homelab-runtime-publisher
39 lines
12 KiB
JSON
39 lines
12 KiB
JSON
{
|
|
"schema_version": 1,
|
|
"channel": "homelab-runtime",
|
|
"command_id": "NEWFI-260908-A-STAGINGEDGE-PUBLICINGRESS-WRITERPATH-RCA43",
|
|
"status": "OK",
|
|
"rc": 0,
|
|
"host": "pve01",
|
|
"mode": "read-only",
|
|
"component": "newfi-stagingedge-public-ingress-router-live-writerpath-rca-v7",
|
|
"started_at_utc": "2026-09-08T18:29:28Z",
|
|
"finished_at_utc": "2026-09-08T18:29:28Z",
|
|
"reference_register_checked": true,
|
|
"reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
|
|
"error_register_checked": true,
|
|
"error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
|
|
"command_sha256": "5d37f67460c7ccdd0ae041b342d7b75e929bf60333a13dd1b206e2befe296a6f",
|
|
"duplicate_failed_command_blocked": false,
|
|
"block_reason": null,
|
|
"execution_started": true,
|
|
"change_declared": false,
|
|
"result_contract_valid": true,
|
|
"result_contract_status": null,
|
|
"result_contract_error": null,
|
|
"command_rc": 0,
|
|
"changes_made": false,
|
|
"rollback_started": false,
|
|
"rollback_restored": null,
|
|
"mutation_outcome": "NO_MUTATION",
|
|
"sanitized": true,
|
|
"secrets_included": false,
|
|
"private_addresses_included": false,
|
|
"raw_evidence_retained_locally": true,
|
|
"raw_evidence_sha256": "a94b0dc6cf0dca478f6e33ea44afab6abb54befb21a9f4e5a10e819be229e2ad",
|
|
"sanitized_output_sha256": "a94b0dc6cf0dca478f6e33ea44afab6abb54befb21a9f4e5a10e819be229e2ad",
|
|
"output_truncated_in_json": false,
|
|
"full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
|
|
"output": "ERROR_REGISTER_CHECK=OK\nREFERENCE_CHECK=OK\nAUTHORITY_CHECK_SCOPE=READABILITY_ONLY_INCIDENTS_NOT_CLOSED\nNEWFI43_RUNNER_SHA256=b248a4c32c9cc64e5747e7dce6c7fc0a23f5124a77c71ce72e27a81aceae9d2d\nNEWFI43_KNOWN_HOSTS_SHA256_BEFORE=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI43_ERROR_ROUTER_CLUE_COUNT=13\nNEWFI43_ERROR_ROUTER_CLUES=[{\"line\":171,\"text\":\"Факт: first reconciliation wrote STATUS=ERROR because router-running-config-mail-cloud.txt is on pve01, not edge-vm.\"},{\"line\":214,\"text\":\"- Context: attempted Netcraze router ACL apply through SSH stdin/multiline for Homepage Moscow Router monitor fix.\"},{\"line\":217,\"text\":\"- Rule: do not apply Netcraze config through stdin/multiline SSH; prove CLI input mode first.\"},{\"line\":224,\"text\":\"## ROUTERBACKUP_READONLY_CLI_PERMISSION_LIMIT_20260630\"},{\"line\":225,\"text\":\"- Context: routerbackup user can run show running-config but cannot execute configuration commands such as access-list.\"},{\"line\":228,\"text\":\"- Rule: do not attempt ACL/config changes as routerbackup; use admin/operator router access or router Web UI for write changes.\"},{\"line\":239,\"text\":\"- Rule: after manual router Web UI ACL edits, compare _WEBADMIN_Bridge0, _WEBADMIN_Bridge1 and _WEBADMIN_GigabitEthernet1 before continuing.