pilonuxt deploy на vds-kzntsv за Traefik. Compose готов (proxy net,
websecure, certresolver letsEncrypt, Host pilonuxt.vds.kzntsv.site, :3000,
GTM погашен на smoke-поддомене). Домен согласован с vitya: temp-поддомен
для smoke, cutover www.pilorama98.ru — отдельным шагом.
Сборка диагностирована, образ НЕ собран — Dockerfile pilonuxt падает в
чистом контейнере (локально замаскировано глоб. yarnrc + сетью):
1. .yarnrc.yml без npmAlwaysAuth:true → YN0041 anonymous (whoami=vitya).
2. Dockerfile не копирует scripts/+src/generated до yarn install →
postinstall Cannot find module scripts/ensure-schema.mjs (YN0009).
По решению vitya сборка отдана pilonuxt (их репо/фикс), за admin — Portainer.
Inbox victor/pilonuxt отправлен с разбором. Задача 🔵 blocked до образа.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Запрос snolla (raw-stream content-api) потребовал MinIO endpoint+креды;
ответ был выводим из вики, но не собран одним куском. Добавлен раздел
«S3 access для клиентских приложений» в minio-imgproxy-on-vds.md:
endpoint (https://minio.kzntsv.site / сырой :9000 / inter minio:9000),
root accessKey + pass-ссылка на secret, форма ключа, ssl/region/pathStyle.
Следующий такой вопрос — grep по вики, без SSH на сервер.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
snolla galleries 404 (imgproxy "Source unreachable"): legacy storageClient
"galleries" = MoreThenCms Local storage class (App_Data\galleries\<siteId>),
never in S3 — products were migrated, galleries weren't. Path A (user pick):
new bucket `galleries`, 301 pilorama98 originals (77 MiB) rclone'd from RUVDS
IIS → s3://galleries/37e6…/<guid>.jpg verbatim. snolla code unchanged
(storageClient=bucket is the working convention). imgproxy smoke from
books-vds: real obj 200 image/webp, fake guid 404. Other sites unmigrated
(scope). Inbox sent to victor/snolla.
- close [migrate-gallery-originals-to-s3] (scope pilorama98)
- NEW .wiki concept galleries-storage-class-local-not-s3
- fix stale minio-imgproxy-on-vds (pipeline on books-vds since 2026-06-08)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
bookva-es (отдельный ES 7.10, Portainer stack 37) не снапшотился — path.repo
не сконфигурирован. Пересоздан через Portainer API (PUT /api/stacks/37) с
path.repo=/snapshots + bind /usr/docker/bookva-es/snapshots (uid 1000:0);
внешний том bookva-es-data сохранён (epz/products целы). Repo kreknin
зарегистрирован.
Добавлен Step 2b (bookva-es snapshot + prune) в run.sh.
Gotcha пойман на проверке приёмника ДО коммита: оба ES-каталога называются
`snapshots` → как отдельные rsync-источники сливаются в один dest/snapshots/
и портят оба репо (видно по двойному index-N). Fix: источник bookva-es =
родительский /usr/docker/bookva-es (basename bookva-es → dest/bookva-es/snapshots/).
Verified green: BOOKS-VDS backup OK 10m28s, на kreknin раздельно
snapshots/ (slovo, index-41, 795M) + bookva-es/snapshots/ (index-4, 801M),
по одному index-N в каждом → оба независимо рестораблельны.
Закрывает .tasks/bookva-es-snapshot-repo.md (🟢). bookva tenant полностью
покрыт (db/mongo/minio/es).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
bookva tenant (bookva-db/mongo/es/minio) поднят 26.05 при cutover-prep, а
books-vds backup написан 25.05 — до bookva. Покрытие не расширили; gap висел
wiki-follow-up #2 ~2.5 недели. Тот же класс, что MSSQL: новый stateful, бэкап
отстал, повешен как заметка.
