CHAT_OUTPUT_BEGIN
COMMAND_ID=SUPPORT-260925-SKLADCHIK-USA-MIGRATION-AUTHORITY-MINIREAD-73276R1
STATUS=OK
RC=0
HOST=pve01
MODE=read-only
COMPONENT=skladchik-usa-migration-authority-miniread
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
COMMAND_SHA256=50e4c7308ff3d4c751750cc63eee7536aa985f884c94b84ffcc1180c5eb60b05
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=f9810e721990dfc12c47863f23a39ad78582eaaf2cf212ac359cfbff17121390
SANITIZED_OUTPUT_SHA256=f9810e721990dfc12c47863f23a39ad78582eaaf2cf212ac359cfbff17121390
OUTPUT_BEGIN
RCA_VERSION=73276_V1
MODE=read-only
MIGRATION_DOC_EXISTS=true
MIGRATION_DOC_SHA256=12fe079849346352315aac76fae82d00cbd17f88a3553270ca2c5f2749840552
RUNBOOK_EXISTS=true
RUNBOOK_SHA256=725e2068337b379ebdf47822d5871aa5f4d5ec5956546674b2cf55b3250fb7a3
MIGRATION_DOC_SHA_MATCH=true
RUNBOOK_SHA_MATCH=true
FILE_BEGIN=20_NETBIRD_USA_MIGRATION_2026-08-18.md
1:# NETBIRD USA MIGRATION — FINAL CURRENT RECORD
5:Old USA mail/NetBird VPS:
11:Host-level NetBird client left running for rollback/peer observation.
54:- [TOKEN_OR_KEY] startup
56:- Moldova synthetic check passes
57:- edge peer works
61:- `:9000/health` 503 in combined relay/server mode
70:- narrow TrustedPeers
71:- fix Traefik Compose network warning
FILE_END=20_NETBIRD_USA_MIGRATION_2026-08-18.md
FILE_BEGIN=04_NETBIRD_USA.md
1:# Runbook: NetBird USA
5:Do not use `/api/health` or combined `:9000/health` as generic readiness gates for this exact deployment; they were 404/503 and caused a false rollback. Use repeated Dashboard 200 + OIDC 200 + expected listeners + real client/peer connectivity.
14:7. retain migration key only until old USA is no longer needed.
FILE_END=04_NETBIRD_USA.md
FILE_BEGIN=771z_after_manual_netbird_egress_capi.sh
3:if ! test -s [TOKEN_OR_KEY].md || ! test -s [TOKEN_OR_KEY].md; then echo [TOKEN_OR_KEY]; exit 1; fi
8:PROOF="[TOKEN_OR_KEY]${TS}_PROOF.txt"
14:  echo "[TOKEN_OR_KEY]"
17:  echo "[TOKEN_OR_KEY]"
18:  echo "TARGETS=edge-vm:[IP] relay-moldova:[IP] mail-usa:[IP]"
67:    networks:
71:networks:
94:    networks:
98:networks:
180:    raise SystemExit("api.server block not found")
201:echo "PEERS_RELAY_MAIL_EDGE"
209:    for peer in data.get("peers",{}).get("details",[]):
210:        fqdn=peer.get("fqdn","")
211:        ip=peer.get("netbirdIp","")
212:        if ip in {"[IP]","[IP]","[IP]"} or any(x in fqdn for x in ["relay","mail","edge-vm"]):
213:            print("PEER", fqdn, ip, "status="+str(peer.get("status")), "handshake="+str(peer.get("lastWireguardHandshake")), "conn="+str(peer.get("connectionType")))
216:echo "RELAY_MAIL_CONNECTIVITY"
219:  ip route get "$ip" 2>&1 || true
224:echo "WG_ALLOWED_IPS_RELAY_MAIL"
226:  wg show wt0 allowed-ips 2>/dev/null | sed -E 's/^[A-Za-z0-9+\/=]{20,}/PEERKEY_REDACTED/' | grep -E '100\.100\.19\.1|100\.100\.147\.204|0\.0\.0\.0/0|100\.100\.0\.0/16' || echo [TOKEN_OR_KEY]
229:echo "[TOKEN_OR_KEY]"
239:  wait_lapi "CAPI_ROUTE_NOT_READY_SAFE" || true
240:  write_health "[TOKEN_OR_KEY]" "After manual NetBird setup, edge still cannot reach api.crowdsec.net; CrowdSec remains LAPI-only no-capi"
241:  echo "[TOKEN_OR_KEY]"
243:  exit 70
246:echo "[TOKEN_OR_KEY]"
247:cd "$STACK" || exit 71
248:mkdir -p "manual-backups/771z-$TS"
249:test -f config/config.yaml && cp -a config/config.yaml "manual-backups/771z-$TS/config.yaml.before" || true
250:test -f config/user.yaml && cp -a config/user.yaml "manual-backups/771z-$TS/user.yaml.before" || true
251:test -f [TOKEN_OR_KEY].yaml && mv [TOKEN_OR_KEY].yaml "manual-backups/771z-$TS/online_api_credentials.yaml.before" || true
257:  write_health "[TOKEN_OR_KEY]" "Direct CAPI route works, but compose CAPI enable failed"
258:  exit 72
262:wait_lapi "REGISTER_MODE" || exit 73
284:  write_health "[TOKEN_OR_KEY]" "Direct CAPI route works, but cscli capi register failed; restored no-capi"
287:  exit 74
290:stat -c 'ONLINE_CREDS path=%n mode=%a owner=%U group=%G size=%s' [TOKEN_OR_KEY].yaml || true
294:enable_capi_compose || exit 75
315:  write_health "[TOKEN_OR_KEY]" "CrowdSec CAPI registered and stable after manual NetBird egress via relay/mail"
318:  exit 0
326:exit 76
329:  echo "POST_ROUTE_SMOKE"
337:  echo [TOKEN_OR_KEY]
FILE_END=771z_after_manual_netbird_egress_capi.sh
AUTHORITY_CANONICAL_READY=true
DECISION=PASS_USA_MIGRATION_AUTHORITY_COLLECTED
NEXT_GATE=BUILD_USA_EGRESS_AND_LOCAL_STACK_REPAIR
TASK_RESULT=PASS_USA_MIGRATION_AUTHORITY_RCA
HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260925-SKLADCHIK-USA-MIGRATION-AUTHORITY-MINIREAD-73276R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}

OUTPUT_END
CHAT_OUTPUT_END