diff --git a/zarya-code.xml b/zarya-code.xml
deleted file mode 100644
index b694890..0000000
--- a/zarya-code.xml
+++ /dev/null
@@ -1,1412 +0,0 @@
-This file is a merged representation of a subset of the codebase, containing specifically included files and files not matching ignore patterns, combined into a single document by Repomix.
-The content has been processed where empty lines have been removed.
-
-
-This section contains a summary of this file.
-
-
-This file contains a packed representation of a subset of the repository's contents that is considered the most important context.
-It is designed to be easily consumable by AI systems for analysis, code review,
-or other automated processes.
-
-
-
-The content is organized as follows:
-1. This summary section
-2. Repository information
-3. Directory structure
-4. Repository files (if enabled)
-5. Multiple file entries, each consisting of:
- - File path as an attribute
- - Full contents of the file
-
-
-
-- This file should be treated as read-only. Any changes should be made to the
- original repository files, not this packed version.
-- When processing this file, use the file path to distinguish
- between different files in the repository.
-- Be aware that this file may contain sensitive information. Handle it with
- the same level of security as you would the original repository.
-
-
-
-- Some files may have been excluded based on .gitignore rules and Repomix's configuration
-- Binary files are not included in this packed representation. Please refer to the Repository Structure section for a complete list of file paths, including binary files
-- Only files matching these patterns are included: bin/**, cmd/**, lib/**, layers/**, state/*.sh, config.env
-- Files matching these patterns are excluded: state/snapshots/**, *.xml
-- Files matching patterns in .gitignore are excluded
-- Files matching default ignore patterns are excluded
-- Empty lines have been removed from all files
-- Files are sorted by Git change count (files with more changes are at the bottom)
-
-
-
-
-
-bin/
- fc
- gg
- op
- zarya
-cmd/
- a.sh
- disks.sh
- errors.sh
- exec.sh
- flux.sh
- git-credential.sh
- logs.sh
- net.sh
- nodes.sh
- pack.sh
- pods.sh
- run.sh
- session.sh
- snap.sh
- unseal.sh
- up.sh
-layers/
- 00_host.sh
- 01_net.sh
- 02_tier0.sh
- 03_talos.sh
- 04_apps.sh
- gc.sh
- reset.sh
-lib/
- common.sh
- kdbx_parser.py
- log.sh
- net.sh
- session.sh
- vault.sh
-state/
- 00_workstation.sh
- 01_pve.sh
- 02_vps.sh
- 03_vyos.sh
- 04_tier0.sh
- 05_k8s.sh
- collect_state.sh
-config.env
-
-
-
-This section contains the contents of the repository's files.
-
-
-#!/bin/bash
-set -euo pipefail
-if [[ $# -eq 0 ]]; then
- echo "Использование: fc <файл>"
- exit 1
-fi
-if [[ -f "$1" ]]; then
- wl-copy < "$1"
- echo "'$1' +++"
-else
- echo "'$1'+++"
-fi
-
-
-
-#!/bin/bash
-set -euo pipefail
-if [[ -z "${1:-}" ]]; then
- echo "Тема СВО не раскрыта: gg \"сообщение\""
- exit 1
-fi
-git add . && git commit -m "$1" && git push
-
-
-
-#!/bin/bash
-set -euo pipefail
-if [[ $# -eq 0 ]]; then
- echo "Использование: op <файл...>"
- exit 1
-fi
-for f in "$@"; do
- printf "file://%s\r\n" "$(realpath "$f")"
-done | wl-copy -t text/uri-list
-
-
-
-#!/bin/bash
-set -euo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-unseal_vault
-run_isolated bash -c "cd '${REPO_ROOT}/tofu' && tofu apply $*"
-
-
-
-#!/bin/bash
-set -uo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-echo -e "${BLUE}=== ФИЗИЧЕСКИЕ ПУЛЫ ХОСТА PROXMOX (ZFS) ===${NC}"
-ssh -n -o BatchMode=yes -o ConnectTimeout=2 proxmox "zpool list -o name,size,alloc,free,cap,health" 2>/dev/null || log_err "PVE недоступен"
-echo ""
-echo -e "${BLUE}=== ПОЛЬЗОВАТЕЛЬСКИЕ ДАТАСЕТЫ TIER-0 (/astra/data) ===${NC}"
-ssh -n -o BatchMode=yes -o ConnectTimeout=2 proxmox "zfs list -o name,used,avail,refer,mountpoint -r astra/data" 2>/dev/null || true
-echo ""
-echo -e "${BLUE}=== ТОМА ДИСКОВ KUBERNETES (ZVOL) ===${NC}"
-kubectl get pvc -A -o custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,STATUS:.status.phase,VOLUME:.spec.volumeName,SIZE:.status.capacity.storage 2>/dev/null || log_err "K8s API недоступен"
-
-
-
-#!/bin/bash
-set -uo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-has_errors=false
-echo -e "${YELLOW}=== ТРИАЖ АВАРИЙ И СБОЕВ (K8s / Host / VyOS) ===${NC}"
-bad_pods=$(kubectl get pods -A --field-selector=status.phase!=Running,status.phase!=Succeeded --no-headers 2>/dev/null | grep -v 'Completed' || true)
-if [[ -n "${bad_pods}" ]]; then
- has_errors=true
- echo -e "${RED}[K8S] Проблемные поды:${NC}"
- echo "${bad_pods}" | awk '{printf " %-16s %-36s %s\n", $1, $2, $3}'
-fi
-pve_failed=$(ssh -n -o BatchMode=yes -o ConnectTimeout=1 proxmox "systemctl --failed --no-legend --plain" 2>/dev/null || echo "UNREACHABLE")
-if [[ "${pve_failed}" == "UNREACHABLE" ]]; then
- has_errors=true
- echo -e "${RED}[PVE] Гипервизор недоступен по SSH${NC}"
-elif [[ -n "${pve_failed}" ]]; then
- has_errors=true
- echo -e "${RED}[PVE] Упавшие systemd-сервисы:${NC}"
- echo "${pve_failed}" | awk '{print " " $1}'
-fi
-vyos_failed=$(ssh -n -o BatchMode=yes -o ConnectTimeout=1 vyos_router "systemctl --failed --no-legend --plain" 2>/dev/null || echo "UNREACHABLE")
-if [[ "${vyos_failed}" == "UNREACHABLE" ]]; then
- has_errors=true
- echo -e "${RED}[VyOS] Роутер недоступен по SSH${NC}"
-elif [[ -n "${vyos_failed}" ]]; then
- has_errors=true
- echo -e "${RED}[VyOS] Упавшие systemd-сервисы:${NC}"
- echo "${vyos_failed}" | awk '{print " " $1}'
-fi
-if [[ "$has_errors" == false ]]; then
- echo -e "${GREEN}✔ Все системы в норме. Сбоев не обнаружено.${NC}"
-fi
-
-
-
-#!/bin/bash
-set -euo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-if [[ $# -eq 0 ]]; then
- log_err "Использование: z exec <команда> [аргументы...]"
- exit 1
-fi
-run_isolated "$@"
-
-
-
-#!/bin/bash
-set -uo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-subcmd="${1:-status}"
-shift || true
-case "${subcmd}" in
- sync|reconcile|s)
- log_info "Принудительная конвергенция FluxCD..."
- flux reconcile source git atlas-repo -n flux-system 2>/dev/null || true
- flux reconcile kustomization infra-sync -n flux-system 2>/dev/null || true
- flux reconcile kustomization apps-sync -n flux-system 2>/dev/null || true
- log_ok "Синхронизация завершена."
- ;;
- logs|log|l)
- log_info "Стриминг логов kustomize-controller..."
- exec kubectl -n flux-system logs -l app.kubernetes.io/name=kustomize-controller --tail=50 -f
- ;;
- status|st)
- echo -e "${BLUE}=== СТАТУС РЕПОЗИТОРИЕВ И KUSTOMIZATION (FLUX) ===${NC}"
- kubectl -n flux-system get gitrepositories,kustomizations,helmreleases 2>/dev/null || log_err "Flux недоступен"
- ;;
- *)
- kubectl -n flux-system get kustomizations 2>/dev/null || log_err "Flux недоступен"
- ;;
-esac
-
-
-
-#!/bin/bash
-set -uo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-query="${1:-}"
-if [[ -z "${query}" ]]; then
- log_err "Использование: z logs <сервис> [-f] [-t <строки>]"
- exit 1
-fi
-shift
-follow_arg=""
-tail_val="50"
-while [[ $# -gt 0 ]]; do
- case "$1" in
- -f|--follow) follow_arg="-f"; shift ;;
- -t|--tail) tail_val="$2"; shift 2 ;;
- *) shift ;;
- esac
-done
-pod_info=$(kubectl get pods -A --no-headers 2>/dev/null | awk -v q="${query}" 'tolower($1) ~ tolower(q) || tolower($2) ~ tolower(q) {print $1, $2; exit}')
-if [[ -z "${pod_info}" ]]; then
- log_err "Под с именем '${query}' не найден ни в одном namespace."
- exit 1
-fi
-ns=$(echo "${pod_info}" | awk '{print $1}')
-pod=$(echo "${pod_info}" | awk '{print $2}')
-log_info "Логи ${ns}/${pod} (tail: ${tail_val}):"
-exec kubectl logs -n "${ns}" "${pod}" --tail="${tail_val}" ${follow_arg}
-
-
-
-#!/bin/bash
-set -uo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-echo -e "${BLUE}=== СЕТЕВОЙ РАДАР ИНФРАСТРУКТУРЫ (Таймаут 1 сек) ===${NC}"
-printf "%-22s %-20s %-12s %s\n" "УЗЕЛ" "АДРЕС" "СТАТУС" "ЗАДЕРЖКА"
-echo "------------------------------------------------------------------"
-check_target() {
- local name="$1"
- local host="$2"
- local port="$3"
- local start end dur
- start=$(date +%s%N)
- if nc -z -w 1 "${host}" "${port}" 2>/dev/null; then
- end=$(date +%s%N)
- dur=$(( (end - start) / 1000000 ))
- printf "%-22s %-20s \033[32m%-12s\033[0m %d ms\n" "${name}" "${host}:${port}" "UP" "${dur}"
- else
- printf "%-22s %-20s \033[31m%-12s\033[0m -\n" "${name}" "${host}:${port}" "DOWN"
- fi
-}
-check_target "Proxmox Host (PVE)" "192.168.1.177" 8006
-check_target "Edge Router (VyOS)" "192.168.1.2" 22
-check_target "Technitium DNS" "10.0.10.11" 53
-check_target "OpenBao Vault" "10.0.10.12" 8200
-check_target "Forgejo GitOps" "10.0.10.13" 3000
-check_target "NFS Storage (NAS)" "10.0.10.14" 2049
-check_target "Traefik L2 VIP" "10.0.30.200" 443
-check_target "Perimeter VPS" "153.76.194.24" 443
-
-
-
-#!/bin/bash
-set -u
-watch_mode=false
-while [[ $# -gt 0 ]]; do
- case "$1" in
- -w|--watch) watch_mode=true; shift ;;
- *) shift ;;
- esac
-done
-render_nodes() {
- local raw
- raw=$(kubectl get nodes -L topology.kubernetes.io/zone,topology.kubernetes.io/region 2>/dev/null || true)
- echo "$raw" | awk '
- BEGIN {
- ERR = "\033[38;2;255;46;76m"
- RUN = "\033[38;2;166;227;161m"
- HEAD = "\033[38;2;147;154;183m"
- RST = "\033[0m"
- }
- NR==1 { print HEAD $0 RST; next }
- {
- if ($2 ~ /Ready/ && $2 !~ /NotReady/) {
- print RUN $0 RST
- }
- else {
- print ERR $0 RST
- }
- }'
-}
-if [[ "$watch_mode" == true ]]; then
- trap 'tput cnorm 2>/dev/null || true; echo ""; exit 0' INT TERM
- tput civis 2>/dev/null || true
- clear
- while true; do
- tput cup 0 0 2>/dev/null || true
- render_nodes
- tput ed 2>/dev/null || true
- sleep 1
- done
-else
- render_nodes
-fi
-
-
-
-#!/bin/bash
-set -u
-watch_mode=false
-ns_filter=""
-query=""
-all_namespaces=false
-while [[ $# -gt 0 ]]; do
- case "$1" in
- -w|--watch) watch_mode=true; shift ;;
- -n|--namespace) ns_filter="$2"; shift 2 ;;
- -s|--service) query="$2"; shift 2 ;;
- -A|--all) all_namespaces=true; shift ;;
- all) all_namespaces=true; shift ;;
- *) query="$1"; shift ;;
- esac
-done
-render_pods() {
- local raw
- if [[ "$all_namespaces" == true ]]; then
- raw=$(kubectl get pods -A -o wide 2>/dev/null || true)
- elif [[ -n "$ns_filter" ]]; then
- raw=$(kubectl get pods -n "$ns_filter" -o wide 2>/dev/null || true)
- elif [[ -n "$query" ]]; then
- raw=$(kubectl get pods -A -o wide 2>/dev/null | awk -v q="$query" 'NR==1 || tolower($1) ~ tolower(q) || tolower($2) ~ tolower(q)' || true)
- else
- raw=$(kubectl get pods -A -o wide 2>/dev/null | awk 'NR==1 || ($1 !~ /^(kube-system|flux-system|cert-manager|external-secrets)$/ && $4 != "Completed")' || true)
- fi
- echo "$raw" | awk '
- BEGIN {
- ERR = "\033[38;2;255;46;76m"
- RUN = "\033[38;2;180;190;254m"
- WARN = "\033[38;2;250;179;135m"
- HEAD = "\033[38;2;147;154;183m"
- RST = "\033[0m"
- }
- NR==1 { print HEAD $0 RST; next }
- {
- if ($0 ~ /CrashLoopBackOff|Error|OOMKilled|ImagePullBackOff/) { print ERR $0 RST }
- else if ($0 ~ /ContainerCreating|Pending|Terminating|Init:/ || ($0 ~ /Running/ && $2 ~ /^0\//)) { print WARN $0 RST }
- else if ($0 ~ /Running/) { print RUN $0 RST }
- else { print $0 }
- }'
-}
-if [[ "$watch_mode" == true ]]; then
- trap 'tput cnorm 2>/dev/null || true; echo ""; exit 0' INT TERM
- tput civis 2>/dev/null || true
- clear
- while true; do
- tput cup 0 0 2>/dev/null || true
- render_pods
- tput ed 2>/dev/null || true
- sleep 1
- done
-else
- render_pods
-fi
-
-
-
-#!/bin/bash
-set -euo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-resolve_playbook() {
- local id="$1"
- local found
- found=$(find "${REPO_ROOT}/ansible/playbooks" -maxdepth 1 -name "${id}_*.yml" | head -n1)
- if [[ -z "${found}" ]]; then
- log_err "Плейбук с префиксом [${id}] не найден в ansible/playbooks/"
- exit 1
- fi
- echo "${found}"
-}
-if [[ $# -eq 0 ]] || [[ "${1:-}" == "list" ]]; then
- echo -e "${BLUE}=== Каталог плейбуков (${REPO_ROOT}/ansible/playbooks/) ===${NC}"
- for pb in $(ls -1 "${REPO_ROOT}/ansible/playbooks"/[0-9][0-9]_*.yml 2>/dev/null | sort); do
- echo " $(basename "${pb}")"
- done
- exit 0
-fi
-for id in "$@"; do
- pb_path=$(resolve_playbook "${id}")
- log_info "==> Исполнение: $(basename "${pb_path}")..."
