5.4","proto":"tcp"},{"port":5269,"process":"lua5.4","proto":"tcp"},{"port":5355,"process":"systemd-resolve","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":22,"process":"sshd","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":5280,"process":"lua5.4","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":5000,"process":"lua5.4","proto":"tcp"},{"port":5223,"process":"lua5.4","proto":"tcp"},{"port":5222,"process":"lua5.4","proto":"tcp"},{"port":5269,"process":"lua5.4","proto":"tcp"},{"port":5355,"process":"systemd-resolve","proto":"tcp"}],"nft":[],"routes":["default via dev eth0 proto static "," dev eth0 proto kernel scope link src ","local dev eth0 table local proto kernel scope host src ","broadcast dev eth0 table local proto kernel scope link src "],"target_owned":false,"uid":0} +SPB_TO_TRUE_WAN_PROBE={"tcp":{"3478":"TIMEOUT","3479":"TIMEOUT","443":"OPEN","5000":"TIMEOUT","5222":"TIMEOUT","5349":"TIMEOUT","5350":"TIMEOUT","80":"OPEN"},"udp_stun":{"3478":{"ok":false,"result":"TIMEOUT"},"3479":{"ok":false,"result":"TIMEOUT"}},"wan_sha16":"26ac437d63a8bcf2"} +TRUE_WAN_CONSENSUS=true +TRUE_WAN_SHA16=26ac437d63a8bcf2 +ROUTER_MANAGEMENT_OPEN_PORTS= +ROUTER_AUTOMATION_ARTIFACT_COUNT=6 +PUBLIC_CHAT_DNS_ALREADY_HOME_WAN=false +VM130_OWNS_SNIKKET_DNAT_TARGET=true +VM150_OWNS_SNIKKET_DNAT_TARGET=false +VM130_OWNS_SNIKKET_EGRESS_SOURCE=false +VM150_OWNS_SNIKKET_EGRESS_SOURCE=true +VM130_REQUIRED_LISTENER_COUNT=1 +VM150_REQUIRED_LISTENER_COUNT=6 +TRUE_WAN_TCP_OPEN_COUNT=2 +TRUE_WAN_STUN_OK_COUNT=0 +NEXT_ACTION=BUILD_ROUTER_SNIKKET_NAT_MIGRATION_FROM_PROVEN_TOPOLOGY +TASK_COMPLETE=true +TASK_RESULT=PASS_SPB_HOME_WAN_ROUTER_SNIKKET_AUDIT +DECISION=READ_EXACT_9213_THEN_BUILD_ROUTER_MIGRATION_ONLY_FROM_PROVEN_TOPOLOGY +NEXT_GATE=EXACT_9213_TRUE_WAN_ROUTER_SNIKKET +HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null} + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index f69f6fc3..2cb146a7 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,19 +1,19 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "SUPPORT-260923-SKLADCHIK-NETBIRD-API-ROUTE-RCA-961R1", - "status": "FAIL", - "rc": 1, + "command_id": "SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1", + "status": "OK", + "rc": 0, "host": "pve01", "mode": "read-only", - "component": "skladchik-netbird-api-route-rca", - "started_at_utc": "2026-09-23T15:30:06Z", - "finished_at_utc": "2026-09-23T15:30:12Z", + "component": "spb-home-wan-router-snikket-audit", + "started_at_utc": "2026-09-23T15:39:27Z", + "finished_at_utc": "2026-09-23T15:40:18Z", "reference_register_checked": true, "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66", "error_register_checked": true, "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0", - "command_sha256": "0ae33d5d0d029e0b0cb4ff434a82de924eaaeb617e36dbc35889c319ba85b898", + "command_sha256": "e8cf489f5c96585a16ddf42ca05d7f8f60a72b6f41cb180c370c54028398971a", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, @@ -21,7 +21,7 @@ "result_contract_valid": true, "result_contract_status": null, "result_contract_error": null, - "command_rc": 1, + "command_rc": 0, "changes_made": false, "rollback_started": false, "rollback_restored": null, @@ -30,9 +30,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "7dc542d10bde3ea3dc5f9a087b52c1d1448f2675161f1e3b162298d95ff28bc5", - "sanitized_output_sha256": "7dc542d10bde3ea3dc5f9a087b52c1d1448f2675161f1e3b162298d95ff28bc5", + "raw_evidence_sha256": "ab2409f5a0b922cddc2c05b1fa06f012701bfee81045a413e48a6f9ef4f8cab4", + "sanitized_output_sha256": "ab2409f5a0b922cddc2c05b1fa06f012701bfee81045a413e48a6f9ef4f8cab4", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "SKLADCHIK961_BEGIN=true\nCOMMAND_ID=SUPPORT-260923-SKLADCHIK-NETBIRD-API-ROUTE-RCA-961R1\nMODE=read-only\nCOMPONENT=skladchik-netbird-api-route-rca\nPREDECESSOR_960=USA_SSH_CURRENTLY_UNAVAILABLE\nMUTATION_BOUNDARY=NONE_READ_ONLY\nACCESS_PATH=NETBIRD_PUBLIC_API_VIA_EXISTING_LOCAL_CREDENTIAL_IF_PRESENT\nEDGE_NETBIRD_IP_FOUND=true\nEDGE_NETBIRD_IP_HASH=8ce86a6ae65d3692\nEDGE_HOSTNAME_FOUND=true\nEDGE_HOSTNAME_HASH=ebb24cf2960c2243\nTOKEN_SEARCH_FILES_SCANNED=12000\nTOKEN_MATCHED_FILE_COUNT=0\nTOKEN_CANDIDATE_COUNT=0\nAPI_FORCED_MOLDOVA_REACH_RC=0\nAPI_FORCED_MOLDOVA_HTTP=401\nWORKING_NETBIRD_API_TOKEN_FOUND=false\nDECISION=HOLD_NO_WORKING_NETBIRD_API_CREDENTIAL\nCHANGES_MADE_BY_961=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260923-SKLADCHIK-NETBIRD-API-ROUTE-RCA-961R1\",\"status\":\"FAIL\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\nSKLADCHIK961_END=true\n" + "output": "WAN9213_BEGIN=true\nMODE=READ_ONLY_TRUE_WAN_ROUTER_SNIKKET_AUDIT\nMUTATION_BOUNDARY=NONE;NO_ROUTER_WRITE;NO_SPB_WRITE;NO_GUEST_WRITE;NO_DNS_WRITE;NO_SHUTDOWN\nLOCAL9209_BEGIN=true\nCID=SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1\nPLINK_PRESENT=true\nSPB_CANDIDATE_COUNT=1\nSPB_CANDIDATE_SHA16=6d6149f42864ce03\nHOME_CANDIDATE_COUNT=1\nHOME_CANDIDATE_SHA16=bc517b4af3298846\nSPB_HASH_MATCH=true\nSPB_PINNED_PROBE_RC=0\nDPAPI_DECRYPTABLE_COUNT=1\nOLD9208_LOCAL_ERR_SHA16=5a00a4ad6f6ef637\nLOCAL_ACCESS_STATUS=PASS\nLOCAL9209_END=true\nSPB_PINNED_ACCESS=PASS\nSPB_EXTRACT_RC=0\nPVE_TRUE_WAN_AUDIT_RC=0\nVM130_QGA_TRANSPORT_RC=0\nVM150_QGA_TRANSPORT_RC=0\nSPB_TRUE_WAN_PROBE_RC=0\nTRUE_WAN9213={\"dns\":{\"chat.gram1.ru\":{\"1.1.1.1\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]},\"8.8.8.8\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]}},\"git.gram1.ru\":{\"1.1.1.1\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]},\"8.8.8.8\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]}},\"groups.chat.gram1.ru\":{\"1.1.1.1\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]},\"8.8.8.8\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]}},\"share.chat.gram1.ru\":{\"1.1.1.1\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]},\"8.8.8.8\":{\"count\":1,\"matches_wan\":false,\"sha16\":[\"6d6149f42864ce03\"]}}},\"evidence\":[{\"line\":234,\"text\":\"- WAN DHCP observed in router log: , gateway .\"},{\"line\":315,\"text\":\"### NAT / port forwarding\"},{\"line\":316,\"text\":\"- ISP tcp/80 -> bc:24:11:e1:f3:3c, NPMplus.\"},{\"line\":317,\"text\":\"- ISP tcp/443 -> bc:24:11:e1:f3:3c, NPMplus.\"},{\"line\":318,\"text\":\"- ISP tcpudp/3478 -> bc:24:11:e1:9a:25, Nextcloud Talk TURN.