homelab-runtime-publisher
39 lines
5.7 KiB
JSON
39 lines
5.7 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"channel": "homelab-runtime",
|
|
"command_id": "SUPPORT-260925-SKLADCHIK-USA-MIGRATION-AUTHORITY-MINIREAD-73276R1",
|
|
"status": "OK",
|
|
"rc": 0,
|
|
"host": "pve01",
|
|
"mode": "read-only",
|
|
"component": "skladchik-usa-migration-authority-miniread",
|
|
"started_at_utc": "2026-09-25T18:31:29Z",
|
|
"finished_at_utc": "2026-09-25T18:31:29Z",
|
|
"reference_register_checked": true,
|
|
"reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
|
|
"error_register_checked": true,
|
|
"error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
|
|
"command_sha256": "50e4c7308ff3d4c751750cc63eee7536aa985f884c94b84ffcc1180c5eb60b05",
|
|
"duplicate_failed_command_blocked": false,
|
|
"block_reason": null,
|
|
"execution_started": true,
|
|
"change_declared": false,
|
|
"result_contract_valid": true,
|
|
"result_contract_status": null,
|
|
"result_contract_error": null,
|
|
"command_rc": 0,
|
|
"changes_made": false,
|
|
"rollback_started": false,
|
|
"rollback_restored": null,
|
|
"mutation_outcome": "NO_MUTATION",
|
|
"sanitized": true,
|
|
"secrets_included": false,
|
|
"private_addresses_included": false,
|
|
"raw_evidence_retained_locally": true,
|
|
"raw_evidence_sha256": "f9810e721990dfc12c47863f23a39ad78582eaaf2cf212ac359cfbff17121390",
|
|
"sanitized_output_sha256": "f9810e721990dfc12c47863f23a39ad78582eaaf2cf212ac359cfbff17121390",
|
|
"output_truncated_in_json": false,
|
|
"full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
|
|
"output": "RCA_VERSION=73276_V1\nMODE=read-only\nMIGRATION_DOC_EXISTS=true\nMIGRATION_DOC_SHA256=12fe079849346352315aac76fae82d00cbd17f88a3553270ca2c5f2749840552\nRUNBOOK_EXISTS=true\nRUNBOOK_SHA256=725e2068337b379ebdf47822d5871aa5f4d5ec5956546674b2cf55b3250fb7a3\nMIGRATION_DOC_SHA_MATCH=true\nRUNBOOK_SHA_MATCH=true\nFILE_BEGIN=20_NETBIRD_USA_MIGRATION_2026-08-18.md\n1:# NETBIRD USA MIGRATION — FINAL CURRENT RECORD\n5:Old USA mail/NetBird VPS:\n11:Host-level NetBird client left running for rollback/peer observation.\n54:- [TOKEN_OR_KEY] startup\n56:- Moldova synthetic check passes\n57:- edge peer works\n61:- `:9000/health` 503 in combined relay/server mode\n70:- narrow TrustedPeers\n71:- fix Traefik Compose network warning\nFILE_END=20_NETBIRD_USA_MIGRATION_2026-08-18.md\nFILE_BEGIN=04_NETBIRD_USA.md\n1:# Runbook: NetBird USA\n5:Do not use `/api/health` or combined `:9000/health` as generic readiness gates for this exact deployment; they were 404/503 and caused a false rollback. Use repeated Dashboard 200 + OIDC 200 + expected listeners + real client/peer connectivity.\n14:7. retain migration key only until old USA is no longer needed.