- run_isolated ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${pb_path}"
-done
-log_ok "Плейбуки выполнены."
-
-
-
-#!/bin/bash
-set -euo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-action="${1:-start}"
-shift || true
-case "${action}" in
- start|login)
- hours="${1:-1}"
- ensure_prerequisites
- load_secrets_to_ram "${hours}"
- unseal_vault
- log_ok "Сессия Zarya активна (TTL: ${hours} ч)."
- ;;
- clean|logout)
- rm -f "${RAM_CACHE}" /dev/shm/.atlas_core
- log_ok "RAM-кэш и ключи уничтожены."
- ;;
-esac
-
-
-
-#!/bin/bash
-set -uo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-target="${1:-all}"
-"${ZARYA_DIR}/state/collect_state.sh" "${target}"
-
-
-
-#!/bin/bash
-set -euo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-ensure_prerequisites
-unseal_vault
-
-
-
-#!/bin/bash
-set -euo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-target="${1:-all}"
-case "${target}" in
- host) run_isolated "${ZARYA_DIR}/layers/00_host.sh" ;;
- net) run_isolated "${ZARYA_DIR}/layers/01_net.sh" ;;
- tier0) run_isolated "${ZARYA_DIR}/layers/02_tier0.sh" ;;
- talos) run_isolated "${ZARYA_DIR}/layers/03_talos.sh" ;;
- apps) "${ZARYA_DIR}/layers/04_apps.sh" ;;
- all)
- run_isolated "${ZARYA_DIR}/layers/00_host.sh"
- run_isolated "${ZARYA_DIR}/layers/01_net.sh"
- run_isolated "${ZARYA_DIR}/layers/02_tier0.sh"
- run_isolated "${ZARYA_DIR}/layers/03_talos.sh"
- "${ZARYA_DIR}/layers/04_apps.sh"
- log_ok "Инфраструктура Atlas развернута."
- ;;
- *)
- log_err "Неизвестный слой: ${target}. Доступны: host, net, tier0, talos, apps, all"
- exit 1
- ;;
-esac
-
-
-
-#!/bin/bash
-set -euo pipefail
-source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
-ensure_prerequisites
-load_secrets_to_ram
-log_info "[Layer 0: PVE Host] Подготовка хоста, шаблонов и базовых директорий ZFS..."
-ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/01_pve_host_day0.yml"
-log_info "[Layer 0: PVE Host] Инициализация compute-скелетов ВМ и LXC через OpenTofu..."
-cd "${REPO_ROOT}/tofu" && tofu apply \
- -target=proxmox_virtual_environment_vm.vyos_router \
- -target=proxmox_virtual_environment_container.dns0 \
- -target=proxmox_virtual_environment_container.vault0 \
- -target=proxmox_virtual_environment_container.git0 \
- -target=proxmox_virtual_environment_container.storage0 \
- -target=proxmox_virtual_environment_container.registry0 \
- -target=proxmox_virtual_environment_vm.talos_master_1 \
- -target=proxmox_virtual_environment_vm.talos_worker_1 \
- -target=proxmox_virtual_environment_vm.talos_worker_2 \
- -auto-approve
-log_info "[Layer 0: PVE Host] Применение постоянных ZFS-маунтов (mp) на созданные LXC..."
-ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/01_pve_host_day0.yml"
-log_ok "Layer 0 готов: хост настроен, ВМ и LXC созданы, ZFS смонтирован."
-
-
-
-#!/bin/bash
-set -euo pipefail
-source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
-ensure_prerequisites
-load_secrets_to_ram
-log_info "[Layer 1: VyOS & Perimeter] Накатка конфигурации сети..."
-ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/02_vyos_network_day0.yml"
-log_ok "Layer 1 готов."
-
-
-
-#!/bin/bash
-set -euo pipefail
-source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
-ensure_prerequisites
-load_secrets_to_ram
-log_info "[Layer 2: Tier-0 Air-Gap] Развертывание базовой инфраструктуры (Registry, DNS, Vault)..."
-for pb in 03_zot_registry.yml 04_technitium_dns.yml 05_openbao_vault.yml; do
- ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/${pb}"
-done
-log_info "[Layer 2: Tier-0 Air-Gap] Распечатывание OpenBao Vault..."
-unseal_vault
-log_info "[Layer 2: Tier-0 Air-Gap] Наполнение Vault секретами через OpenTofu..."
-cd "${REPO_ROOT}/tofu" && tofu apply -auto-approve
-log_info "[Layer 2: Tier-0 Air-Gap] Развертывание зависимых сервисов (Forgejo, NAS Storage)..."
-for pb in 06_forgejo_git.yml 07_nas_storage.yml; do
- ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/${pb}"
-done
-log_info "[Layer 2: Tier-0 Air-Gap] Автоматическая первичная синхронизация Git в Forgejo (SEC-03 RAM auth)..."
-CURRENT_BRANCH=$(git -C "${REPO_ROOT}" branch --show-current 2>/dev/null || echo "master")
-git -C "${REPO_ROOT}" push -u http://10.0.10.13:3000/atlas/atlas.git "${CURRENT_BRANCH}" 2>/dev/null || \
- git -C "${REPO_ROOT}" push http://10.0.10.13:3000/atlas/atlas.git "${CURRENT_BRANCH}" 2>/dev/null || true
-log_ok "Layer 2 готов. Базовые сервисы, секреты и GitOps-репозиторий развернуты."
-
-
-
-#!/bin/bash
-set -euo pipefail
-source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
-ensure_prerequisites
-load_secrets_to_ram
-unseal_vault
-log_info "[Layer 3: Talos & Kubernetes] Проверка конфигураций машинных манифестов..."
-if [[ ! -f "${REPO_ROOT}/talos/clusterconfig/controlplane.yaml" ]]; then
- log_info "Генерация машинных конфигураций Talos..."
- cd "${REPO_ROOT}" && talos/generate_config.sh
-fi
-log_info "[Layer 3: Talos & Kubernetes] Бутстрап кластера..."
-cd "${REPO_ROOT}/talos" && ./bootstrap.sh
-sync_k8s_vault_token
-log_ok "Layer 3 готов."
-
-
-
-#!/bin/bash
-set -euo pipefail
-source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
-ensure_prerequisites
-log_info "[Layer 4: Apps] Применение манифестов FluxCD..."
-kubectl apply -f "${REPO_ROOT}/kubernetes/bootstrap/sync.yaml"
-log_ok "Layer 4 готов."
-
-
-
-#!/bin/bash
-set -uo pipefail
-source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
-ensure_prerequisites
-log_info "🧹 Запуск генеральной очистки кластера (dep gc)..."
-# 1. Удаление зомби-нод в статусе NotReady
-NOT_READY_NODES=$(kubectl get nodes --no-headers 2>/dev/null | grep 'NotReady' | awk '{print $1}' || true)
-if [[ -n "${NOT_READY_NODES}" ]]; then
- for node in ${NOT_READY_NODES}; do
- log_warn "Удаляем мертвую ноду: ${node}"
- kubectl delete node "${node}" --timeout=5s 2>/dev/null || true
- done
-fi
-# 2. Мгновенная зачистка зависших в Terminating
-kubectl get pods -A --no-headers 2>/dev/null | awk '/Terminating/ {print $1, $2}' | while read -r ns pod; do
- log_warn "Принудительно удаляем: ${ns}/${pod}"
- kubectl -n "${ns}" delete pod "${pod}" --force --grace-period=0 2>/dev/null || true
-done
-# 3. Сброс бэкоффа для упавших подов (CrashLoopBackOff, Error, OOMKilled, CreateContainerConfigError)
-kubectl get pods -A --no-headers 2>/dev/null | grep -E 'CrashLoopBackOff|Error|OOMKilled|CreateContainerConfigError|ImagePullBackOff' | awk '{print $1, $2}' | while read -r ns pod; do
- log_info "Сбрасываем упавший под: ${ns}/${pod}"
- kubectl -n "${ns}" delete pod "${pod}" --force --grace-period=0 2>/dev/null || true
-done
-# 4. Очистка завершенных одноразовых Job
-COMPLETED_JOBS=$(kubectl get jobs -A --field-selector status.successful=1 --no-headers 2>/dev/null | awk '{print $1, $2}' || true)
-if [[ -n "${COMPLETED_JOBS}" ]]; then
- echo "${COMPLETED_JOBS}" | while read -r ns job; do
- kubectl -n "${ns}" delete job "${job}" >/dev/null 2>&1 || true
- done
-fi
-log_ok "Кластер очищен. Все сервисы пересоздаются против живых БД и NFS."
-
-
-
-#!/bin/bash
-set -euo pipefail
-source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
-RESET_WIPE_HISTORY="${RESET_WIPE_HISTORY:-false}"
-log_warn "ВНИМАНИЕ! Инициирована процедура полного уничтожения инфраструктуры Proxmox VE."
-log_info "Очистка текущей RAM-сессии. Требуется физическая повторная аутентификация..."
-rm -f "${RAM_CACHE}" /dev/shm/.atlas_core
-read -s -p "Master Password для подтверждения сноса: " KP_PASS
-echo ""
-yk_args=()
-if ykman info >/dev/null 2>&1; then
- yk_args=("-y" "2")
- log_info "Приготовьтесь к аппаратному подтверждению (касание YubiKey)..."
-fi
-tmp_verify="/dev/shm/.verify_$$"
-if ! echo "${KP_PASS}" | timeout 15 keepassxc-cli export "${yk_args[@]}" "${KDBX_PATH}" -f xml > "${tmp_verify}" 2>/dev/null; then
- log_err "Аппаратная проверка провалена или таймаут касания. Доступ заблокирован."
- rm -f "${tmp_verify}"
- unset KP_PASS
- if [[ "${RESET_WIPE_HISTORY}" == "true" ]]; then
- history -c 2>/dev/null || true
- fi
- exit 1
-fi
-rm -f "${tmp_verify}"
-unset KP_PASS
-log_ok "Аппаратная проверка YubiKey и пароля подтверждена."
-read -r -p "Введите 'CONFIRM-DESTRUCTION' для безвозвратного уничтожения: " confirm
-if [[ "${confirm}" != "CONFIRM-DESTRUCTION" ]]; then
- log_warn "Отмена операции."
- exit 0
-fi
-log_info "Снятие защиты и уничтожение виртуальных машин и контейнеров на Proxmox..."
-ssh proxmox bash << 'SSHEOF'
-for id in 100 201 202 203; do
- qm stop $id --skiplock 1 2>/dev/null || true
- qm destroy $id --purge 1 --destroy-unreferenced-disks 1 2>/dev/null || true
-done
-for id in 101 102 103 104 105; do
- pct set $id -protection 0 2>/dev/null || true
- pct stop $id --skiplock 1 2>/dev/null || true
- pct destroy $id --purge 1 --force 1 2>/dev/null || true
-done
-SSHEOF
-log_info "Очистка локального стейта OpenTofu..."
-rm -f "${REPO_ROOT}/tofu/terraform.tfstate"* "${REPO_ROOT}/tofu/.terraform.tfstate.lock.info"
-rm -f "${RAM_CACHE}" /dev/shm/.atlas_core
-if [[ "${RESET_WIPE_HISTORY}" == "true" ]]; then
- history -c 2>/dev/null || true
-fi
-log_ok "Сервер зачищен до голого железа."
