homelab-public-context/runtime/latest.json

{
  "schema_version": 1,
  "channel": "homelab-runtime",
  "command_id": "SUPPORT-261006-PVE01-GFS-VPN-FINAL-RCA-99696R1",
  "status": "OK",
  "rc": 0,
  "host": "pve01",
  "mode": "read-only",
  "component": "pve01-gfs-vpn-final-rca",
  "started_at_utc": "2026-10-06T08:45:16Z",
  "finished_at_utc": "2026-10-06T08:45:20Z",
  "reference_register_checked": true,
  "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66",
  "error_register_checked": true,
  "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0",
  "command_sha256": "9c86990b05592de487ff89f09077586a7f5c5c5c54fe3be43817e81dc4df0276",
  "duplicate_failed_command_blocked": false,
  "block_reason": null,
  "execution_started": true,
  "change_declared": false,
  "result_contract_valid": true,
  "result_contract_status": null,
  "result_contract_error": null,
  "command_rc": 0,
  "changes_made": false,
  "rollback_started": false,
  "rollback_restored": null,
  "mutation_outcome": "NO_MUTATION",
  "sanitized": true,
  "secrets_included": false,
  "private_addresses_included": false,
  "raw_evidence_retained_locally": true,
  "raw_evidence_sha256": "5de6a14be4a76e65a8cd5b1d048ed7f51c51c4d57732588bb9207e7de92f4d28",
  "sanitized_output_sha256": "5de6a14be4a76e65a8cd5b1d048ed7f51c51c4d57732588bb9207e7de92f4d28",
  "output_truncated_in_json": false,
  "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt",
  "output": "PVE01_GFS_VPN_FINAL_RCA=V1\nMODE=read-only\nNO_REBOOT=true\nNO_APT_UPDATE=true\nNO_PACKAGE_MUTATION=true\nNO_SERVICE_START_STOP_RESTART=true\nNO_RESET_FAILED=true\nNO_CONFIG_WRITE=true\nNO_FILE_DELETE=true\nNO_GUEST_MUTATION=true\nNO_BACKUP_EXECUTION=true\nNO_NETWORK_MUTATION=true\nNODE_HOSTNAME=pve01\nREC|FILE|BASENAME=targets.json|PRESENT=true|SHA=c588c4aa0c941406efcb3d24876c9262d9ec0dd4ced297d456fd2193e83afc49\nREC|FILE|BASENAME=homelab-backup-gfs-policy|PRESENT=true|SHA=a1aed0c6039f8095bd5da7f62b47f4ee6932df98c4e0e7420d3006df86bd5c94\nREC|FILE|BASENAME=gfs-retention.json|PRESENT=true|SHA=2c7674045dd5c68cc48d348d616494dbbe145df460a8e85d97a2c5c153ec792d\nREC|FILE|BASENAME=homelab-app-cloud-quorum-queue|PRESENT=true|SHA=1f959049cca2710a2cb820cc1f6acab16399c6b6711b9e4522e0ecd49e0e4650\nREC|FILE|BASENAME=homelab-backup-retention-gc|PRESENT=true|SHA=a96e607107e7b4e7762f7cb7f0e91f8c3ec6b793ed4604633c125433839ac909\nREC|FILE|BASENAME=homelab-backup-target-registry|PRESENT=true|SHA=66a243a207cbc5e19255fcafdb06013008d1d8c1d1205e660fdf0f236ff6a15a\nREC|FILE|BASENAME=homelab-check-private-vpn-hosts|PRESENT=true|SHA=591217150ef742117f677c4db12578528b1eaa0ec69ff31122003505a4fc7a82\nGFS_VALIDATE_CORRECT_ENV_RC=66\nREC|GFS_CORRECT_ERR|GFS_POLICY_ERROR=CRITICAL_NOT_ACTIVE_VM_vm160\nREC|GFS_SOURCE|LINE=1|#!PATH_REDACTED