Добавлено в scripts/books-vds-backup-daily-kreknin/run.sh (deploy == repo,
бэкап .bak-pre-bookva):
- bookva-db: mariadb-dump (тот же BOOKS_DB_ROOT_PASSWORD, стек клонирован)
- bookva-mongo: mongodump --archive (no-auth)
- bookva-minio: raw rsync named volume bookva-minio-data (immutable objects)
Каждая команда протестирована изолированно ДО внесения в скрипт. Verified
зелёным прогоном: BOOKS-VDS backup OK 10m42s, артефакты на kreknin
(bookva-mariadb 257M, bookva-mongo 3.2M, bookva-minio 1.4G).
bookva-es отложен (path.repo не сконфигурирован, нужен ES restart через
Portainer) -> .tasks/bookva-es-snapshot-repo.md. Покрыт по факту: индексы
epz/products идентичны slovo ES, который снапшотится.
- .wiki/entities/books-vds.md: Backup-секция + follow-up #2 частично закрыт
- .wiki/concepts/backup-inventory-2026-06.md: bookva row -> done
- .tasks/bookva-es-snapshot-repo.md: backlog для ES-снапшота
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
VDS daily backup пал с 12.06 (line 108, exit 1): mssql-блок (added 11.06,
commit f8ca0794) использовал `WITH ... INIT`, упирался в компрессованный
media-header майских .bak (созданы WITH COMPRESSION на Developer-источнике).
Express не пишет в compression-форматированный media set -> Msg 1844, молчаливый
провал первым же cron-запуском. 5 боевых CMS-баз 3 недели без offsite-копии.
Fix: INIT -> FORMAT (всегда новый media set, иммунно к остаткам). Прогон
verified зелёным: VDS backup OK 95m41s, все 5 .bak на kreknin
(MoreThenCms 910M, StayerCalculator 528M, StayerPrice 39M, TireService 4.5M,
stostayer 990M), speedup 22.62 (--link-dest хардлинкует).
- scripts/vds-backup-rsync-kreknin/run.sh: синхронизирован с задеплоенным
(mssql-блока в репо не было); FORMAT
- .wiki/concepts/mssql-on-vds.md: gotcha #2 (INIT vs FORMAT) + backup-gap
- .wiki/concepts/backup-inventory-2026-06.md: новая — карта estate × что реально
бэкапится (с доказательством); триаж дыр
- openwrt UCI backup настроен (cron 03:30 -> kreknin, restricted forced-command
key) — документация в entity + inventory
- .tasks/kreknin-self-backup.md: backlog #1 SPOF (приёмник сам не бэкапится)
- STATUS.md: incident + audit summary
Урок: бэкап-шаг не готов, пока не предъявлен лог одного реального успеха;
прод-крон не должен быть первым тестом бэкап-пути.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Cross-ref the practical auth runbook (projects-wiki concepts/verdaccio-token-usage)
from the local postmortem. lifecycle = why, token-usage = how.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Yarn >=4.16 npmMinimalAgeGate (default 1d) карантинит версии <24ч на
КЛИЕНТЕ — независимый от auth gate #2 (после 401). Серверного карантина
в verdaccio нет; первичная гипотеза опровергнута пруфом из yarn.js.
Глобальный config (per-scope не работает), fix npmMinimalAgeGate:0.
Backlink из verdaccio-token-lifecycle + index/log.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
disaster-restore вернул тарболлы но древний/пустой packument →
publish свежей версии EEXISTS 409. Fix: снять только коллизирующий
целевой .tgz (backup first), republish; НЕ rm -rf каталог.
Применено к @snollajs/{data,mailer,numbering,content-api}.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- .admin claim-guard pushed + verified: claim-gate run over real .admin board
skips all 4 claimable .admin tasks with reason=needs-human (zero slip-through).
- Always-on bring-up started (docker mongo+reconciler) then torn down per user
"don't start pollers without permission". Host task-runner never started — no
claim/spawn occurred. .env/secrets.env/guard left in place, ready.
- Worker config decided: this workstation; AGENT_RUNTIME=claude-opus;
AGENT_CAPABILITIES=needs-internet; headless claude login suffices.