-
-
-
-#!/bin/bash
-set -euo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-export ATLAS_DIR="${ATLAS_DIR:-$HOME/Projects/atlas}"
-export REPO_ROOT="${ATLAS_DIR}"
-source "${ZARYA_DIR}/config.env" 2>/dev/null || true
-source "${ZARYA_DIR}/lib/log.sh"
-source "${ZARYA_DIR}/lib/net.sh"
-source "${ZARYA_DIR}/lib/vault.sh"
-source "${ZARYA_DIR}/lib/session.sh"
-
-
-
-import sys
-import xml.etree.ElementTree as ET
-import os
-dump_file = sys.argv[1]
-cache_file = sys.argv[2]
-key_file = sys.argv[3]
-ttl_sec = sys.argv[4]
-pve_endpoint = sys.argv[5]
-vault_addr = sys.argv[6]
-tree = ET.parse(dump_file)
-root = tree.getroot()
-for h in root.findall(".//History"):
- h.clear()
-for g in root.findall(".//Group"):
- name = g.find("./Name")
- if name is not None and name.text == "Recycle Bin":
- g.clear()
-entries = {}
-for entry in root.findall(".//Entry"):
- title = ""
- username = ""
- password = ""
- notes = ""
- for string in entry.findall("./String"):
- key_elem = string.find("./Key")
- val_elem = string.find("./Value")
- if key_elem is not None and val_elem is not None and key_elem.text:
- k = key_elem.text
- v = val_elem.text or ""
- if k == "Title": title = v.strip()
- elif k == "UserName": username = v.strip()
- elif k == "Password": password = v.strip()
- elif k == "Notes": notes = v.strip()
- if title and title not in entries:
- entries[title] = {
- "username": username,
- "password": password,
- "notes": notes
- }
-ssh_loaded = False
-for title in ("Atlas Core Key", "AtlasCoreKey", "Atlas Core"):
- entry_data = entries.get(title, {})
- for field in ("password", "notes"):
- val = entry_data.get(field, "")
- if "-----BEGIN" in val or "PRIVATE KEY" in val:
- with open(key_file, "w") as kf:
- kf.write(val.strip() + "\n")
- os.chmod(key_file, 0o600)
- ssh_loaded = True
- break
- if ssh_loaded:
- break
-if not ssh_loaded:
- sys.stderr.write("Внимание: приватный SSH-ключ не найден в полях Password/Notes записи Atlas Core Key.\n")
-with open(cache_file, "w") as f:
- f.write(f"# TTL_SECONDS={ttl_sec}\n")
- f.write(f"export PROXMOX_VE_API_TOKEN={repr(entries.get('ProxmoxAPI', {}).get('password', ''))}\n")
- f.write(f"export TF_VAR_proxmox_api_token={repr(entries.get('ProxmoxAPI', {}).get('password', ''))}\n")
- f.write(f"export TF_VAR_state_passphrase={repr(entries.get('TofuState', {}).get('password', ''))}\n")
- f.write(f"export PROXMOX_VE_ENDPOINT={repr(pve_endpoint)}\n")
- f.write(f"export VAULT_ADDR={repr(vault_addr)}\n")
- f.write(f"export VAULT_TOKEN={repr(entries.get('OpenBaoToken', {}).get('password', ''))}\n")
- f.write(f"export VAULT_UNSEAL_KEY={repr(entries.get('OpenBaoUnseal', {}).get('password', ''))}\n")
- f.write(f"export TECHNITIUM_PASSWORD={repr(entries.get('Technitium', {}).get('password', 'admin'))}\n")
- f.write(f"export TF_VAR_vaultwarden_admin_token={repr(entries.get('VaultwardenAdmin', {}).get('password', ''))}\n")
- f.write(f"export TF_VAR_forgejo_runner_token={repr(entries.get('ForgejoRunnerToken', {}).get('password', ''))}\n")
- f.write(f"export TF_VAR_forgejo_oidc_client_id={repr(entries.get('ForgejoOIDC', {}).get('username', 'forgejo'))}\n")
- f.write(f"export TF_VAR_forgejo_oidc_secret={repr(entries.get('ForgejoOIDC', {}).get('password', ''))}\n")
- f.write(f"export ATLAS_PUSH_TOKEN={repr(entries.get('AtlasPushToken', {}).get('password', ''))}\n")
- f.write(f"export VYOS_WG_PRIVATE_KEY={repr(entries.get('VyosWG', {}).get('password', ''))}\n")
-os.chmod(cache_file, 0o600)
-
-
-
-#!/bin/bash
-# Log formatting and color definitions
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-BLUE='\033[0;34m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-log_info() { echo -e "${BLUE}==>${NC} $*"; }
-log_ok() { echo -e "${GREEN}✔${NC} $*"; }
-log_warn() { echo -e "${YELLOW}⚠${NC} $*"; }
-log_err() { echo -e "${RED}✖${NC} $*"; }
-
-
-
-#!/bin/bash
-# OpenBao Vault operations and Kubernetes Secret synchronization
-sync_k8s_vault_token() {
- if kubectl --request-timeout=2s cluster-info >/dev/null 2>&1; then
- log_info "Синхронизация токена OpenBao в Kubernetes..."
- local bao_tok
- bao_tok=$(grep '^export VAULT_TOKEN=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'"'")
- if [[ -n "${bao_tok}" ]]; then
- kubectl create namespace external-secrets --dry-run=client -o yaml | kubectl apply -f - >/dev/null 2>&1 || true
- kubectl -n external-secrets create secret generic openbao-token \
- --from-literal=token="${bao_tok}" \
- --dry-run=client -o yaml | kubectl apply -f - >/dev/null 2>&1
- kubectl -n external-secrets rollout restart deployment external-secrets >/dev/null 2>&1 || true
- log_ok "Токен OpenBao в Kubernetes актуализирован."
- fi
- fi
-}
-unseal_vault() {
- local unseal_key target_vault_addr seal_status resp
- unseal_key=$(grep '^export VAULT_UNSEAL_KEY=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'"'")
- target_vault_addr=$(grep '^export VAULT_ADDR=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'"'")
- target_vault_addr="${target_vault_addr:-$VAULT_ADDR}"
- seal_status=$(curl -s --connect-timeout 2 "${target_vault_addr}/v1/sys/seal-status" 2>/dev/null || echo "")
- if [[ -z "${seal_status}" ]]; then
- log_warn "OpenBao (${target_vault_addr}) недоступен. Пропуск ансила."
- return 0
- fi
- if echo "${seal_status}" | grep -q '"sealed":true'; then
- log_info "OpenBao запечатан. Ансил..."
- resp=$(printf '{"key":"%s"}' "${unseal_key}" | curl -s -X POST -H "Content-Type: application/json" --data-binary @- "${target_vault_addr}/v1/sys/unseal")
- if echo "${resp}" | grep -q '"sealed":false'; then
- log_ok "OpenBao успешно распечатан."
- sync_k8s_vault_token
- else
- log_err "Ошибка ансила OpenBao: ${resp}"
- return 1
- fi
- else
- log_ok "OpenBao распечатан."
- sync_k8s_vault_token
- fi
-}
-
-
-
-#!/bin/bash
-set -uo pipefail
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-echo "## 0. Рабочая станция администратора (Operator Environment)"
-echo "### Инфраструктурные SSH-хосты (~/.ssh/config):"
-echo '```text'
-if [[ -f ~/.ssh/config ]]; then
- awk '/^Host (router|proxmox|vyos|10\.|fin21|ded|incserv)/, /^$/' ~/.ssh/config
-else
- echo "Файл ~/.ssh/config не найден"
-fi
-echo '```'
-echo "### Рабочие алиасы и функции оператора (Active Workflow Aliases):"
-echo '```bash'
-if [[ -f ~/.bashrc ]] && grep -q '# >>> ATLAS C2 WORKFLOW >>>' ~/.bashrc; then
- sed -n '/# >>> ATLAS C2 WORKFLOW >>>/,/# <<< ATLAS C2 WORKFLOW <<>>'
-else
- echo "# Маркер # >>> ATLAS C2 WORKFLOW >>> не найден в ~/.bashrc"
-fi
-echo '```'
-echo "### Статус RAM-кэша секретов (/dev/shm/.atlas_secrets_cache):"
-echo '```text'
-if [[ -f /dev/shm/.atlas_secrets_cache ]]; then
- stat -c "Размер: %s байт | Права: %a | Создан: %y" /dev/shm/.atlas_secrets_cache
-else
- echo "Кэш секретов в RAM отсутствует"
-fi
-echo '```'
-echo "### Проверка Git Credential Helper (git.svo88.space):"
-echo '```text'
-printf "protocol=https\nhost=git.svo88.space\n" | git credential fill 2>&1 | awk -F= '/^username/ {print "Username:", $2} /^password/ {print "Password: [PRESENT in RAM]"}' || echo "Credential helper не вернул учетных данных"
-echo '```'
-echo "### Ядро, память, ZRAM и параметры Coredump:"
-echo '```text'
-echo -n "Kernel: "; uname -r
-echo -n "Swapon: "; swapon --show 2>&1 || echo "swapon недоступен"
-zramctl 2>&1 || echo "zramctl недоступен"
-echo "Coredump config:"
-cat /etc/systemd/coredump.conf.d/*.conf 2>/dev/null || grep -E "Storage|ProcessSizeMax" /etc/systemd/coredump.conf 2>/dev/null || echo "Дефолтная конфигурация coredump"
-echo '```'
-echo "### Токены безопасности и ключи в ssh-agent:"
-echo '```text'
-echo "Active SSH Agent keys:"
-ssh-add -l 2>&1 || true
-echo "YubiKey / FIDO2 Status:"
-ykman info 2>/dev/null || echo "Токен YubiKey не обнаружен"
-echo '```'
-echo "### Зеркала пакетов Pacman (Mirrorlist):"
-echo '```text'
-grep -E "^Server|^\[" /etc/pacman.conf /etc/pacman.d/* 2>/dev/null | head -n 15 || echo "Нет данных о зеркалах"
-echo '```'
-echo "### Маршрутизация на хосте (Routing to C2):"
-echo '```text'
-ip route show | grep -E "10.0.|192.168." || echo "Маршруты к ЦОД не обнаружены"
-echo '```'
-echo "### Версии локальных инструментов:"
-echo '```text'
-echo -n "OpenTofu: "; tofu version 2>/dev/null | head -n1 || echo "not installed"
-echo -n "Kubectl: "; kubectl version --client -o yaml 2>/dev/null | grep gitVersion | head -n1 || echo "not installed"
-echo -n "Talosctl: "; talosctl version --client --short 2>/dev/null || echo "not installed"
-echo '```'
-echo "### Состояние локального Git-репозитория (SSOT Source):"
-echo '```text'
-git -C "${REPO_ROOT}" status -sb
-echo "Последний коммит: $(git -C "${REPO_ROOT}" log -1 --format='%h - %s (%cr)')"
-echo "Remote URL: $(git -C "${REPO_ROOT}" remote -v 2>/dev/null | head -n1 | awk '{print $1, $2}' || echo 'no remote')"
-echo '```'
-echo "---"
-
-
-
-#!/bin/bash
-set -uo pipefail
-SSH_CMD="ssh -n -o BatchMode=yes -o ConnectTimeout=3 proxmox"
-echo "## 1. Гипервизор Proxmox VE (192.168.1.177)"
-echo "### Память хоста, Uptime и Температура CPU:"
-echo '```text'
-timeout 4s ${SSH_CMD} "uptime; echo ''; free -h; echo ''; sensors 2>/dev/null | grep -E 'Tctl|Package|temp1' || cat /sys/class/thermal/thermal_zone*/temp 2>/dev/null | awk '{print \"CPU Temp: \" \$1/1000 \"°C\"}'" 2>&1 || echo "PVE недоступен"
-echo '```'
-echo "### Здоровье физических дисков (SMART):"
-echo '```text'
-timeout 5s ${SSH_CMD} "for d in sda sdb sdc sdd sde sdf; do echo -n \"/dev/\$d: \"; smartctl -H /dev/\$d 2>/dev/null | grep -E 'result|PASSED|FAILED' || echo 'N/A'; done" 2>&1 || echo "SMART недоступен"
-echo '```'
-echo "### Статус шифрования ZFS (Encryption & Keys):"
-echo '```text'
-timeout 4s ${SSH_CMD} "zfs get encryption,keystatus,keyformat,keylocation astra terra 2>/dev/null" 2>&1 || echo "Ошибка сбора шифрования ZFS"
-echo '```'
-echo "### Здоровье и емкость ZFS-пулов:"
-echo '```text'
-timeout 4s ${SSH_CMD} "zpool list -o name,size,alloc,free,frag,cap,health; echo ''; zfs list -o name,used,avail,refer,mountpoint -r astra terra" 2>&1 || echo "Ошибка сбора ZFS"
-echo '```'
-echo "### Физическая емкость каталогов на /terra:"
-echo '```text'
-timeout 5s ${SSH_CMD} "du -sh /terra/* 2>/dev/null" 2>&1 || echo "Ошибка чтения /terra"
-echo '```'
-echo "### Блочные устройства хоста и тома ZVOL (lsblk):"
-echo '```text'
-timeout 4s ${SSH_CMD} "lsblk -o NAME,FSTYPE,SIZE,MOUNTPOINTS" 2>&1 || echo "Ошибка сбора lsblk"
-echo '```'
-echo "### Виртуальные диски K8s и ВМ (ZVOLs на astra):"
-echo '```text'
-timeout 4s ${SSH_CMD} "zfs list -t volume -o name,volsize,used,referenced" 2>&1 || echo "Ошибка чтения ZVOL"
-echo '```'
-echo "### Модули ядра (nfsd, zfs):"
-echo '```text'
-timeout 4s ${SSH_CMD} "lsmod | grep -E '^(nfsd|zfs) '" 2>&1 || echo "Модули не загружены"
-echo '```'
-echo "### Теги сетевых карт ВМ 100 (VyOS) в Proxmox:"
-echo '```text'
-timeout 4s ${SSH_CMD} "qm config 100 2>/dev/null | grep -E '^net[0-9]'" 2>&1 || echo "Ошибка чтения qm config 100"
-echo '```'
-echo "### Точки монтирования LXC-контейнеров (/etc/pve/lxc/*.conf):"
-echo '```text'
-timeout 4s ${SSH_CMD} "grep -H -E '^mp[0-9]:' /etc/pve/lxc/*.conf 2>/dev/null" 2>&1 || echo "Ошибка чтения lxc conf"
-echo '```'
-echo "### Флаги автостарта ВМ и Контейнеров (onboot):"
-echo '```text'
-timeout 4s ${SSH_CMD} "grep -H -E '^onboot:' /etc/pve/qemu-server/*.conf /etc/pve/lxc/*.conf 2>/dev/null" 2>&1 || echo "Ошибка чтения onboot"
-echo '```'
-echo "### Виртуальные машины (QEMU) и Контейнеры (LXC):"
-echo '```text'
-timeout 4s ${SSH_CMD} "qm list; echo ''; pct list" 2>&1 || echo "Ошибка получения списка ВМ/LXC"
-echo '```'
-echo "---"
-
-
-
-#!/bin/bash
-set -uo pipefail
-SSH_CMD="ssh -n -o BatchMode=yes -o ConnectTimeout=4 fin21"
-echo "## 2. Периметр: Белый VPS (Host: fin21, IP: 153.76.194.24)"
-echo "### WireGuard wg0 на VPS:"
-echo '```text'
-timeout 4s ${SSH_CMD} "sudo wg show wg0" 2>&1 || echo "VPS или WireGuard недоступен"
-echo '```'
-echo "### Статус системных сервисов (Edge Stack):"
-echo '```text'
-timeout 4s ${SSH_CMD} "sudo systemctl is-active wg-quick@wg0 haproxy xray nginx | paste -d' ' -s - | awk '{print \"WireGuard:\", \$1, \"| HAProxy:\", \$2, \"| Xray:\", \$3, \"| Nginx:\", \$4}'" 2>&1 || echo "Ошибка проверки systemd"
-echo '```'
-echo "### Прослушиваемые сокеты (Ports 80, 443, 4443, 8443, 51820):"
-echo '```text'