python3\nREC|GFS_SOURCE|LINE=2|import datetime as dt, json, os, pathlib, sys\nREC|GFS_SOURCE|LINE=3|CFG=pathlib.Path(os.environ.get(\"HOMELAB_BACKUP_GFS_POLICY\",\"PATH_REDACTED\nREC|GFS_SOURCE|LINE=4|REG=pathlib.Path(os.environ.get(\"HOMELAB_BACKUP_TARGET_REGISTRY\",\"PATH_REDACTED\nREC|GFS_SOURCE|LINE=5|def die(msg,rc=65):\nREC|GFS_SOURCE|LINE=6|    print(f\"GFS_POLICY_ERROR={msg}\",file=sys.stderr); raise SystemExit(rc)\nREC|GFS_SOURCE|LINE=7|def load():\nREC|GFS_SOURCE|LINE=8|    try: c=json.loads(CFG.read_text()); r=json.loads(REG.read_text())\nREC|GFS_SOURCE|LINE=9|    except Exception: die(\"READ_OR_JSON_INVALID\",66)\nREC|GFS_SOURCE|LINE=10|    if c.get(\"schema\")!=\"homelab-backup-gfs-policy-v1\" or c.get(\"policy_version\")!=1: die(\"SCHEMA_INVALID\",66)\nREC|GFS_SOURCE|LINE=11|    if c.get(\"completed_periods_only\") is not True or c.get(\"weekly_buckets\")!=4 or c.get(\"monthly_buckets\")!=6 or c.get(\"capacity_guard_max_free_fraction_milli\")!=500 or c.get(\"capacity_guard_target_max_age_seconds\")!=172800 or c.get(\"capacity_guard_cloud_max_age_seconds\")!=14400: die(\"POLICY_INVALID\",66)\nREC|GFS_SOURCE|LINE=12|    crit=c.get(\"critical_vm_logicals\")\nREC|GFS_SOURCE|LINE=13|    if not isinstance(crit,list) or not crit or len(set(crit))!=len(crit): die(\"CRITICAL_SET_INVALID\",66)\nREC|GFS_SOURCE|LINE=14|    rows={x.get(\"logical_id\"):x for x in r.get(\"targets\",[])}\nREC|GFS_SOURCE|LINE=15|    for logical in crit:\nREC|GFS_SOURCE|LINE=16|        rec=rows.get(logical)\nREC|GFS_SOURCE|LINE=17|        if not rec or rec.get(\"kind\")!=\"VM\" or rec.get(\"lifecycle\")!=\"ACTIVE\": die(f\"CRITICAL_NOT_ACTIVE_VM_{logical}\",66)\nREC|GFS_SOURCE|LINE=18|    return c,r\nREC|GFS_SOURCE|LINE=19|def parse_utc(s):\nREC|GFS_SOURCE|LINE=20|    try:\nREC|GFS_SOURCE|LINE=21|        if s.endswith('Z'): s=s[:-1]+'+00:00'\nREC|GFS_SOURCE|LINE=22|        x=dt.datetime.fromisoformat(s)\nREC|GFS_SOURCE|LINE=23|        if x.tzinfo is None: x=x.replace(tzinfo=dt.timezone.utc)\nREC|GFS_SOURCE|LINE=24|        return x.astimezone(dt.timezone.utc)\nREC|GFS_SOURCE|LINE=25|    except Exception: die(\"SEALED_TIME_INVALID\",66)\nREC|GFS_SOURCE|LINE=26|def now_utc():\nREC|GFS_SOURCE|LINE=27|    v=os.environ.get(\"HOMELAB_GFS_NOW_UTC\")\nREC|GFS_SOURCE|LINE=28|    return parse_utc(v) if v else dt.datetime.now(dt.timezone.utc)\nREC|GFS_SOURCE|LINE=29|def select(logical,c):\nREC|GFS_SOURCE|LINE=30|    if logical not in c[\"critical_vm_logicals\"]: return\nREC|GFS_SOURCE|LINE=31|    now=now_utc(); cur_iso=now.isocalendar(); cur_week=(cur_iso.year,cur_iso.week); cur_month=(now.year,now.month)\nREC|GFS_SOURCE|LINE=32|    weekly=[]; monthly=[]; seen_w=set(); seen_m=set()\nREC|GFS_SOURCE|LINE=33|    for raw in sys.stdin:\nREC|GFS_SOURCE|LINE=34|        raw=raw.rstrip(\"\\n\")\nREC|GFS_SOURCE|LINE=35|        if not raw: continue\nREC|GFS_SOURCE|LINE=36|        parts=raw.split(\"\\t\")\nREC|GFS_SOURCE|LINE=37|        if len(parts)!=2: die(\"SELECT_INPUT_INVALID\",66)\nREC|GFS_SOURCE|LINE=38|        gen,sealed=parts; when=parse_utc(sealed); iso=when.isocalendar(); wb=(iso.year,iso.week); mb=(when.year,when.month)\nREC|GFS_SOURCE|LINE=39|        if wb!=cur_week and len(weekly)<c[\"weekly_buckets\"] and wb not in seen_w:\nREC|GFS_SOURCE|LINE=40|            seen_w.add(wb); weekly.append((gen,f\"{wb[0]:04d}-W{wb[1]:02d}\"))\nREC|GFS_SOURCE|LINE=41|        if mb!=cur_month and len(monthly)<c[\"monthly_buckets\"] and mb not in seen_m:\nREC|GFS_SOURCE|LINE=42|            seen_m.add(mb); monthly.append((gen,f\"{mb[0]:04d}-{mb[1]:02d}\"))\nREC|GFS_SOURCE|LINE=43|        if len(weekly)>=c[\"weekly_buckets\"] and len(monthly)>=c[\"monthly_buckets\"]: break\nREC|GFS_SOURCE|LINE=44|    for gen,b in weekly: print(f\"WEEKLY\\t{gen}\\t{b}\")\nREC|GFS_SOURCE|LINE=45|    for gen,b in monthly: print(f\"MONTHLY\\t{gen}\\t{b}\")\nREC|GFS_SOURCE|LINE=46|def main():\nREC|GFS_SOURCE|LINE=47|    c,_=load(); args=sys.argv[1:]\nREC|GFS_SOURCE|LINE=48|    if args==[\"validate\"]: print(\"GFS_POLICY=OK\"); return\nREC|GFS_SOURCE|LINE=49|    if args==[\"critical-logicals\"]:\nREC|GFS_SOURCE|LINE=50|        print(\"\\n\".join(c[\"critical_vm_logicals\"])); return\nREC|GFS_SOURCE|LINE=51|    if args==[\"weekly-buckets\"]: print(c[\"weekly_buckets\"]); return\nREC|GFS_SOURCE|LINE=52|    if args==[\"monthly-buckets\"]: print(c[\"monthly_buckets\"]); return\nREC|GFS_SOURCE|LINE=53|    if args==[\"capacity-guard-milli\"]: print(c[\"capacity_guard_max_free_fraction_milli\"]); return\nREC|GFS_SOURCE|LINE=54|    if len(args)==2 and args[0]==\"is-critical\": raise