\"},{\"line\":319,\"text\":\"- Home tcp/51820 -> bc:24:11:f4:c5:d8, WireGuard vpn1.\"},{\"line\":378,\"text\":\"- WireGuard port: 51820.\"},{\"line\":683,\"text\":\"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, .\"},{\"line\":684,\"text\":\"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on .\"},{\"line\":685,\"text\":\"- Router forwards Home TCP/51820 to WireGuard host .\"},{\"line\":1356,\"text\":\"- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm .\"},{\"line\":1420,\"text\":\"- Router forwards TCP/UDP 3478 to Nextcloud .\"},{\"line\":1421,\"text\":\"- Router forwards TCP/UDP 51820 for WireGuard on the Home bridge, not to edge-vm.\"}],\"router\":{\"artifact_hits\":[{\"basename\":\"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md\",\"path_sha16\":\"7c0a71546dbaf313\"},{\"basename\":\"31_HOMELAB_REFERENCE.md\",\"path_sha16\":\"b6a8564938774058\"},{\"basename\":\"HOMELAB_FULL_HANDOFF_CURRENT.md\",\"path_sha16\":\"aff2edacfd1256cd\"},{\"basename\":\"HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z\",\"path_sha16\":\"36bb80fe9818f709\"},{\"basename\":\"HOMELAB_ASSISTANT_ERROR_REGISTER.md\",\"path_sha16\":\"035234526670966e\"},{\"basename\":\"HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-proof-repair-20260630T215529Z\",\"path_sha16\":\"4cddf80b93b25b32\"}],\"gateway_sha16\":\"4f9da1283166a1e9\",\"ports\":{\"22\":\"TIMEOUT\",\"23\":\"TIMEOUT\",\"2323\":\"TIMEOUT\",\"443\":\"TIMEOUT\",\"80\":\"TIMEOUT\"}},\"wan\":{\"hashes\":[\"26ac437d63a8bcf2\"],\"source_count\":2,\"unique_count\":1}}\nVM130_EDGE_AUDIT={\"addresses\":[{\"iface\":\"lo\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"12ca17b49af22894\"},{\"iface\":\"eth0\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"bc517b4af3298846\"},{\"iface\":\"wg-taftauto\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"d1d4b6abdd6b1971\"},{\"iface\":\"wg-edge01\",\"is_egress_source\":false,\"is_target\":true,\"sha16\":\"0b7870e2230336f5\"},{\"iface\":\"br-4d894f9e427b\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"fbd57f0145e15cc8\"},{\"iface\":\"br-5f66e1018bdd\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"5db063f47c3859a0\"},{\"iface\":\"br-8122fec51f39\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"93449cac351e054d\"},{\"iface\":\"docker0\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"346840d5a3d9fe9b\"},{\"iface\":\"br-915a81681c3e\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"bc41ed840e460923\"},{\"iface\":\"br-a4e31561a8d5\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"c138df8d3b53b190\"},{\"iface\":\"br-d41b3e918fbc\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"f9bcbcb71ab0bfd4\"},{\"iface\":\"br-f43db13d76c4\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"885dfc9b72d2209e\"}],\"config_hits\":[{\"basename\":\"cloud-init-network.service\",\"lines\":[{\"line\":28,\"text\":\"# stage can start, and then wait on a return socket until the cloud-init\"},{\"line\":29,\"text\":\"# process has completed this stage. The output from the return socket is piped\"},{\"line\":32,\"text\":\"ExecStart=sh -c 'echo \\\"start\\\" | nc -Uu -W1 /run/cloud-init/share/network.sock -s /run/cloud-init/share/network-return.sock | sh'\"}],\"path_sha16\":\"d00cb9850586513a\"},{\"basename\":\"snikket-edge-ingress.nft\",\"lines\":[{\"line\":1,\"text\":\"table ip snikket_edge_prod {\"},{\"line\":4,\"text\":\" iifname \\\"wg-edge01\\\" ip saddr ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } dnat to \"},{\"line\":5,\"text\":\" iifname \\\"wg-edge01\\\" ip saddr ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } dnat to \"},{\"line\":9,\"text\":\" oifname \\\"eth0\\\" ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } snat to \"},{\"line\":10,\"text\":\" oifname \\\"eth0\\\" ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } snat to \"}],\"path_sha16\":\"70fb445de6996d23\"},{\"basename\":\"p2-22-health-surface-response-validation-return-packet-20260626T023040Z.json\",\"lines\":[{\"line\":128,\"text\":\" \\\"return_packet_flow\\\": [\"},{\"line\":160,\"text\":\" \\\"return_rows\\\": [\"},{\"line\":178,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":215,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_01\\\",\"},{\"line\":241,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":278,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_02\\\",\"},{\"line\":304,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":341,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_03\\\",\"},{\"line\":367,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":404,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_04\\\",\"},{\"line\":430,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":467,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_05\\\",\"},{\"line\":493,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":530,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_06\\\",\"},{\"line\":556,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":593,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_07\\\",\"},{\"line\":619,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":656,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_08\\\",\"},{\"line\":682,\"text\":\" \\\"expected_return_path\\\": \\\"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\\\",\"},{\"line\":719,\"text\":\" \\\"return_row_id\\\": \\\"P2_22_RETURN_ROW_09\\\",\"}],\"path_sha16\":\"fe6950b250508445\"},{\"basename\":\"p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json\",\"lines\":[{\"line\":348,\"text\":\" \\\"Monitor proxy reachability and verify no direct socket mounts return for migrated clients.\\\"\"}],\"path_sha16\":\"8733d16ab518b1f6\"},{\"basename\":\"p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json\",\"lines\":[{\"line\":217,\"text\":\" \\\"Monitor proxy reachability and verify no direct socket mounts return for migrated clients.