From f1f7997e7a6983c77a40e97206f980f9ca45deeb Mon Sep 17 00:00:00 2001 From: homelab-runtime-publisher Date: Sat, 19 Sep 2026 12:11:29 +0000 Subject: [PATCH] runtime: publish SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2 --- ...DOVA-FIREWALL-PATH-RCA-READONLY-610R2.json | 38 +++++++++ ...LDOVA-FIREWALL-PATH-RCA-READONLY-610R2.txt | 84 +++++++++++++++++++ runtime/latest.json | 14 ++-- runtime/latest.txt | 66 +++++++++++---- 4 files changed, 179 insertions(+), 23 deletions(-) create mode 100644 runtime/history/SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2.json create mode 100644 runtime/history/SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2.txt diff --git a/runtime/history/SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2.json b/runtime/history/SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2.json new file mode 100644 index 00000000..a0f85a9c --- /dev/null +++ b/runtime/history/SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2.json @@ -0,0 +1,38 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2", + "status": "OK", + "rc": 0, + "host": "pve01", + "mode": "read-only", + "component": "netbird-moldova-firewall-path-rca-readonly", + "started_at_utc": "2026-09-19T12:11:27Z", + "finished_at_utc": "2026-09-19T12:11:28Z", + "reference_register_checked": true, + "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66", + "error_register_checked": true, + "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0", + "command_sha256": "b71cc94cbc71e9bbd2e51cbfc989c47a106bd17d04ede98ea5a97c741020ea2a", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "change_declared": false, + "result_contract_valid": true, + "result_contract_status": null, + "result_contract_error": null, + "command_rc": 0, + "changes_made": false, + "rollback_started": false, + "rollback_restored": null, + "mutation_outcome": "NO_MUTATION", + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "f3cfe4d8536ad376981cf875f37f2d61735ede8cefb46ee68dc9884d1aac198d", + "sanitized_output_sha256": "f3cfe4d8536ad376981cf875f37f2d61735ede8cefb46ee68dc9884d1aac198d", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "PVE1_OPERATOR_KEY_MATCH=True\nMOLDOVA_KNOWNHOST_MATCH=True\nMOLDOVA_SSH_RC=0\nAUDIT_REMOTE=BEGIN\nHOSTNAME=relay\nUID=1000\nUSER=ops\nGROUPS=ops sudo\nSUDO_N=True\nIDENTITY_REMOTE_OK=True\nDEFAULT_ROUTE_DEVS=eth0\nNFTABLES_ACTIVE=active\nNFTABLES_ENABLED=enabled\nFIREWALLD_ACTIVE=inactive\nNETFILTER_PERSISTENT_ACTIVE=inactive\nNETBIRD_ACTIVE=active\nNFTABLES_SYSTEMD_SHOW=ExecStart={ path=/usr/sbin/nft ; argv[]=/usr/sbin/nft -f /etc/nftables.conf ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } FragmentPath=/lib/systemd/system/nftables.service\nNETBIRD_SYSTEMD_SHOW=ExecStart={ path=/usr/bin/netbird ; argv[]=/usr/bin/netbird service run --log-level info --daemon-addr unix:///var/run/netbird.sock --log-file /var/log/netbird/client.log ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } FragmentPath=/etc/systemd/system/netbird.service\nNFTABLES_CONF_PRESENT=True\nNFTABLES_CONF_SHA256=dbde07925ede154b7d584f6401166c4c044aa7bd4375afe7b558cba68cef9472\nNFTABLES_CONF_CHECK_RC=0\nNFT_CONFIG_FILE_COUNT=1\nNFT_CONFIG_FILE_00=/etc/nftables.conf|dbde07925ede154b7d584f6401166c4c044aa7bd4375afe7b558cba68cef9472\nNFT_JSON_RC=0\nINPUT_BASE_CHAIN_COUNT=3\nINPUT_BASE_00=family=inet table=filter chain=input type=filter priority=0 policy=drop\nINPUT_BASE_01=family=ip table=netbird chain=netbird-acl-input-filter type=filter priority=0 policy=accept\nINPUT_BASE_02=family=ip6 table=netbird chain=netbird-acl-input-filter type=filter priority=0 policy=accept\nINPUT_REACHABLE_CHAIN_COUNT=5\nNFT_RULE_00=family=inet table=filter chain=input handle=5 dports=- iif=- ct=established,related verdict=accept jump=- comment=-\nNFT_RULE_01=family=inet table=filter chain=input handle=8 dports=22 iif=- ct=- verdict=accept jump=- comment=-\nNFT_RULE_02=family=ip table=netbird chain=netbird-acl-input-filter handle=16 dports=- iif=wt0 ct=- verdict=- jump=jump:netbird-acl-input-rules comment=-\nNFT_RULE_03=family=ip table=netbird chain=netbird-acl-input-filter handle=17 dports=- iif=wt0 ct=- verdict=drop jump=- comment=-\nNFT_RULE_04=family=ip table=netbird chain=netbird-acl-input-rules handle=14 dports=- iif=- ct=established,related verdict=accept jump=- comment=-\nNFT_RULE_05=family=ip6 table=netbird chain=netbird-acl-input-filter handle=16 dports=- iif=wt0 ct=- verdict=- jump=jump:netbird-acl-input-rules comment=-\nNFT_RULE_06=family=ip6 table=netbird chain=netbird-acl-input-filter handle=17 dports=- iif=wt0 ct=- verdict=drop jump=- comment=-\nNFT_RULE_07=family=ip6 table=netbird chain=netbird-acl-input-rules handle=14 dports=- iif=- ct=established,related verdict=accept jump=- comment=-\nNFT_RULE_RELEVANT_COUNT=8\nDROP_BASE_COUNT=1\nDROP_BASE_00=family=inet table=filter chain=input ssh_accept_handles=8 port443_accept_handles=NONE terminal_drop_handles=NONE jumps=NONE\nNFT_CONFIG_CTX_00=/etc/nftables.conf:5:type filter hook input priority filter; policy drop;\nNFT_CONFIG_CTX_01=/etc/nftables.conf:10:tcp dport 22 accept\nNFT_CONFIG_CTX_02=/etc/nftables.conf:11:udp dport 51822 accept\nNFT_CONFIG_CTX_03=/etc/nftables.conf:14:type filter hook forward priority filter; policy drop;\nNFT_CONFIG_CONTEXT_COUNT=4\nFIREWALL_WRITER_FILE_COUNT=0\nFIREWALL_MUTATION_PATH_PROVEN=True\nAUDIT_REMOTE=END\nTASK_COMPLETE=true\nTASK_RESULT=MOLDOVA_FIREWALL_PATH_EVIDENCE_COLLECTED\nNO_MUTATION=true\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n" +} diff --git a/runtime/history/SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2.txt b/runtime/history/SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2.txt new file mode 100644 index 00000000..1a2c2689 --- /dev/null +++ b/runtime/history/SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2.txt @@ -0,0 +1,84 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2 +STATUS=OK +RC=0 +HOST=pve01 +MODE=read-only +COMPONENT=netbird-moldova-firewall-path-rca-readonly +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66 +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0 +COMMAND_SHA256=b71cc94cbc71e9bbd2e51cbfc989c47a106bd17d04ede98ea5a97c741020ea2a +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGE_DECLARED=false +RESULT_CONTRACT_VALID=true +RESULT_CONTRACT_STATUS=NOT_APPLICABLE +RESULT_CONTRACT_ERROR=NONE +COMMAND_RC=0 +CHANGES_MADE=false +ROLLBACK_STARTED=false +ROLLBACK_RESTORED=null +MUTATION_OUTCOME=NO_MUTATION +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=f3cfe4d8536ad376981cf875f37f2d61735ede8cefb46ee68dc9884d1aac198d +SANITIZED_OUTPUT_SHA256=f3cfe4d8536ad376981cf875f37f2d61735ede8cefb46ee68dc9884d1aac198d +OUTPUT_BEGIN +PVE1_OPERATOR_KEY_MATCH=True +MOLDOVA_KNOWNHOST_MATCH=True +MOLDOVA_SSH_RC=0 +AUDIT_REMOTE=BEGIN +HOSTNAME=relay +UID=1000 +USER=ops +GROUPS=ops sudo +SUDO_N=True +IDENTITY_REMOTE_OK=True +DEFAULT_ROUTE_DEVS=eth0 +NFTABLES_ACTIVE=active +NFTABLES_ENABLED=enabled +FIREWALLD_ACTIVE=inactive +NETFILTER_PERSISTENT_ACTIVE=inactive +NETBIRD_ACTIVE=active +NFTABLES_SYSTEMD_SHOW=ExecStart={ path=/usr/sbin/nft ; argv[]=/usr/sbin/nft -f /etc/nftables.conf ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } FragmentPath=/lib/systemd/system/nftables.service +NETBIRD_SYSTEMD_SHOW=ExecStart={ path=/usr/bin/netbird ; argv[]=/usr/bin/netbird service run --log-level info --daemon-addr unix:///var/run/netbird.sock --log-file /var/log/netbird/client.log ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } FragmentPath=/etc/systemd/system/netbird.service +NFTABLES_CONF_PRESENT=True +NFTABLES_CONF_SHA256=dbde07925ede154b7d584f6401166c4c044aa7bd4375afe7b558cba68cef9472 +NFTABLES_CONF_CHECK_RC=0 +NFT_CONFIG_FILE_COUNT=1 +NFT_CONFIG_FILE_00=/etc/nftables.conf|dbde07925ede154b7d584f6401166c4c044aa7bd4375afe7b558cba68cef9472 +NFT_JSON_RC=0 +INPUT_BASE_CHAIN_COUNT=3 +INPUT_BASE_00=family=inet table=filter chain=input type=filter priority=0 policy=drop +INPUT_BASE_01=family=ip table=netbird chain=netbird-acl-input-filter type=filter priority=0 policy=accept +INPUT_BASE_02=family=ip6 table=netbird chain=netbird-acl-input-filter type=filter priority=0 policy=accept +INPUT_REACHABLE_CHAIN_COUNT=5 +NFT_RULE_00=family=inet table=filter chain=input handle=5 dports=- iif=- ct=established,related verdict=accept jump=- comment=- +NFT_RULE_01=family=inet table=filter chain=input handle=8 dports=22 iif=- ct=- verdict=accept jump=- comment=- +NFT_RULE_02=family=ip table=netbird chain=netbird-acl-input-filter handle=16 dports=- iif=wt0 ct=- verdict=- jump=jump:netbird-acl-input-rules comment=- +NFT_RULE_03=family=ip table=netbird chain=netbird-acl-input-filter handle=17 dports=- iif=wt0 ct=- verdict=drop jump=- comment=- +NFT_RULE_04=family=ip table=netbird chain=netbird-acl-input-rules handle=14 dports=- iif=- ct=established,related verdict=accept jump=- comment=- +NFT_RULE_05=family=ip6 table=netbird chain=netbird-acl-input-filter handle=16 