\"},{\"line\":250,\"text\":\"- Observed: edge-vm TCP to [PRIVATE_IP]:5080/5083 is OK, but router HTTP/HTTPS returns 403 for all tested paths.\"},{\"line\":265,\"text\":\"- Mitigation: use dedicated edge-vm health endpoint that checks router TCP [PRIVATE_IP]:5080 and returns HTTP 200/503 for Homepage.\"},{\"line\":598,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":604,\"text\":\"- Context: taftauto.ru points to the dacha router public IP. Operator confirmed the router model is Netcraze-like, same family as Moscow router.\"},{\"line\":612,\"text\":\"- Rule: generated client config may be stored only as root/debian mode 600 file and must be imported into the Netcraze router UI manually.\"},{\"line\":3180,\"text\":\"TAFTAUTO_INTERMITTENT_HTTP_TIMEOUT_20260904 | CLOSED_BLOCKED_REMOTE_SERVICE | VM130 route via wg-taftauto is healthy, WireGuard handshake is current, ICMP to [PRIVATE_IP] succeeds, but remote TCP/80 and TCP/443 are not listening. NPMplus/EDGE path is not the root cause; remediation requires the remote dacha service/router side.\"}]\nNEWFI43_REFERENCE_ROUTER_CLUE_COUNT=24\nNEWFI43_REFERENCE_ROUTER_CLUES=[{\"line\":199,\"text\":\"## ROUTER_NETCRAZE_ULTRA_NC1812_20260630\"},{\"line\":201,\"text\":\"Источник: self-test Netcraze Ultra NC-1812 от 2026-06-30. Секреты Wi-Fi, пароли и токены в справочник не вносятся.\"},{\"line\":204,\"text\":\"- Model: Netcraze Ultra.\"},{\"line\":205,\"text\":\"- Device description: Netcraze Ultra (NC-1812).\"},{\"line\":206,\"text\":\"- Hostname: Netcraze-9202.\"},{\"line\":211,\"text\":\"- Локальный домен/сертификат в логах: aleisaevn.netcraze.pro.\"},{\"line\":317,\"text\":\"- ISP tcp/443 -> bc:24:11:e1:f3:3c, NPMplus.\"},{\"line\":355,\"text\":\"- Netcraze SSH CLI is not a normal POSIX shell.\"},{\"line\":683,\"text\":\"- Public WAN router forwards TCP/80 and TCP/443 to NPMplus on edge-vm, [PRIVATE_IP].\"},{\"line\":694,\"text\":\"- Public listen ports on edge-vm: [PRIVATE_IP]:80 and [PRIVATE_IP]:443 by nginx/NPMplus.\"},{\"line\":1237,\"text\":\"- edge-vm exposes public :80/:443 through NPMplus.\"},{\"line\":1356,\"text\":\"- Public ingress HTTP/HTTPS: router forwards TCP 80/443 to edge-vm [PRIVATE_IP].\"},{\"line\":1367,\"text\":\"| gotify.gram1.ru | http://[PRIVATE_IP]:8082 | edge-vm / gotify | gotify health, alert-routing proof |\"},{\"line\":1368,\"text\":\"| vault.gram1.ru | http://[PRIVATE_IP]:8083 | edge-vm / vaultwarden | vaultwarden backup/offhost/restore |\"},{\"line\":1373,\"text\":\"| paper.gram1.ru | http://[PRIVATE_IP]:8010 | edge-vm / paperless | paperless backup/offhost/restore |\"},{\"line\":1626,\"text\":\"- Do not run bash/POSIX automation against Netcraze CLI; use router CLI syntax only.\"},{\"line\":1660,\"text\":\"- Timer: homelab-router-running-config-mail-cloud.timer.\"},{\"line\":1661,\"text\":\"- Health file: /var/lib/homelab-health/router-running-config-mail-cloud.txt.