admin

OpeItcLoc03/admin

Fork 0

Commit Graph

Author	SHA1	Message	Date
vitya	b7b8e27a27	tasks(books-ssh-audit-shared-vds): close 🟢 — audit clean (1 retained, 0 revoked) SSH audit на shared VDS vds-kzntsv (89.253.255.94, hosts books Slovo + Bookva в shared compose-стеке) перед Phase 3 cutover'ом tenant-split. Findings: - 1 retained key: vitya@DESKTOP-NSEF0UK (core dev, sole admin) - 0 keys to revoke — никаких analyst / former employee / unknown keys - 1 cosmetic cleanup: removed dead root authorized_keys entry (was duplicate of vitya's key, dead из-за `permitrootlogin no`) - sshd hardening verified via `sshd -T` (effective config: root-no, password-no, kbd-no). Gotcha noted: raw grep of /etc/ssh/sshd_config shows defaults; sshd_config.d/ overrides делают effective. Future audits use `sshd -T`, not raw grep. - fail2ban active, 2670 failed / 37 banned hist, currently 0 - last 7 days journalctl ssh: только vitya@94.19.247.14 (мой home IP) Acceptance per spec (Фаза 3, шаг 2 tenant-split): ✅ authorized_keys reviewed ✅ Non-core keys revoked (N/A — none existed) ✅ Analyst keys revoked (N/A — never issued) ✅ Documented in .wiki/concepts/books-ssh-access.md Ingest: .wiki/concepts/books-ssh-access.md — retained keys table + sshd state + fail2ban + login history + add/revoke processes + cross-refs. Logged + indexed. STATUS.md ⚪ block → ARCHIVE.md (per-task file kept in .tasks/). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 15:59:50 +03:00
vitya	7f40bba14b	tasks(windows-host-fallback-backup-daily): close 🟢 — daily live, smoke #1 ✓ End-to-end pipeline verified — windows-host (DESKTOP-NSEF0UK) → kreknin SFTP daily 03:00 MSK live. Smoke run #1 на 14:03-15:25 = 4868 sec (81 min). Total 23 GB на kreknin /volume1/NetBackup/windows-host/<date>/. Components synced (6 paths): - mssql/ 486 MB (5 .bak FULL+COMPRESSION+INIT for MoreThenCms, StayerCalculator, StayerPrice, stostayer, TireService) - sites/ 20 GB (C:\sites\* всё содержимое) - minio/ 3.1 GB (windows-host MinIO data dir) - traefik/ 1.1 MB (config + acme.json) - iis-config/ 68 KB (applicationHost.config) - iis-backup-webconfiguration/ 384 KB (native Backup-WebConfiguration) ScheduledTask `WindowsHost-Backup-Daily` 03:00 MSK SYSTEM Wake-To-Run (машина просыпается из standby). Все 3 host backups (windows 03:00 → RUVDS 04:30 → VDS 05:00) sequential — аккумулируются за одну ночь. Notifications dual-channel ntfy `vds-backup` + email Yandex 587 STARTTLS fired clean (no WARNING/FAILED в log). Acceptance check 5/6: ✅ ScheduledTask, components, retention, notify, README ⚠ Smoke recovery test (restore .bak в чистый container + SELECT) — deferred как "DR drill" follow-up, не блокер. Decisions captured в .tasks/ARCHIVE.md closure block: - rclone в ProgramData (не Program Files) — non-admin staging path - icacls SID *S-1-5-32-544 — locale-safe для ru-Windows - sqlcmd 18 `-C` flag (TLS-required даже на localhost) - MinIO bind-mount path verified via docker inspect - SSH key deploy via VDS pivot (windows-host нет direct ssh к kreknin) - Wake-To-Run critical для warm-standby use-case Block moved: STATUS.md ⚪ → ARCHIVE.md 🟢 + header refresh. STATUS.md теперь 2 active tasks (iis-migration-to-ruvds 🟡, infra-inventory ⚪). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 15:37:29 +03:00
vitya	bfdd823b42	tasks: cleanup STATUS.md (25 closed → ARCHIVE.md) + re-scope cms-stopgap STATUS.md cleanup: - 25 🟢 closed task blocks moved to new .tasks/ARCHIVE.md (append-only history; per-task <slug>.md остаются in-place в .tasks/ root). - STATUS.md now 6 KB instead of 78 KB — board показывает только active (🔴/🟡), ready (⚪), blocked (🔵). - Header refreshed с current scope summary. Re-scope: cms-stopgap-backup-daily → windows-host-fallback-backup-daily - Original spec: "временный stop-gap до migration MSSQL/MinIO на VDS" - Reality (2026-05-24): MSSQL+sites уже мигрированы и прикрыты backup'ами (vds-backup-rsync-kreknin 🟢 + ruvds-backup-daily-kreknin 🟢) - New purpose (user-decision): windows-host остаётся warm-standby для DR (failover при потере VDS/RUVDS), backup pipeline нужен чтобы failover не возвращал stale state. - Also: CMS image-rendering хардкодит imgproxy.kzntsv.site через DLL → windows-host MinIO/imgproxy — active dependency даже после primary cutover, не "standby". Backup критично для image-pipeline DR. - Tool: rclone same pattern как ruvds-backup-daily-kreknin 🟢 iis-migration-to-ruvds scope narrow: - tandemmebel.ru + www.tandemmebel.ru EXCLUDED из cutover (user-decision) - Остаются на windows-IIS:8089 неопределённо - Cert на RUVDS уже импортирован, HTTPS binding existing — idle, traffic не пойдёт пока DNS не flipped. Source IIS snolla site нельзя decommission'ить полностью пока tandemmebel на нём же (catch-all). - Scope теперь 24 hostnames для migration (вместо 26). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 13:19:11 +03:00