- Caught a stale-claimable task (MoreThenCms cms-maljarka-https-mode-bug-fix was
⚪ ready though the bug was fixed today) — closed it. Lesson recorded: sweep
boards for stale-claimable before enabling always-on.
- GATE: starting pollers awaits explicit user grant.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Take task to 🔴, create per-task file (was on board w/o file).
- DRY_RUN smoke passed end-to-end on this workstation (host task-runner :3000,
one tick via POST/GET). Real shared-board read; preview candidate
OpeItcLoc03/MoreThenCms/cms-maljarka-https-mode-bug-fix; no claim/spawn.
- Finding: .admin had NO policy.toml; claim gate ignores consult_policy, so the
HARD ".admin excluded from autonomous claim" guard was UNENFORCED. Add
.tasks/policy.toml default_weight="needs-human" → every .admin task fails the
L3 needs-human claim gate. Gates autonomous poller only; INERT until pushed
(claim reads policy.toml via Gitea backend, not local disk).
- Build-prereq in task Next-action was a phantom: runner is plain JS (no tsc);
only projects-meta-mcp needs build and its dist/ already exists.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The F3 smoke false-failed: system VPN proxy swallows Invoke-WebRequest
to localhost (wiki bug #7), returning empty -> gate aborted before E/M.
Verified out-of-band: :8091 -> HTTP 200 (real stostayer.old page), so
the repoint actually succeeded. Switched smoke to curl.exe --noproxy.
Made F2 idempotent (only repoint if still localhost) so re-runs don't
clobber the original localhost backup.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Verified `pass` decrypts in the agent bash env; applied the VDS
orphaned-user fix (snolla@stostayer -> mapped) directly as sa, password
passed via env var (never echoed). Verified snolla can now open VDS
stostayer (128 tables). finish-elevated.ps1 no longer needs sa/pass or
any prompt - it only runs the elevated IIS/web.config/docker steps with
a snolla->stostayer pre-gate.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
In an elevated shell `bash` resolves to WSL bash (not Git bash where
`pass` lives); its stderr proxy warning + ErrorActionPreference=Stop
aborted the script at the pass-fetch line. Replaced with a hidden
Read-Host prompt; set ErrorActionPreference=Continue around the docker
teardown so native stderr can't abort it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Cyrillic comments saved as UTF-8-no-BOM were mis-parsed by Windows
PowerShell 5.1 (read as cp1251) -> parser error at "(~28 GB)". Rewrote
the script with ASCII-only text; verified 0 non-ASCII bytes + clean AST
parse. Also removed traefik teardown step from the script (local traefik
already removed per user decision); kept lightrag + mutable-dev VM.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Root cause (NOT a migration defect): MoreThenCms tenant `maljarka`
had `dbo.Sites.SettingsData = NULL` (no `httpSecure` block) -> on a
real HTTPS request SnollaMiddleware throws KeyNotFoundException ->
502. HTTP served 200 fine. DNS/TLS/IIS binding all correct.
Fix applied to shared MSSQL (mssql.kzntsv.site): UPDATE Sites set
SettingsData with httpSecure{enableHttps:true,...} + recycle snolla
pool. Verified 443->200 server-local and external via 80.64.31.36;
kupimknigi untouched. Audit: maljarka was the only NULL-settings
site with a :443 binding (of 25); rimiz degraded for another reason.
- new concept: morethencms-null-settingsdata-https-502
- entities/ruvds-iis-host: maljarka moved from Degraded -> fixed
- index.md + log.md + STATUS.md + NEXT_SESSION.md updated
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
3 classic chacha20-ietf-poly1305 SS inbounds (ports 32031/32/33),
one ss:// key each, per-key revocable. Protocol e2e-tested OK;
RF reachability unverified (SS DPI-blocked in RF on this node).
Keys/passwords in pass nl-vds-3xui/full-env.