\\\"\"}],\"path_sha16\":\"048ed578a90e647c\"},{\"basename\":\"composer.py\",\"lines\":[{\"line\":22,\"text\":\" return not self.check_event(StreamEndEvent)\"},{\"line\":27,\"text\":\" return self.compose_document()\"},{\"line\":48,\"text\":\" return document\"},{\"line\":61,\"text\":\" return node\"},{\"line\":70,\"text\":\" return self.anchors[anchor]\"},{\"line\":86,\"text\":\" return node\"},{\"line\":97,\"text\":\" return node\"},{\"line\":115,\"text\":\" return node\"},{\"line\":138,\"text\":\" return node\"}],\"path_sha16\":\"c73308fe0d2115d3\"},{\"basename\":\"composer.py\",\"lines\":[{\"line\":22,\"text\":\" return not self.check_event(StreamEndEvent)\"},{\"line\":27,\"text\":\" return self.compose_document()\"},{\"line\":48,\"text\":\" return document\"},{\"line\":61,\"text\":\" return node\"},{\"line\":70,\"text\":\" return self.anchors[anchor]\"},{\"line\":86,\"text\":\" return node\"},{\"line\":97,\"text\":\" return node\"},{\"line\":115,\"text\":\" return node\"},{\"line\":138,\"text\":\" return node\"}],\"path_sha16\":\"7d17ddfec624c826\"}],\"docker\":[{\"image_sha16\":\"5aa369fb5eaf7c46\",\"name\":\"kopia\",\"ports_safe\":\"\"},{\"image_sha16\":\"8112a294af79d305\",\"name\":\"homelab-registry-cache\",\"ports_safe\":\"\"},{\"image_sha16\":\"ef95d2f35b4f5848\",\"name\":\"npmplus\",\"ports_safe\":\"\"},{\"image_sha16\":\"31e555942da7f897\",\"name\":\"crowdsec\",\"ports_safe\":\":7422->7422/tcp, :8088->8080/tcp\"},{\"image_sha16\":\"cdfb05c4b7a8150a\",\"name\":\"dozzle\",\"ports_safe\":\":9999->8080/tcp\"},{\"image_sha16\":\"f4704b71a591a53d\",\"name\":\"cadvisor\",\"ports_safe\":\":8081->8080/tcp\"},{\"image_sha16\":\"4a0705d1136ed8bf\",\"name\":\"alloy\",\"ports_safe\":\":12345->12345/tcp\"},{\"image_sha16\":\"5ef8646c3bb0fb15\",\"name\":\"diun\",\"ports_safe\":\"\"},{\"image_sha16\":\"33d259476c8fec4b\",\"name\":\"socket-proxy\",\"ports_safe\":\":2375->2375/tcp\"},{\"image_sha16\":\"1ad7e04d49dec6a4\",\"name\":\"loki\",\"ports_safe\":\":3100->3100/tcp\"}],\"egress_source_owned\":false,\"hostname\":\"edge-vm\",\"listeners\":[{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":51824,\"process\":\"\",\"proto\":\"udp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":55808,\"process\":\"\",\"proto\":\"udp\"},{\"port\":51824,\"process\":\"\",\"proto\":\"udp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":55808,\"process\":\"\",\"proto\":\"udp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":22,\"process\":\"sshd\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"},{\"port\":12345,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":18083,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":18091,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":18092,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":9221,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":8081,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":8088,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":8014,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":7422,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":9050,\"process\":\"tor\",\"proto\":\"tcp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"},{\"port\":81,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":81,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":81,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":81,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":9999,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":18088,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":18089,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":18090,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":18093,\"process\":\"python3\",\"proto\":\"tcp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"},{\"port\":9221,\"process\":\"pve_exporter\",\"proto\":\"tcp\"},{\"port\":51515,\"process\":\"kopia\",\"proto\":\"tcp\"},{\"port\":2375,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":5000,\"process\":\"registry\",\"proto\":\"tcp\"},{\"port\":3100,\"process\":\"docker-proxy\",\"proto\":\"tcp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":22,\"process\":\"sshd\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"}],\"nft\":[\"table ip snikket_edge_prod {\",\"iifname \\\"wg-edge01\\\" ip saddr ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } dnat to \",\"iifname \\\"wg-edge01\\\" ip saddr ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } dnat to \",\"oifname \\\"eth0\\\" ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } snat to \",\"oifname \\\"eth0\\\" ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } snat to \"],\"routes\":[\"default dev wg-edge01 table 17777 scope link \",\"default via dev eth0 proto static \",\" dev wg-taftauto proto kernel scope link src \",\" dev wg-edge01 proto kernel scope link src \",\"local dev wg-taftauto table local proto kernel scope host src \",\"broadcast dev wg-taftauto table local proto kernel scope link src \",\"local dev wg-edge01 table local proto kernel scope host src \",\"broadcast dev wg-edge01 table local proto kernel scope link src \",\"multicast ff00::/8 dev wg-edge01 table local proto kernel metric 256 pref medium\",\"multicast ff00::/8 dev wg-taftauto table local proto kernel metric 256 pref medium\"],\"target_owned\":true,\"uid\":0}\nVM150_SNIKKET_AUDIT={\"addresses\":[{\"iface\":\"lo\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"12ca17b49af22894\"},{\"iface\":\"eth0\",\"is_egress_source\":true,\"is_target\":false,\"sha16\":\"4e29a2729bbc4066\"},{\"iface\":\"docker0\",\"is_egress_source\":false,\"is_target\":false,\"sha16\":\"346840d5a3d9fe9b\"}],\"config_hits\":[{\"basename\":\"docker-compose.yml\",\"lines\":[{\"line\":4,\"text\":\" snikket_proxy:\"},{\"line\":5,\"text\":\" container_name: snikket-proxy\"},{\"line\":6,\"text\":\" image: snikket/snikket-web-proxy@sha256:e2c22746c19489d2723c6ccebb15f2f14e4e35431cabbc7318d9ee33a48566e1\"},{\"line\":7,\"text\":\" env_file: snikket.conf\"},{\"line\":10,\"text\":\" - snikket_data:/snikket\"},{\"line\":13,\"text\":\" snikket_certs:\"},{\"line\":14,\"text\":\" container_name: snikket-certs\"},{\"line\":15,\"text\":\" image: snikket/snikket-cert-manager@sha256:3920d6d6ad0ff7775d80fba034cf08fe246ff3548f192621cf3be6366a17d530\"},{\"line\":17,\"text\":\" env_file: snikket.conf\"},{\"line\":19,\"text\":\" - snikket_data:/snikket\"},{\"line\":22,\"text\":\" snikket_portal:\"},{\"line\":23,\"text\":\" container_name: snikket-portal\"},{\"line\":24,\"text\":\" image: snikket/snikket-web-portal@sha256:d67ff498c44bcabc6eee0379d030870004cc37ccf445aa5450d891d4ce02e136\"},{\"line\":26,\"text\":\" env_file: snikket.conf\"},{\"line\":29,\"text\":\" snikket_server:\"},{\"line\":30,\"text\":\" container_name: snikket\"},{\"line\":31,\"text\":\" image: snikket/snikket-server@sha256:311c076e06ec0fdb182900577a936cdc8d15da50bcc6ccd6707b743a13a162f3\"},{\"line\":34,\"text\":\" - snikket_data:/snikket\"},{\"line\":35,\"text\":\" env_file: snikket.conf\"},{\"line\":40,\"text\":\" snikket_data:\"}],\"path_sha16\":\"469462f29cd9bad5\"},{\"basename\":\"snikket.conf\",\"lines\":[{\"line\":1,\"text\":\"SNIKKET_DOMAIN=chat.gram1.ru\"},{\"line\":2,\"text\":\"SNIKKET_ADMIN_EMAIL=noreply@pvepro.ru\"},{\"line\":3,\"text\":\"SNIKKET_TWEAK_TURNSERVER_MIN_PORT=60000\"},{\"line\":4,\"text\":\"SNIKKET_TWEAK_TURNSERVER_MAX_PORT=60199\"},{\"line\":6,\"text\":\"SNIKKET_TWEAK_TURNSERVER_INTERNAL_IP=\"}],\"path_sha16\":\"82259917e6cb2726\"},{\"basename\":\"docker-compose.override.yml\",\"lines\":[{\"line\":2,\"text\":\" snikket_server:\"},{\"line\":8,\"text\":\" source: /etc/snikket/turnfix/coturn-run\"},{\"line\":9,\"text\":\" target: /etc/sv/coturn/run\"},{\"line\":12,\"text\":\" source: /etc/snikket/turnfix/coturn-run.upstream\"},{\"line\":13,\"text\":\" target: /etc/sv/coturn/run.upstream\"}],\"path_sha16\":\"370d0aff3f71ce75\"},{\"basename\":\"coturn-run\",\"lines\":[{\"line\":3,\"text\":\"CRT=\\\"$CERTDIR/$SNIKKET_DOMAIN_ASCII.crt\\\"\"},{\"line\":4,\"text\":\"KEY=\\\"$CERTDIR/$SNIKKET_DOMAIN_ASCII.key\\\"\"},{\"line\":10,\"text\":\"chgrp turnserver \\\"$CERTDIR\\\" \\\"$CRT\\\" \\\"$KEY\\\"\"},{\"line\":15,\"text\":\"sed -i 's#^userdb=/snikket/prosody/turndb$#userdb=/var/lib/turn/turndb#' /etc/turnserver.conf\"},{\"line\":16,\"text\":\"install -d -o turnserver -g turnserver -m 0775 /var/lib/turn\"},{\"line\":18,\"text\":\"exec /etc/sv/coturn/run.upstream\"}],\"path_sha16\":\"b77d42082a9cc138\"},{\"basename\":\"coturn-run.upstream\",\"lines\":[{\"line\":3,\"text\":\"if [ \\\"$SNIKKET_TWEAK_TURNSERVER\\\" = \\\"0\\\" ]; then\"},{\"line\":4,\"text\":\"\\techo \\\"TURN server disabled by environment, not launching.\\\";\"},{\"line\":8,\"text\":\"CERTFILE=\\\"/etc/prosody/certs/$SNIKKET_DOMAIN_ASCII.crt\\\";\"},{\"line\":9,\"text\":\"KEYFILE=\\\"/etc/prosody/certs/$SNIKKET_DOMAIN_ASCII.key\\\";\"},{\"line\":17,\"text\":\"TURN_EXTERNAL_IP=\\\"$(snikket-turn-addresses \\\"$SNIKKET_DOMAIN_ASCII\\\")\\\"\"},{\"line\":19,\"text\":\"min_port=\\\"${SNIKKET_TWEAK_TURNSERVER_MIN_PORT:-49152}\\\"\"},{\"line\":20,\"text\":\"max_port=\\\"${SNIKKET_TWEAK_TURNSERVER_MAX_PORT:-65535}\\\"\"},{\"line\":22,\"text\":\"exec s6-setuidgid turnserver /usr/bin/turnserver -c /etc/turnserver.conf --prod \\\\\"},{\"line\":23,\"text\":\" --static-auth-secret= /snikket/prosody/turn-auth-secret-v2)\\\" \\\\\"},{\"line\":24,\"text\":\" --cert=\\\"$CERTFILE\\\" --pkey \\\"$KEYFILE\\\" -r \\\"$SNIKKET_DOMAIN_ASCII\\\" \\\\\"},{\"line\":26,\"text\":\" --listening-port \\\"${SNIKKET_TWEAK_TURNSERVER_PORT-3478}\\\" \\\\\"},{\"line\":27,\"text\":\" -X \\\"$TURN_EXTERNAL_IP\\\"\"}],\"path_sha16\":\"b6e1eb9791801900\"},{\"basename\":\"snikket-edge-egress.service\",\"lines\":[{\"line\":2,\"text\":\"Description=Snikket Internet egress via edge-vm\"}],\"path_sha16\":\"ff8de9e3bc6968cf\"},{\"basename\":\"snikket-turn-reconcile.service\",\"lines\":[{\"line\":2,\"text\":\"Description=Reconcile Snikket TURN certificate permissions and listeners\"},{\"line\":8,\"text\":\"ExecStart=/usr/local/sbin/snikket-turn-reconcile\"}],\"path_sha16\":\"b3c0283f7af1bd61\"},{\"basename\":\"snikket-turn-reconcile.timer\",\"lines\":[{\"line\":2,\"text\":\"Description=Periodic Snikket TURN durability reconciliation\"},{\"line\":9,\"text\":\"Unit=snikket-turn-reconcile.service\"}],\"path_sha16\":\"130e65f40043e8f2\"},{\"basename\":\"snikket-turn-reconcile.timer\",\"lines\":[{\"line\":2,\"text\":\"Description=Periodic Snikket TURN durability reconciliation\"},{\"line\":9,\"text\":\"Unit=snikket-turn-reconcile.service\"}],\"path_sha16\":\"e9b69f6136ce9691\"},{\"basename\":\"cloud-init-network.service\",\"lines\":[{\"line\":28,\"text\":\"# stage can start, and then wait on a return socket until the cloud-init\"},{\"line\":29,\"text\":\"# process has completed this stage. The output from the return socket is piped\"},{\"line\":32,\"text\":\"ExecStart=sh -c 'echo \\\"start\\\" | nc -Uu -W1 /run/cloud-init/share/network.sock -s /run/cloud-init/share/network-return.sock | sh'\"}],\"path_sha16\":\"d00cb9850586513a\"},{\"basename\":\"snikket-edge-egress.service\",\"lines\":[{\"line\":2,\"text\":\"Description=Snikket Internet egress via edge-vm\"}],\"path_sha16\":\"01d7d6f52fe7a474\"}],\"docker\":[{\"image_sha16\":\"0c2eab14269992f7\",\"name\":\"snikket\",\"ports_safe\":\"\"},{\"image_sha16\":\"196c632b7cd3d6fe\",\"name\":\"snikket-portal\",\"ports_safe\":\"\"},{\"image_sha16\":\"afdc9a1e6d2b82c1\",\"name\":\"snikket-certs\",\"ports_safe\":\"\"},{\"image_sha16\":\"f2e47aabc41c5e2d\",\"name\":\"snikket-proxy\",\"ports_safe\":\"\"}],\"egress_source_owned\":true,\"hostname\":\"snikket\",\"listeners\":[{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"udp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"udp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5280,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":46313,\"process\":\"containerd\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":53,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"},{\"port\":5765,\"process\":\"hypercorn\",\"proto\":\"tcp\"},{\"port\":22,\"process\":\"sshd\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":5000,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5223,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5222,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5269,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3479,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":3478,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":22,\"process\":\"sshd\",\"proto\":\"tcp\"},{\"port\":80,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":5280,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5349,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":5350,\"process\":\"turnserver\",\"proto\":\"tcp\"},{\"port\":443,\"process\":\"nginx\",\"proto\":\"tcp\"},{\"port\":5000,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5223,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5222,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5269,\"process\":\"lua5.4\",\"proto\":\"tcp\"},{\"port\":5355,\"process\":\"systemd-resolve\",\"proto\":\"tcp\"}],\"nft\":[],\"routes\":[\"default