OpeItcLoc03/admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
162 Commits 1 Branch 0 Tags
fc245c23c7f0e4449483762f3f2dfd6926796e7a
Commit Graph

13 Commits

Author SHA1 Message Date
vitya
fc245c23c7 fix(nl-vds-3xui): apply Reality dest fix + rotate creds (server-side done) 
Per user "и то и другое":
- Reality 443 dest www.intel.com -> www.microsoft.com (x-ui.db + restart),
  verified end-to-end tunnel through real :443 (SNI microsoft) -> HTTP 204.
  ML-DSA-65 kept. Plain VLESS 32030 unaffected (xray restarted, listening).
- Rotated leaked creds: root SSH password, panel username+password (bcrypt),
  panel JWT secret (kills install API token + sessions). New creds in
  pass nl-vds-3xui/full-env; old SSH pass now rejected; db backed up on server.
- Remaining client-side: user sets v2rayN profile pqmkayaxo2 SNI -> microsoft.

Task fix-nl-vds-reality-pq-dest -> 🟡 (awaiting client-side + confirm).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-05 11:45:44 +03:00
vitya
4fc7cbf688 wiki(nl-vds-3xui): new NL 3x-UI node + Reality PQ×dest root-cause 
Reality 443 inbound silently fails: ML-DSA-65 (post-quantum) ClientHello
key-share X25519MLKEM768 relayed to dest www.intel.com (Akamai) -> HRR ->
borrowed-TLS handshake never completes. Plain VLESS 32030 unaffected.
Isolated via replica xray pair (matrix: intel+PQ is the only failing cell).
Fix (NOT applied, awaiting user): switch dest/SNI -> www.microsoft.com
(PQ-capable, verified) on both inbound and client profile.

- new entities/nl-vds-3xui.md
- new concepts/reality-pq-mldsa65-dest-incompatibility.md
- index.md + log.md updated
- creds saved to pass nl-vds-3xui/full-env (not in repo)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-05 11:26:16 +03:00
vitya
b0559fdbed wiki(books-vds): disk-full incident 2026-06-04 + Bookva->slovo job scoping 
Provider Rusonyx alert (96% used). Reclaimed ~64G: truncated runaway
task-runner json-logs (38G) + removed orphan BuildKit builders/volumes
(26G). Added logrotate copytruncate guard.

Root cause: books-task-runner (slovo) error-looped on Ozon seller Bookva
(50542) whose key was intentionally swapped to slovo's as an access
revocation. Spam came from unscoped legacy seller-iterating agenda jobs.
Fixed: idSeller:2 on 5 jobs (deploy-durable, non-_fromConfig). Verified
6448 errors/min -> 0.

Group-V (channel-driven) confirmed non-issue: Bookva channel is type=ym,
no active Bookva-ozon channel exists.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-04 12:28:30 +03:00
vitya
11554d45ac wiki(ingest): vds-kzntsv network-stack mismatch RCA + ifupdown anti-pattern 
Incident 2026-05-28 ~05:45–13:52 MSK на vds-kzntsv. ~2.5ч активного outage
+ ~5.5ч на эфемерной статике до окончательного fix хостером.

Revised RCA: наш netplan+systemd-networkd конфликтовал с provider's expected
ifupdown stack. Их start/ipadd procedure ожидает чистый ifupdown и не может
auto-recover когда networkd «держит» eth0. 8 дней работало потому что
networkd сам тянул DHCP. Когда что-то на стороне Rusonyx разорвало
DHCP-binding — auto-recovery не сработала.

Fix: systemctl mask netplan + systemd-networkd* (на running system без stop —
IP и SSH сохранились), Rusonyx ребутнул VM и положил чистый
/etc/network/interfaces.d/ifcfg-eth0 через свой start/ipadd. Netmask /18,
gw 89.253.192.1, чистый ifupdown.

Wiki:
- NEW concepts/vds-kzntsv-dhcp-outage-2026-05-28 — full RCA + recovery
  runbook (эфемерная статика + permanent-fix via ifupdown) + diagnostic
  dot-graph + revised lessons-learned + anti-pattern
- NEW sources/vds-kzntsv-incident-2026-05-28 — timeline 05:25 backup OK →
  08:43 statics → 13:52 final reset; provider's ifcfg-eth0 content; ticket
  text reference
- UPDATE entities/vds-kzntsv — mask /18, ifupdown stack, kernel cmdline
  net.ifnames=0 объясняет eth0 naming, hypervisor hw80, pass-store путь,
  Known issues §
- UPDATE concepts/rusonyx-vps-onboarding-quirks — quirk #9 переписан про
  /18 layout + canonical ifcfg, quirk #10 NEW про ifupdown vs netplan
  stack choice + bootstrap mask commands
- UPDATE index.md + log.md

Tasks:
- STATUS header: incident RESOLVED summary
- NEXT_SESSION: следующая сессия — cleanup netplan-artifacts (optional),
  registry GC (~20G pending), board-viewer-build unhealthy разбор

Memory (out-of-repo): vds-kzntsv-rusonyx-network-recovery переписан с
revised RCA — canonical bootstrap step «mask netplan/networkd» для всех
Rusonyx Ubuntu VDS.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-28 14:12:14 +03:00
vitya
3246dabbb5 tasks(migrate-elasticsearch-to-books-vds): 🟢 closed — 3 indices Windows→books VDS 
928616 docs (artmone 2621 / epz 820604 / products 105922) migrated via
reindex-from-remote. Pre-migration snapshot к kreknin repo, target stack 33
получил `reindex.remote.whitelist=elasticold.kzntsv.site:443` через Portainer
API. Consumer configs (books-api + books-task-runner + books-job-scheduler)
sed'd elasticold→elasticsearch.kzntsv.site, 3 containers restarted.
Per-doc byte-match verified, internal smoke от books-api → новый ES 200 OK.
Source ES оставлен running per user (rollback ready).
 2026-05-25 11:33:17 +03:00
vitya
86c44c3db9 tasks(books-vds-stacks-to-portainer): close 🟢 — 6 stacks migrated SSH-compose → Portainer 
Phase 2 ladder executed 2026-05-25 (~10min end-to-end, lowest → highest blast radius):
  proxy-chain (id 28) → imgproxy (29) → minio (30) → mongo (31) → books-db (32) → elasticsearch (33)

All 6 smoked green. books-api + books-task-runner reconnected transparently through
mongo + books-db recreate windows. ES snapshot repo `kreknin` preserved through bind.