-timeout 4s ${SSH_CMD} "sudo ss -tulpn | grep -E '80|443|4443|8443|51820'" 2>&1 || echo "Ошибка ss"
-echo '```'
-echo "### Тест аварийной заглушки Nginx (127.0.0.1:8443):"
-echo '```text'
-timeout 3s ${SSH_CMD} "curl -k -s https://127.0.0.1:8443" 2>&1 || echo "Nginx fallback не отвечает"
-echo '```'
-echo "### Конфигурация SSH-демона (sshd runtime):"
-echo '```text'
-timeout 4s ${SSH_CMD} "sudo sshd -T | grep -E 'passwordauthentication|permitrootlogin'" 2>&1 || echo "Ошибка проверки sshd"
-echo '```'
-echo "---"
-
-
-
-#!/bin/bash
-set -uo pipefail
-SSH_CMD="ssh -n -o BatchMode=yes -o ConnectTimeout=3 vyos"
-echo "## 3. Маршрутизатор VyOS (192.168.1.2)"
-echo "### Сетевые интерфейсы и L2-транк (VLANs 10, 20, 30):"
-echo '```text'
-timeout 4s ${SSH_CMD} "/opt/vyatta/bin/vyatta-op-cmd-wrapper show interfaces" 2>&1 || echo "Ошибка получения интерфейсов"
-echo '```'
-echo "### ARP-таблица K8s-интерфейса eth1 (проверка связности с нодами):"
-echo '```text'
-timeout 4s ${SSH_CMD} "ip neigh show dev eth1 2>/dev/null" 2>&1 || echo "Ошибка чтения ARP"
-echo '```'
-echo "### DHCP-сервер и выданные лизы (Options 3, 6):"
-echo '```text'
-timeout 4s ${SSH_CMD} "/opt/vyatta/bin/vyatta-op-cmd-wrapper show dhcp server leases" 2>&1 || echo "Ошибка получения DHCP лизов"
-echo '```'
-echo "### Перехват DNS через DNAT (Rule 53 -> 127.0.0.42:53):"
-echo '```text'
-timeout 4s ${SSH_CMD} "/opt/vyatta/bin/vyatta-op-cmd-wrapper show nat destination rules" 2>&1 || echo "Ошибка получения NAT правил"
-echo '```'
-echo "### Контейнеры маршрутизатора (Sing-Box & Zapret2):"
-echo '```text'
-timeout 4s ${SSH_CMD} "/opt/vyatta/bin/vyatta-op-cmd-wrapper show container" 2>&1 || echo "Ошибка получения контейнеров"
-echo '```'
-echo "### Наличие /dev/net/tun внутри контейнера sing-box:"
-echo '```text'
-timeout 4s ${SSH_CMD} "sudo podman exec sing-box ls -l /dev/net/tun 2>/dev/null" 2>&1 || echo "Контейнер sing-box не запущен или tun отсутствует"
-echo '```'
-echo "### Задержка VLESS-канала через Clash API (Main-1-out -> fin21):"
-echo '```text'
-timeout 4s ${SSH_CMD} "curl -s http://127.0.0.1:9090/proxies/Main-1-out 2>/dev/null" 2>&1 || echo "Clash API недоступен"
-echo '```'
-echo "### Статус таймера автосинхронизации Git (singbox-sync):"
-echo '```text'
-timeout 4s ${SSH_CMD} "sudo systemctl status singbox-sync.timer --no-pager; echo ''; sudo journalctl -u singbox-sync.service -n 5 --no-pager" 2>&1 || echo "Ошибка проверки таймера"
-echo '```'
-echo "### Статус WireGuard туннеля wg0 и пинг до VPS:"
-echo '```text'
-timeout 4s ${SSH_CMD} "sudo wg show wg0; echo ''; /opt/vyatta/bin/vyatta-op-cmd-wrapper ping 10.8.0.1 count 2" 2>&1 || echo "VyOS или туннель недоступен"
-echo '```'
-echo "### Таблица маршрутизации (show ip route):"
-echo '```text'
-timeout 4s ${SSH_CMD} "/opt/vyatta/bin/vyatta-op-cmd-wrapper show ip route" 2>&1 || echo "Ошибка получения маршрутов"
-echo '```'
-echo "---"
-
-
-
-#!/bin/bash
-set -uo pipefail
-SSH_VYOS="ssh -n -o BatchMode=yes -o ConnectTimeout=3 vyos"
-SSH_STORAGE="ssh -n -o BatchMode=yes -o ConnectTimeout=3 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -J vyos root@10.0.10.14"
-echo "## 4. Сервисы Tier-0 (Air-Gap фундамент)"
-echo "### Technitium DNS (10.0.10.11:53):"
-echo "* **Внутренний домен (*.svo88.space -> 10.0.30.200):** $(timeout 3s ${SSH_VYOS} "dig @10.0.10.11 vw.svo88.space +short" 2>&1 | tr '\n' ' ')"
-echo "* **Внешний резолв (google.com):** $(timeout 3s ${SSH_VYOS} "dig @10.0.10.11 google.com +short" 2>&1 | head -n1)"
-echo "### OpenBao Vault (10.0.10.12:8200):"
-echo '```json'
-timeout 3s ${SSH_VYOS} "curl -s http://10.0.10.12:8200/v1/sys/seal-status" 2>&1 || echo '{"error": "Vault недоступен"}'
-echo '```'
-echo "### Zot OCI Registry (10.0.10.15:5000):"
-echo '```json'
-timeout 3s ${SSH_VYOS} "curl -s http://10.0.10.15:5000/v2/_catalog" 2>&1 || echo '{"error": "Zot недоступен"}'
-echo '```'
-echo "### Forgejo GitOps Server (10.0.10.13:3000):"
-echo '```json'
-timeout 3s ${SSH_VYOS} "curl -s http://10.0.10.13:3000/api/v1/version" 2>&1 || echo '{"error": "Forgejo недоступен"}'
-echo '```'
-echo "### Ядерный NFS nfsd (storage0 - 10.0.10.14):"
-echo '```text'
-timeout 4s ${SSH_STORAGE} "echo '== Активные экспорты ядра (exportfs):'; exportfs -v; echo ''; echo '== Емкость смонтированных ZFS-датасетов:'; df -h /media /torrents /backups /models; echo ''; echo '== Права точки монтирования OpenCloud:'; ls -ld /backups/opencloud-users" 2>&1 || echo "NFS (storage0) недоступен"
-echo '```'
-echo "---"
-
-
-
-#!/bin/bash
-set -uo pipefail
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-TALOSCONFIG="${REPO_ROOT}/talos/clusterconfig/talosconfig"
-KUBECONFIG_PATH="${HOME}/.kube/config"
-echo "## 5. Kubernetes Платформа & Нагрузки"
-echo "### Участники кластера Talos (OS-level):"
-echo '```text'
-timeout 5s talosctl --talosconfig="${TALOSCONFIG}" -n 10.0.20.10 -e 10.0.20.10 get members 2>&1 || echo "Talos API недоступен"
-echo '```'
-echo "### Ноды кластера K8s:"
-echo '```text'
-timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get nodes -o wide 2>&1 || echo "K8s API недоступен"
-echo '```'
-echo "### Топологические лейблы нод (Proxmox-CSI topology):"
-echo '```text'
-timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get nodes -L topology.kubernetes.io/zone,topology.kubernetes.io/region 2>&1 || echo "Не удалось получить лейблы нод"
-echo '```'
-echo "### Статус ExternalSecrets (Синхронизация из Vault):"
-echo '```text'
-timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get clustersecretstores,externalsecrets -A 2>&1 || echo "Не удалось получить ExternalSecrets"
-echo '```'
-echo "### Сетевой ingress, сертификаты TLS и L2 Fast-Path VIP:"
-echo '```text'
-timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get certificates,ingresses -A 2>&1 || echo "Не удалось получить Ingress/TLS"
-echo ''
-timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n kube-system get ciliuml2announcementpolicies,ciliumloadbalancerippools 2>&1 || echo "Не удалось получить Cilium L2"
-echo ''
-timeout 3s curl -k -s -o /dev/null -w "Traefik VIP (10.0.30.200:443) HTTP Status: %{http_code}\n" https://10.0.30.200 2>&1 || echo "Traefik VIP недоступен"
-echo '```'
-echo "### Диски и тома (PVC / PV):"
-echo '```text'
-timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get pvc,pv -A 2>&1 || echo "Не удалось получить PVC"
-echo '```'
-echo "### Статус DaemonSet Proxmox-CSI Node:"
-echo '```text'
-timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n kube-system get daemonset proxmox-csi-plugin-node 2>&1 || echo "Не удалось получить DaemonSet CSI"
-echo '```'
-echo "### Статус пространства мониторинга (VictoriaMetrics & Grafana):"
-echo '```text'
-timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n monitoring get statefulsets,pods,pvc 2>&1 || echo "Не удалось получить мониторинг"
-echo '```'
-echo "### Логи ошибок Proxmox CSI Plugin (последние строки):"
-echo '```text'
-timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n kube-system logs -l app.kubernetes.io/name=proxmox-csi-plugin --tail=15 --prefix=true 2>&1 || echo "Нет логов CSI"
-echo '```'
-echo "### Синхронизация GitOps (FluxCD):"
-echo '```text'
-timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get gitrepositories,kustomizations,helmreleases -A 2>&1 || echo "Flux не установлен или недоступен"
-echo '```'
-echo "### Проблемные поды (Non-Running):"
-echo '```text'
-timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get pods -A --field-selector=status.phase!=Running 2>&1 || echo "Все поды в статусе Running"
-echo '```'
-echo "### Последние события-предупреждения (Warning Events):"
-echo '```text'
-timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get events -A --field-selector type=Warning --sort-by='.lastTimestamp' 2>&1 | tail -n 15 || echo "Нет предупреждений"
-echo '```'
-echo "### Реальный объем данных OpenCloud (/var/lib/opencloud-users):"
-echo '```text'
-timeout 10s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n storage exec statefulset/opencloud -c opencloud -- du -sh /var/lib/opencloud-users 2>&1 || echo "Не удалось получить размер данных OpenCloud"
-echo '```'
-
-
-
-#!/bin/bash
-set -uo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-STATE_DIR="${ZARYA_DIR}/state"
-SNAPSHOTS_DIR="${STATE_DIR}/snapshots"
-TARGET="${1:-all}"
-MODULES=(
- "00_workstation.sh"
- "01_pve.sh"
- "02_vps.sh"
- "03_vyos.sh"
- "04_tier0.sh"
- "05_k8s.sh"
-)
-mkdir -p "${SNAPSHOTS_DIR}"
-generate_header() {
- local mod_name="$1"
- local timestamp branch short_hash commit_msg
- timestamp=$(date -u +"%Y-%m-%d %H:%M:%S UTC")
- branch=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" branch --show-current 2>/dev/null || echo "unknown")
- short_hash=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" rev-parse --short HEAD 2>/dev/null || echo "none")
- commit_msg=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" log -1 --format='%s' 2>/dev/null || echo "none")
- cat < Сбор модуля: ${mod_name}..."
- generate_header "${mod_name}" > "${tmp_file}"
- if [[ -x "${script}" ]]; then
- "${script}" >> "${tmp_file}" 2>&1
- else
- bash "${script}" >> "${tmp_file}" 2>&1
- fi
- mv "${tmp_file}" "${out_file}"
-}
-if [[ "${TARGET}" == "all" ]]; then
- echo "==> Сбор полного аудита Sovereign C2 в ${SNAPSHOTS_DIR}..."
- for mod in "${MODULES[@]}"; do
- run_single_module "${mod}"
- done
- echo "✔ Все модули телеметрии успешно сохранены."
-else
- case "${TARGET}" in
- 00_workstation|workstation|host) run_single_module "00_workstation.sh" ;;
- 01_pve|pve) run_single_module "01_pve.sh" ;;
- 02_vps|vps) run_single_module "02_vps.sh" ;;
- 03_vyos|vyos|net) run_single_module "03_vyos.sh" ;;
- 04_tier0|tier0) run_single_module "04_tier0.sh" ;;
- 05_k8s|k8s|talos) run_single_module "05_k8s.sh" ;;
- *)
- echo "Неизвестный модуль: ${TARGET}"
- exit 1
- ;;
- esac
-fi
-
-
-
-#!/bin/bash
-# Atlas C2 Configuration SSOT
-
-KDBX_PATH="${HOME}/Projects/atlas-secrets.kdbx"
-RAM_CACHE="/dev/shm/.atlas_secrets_cache"
-RAM_KEY="/dev/shm/.atlas_core"
-
-VAULT_ADDR="http://10.0.10.12:8200"
-VYOS_ROUTER_IP="192.168.1.2"
-NET_PREFIX="10.0.0.0/16"
-GIT_HOST="git.svo88.space"
-PVE_ENDPOINT="https://192.168.1.177:8006/"
-
-DEFAULT_SESSION_TTL=1
-
-
-
-#!/bin/bash
-set -euo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-
-SUBCMD="${1:-help}"
-shift || true
-
-case "${SUBCMD}" in
- git-credential) exec "${ZARYA_DIR}/cmd/git-credential.sh" "$@" ;;
- exec) exec "${ZARYA_DIR}/cmd/exec.sh" "$@" ;;
- p|pod|pods) exec "${ZARYA_DIR}/cmd/pods.sh" "$@" ;;
- node|nodes) exec "${ZARYA_DIR}/cmd/nodes.sh" "$@" ;;
- flux) exec "${ZARYA_DIR}/cmd/flux.sh" "$@" ;;
- e|err|errors) exec "${ZARYA_DIR}/cmd/errors.sh" "$@" ;;
- l|log|logs) exec "${ZARYA_DIR}/cmd/logs.sh" "$@" ;;
- n|net) exec "${ZARYA_DIR}/cmd/net.sh" "$@" ;;
- d|df|disks) exec "${ZARYA_DIR}/cmd/disks.sh" "$@" ;;
- unseal) exec "${ZARYA_DIR}/cmd/unseal.sh" "$@" ;;
- login|start) exec "${ZARYA_DIR}/cmd/session.sh" "start" "$@" ;;
- logout|clean) exec "${ZARYA_DIR}/cmd/session.sh" "clean" "$@" ;;
- up) exec "${ZARYA_DIR}/cmd/up.sh" "$@" ;;
- run) exec "${ZARYA_DIR}/cmd/run.sh" "$@" ;;
- a|apply) exec "${ZARYA_DIR}/cmd/a.sh" "$@" ;;
- snap) exec "${ZARYA_DIR}/cmd/snap.sh" "$@" ;;
- pack) exec "${ZARYA_DIR}/cmd/pack.sh" "$@" ;;
- reset|nuke) exec "${ZARYA_DIR}/layers/reset.sh" "$@" ;;
- gc) exec "${ZARYA_DIR}/layers/gc.sh" "$@" ;;
- help|--help|-h)
- cat <] [-s ] [-A] Просмотр подов
- z nodes [-w] Статус нод, роли, зона и регион
- z errors Мгновенный триаж сломанных сервисов
- z logs [-f] [-t ] Логи сервиса без ввода неймспейса
- z net Сетевой радар доступности узлов (1 сек)
- z disks Срез пулов astra/terra и томов K8s
-GitOps и оркестрация:
- z flux [status|sync|logs] Управление GitOps-конвергенцией
- z exec <команда...> Вызов бинарников внутри RAM-изоляции
-Сессия и доступы:
- z login [TTL] Открытие смены (YubiKey + RAM)
- z logout Мгновенная очистка RAM
- z unseal Распечатывание OpenBao Vault
-Деплой и IaC:
- z up [layer] Макро-слои (host, net, tier0, talos, apps, all)
- z run Плейбуки Ansible (01, 02)
- z a [-auto-approve] OpenTofu apply в RAM-изоляции
-Телеметрия и LLM:
- z snap Снятие аудита в state/snapshots/
- z pack [all|atlas|code|state] Сборка контекстов Repomix для LLM
-EOF
- ;;
- *)
- log_err "Неизвестная команда: ${SUBCMD}. Введите 'z help'."