\"},{\"line\":1697,\"text\":\"- Router recurring backup uses a dedicated routerbackup credential file on pve01.\"},{\"line\":1698,\"text\":\"- Secret file path: /var/lib/homelab-private/secrets/routerbackup.pass.\"},{\"line\":2105,\"text\":\"- Netcraze routerbackup SSH access is read-only for backup: show running-config works, but ACL/config commands are denied.\"},{\"line\":2106,\"text\":\"- Homepage Moscow Router red-dot fix requires router ACL/Web UI/admin-level change, not routerbackup.\"},{\"line\":2498,\"text\":\"- Landing service on edge-vm: homelab-pvepro-landing-http.service on http://[PRIVATE_IP]:18089.\"},{\"line\":2511,\"text\":\"- Router model family: Netcraze-like, same as Moscow router family by operator statement.\"}]\nNEWFI43_TRUST_ROUTER_CLUE_COUNT=0\nNEWFI43_TRUST_ROUTER_CLUES=[]\nNEWFI43_EXPECTED_EDGE_ROUTER_TARGET_COUNT=1\nNEWFI43_EXPECTED_EDGE_ROUTER_TARGET_HASHES=[\"bc517b4af3298846906234d3d697d3820b0b652ade1880c937c9d71cd802c834\"]\nNEWFI43_ROUTER_SNAPSHOT_PRESENT=false\nNEWFI43_TEXT_FILES_SCANNED=265\nNEWFI43_ROUTERBACKUP_ENDPOINT_COUNT=0\nNEWFI43_ROUTERBACKUP_ENDPOINT_HASHES=[]\nNEWFI43_ROUTER_RELATED_FILE_COUNT=21\nNEWFI43_ROUTER_RELATED_FILES=[{\"path\":\"/etc/pve/HOMELAB_ASSISTANT_ERROR_REGISTER.md\",\"sha256\":\"3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0\",\"size\":302058},{\"path\":\"/etc/pve/31_HOMELAB_REFERENCE.md\",\"sha256\":\"5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66\",\"size\":201129},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/task.json\",\"sha256\":\"9cad3f6291663d6e85a556882c8ed751eaaa61b816b9bae934032fb0677267fd\",\"size\":5697},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/README.txt\",\"sha256\":\"f01ab83f721cd4782e60ebc57316dcc753caf96e03598ce57ba829d47a8daeec\",\"size\":734},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-home-restricted-ingress.nft\",\"sha256\":\"124cf4df2391ce0256eceaf7a1470c8f53588c467de06af8a317bcc2ffdacfba\",\"size\":1460},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/assets/edge01-public-ingress.nft\",\"sha256\":\"a195c34384dd7b2cdbdd83472bf5d527c3ba7b1c80d97a23562ddb703b1b7220\",\"size\":1281},{\"path\":\"/srv/homelab-ops/tasks/snikket-edge-cutover-v1/tools/cutover.py\",\"sha256\":\"0b17af22f494cd5e299fceae33c9bff114cefd5ab886426f0b822794a6787287\",\"size\":16029},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json\",\"sha256\":\"26b81f4a16e66e5e1f6b09d6d600c17a86a87d6bf1eaddd506bb33555480c8a3\",\"size\":5352},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py\",\"sha256\":\"e63317e9f5ed00b4535ccbd0930b305fdf847a44c5a67a9cc0e94c05106ff2f8\",\"size\":17076},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/task.json\",\"sha256\":\"48564bec1e1dc49ba117ea2590f7922030462a0f4f71a62adf19a033ddaf74b4\",\"size\":5427},{\"path\":\"/srv/homelab-ops/tasks/snikket-turn-legacy-dns-retire-v1/tools/retire_turn_dns.py\",\"sha