via dev eth0 proto static \",\" dev eth0 proto kernel scope link src \",\"local dev eth0 table local proto kernel scope host src \",\"broadcast dev eth0 table local proto kernel scope link src \"],\"target_owned\":false,\"uid\":0}\nSPB_TO_TRUE_WAN_PROBE={\"tcp\":{\"3478\":\"TIMEOUT\",\"3479\":\"TIMEOUT\",\"443\":\"OPEN\",\"5000\":\"TIMEOUT\",\"5222\":\"TIMEOUT\",\"5349\":\"TIMEOUT\",\"5350\":\"TIMEOUT\",\"80\":\"OPEN\"},\"udp_stun\":{\"3478\":{\"ok\":false,\"result\":\"TIMEOUT\"},\"3479\":{\"ok\":false,\"result\":\"TIMEOUT\"}},\"wan_sha16\":\"26ac437d63a8bcf2\"}\nTRUE_WAN_CONSENSUS=true\nTRUE_WAN_SHA16=26ac437d63a8bcf2\nROUTER_MANAGEMENT_OPEN_PORTS=\nROUTER_AUTOMATION_ARTIFACT_COUNT=6\nPUBLIC_CHAT_DNS_ALREADY_HOME_WAN=false\nVM130_OWNS_SNIKKET_DNAT_TARGET=true\nVM150_OWNS_SNIKKET_DNAT_TARGET=false\nVM130_OWNS_SNIKKET_EGRESS_SOURCE=false\nVM150_OWNS_SNIKKET_EGRESS_SOURCE=true\nVM130_REQUIRED_LISTENER_COUNT=1\nVM150_REQUIRED_LISTENER_COUNT=6\nTRUE_WAN_TCP_OPEN_COUNT=2\nTRUE_WAN_STUN_OK_COUNT=0\nNEXT_ACTION=BUILD_ROUTER_SNIKKET_NAT_MIGRATION_FROM_PROVEN_TOPOLOGY\nTASK_COMPLETE=true\nTASK_RESULT=PASS_SPB_HOME_WAN_ROUTER_SNIKKET_AUDIT\nDECISION=READ_EXACT_9213_THEN_BUILD_ROUTER_MIGRATION_ONLY_FROM_PROVEN_TOPOLOGY\nNEXT_GATE=EXACT_9213_TRUE_WAN_ROUTER_SNIKKET\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index 1ae8a0de..3de7dcce 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,22 +1,22 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=SUPPORT-260923-SKLADCHIK-NETBIRD-API-ROUTE-RCA-961R1 -STATUS=FAIL -RC=1 +COMMAND_ID=SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1 +STATUS=OK +RC=0 HOST=pve01 MODE=read-only -COMPONENT=skladchik-netbird-api-route-rca +COMPONENT=spb-home-wan-router-snikket-audit REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66 ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0 -COMMAND_SHA256=0ae33d5d0d029e0b0cb4ff434a82de924eaaeb617e36dbc35889c319ba85b898 +COMMAND_SHA256=e8cf489f5c96585a16ddf42ca05d7f8f60a72b6f41cb180c370c54028398971a DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true CHANGE_DECLARED=false RESULT_CONTRACT_VALID=true RESULT_CONTRACT_STATUS=NOT_APPLICABLE RESULT_CONTRACT_ERROR=NONE -COMMAND_RC=1 +COMMAND_RC=0 CHANGES_MADE=false ROLLBACK_STARTED=false ROLLBACK_RESTORED=null @@ -24,32 +24,54 @@ MUTATION_OUTCOME=NO_MUTATION SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=7dc542d10bde3ea3dc5f9a087b52c1d1448f2675161f1e3b162298d95ff28bc5 -SANITIZED_OUTPUT_SHA256=7dc542d10bde3ea3dc5f9a087b52c1d1448f2675161f1e3b162298d95ff28bc5 +RAW_EVIDENCE_SHA256=ab2409f5a0b922cddc2c05b1fa06f012701bfee81045a413e48a6f9ef4f8cab4 +SANITIZED_OUTPUT_SHA256=ab2409f5a0b922cddc2c05b1fa06f012701bfee81045a413e48a6f9ef4f8cab4 OUTPUT_BEGIN -SKLADCHIK961_BEGIN=true -COMMAND_ID=SUPPORT-260923-SKLADCHIK-NETBIRD-API-ROUTE-RCA-961R1 -MODE=read-only -COMPONENT=skladchik-netbird-api-route-rca -PREDECESSOR_960=USA_SSH_CURRENTLY_UNAVAILABLE -MUTATION_BOUNDARY=NONE_READ_ONLY -ACCESS_PATH=NETBIRD_PUBLIC_API_VIA_EXISTING_LOCAL_CREDENTIAL_IF_PRESENT -EDGE_NETBIRD_IP_FOUND=true -EDGE_NETBIRD_IP_HASH=8ce86a6ae65d3692 -EDGE_HOSTNAME_FOUND=true -EDGE_HOSTNAME_HASH=ebb24cf2960c2243 -TOKEN_SEARCH_FILES_SCANNED=12000 -TOKEN_MATCHED_FILE_COUNT=0 -TOKEN_CANDIDATE_COUNT=0 -API_FORCED_MOLDOVA_REACH_RC=0 -API_FORCED_MOLDOVA_HTTP=401 -WORKING_NETBIRD_API_TOKEN_FOUND=false -DECISION=HOLD_NO_WORKING_NETBIRD_API_CREDENTIAL -CHANGES_MADE_BY_961=false -ROLLBACK_STARTED=false -ROLLBACK_RESTORED=null -HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260923-SKLADCHIK-NETBIRD-API-ROUTE-RCA-961R1","status":"FAIL","changes_made":false,"rollback_started":false,"rollback_restored":null} -SKLADCHIK961_END=true +WAN9213_BEGIN=true +MODE=READ_ONLY_TRUE_WAN_ROUTER_SNIKKET_AUDIT +MUTATION_BOUNDARY=NONE;NO_ROUTER_WRITE;NO_SPB_WRITE;NO_GUEST_WRITE;NO_DNS_WRITE;NO_SHUTDOWN +LOCAL9209_BEGIN=true +CID=SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1 +PLINK_PRESENT=true +SPB_CANDIDATE_COUNT=1 +SPB_CANDIDATE_SHA16=6d6149f42864ce03 +HOME_CANDIDATE_COUNT=1 +HOME_CANDIDATE_SHA16=bc517b4af3298846 +SPB_HASH_MATCH=true +SPB_PINNED_PROBE_RC=0 +DPAPI_DECRYPTABLE_COUNT=1 +OLD9208_LOCAL_ERR_SHA16=5a00a4ad6f6ef637 +LOCAL_ACCESS_STATUS=PASS +LOCAL9209_END=true +SPB_PINNED_ACCESS=PASS +SPB_EXTRACT_RC=0 +PVE_TRUE_WAN_AUDIT_RC=0 +VM130_QGA_TRANSPORT_RC=0 +VM150_QGA_TRANSPORT_RC=0 +SPB_TRUE_WAN_PROBE_RC=0 +TRUE_WAN9213={"dns":{"chat.gram1.ru":{"1.1.1.1":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]},"8.8.8.8":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]}},"git.gram1.ru":{"1.1.1.1":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]},"8.8.8.8":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]}},"groups.chat.gram1.ru":{"1.1.1.1":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]},"8.8.8.8":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]}},"share.chat.gram1.ru":{"1.1.1.1":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]},"8.8.8.8":{"count":1,"matches_wan":false,"sha16":["6d6149f42864ce03"]}}},"evidence":[{"line":234,"text":"- WAN DHCP observed in router log: , gateway ."},{"line":315,"text":"### NAT / port forwarding"},{"line":316,"text":"- ISP tcp/80 -> bc:24:11:e1:f3:3c, NPMplus."},{"line":317,"text":"- ISP tcp/443 -> bc:24:11:e1:f3:3c, NPMplus."},{"line":318,"text":"- ISP tcpudp/3478 -> bc:24:11:e1:9a:25, Nextcloud Talk TURN."},{"line":319,"text":"- Home tcp/51820 -> bc:24:11:f4:c5:d8, WireGuard vpn1."},{"line":378,"text":"- WireGuard port: 51820."},{"line":683,"text":"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, ."},{"line":684,"text":"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on ."},{"line":685,"text":"- Router forwards Home TCP/51820 to WireGuard host ."},{"line":1356,"text":"- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm ."},{"line":1420,"text":"- Router forwards TCP/UDP 3478 to Nextcloud ."},{"line":1421,"text":"- Router forwards TCP/UDP 51820 for WireGuard on the Home bridge, not to edge-vm."