\nFILE_END=04_NETBIRD_USA.md\nFILE_BEGIN=771z_after_manual_netbird_egress_capi.sh\n3:if ! test -s [TOKEN_OR_KEY].md || ! test -s [TOKEN_OR_KEY].md; then echo [TOKEN_OR_KEY]; exit 1; fi\n8:PROOF=\"[TOKEN_OR_KEY]${TS}_PROOF.txt\"\n14: echo \"[TOKEN_OR_KEY]\"\n17: echo \"[TOKEN_OR_KEY]\"\n18: echo \"TARGETS=edge-vm:[IP] relay-moldova:[IP] mail-usa:[IP]\"\n67: networks:\n71:networks:\n94: networks:\n98:networks:\n180: raise SystemExit(\"api.server block not found\")\n201:echo \"PEERS_RELAY_MAIL_EDGE\"\n209: for peer in data.get(\"peers\",{}).get(\"details\",[]):\n210: fqdn=peer.get(\"fqdn\",\"\")\n211: ip=peer.get(\"netbirdIp\",\"\")\n212: if ip in {\"[IP]\",\"[IP]\",\"[IP]\"} or any(x in fqdn for x in [\"relay\",\"mail\",\"edge-vm\"]):\n213: print(\"PEER\", fqdn, ip, \"status=\"+str(peer.get(\"status\")), \"handshake=\"+str(peer.get(\"lastWireguardHandshake\")), \"conn=\"+str(peer.get(\"connectionType\")))\n216:echo \"RELAY_MAIL_CONNECTIVITY\"\n219: ip route get \"$ip\" 2>&1 || true\n224:echo \"WG_ALLOWED_IPS_RELAY_MAIL\"\n226: wg show wt0 allowed-ips 2>/dev/null | sed -E 's/^[A-Za-z0-9+\\/=]{20,}/PEERKEY_REDACTED/' | grep -E '100\\.100\\.19\\.1|100\\.100\\.147\\.204|0\\.0\\.0\\.0/0|100\\.100\\.0\\.0/16' || echo [TOKEN_OR_KEY]\n229:echo \"[TOKEN_OR_KEY]\"\n239: wait_lapi \"CAPI_ROUTE_NOT_READY_SAFE\" || true\n240: write_health \"[TOKEN_OR_KEY]\" \"After manual NetBird setup, edge still cannot reach api.crowdsec.net; CrowdSec remains LAPI-only no-capi\"\n241: echo \"[TOKEN_OR_KEY]\"\n243: exit 70\n246:echo \"[TOKEN_OR_KEY]\"\n247:cd \"$STACK\" || exit 71\n248:mkdir -p \"manual-backups/771z-$TS\"\n249:test -f config/config.yaml && cp -a config/config.yaml \"manual-backups/771z-$TS/config.yaml.before\" || true\n250:test -f config/user.yaml && cp -a config/user.yaml \"manual-backups/771z-$TS/user.yaml.before\" || true\n251:test -f [TOKEN_OR_KEY].yaml && mv [TOKEN_OR_KEY].yaml \"manual-backups/771z-$TS/online_api_credentials.yaml.before\" || true\n257: write_health \"[TOKEN_OR_KEY]\" \"Direct CAPI route works, but compose CAPI enable failed\"\n258: exit 72\n262:wait_lapi \"REGISTER_MODE\" || exit 73\n284: write_health \"[TOKEN_OR_KEY]\" \"Direct CAPI route works, but cscli capi register failed; restored no-capi\"\n287: exit 74\n290:stat -c 'ONLINE_CREDS path=%n mode=%a owner=%U group=%G size=%s' [TOKEN_OR_KEY].yaml || true\n294:enable_capi_compose || exit 75\n315: write_health \"[TOKEN_OR_KEY]\" \"CrowdSec CAPI registered and stable after manual NetBird egress via relay/mail\"\n318: exit 0\n326:exit 76\n329: echo \"POST_ROUTE_SMOKE\"\n337: echo [TOKEN_OR_KEY]\nFILE_END=771z_after_manual_netbird_egress_capi.sh\nAUTHORITY_CANONICAL_READY=true\nDECISION=PASS_USA_MIGRATION_AUTHORITY_COLLECTED\nNEXT_GATE=BUILD_USA_EGRESS_AND_LOCAL_STACK_REPAIR\nTASK_RESULT=PASS_USA_MIGRATION_AUTHORITY_RCA\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-260925-SKLADCHIK-USA-MIGRATION-AUTHORITY-MINIREAD-73276R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n"
|
|
}
|