From 1d054935c4c2ccdec90c335cdebd2e942eee4712 Mon Sep 17 00:00:00 2001 From: v Date: Sun, 25 Oct 2026 18:25:49 +0300 Subject: [PATCH] chore: ignore generated xml files --- zarya-code.xml | 1412 ----------------------------------------------- zarya-state.xml | 898 ------------------------------ 2 files changed, 2310 deletions(-) delete mode 100644 zarya-code.xml delete mode 100644 zarya-state.xml diff --git a/zarya-code.xml b/zarya-code.xml deleted file mode 100644 index b694890..0000000 --- a/zarya-code.xml +++ /dev/null @@ -1,1412 +0,0 @@ -This file is a merged representation of a subset of the codebase, containing specifically included files and files not matching ignore patterns, combined into a single document by Repomix. -The content has been processed where empty lines have been removed. - - -This section contains a summary of this file. - - -This file contains a packed representation of a subset of the repository's contents that is considered the most important context. -It is designed to be easily consumable by AI systems for analysis, code review, -or other automated processes. - - - -The content is organized as follows: -1. This summary section -2. Repository information -3. Directory structure -4. Repository files (if enabled) -5. Multiple file entries, each consisting of: - - File path as an attribute - - Full contents of the file - - - -- This file should be treated as read-only. Any changes should be made to the - original repository files, not this packed version. -- When processing this file, use the file path to distinguish - between different files in the repository. -- Be aware that this file may contain sensitive information. Handle it with - the same level of security as you would the original repository. - - - -- Some files may have been excluded based on .gitignore rules and Repomix's configuration -- Binary files are not included in this packed representation. Please refer to the Repository Structure section for a complete list of file paths, including binary files -- Only files matching these patterns are included: bin/**, cmd/**, lib/**, layers/**, state/*.sh, config.env -- Files matching these patterns are excluded: state/snapshots/**, *.xml -- Files matching patterns in .gitignore are excluded -- Files matching default ignore patterns are excluded -- Empty lines have been removed from all files -- Files are sorted by Git change count (files with more changes are at the bottom) - - - - - -bin/ - fc - gg - op - zarya -cmd/ - a.sh - disks.sh - errors.sh - exec.sh - flux.sh - git-credential.sh - logs.sh - net.sh - nodes.sh - pack.sh - pods.sh - run.sh - session.sh - snap.sh - unseal.sh - up.sh -layers/ - 00_host.sh - 01_net.sh - 02_tier0.sh - 03_talos.sh - 04_apps.sh - gc.sh - reset.sh -lib/ - common.sh - kdbx_parser.py - log.sh - net.sh - session.sh - vault.sh -state/ - 00_workstation.sh - 01_pve.sh - 02_vps.sh - 03_vyos.sh - 04_tier0.sh - 05_k8s.sh - collect_state.sh -config.env - - - -This section contains the contents of the repository's files. - - -#!/bin/bash -set -euo pipefail -if [[ $# -eq 0 ]]; then - echo "Использование: fc <файл>" - exit 1 -fi -if [[ -f "$1" ]]; then - wl-copy < "$1" - echo "'$1' +++" -else - echo "'$1'+++" -fi - - - -#!/bin/bash -set -euo pipefail -if [[ -z "${1:-}" ]]; then - echo "Тема СВО не раскрыта: gg \"сообщение\"" - exit 1 -fi -git add . && git commit -m "$1" && git push - - - -#!