}],"router":{"artifact_hits":[{"basename":"HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md","path_sha16":"7c0a71546dbaf313"},{"basename":"31_HOMELAB_REFERENCE.md","path_sha16":"b6a8564938774058"},{"basename":"HOMELAB_FULL_HANDOFF_CURRENT.md","path_sha16":"aff2edacfd1256cd"},{"basename":"HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z","path_sha16":"36bb80fe9818f709"},{"basename":"HOMELAB_ASSISTANT_ERROR_REGISTER.md","path_sha16":"035234526670966e"},{"basename":"HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-proof-repair-20260630T215529Z","path_sha16":"4cddf80b93b25b32"}],"gateway_sha16":"4f9da1283166a1e9","ports":{"22":"TIMEOUT","23":"TIMEOUT","2323":"TIMEOUT","443":"TIMEOUT","80":"TIMEOUT"}},"wan":{"hashes":["26ac437d63a8bcf2"],"source_count":2,"unique_count":1}} +VM130_EDGE_AUDIT={"addresses":[{"iface":"lo","is_egress_source":false,"is_target":false,"sha16":"12ca17b49af22894"},{"iface":"eth0","is_egress_source":false,"is_target":false,"sha16":"bc517b4af3298846"},{"iface":"wg-taftauto","is_egress_source":false,"is_target":false,"sha16":"d1d4b6abdd6b1971"},{"iface":"wg-edge01","is_egress_source":false,"is_target":true,"sha16":"0b7870e2230336f5"},{"iface":"br-4d894f9e427b","is_egress_source":false,"is_target":false,"sha16":"fbd57f0145e15cc8"},{"iface":"br-5f66e1018bdd","is_egress_source":false,"is_target":false,"sha16":"5db063f47c3859a0"},{"iface":"br-8122fec51f39","is_egress_source":false,"is_target":false,"sha16":"93449cac351e054d"},{"iface":"docker0","is_egress_source":false,"is_target":false,"sha16":"346840d5a3d9fe9b"},{"iface":"br-915a81681c3e","is_egress_source":false,"is_target":false,"sha16":"bc41ed840e460923"},{"iface":"br-a4e31561a8d5","is_egress_source":false,"is_target":false,"sha16":"c138df8d3b53b190"},{"iface":"br-d41b3e918fbc","is_egress_source":false,"is_target":false,"sha16":"f9bcbcb71ab0bfd4"},{"iface":"br-f43db13d76c4","is_egress_source":false,"is_target":false,"sha16":"885dfc9b72d2209e"}],"config_hits":[{"basename":"cloud-init-network.service","lines":[{"line":28,"text":"# stage can start, and then wait on a return socket until the cloud-init"},{"line":29,"text":"# process has completed this stage. The output from the return socket is piped"},{"line":32,"text":"ExecStart=sh -c 'echo \"start\" | nc -Uu -W1 /run/cloud-init/share/network.sock -s /run/cloud-init/share/network-return.sock | sh'"}],"path_sha16":"d00cb9850586513a"},{"basename":"snikket-edge-ingress.nft","lines":[{"line":1,"text":"table ip snikket_edge_prod {"},{"line":4,"text":" iifname \"wg-edge01\" ip saddr ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } dnat to "},{"line":5,"text":" iifname \"wg-edge01\" ip saddr ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } dnat to "},{"line":9,"text":" oifname \"eth0\" ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } snat to "},{"line":10,"text":" oifname \"eth0\" ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } snat to "}],"path_sha16":"70fb445de6996d23"},{"basename":"p2-22-health-surface-response-validation-return-packet-20260626T023040Z.json","lines":[{"line":128,"text":" \"return_packet_flow\": ["},{"line":160,"text":" \"return_rows\": ["},{"line":178,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":215,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_01\","},{"line":241,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":278,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_02\","},{"line":304,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":341,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_03\","},{"line":367,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":404,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_04\","},{"line":430,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":467,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_05\","},{"line":493,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":530,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_06\","},{"line":556,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":593,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_07\","},{"line":619,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":656,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_08\","},{"line":682,"text":" \"expected_return_path\": \"IMPLEMENTATION_CANDIDATE_AFTER_VALIDATION_ONLY\","},{"line":719,"text":" \"return_row_id\": \"P2_22_RETURN_ROW_09\","}],"path_sha16":"fe6950b250508445"},{"basename":"p2-02-docker-socket-host-network-privilege-decision-plan-20260625T224622Z.json","lines":[{"line":348,"text":" \"Monitor proxy reachability and verify no direct socket mounts return for migrated clients.\""}],"path_sha16":"8733d16ab518b1f6"},{"basename":"p2-02-docker-socket-host-network-privilege-classification-20260625T224513Z.json","lines":[{"line":217,"text":" \"Monitor proxy reachability and verify no direct socket mounts return for migrated clients.\""}],"path_sha16":"048ed578a90e647c"},{"basename":"composer.py","lines":[{"line":22,"text":" return not self.check_event(StreamEndEvent)"},{"line":27,"text":" return self.compose_document()"},{"line":48,"text":" return document"},{"line":61,"text":" return node"},{"line":70,"text":" return self.anchors[anchor]"},{"line":86,"text":" return node"},{"line":97,"text":" return node"},{"line":115,"text":" return node"},{"line":138,"text":" return node"}],"path_sha16":"c73308fe0d2115d3"},{"basename":"composer.py","lines":[{"line":22,"text":" return not self.check_event(StreamEndEvent)"},{"line":27,"text":" return self.compose_document()"},{"line":48,"text":" return document"},{"line":61,"text":" return node"},{"line":70,"text":" return self.anchors[anchor]"},{"line":86,"text":" return node"},{"line":97,"text":" return node"},{"line":115,"text":" return node"},{"line":138,"text":" return