Also flagged undocumented VLESS:13027 inbound found in DB.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Stood up a permanent self-renewing Let's Encrypt pipeline on the RUVDS
IIS host, replacing the manual traefik acme.json -> PFX import and
closing the 2026-07-22 cert-expiry deadline (new 25-SAN cert valid to
2026-09-03, SYSTEM scheduled task renews 55 days before expiry).
Key obstacle: the MoreThenCms OWIN catch-all (owin:HandleAllRequests)
swallowed /.well-known/acme-challenge/. Solved by carving the challenge
path into a separate IIS application in a No-Managed-Code app pool, plus
patching win-acme's Web_Config.xml template to remove the inherited Owin
handler. Staging + prod validation green for all 25 hostnames; live TLS
smoke confirms the new cert is served (incl degraded maljarka/rimiz).
- scripts/iis-migration-to-ruvds/03-ruvds-winacme.ps1 (idempotent setup)
- scripts/iis-migration-to-ruvds/winacme-Web_Config.xml (patched template)
- .wiki/concepts/winacme-iis-owin-catchall-http01.md (recipe + gotchas)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
All 25 hostnames (tandemmebel + entire snolla.com zone) now resolve to
RUVDS (80.64.31.36) authoritatively on ns1.reg.ru; nothing left on
windows-source authoritatively. Google cache tail draining for
on./tandemmebel.snolla.com. Source kept as warm rollback per user
decision; decommission + win-acme LE renewal pending soak.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
tandemmebel.ru/www/maljarka resolve to RUVDS (80.64.31.36) on
authoritative + all public resolvers. RUVDS serves 200 OK; maljarka
502 is pre-existing CMS defect, not a cutover regression. Supersedes
the 2026-05-24 scope-exception. Source left as warm rollback per
user decision (shared catch-all, 11 *.snolla.com still resolve here).
Balance: 14 hostnames on RUVDS / 11 on windows-source.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- new sources/nl-vds-3xui-setup-2026-06-05.md (full chronicle; HONEST outcome:
у реальных клиентов из РФ работает только plain VLESS 32030; Reality/MTProto/
SOCKS не поднялись)
- new concepts/proxy-debugging-test-the-real-client.md (anti-pattern: own curl/
standalone tests passed while user's real clients failed; overclaim + bad
MSS-clamp fix that broke things)
- rewrote entities/nl-vds-3xui.md — removed false "Reality verified/fixed" &
"mtg works" claims; honest status table; MSS-clamp removed
- caveat added to reality-pq concept (disabling PQ != working Reality for GUI
clients); index.md + log.md updated
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Confirmed by experiment: Reality on :443 worked ~12min then died (all
timeouts via live v2rayN); moved inbound to :2053 and verified from same
RU PC/core -> exit NL, google 200, 10MB @5.3MB/s. RKN port-blocks :443
dynamically. New X25519 share link (port 2053) in pass. Caveat: 2053 may
also get flagged under heavy use; rotate port if it dies.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Root cause of "Reality fails on client": v2rayN 7.19.5 + phone apps do NOT emit
mldsa65Verify to the xray core, so they can't auth to a PQ-mandated REALITY
inbound (only plain VLESS 32030 worked). Replica matrix: noPQ+no-verify=204,
PQ+no-verify=000, noPQ+with-verify=000. Removed mldsa65Seed from inbound id=1 ->
standard Reality X25519. Verified verify-less client through real :443 -> 204.
Fresh X25519 share-link generated for re-import. Wiki concept updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
SOCKS5 works server-side but DPI on user's path blocks it -> stood up mtg
v2.2.8 as systemd service (DynamicUser, Restart=always), FakeTLS domain
www.cloudflare.com. Verified: openssl probe -> valid TLS1.3 CN=www.cloudflare.com
(indistinguishable from real HTTPS). Secret + tg link in pass.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Read-only diagnosis complete, server untouched. Root cause: ML-DSA-65 (PQ)
incompatible with dest www.intel.com (Akamai). Fix (intel->microsoft) staged
on board, not applied. Plain VLESS 32030 works.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
