{
  "schema_version": 1,
  "channel": "homelab-runtime",
  "command_id": "SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2",
  "status": "OK",
  "rc": 0,
  "host": "pve01",
  "mode": "read-only",
  "component": "netbird-moldova-firewall-path-rca-readonly",
  "started_at_utc": "2026-09-19T12:11:27Z",
  "finished_at_utc": "2026-09-19T12:11:28Z",
  "reference_register_checked": true,
  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
  "error_register_checked": true,
  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
  "command_sha256": "b71cc94cbc71e9bbd2e51cbfc989c47a106bd17d04ede98ea5a97c741020ea2a",
  "duplicate_failed_command_blocked": false,
  "block_reason": null,
  "execution_started": true,
  "change_declared": false,
  "result_contract_valid": true,
  "result_contract_status": null,
  "result_contract_error": null,
  "command_rc": 0,
  "changes_made": false,
  "rollback_started": false,
  "rollback_restored": null,
  "mutation_outcome": "NO_MUTATION",
  "sanitized": true,
  "secrets_included": false,
  "private_addresses_included": false,
  "raw_evidence_retained_locally": true,
  "raw_evidence_sha256": "f3cfe4d8536ad376981cf875f37f2d61735ede8cefb46ee68dc9884d1aac198d",
  "sanitized_output_sha256": "f3cfe4d8536ad376981cf875f37f2d61735ede8cefb46ee68dc9884d1aac198d",
  "output_truncated_in_json": false,
  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
  "output": "PVE1_OPERATOR_KEY_MATCH=True\nMOLDOVA_KNOWNHOST_MATCH=True\nMOLDOVA_SSH_RC=0\nAUDIT_REMOTE=BEGIN\nHOSTNAME=relay\nUID=1000\nUSER=ops\nGROUPS=ops sudo\nSUDO_N=True\nIDENTITY_REMOTE_OK=True\nDEFAULT_ROUTE_DEVS=eth0\nNFTABLES_ACTIVE=active\nNFTABLES_ENABLED=enabled\nFIREWALLD_ACTIVE=inactive\nNETFILTER_PERSISTENT_ACTIVE=inactive\nNETBIRD_ACTIVE=active\nNFTABLES_SYSTEMD_SHOW=ExecStart={ path=/usr/sbin/nft ; argv[]=/usr/sbin/nft -f /etc/nftables.conf ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } FragmentPath=/lib/systemd/system/nftables.service\nNETBIRD_SYSTEMD_SHOW=ExecStart={ path=/usr/bin/netbird ; argv[]=/usr/bin/netbird service run --log-level info --daemon-addr unix:///var/run/netbird.sock --log-file /var/log/netbird/client.log ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } FragmentPath=/etc/systemd/system/netbird.service\nNFTABLES_CONF_PRESENT=True\nNFTABLES_CONF_SHA256=dbde07925ede154b7d584f6401166c4c044aa7bd4375afe7b558cba68cef9472\nNFTABLES_CONF_CHECK_RC=0\nNFT_CONFIG_FILE_COUNT=1\nNFT_CONFIG_FILE_00=/etc/nftables.conf|dbde07925ede154b7d584f6401166c4c044aa7bd4375afe7b558cba68cef9472\nNFT_JSON_RC=0\nINPUT_BASE_CHAIN_COUNT=3\nINPUT_BASE_00=family=inet table=filter chain=input type=filter priority=0 policy=drop\nINPUT_BASE_01=family=ip table=netbird chain=netbird-acl-input-filter type=filter priority=0 policy=accept\nINPUT_BASE_02=family=ip6 table=netbird chain=netbird-acl-input-filter type=filter priority=0 policy=accept\nINPUT_REACHABLE_CHAIN_COUNT=5\nNFT_RULE_00=family=inet table=filter chain=input handle=5 dports=- iif=- ct=established,related verdict=accept jump=- comment=-\nNFT_RULE_01=family=inet table=filter chain=input handle=8 dports=22 iif=- ct=- verdict=accept jump=- comment=-\nNFT_RULE_02=family=ip table=netbird chain=netbird-acl-input-filter handle=16 dports=- iif=wt0 ct=- verdict=- jump=jump:netbird-acl-input-rules comment=-\nNFT_RULE_03=family=ip table=netbird chain=netbird-acl-input-filter handle=17 dports=- iif=wt0 ct=- verdict=drop jump=- comment=-\nNFT_RULE_04=family=ip table=netbird chain=netbird-acl-input-rules handle=14 dports=- iif=- ct=established,related verdict=accept jump=- comment=-\nNFT_RULE_05=family=ip6 table=netbird chain=netbird-acl-input-filter handle=16 dports=- iif=wt0 ct=- verdict=- jump=jump:netbird-acl-input-rules comment=-\nNFT_RULE_06=family=ip6 table=netbird chain=netbird-acl-input-filter handle=17 dports=- iif=wt0 ct=- verdict=drop jump=- comment=-\nNFT_RULE_07=family=ip6 table=netbird chain=netbird-acl-input-rules handle=14 dports=- iif=- ct=established,related verdict=accept jump=- comment=-\nNFT_RULE_RELEVANT_COUNT=8\nDROP_BASE_COUNT=1\nDROP_BASE_00=family=inet table=filter chain=input ssh_accept_handles=8 port443_accept_handles=NONE terminal_drop_handles=NONE jumps=NONE\nNFT_CONFIG_CTX_00=/etc/nftables.conf:5:type filter hook input priority filter; policy drop;\nNFT_CONFIG_CTX_01=/etc/nftables.conf:10:tcp dport 22 accept\nNFT_CONFIG_CTX_02=/etc/nftables.conf:11:udp dport 51822 accept\nNFT_CONFIG_CTX_03=/etc/nftables.conf:14:type filter hook forward priority filter; policy drop;\nNFT_CONFIG_CONTEXT_COUNT=4\nFIREWALL_WRITER_FILE_COUNT=0\nFIREWALL_MUTATION_PATH_PROVEN=True\nAUDIT_REMOTE=END\nTASK_COMPLETE=true\nTASK_RESULT=MOLDOVA_FIREWALL_PATH_EVIDENCE_COLLECTED\nNO_MUTATION=true\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260919-NETBIRD-MOLDOVA-FIREWALL-PATH-RCA-READONLY-610R2\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n"
}