- exit 1
- ;;
-esac
-
-
-
-#!/bin/bash
-set -euo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-if [[ -f "${RAM_CACHE}" ]]; then
- token=$(grep '^export ATLAS_PUSH_TOKEN=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'\'' ' || true)
- if [[ -n "${token}" ]]; then
- echo "username=atlas"
- echo "password=${token}"
- fi
-fi
-exit 0
-
-
-
-#!/bin/bash
-set -euo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
-mode="${1:-all}"
-pack_atlas() {
- log_info "==> [1/3] Упаковка чистой архитектуры Atlas (atlas-code.xml)..."
- (cd "${ATLAS_DIR}" && repomix --config "${ATLAS_DIR}/repomix.config.json")
- log_ok "Файл ${ATLAS_DIR}/atlas-code.xml готов."
-}
-pack_zarya() {
- log_info "==> [2/3] Упаковка станции оператора Zarya (zarya-code.xml)..."
- (cd "${ZARYA_DIR}" && repomix --config "${ZARYA_DIR}/repomix.config.json")
- log_ok "Файл ${ZARYA_DIR}/zarya-code.xml готов."
-}
-pack_state() {
- log_info "==> [3/3] Снятие живого аудита и упаковка телеметрии (zarya-state.xml)..."
- "${ZARYA_DIR}/state/collect_state.sh" all
- (cd "${ZARYA_DIR}" && repomix --config "${ZARYA_DIR}/repomix.state.json")
- log_ok "Файл ${ZARYA_DIR}/zarya-state.xml готов."
-}
-case "${mode}" in
- all)
- pack_atlas
- echo ""
- pack_zarya
- echo ""
- pack_state
- echo ""
- log_ok "Все три контекста Repomix собраны без ошибок."
- ;;
- atlas)
- pack_atlas
- ;;
- code)
- pack_zarya
- ;;
- state)
- pack_state
- ;;
- *)
- log_err "Использование: z pack [all|atlas|code|state]"
- exit 1
- ;;
-esac
-
-
-
-#!/bin/bash
-ensure_prerequisites() {
- local target_ip="${VAULT_ADDR#*//}"
- target_ip="${target_ip%%:*}"
- if ! ip route get "${target_ip}" 2>/dev/null | grep -q "${VYOS_ROUTER_IP}"; then
- log_info "Восстанавливаем маршрут к ${NET_PREFIX} через VyOS (${VYOS_ROUTER_IP})..."
- sudo ip route replace "${NET_PREFIX}" via "${VYOS_ROUTER_IP}" 2>/dev/null || true
- fi
- local target_helper="!${ZARYA_DIR}/bin/zarya git-credential"
- local current_helper
- current_helper=$(git config --global --get credential."https://${GIT_HOST}".helper 2>/dev/null || true)
- if [[ "${current_helper}" != "${target_helper}" ]]; then
- git config --global credential."https://${GIT_HOST}".helper "${target_helper}"
- fi
- local direct_helper
- direct_helper=$(git config --global --get credential."http://10.0.10.13:3000".helper 2>/dev/null || true)
- if [[ "${direct_helper}" != "${target_helper}" ]]; then
- git config --global credential."http://10.0.10.13:3000".helper "${target_helper}"
- fi
- local ssh_hosts="proxmox pve0 vyos vyos_router 10.0.* dns0 vault0 git0 storage0 registry0"
- if [[ -f "${HOME}/.ssh/config" ]] && ! grep -q "IdentityFile ${RAM_KEY}" "${HOME}/.ssh/config"; then
- printf "\nHost %s\n IdentityFile %s\n IdentitiesOnly yes\n" "${ssh_hosts}" "${RAM_KEY}" >> "${HOME}/.ssh/config"
- fi
-}
-
-
-
-#!/bin/bash
-load_secrets_to_ram() {
- local hours="${1:-$DEFAULT_SESSION_TTL}"
- local now
- now=$(date +%s)
- ensure_prerequisites
- if [[ -f "${RAM_CACHE}" ]] && [[ -f "${RAM_KEY}" ]] && [[ -s "${RAM_KEY}" ]]; then
- local created age cached_ttl
- created=$(stat -c %Y "${RAM_CACHE}" 2>/dev/null || echo 0)
- age=$(( now - created ))
- cached_ttl=$(grep '^# TTL_SECONDS=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2 || echo 3600)
- if [[ "${cached_ttl}" -ne 0 ]] && (( age >= cached_ttl )); then
- log_warn "Время сессии истекло ($(( age / 60 )) мин >= $(( cached_ttl / 60 )) мин). Инвалидация кэша..."
- rm -f "${RAM_CACHE}" "${RAM_KEY}"
- else
- return 0
- fi
- fi
- local ttl_seconds
- if [[ "${hours}" -eq 0 ]]; then
- ttl_seconds=0
- else
- ttl_seconds=$(( hours * 3600 ))
- fi
- log_info "🔐 Вход в защищенный контур Zarya..."
- read -s -p "Master Password: " KP_PASS
- echo ""
- local yk_args=()
- if ykman info >/dev/null 2>&1; then
- yk_args=("-y" "2")
- log_info "YubiKey обнаружен. Приготовьтесь к аппаратному подтверждению (1 касание)..."
- fi
- local tmp_dump="/dev/shm/.kdbx_dump_${now}_$$.xml"
- rm -f "${tmp_dump}"
- touch "${tmp_dump}"
- chmod 600 "${tmp_dump}"
- if ! echo "${KP_PASS}" | keepassxc-cli export "${yk_args[@]}" "${KDBX_PATH}" -f xml > "${tmp_dump}" 2>/dev/null; then
- log_err "Ошибка расшифровки базы KDBX (неверный пароль или таймаут касания YubiKey)"
- rm -f "${tmp_dump}"
- unset KP_PASS
- return 1
- fi
- unset KP_PASS
- python3 "${ZARYA_DIR}/lib/kdbx_parser.py" "${tmp_dump}" "${RAM_CACHE}" "${RAM_KEY}" "${ttl_seconds}" "${PVE_ENDPOINT}" "${VAULT_ADDR}"
- rm -f "${tmp_dump}"
- log_ok "База расшифрована за 1 касание. Ключ и секреты в RAM (TTL: ${hours}ч)"
-}
-run_isolated() {
- ensure_prerequisites
- load_secrets_to_ram
- (
- set -a
- source "${RAM_CACHE}"
- set +a
- "$@"
- )
-}
-
-
-
diff --git a/zarya-state.xml b/zarya-state.xml
deleted file mode 100644
index 742b380..0000000
--- a/zarya-state.xml
+++ /dev/null
@@ -1,898 +0,0 @@
-This file is a merged representation of a subset of the codebase, containing specifically included files, combined into a single document by Repomix.
-The content has been processed where empty lines have been removed.
-
-
-This section contains a summary of this file.
-
-
-This file contains a packed representation of a subset of the repository's contents that is considered the most important context.
-It is designed to be easily consumable by AI systems for analysis, code review,
-or other automated processes.
-
-
-
-The content is organized as follows:
-1. This summary section
-2. Repository information
-3. Directory structure
-4. Repository files (if enabled)
-5. Multiple file entries, each consisting of:
- - File path as an attribute
- - Full contents of the file
-
-
-
-- This file should be treated as read-only. Any changes should be made to the
- original repository files, not this packed version.
-- When processing this file, use the file path to distinguish
- between different files in the repository.
-- Be aware that this file may contain sensitive information. Handle it with
- the same level of security as you would the original repository.
-
-
-
-- Some files may have been excluded based on .gitignore rules and Repomix's configuration
-- Binary files are not included in this packed representation. Please refer to the Repository Structure section for a complete list of file paths, including binary files
-- Only files matching these patterns are included: state/snapshots/**
-- Files matching default ignore patterns are excluded
-- Empty lines have been removed from all files
-- Files are sorted by Git change count (files with more changes are at the bottom)
-
-
-
-
-
-state/
- snapshots/
- 00_workstation.md
- 01_pve.md
- 02_vps.md
- 03_vyos.md
- 04_tier0.md
- 05_k8s.md
-
-
-
-This section contains the contents of the repository's files.
-
-
-# Sovereign C2 Runtime: 00_workstation
-**Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git")
-## 0. Рабочая станция администратора (Operator Environment)
-### Инфраструктурные SSH-хосты (~/.ssh/config):
-```text
-Host proxmox pve0
- Hostname 192.168.1.177
- Port 22
- User root
-
-Host vyos vyos_router
- Hostname 192.168.1.2
- Port 22
- User vyos
-
-Host 10.0.* dns0 vault0 git0 storage0 registry0
- User root
- StrictHostKeyChecking no
- UserKnownHostsFile /dev/null
- LogLevel ERROR
-
-Host fin21
- Hostname 153.76.194.24
- Port 22
- User atlas
-
-Host incserv
- Hostname 31.76.100.166
- Port 8765
- User root
-
-Host router
- Hostname 192.168.1.1
- Port 1488
- User root
-
-Host proxmox pve0 vyos vyos_router fin21 10.0.*
- IdentityFile /dev/shm/.atlas_core
- IdentitiesOnly yes
-```
-### Рабочие алиасы и функции оператора (Active Workflow Aliases):
-```bash
-# Маркер # >>> ATLAS C2 WORKFLOW >>> не найден в ~/.bashrc
-```
-### Статус RAM-кэша секретов (/dev/shm/.atlas_secrets_cache):
-```text
-Размер: 1058 байт | Права: 600 | Создан: 2026-10-25 18:08:15.915202821 +0300
-```
-### Проверка Git Credential Helper (git.svo88.space):
-```text
-Username: atlas
-Password: [PRESENT in RAM]
-```
-### Ядро, память, ZRAM и параметры Coredump:
-```text
-Kernel: 7.2.5-3-omarchy
-Swapon: NAME TYPE SIZE USED PRIO
-/swap/swapfile file 13.5G 0B 0
-/dev/zram0 partition 13.5G 358M 100
-NAME ALGORITHM DISKSIZE DATA COMPR TOTAL STREAMS MOUNTPOINT
-/dev/zram0 zstd 13.5G 331.5M 89.6M 95M [SWAP]
-Coredump config:
-#Storage=external
-#ProcessSizeMax=32G
-```
-### Токены безопасности и ключи в ssh-agent:
-```text
-Active SSH Agent keys:
-The agent has no identities.