node"}],"path_sha16":"7d17ddfec624c826"}],"docker":[{"image_sha16":"5aa369fb5eaf7c46","name":"kopia","ports_safe":""},{"image_sha16":"8112a294af79d305","name":"homelab-registry-cache","ports_safe":""},{"image_sha16":"ef95d2f35b4f5848","name":"npmplus","ports_safe":""},{"image_sha16":"31e555942da7f897","name":"crowdsec","ports_safe":":7422->7422/tcp, :8088->8080/tcp"},{"image_sha16":"cdfb05c4b7a8150a","name":"dozzle","ports_safe":":9999->8080/tcp"},{"image_sha16":"f4704b71a591a53d","name":"cadvisor","ports_safe":":8081->8080/tcp"},{"image_sha16":"4a0705d1136ed8bf","name":"alloy","ports_safe":":12345->12345/tcp"},{"image_sha16":"5ef8646c3bb0fb15","name":"diun","ports_safe":""},{"image_sha16":"33d259476c8fec4b","name":"socket-proxy","ports_safe":":2375->2375/tcp"},{"image_sha16":"1ad7e04d49dec6a4","name":"loki","ports_safe":":3100->3100/tcp"}],"egress_source_owned":false,"hostname":"edge-vm","listeners":[{"port":53,"process":"systemd-resolve","proto":"udp"},{"port":53,"process":"systemd-resolve","proto":"udp"},{"port":51824,"process":"","proto":"udp"},{"port":5355,"process":"systemd-resolve","proto":"udp"},{"port":55808,"process":"","proto":"udp"},{"port":51824,"process":"","proto":"udp"},{"port":5355,"process":"systemd-resolve","proto":"udp"},{"port":55808,"process":"","proto":"udp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":22,"process":"sshd","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":53,"process":"systemd-resolve","proto":"tcp"},{"port":12345,"process":"docker-proxy","proto":"tcp"},{"port":18083,"process":"python3","proto":"tcp"},{"port":18091,"process":"python3","proto":"tcp"},{"port":18092,"process":"python3","proto":"tcp"},{"port":9221,"process":"python3","proto":"tcp"},{"port":8081,"process":"docker-proxy","proto":"tcp"},{"port":8088,"process":"docker-proxy","proto":"tcp"},{"port":8014,"process":"python3","proto":"tcp"},{"port":7422,"process":"docker-proxy","proto":"tcp"},{"port":9050,"process":"tor","proto":"tcp"},{"port":53,"process":"systemd-resolve","proto":"tcp"},{"port":81,"process":"nginx","proto":"tcp"},{"port":81,"process":"nginx","proto":"tcp"},{"port":81,"process":"nginx","proto":"tcp"},{"port":81,"process":"nginx","proto":"tcp"},{"port":9999,"process":"docker-proxy","proto":"tcp"},{"port":18088,"process":"python3","proto":"tcp"},{"port":18089,"process":"python3","proto":"tcp"},{"port":18090,"process":"python3","proto":"tcp"},{"port":18093,"process":"python3","proto":"tcp"},{"port":5355,"process":"systemd-resolve","proto":"tcp"},{"port":9221,"process":"pve_exporter","proto":"tcp"},{"port":51515,"process":"kopia","proto":"tcp"},{"port":2375,"process":"docker-proxy","proto":"tcp"},{"port":5000,"process":"registry","proto":"tcp"},{"port":3100,"process":"docker-proxy","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":22,"process":"sshd","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":5355,"process":"systemd-resolve","proto":"tcp"}],"nft":["table ip snikket_edge_prod {","iifname \"wg-edge01\" ip saddr ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } dnat to ","iifname \"wg-edge01\" ip saddr ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } dnat to ","oifname \"eth0\" ip daddr tcp dport { 3478, 3479, 5000, 5222, 5269, 5349, 5350 } snat to ","oifname \"eth0\" ip daddr udp dport { 3478-3479, 5349-5350, 60000-60199 } snat to "],"routes":["default dev wg-edge01 table 17777 scope link ","default via dev eth0 proto static "," dev wg-taftauto proto kernel scope link src "," dev wg-edge01 proto kernel scope link src ","local dev wg-taftauto table local proto kernel scope host src ","broadcast dev wg-taftauto table local proto kernel scope link src ","local dev wg-edge01 table local proto kernel scope host src ","broadcast dev wg-edge01 table local proto kernel scope link src ","multicast ff00::/8 dev wg-edge01 table local proto kernel metric 256 pref medium","multicast ff00::/8 dev wg-taftauto table local proto kernel metric 256 pref medium"],"target_owned":true,"uid":0} +VM150_SNIKKET_AUDIT={"addresses":[{"iface":"lo","is_egress_source":false,"is_target":false,"sha16":"12ca17b49af22894"},{"iface":"eth0","is_egress_source":true,"is_target":false,"sha16":"4e29a2729bbc4066"},{"iface":"docker0","is_egress_source":false,"is_target":false,"sha16":"346840d5a3d9fe9b"}],"config_hits":[{"basename":"docker-compose.yml","lines":[{"line":4,"text":" snikket_proxy:"},{"line":5,"text":" container_name: snikket-proxy"},{"line":6,"text":" image: snikket/snikket-web-proxy@sha256:e2c22746c19489d2723c6ccebb15f2f14e4e35431cabbc7318d9ee33a48566e1"},{"line":7,"text":" env_file: snikket.conf"},{"line":10,"text":" - snikket_data:/snikket"},{"line":13,"text":" snikket_certs:"},{"line":14,"text":" container_name: snikket-certs"},{"line":15,"text":" image: snikket/snikket-cert-manager@sha256:3920d6d6ad0ff7775d80fba034cf08fe246ff3548f192621cf3be6366a17d530"},{"line":17,"text":" env_file: snikket.conf"},{"line":19,"text":" - snikket_data:/snikket"},{"line":22,"text":" snikket_portal:"},{"line":23,"text":" container_name: snikket-portal"},{"line":24,"text":" image: snikket/snikket-web-portal@sha256:d67ff498c44bcabc6eee0379d030870004cc37ccf445aa5450d891d4ce02e136"},{"line":26,"text":" env_file: snikket.conf"},{"line":29,"text":" snikket_server:"},{"line":30,"text":" container_name: snikket"},{"line":31,"text":" image: snikket/snikket-server@sha256:311c076e06ec0fdb182900577a936cdc8d15da50bcc6ccd6707b743a13a162f3"},{"line":34,"text":" - snikket_data:/snikket"},{"line":35,"text":" env_file: snikket.conf"},{"line":40,"text":" snikket_data:"}],"path_sha16":"469462f29cd9bad5"},{"basename":"snikket.conf","lines":[{"line":1,"text":"SNIKKET_DOMAIN=chat.gram1.ru"},{"line":2,"text":"SNIKKET_ADMIN_EMAIL=noreply@pvepro.ru"},{"line":3,"text":"SNIKKET_TWEAK_TURNSERVER_MIN_PORT=60000"},{"line":4,"text":"SNIKKET_TWEAK_TURNSERVER_MAX_PORT=60199"},{"line":6,"text":"SNIKKET_TWEAK_TURNSERVER_INTERNAL_IP="}],"path_sha16":"82259917e6cb2726"},{"basename":"docker-compose.override.yml","lines":[{"line":2,"text":" snikket_server:"},{"line":8,"text":" source: /etc/snikket/turnfix/coturn-run"},{"line":9,"text":" target: /etc/sv/coturn/run"},{"line":12,"text":" source: /etc/snikket/turnfix/coturn-run.upstream"},{"line":13,"text":" target: /etc/sv/coturn/run.upstream"}],"path_sha16":"370d0aff3f71ce75"},{"basename":"coturn-run","lines":[{"line":3,"text":"CRT=\"$CERTDIR/$SNIKKET_DOMAIN_ASCII.crt\""},{"line":4,"text":"KEY=\"$CERTDIR/$SNIKKET_DOMAIN_ASCII.key\""},{"line":10,"text":"chgrp turnserver \"$CERTDIR\" \"$CRT\" \"$KEY\""},{"line":15,"text":"sed -i 's#^userdb=/snikket/prosody/turndb$#userdb=/var/lib/turn/turndb#' /etc/turnserver.conf"},{"line":16,"text":"install -d -o turnserver -g turnserver -m 0775 /var/lib/turn"},{"line":18,"text":"exec /etc/sv/coturn/run.upstream"}],"path_sha16":"b77d42082a9cc138"},{"basename":"coturn-run.upstream","lines":[{"line":3,"text":"if [ \"$SNIKKET_TWEAK_TURNSERVER\" = \"0\" ]; then"},{"line":4,"text":"\techo \"TURN server disabled by environment, not launching.