homelab-admin/homelab-public-context
1
0
Fork 0
Code Activity
Files
63693b52f086edb88050f85af0923b980e2c5afe
homelab-public-context/runtime/latest.json
T
homelab-runtime-publisher 63693b52f0 runtime: publish NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42
2026-09-08 18:19:53 +00:00

39 lines
23 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"schema_version": 1,
"channel": "homelab-runtime",
"command_id": "NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-TOPOLOGY-RCA42",
"status": "OK",
"rc": 0,
"host": "pve01",
"mode": "read-only",
"component": "newfi-stagingedge-public-ingress-topology-rca-v6",
"started_at_utc": "2026-09-08T18:19:52Z",
"finished_at_utc": "2026-09-08T18:19:52Z",
"reference_register_checked": true,
"reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
"error_register_checked": true,
"error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
"command_sha256": "8c1deae24d2c2e50bd7eca16ab18b10c78eb623b43884a033be8abcb060328de",
"duplicate_failed_command_blocked": false,
"block_reason": null,
"execution_started": true,
"change_declared": false,
"result_contract_valid": true,
"result_contract_status": null,
"result_contract_error": null,
"command_rc": 0,
"changes_made": false,
"rollback_started": false,
"rollback_restored": null,
"mutation_outcome": "NO_MUTATION",
"sanitized": true,
"secrets_included": false,
"private_addresses_included": false,
"raw_evidence_retained_locally": true,
"raw_evidence_sha256": "475297be47aae03d0ef913ed8d3c90d3f0eabe4b0a86b02e6cccd5e805171e4f",
"sanitized_output_sha256": "2740dbcc0eb7d919991be01db110d70f85f1c7ab59bcebf520b56960fa9399f9",
"output_truncated_in_json": false,
"full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
"output": "ERROR_REGISTER_CHECK=OK\nREFERENCE_CHECK=OK\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\nNEWFI42_RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\nNEWFI42_KNOWN_HOSTS_SHA256_BEFORE=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI42_TRUST_FILE_PRESENT=true\nNEWFI42_TRUST_FILE_SHA256=5ff80132df401240519f48091ed62c139183c325000ef7dd253e7f676a539b2c\nNEWFI42_TRUST_EDGEVM_MARKER=true\nNEWFI42_TRUST_REJECTED_MARKER=false\nNEWFI42_ERROR_RELEVANT_LINE_COUNT=50\nNEWFI42_ERROR_RELEVANT_LINES=[{\"line\":19,\"text\":\"CHECK-8: для edge-vm использовать debian@[PRIVATE_IP] и sudo.\"},{\"line\":28,\"text\":\"VM130 edge-vm has secondary disk backup=0 risk.\"},{\"line\":52,\"text\":\"edge-vm: ssh debian@[PRIVATE_IP], внутри использовать sudo.\"},{\"line\":170,\"text\":\"41. Ошибка: post-backup-pass-slo-reconciliation checked pve01 router health on edge-vm.\"},{\"line\":171,\"text\":\"Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm.\"},{\"line\":172,\"text\":\"Fix: build reconciliation from pve01 and edge-vm health files by correct owner.\"},{\"line\":213,\"text\":\"## ROUTER_CLI_STDIN_APPLY_FAILURE_20260630\"},{\"line\":214,\"text\":\"- Context: attempted Netcraze router ACL apply through SSH stdin/multiline for Homepage Moscow Router monitor fix.\"},{\"line\":215,\"text\":\"- Evidence: [LONG_REDACTED].txt.\"},{\"line\":219,\"text\":\"## [LONG_REDACTED]\"},{\"line\":221,\"text\":\"- Evidence: [LONG_REDACTED].txt showed COMMAND_COUNT=1.\"},{\"line\":224,\"text\":\"## [LONG_REDACTED]\"},{\"line\":225,\"text\":\"- Context: routerbackup user can run show running-config but cannot execute configuration commands such as access-list.\"},{\"line\":226,\"text\":\"- Evidence: [LONG_REDACTED].txt.\"},{\"line\":228,\"text\":\"- Rule: do not attempt ACL/config changes as routerbackup; use admin/operator router access or router Web UI for write changes.