-YubiKey / FIDO2 Status:
-Device type: YubiKey 5 Nano
-Serial number: 29508635
-Firmware version: 5.7.1
-Form factor: Nano (USB-A)
-Enabled USB interfaces: OTP, FIDO, CCID
-
-Applications
-Yubico OTP Enabled
-FIDO U2F Enabled
-FIDO2 Enabled
-OATH Enabled
-PIV Enabled
-OpenPGP Enabled
-YubiHSM Auth Enabled
-```
-### Зеркала пакетов Pacman (Mirrorlist):
-```text
-/etc/pacman.conf:[options]
-/etc/pacman.conf:[core]
-/etc/pacman.conf:[extra]
-/etc/pacman.conf:[multilib]
-/etc/pacman.conf:[omarchy]
-/etc/pacman.conf:Server = https://pkgs.omarchy.org/stable/$arch
-/etc/pacman.d/mirrorlist:Server = https://stable-mirror.omarchy.org/$repo/os/$arch
-/etc/pacman.d/mirrorlist.bak:Server = https://mirror.omarchy.org/$repo/os/$arch
-/etc/pacman.d/mirrorlist.omarchy-upgrade-to-quattro.20260905155315.bak:Server = https://mirror.omarchy.org/$repo/os/$arch
-Нет данных о зеркалах
-```
-### Маршрутизация на хосте (Routing to C2):
-```text
-default via 192.168.1.2 dev enp34s0 proto dhcp src 192.168.1.247 metric 100
-10.0.0.0/16 via 192.168.1.2 dev enp34s0 proto static metric 100
-192.168.1.0/24 dev enp34s0 proto kernel scope link src 192.168.1.247 metric 100
-```
-### Версии локальных инструментов:
-```text
-OpenTofu: OpenTofu v1.12.1
-Kubectl: gitVersion: v1.36.4
-Talosctl: Client:
-Talos v1.14.0
-```
-### Состояние локального Git-репозитория (SSOT Source):
-```text
-fatal: not a git repository (or any parent up to mount point /)
-Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
-fatal: not a git repository (or any parent up to mount point /)
-Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
-Последний коммит:
-Remote URL: no remote
-```
----
-
-
-
-# Sovereign C2 Runtime: 01_pve
-**Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git")
-## 1. Гипервизор Proxmox VE (192.168.1.177)
-### Память хоста, Uptime и Температура CPU:
-```text
- 18:20:07 up 3:30, 1 user, load average: 1.59, 1.90, 1.69
-
- total used free shared buff/cache available
-Mem: 37Gi 30Gi 5.8Gi 75Mi 1.3Gi 6.6Gi
-Swap: 0B 0B 0B
-
-```
-### Здоровье физических дисков (SMART):
-```text
-/dev/sda: SMART overall-health self-assessment test result: PASSED
-/dev/sdb: SMART overall-health self-assessment test result: PASSED
-/dev/sdc: SMART overall-health self-assessment test result: PASSED
-/dev/sdd: SMART overall-health self-assessment test result: PASSED
-/dev/sde: SMART overall-health self-assessment test result: PASSED
-/dev/sdf: SMART overall-health self-assessment test result: PASSED
-```
-### Статус шифрования ZFS (Encryption & Keys):
-```text
-NAME PROPERTY VALUE SOURCE
-astra encryption aes-256-gcm -
-astra keystatus available -
-astra keyformat raw -
-astra keylocation file:///etc/zfs/keys/astra.key local
-terra encryption aes-256-gcm -
-terra keystatus available -
-terra keyformat raw -
-terra keylocation file:///etc/zfs/keys/terra.key local
-```
-### Здоровье и емкость ZFS-пулов:
-```text
-NAME SIZE ALLOC FREE FRAG CAP HEALTH
-astra 2.78T 540G 2.25T 9% 18% ONLINE
-terra 1.81T 345G 1.48T 0% 18% ONLINE
-
-NAME USED AVAIL REFER MOUNTPOINT
-astra 360G 1.44T 55.0M /astra
-astra/vm-100-cloudinit 128K 1.44T 128K -
-astra/vm-100-disk-0 1.06G 1.44T 1.06G -
-astra/vm-201-disk-0 1.38G 1.44T 1.38G -
-astra/vm-202-disk-0 14.8G 1.44T 14.8G -
-astra/vm-203-disk-0 20.4G 1.44T 20.4G -
-astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 27.2M 1.44T 27.2M -
-astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 8.61M 1.44T 8.61M -
-astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 203M 1.44T 203M -
-astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 714K 1.44T 714K -
-astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 5.13M 1.44T 5.13M -
-astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 884K 1.44T 884K -
-astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 1.05M 1.44T 1.05M -
-astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 416K 1.44T 416K -
-astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 7.02M 1.44T 7.02M -
-astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 320G 1.44T 320G -
-astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 970K 1.44T 970K -
-astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 375M 1.44T 375M -
-astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 1.33M 1.44T 1.33M -
-astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 2.54M 1.44T 2.54M -
-astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 704M 1.44T 704M -
-astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 14.5M 1.44T 14.5M -
-astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 20.7M 1.44T 20.7M -
-terra 345G 1.42T 12.6G /terra
-terra/media 248K 1.42T 248K /terra/media
-terra/s3 192K 1.42T 192K /terra/s3
-terra/vault 333G 1.42T 333G /terra/vault
-```
-### Физическая емкость каталогов на /terra:
-```text
-68K /terra/media
-4.6M /terra/models
-171K /terra/packages
-13G /terra/registry
-8.5K /terra/s3
-4.3M /terra/torrents
-333G /terra/vault
-```
-### Блочные устройства хоста и тома ZVOL (lsblk):
-```text
-NAME FSTYPE SIZE MOUNTPOINTS
-loop0 ext4 4G
-loop1 ext4 4G
-loop2 ext4 2G
-loop3 ext4 8G
-loop4 ext4 8G
-sda 1.8T
-├─sda1 zfs_member 1.8T
-└─sda9 8M
-sdb 953.9G
-├─sdb1 zfs_member 953.9G
-└─sdb9 8M
-sdc 476.9G
-├─sdc1 vfat 976M /boot/efi
-├─sdc2 linux_raid_member 977M
-│ └─md0 ext4 976M /boot
-└─sdc3 linux_raid_member 445.3G
- └─md1 crypto_LUKS 445.1G
- └─md1_crypt ext4 445.1G /
-sdd 953.9G
-├─sdd1 zfs_member 953.9G
-└─sdd9 8M
-sde 447.1G
-├─sde1 vfat 976M
-├─sde2 linux_raid_member 977M
-│ └─md0 ext4 976M /boot
-└─sde3 linux_raid_member 445.2G
- └─md1 crypto_LUKS 445.1G
- └─md1_crypt ext4 445.1G /
-sdf 953.9G
-├─sdf1 zfs_member 953.9G
-└─sdf9 8M
-zd0 ext4 2G
-zd16 ext4 10G
-zd32 ext4 10G
-zd48 ext4 20G
-zd64 iso9660 4M
-zd80 ext4 5G
-zd96 ext4 5G
-zd112 ext4 5G
-zd128 ext4 5G
-zd144 100G
-├─zd144p1 vfat 100M
-├─zd144p2 1M
-├─zd144p3 xfs 2G
-├─zd144p4 1M
-├─zd144p5 xfs 100M
-└─zd144p6 xfs 97.8G
-zd160 ext4 30G
-zd176 ext4 30G
-zd192 ext4 400G
-zd208 ext4 100G
-zd224 100G
-├─zd224p1 vfat 100M
-├─zd224p2 1M
-├─zd224p3 xfs 2G
-├─zd224p4 1M
-├─zd224p5 xfs 100M
-└─zd224p6 xfs 97.8G
-zd240 10G
-├─zd240p1 1M
-├─zd240p2 vfat 256M
-└─zd240p3 ext4 9G
-zd256 ext4 100G
-zd272 20G
-├─zd272p1 vfat 100M
-├─zd272p2 1M
-├─zd272p3 xfs 2G
-├─zd272p4 1M
-├─zd272p5 xfs 100M
-└─zd272p6 xfs 17.8G
-zd288 ext4 20G
-zd304 ext4 15G
-zd320 ext4 5G
-zd336 ext4 30G
-```
-### Виртуальные диски K8s и ВМ (ZVOLs на astra):
-```text
-NAME VOLSIZE USED REFER
-astra/vm-100-cloudinit 4M 128K 128K
-astra/vm-100-disk-0 10G 1.06G 1.06G
-astra/vm-201-disk-0 20G 1.38G 1.38G
-astra/vm-202-disk-0 100G 14.8G 14.8G
-astra/vm-203-disk-0 100G 20.4G 20.4G
-astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10G 27.2M 27.2M
-astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100G 8.61M 8.61M
-astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100G 203M 203M
-astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5G 714K 714K
-astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20G 5.13M 5.13M
-astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10G 884K 884K
-astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15G 1.05M 1.05M
-astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2G 416K 416K
-astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5G 7.02M 7.02M
-astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400G 320G 320G
-astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5G 970K 970K
-astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5G 375M 375M
-astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20G 1.33M 1.33M
-astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5G 2.54M 2.54M
-astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30G 704M 704M
-astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30G 14.5M 14.5M
-astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30G 20.7M 20.7M
-```
-### Модули ядра (nfsd, zfs):
-```text
-zfs 6262784 44
-nfsd 1011712 3
-```
-### Теги сетевых карт ВМ 100 (VyOS) в Proxmox:
-```text
-net0: virtio=BC:24:11:DC:6D:EC,bridge=vmbr0,firewall=0
-net1: virtio=BC:24:11:3F:CB:C9,bridge=vmbr0,firewall=0,tag=20
-net2: virtio=BC:24:11:EA:32:2F,bridge=vmbr0,firewall=0,tag=30
-net3: virtio=BC:24:11:59:E8:8D,bridge=vmbr0,firewall=0,tag=10
-```
-### Точки монтирования LXC-контейнеров (/etc/pve/lxc/*.conf):
-```text
-/etc/pve/lxc/101.conf:mp0: /astra/data/dns0,mp=/opt/technitium/dns/config
-/etc/pve/lxc/102.conf:mp0: /astra/data/vault0,mp=/var/lib/bao/data
-/etc/pve/lxc/103.conf:mp0: /astra/data/git0,mp=/var/lib/forgejo
-/etc/pve/lxc/104.conf:mp0: /terra/media,mp=/media
-/etc/pve/lxc/104.conf:mp1: /terra/torrents,mp=/torrents
-/etc/pve/lxc/104.conf:mp2: /terra/vault,mp=/backups
-/etc/pve/lxc/104.conf:mp3: /terra/models,mp=/models
-/etc/pve/lxc/104.conf:mp4: /terra/packages,mp=/packages
-/etc/pve/lxc/105.conf:mp0: /terra/registry,mp=/mnt/registry
-```
-### Флаги автостарта ВМ и Контейнеров (onboot):
-```text
-/etc/pve/qemu-server/100.conf:onboot: 1
-/etc/pve/qemu-server/201.conf:onboot: 1
-/etc/pve/qemu-server/202.conf:onboot: 1
-/etc/pve/qemu-server/203.conf:onboot: 1
-/etc/pve/lxc/101.conf:onboot: 1
-/etc/pve/lxc/102.conf:onboot: 1
-/etc/pve/lxc/103.conf:onboot: 1
-/etc/pve/lxc/104.conf:onboot: 1
-/etc/pve/lxc/105.conf:onboot: 1
-```
-### Виртуальные машины (QEMU) и Контейнеры (LXC):
-```text
- VMID NAME STATUS MEM(MB) BOOTDISK(GB) PID
- 100 vyos-router running 2048 10.00 2594
- 201 talos-master-1 running 2560 20.00 2698
- 202 talos-worker-1 running 10240 100.00 3869
- 203 talos-worker-2 running 10240 100.00 4919
-
-VMID Status Lock Name
-101 running dns0
-102 running vault0
-103 running git0
-104 running storage0
-105 running registry0
-```
----
-
-
-
-# Sovereign C2 Runtime: 02_vps
-**Срез:** 2026-10-25 15:20:12 UTC | **Git:** master@10fbe14 ("git")
-## 2. Периметр: Белый VPS (Host: fin21, IP: 153.76.194.24)
-### WireGuard wg0 на VPS:
-```text
-interface: wg0
- public key: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY=
- private key: (hidden)
- listening port: 51820
-
-peer: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4=
- endpoint: 45.93.6.172:46777
- allowed ips: 10.8.0.2/32, 10.0.30.200/32
- latest handshake: 3 hours, 28 minutes, 44 seconds ago
- transfer: 64.06 MiB received, 54.22 MiB sent
-```
-### Статус системных сервисов (Edge Stack):
-```text
-WireGuard: active | HAProxy: active | Xray: active | Nginx: active
-```
-### Прослушиваемые сокеты (Ports 80, 443, 4443, 8443, 51820):
-```text
-udp UNCONN 0 0 0.0.0.0:51820 0.0.0.0:*
-udp UNCONN 0 0 [::]:51820 [::]:*
-tcp LISTEN 0 4096 127.0.0.1:4443 0.0.0.0:* users:(("haproxy",pid=862,fd=10))
-tcp LISTEN 0 511 127.0.0.1:8443 0.0.0.0:* users:(("nginx",pid=739,fd=5),("nginx",pid=735,fd=5))
-tcp LISTEN 0 4096 0.0.0.0:80 0.0.0.0:* users:(("haproxy",pid=862,fd=9))
-tcp LISTEN 0 4096 *:443 *:* users:(("xray",pid=690,fd=3))
-```
-### Тест аварийной заглушки Nginx (127.0.0.1:8443):
-```text
-Atlas Sovereign Home Server is currently offline for maintenance.