Author

SHA1

Message

Date

vitya

b7b8e27a27

tasks(books-ssh-audit-shared-vds): close 🟢 — audit clean (1 retained, 0 revoked)

SSH audit на shared VDS vds-kzntsv (89.253.255.94, hosts books Slovo +
Bookva в shared compose-стеке) перед Phase 3 cutover'ом tenant-split.

Findings:
- 1 retained key: vitya@DESKTOP-NSEF0UK (core dev, sole admin)
- 0 keys to revoke — никаких analyst / former employee / unknown keys
- 1 cosmetic cleanup: removed dead root authorized_keys entry (was
  duplicate of vitya's key, dead из-за `permitrootlogin no`)
- sshd hardening verified via `sshd -T` (effective config: root-no,
  password-no, kbd-no). **Gotcha** noted: raw grep of /etc/ssh/sshd_config
  shows defaults; sshd_config.d/ overrides делают effective. Future
  audits use `sshd -T`, not raw grep.
- fail2ban active, 2670 failed / 37 banned hist, currently 0
- last 7 days journalctl ssh: только vitya@94.19.247.14 (мой home IP)

Acceptance per spec (Фаза 3, шаг 2 tenant-split):
✅ authorized_keys reviewed
✅ Non-core keys revoked (N/A — none existed)
✅ Analyst keys revoked (N/A — never issued)
✅ Documented in .wiki/concepts/books-ssh-access.md

Ingest: .wiki/concepts/books-ssh-access.md — retained keys table +
sshd state + fail2ban + login history + add/revoke processes +
cross-refs. Logged + indexed.

STATUS.md ⚪ block → ARCHIVE.md (per-task file kept in .tasks/).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-24 15:59:50 +03:00

vitya

7f40bba14b

tasks(windows-host-fallback-backup-daily): close 🟢 — daily live, smoke #1 ✓

End-to-end pipeline verified — windows-host (DESKTOP-NSEF0UK) → kreknin
SFTP daily 03:00 MSK live. Smoke run #1 на 14:03-15:25 = 4868 sec
(81 min). Total 23 GB на kreknin /volume1/NetBackup/windows-host/<date>/.