/bin/bash -set -euo pipefail -if [[ $# -eq 0 ]]; then - echo "Использование: op <файл...>" - exit 1 -fi -for f in "$@"; do - printf "file://%s\r\n" "$(realpath "$f")" -done | wl-copy -t text/uri-list - - - -#!/bin/bash -set -euo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" -unseal_vault -run_isolated bash -c "cd '${REPO_ROOT}/tofu' && tofu apply $*" - - - -#!/bin/bash -set -uo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" -echo -e "${BLUE}=== ФИЗИЧЕСКИЕ ПУЛЫ ХОСТА PROXMOX (ZFS) ===${NC}" -ssh -n -o BatchMode=yes -o ConnectTimeout=2 proxmox "zpool list -o name,size,alloc,free,cap,health" 2>/dev/null || log_err "PVE недоступен" -echo "" -echo -e "${BLUE}=== ПОЛЬЗОВАТЕЛЬСКИЕ ДАТАСЕТЫ TIER-0 (/astra/data) ===${NC}" -ssh -n -o BatchMode=yes -o ConnectTimeout=2 proxmox "zfs list -o name,used,avail,refer,mountpoint -r astra/data" 2>/dev/null || true -echo "" -echo -e "${BLUE}=== ТОМА ДИСКОВ KUBERNETES (ZVOL) ===${NC}" -kubectl get pvc -A -o custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,STATUS:.status.phase,VOLUME:.spec.volumeName,SIZE:.status.capacity.storage 2>/dev/null || log_err "K8s API недоступен" - - - -#!/bin/bash -set -uo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" -has_errors=false -echo -e "${YELLOW}=== ТРИАЖ АВАРИЙ И СБОЕВ (K8s / Host / VyOS) ===${NC}" -bad_pods=$(kubectl get pods -A --field-selector=status.phase!=Running,status.phase!=Succeeded --no-headers 2>/dev/null | grep -v 'Completed' || true) -if [[ -n "${bad_pods}" ]]; then - has_errors=true - echo -e "${RED}[K8S] Проблемные поды:${NC}" - echo "${bad_pods}" | awk '{printf " %-16s %-36s %s\n", $1, $2, $3}' -fi -pve_failed=$(ssh -n -o BatchMode=yes -o ConnectTimeout=1 proxmox "systemctl --failed --no-legend --plain" 2>/dev/null || echo "UNREACHABLE") -if [[ "${pve_failed}" == "UNREACHABLE" ]]; then - has_errors=true - echo -e "${RED}[PVE] Гипервизор недоступен по SSH${NC}" -elif [[ -n "${pve_failed}" ]]; then - has_errors=true - echo -e "${RED}[PVE] Упавшие systemd-сервисы:${NC}" - echo "${pve_failed}" | awk '{print " " $1}' -fi -vyos_failed=$(ssh -n -o BatchMode=yes -o ConnectTimeout=1 vyos_router "systemctl --failed --no-legend --plain" 2>/dev/null || echo "UNREACHABLE") -if [[ "${vyos_failed}" == "UNREACHABLE" ]]; then - has_errors=true - echo -e "${RED}[VyOS] Роутер недоступен по SSH${NC}" -elif [[ -n "${vyos_failed}" ]]; then - has_errors=true - echo -e "${RED}[VyOS] Упавшие systemd-сервисы:${NC}" - echo "${vyos_failed}" | awk '{print " " $1}' -fi -if [[ "$has_errors" == false ]]; then - echo -e "${GREEN}✔ Все системы в норме. Сбоев не обнаружено.${NC}" -fi - - - -#!/bin/bash -set -euo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" -if [[ $# -eq 0 ]]; then - log_err "Использование: z exec <команда> [аргументы...]" - exit 1 -fi -run_isolated "$@" - - - -#!/bin/bash -set -uo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" -subcmd="${1:-status}" -shift || true -case "${subcmd}" in - sync|reconcile|s) - log_info "Принудительная конвергенция FluxCD..." - flux reconcile source git atlas-repo -n flux-system 2>/dev/null || true - flux reconcile kustomization infra-sync -n flux-system 2>/dev/null || true - flux reconcile kustomization apps-sync -n flux-system 2>/dev/null || true - log_ok "Синхронизация завершена." - ;; - logs|log|l) - log_info "Стриминг логов kustomize-controller..." - exec kubectl -n flux-system logs -l app.kubernetes.io/name=kustomize-controller --tail=50 -f - ;; - status|st) - echo -e "${BLUE}=== СТАТУС РЕПОЗИТОРИЕВ И KUSTOMIZATION (FLUX) ===${NC}" - kubectl -n flux-system get gitrepositories,kustomizations,helmreleases 2>/dev/null || log_err "Flux недоступен" - ;; - *) - kubectl -n flux-system get kustomizations 2>/dev/null || log_err "Flux недоступен" - ;; -esac - - - -#!