\"},{\"line\":232,\"text\":\"- Evidence: [LONG_REDACTED].txt has blank [LONG_REDACTED] fields.\"},{\"line\":235,\"text\":\"## [LONG_REDACTED]\"},{\"line\":236,\"text\":\"- Context: while moving Moscow Router monitor rules to _WEBADMIN_Bridge1, two _WEBADMIN_Bridge0 Nextcloud Talk TURN rules were accidentally removed.\"},{\"line\":238,\"text\":\"- Verification proof: 399_ROUTER_ACL_RESTORE_AFTER_UI_PROOF.txt.\"},{\"line\":239,\"text\":\"- Rule: after manual router Web UI ACL edits, compare _WEBADMIN_Bridge0, _WEBADMIN_Bridge1 and _WEBADMIN_GigabitEthernet1 before continuing.\"},{\"line\":241,\"text\":\"## [LONG_REDACTED]\"},{\"line\":242,\"text\":\"- Context: proof 400 tested Moscow router HTTPS monitor from Homepage container with custom Node lookup callback.\"},{\"line\":247,\"text\":\"## [LONG_REDACTED]\"},{\"line\":248,\"text\":\"- Context: Moscow Router Homepage monitor after ACL fix.\"},{\"line\":250,\"text\":\"- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths.\"},{\"line\":251,\"text\":\"- Impact: Homepage siteMonitor cannot be made green via direct router HTTP URL until router web service allows the Bridge1/Proxmox/protected segment or an explicit safe monitor endpoint is used.\"},{\"line\":255,\"text\":\"- Context: installing edge-vm Moscow router health endpoint.\"},{\"line\":261,\"text\":\"## [LONG_REDACTED]\"},{\"line\":262,\"text\":\"- Context: Moscow Router Homepage siteMonitor attempt using http://[PRIVATE_IP]:5080.\"},{\"line\":264,\"text\":\"- Impact: do not use [PRIVATE_IP] directly as Homepage siteMonitor from edge-vm.\"},{\"line\":265,\"text\":\"- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage.\"},{\"line\":267,\"text\":\"## [LONG_REDACTED]\"},{\"line\":268,\"text\":\"- Context: applying Moscow Router Homepage siteMonitor health endpoint.\"},{\"line\":273,\"text\":\"## [LONG_REDACTED]\"},{\"line\":274,\"text\":\"- Context: applying Moscow Router Homepage health endpoint.\"},{\"line\":276,\"text\":\"- Evidence: proof 408 showed SyntaxError in /tmp/homepage-router-moscow-apply-fixed.py.\"},{\"line\":582,\"text\":\"- Context: pvepro.ru root/www currently point to the Mailcow VPS and return Mailcow with TLS hostname mismatch.\"},{\"line\":583,\"text\":\"- Decision: because pve01 has no SSH key access to the external VPS, do not modify the VPS. Instead move only pvepro.ru and www.pvepro.ru A records to edge and serve an edge landing page.\"},{\"line\":598,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":599,\"text\":\"- Current limitation: there is no safe private remote access path to the dacha router yet.\"},{\"line\":600,\"text\":\"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet.\"},{\"line\":604,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":605,\"text\":\"- Current limitation: there is no safe private remote access path to the dacha router yet.\"},{\"line\":606,\"text\":\"- Rule: do not expose router admin publicly and do not attempt certificate deployment to the router over the public internet.\"},{\"line\":610,\"text\":\"- Context: configuring private management path for taftauto.ru dacha router.\"},{\"line\":612,\"text\":\"- Rule: generated client config may be stored only as root/debian mode 600 file and must be imported into the Netcraze router UI manually.\"},{\"line\":613,\"text\":\"- Rule: do not open router public admin or certificate deployment until WireGuard handshake is proven.\"},{\"line\":626,\"text\":\"- Fix: rebuild SmartApe under External Homelabs with 2-space item indentation, remove Router Moscow, rebuild Sites category.\"},{\"line\":647,\"text\":\"## [LONG_REDACTED]\"},{\"line\":648,\"text\":\"- Previous apply looked for Russian Router card name, but active Homepage Useful group contains Router and Public Domain.