SystemExit(0 if args[1] in c[\"critical_vm_logicals\"] else 1)\nREC|GFS_SOURCE|LINE=55|    if len(args)==2 and args[0]==\"select\": select(args[1],c); return\nREC|GFS_SOURCE|LINE=56|    die(\"USAGE\",64)\nREC|GFS_SOURCE|LINE=57|if __name__==\"__main__\": main()\nGFS_POLICY_SCHEMA=homelab-backup-gfs-policy-v1\nGFS_POLICY_VERSION=1\nGFS_POLICY_KEYS=capacity_guard_cloud_max_age_seconds,capacity_guard_max_free_fraction_milli,capacity_guard_target_max_age_seconds,completed_periods_only,critical_vm_logicals,monthly_buckets,policy_version,schema,weekly_buckets\nREC|GFS_POLICY_SCALAR|KEY=capacity_guard_cloud_max_age_seconds|VALUE=14400\nREC|GFS_POLICY_SCALAR|KEY=capacity_guard_max_free_fraction_milli|VALUE=500\nREC|GFS_POLICY_SCALAR|KEY=capacity_guard_target_max_age_seconds|VALUE=172800\nREC|GFS_POLICY_SCALAR|KEY=completed_periods_only|VALUE=True\nREC|GFS_POLICY_LIST|KEY=critical_vm_logicals|COUNT=8|VALUES=vm110,vm111,vm112,vm113,vm130,vm150,vm160,vm170\nREC|GFS_POLICY_SCALAR|KEY=monthly_buckets|VALUE=6\nREC|GFS_POLICY_SCALAR|KEY=policy_version|VALUE=1\nREC|GFS_POLICY_SCALAR|KEY=schema|VALUE=homelab-backup-gfs-policy-v1\nREC|GFS_POLICY_SCALAR|KEY=weekly_buckets|VALUE=4\nUNIFIED_TOTAL=21\nUNIFIED_VM_ACTIVE=10\nUNIFIED_VM_RETIRED_PRESERVE=3\nUNIFIED_APP_ACTIVE=4\nUNIFIED_APP_RETIRED_PRESERVE=3\nUNIFIED_CONTROL_ACTIVE=1\nUNIFIED_CONTROL_RETIRED_PRESERVE=0\nUNIFIED_LOGICAL_IDS=app-filebrowser,app-hbarhub,app-immich,app-memos,app-scrutiny,app-skladchik-moderator-assistant,app-skladchik-reports-monitor,control-bootstrap-v2,vm110,vm111,vm112,vm113,vm130,vm150,vm160,vm170,vm171,vm180,vm190,vm200,vm9130\nAPPQ_DIRECT_RC=65\nREC|APPQ_ERR|APP_QUORUM_QUEUE_ERROR=TARGET_REGISTRY_HELPER_SHA_DRIFT\nRET_DIRECT_RC=65\nREC|RET_ERR|GC_STATUS=ERROR|ROOT_CAUSE=TARGET_REGISTRY_HELPER_SHA_DRIFT\nVPN_LITERAL_NAME_COUNT=5\nREC|VPN_NAME|IDX=1|NAME_SHA=1588bd492f97c578a05fad877bb1c11e6738df68992b121042a13fb2f17329c0\nREC|VPN_NAME|IDX=2|NAME_SHA=bc1585521e17de78e3a7bd903ca2427f5941f3bc1276f324fafe794ea8eabdbc\nREC|VPN_NAME|IDX=3|NAME_SHA=968bf918c9b60ba4ae098281e24580e629b4ac33446a76981ed53c671db1e8c8\nREC|VPN_NAME|IDX=4|NAME_SHA=9f64956d61ca126d479e1ca923eed5c6994916944111962c6e2f3ad1d2538dcd\nREC|VPN_NAME|IDX=5|NAME_SHA=95f56744bb158973029a5113cf2904b44a928103143dfab662552f9beb28b9d9\nREC|VPN_SOURCE_ALL|LINE=1|#!PATH_REDACTED bash\nREC|VPN_SOURCE_ALL|LINE=2|set -u\nREC|VPN_SOURCE_ALL|LINE=4|H=\"PATH_REDACTED\nREC|VPN_SOURCE_ALL|LINE=5|HOSTS=\"\nREC|VPN_SOURCE_ALL|LINE=6|VPN_HOST_REDACTED\nREC|VPN_SOURCE_ALL|LINE=7|VPN_HOST_REDACTED\nREC|VPN_SOURCE_ALL|LINE=8|VPN_HOST_REDACTED\nREC|VPN_SOURCE_ALL|LINE=9|VPN_HOST_REDACTED\nREC|VPN_SOURCE_ALL|LINE=10|VPN_HOST_REDACTED\nREC|VPN_SOURCE_ALL|LINE=11|\"\nREC|VPN_SOURCE_ALL|LINE=13|mkdir -p PATH_REDACTED\nREC|VPN_SOURCE_ALL|LINE=14|tmp=\"$(mktemp)\"\nREC|VPN_SOURCE_ALL|LINE=15|trap 'rm -f \"$tmp\"' EXIT\nREC|VPN_SOURCE_ALL|LINE=17|bad=0\nREC|VPN_SOURCE_ALL|LINE=18|for h in $HOSTS; do\nREC|VPN_SOURCE_ALL|LINE=19|ip=\"$(getent hosts \"$h\" 2>PATH_REDACTED | awk '{print $1}' | head -n1 || true)\"\nREC|VPN_SOURCE_ALL|LINE=20|http=\"000error\"\nREC|VPN_SOURCE_ALL|LINE=21|https=\"000error\"\nREC|VPN_SOURCE_ALL|LINE=22|location=\"none\"\nREC|VPN_SOURCE_ALL|LINE=23|cert_ok=\"yes\"\nREC|VPN_SOURCE_ALL|LINE=25|if [ -n \"$ip\" ]; then\nREC|VPN_SOURCE_ALL|LINE=26|http_code=\"$(curl -4 -ksS -o PATH_REDACTED -D PATH_REDACTED -w '%{http_code}' --max-time 10 \"http:PATH_REDACTED 2>PATH_REDACTED || true)\"\nREC|VPN_SOURCE_ALL|LINE=27|https_code=\"$(curl -4 -ksS -o PATH_REDACTED -D PATH_REDACTED -w '%{http_code}' --max-time 10 \"https:PATH_REDACTED 2>PATH_REDACTED || true)\"\nREC|VPN_SOURCE_ALL|LINE=28|[ -n \"$http_code\" ] && http=\"$http_code\"\nREC|VPN_SOURCE_ALL|LINE=29|[ -n \"$https_code\" ] && https=\"$https_code\"\nREC|VPN_SOURCE_ALL|LINE=30|location=\"$(awk 'tolower($1)==\"location:\"{print $2; exit}' PATH_REDACTED 2>PATH_REDACTED | tr -d '\\r' || true)\"\nREC|VPN_SOURCE_ALL|LINE=31|[ -n \"$location\" ] || location=\"none\"\nREC|VPN_SOURCE_ALL|LINE=32|fi\nREC|VPN_SOURCE_ALL|LINE=34|case \"$https\" in\nREC|VPN_SOURCE_ALL|LINE=35|200|301|302|401|403) ;;\nREC|VPN_SOURCE_ALL|LINE=36|*) bad=$((bad+1)) ;;\nREC|VPN_SOURCE_ALL|LINE=37|esac\nREC|VPN_SOURCE_ALL|LINE=39|printf 'HOST|%s|fqdn=%s|dns=%s|http=%s|https=%s|location=%s|cert_ok=%s\\n' \\\nREC|VPN_SOURCE_ALL|LINE=40|\"${h%%.*}\" \"$h\" \"${ip:-NONE}\" \"$http\" \"$https\" \"$location\" \"$cert_ok\" >> \"$tmp\"\nREC|VPN_SOURCE_ALL|LINE=41|done\nREC|VPN_SOURCE_ALL|LINE=43|if [ \"$bad\" = \"0\" ]; then\nREC|VPN_SOURCE_ALL|LINE=44|status=OK\nREC|VPN_SOURCE_ALL|LINE=45|else\nREC|VPN_SOURCE_ALL|LINE=46|status=ERROR\nREC|VPN_SOURCE_ALL|LINE=47|fi\nREC|VPN_SOURCE_ALL|LINE=49|{\nREC|VPN_SOURCE_ALL|LINE=50|cat \"$tmp\"\nREC|VPN_SOURCE_ALL|LINE=51|printf 'STATUS=%s\\n' \"$status\"\nREC|VPN_SOURCE_ALL|LINE=52|} > \"$H\"\nREC|VPN_SOURCE_ALL|LINE=54|cat \"$H\"\nREC|VPN_SOURCE_ALL|LINE=55|[ \"$status\" = \"OK\" ]\nREC|VPN_RESOLUTION|IDX=1|PVE01_COUNT=0|PVE01_SET_SHA=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855|PVE02_COUNT=0|PVE02_SET_SHA=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855|SETS_EQUAL=true\nREC|VPN_RESOLUTION|IDX=2|PVE01_COUNT=0|PVE01_SET_SHA=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855|PVE02_COUNT=0|PVE02_SET_SHA=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855|SETS_EQUAL=true\nREC|VPN_RESOLUTION|IDX=3|PVE01_COUNT=0|PVE01_SET_SHA=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855|PVE02_COUNT=0|PVE02_SET_SHA=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855|SETS_EQUAL=true\nREC|VPN_RESOLUTION|IDX=4|PVE01_COUNT=0|PVE01_SET_SHA=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855|PVE02_COUNT=0|PVE02_SET_SHA=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855|SETS_EQUAL=true\nREC|VPN_RESOLUTION|IDX=5|PVE01_COUNT=0|PVE01_SET_SHA=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855|PVE02_COUNT=0|PVE02_SET_SHA=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855|SETS_EQUAL=true\nREC|RESOLVER|HOST=pve01|RESOLV_IS_SYMLINK=false\nREC|RESOLVER|HOST=pve01|RESOLV_LINK_BASENAME=NONE\nREC|RESOLVER|HOST=pve01|RESOLV_SHA=a89871ac2938a423c74c6dfe801eab57085b4a4c869bb1f864097f5885e27a74\nREC|RESOLVER|HOST=pve01|NAMESERVER_COUNT=1\nREC|RESOLVER|HOST=pve01|SEARCH_LINE_COUNT=1\nREC|RESOLVER|HOST=pve01|REC|RESOLVER_NS_SHA|a6f12182e30cba92f9e91dc59ae899c758ecc34e1c3b9b06404eb741a56916ac\nREC|RESOLVER|HOST=pve02|RESOLV_IS_SYMLINK=false\nREC|RESOLVER|HOST=pve02|RESOLV_LINK_BASENAME=NONE\nREC|RESOLVER|HOST=pve02|RESOLV_SHA=466da4d9381fbd060c635244fa97a800e50b77613fbd8c2ea0d2057ad4617f1f\nREC|RESOLVER|HOST=pve02|NAMESERVER_COUNT=1\nREC|RESOLVER|HOST=pve02|SEARCH_LINE_COUNT=1\nREC|RESOLVER|HOST=pve02|REC|RESOLVER_NS_SHA|3e731e83b523045ce83835503795f722459caf77bb2f8c0afcfaf75971b2bd78\nREC|PVE01_NS_CONFIG_REF|BASENAME=interfaces|PARENT=network|MATCH_COUNT=0|SHA=8558349d08d267b08a8abb490a591b5d4b7d539d3cc515b08f3165f3af0b8898\nFAILED_UNIT_COUNT_NOW=2\nREC|FAILED_UNIT_NOW|homelab-backup-audit.service\nREC|FAILED_UNIT_NOW|homelab-private-vpn-hosts-health.service\nDECISION=PASS_PVE01_GFS_VPN_FINAL_RCA\nNEXT_GATE=PVE01_HEALTH_HELPERS_AND_VPN_REPAIR\nTASK_RESULT=PVE01_GFS_VPN_FINAL_RCA\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-261006-PVE01-GFS-VPN-FINAL-RCA-99696R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n"
}