Components synced (6 paths):
- mssql/ 486 MB (5 .bak FULL+COMPRESSION+INIT for MoreThenCms,
  StayerCalculator, StayerPrice, stostayer, TireService)
- sites/ 20 GB (C:\sites\* всё содержимое)
- minio/ 3.1 GB (windows-host MinIO data dir)
- traefik/ 1.1 MB (config + acme.json)
- iis-config/ 68 KB (applicationHost.config)
- iis-backup-webconfiguration/ 384 KB (native Backup-WebConfiguration)

ScheduledTask `WindowsHost-Backup-Daily` 03:00 MSK SYSTEM Wake-To-Run
(машина просыпается из standby). Все 3 host backups (windows 03:00 →
RUVDS 04:30 → VDS 05:00) sequential — аккумулируются за одну ночь.

Notifications dual-channel ntfy `vds-backup` + email Yandex 587 STARTTLS
fired clean (no WARNING/FAILED в log).

Acceptance check 5/6:
✅ ScheduledTask, components, retention, notify, README
⚠ Smoke recovery test (restore .bak в чистый container + SELECT) —
   deferred как "DR drill" follow-up, не блокер.

Decisions captured в .tasks/ARCHIVE.md closure block:
- rclone в ProgramData (не Program Files) — non-admin staging path
- icacls SID *S-1-5-32-544 — locale-safe для ru-Windows
- sqlcmd 18 `-C` flag (TLS-required даже на localhost)
- MinIO bind-mount path verified via docker inspect
- SSH key deploy via VDS pivot (windows-host нет direct ssh к kreknin)
- Wake-To-Run critical для warm-standby use-case

Block moved: STATUS.md ⚪ → ARCHIVE.md 🟢 + header refresh. STATUS.md
теперь 2 active tasks (iis-migration-to-ruvds 🟡, infra-inventory ⚪).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-24 15:37:29 +03:00

vitya

bfdd823b42

tasks: cleanup STATUS.md (25 closed → ARCHIVE.md) + re-scope cms-stopgap

STATUS.md cleanup:
- 25 🟢 closed task blocks moved to new .tasks/ARCHIVE.md (append-only
  history; per-task <slug>.md остаются in-place в .tasks/ root).
- STATUS.md now 6 KB instead of 78 KB — board показывает только active
  (🔴/🟡), ready (⚪), blocked (🔵).
- Header refreshed с current scope summary.

Re-scope: cms-stopgap-backup-daily → windows-host-fallback-backup-daily
- Original spec: "временный stop-gap до migration MSSQL/MinIO на VDS"
- Reality (2026-05-24): MSSQL+sites уже мигрированы и прикрыты backup'ами
  (vds-backup-rsync-kreknin 🟢 + ruvds-backup-daily-kreknin 🟢)
- New purpose (user-decision): windows-host остаётся warm-standby для DR
  (failover при потере VDS/RUVDS), backup pipeline нужен чтобы failover не
  возвращал stale state.
- Also: CMS image-rendering хардкодит imgproxy.kzntsv.site через DLL →
  windows-host MinIO/imgproxy — active dependency даже после primary
  cutover, не "standby". Backup критично для image-pipeline DR.
- Tool: rclone same pattern как ruvds-backup-daily-kreknin 🟢

iis-migration-to-ruvds scope narrow:
- tandemmebel.ru + www.tandemmebel.ru EXCLUDED из cutover (user-decision)
- Остаются на windows-IIS:8089 неопределённо
- Cert на RUVDS уже импортирован, HTTPS binding existing — idle, traffic
  не пойдёт пока DNS не flipped. Source IIS snolla site нельзя
  decommission'ить полностью пока tandemmebel на нём же (catch-all).
- Scope теперь 24 hostnames для migration (вместо 26).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-24 13:19:11 +03:00

3 Commits