\"}]\nNEWFI42_REFERENCE_RELEVANT_LINE_COUNT=50\nNEWFI42_REFERENCE_RELEVANT_LINES=[{\"line\":14,\"text\":\"- VM130 edge-vm | pve03 | running | KEEP\"},{\"line\":75,\"text\":\"NOTE edge-vm disk scsi1 backup=0 risk must be documented\"},{\"line\":90,\"text\":\"HEALTH_NOT_OK item=ingress-dns-route-slo.txt line=STATUS=WARN\"},{\"line\":149,\"text\":\"- У VM130 edge-vm есть риск: дополнительный диск backup=0.\"},{\"line\":166,\"text\":\"- VM130 edge-vm pve03 [PRIVATE_IP] Docker ingress/app host.\"},{\"line\":199,\"text\":\"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630\"},{\"line\":234,\"text\":\"- WAN DHCP observed in router log: 95.84.154.183/23, gateway 95.84.154.1.\"},{\"line\":235,\"text\":\"- ISP DNS observed in router log: 77.37.251.33, 77.37.255.30.\"},{\"line\":282,\"text\":\"- Default router: [PRIVATE_IP].\"},{\"line\":312,\"text\":\"- [PRIVATE_IP] -> bc:24:11:e1:f3:3c NPMplus / edge-vm.\"},{\"line\":315,\"text\":\"### NAT / port forwarding\"},{\"line\":324,\"text\":\"- _WEBADMIN_GigabitEthernet1 permits admin PC [PRIVATE_IP] outbound TCP 80/443.\"},{\"line\":327,\"text\":\"### Router management\"},{\"line\":333,\"text\":\"- Telnet port configured: 2323, security-level private; router log shows Telnet disabled later on 2026-06-26.\"},{\"line\":339,\"text\":\"### Router services\"},{\"line\":354,\"text\":\"### Router automation warning\"},{\"line\":357,\"text\":\"- Automation must use router CLI syntax, not bash syntax.\"},{\"line\":366,\"text\":\"- edge-vm: no UPS/NUT/APCUPSD integration discovered.\"},{\"line\":371,\"text\":\"- NetBird service is active on pve01, pve02, pve03 and edge-vm.\"},{\"line\":376,\"text\":\"- edge-vm: FQDN edge-vm.netbird.selfhosted, IPv4 100.100.60.182/16.\"},{\"line\":395,\"text\":\"- edge-vm owns most application health, dashboard, ingress, backup, NetBox, NPMplus, certificate, Trivy and vulnerability jobs.\"},{\"line\":396,\"text\":\"- pve01 owns many [LONG_REDACTED] VPS/rclone/sops/scrutiny jobs.\"},{\"line\":455,\"text\":\"- edge-vm timers cover runtime dashboard, Paperless guard, external canary, health metrics, restore drill index, AdGuard rewrite sync, NPMplus cert expiry, NetBox backup/sync, retention, cluster daily status, vulnerability and Trivy scans, ingress hardening an\"},{\"line\":456,\"text\":\"- pve01 timers cover VPN/NetBird health, health metrics, smartctl, disk space, MkDocs refresh, VPS identity audit, storage capacity, quality gate, evidence catalog, backup freshness, docker health, Filebrowser backup/offhost/restore, NPMplus/Kuma backup, NetBi\"},{\"line\":459,\"text\":\"- Script hashes were captured for /usr/local/sbin and /usr/local/bin on edge-vm, pve01, pve02 and pve03.\"},{\"line\":531,\"text\":\"- Main active workload: VM130 edge-vm.\"},{\"line\":545,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":560,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":575,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":590,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":597,\"text\":\"### VM130 edge-vm\"},{\"line\":600,\"text\":\"- Name: edge-vm.\"},{\"line\":608,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":626,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":643,\"text\":\"- Network: vmbr0, gateway [PRIVATE_IP].\"},{\"line\":653,\"text\":\"## [LONG_REDACTED]\"},{\"line\":672,\"text\":\"- git.gram1.ru -> [PRIVATE_IP].\"},{\"line\":682,\"text\":\"### Router ingress\"},{\"line\":683,\"text\":\"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP].\"},{\"line\":684,\"text\":\"- Router forwards TCP/UDP 3478 to Nextcloud Talk TURN on [PRIVATE_IP].