/bin/bash -set -uo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" -query="${1:-}" -if [[ -z "${query}" ]]; then - log_err "Использование: z logs <сервис> [-f] [-t <строки>]" - exit 1 -fi -shift -follow_arg="" -tail_val="50" -while [[ $# -gt 0 ]]; do - case "$1" in - -f|--follow) follow_arg="-f"; shift ;; - -t|--tail) tail_val="$2"; shift 2 ;; - *) shift ;; - esac -done -pod_info=$(kubectl get pods -A --no-headers 2>/dev/null | awk -v q="${query}" 'tolower($1) ~ tolower(q) || tolower($2) ~ tolower(q) {print $1, $2; exit}') -if [[ -z "${pod_info}" ]]; then - log_err "Под с именем '${query}' не найден ни в одном namespace." - exit 1 -fi -ns=$(echo "${pod_info}" | awk '{print $1}') -pod=$(echo "${pod_info}" | awk '{print $2}') -log_info "Логи ${ns}/${pod} (tail: ${tail_val}):" -exec kubectl logs -n "${ns}" "${pod}" --tail="${tail_val}" ${follow_arg} - - - -#!/bin/bash -set -uo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" -echo -e "${BLUE}=== СЕТЕВОЙ РАДАР ИНФРАСТРУКТУРЫ (Таймаут 1 сек) ===${NC}" -printf "%-22s %-20s %-12s %s\n" "УЗЕЛ" "АДРЕС" "СТАТУС" "ЗАДЕРЖКА" -echo "------------------------------------------------------------------" -check_target() { - local name="$1" - local host="$2" - local port="$3" - local start end dur - start=$(date +%s%N) - if nc -z -w 1 "${host}" "${port}" 2>/dev/null; then - end=$(date +%s%N) - dur=$(( (end - start) / 1000000 )) - printf "%-22s %-20s \033[32m%-12s\033[0m %d ms\n" "${name}" "${host}:${port}" "UP" "${dur}" - else - printf "%-22s %-20s \033[31m%-12s\033[0m -\n" "${name}" "${host}:${port}" "DOWN" - fi -} -check_target "Proxmox Host (PVE)" "192.168.1.177" 8006 -check_target "Edge Router (VyOS)" "192.168.1.2" 22 -check_target "Technitium DNS" "10.0.10.11" 53 -check_target "OpenBao Vault" "10.0.10.12" 8200 -check_target "Forgejo GitOps" "10.0.10.13" 3000 -check_target "NFS Storage (NAS)" "10.0.10.14" 2049 -check_target "Traefik L2 VIP" "10.0.30.200" 443 -check_target "Perimeter VPS" "153.76.194.24" 443 - - - -#!/bin/bash -set -u -watch_mode=false -while [[ $# -gt 0 ]]; do - case "$1" in - -w|--watch) watch_mode=true; shift ;; - *) shift ;; - esac -done -render_nodes() { - local raw - raw=$(kubectl get nodes -L topology.kubernetes.io/zone,topology.kubernetes.io/region 2>/dev/null || true) - echo "$raw" | awk ' - BEGIN { - ERR = "\033[38;2;255;46;76m" - RUN = "\033[38;2;166;227;161m" - HEAD = "\033[38;2;147;154;183m" - RST = "\033[0m" - } - NR==1 { print HEAD $0 RST; next } - { - if ($2 ~ /Ready/ && $2 !~ /NotReady/) { - print RUN $0 RST - } - else { - print ERR $0 RST - } - }' -} -if [[ "$watch_mode" == true ]]; then - trap 'tput cnorm 2>/dev/null || true; echo ""; exit 0' INT TERM - tput civis 2>/dev/null || true - clear - while true; do - tput cup 0 0 2>/dev/null || true - render_nodes - tput ed 2>/dev/null || true - sleep 1 - done -else - render_nodes -fi - - - -#!