dports=- iif=wt0 ct=- verdict=- jump=jump:netbird-acl-input-rules comment=- +NFT_RULE_06=family=ip6 table=netbird chain=netbird-acl-input-filter handle=17 dports=- iif=wt0 ct=- verdict=drop jump=- comment=- +NFT_RULE_07=family=ip6 table=netbird chain=netbird-acl-input-rules handle=14 dports=- iif=- ct=established,related verdict=accept jump=- comment=- +NFT_RULE_RELEVANT_COUNT=8 +DROP_BASE_COUNT=1 +DROP_BASE_00=family=inet table=filter chain=input ssh_accept_handles=8 port443_accept_handles=NONE terminal_drop_handles=NONE jumps=NONE +NFT_CONFIG_CTX_00=/etc/nftables.conf:5:type filter hook input priority filter; policy drop; +NFT_CONFIG_CTX_01=/etc/nftables.conf:10:tcp dport 22 accept +NFT_CONFIG_CTX_02=/etc/nftables.conf:11:udp dport 51822 accept +NFT_CONFIG_CTX_03=/etc/nftables.conf:14:type filter hook forward priority filter; policy drop; +NFT_CONFIG_CONTEXT_COUNT=4 +FIREWALL_WRITER_FILE_COUNT=0 +FIREWALL_MUTATION_PATH_PROVEN=True +AUDIT_REMOTE=END +TASK_COMPLETE=true +TASK_RESULT=MOLDOVA_FIREWALL_PATH_EVIDENCE_COLLECTED +NO_MUTATION=true +HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null} + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index 0e83e0f5..a0f85a9c 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,19 +1,19 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R1", + "command_id": "SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2", "status": "OK", "rc": 0, "host": "pve01", "mode": "read-only", "component": "netbird-moldova-firewall-path-rca-readonly", - "started_at_utc": "2026-09-19T12:08:36Z", - "finished_at_utc": "2026-09-19T12:08:36Z", + "started_at_utc": "2026-09-19T12:11:27Z", + "finished_at_utc": "2026-09-19T12:11:28Z", "reference_register_checked": true, "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66", "error_register_checked": true, "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0", - "command_sha256": "5f1e44dc3cf366bab26e54cea8bcc3463f8b592bcd1f9c536ec24be093448e18", + "command_sha256": "b71cc94cbc71e9bbd2e51cbfc989c47a106bd17d04ede98ea5a97c741020ea2a", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, @@ -30,9 +30,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "10812203d21f2800bff16841b6efabc3aa19147ecfa07567b619df3b86fba0d8", - "sanitized_output_sha256": "10812203d21f2800bff16841b6efabc3aa19147ecfa07567b619df3b86fba0d8", + "raw_evidence_sha256": "f3cfe4d8536ad376981cf875f37f2d61735ede8cefb46ee68dc9884d1aac198d", + "sanitized_output_sha256": "f3cfe4d8536ad376981cf875f37f2d61735ede8cefb46ee68dc9884d1aac198d", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "AUDIT_REMOTE=BEGIN\nSUDO_N=False\nDEFAULT_ROUTE_DEVS=vmbr0\nNFTABLES_ACTIVE=inactive\nNFTABLES_ENABLED=disabled\nFIREWALLD_ACTIVE=inactive\nNETFILTER_PERSISTENT_ACTIVE=inactive\nNFTABLES_SYSTEMD_SHOW=ExecStart={ path=/usr/sbin/nft ; argv[]=/usr/sbin/nft -f /etc/nftables.conf ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } FragmentPath=/usr/lib/systemd/system/nftables.service\nNFTABLES_CONF_PRESENT=True\nNFTABLES_CONF_SHA256=60dac93ffe0ea440fc4a8941a080b6fb8d2c8655d47baf856e97182a0d1ca29a\nNFTABLES_CONF_CHECK_RC=999\nNFT_CONFIG_FILE_COUNT=1\nNFT_CONFIG_FILE_00=/etc/nftables.conf|60dac93ffe0ea440fc4a8941a080b6fb8d2c8655d47baf856e97182a0d1ca29a\nNFT_JSON_RC=999\nNFT_CONFIG_CTX_00=/etc/nftables.conf:7:type filter hook input priority filter;\nNFT_CONFIG_CONTEXT_COUNT=1\nFIREWALL_MUTATION_PATH_PROVEN=False\nAUDIT_REMOTE=END\n" + "output": "PVE1_OPERATOR_KEY_MATCH=True\nMOLDOVA_KNOWNHOST_MATCH=True\nMOLDOVA_SSH_RC=0\nAUDIT_REMOTE=BEGIN\nHOSTNAME=relay\nUID=1000\nUSER=ops\nGROUPS=ops sudo\nSUDO_N=True\nIDENTITY_REMOTE_OK=True\nDEFAULT_ROUTE_DEVS=eth0\nNFTABLES_ACTIVE=active\nNFTABLES_ENABLED=enabled\nFIREWALLD_ACTIVE=inactive\nNETFILTER_PERSISTENT_ACTIVE=inactive\nNETBIRD_ACTIVE=active\nNFTABLES_SYSTEMD_SHOW=ExecStart={ path=/usr/sbin/nft ; argv[]=/usr/sbin/nft -f /etc/nftables.conf ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } FragmentPath=/lib/systemd/system/nftables.service\nNETBIRD_SYSTEMD_SHOW=ExecStart={ path=/usr/bin/netbird ; argv[]=/usr/bin/netbird service run --log-level info --daemon-addr unix:///var/run/netbird.sock --log-file /var/log/netbird/client.log ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } FragmentPath=/etc/systemd/system/netbird.service\nNFTABLES_CONF_PRESENT=True\nNFTABLES_CONF_SHA256=dbde07925ede154b7d584f6401166c4c044aa7bd4375afe7b558cba68cef9472\nNFTABLES_CONF_CHECK_RC=0\nNFT_CONFIG_FILE_COUNT=1\nNFT_CONFIG_FILE_00=/etc/nftables.conf|dbde07925ede154b7d584f6401166c4c044aa7bd4375afe7b558cba68cef9472\nNFT_JSON_RC=0\nINPUT_BASE_CHAIN_COUNT=3\nINPUT_BASE_00=family=inet table=filter chain=input type=filter priority=0 policy=drop\nINPUT_BASE_01=family=ip table=netbird chain=netbird-acl-input-filter type=filter priority=0 policy=accept\nINPUT_BASE_02=family=ip6 table=netbird chain=netbird-acl-input-filter type=filter priority=0 policy=accept\nINPUT_REACHABLE_CHAIN_COUNT=5\nNFT_RULE_00=family=inet table=filter chain=input handle=5 dports=- iif=- ct=established,related verdict=accept jump=- comment=-\nNFT_RULE_01=family=inet table=filter chain=input handle=8 dports=22 iif=- ct=- verdict=accept jump=- comment=-\nNFT_RULE_02=family=ip table=netbird chain=netbird-acl-input-filter handle=16 dports=- iif=wt0 ct=- verdict=- jump=jump:netbird-acl-input-rules comment=-\nNFT_RULE_03=family=ip table=netbird chain=netbird-acl-input-filter handle=17 dports=- iif=wt0 ct=- verdict=drop jump=- comment=-\nNFT_RULE_04=family=ip table=netbird chain=netbird-acl-input-rules handle=14 dports=- iif=- ct=established,related verdict=accept jump=- comment=-\nNFT_RULE_05=family=ip6 table=netbird chain=netbird-acl-input-filter handle=16 dports=- iif=wt0 ct=- verdict=- jump=jump:netbird-acl-input-rules comment=-\nNFT_RULE_06=family=ip6 table=netbird chain=netbird-acl-input-filter handle=17 dports=- iif=wt0 ct=- verdict=drop jump=- comment=-\nNFT_RULE_07=family=ip6 table=netbird chain=netbird-acl-input-rules