\"},{\"line\":685,\"text\":\"- Router forwards Home TCP/51820 to WireGuard host [PRIVATE_IP].\"},{\"line\":686,\"text\":\"- NPMplus admin listener is bound to localhost on edge-vm, [PRIVATE_IP]:81; public disabled legacy host npm.gram1.ru exists but enabled=0.\"},{\"line\":689,\"text\":\"- Host: edge-vm, [PRIVATE_IP].\"},{\"line\":694,\"text\":\"- Public listen ports on edge-vm: [PRIVATE_IP]:80 and [PRIVATE_IP]:443 by nginx/NPMplus.\"},{\"line\":705,\"text\":\"- git.gram1.ru -> http://[PRIVATE_IP]:3002, cert=29, ssl_forced=1, enabled=1.\"},{\"line\":754,\"text\":\"- cert=29: git.gram1.ru, expires 2026-09-13 17:36:55.\"},{\"line\":762,\"text\":\"- NPMplus schema/listen inventory: [LONG_REDACTED].txt.\"},{\"line\":769,\"text\":\"- Host: edge-vm, IP [PRIVATE_IP].\"},{\"line\":774,\"text\":\"- Public ingress terminates through NPMplus on ports 80/443.\"},{\"line\":826,\"text\":\"- Ingress/security: npmplus, socket-proxy, crowdsec.\"}]\nNEWFI42_TRUST_RELEVANT_LINE_COUNT=37\nNEWFI42_TRUST_RELEVANT_LINES=[{\"line\":1,\"text\":\"# NetBird VPS trust readiness\"},{\"line\":14,\"text\":\"public_ip=188.127.235.6\"},{\"line\":21,\"text\":\"netbird_vps_backup_ok=1\"},{\"line\":22,\"text\":\"netbird_vps_offhost_ok=1\"},{\"line\":23,\"text\":\"netbird_vps_restore_ok=1\"},{\"line\":27,\"text\":\"- Do not use public IP 188.127.235.6 until its host-key mismatch is intentionally resolved.\"},{\"line\":37,\"text\":\"--- HOST=188.127.235.6\"},{\"line\":39,\"text\":\"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|/0oIfigkDxhJFJWj72WrkRkYUqo=|29qT4RhgqPPXt3sOwBqw7QrafBY= (ECDSA)\"},{\"line\":40,\"text\":\"KNOWN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] |1|Hmbhg2wXCUS/SDiuLTTgk6Vxhns=|kw5S70w76UhROmk1XT92s4Z757Y= (RSA)\"},{\"line\":41,\"text\":\"KNOWN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] |1|q70vtOfl5nR+CvnLuV7OQ3aEFIo=|OJi44TxJaz3cfw57HO19UEkZc/M= (ED25519)\"},{\"line\":43,\"text\":\"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ED25519)\"},{\"line\":44,\"text\":\"KEYSCAN_FP host=188.127.235.6 3072 SHA256:[LONG_REDACTED] 188.127.235.6 (RSA)\"},{\"line\":45,\"text\":\"KEYSCAN_FP host=188.127.235.6 256 SHA256:[LONG_REDACTED] 188.127.235.6 (ECDSA)\"},{\"line\":63,\"text\":\"REMOTE_HOSTNAME=edge-vm\"},{\"line\":71,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)\"},{\"line\":72,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)\"},{\"line\":73,\"text\":\"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)\"},{\"line\":77,\"text\":\"REMOTE_HOSTNAME=edge-vm\"},{\"line\":85,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ED25519)\"},{\"line\":86,\"text\":\"256 SHA256:[LONG_REDACTED] root@edge-vm (ECDSA)\"},{\"line\":87,\"text\":\"3072 SHA256:[LONG_REDACTED] root@edge-vm (RSA)\"},{\"line\":102,\"text\":\"PUBLIC_STRICT ssh-keygen -f '[SENSITIVE_PATH] -R '188.127.235.6'\"},{\"line\":103,\"text\":\"PUBLIC_STRICT Host key for 188.127.235.6 has changed and you have requested strict checking.\"},{\"line\":107,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":108,\"text\":\"STATUS=OK TS=2026-07-07T15:15:14Z TYPE=external-probe-vps BAD=0 WARN=0 MODE=STRATEGY_ONLY DEPLOYED=NO [LONG_REDACTED] [LONG_REDACTED] BACKUP_HOSTKEYS=no PVE01_PUBLIC_SMOKE_BAD=0 INDEPENDENT_RUNNER=missing [LONG_REDACTED].md\"},{\"line\":109,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":111,\"text\":\"SERVICE=netbird-vps-backup\"},{\"line\":113,\"text\":\"VPS_IP=188.127.235.6\"},{\"line\":114,\"text\":\"[LONG_REDACTED]\"},{\"line\":115,\"text\":\"[LONG_REDACTED]\"},{\"line\":119,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":121,\"text\":\"SERVICE=netbird-vps-offhost\"},{\"line\":124,\"text\":\"[LONG_REDACTED]\"},{\"line\":129,\"text\":\"--- [LONG_REDACTED].txt\"},{\"line\":131,\"text\":\"SERVICE=netbird-vps-restore-validation\"},{\"line\":134,\"text\":\"[LONG_REDACTED].tgz\"},{\"line\":153,\"text\":\"edge-vm