/bin/bash -set -u -watch_mode=false -ns_filter="" -query="" -all_namespaces=false -while [[ $# -gt 0 ]]; do - case "$1" in - -w|--watch) watch_mode=true; shift ;; - -n|--namespace) ns_filter="$2"; shift 2 ;; - -s|--service) query="$2"; shift 2 ;; - -A|--all) all_namespaces=true; shift ;; - all) all_namespaces=true; shift ;; - *) query="$1"; shift ;; - esac -done -render_pods() { - local raw - if [[ "$all_namespaces" == true ]]; then - raw=$(kubectl get pods -A -o wide 2>/dev/null || true) - elif [[ -n "$ns_filter" ]]; then - raw=$(kubectl get pods -n "$ns_filter" -o wide 2>/dev/null || true) - elif [[ -n "$query" ]]; then - raw=$(kubectl get pods -A -o wide 2>/dev/null | awk -v q="$query" 'NR==1 || tolower($1) ~ tolower(q) || tolower($2) ~ tolower(q)' || true) - else - raw=$(kubectl get pods -A -o wide 2>/dev/null | awk 'NR==1 || ($1 !~ /^(kube-system|flux-system|cert-manager|external-secrets)$/ && $4 != "Completed")' || true) - fi - echo "$raw" | awk ' - BEGIN { - ERR = "\033[38;2;255;46;76m" - RUN = "\033[38;2;180;190;254m" - WARN = "\033[38;2;250;179;135m" - HEAD = "\033[38;2;147;154;183m" - RST = "\033[0m" - } - NR==1 { print HEAD $0 RST; next } - { - if ($0 ~ /CrashLoopBackOff|Error|OOMKilled|ImagePullBackOff/) { print ERR $0 RST } - else if ($0 ~ /ContainerCreating|Pending|Terminating|Init:/ || ($0 ~ /Running/ && $2 ~ /^0\//)) { print WARN $0 RST } - else if ($0 ~ /Running/) { print RUN $0 RST } - else { print $0 } - }' -} -if [[ "$watch_mode" == true ]]; then - trap 'tput cnorm 2>/dev/null || true; echo ""; exit 0' INT TERM - tput civis 2>/dev/null || true - clear - while true; do - tput cup 0 0 2>/dev/null || true - render_pods - tput ed 2>/dev/null || true - sleep 1 - done -else - render_pods -fi - - - -#!/bin/bash -set -euo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" -resolve_playbook() { - local id="$1" - local found - found=$(find "${REPO_ROOT}/ansible/playbooks" -maxdepth 1 -name "${id}_*.yml" | head -n1) - if [[ -z "${found}" ]]; then - log_err "Плейбук с префиксом [${id}] не найден в ansible/playbooks/" - exit 1 - fi - echo "${found}" -} -if [[ $# -eq 0 ]] || [[ "${1:-}" == "list" ]]; then - echo -e "${BLUE}=== Каталог плейбуков (${REPO_ROOT}/ansible/playbooks/) ===${NC}" - for pb in $(ls -1 "${REPO_ROOT}/ansible/playbooks"/[0-9][0-9]_*.yml 2>/dev/null | sort); do - echo " $(basename "${pb}")" - done - exit 0 -fi -for id in "$@"; do - pb_path=$(resolve_playbook "${id}") - log_info "==> Исполнение: $(basename "${pb_path}")..." - run_isolated ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${pb_path}" -done -log_ok "Плейбуки выполнены." - - - -#!/bin/bash -set -euo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" -action="${1:-start}" -shift || true -case "${action}" in - start|login) - hours="${1:-1}" - ensure_prerequisites - load_secrets_to_ram "${hours}" - unseal_vault - log_ok "Сессия Zarya активна (TTL: ${hours} ч)." - ;; - clean|logout) - rm -f "${RAM_CACHE}" /dev/shm/.atlas_core - log_ok "RAM-кэш и ключи уничтожены." - ;; -esac - - - -#!/bin/bash -set -uo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -target="${1:-all}" -"${ZARYA_DIR}/state/collect_state.sh" "${target}" - - - -#!/bin/bash -set -euo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" -ensure_prerequisites -unseal_vault - - - -#!