-```
-### Конфигурация SSH-демона (sshd runtime):
-```text
-permitrootlogin no
-passwordauthentication yes
-```
----
-
-
-
-# Sovereign C2 Runtime: 03_vyos
-**Срез:** 2026-10-25 15:20:15 UTC | **Git:** master@10fbe14 ("git")
-## 3. Маршрутизатор VyOS (192.168.1.2)
-### Сетевые интерфейсы и L2-транк (VLANs 10, 20, 30):
-```text
-Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-Interface IP Address MAC VRF MTU S/L Description
------------ -------------- ----------------- ------- ----- ----- -------------------
-eth0 192.168.1.2/24 bc:24:11:dc:6d:ec default 1500 u/u WAN_TRUNK
-eth1 10.0.20.1/24 bc:24:11:3f:cb:c9 default 1500 u/u K8S
-eth2 10.0.10.1/24 bc:24:11:59:e8:8d default 1500 u/u TIER0
-eth3 10.0.30.1/24 bc:24:11:ea:32:2f default 1500 u/u LAN_CLIENTS
-lo 127.0.0.1/8 00:00:00:00:00:00 default 65536 u/u
- ::1/128
-tun0 172.19.0.1/30 n/a default 65535 u/u
-wg0 10.8.0.2/24 n/a default 1420 u/u TUNNEL_TO_VPS_FIN21
-```
-### ARP-таблица K8s-интерфейса eth1 (проверка связности с нодами):
-```text
-10.0.20.11 lladdr bc:24:11:12:c5:1b REACHABLE
-10.0.20.12 lladdr bc:24:11:ef:1a:d4 STALE
-10.0.20.10 lladdr bc:24:11:71:b6:82 REACHABLE
-fe80::be24:11ff:fe12:c51b lladdr bc:24:11:12:c5:1b STALE
-fe80::be24:11ff:feef:1ad4 lladdr bc:24:11:ef:1a:d4 STALE
-fe80::be24:11ff:fe71:b682 lladdr bc:24:11:71:b6:82 STALE
-```
-### DHCP-сервер и выданные лизы (Options 3, 6):
-```text
-IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname Origin
------------- ----------------- ------- ------------------- ------------------- ----------- ----------- -------------- --------
-10.0.20.10 bc:24:11:71:b6:82 active 2026-10-25 11:51:32 2026-10-26 11:51:32 20:31:16 K8S talos-master-1 local
-10.0.20.11 bc:24:11:12:c5:1b active 2026-10-25 12:29:01 2026-10-26 12:29:01 21:08:45 K8S talos-worker-1 local
-10.0.20.12 bc:24:11:ef:1a:d4 active 2026-10-25 12:29:04 2026-10-26 12:29:04 21:08:48 K8S talos-worker-2 local
-10.0.30.100 bc:24:11:eb:38:63 active 2026-10-25 12:29:02 2026-10-26 12:29:02 21:08:46 LAN_CLIENTS talos-worker-1 local
-10.0.30.101 bc:24:11:bb:00:d3 active 2026-10-25 12:29:05 2026-10-26 12:29:05 21:08:49 LAN_CLIENTS talos-worker-2 local
-```
-### Перехват DNS через DNAT (Rule 53 -> 127.0.0.42:53):
-```text
-Rule Source Destination Proto In-Int Translation
------- --------- ------------- -------- -------- -------------
-53 0.0.0.0/0 0.0.0.0/0 TCP, UDP LAN 127.0.0.42
- sport any dport 53 port 53
-```
-### Контейнеры маршрутизатора (Sing-Box & Zapret2):
-```text
-CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
-9217a0a6ac83 ghcr.io/sagernet/sing-box:latest run -c /etc/sing-... 3 hours ago Up 3 hours sing-box
-c7e27e9bb9fc docker.io/vernette/ss-zapret2:latest /etc/zapret/run.s... 3 hours ago Up 3 hours 1080/tcp, 8388/tcp zapret2
-```
-### Наличие /dev/net/tun внутри контейнера sing-box:
-```text
-crw-rw-rw- 1 root root 10, 200 Oct 25 11:51 /dev/net/tun
-```
-### Задержка VLESS-канала через Clash API (Main-1-out -> fin21):
-```text
-{"type": "VLESS", "name": "Main-1-out", "udp": true, "history": [{"time":"2026-10-25T15:19:30.52662628Z","delay":122}]}```
-### Статус таймера автосинхронизации Git (singbox-sync):
-```text
-● singbox-sync.timer - Periodic Sing-Box Config Git Sync Timer
- Loaded: loaded (/etc/systemd/system/singbox-sync.timer; enabled; preset: enabled)
- Active: active (waiting) since Sun 2026-10-25 11:51:13 UTC; 3h 29min ago
- Trigger: Sun 2026-10-25 15:20:23 UTC; 6s left
- Triggers: ● singbox-sync.service
-
-Oct 25 11:51:13 vyos-router systemd[1]: Started Periodic Sing-Box Config Git Sync Timer.
-
-Oct 25 15:19:23 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully.
-Oct 25 15:19:23 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync.
-Oct 25 15:19:53 vyos-router systemd[1]: Starting Automated Sing-Box Config Git Sync...
-Oct 25 15:19:54 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully.
-Oct 25 15:19:54 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync.
-```
-### Статус WireGuard туннеля wg0 и пинг до VPS:
-```text
-interface: wg0
- public key: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4=
- private key: (hidden)
- listening port: 34756
-
-peer: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY=
- endpoint: 153.76.194.24:51820
- allowed ips: 10.8.0.0/24
- latest handshake: 3 hours, 28 minutes, 47 seconds ago
- transfer: 1.12 KiB received, 282.34 KiB sent
- persistent keepalive: every 25 seconds
-
-VyOS или туннель недоступен
-```
-### Таблица маршрутизации (show ip route):
-```text
-Codes: K - kernel route, C - connected, L - local, S - static,
- R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
- T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
- f - OpenFabric, t - Table-Direct,
- > - selected route, * - FIB route, q - queued, r - rejected, b - backup
- t - trapped, o - offload failure
-
-IPv4 unicast VRF default:
-S>* 0.0.0.0/0 [1/0] via 192.168.1.1, eth0, weight 1, 03:28:52
-C>* 10.0.10.0/24 is directly connected, eth2, weight 1, 03:28:58
-L>* 10.0.10.1/32 is directly connected, eth2, weight 1, 03:28:58
-C>* 10.0.20.0/24 is directly connected, eth1, weight 1, 03:28:58
-L>* 10.0.20.1/32 is directly connected, eth1, weight 1, 03:28:58
-C>* 10.0.30.0/24 is directly connected, eth3, weight 1, 03:28:58
-L>* 10.0.30.1/32 is directly connected, eth3, weight 1, 03:28:58
-C>* 10.8.0.0/24 is directly connected, wg0, weight 1, 03:28:57
-L>* 10.8.0.2/32 is directly connected, wg0, weight 1, 03:28:57
-C>* 172.19.0.0/30 is directly connected, tun0, weight 1, 03:28:55
-L>* 172.19.0.1/32 is directly connected, tun0, weight 1, 03:28:55
-C>* 192.168.1.0/24 is directly connected, eth0, weight 1, 03:28:58
-L>* 192.168.1.2/32 is directly connected, eth0, weight 1, 03:28:58
-```
----
-
-
-
-# Sovereign C2 Runtime: 04_tier0
-**Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git")
-## 4. Сервисы Tier-0 (Air-Gap фундамент)
-### Technitium DNS (10.0.10.11:53):
-* **Внутренний домен (*.svo88.space -> 10.0.30.200):** 10.0.30.200
-* **Внешний резолв (google.com):** 173.194.220.100
-### OpenBao Vault (10.0.10.12:8200):
-```json
-{"type":"shamir","initialized":true,"sealed":false,"t":1,"n":1,"progress":0,"nonce":"","version":"2.0.1","build_date":"2024-09-03T19:57:34Z","migration":false,"cluster_name":"vault-cluster-74026fc7","cluster_id":"79b6d270-a6b1-b082-39be-aeb24d8841f5","recovery_seal":false,"storage_type":"file"}
-```
-### Zot OCI Registry (10.0.10.15:5000):
-```json
-{"repositories":["alpine","docker.io/getmeili/meilisearch","docker.io/grafana/loki","docker.io/jellyfin/jellyfin","docker.io/library/alpine","docker.io/library/busybox","docker.io/library/nginx","docker.io/library/postgres","docker.io/library/redis","docker.io/library/traefik","docker.io/netboxcommunity/netbox","docker.io/opencloudeu/opencloud-rolling","docker.io/owncloud/ocis","docker.io/searxng/searxng","docker.io/vaultwarden/server","docker.io/victoriametrics/victoria-metrics","docker.io/xream/sub-store","ghcr.io/anatol/pacoloco","ghcr.io/donkie/spoolman","ghcr.io/external-secrets/external-secrets","ghcr.io/fluxcd/helm-controller","ghcr.io/fluxcd/image-automation-controller","ghcr.io/fluxcd/image-reflector-controller","ghcr.io/fluxcd/kustomize-controller","ghcr.io/fluxcd/notification-controller","ghcr.io/fluxcd/source-controller","ghcr.io/fluxcd/source-watcher","ghcr.io/goauthentik/server","ghcr.io/immich-app/postgres","ghcr.io/karakeep-app/karakeep","ghcr.io/karakeep-app/karakeep-chrome","ghcr.io/kiwix/kiwix-serve","ghcr.io/sergelogvinov/proxmox-csi-controller","ghcr.io/sergelogvinov/proxmox-csi-node","ghcr.io/siderolabs/kubelet","ghcr.io/sysadminsmedia/homebox","ghcr.io/triliumnext/notes","ghcr.io/triliumnext/trilium","ghcr.io/we-promise/sure","ghcr.io/xiao-villamor/printstash","k8s.io/coredns/coredns","k8s.io/kube-apiserver","k8s.io/kube-controller-manager","k8s.io/kube-proxy","k8s.io/kube-scheduler","k8s.io/sig-storage/csi-attacher","k8s.io/sig-storage/csi-provisioner","k8s.io/sig-storage/csi-resizer","k8s.io/sig-storage/livenessprobe","quay.io/invidious/invidious","quay.io/invidious/invidious-companion","quay.io/jetstack/cert-manager-cainjector"]}```
-### Forgejo GitOps Server (10.0.10.13:3000):
-```json
-{"version":"7.0.4+gitea-1.21.11"}
-```
-### Ядерный NFS nfsd (storage0 - 10.0.10.14):
-```text
-== Активные экспорты ядра (exportfs):
-/media 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
-/torrents 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
-/backups 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
-/models 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
-/packages 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
-/media 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
-/torrents 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
-/backups 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
-/models 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
-/packages 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
-
-== Емкость смонтированных ZFS-датасетов:
-Filesystem Size Used Available Use% Mounted on
-terra/media 1.4T 1.0M 1.4T 0% /media
-terra 1.4T 12.6G 1.4T 1% /torrents
-terra/vault 1.7T 332.6G 1.4T 19% /backups
-terra 1.4T 12.6G 1.4T 1% /torrents
-
-== Права точки монтирования OpenCloud:
-drwxrws--- 5 1000 1000 5 Oct 25 12:31 /backups/opencloud-users
-```
----
-
-
-
-# Sovereign C2 Runtime: 05_k8s
-**Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git")
-## 5. Kubernetes Платформа & Нагрузки
-### Участники кластера Talos (OS-level):
-```text
-10.0.20.10: error getting server version: error constructing client: failed to create client connection: failed to resolve configuration context: talos config file is empty
-Talos API недоступен
-```
-### Ноды кластера K8s:
-```text
-NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
-talos-1il-vwa Ready control-plane 3h26m v1.37.0 10.0.20.10 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
-talos-worker-1 Ready 171m v1.37.0 10.0.20.11 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
-talos-worker-2 Ready 170m v1.37.0 10.0.20.12 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
-```
-### Топологические лейблы нод (Proxmox-CSI topology):
-```text
-NAME STATUS ROLES AGE VERSION ZONE REGION
-talos-1il-vwa Ready control-plane 3h26m v1.37.0
-talos-worker-1 Ready 171m v1.37.0 pve0 atlas
-talos-worker-2 Ready 170m v1.37.0 pve0 atlas
-```
-### Статус ExternalSecrets (Синхронизация из Vault):
-```text
-NAME AGE STATUS CAPABILITIES READY
-clustersecretstore.external-secrets.io/openbao-backend 33d Valid ReadWrite True
-
-NAMESPACE NAME STORETYPE STORE REFRESH INTERVAL STATUS READY LAST SYNC
-authentik externalsecret.external-secrets.io/authentik-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 49m
-databases externalsecret.external-secrets.io/all-db-passwords ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-databases externalsecret.external-secrets.io/postgres-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-documents externalsecret.external-secrets.io/paperless-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-flux-system externalsecret.external-secrets.io/atlas-repo-auth ClusterSecretStore openbao-backend 1h SecretSyncedError False 3d1h
-infra externalsecret.external-secrets.io/netbox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-kube-system externalsecret.external-secrets.io/proxmox-csi-config ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-media externalsecret.external-secrets.io/immich-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-media externalsecret.external-secrets.io/invidious-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-monitoring externalsecret.external-secrets.io/grafana-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-security externalsecret.external-secrets.io/vaultwarden-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-tools externalsecret.external-secrets.io/homebox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-tools externalsecret.external-secrets.io/karakeep-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-tools externalsecret.external-secrets.io/printstash-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-tools externalsecret.external-secrets.io/searxng-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-tools externalsecret.external-secrets.io/sure-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
-```
-### Сетевой ingress, сертификаты TLS и L2 Fast-Path VIP:
-```text
-NAMESPACE NAME READY SECRET AGE
-authentik certificate.cert-manager.io/auth-svo88-tls True auth-svo88-tls 27d
-devices certificate.cert-manager.io/print-svo88-tls True print-svo88-tls 7d5h
-documents certificate.cert-manager.io/paperless-svo88-tls True paperless-svo88-tls 26d
-documents certificate.cert-manager.io/trilium-svo88-tls True trilium-svo88-tls 21d
-infra certificate.cert-manager.io/dns-svo88-tls True dns-svo88-tls 26d
-infra certificate.cert-manager.io/git-svo88-tls True git-svo88-tls 27d
-infra certificate.cert-manager.io/netbox-svo88-tls True netbox-svo88-tls 26d
-infra certificate.cert-manager.io/pkg-svo88-tls True pkg-svo88-tls 6d20h
-infra certificate.cert-manager.io/pve-svo88-tls True pve-svo88-tls 26d
-infra certificate.cert-manager.io/vault-svo88-tls True vault-svo88-tls 26d
-infra certificate.cert-manager.io/zot-svo88-tls True zot-svo88-tls 27d
-media certificate.cert-manager.io/immich-svo88-tls True immich-svo88-tls 25d
-media certificate.cert-manager.io/jellyfin-svo88-tls True jellyfin-svo88-tls 21d
-media certificate.cert-manager.io/metube-svo88-tls True metube-svo88-tls 21d
-media certificate.cert-manager.io/yt-svo88-tls True yt-svo88-tls 21d
-security certificate.cert-manager.io/vw-svo88-tls True vw-svo88-tls 31d
-storage certificate.cert-manager.io/opencloud-svo88-tls True opencloud-svo88-tls 26d
-tools certificate.cert-manager.io/dash-svo88-tls True dash-svo88-tls 21d
-tools certificate.cert-manager.io/finance-svo88-tls True finance-svo88-tls 26d
-tools certificate.cert-manager.io/homebox-svo88-tls True homebox-svo88-tls 27d
-tools certificate.cert-manager.io/keep-svo88-tls True keep-svo88-tls 21d
-tools certificate.cert-manager.io/printstash-svo88-tls True printstash-svo88-tls 27d
-tools certificate.cert-manager.io/search-svo88-tls True search-svo88-tls 26d
-tools certificate.cert-manager.io/spoolman-svo88-tls True spoolman-svo88-tls 7d5h
-tools certificate.cert-manager.io/sub-store-svo88-tls True sub-store-svo88-tls 3d9h
-
-NAMESPACE NAME CLASS HOSTS ADDRESS PORTS AGE
-authentik ingress.networking.k8s.io/authentik traefik auth.svo88.space 10.0.30.200 80, 443 27d
-devices ingress.networking.k8s.io/qidi-printer traefik print.svo88.space 10.0.30.200 80, 443 7d5h
-documents ingress.networking.k8s.io/paperless traefik paperless.svo88.space 10.0.30.200 80, 443 26d
-documents ingress.networking.k8s.io/trilium traefik trilium.svo88.space 10.0.30.200 80, 443 21d
-infra ingress.networking.k8s.io/forgejo-git traefik git.svo88.space 10.0.30.200 80, 443 27d
-infra ingress.networking.k8s.io/netbox traefik netbox.svo88.space 10.0.30.200 80, 443 26d
-infra ingress.networking.k8s.io/openbao-vault traefik vault.svo88.space 10.0.30.200 80, 443 26d
-infra ingress.networking.k8s.io/pkg-custom traefik pkg.svo88.space 10.0.30.200 80 6d20h
-infra ingress.networking.k8s.io/pkg-server traefik pkg.svo88.space 10.0.30.200 80, 443 6d20h
-infra ingress.networking.k8s.io/proxmox-ve traefik pve.svo88.space 10.0.30.200 80, 443 26d
-infra ingress.networking.k8s.io/technitium-dns traefik dns.svo88.space 10.0.30.200 80, 443 26d
-infra ingress.networking.k8s.io/zot-registry traefik zot.svo88.space 10.0.30.200 80, 443 27d
-media ingress.networking.k8s.io/immich traefik immich.svo88.space 10.0.30.200 80, 443 25d
-media ingress.networking.k8s.io/invidious traefik yt.svo88.space 10.0.30.200 80, 443 21d
-media ingress.networking.k8s.io/jellyfin traefik jellyfin.svo88.space 10.0.30.200 80, 443 21d
-media ingress.networking.k8s.io/metube traefik metube.svo88.space 10.0.30.200 80, 443 21d
-security ingress.networking.k8s.io/vaultwarden traefik vw.svo88.space 10.0.30.200 80, 443 31d
-storage ingress.networking.k8s.io/opencloud traefik opencloud.svo88.space 10.0.30.200 80, 443 26d