service=active/enabled wt0_ip=100.100.60.182/16 management=yes signal=yes peers=6/9 Connected\"}]\nNEWFI42_TEXT_FILES_SCANNED=336\nNEWFI42_TOPOLOGY_MATCH_FILE_COUNT=50\nNEWFI42_TOPOLOGY_MATCH_FILES_TRUNCATED=false\nNEWFI42_TOPOLOGY_MATCH_FILES=[{\"path\":\"/etc/pve/.rrd\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md.bak-corrected-20260630T185336Z\",\"tags\":[\"ROUTER\"]},{\"path\":\"/etc/pve/HOMELAB_FULL_HANDOFF_HISTORICAL_2026-07-09.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMEPAGE_BACKUP_COVERAGE_MATRIX.md\",\"tags\":[\"ROUTER\"]},{\"path\":\"/etc/pve/31_HOMELAB_REFERENCE.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-router-cli-20260630T215229Z\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/etc/pve/HOMELAB_FULL_HANDOFF_CURRENT.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak.20260721T112115Z\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_CLUSTER_BACKLOG.md\",\"tags\":[\"EDGE_VM\",\"ROUTER\"]},{\"path\":\"/etc/pve/HOMEPAGE_BACKUP_GAP_CLASSIFICATION.md\",\"tags\":[\"ROUTER\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"STAGING_HOST\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md.bak-proof-repair-20260630T215529Z\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/etc/pve/priv/authorized_keys\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\"]},{\"path\":\"/etc/pve/nodes/pve03/qemu-server/130.conf\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/var/lib/homelab-netbird-vps-trust/closure-latest.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\",\"NAT_FORWARD\"]},{\"path\":\"/var/lib/homelab-netbird-vps-trust/latest.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\"]},{\"path\":\"/var/lib/homelab-netbird-vps-trust/clean-seal-latest.md\",\"tags\":[\"REJECTED_IP\",\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/observed/cluster-guests.json\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/observed/source-snapshots/dependency-map-latest.tsv\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/inventory/access-paths.json\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/changes/CR-2026-0081/home-forward-retire-package.sha256\",\"tags\":[\"PUBLIC_80_443\"]},{\"path\":\"/srv/homelab-ops/changes/CR-2026-0018/design.md\",\"tags\":[\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/changes/CR-2026-0080/task-package.sha256\",\"tags\":[\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-vm150-rebuild-v2/task.json\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-status\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/tasks/skladchik-reports-monitor-controlled-reauth-v1/assets/pve01/skladchik-reports-monitor-monthly-selftest-watch\",\"tags\":[\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/task.json\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/README.txt\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-home-restricted-ingress.nft\",\"tags\":[\"PUBLIC_IP\",\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-public-ingress.nft\",\"tags\":[\"PUBLIC_IP\",\"NAT_FORWARD\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"NAT_FORWARD\",\"ROUTER\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/README.txt\",\"tags\":[\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py\",\"tags\":[\"PUBLIC_IP\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/task.json\