/bin/bash -set -euo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" -target="${1:-all}" -case "${target}" in - host) run_isolated "${ZARYA_DIR}/layers/00_host.sh" ;; - net) run_isolated "${ZARYA_DIR}/layers/01_net.sh" ;; - tier0) run_isolated "${ZARYA_DIR}/layers/02_tier0.sh" ;; - talos) run_isolated "${ZARYA_DIR}/layers/03_talos.sh" ;; - apps) "${ZARYA_DIR}/layers/04_apps.sh" ;; - all) - run_isolated "${ZARYA_DIR}/layers/00_host.sh" - run_isolated "${ZARYA_DIR}/layers/01_net.sh" - run_isolated "${ZARYA_DIR}/layers/02_tier0.sh" - run_isolated "${ZARYA_DIR}/layers/03_talos.sh" - "${ZARYA_DIR}/layers/04_apps.sh" - log_ok "Инфраструктура Atlas развернута." - ;; - *) - log_err "Неизвестный слой: ${target}. Доступны: host, net, tier0, talos, apps, all" - exit 1 - ;; -esac - - - -#!/bin/bash -set -euo pipefail -source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh" -ensure_prerequisites -load_secrets_to_ram -log_info "[Layer 0: PVE Host] Подготовка хоста, шаблонов и базовых директорий ZFS..." -ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/01_pve_host_day0.yml" -log_info "[Layer 0: PVE Host] Инициализация compute-скелетов ВМ и LXC через OpenTofu..." -cd "${REPO_ROOT}/tofu" && tofu apply \ - -target=proxmox_virtual_environment_vm.vyos_router \ - -target=proxmox_virtual_environment_container.dns0 \ - -target=proxmox_virtual_environment_container.vault0 \ - -target=proxmox_virtual_environment_container.git0 \ - -target=proxmox_virtual_environment_container.storage0 \ - -target=proxmox_virtual_environment_container.registry0 \ - -target=proxmox_virtual_environment_vm.talos_master_1 \ - -target=proxmox_virtual_environment_vm.talos_worker_1 \ - -target=proxmox_virtual_environment_vm.talos_worker_2 \ - -auto-approve -log_info "[Layer 0: PVE Host] Применение постоянных ZFS-маунтов (mp) на созданные LXC..." -ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/01_pve_host_day0.yml" -log_ok "Layer 0 готов: хост настроен, ВМ и LXC созданы, ZFS смонтирован." - - - -#!/bin/bash -set -euo pipefail -source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh" -ensure_prerequisites -load_secrets_to_ram -log_info "[Layer 1: VyOS & Perimeter] Накатка конфигурации сети..." -ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/02_vyos_network_day0.yml" -log_ok "Layer 1 готов." - - - -#!/bin/bash -set -euo pipefail -source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh" -ensure_prerequisites -load_secrets_to_ram -log_info "[Layer 2: Tier-0 Air-Gap] Развертывание базовой инфраструктуры (Registry, DNS, Vault)..." -for pb in 03_zot_registry.yml 04_technitium_dns.yml 05_openbao_vault.yml; do - ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/${pb}" -done -log_info "[Layer 2: Tier-0 Air-Gap] Распечатывание OpenBao Vault..." -unseal_vault -log_info "[Layer 2: Tier-0 Air-Gap] Наполнение Vault секретами через OpenTofu..." -cd "${REPO_ROOT}/tofu" && tofu apply -auto-approve -log_info "[Layer 2: Tier-0 Air-Gap] Развертывание зависимых сервисов (Forgejo, NAS Storage)..." -for pb in 06_forgejo_git.yml 07_nas_storage.yml; do - ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/${pb}" -done -log_info "[Layer 2: Tier-0 Air-Gap] Автоматическая первичная синхронизация Git в Forgejo (SEC-03 RAM auth)..." -CURRENT_BRANCH=$(git -C "${REPO_ROOT}" branch --show-current 2>/dev/null || echo "master") -git -C "${REPO_ROOT}" push -u http://10.0.10.13:3000/atlas/atlas.git "${CURRENT_BRANCH}" 2>/dev/null || \ - git -C "${REPO_ROOT}" push http://10.0.10.13:3000/atlas/atlas.git "${CURRENT_BRANCH}" 2>/dev/null || true -log_ok "Layer 2 готов. Базовые сервисы, секреты и GitOps-репозиторий развернуты." - - - -#!