256\":\"33328864f5677f7a2962fccd1707e32e429a4d818fb45c7395efc1a67d829a27\",\"size\":13921},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-post-cutover-hardening-design.md\",\"sha256\":\"da27ba7192019193cb08c6fead1e0fc847671121bea63735492e8123468b1837\",\"size\":3702},{\"path\":\"/srv/homelab-ops/docs/superpowers/specs/2026-08-17-snikket-edge-cutover-design.md\",\"sha256\":\"b774fe2d10c15832030192e475ba707fbe6e7d286fd079c4ffcaec013424bc6c\",\"size\":3638},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-18-gitea-edge-publisher-v3.md\",\"sha256\":\"f42b0e0be98c7f6d9f0e06d5565ec1cfc277e4221cbc164f21c157fe4121ad72\",\"size\":31037},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-home-forward-retirement.md\",\"sha256\":\"415c7f8302baf917e954118551ddcb507f8359418846bf4aa429c173b856f9a6\",\"size\":3408},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-edge-cutover.md\",\"sha256\":\"db6119a6a40c326609f1041239ce465d6a3f1d8f169512296db7de5ae4316a74\",\"size\":4548},{\"path\":\"/srv/homelab-ops/docs/superpowers/plans/2026-08-17-snikket-turn-legacy-dns-retirement.md\",\"sha256\":\"a5b937405e9e073a31d11786f2300ed6acc9d8aeed4579c7bc19ec44ec83b907\",\"size\":5118},{\"path\":\"/srv/homelab-ops/kb/AI_CONTEXT.md\",\"sha256\":\"5fc43e34a1f0714ddacf7c00ed5c4bbaf788df3b8407dcfebd1333a23a623acc\",\"size\":3587},{\"path\":\"/srv/homelab-ops/kb/runbooks/03_EDGE_NGINX.md\",\"sha256\":\"ed07c49d6d425bed81b09004b7fec2844f38be270919bc04cb65c6b534a2b02b\",\"size\":650},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0080_snikket_edge_cutover.py\",\"sha256\":\"a8b58624a22ea817b2696b50b3d410fb4cd23dd013f865d7d80ce465ebe8cf57\",\"size\":6137},{\"path\":\"/srv/homelab-ops/tests/test_cr_2026_0081_home_forward_retire.py\",\"sha256\":\"317aa49a5c23f395ca006b9e63cb26c298cb060e37e2cc26e9cd6783d777a468\",\"size\":6119}]\nNEWFI43_ROUTER_SCRIPT_CANDIDATES=[{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/task.json\",\"sha256\":\"26b81f4a16e66e5e1f6b09d6d600c17a86a87d6bf1eaddd506bb33555480c8a3\",\"mode\":\"0o644\"},{\"path\":\"/srv/homelab-ops/tasks/snikket-home-forward-retire-v1/tools/retire_home_forwards.py\",\"sha256\":\"e63317e9f5ed00b4535ccbd0930b305fdf847a44c5a67a9cc0e94c05106ff2f8\",\"mode\":\"0o755\"}]\nNEWFI43_ROUTERBACKUP_READ_CAPABILITY_ASSERTED=true\nNEWFI43_ROUTERBACKUP_WRITE_DENIED_ASSERTED=true\nNEWFI43_ROUTER_WRITER_REFERENCE_PRESENT=true\nNEWFI43_ROUTER_EXISTING_KNOWN_HOST_MATCH_COUNT=0\nNEWFI43_ROUTER_LIVE_SHOW_RUNNING_CONFIG_RC=NOT_ATTEMPTED\nNEWFI43_SNAPSHOT_TARGET_RELATION=UNKNOWN\nNEWFI43_LIVE_TARGET_RELATION=UNKNOWN\nNEWFI43_DECISION=HOLD_ROUTERBACKUP_ENDPOINT_NOT_UNIQUE_REVIEW_EXACT_REFERENCES\nNEWFI43_KNOWN_HOSTS_SHA256_AFTER=ab01de61ca5030ad158f1aef377364100531473de1e10a529089174f6890d735\nNEWFI43_KNOWN_HOSTS_UNCHANGED=true\nNEWFI43_CHANGES_MADE=false\nNEWFI43_MUTATION_SCOPE=NONE_READ_ONLY\nNEWFI43_RCA_EXECUTION=PASS\n"
|
|
}
|