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/README.txt\",\"tags\":[\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/tools/retire_turn_dns.py\",\"tags\":[\"PUBLIC_IP\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-post-cutover-hardening-design.md\",\"tags\":[\"PUBLIC_IP\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-18-gitea-edge-publisher-v3-design-v1.1.md\",\"tags\":[\"NAT_FORWARD\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md\",\"tags\":[\"PUBLIC_IP\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-home-forward-retirement.md\",\"tags\":[\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-edge-cutover.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"PUBLIC_80_443\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-turn-legacy-dns-retirement.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/kb/AI_CONTEXT.md\",\"tags\":[\"PUBLIC_IP\",\"EDGE_VM\"]},{\"path\":\"/srv/homelab-ops/kb/inventory/guests.json\",\"tags\":[\"EDGE_VM\",\"NAT_FORWARD\",\"TUNNEL\"]},{\"path\":\"/srv/homelab-ops/kb/runbooks/03_EDGE_NGINX.md\",\"tags\":[\"PUBLIC_IP\"]},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0080_snikket_edge_cutover.py\",\"tags\":[\"PUBLIC_IP\",\"NAT_FORWARD\",\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0081_turn_dns_retire.py\",\"tags\":[\"ROUTER\"]},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0081_home_forward_retire.py\",\"tags\":[\"PUBLIC_IP\",\"ROUTER\"]}]\nNEWFI42_OPS_GIT_STATUS_RC=0\nNEWFI42_OPS_GIT_STATUS_SHA256=5fbcb2990ad25e368c12219bf3ddca36e464d044e7acac16696fa8cd54159185\nNEWFI42_OPS_GIT_HEAD_RC=0\nNEWFI42_OPS_GIT_HEAD=d5e2ef5639398a762283e47143c17b494f8ed579\nNEWFI42_NETWORK_RELATED_UNIT_QUERY_RC=0\nNEWFI42_NETWORK_RELATED_UNITS=[{\"unit\":\"\\u25cf\",\"load\":\"gssproxy.service\",\"active\":\"not-found\",\"sub\":\"inactive\"},{\"unit\":\"netbird-peers-health.service\",\"load\":\"loaded\",\"active\":\"inactive\",\"sub\":\"dead\"},{\"unit\":\"netbird.service\",\"load\":\"loaded\",\"active\":\"active\",\"sub\":\"running\"},{\"unit\":\"pveproxy.service\",\"load\":\"loaded\",\"active\":\"active\",\"sub\":\"running\"},{\"unit\":\"spiceproxy.service\",\"load\":\"loaded\",\"active\":\"active\",\"sub\":\"running\"},{\"unit\":\"systemd-ask-password-wall.service\",\"load\":\"loaded\",\"active\":\"inactive\",\"sub\":\"dead\"}]\nNEWFI42_NFT_QUERY_RC=0\nNEWFI42_NFT_RELEVANT_RULE_COUNT=0\nNEWFI42_NFT_RELEVANT_LOCATIONS=[]\nNEWFI42_ROUTE_TO_PUBLIC_IP_RC=0\nNEWFI42_ROUTE_TO_PUBLIC_IP={\"dev\":\"vmbr0\",\"gateway_present\":true,\"gateway_sha256\":\"4f9da1283166a1e9f4e6bc7dd240c76aef85772177f717f92abb6e8e2bb8de90\",\"prefsrc_sha256\":\"fb345731d21c612ed2cb13088c10fd26bac959c79a7634cb55e23ee6bfb428d9\"}\nNEWFI42_DNS_A={\"newfi-staging.gram1.ru\":{\"ips\":[\"185.225.35.6\"],\"sources\":[\"getent\",\"dig\"]},\"chat.gram1.ru\":{\"ips\":[\"[PRIVATE_IP]\"],\"sources\":[\"getent\",\"dig\"]},\"git.gram1.ru\":{\"ips\":[\"[PRIVATE_IP]\"],\"sources\":[\"getent\",\"dig\"]},\"newfi.ru\":{\"ips\":[\"185.225.35.6\"],\"sources\":[\"getent\",\"dig\"]}}\nNEWFI42_DNS_STAGE_SHARES_IP_WITH_CHAT=false\nNEWFI42_DNS_STAGE_SHARES_IP_WITH_GIT=false\nNEWFI42_AUTHORITY_FORWARDING_ASSERTION_PRESENT=true\nNEWFI42_LOCAL_FORWARDING_RELATED_FILE_EVIDENCE=true\nNEWFI42_EXPLICIT_PUBLIC_IP_CONFIG_REFERENCE=true\nNEWFI42_DECISION=PUBLIC_INGRESS_CONTROL_PLANE_REFERENCE_FOUND_REVIEW_EXACT_MATCHED_PATHS_BEFORE_FIX\nNEWFI42_KNOWN_HOSTS_SHA256_AFTER=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI42_KNOWN_HOSTS_UNCHANGED=true\nNEWFI42_CHANGES_MADE=false\nNEWFI42_MUTATION_SCOPE=NONE_READ_ONLY\nNEWFI42_RCA_EXECUTION=PASS\n"
}
View Git Blame Copy Permalink