vitya
b7b8e27a27
SSH audit на shared VDS vds-kzntsv (89.253.255.94, hosts books Slovo + Bookva в shared compose-стеке) перед Phase 3 cutover'ом tenant-split. Findings: - 1 retained key: vitya@DESKTOP-NSEF0UK (core dev, sole admin) - 0 keys to revoke — никаких analyst / former employee / unknown keys - 1 cosmetic cleanup: removed dead root authorized_keys entry (was duplicate of vitya's key, dead из-за `permitrootlogin no`) - sshd hardening verified via `sshd -T` (effective config: root-no, password-no, kbd-no). **Gotcha** noted: raw grep of /etc/ssh/sshd_config shows defaults; sshd_config.d/ overrides делают effective. Future audits use `sshd -T`, not raw grep. - fail2ban active, 2670 failed / 37 banned hist, currently 0 - last 7 days journalctl ssh: только vitya@94.19.247.14 (мой home IP) Acceptance per spec (Фаза 3, шаг 2 tenant-split): ✅ authorized_keys reviewed ✅ Non-core keys revoked (N/A — none existed) ✅ Analyst keys revoked (N/A — never issued) ✅ Documented in .wiki/concepts/books-ssh-access.md Ingest: .wiki/concepts/books-ssh-access.md — retained keys table + sshd state + fail2ban + login history + add/revoke processes + cross-refs. Logged + indexed. STATUS.md ⚪ block → ARCHIVE.md (per-task file kept in .tasks/). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
5.0 KiB
5.0 KiB
Wiki Index
Catalog of all wiki pages. One line per page, organized by type. Updated on every ingest / new page.
Overview
- overview.md — project overview
Entities
- dead-synology-diskstation — мёртвая Synology DiskStation (source NAS)
- kreknin-synology — Kreknin Synology (backup target + DDNS)
- openwrt-router — OpenWRT Router (192.168.1.1)
- snolla-recovery-vm — Snolla Recovery VM (VirtualBox, savestate'нута 2026-05-21 после 36h soak)
- vds-kzntsv — VDS kzntsv (Rusonyx 160 NVMe cloud server)
- windows-recovery-host — Windows Recovery Host (рабочий PC пользователя)
Concepts
- admin-infra-project — design + migration plan для OpeItcLoc03/admin (canonical)
- books-ssh-access — SSH access audit на shared VDS (books Slovo+Bookva), retained keys + add/revoke processes
- compose-bcrypt-escape-trap — Docker Compose ест
$в bcrypt hashes - db-tls-self-signed-via-traefik-raw-tcp — DB TLS через traefik raw TCP с self-signed certs
- docker-host-loopback-detect — Docker host-loopback detection — как доказать что host.docker.internal не петля
- future-resilient-architecture-goals — fault-tolerance roadmap placeholder (расширяется через
[resilience-roadmap-design]) - hyper-backup-structure-and-recovery — Hyper Backup — структура репо и стратегия восстановления
- iis-migration-2026-05-19-postmortem — post-mortem миграции CMS на нативный IIS, 2026-05-19
- minio-imgproxy-on-vds — MinIO+imgproxy stack на VDS, миграция с upgrade 2020→2025 + DNS swap pending
- mssql-container-data-restore — MSSQL контейнер с восстановленными production data — паттерн
- mssql-on-vds — MSSQL Express 2022 Linux на VDS — миграция + login orphan fix + traefik TCP gotchas
- ocis-on-vds-deploy-recipe — oCIS на VDS — deploy recipe + non-obvious gotchas (UID 1001 vs 1000, basic auth, LibreGraph user-create)
- portainer-2.21-admin-password-regression — Portainer 2.21
--admin-passwordregression + min 12-char policy - portainer-stack-management-vds — Portainer-managed stacks на VDS — canonical pattern + migration script + gotchas
- recovery-architecture-snapshot — текущая recovery architecture (2026-05-19/21, attempt 2)
- registry-gc-mount-and-modify-flag — Docker Registry GC mount layout +
-mflag - rusonyx-vps-onboarding-quirks — Rusonyx VPS onboarding quirks (Astra Облако / myvm.rusonyx.ru)
- traefik-file-watch-wsl2-broken — Traefik file-watch broken под Docker Desktop Windows (WSL2 9p mount)
- traefik-on-windows-docker-desktop — Traefik на Windows Docker Desktop — нюансы
- traefik-tcp-passthrough-vs-starttls — Traefik TCP passthrough vs STARTTLS-protocols
- vbox-windows-stability-tuning — VirtualBox + Windows-гость — нюансы стабильности cross-hypervisor миграции
- verdaccio-prune-semantics — Verdaccio prune semantics — proxied vs locally-published
- wd40efax-smr-cascade — WD40EFAX SMR Cascade — root cause NAS failure 2026-05-18
- windows-server-2025-core-bootstrap — Win Server 2025 Core (RUVDS) — bootstrap для IIS-хоста: default-blockers + transfer-методов матрица
Packages
Sources
- iis-host-migration-2026-05-19 — IIS Host Migration Session 2026-05-19 chronology
- nas-recovery-session-2026-05-18 — NAS Recovery Session 2026-05-18/19 chronology
- vds-kzntsv-bootstrap-2026-05-20 — VDS bootstrap session 2026-05-20 chronology