Phase 3:
- created .wiki/concepts/portainer-stack-management-books-vds.md (pattern application + diffs from vds-kzntsv)
- entity books-vds.md: 6 stacks flipped SSH-managed → Portainer-managed
- index.md: new concept entry

Pre-flight quirks documented (CentOS 7 yum dead, no jq, no docker login).

Acceptance: 4/5 verified, backup pipeline (#5) verified by inspection (bind paths
preserved) — full pipeline run pending next 06:00 MSK.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-25 10:27:23 +03:00
vitya
bfb942cd1d tasks(books-vds-stacks-to-portainer): Phase 0 probe complete, +imgproxy scope 
Phase 0 findings:
- 6 target stacks (5 original + imgproxy discovered on /usr/docker/imgproxy/)
- All bind-only, no env_file, no surprise named volumes
- Portainer PAT works via X-API-Key; endpoint 1 = books VDS, endpoint 6 = stostayer (not ours, user-confirmed)
- mongo container lost image tag (digest only) — fresh mongo:4.2 pull at recreate acceptable
- Q1 (endpoint 6) + Q2 (volume preservation) closed

Updated entity books-vds: imgproxy added to SSH-managed inventory (was missing).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-25 10:12:55 +03:00
vitya
fe41ee4422 backup(books-vds): daily 06:00 MSK pipeline to kreknin live 🟢 
- scripts/books-vds-backup-daily-kreknin/ — run.sh + .env.example + README
- ES path.repo bootstrap (one-time stack edit, snapshot repo 'kreknin' registered)
- curl smtps://yandex:465 email (CRLF + Date headers, no msmtp dep on CentOS 7)
- StrictHostKeyChecking=yes + pre-populated known_hosts (CentOS 7 no accept-new)
- cron /etc/cron.d/books-vds-backup live, initial sync 4.87 GB in 13m28s, ntfy push sent
- wiki: entities/books-vds.md + sources/books-vds-backup-daily-kreknin-2026-05-25.md created
- wiki: concepts/books-ssh-access → vds-kzntsv-ssh-access (was lying about books on vds-kzntsv)
- .tasks/books-vds-backup-daily-kreknin.md closed 🟢 pending phone-side verify

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-25 09:37:16 +03:00
vitya
22786e1865 wiki(ingest): RUVDS IIS migration + daily backup pipeline 
- entities/ruvds-iis-host (NEW) — 80.64.31.36, Win Server 2025 Core,
  25 SNI HTTPS bindings, 2/24 hostnames DNS-flipped
- sources/iis-migration-to-ruvds-2026-05-23 (NEW) — chronology,
  SSH/scp pivot после home-ISP outbound 445 block
- sources/ruvds-backup-daily-kreknin-2026-05-24 (NEW) — rclone+SFTP
  SYSTEM task daily 04:30, ntfy общий канал
- concepts/traefik-acme-json-to-iis-cert-import (NEW) — PFX + SNI
  recipe
- concepts/windows-server-2025-core-bootstrap — SMB deprecate,
  HTTP middlebox warning, HTTP/2 note; backup/cert open-Qs закрыты
- entities/windows-recovery-host — partial-cutover state,
  imgproxy SPOF carve-out, tandemmebel indefinitely здесь
- overview / index / log — catalog refresh

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-24 23:31:14 +03:00
vitya
74cf219533 wiki(concepts): ingest ocis-on-vds-deploy-recipe + entity refresh 
New concept page documents the oCIS-on-VDS deploy pattern with the 4
non-obvious gotchas surfaced during owncloud-vds-deploy:

  1. UID mismatch — image ocis-user is 1000, host vitya is 1001 →
     compose `user: "1001:1001"` override (alt chown rejected as orphan-UID)
  2. PROXY_TLS=false — explicit per docs when reverse proxy terminates HTTPS
  3. PROXY_ENABLE_BASIC_AUTH=true — required for WebDAV/LibreGraph API
  4. LibreGraph POST /graph/v1.0/users — only way to create users (no CLI)

Plus decomposedfs storage layout, atomic-revert recipe, backup integration
note. Source: .tasks/owncloud-vds-deploy.md.

entities/vds-kzntsv.md updated: stack table + hostnames + file layout
include owncloud row.

index.md catalog + log.md ingest entry refreshed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-21 19:29:43 +03:00
vitya
d25c0577c8 import: .wiki/entities/ from MoreThenCms via subtree-split 
git-subtree-dir: .wiki/entities
git-subtree-mainline: 6d8d75474d
git-subtree-split: 24661c10fb
 2026-05-21 13:46:38 +03:00
vitya
6d8d75474d prep: clear gitkeep before subtree import 2026-05-21 13:46:33 +03:00
vitya
34e779e002 bootstrap: admin project skeleton (CLAUDE.md, .wiki/, .tasks/) 2026-05-21 13:17:45 +03:00