handle=14 dports=- iif=- ct=established,related verdict=accept jump=- comment=-\nNFT_RULE_RELEVANT_COUNT=8\nDROP_BASE_COUNT=1\nDROP_BASE_00=family=inet table=filter chain=input ssh_accept_handles=8 port443_accept_handles=NONE terminal_drop_handles=NONE jumps=NONE\nNFT_CONFIG_CTX_00=/etc/nftables.conf:5:type filter hook input priority filter; policy drop;\nNFT_CONFIG_CTX_01=/etc/nftables.conf:10:tcp dport 22 accept\nNFT_CONFIG_CTX_02=/etc/nftables.conf:11:udp dport 51822 accept\nNFT_CONFIG_CTX_03=/etc/nftables.conf:14:type filter hook forward priority filter; policy drop;\nNFT_CONFIG_CONTEXT_COUNT=4\nFIREWALL_WRITER_FILE_COUNT=0\nFIREWALL_MUTATION_PATH_PROVEN=True\nAUDIT_REMOTE=END\nTASK_COMPLETE=true\nTASK_RESULT=MOLDOVA_FIREWALL_PATH_EVIDENCE_COLLECTED\nNO_MUTATION=true\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index 34f779cb..1a2c2689 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,5 +1,5 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R1 +COMMAND_ID=SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2 STATUS=OK RC=0 HOST=pve01 @@ -9,7 +9,7 @@ REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66 ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0 -COMMAND_SHA256=5f1e44dc3cf366bab26e54cea8bcc3463f8b592bcd1f9c536ec24be093448e18 +COMMAND_SHA256=b71cc94cbc71e9bbd2e51cbfc989c47a106bd17d04ede98ea5a97c741020ea2a DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true CHANGE_DECLARED=false @@ -24,27 +24,61 @@ MUTATION_OUTCOME=NO_MUTATION SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=10812203d21f2800bff16841b6efabc3aa19147ecfa07567b619df3b86fba0d8 -SANITIZED_OUTPUT_SHA256=10812203d21f2800bff16841b6efabc3aa19147ecfa07567b619df3b86fba0d8 +RAW_EVIDENCE_SHA256=f3cfe4d8536ad376981cf875f37f2d61735ede8cefb46ee68dc9884d1aac198d +SANITIZED_OUTPUT_SHA256=f3cfe4d8536ad376981cf875f37f2d61735ede8cefb46ee68dc9884d1aac198d OUTPUT_BEGIN +PVE1_OPERATOR_KEY_MATCH=True +MOLDOVA_KNOWNHOST_MATCH=True +MOLDOVA_SSH_RC=0 AUDIT_REMOTE=BEGIN -SUDO_N=False -DEFAULT_ROUTE_DEVS=vmbr0 -NFTABLES_ACTIVE=inactive -NFTABLES_ENABLED=disabled +HOSTNAME=relay +UID=1000 +USER=ops +GROUPS=ops sudo +SUDO_N=True +IDENTITY_REMOTE_OK=True +DEFAULT_ROUTE_DEVS=eth0 +NFTABLES_ACTIVE=active +NFTABLES_ENABLED=enabled FIREWALLD_ACTIVE=inactive NETFILTER_PERSISTENT_ACTIVE=inactive -NFTABLES_SYSTEMD_SHOW=ExecStart={ path=/usr/sbin/nft ; argv[]=/usr/sbin/nft -f /etc/nftables.conf ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } FragmentPath=/usr/lib/systemd/system/nftables.service +NETBIRD_ACTIVE=active +NFTABLES_SYSTEMD_SHOW=ExecStart={ path=/usr/sbin/nft ; argv[]=/usr/sbin/nft -f /etc/nftables.conf ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } FragmentPath=/lib/systemd/system/nftables.service +NETBIRD_SYSTEMD_SHOW=ExecStart={ path=/usr/bin/netbird ; argv[]=/usr/bin/netbird service run --log-level info --daemon-addr unix:///var/run/netbird.sock --log-file /var/log/netbird/client.log ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } FragmentPath=/etc/systemd/system/netbird.service NFTABLES_CONF_PRESENT=True -NFTABLES_CONF_SHA256=60dac93ffe0ea440fc4a8941a080b6fb8d2c8655d47baf856e97182a0d1ca29a -NFTABLES_CONF_CHECK_RC=999 +NFTABLES_CONF_SHA256=dbde07925ede154b7d584f6401166c4c044aa7bd4375afe7b558cba68cef9472 +NFTABLES_CONF_CHECK_RC=0 NFT_CONFIG_FILE_COUNT=1 -NFT_CONFIG_FILE_00=/etc/nftables.conf|60dac93ffe0ea440fc4a8941a080b6fb8d2c8655d47baf856e97182a0d1ca29a -NFT_JSON_RC=999 -NFT_CONFIG_CTX_00=/etc/nftables.conf:7:type filter hook input priority filter; -NFT_CONFIG_CONTEXT_COUNT=1 -FIREWALL_MUTATION_PATH_PROVEN=False +NFT_CONFIG_FILE_00=/etc/nftables.conf|dbde07925ede154b7d584f6401166c4c044aa7bd4375afe7b558cba68cef9472 +NFT_JSON_RC=0 +INPUT_BASE_CHAIN_COUNT=3 +INPUT_BASE_00=family=inet table=filter chain=input type=filter priority=0 policy=drop +INPUT_BASE_01=family=ip table=netbird chain=netbird-acl-input-filter type=filter priority=0 policy=accept +INPUT_BASE_02=family=ip6 table=netbird chain=netbird-acl-input-filter type=filter priority=0 policy=accept +INPUT_REACHABLE_CHAIN_COUNT=5 +NFT_RULE_00=family=inet table=filter chain=input handle=5 dports=- iif=- ct=established,related verdict=accept jump=- comment=- +NFT_RULE_01=family=inet table=filter chain=input handle=8 dports=22 iif=- ct=- verdict=accept jump=- comment=- +NFT_RULE_02=family=ip table=netbird chain=netbird-acl-input-filter handle=16 dports=- iif=wt0 ct=- verdict=- jump=jump:netbird-acl-input-rules comment=- +NFT_RULE_03=family=ip table=netbird chain=netbird-acl-input-filter handle=17 dports=- iif=wt0 ct=- verdict=drop jump=- comment=- +NFT_RULE_04=family=ip table=netbird chain=netbird-acl-input-rules handle=14 dports=- iif=- ct=established,related verdict=accept jump=- comment=- +NFT_RULE_05=family=ip6 table=netbird chain=netbird-acl-input-filter handle=16 dports=- iif=wt0 ct=- verdict=- jump=jump:netbird-acl-input-rules comment=- +NFT_RULE_06=family=ip6 table=netbird chain=netbird-acl-input-filter handle=17 dports=- iif=wt0 ct=- verdict=drop jump=- comment=- +NFT_RULE_07=family=ip6 table=netbird chain=netbird-acl-input-rules handle=14 dports=- iif=- ct=established,related verdict=accept jump=- comment=- +NFT_RULE_RELEVANT_COUNT=8 +DROP_BASE_COUNT=1 +DROP_BASE_00=family=inet table=filter chain=input ssh_accept_handles=8 port443_accept_handles=NONE terminal_drop_handles=NONE jumps=NONE +NFT_CONFIG_CTX_00=/etc/nftables.conf:5:type filter hook input priority filter; policy drop; +NFT_CONFIG_CTX_01=/etc/nftables.conf:10:tcp dport 22 accept +NFT_CONFIG_CTX_02=/etc/nftables.conf:11:udp dport 51822 accept +NFT_CONFIG_CTX_03=/etc/nftables.conf:14:type filter hook forward priority filter; policy drop; +NFT_CONFIG_CONTEXT_COUNT=4 +FIREWALL_WRITER_FILE_COUNT=0 +FIREWALL_MUTATION_PATH_PROVEN=True AUDIT_REMOTE=END +TASK_COMPLETE=true +TASK_RESULT=MOLDOVA_FIREWALL_PATH_EVIDENCE_COLLECTED +NO_MUTATION=true +HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null} OUTPUT_END CHAT_OUTPUT_END