-tools ingress.networking.k8s.io/dashboard traefik dash.svo88.space 10.0.30.200 80, 443 21d
-tools ingress.networking.k8s.io/homebox traefik homebox.svo88.space 10.0.30.200 80, 443 27d
-tools ingress.networking.k8s.io/karakeep traefik keep.svo88.space 10.0.30.200 80, 443 21d
-tools ingress.networking.k8s.io/printstash traefik printstash.svo88.space 10.0.30.200 80, 443 27d
-tools ingress.networking.k8s.io/searxng traefik search.svo88.space 10.0.30.200 80, 443 26d
-tools ingress.networking.k8s.io/spoolman traefik spoolman.svo88.space 10.0.30.200 80, 443 7d5h
-tools ingress.networking.k8s.io/sub-store traefik sub-store.svo88.space 10.0.30.200 80, 443 3d9h
-tools ingress.networking.k8s.io/sure-finance traefik finance.svo88.space 10.0.30.200 80, 443 26d
-
-NAME AGE
-ciliuml2announcementpolicy.cilium.io/lan-fastpath-announcement 35d
-
-NAME DISABLED CONFLICTING IPS AVAILABLE AGE
-ciliumloadbalancerippool.cilium.io/lan-ingress-pool false False 0 35d
-
-Traefik VIP (10.0.30.200:443) HTTP Status: 404
-```
-### Диски и тома (PVC / PV):
-```text
-NAMESPACE NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE
-databases persistentvolumeclaim/postgres-data-postgres-core-0 Bound pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO proxmox-csi-db 32d
-documents persistentvolumeclaim/paperless-data-pvc Bound pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO proxmox-csi-general 32d
-documents persistentvolumeclaim/trilium-data-pvc Bound pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO proxmox-csi-general 21d
-infra persistentvolumeclaim/netbox-media-pvc Bound pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO proxmox-csi-general 32d
-infra persistentvolumeclaim/nfs-packages-pvc Bound nfs-packages-pv 200Gi RWX 6d20h
-media persistentvolumeclaim/immich-db-pvc Bound pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO proxmox-csi-db 25d
-media persistentvolumeclaim/immich-library-pvc Bound pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO proxmox-csi-general 25d
-media persistentvolumeclaim/jellyfin-config-pvc Bound pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO proxmox-csi-general 21d
-media persistentvolumeclaim/nfs-kiwix-pvc Bound nfs-kiwix-pv 200Gi ROX 32d
-media persistentvolumeclaim/nfs-media-pvc Bound nfs-media-pv 1Ti RWX 21d
-media persistentvolumeclaim/nfs-torrents-pvc Bound nfs-torrents-pv 500Gi RWX 32d
-monitoring persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general 16d
-monitoring persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general 16d
-monitoring persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general 16d
-security persistentvolumeclaim/vaultwarden-data-pvc Bound pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO proxmox-csi-general 32d
-storage persistentvolumeclaim/nfs-opencloud-users-pvc Bound nfs-opencloud-users-pv 600Gi RWX 21d
-storage persistentvolumeclaim/opencloud-data-pvc Bound pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO proxmox-csi-general 16d
-tools persistentvolumeclaim/homebox-data-pvc Bound pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO proxmox-csi-general 32d
-tools persistentvolumeclaim/karakeep-data-pvc Bound pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO proxmox-csi-general 21d
-tools persistentvolumeclaim/karakeep-meili-pvc Bound pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO proxmox-csi-general 21d
-tools persistentvolumeclaim/printstash-models-pvc Bound printstash-models-pv 100Gi RWX 32d
-tools persistentvolumeclaim/spoolman-data-pvc Bound pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO proxmox-csi-general 7d5h
-tools persistentvolumeclaim/sub-store-data-pvc Bound pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO proxmox-csi-general 3d9h
-
-NAMESPACE NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS VOLUMEATTRIBUTESCLASS REASON AGE
- persistentvolume/nfs-kiwix-pv 200Gi ROX Retain Bound media/nfs-kiwix-pvc 32d
- persistentvolume/nfs-media-pv 1Ti RWX Retain Bound media/nfs-media-pvc 21d
- persistentvolume/nfs-opencloud-users-pv 600Gi RWX Retain Bound storage/nfs-opencloud-users-pvc 21d
- persistentvolume/nfs-packages-pv 200Gi RWX Retain Bound infra/nfs-packages-pvc 6d20h
- persistentvolume/nfs-torrents-pv 500Gi RWX Retain Bound media/nfs-torrents-pvc 32d
- persistentvolume/printstash-models-pv 100Gi RWX Retain Bound tools/printstash-models-pvc 32d
- persistentvolume/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO Delete Bound documents/trilium-data-pvc proxmox-csi-general 21d
- persistentvolume/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO Delete Bound storage/opencloud-data-pvc proxmox-csi-general 16d
- persistentvolume/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO Delete Bound databases/postgres-data-postgres-core-0 proxmox-csi-db 32d
- persistentvolume/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO Delete Bound tools/karakeep-meili-pvc proxmox-csi-general 21d
- persistentvolume/pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO Delete Bound media/jellyfin-config-pvc proxmox-csi-general 21d
- persistentvolume/pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO Delete Bound infra/netbox-media-pvc proxmox-csi-general 32d
- persistentvolume/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO Delete Bound tools/karakeep-data-pvc proxmox-csi-general 21d
- persistentvolume/pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO Delete Bound tools/sub-store-data-pvc proxmox-csi-general 3d9h
- persistentvolume/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO Delete Bound security/vaultwarden-data-pvc proxmox-csi-general 32d
- persistentvolume/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO Delete Bound media/immich-library-pvc proxmox-csi-general 25d
- persistentvolume/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO Delete Bound tools/homebox-data-pvc proxmox-csi-general 32d
- persistentvolume/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO Delete Bound monitoring/grafana-data-pvc proxmox-csi-general 16d
- persistentvolume/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO Delete Bound monitoring/victoria-metrics-pvc proxmox-csi-general 16d
- persistentvolume/pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO Delete Bound tools/spoolman-data-pvc proxmox-csi-general 7d5h
- persistentvolume/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO Delete Bound media/immich-db-pvc proxmox-csi-db 25d
- persistentvolume/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO Delete Bound monitoring/loki-data-pvc proxmox-csi-general 16d
- persistentvolume/pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO Delete Bound documents/paperless-data-pvc proxmox-csi-general 32d
-```
-### Статус DaemonSet Proxmox-CSI Node:
-```text
-NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
-proxmox-csi-plugin-node 2 2 2 2 2 33d
-```
-### Статус пространства мониторинга (VictoriaMetrics & Grafana):
-```text
-NAME READY AGE
-statefulset.apps/grafana 1/1 16d
-statefulset.apps/loki 1/1 16d
-statefulset.apps/victoriametrics 1/1 16d
-
-NAME READY STATUS RESTARTS AGE
-pod/grafana-0 1/1 Running 0 169m
-pod/loki-0 1/1 Running 0 169m
-pod/victoriametrics-0 1/1 Running 0 169m
-
-NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE
-persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general 16d
-persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general 16d
-persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general 16d
-```
-### Логи ошибок Proxmox CSI Plugin (последние строки):
-```text
-Defaulted container "proxmox-csi-plugin-controller" out of: proxmox-csi-plugin-controller, csi-attacher, csi-provisioner, csi-resizer, liveness-probe
-Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe
-Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.012208 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4" nodeID="talos-worker-2"
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.131792 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb" nodeID="talos-worker-2"
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.206486 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7" nodeID="talos-worker-2"
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.277975 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2"
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.352701 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2"
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.430266 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780" nodeID="talos-worker-2"
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.509551 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2" nodeID="talos-worker-2"
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669146 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790776828491-7787-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\"}"
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669198 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2"
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.681187 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID=""
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873038 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790090280571-543-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\"}"
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873096 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2"
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.882474 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID=""
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.084431 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2"
-[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.357862 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:29.408317 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3\",\"volume_path\":\"/var/lib/kubelet/pods/b6ccf3ff-f0fc-411e-b5aa-5bbd61174578/volumes/kubernetes.io~csi/pvc-6eb8c148-32b0-45af-8945-2799d04875a3/mount\"}"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.576536 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.577998 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945\",\"volume_path\":\"/var/lib/kubelet/pods/f3402b78-9a95-4a5c-89c9-7535456d39e0/volumes/kubernetes.io~csi/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945/mount\"}"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.887356 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.888572 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\",\"volume_path\":\"/var/lib/kubelet/pods/ce3b896c-9957-4a70-b713-265ab487c32b/volumes/kubernetes.io~csi/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f/mount\"}"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.095236 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.096521 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780\",\"volume_path\":\"/var/lib/kubelet/pods/919bd05a-93f8-44e3-850e-7a8dd2a570d6/volumes/kubernetes.io~csi/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780/mount\"}"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.657181 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.658240 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b/mount\"}"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.659625 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.660965 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb/mount\"}"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.981192 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.982711 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242\",\"volume_path\":\"/var/lib/kubelet/pods/fa9abffb-f2c3-470f-9ee7-7bd93688270c/volumes/kubernetes.io~csi/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242/mount\"}"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.278791 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.280160 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd\",\"volume_path\":\"/var/lib/kubelet/pods/9ce6cd32-c936-4d17-8597-3efdb4845bc8/volumes/kubernetes.io~csi/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd/mount\"}"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:03.366763 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.621786 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.622940 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.802709 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.804175 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.307289 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.308598 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf\",\"volume_path\":\"/var/lib/kubelet/pods/288247da-f98a-4d43-9f15-e882d4c7acb5/volumes/kubernetes.io~csi/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf/mount\"}"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.015178 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.016475 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a\",\"volume_path\":\"/var/lib/kubelet/pods/096b52fa-6650-4996-8813-dd472343cf8e/volumes/kubernetes.io~csi/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a/mount\"}"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.754757 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.755939 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.979195 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.980398 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.775598 1 node.go:524] "NodeGetCapabilities: called"
-[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.776955 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}"
-```
-### Синхронизация GitOps (FluxCD):
-```text
-NAMESPACE NAME URL AGE READY STATUS
-flux-system gitrepository.source.toolkit.fluxcd.io/atlas-repo http://10.0.10.13:3000/atlas/atlas.git 33d True stored artifact for revision 'master@sha1:10fbe14ef463bef034856278733f9ad3155cd866'
-
-NAMESPACE NAME AGE READY STATUS
-flux-system kustomization.kustomize.toolkit.fluxcd.io/apps-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866
-flux-system kustomization.kustomize.toolkit.fluxcd.io/infra-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866
-
-NAMESPACE NAME AGE READY STATUS
-cert-manager helmrelease.helm.toolkit.fluxcd.io/cert-manager 33d True Helm upgrade succeeded for release cert-manager/cert-manager.v2 with chart cert-manager@v1.21.3
-external-secrets helmrelease.helm.toolkit.fluxcd.io/external-secrets 33d True Helm upgrade succeeded for release external-secrets/external-secrets.v5 with chart external-secrets@2.14.0
-kube-system helmrelease.helm.toolkit.fluxcd.io/cilium 33d True Helm upgrade succeeded for release kube-system/cilium.v6 with chart cilium@1.15.5
-kube-system helmrelease.helm.toolkit.fluxcd.io/proxmox-csi-plugin 33d True Helm upgrade succeeded for release kube-system/proxmox-csi-plugin.v4 with chart proxmox-csi-plugin@0.5.12
-```
-### Проблемные поды (Non-Running):
-```text
-NAMESPACE NAME READY STATUS RESTARTS AGE
-databases postgres-init-databases-4lk9r 0/1 Completed 0 169m
-```
-### Последние события-предупреждения (Warning Events):
-```text
-NAMESPACE LAST SEEN TYPE REASON OBJECT MESSAGE
-traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use
-traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use
-traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use
-traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use
-monitoring 51m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-7tjsw" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
-monitoring 34m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-t6n9v" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
-monitoring 17m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-rsbtk" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
-flux-system 16m Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider
-flux-system 3m34s Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider
-monitoring 73s Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-xsj4k" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
-```
-### Реальный объем данных OpenCloud (/var/lib/opencloud-users):
-```text
-331.7G /var/lib/opencloud-users
-```
-
-
-