homelab-runtime-publisher
107 lines
5.0 KiB
Plaintext
107 lines
5.0 KiB
Plaintext
CHAT_OUTPUT_BEGIN
|
|
COMMAND_ID=SUPPORT-260925-SKLADCHIK-USA-MIGRATION-AUTHORITY-MINIREAD-73276R1
|
|
STATUS=OK
|
|
RC=0
|
|
HOST=pve01
|
|
MODE=read-only
|
|
COMPONENT=skladchik-usa-migration-authority-miniread
|
|
REFERENCE_REGISTER_CHECK=OK
|
|
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
|
|
ERROR_REGISTER_CHECK=OK
|
|
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
|
|
COMMAND_SHA256=50e4c7308ff3d4c751750cc63eee7536aa985f884c94b84ffcc1180c5eb60b05
|
|
DUPLICATE_FAILED_COMMAND_BLOCKED=false
|
|
EXECUTION_STARTED=true
|
|
CHANGE_DECLARED=false
|
|
RESULT_CONTRACT_VALID=true
|
|
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
|
|
RESULT_CONTRACT_ERROR=NONE
|
|
COMMAND_RC=0
|
|
CHANGES_MADE=false
|
|
ROLLBACK_STARTED=false
|
|
ROLLBACK_RESTORED=null
|
|
MUTATION_OUTCOME=NO_MUTATION
|
|
SANITIZED=yes
|
|
SECRETS_INCLUDED=no
|
|
PRIVATE_ADDRESSES_INCLUDED=no
|
|
RAW_EVIDENCE_SHA256=f9810e721990dfc12c47863f23a39ad78582eaaf2cf212ac359cfbff17121390
|
|
SANITIZED_OUTPUT_SHA256=f9810e721990dfc12c47863f23a39ad78582eaaf2cf212ac359cfbff17121390
|
|
OUTPUT_BEGIN
|
|
RCA_VERSION=73276_V1
|
|
MODE=read-only
|
|
MIGRATION_DOC_EXISTS=true
|
|
MIGRATION_DOC_SHA256=12fe079849346352315aac76fae82d00cbd17f88a3553270ca2c5f2749840552
|
|
RUNBOOK_EXISTS=true
|
|
RUNBOOK_SHA256=725e2068337b379ebdf47822d5871aa5f4d5ec5956546674b2cf55b3250fb7a3
|
|
MIGRATION_DOC_SHA_MATCH=true
|
|
RUNBOOK_SHA_MATCH=true
|
|
FILE_BEGIN=20_NETBIRD_USA_MIGRATION_2026-08-18.md
|
|
1:# NETBIRD USA MIGRATION — FINAL CURRENT RECORD
|
|
5:Old USA mail/NetBird VPS:
|
|
11:Host-level NetBird client left running for rollback/peer observation.
|
|
54:- [TOKEN_OR_KEY] startup
|
|
56:- Moldova synthetic check passes
|
|
57:- edge peer works
|
|
61:- `:9000/health` 503 in combined relay/server mode
|
|
70:- narrow TrustedPeers
|
|
71:- fix Traefik Compose network warning
|
|
FILE_END=20_NETBIRD_USA_MIGRATION_2026-08-18.md
|
|
FILE_BEGIN=04_NETBIRD_USA.md
|
|
1:# Runbook: NetBird USA
|
|
5:Do not use `/api/health` or combined `:9000/health` as generic readiness gates for this exact deployment; they were 404/503 and caused a false rollback. Use repeated Dashboard 200 + OIDC 200 + expected listeners + real client/peer connectivity.
|
|
14:7. retain migration key only until old USA is no longer needed.