\";"},{"line":8,"text":"CERTFILE=\"/etc/prosody/certs/$SNIKKET_DOMAIN_ASCII.crt\";"},{"line":9,"text":"KEYFILE=\"/etc/prosody/certs/$SNIKKET_DOMAIN_ASCII.key\";"},{"line":17,"text":"TURN_EXTERNAL_IP=\"$(snikket-turn-addresses \"$SNIKKET_DOMAIN_ASCII\")\""},{"line":19,"text":"min_port=\"${SNIKKET_TWEAK_TURNSERVER_MIN_PORT:-49152}\""},{"line":20,"text":"max_port=\"${SNIKKET_TWEAK_TURNSERVER_MAX_PORT:-65535}\""},{"line":22,"text":"exec s6-setuidgid turnserver /usr/bin/turnserver -c /etc/turnserver.conf --prod \\"},{"line":23,"text":" --static-auth-secret= /snikket/prosody/turn-auth-secret-v2)\" \\"},{"line":24,"text":" --cert=\"$CERTFILE\" --pkey \"$KEYFILE\" -r \"$SNIKKET_DOMAIN_ASCII\" \\"},{"line":26,"text":" --listening-port \"${SNIKKET_TWEAK_TURNSERVER_PORT-3478}\" \\"},{"line":27,"text":" -X \"$TURN_EXTERNAL_IP\""}],"path_sha16":"b6e1eb9791801900"},{"basename":"snikket-edge-egress.service","lines":[{"line":2,"text":"Description=Snikket Internet egress via edge-vm"}],"path_sha16":"ff8de9e3bc6968cf"},{"basename":"snikket-turn-reconcile.service","lines":[{"line":2,"text":"Description=Reconcile Snikket TURN certificate permissions and listeners"},{"line":8,"text":"ExecStart=/usr/local/sbin/snikket-turn-reconcile"}],"path_sha16":"b3c0283f7af1bd61"},{"basename":"snikket-turn-reconcile.timer","lines":[{"line":2,"text":"Description=Periodic Snikket TURN durability reconciliation"},{"line":9,"text":"Unit=snikket-turn-reconcile.service"}],"path_sha16":"130e65f40043e8f2"},{"basename":"snikket-turn-reconcile.timer","lines":[{"line":2,"text":"Description=Periodic Snikket TURN durability reconciliation"},{"line":9,"text":"Unit=snikket-turn-reconcile.service"}],"path_sha16":"e9b69f6136ce9691"},{"basename":"cloud-init-network.service","lines":[{"line":28,"text":"# stage can start, and then wait on a return socket until the cloud-init"},{"line":29,"text":"# process has completed this stage. The output from the return socket is piped"},{"line":32,"text":"ExecStart=sh -c 'echo \"start\" | nc -Uu -W1 /run/cloud-init/share/network.sock -s /run/cloud-init/share/network-return.sock | sh'"}],"path_sha16":"d00cb9850586513a"},{"basename":"snikket-edge-egress.service","lines":[{"line":2,"text":"Description=Snikket Internet egress via edge-vm"}],"path_sha16":"01d7d6f52fe7a474"}],"docker":[{"image_sha16":"0c2eab14269992f7","name":"snikket","ports_safe":""},{"image_sha16":"196c632b7cd3d6fe","name":"snikket-portal","ports_safe":""},{"image_sha16":"afdc9a1e6d2b82c1","name":"snikket-certs","ports_safe":""},{"image_sha16":"f2e47aabc41c5e2d","name":"snikket-proxy","ports_safe":""}],"egress_source_owned":true,"hostname":"snikket","listeners":[{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":53,"process":"systemd-resolve","proto":"udp"},{"port":53,"process":"systemd-resolve","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5355,"process":"systemd-resolve","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3478,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":3479,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5349,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5350,"process":"turnserver","proto":"udp"},{"port":5355,"process":"systemd-resolve","proto":"udp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5280,"process":"lua5.4","proto":"tcp"},{"port":46313,"process":"containerd","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":53,"process":"systemd-resolve","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":53,"process":"systemd-resolve","proto":"tcp"},{"port":5765,"process":"hypercorn","proto":"tcp"},{"port":22,"process":"sshd","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":5000,"process":"lua5.4","proto":"tcp"},{"port":5223,"process":"lua5.4","proto":"tcp"},{"port":5222,"process":"lua5.4","proto":"tcp"},{"port":5269,"process":"lua5.4","proto":"tcp"},{"port":5355,"process":"systemd-resolve","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3479,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":3478,"process":"turnserver","proto":"tcp"},{"port":22,"process":"sshd","proto":"tcp"},{"port":80,"process":"nginx","proto":"tcp"},{"port":5280,"process":"lua5.4","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5349,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":5350,"process":"turnserver","proto":"tcp"},{"port":443,"process":"nginx","proto":"tcp"},{"port":5000,"process":"lua5.4","proto":"tcp"},{"port":5223,"process":"lua5.4","proto":"tcp"},{"port":5222,"process":"lua5.4","proto":"tcp"},{"port":5269,"process":"lua5.4","proto":"tcp"},{"port":5355,"process":"systemd-resolve","proto":"tcp"}],"nft":[],"routes":["default via dev eth0 proto static "," dev eth0 proto kernel scope link src ","local dev eth0 table local proto kernel scope host src ","broadcast dev eth0 table local proto kernel scope link src "],"target_owned":false,"uid":0} +SPB_TO_TRUE_WAN_PROBE={"tcp":{"3478":"TIMEOUT","3479":"TIMEOUT","443":"OPEN","5000":"TIMEOUT","5222":"TIMEOUT","5349":"TIMEOUT","5350":"TIMEOUT","80":"OPEN"},"udp_stun":{"3478":{"ok":false,"result":"TIMEOUT"},"3479":{"ok":false,"result":"TIMEOUT"}},"wan_sha16":"26ac437d63a8bcf2"} +TRUE_WAN_CONSENSUS=true +TRUE_WAN_SHA16=26ac437d63a8bcf2 +ROUTER_MANAGEMENT_OPEN_PORTS= +ROUTER_AUTOMATION_ARTIFACT_COUNT=6 +PUBLIC_CHAT_DNS_ALREADY_HOME_WAN=false +VM130_OWNS_SNIKKET_DNAT_TARGET=true +VM150_OWNS_SNIKKET_DNAT_TARGET=false +VM130_OWNS_SNIKKET_EGRESS_SOURCE=false +VM150_OWNS_SNIKKET_EGRESS_SOURCE=true +VM130_REQUIRED_LISTENER_COUNT=1 +VM150_REQUIRED_LISTENER_COUNT=6 +TRUE_WAN_TCP_OPEN_COUNT=2 +TRUE_WAN_STUN_OK_COUNT=0 +NEXT_ACTION=BUILD_ROUTER_SNIKKET_NAT_MIGRATION_FROM_PROVEN_TOPOLOGY +TASK_COMPLETE=true +TASK_RESULT=PASS_SPB_HOME_WAN_ROUTER_SNIKKET_AUDIT +DECISION=READ_EXACT_9213_THEN_BUILD_ROUTER_MIGRATION_ONLY_FROM_PROVEN_TOPOLOGY +NEXT_GATE=EXACT_9213_TRUE_WAN_ROUTER_SNIKKET +HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260923-SPB-HOME-WAN-ROUTER-SNIKKET-AUDIT-9213R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null} OUTPUT_END CHAT_OUTPUT_END