|
|
FILE_END=04_NETBIRD_USA.md
|
|
FILE_BEGIN=771z_after_manual_netbird_egress_capi.sh
|
|
3:if ! test -s [TOKEN_OR_KEY].md || ! test -s [TOKEN_OR_KEY].md; then echo [TOKEN_OR_KEY]; exit 1; fi
|
|
8:PROOF="[TOKEN_OR_KEY]${TS}_PROOF.txt"
|
|
14: echo "[TOKEN_OR_KEY]"
|
|
17: echo "[TOKEN_OR_KEY]"
|
|
18: echo "TARGETS=edge-vm:[IP] relay-moldova:[IP] mail-usa:[IP]"
|
|
67: networks:
|
|
71:networks:
|
|
94: networks:
|
|
98:networks:
|
|
180: raise SystemExit("api.server block not found")
|
|
201:echo "PEERS_RELAY_MAIL_EDGE"
|
|
209: for peer in data.get("peers",{}).get("details",[]):
|
|
210: fqdn=peer.get("fqdn","")
|
|
211: ip=peer.get("netbirdIp","")
|
|
212: if ip in {"[IP]","[IP]","[IP]"} or any(x in fqdn for x in ["relay","mail","edge-vm"]):
|
|
213: print("PEER", fqdn, ip, "status="+str(peer.get("status")), "handshake="+str(peer.get("lastWireguardHandshake")), "conn="+str(peer.get("connectionType")))
|
|
216:echo "RELAY_MAIL_CONNECTIVITY"
|
|
219: ip route get "$ip" 2>&1 || true
|
|
224:echo "WG_ALLOWED_IPS_RELAY_MAIL"
|
|
226: wg show wt0 allowed-ips 2>/dev/null | sed -E 's/^[A-Za-z0-9+\/=]{20,}/PEERKEY_REDACTED/' | grep -E '100\.100\.19\.1|100\.100\.147\.204|0\.0\.0\.0/0|100\.100\.0\.0/16' || echo [TOKEN_OR_KEY]
|
|
229:echo "[TOKEN_OR_KEY]"
|
|
239: wait_lapi "CAPI_ROUTE_NOT_READY_SAFE" || true
|
|
240: write_health "[TOKEN_OR_KEY]" "After manual NetBird setup, edge still cannot reach api.crowdsec.net; CrowdSec remains LAPI-only no-capi"
|
|
241: echo "[TOKEN_OR_KEY]"
|
|
243: exit 70
|
|
246:echo "[TOKEN_OR_KEY]"
|
|
247:cd "$STACK" || exit 71
|
|
248:mkdir -p "manual-backups/771z-$TS"
|
|
249:test -f config/config.yaml && cp -a config/config.yaml "manual-backups/771z-$TS/config.yaml.before" || true
|
|
250:test -f config/user.yaml && cp -a config/user.yaml "manual-backups/771z-$TS/user.yaml.before" || true
|
|
251:test -f [TOKEN_OR_KEY].yaml && mv [TOKEN_OR_KEY].yaml "manual-backups/771z-$TS/online_api_credentials.yaml.before" || true
|
|
257: write_health "[TOKEN_OR_KEY]" "Direct CAPI route works, but compose CAPI enable failed"
|
|
258: exit 72
|
|
262:wait_lapi "REGISTER_MODE" || exit 73
|
|
284: write_health "[TOKEN_OR_KEY]" "Direct CAPI route works, but cscli capi register failed; restored no-capi"
|
|
287: exit 74
|
|
290:stat -c 'ONLINE_CREDS path=%n mode=%a owner=%U group=%G size=%s' [TOKEN_OR_KEY].yaml || true
|
|
294:enable_capi_compose || exit 75
|
|
315: write_health "[TOKEN_OR_KEY]" "CrowdSec CAPI registered and stable after manual NetBird egress via relay/mail"
|
|
318: exit 0
|
|
326:exit 76
|
|
329: echo "POST_ROUTE_SMOKE"
|
|
337: echo [TOKEN_OR_KEY]
|
|
FILE_END=771z_after_manual_netbird_egress_capi.sh
|
|
AUTHORITY_CANONICAL_READY=true
|
|
DECISION=PASS_USA_MIGRATION_AUTHORITY_COLLECTED
|
|
NEXT_GATE=BUILD_USA_EGRESS_AND_LOCAL_STACK_REPAIR
|
|
TASK_RESULT=PASS_USA_MIGRATION_AUTHORITY_RCA
|
|
HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-260925-SKLADCHIK-USA-MIGRATION-AUTHORITY-MINIREAD-73276R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
|
|
|
|
OUTPUT_END
|
|
CHAT_OUTPUT_END
|