/bin/bash -set -euo pipefail -source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh" -ensure_prerequisites -load_secrets_to_ram -unseal_vault -log_info "[Layer 3: Talos & Kubernetes] Проверка конфигураций машинных манифестов..." -if [[ ! -f "${REPO_ROOT}/talos/clusterconfig/controlplane.yaml" ]]; then - log_info "Генерация машинных конфигураций Talos..." - cd "${REPO_ROOT}" && talos/generate_config.sh -fi -log_info "[Layer 3: Talos & Kubernetes] Бутстрап кластера..." -cd "${REPO_ROOT}/talos" && ./bootstrap.sh -sync_k8s_vault_token -log_ok "Layer 3 готов." - - - -#!/bin/bash -set -euo pipefail -source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh" -ensure_prerequisites -log_info "[Layer 4: Apps] Применение манифестов FluxCD..." -kubectl apply -f "${REPO_ROOT}/kubernetes/bootstrap/sync.yaml" -log_ok "Layer 4 готов." - - - -#!/bin/bash -set -uo pipefail -source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh" -ensure_prerequisites -log_info "🧹 Запуск генеральной очистки кластера (dep gc)..." -# 1. Удаление зомби-нод в статусе NotReady -NOT_READY_NODES=$(kubectl get nodes --no-headers 2>/dev/null | grep 'NotReady' | awk '{print $1}' || true) -if [[ -n "${NOT_READY_NODES}" ]]; then - for node in ${NOT_READY_NODES}; do - log_warn "Удаляем мертвую ноду: ${node}" - kubectl delete node "${node}" --timeout=5s 2>/dev/null || true - done -fi -# 2. Мгновенная зачистка зависших в Terminating -kubectl get pods -A --no-headers 2>/dev/null | awk '/Terminating/ {print $1, $2}' | while read -r ns pod; do - log_warn "Принудительно удаляем: ${ns}/${pod}" - kubectl -n "${ns}" delete pod "${pod}" --force --grace-period=0 2>/dev/null || true -done -# 3. Сброс бэкоффа для упавших подов (CrashLoopBackOff, Error, OOMKilled, CreateContainerConfigError) -kubectl get pods -A --no-headers 2>/dev/null | grep -E 'CrashLoopBackOff|Error|OOMKilled|CreateContainerConfigError|ImagePullBackOff' | awk '{print $1, $2}' | while read -r ns pod; do - log_info "Сбрасываем упавший под: ${ns}/${pod}" - kubectl -n "${ns}" delete pod "${pod}" --force --grace-period=0 2>/dev/null || true -done -# 4. Очистка завершенных одноразовых Job -COMPLETED_JOBS=$(kubectl get jobs -A --field-selector status.successful=1 --no-headers 2>/dev/null | awk '{print $1, $2}' || true) -if [[ -n "${COMPLETED_JOBS}" ]]; then - echo "${COMPLETED_JOBS}" | while read -r ns job; do - kubectl -n "${ns}" delete job "${job}" >/dev/null 2>&1 || true - done -fi -log_ok "Кластер очищен. Все сервисы пересоздаются против живых БД и NFS." - - - -#!/bin/bash -set -euo pipefail -source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh" -RESET_WIPE_HISTORY="${RESET_WIPE_HISTORY:-false}" -log_warn "ВНИМАНИЕ! Инициирована процедура полного уничтожения инфраструктуры Proxmox VE." -log_info "Очистка текущей RAM-сессии. Требуется физическая повторная аутентификация..." -rm -f "${RAM_CACHE}" /dev/shm/.atlas_core -read -s -p "Master Password для подтверждения сноса: " KP_PASS -echo "" -yk_args=() -if ykman info >/dev/null 2>&1; then - yk_args=("-y" "2") - log_info "Приготовьтесь к аппаратному подтверждению (касание YubiKey)..." -fi -tmp_verify="/dev/shm/.verify_$$" -if ! echo "${KP_PASS}" | timeout 15 keepassxc-cli export "${yk_args[@]}" "${KDBX_PATH}" -f xml > "${tmp_verify}" 2>/dev/null; then - log_err "Аппаратная проверка провалена или таймаут касания. Доступ заблокирован." - rm -f "${tmp_verify}" - unset KP_PASS - if [[ "${RESET_WIPE_HISTORY}" == "true" ]]; then - history -c 2>/dev/null || true - fi - exit 1 -fi -rm -f "${tmp_verify}" -unset KP_PASS -log_ok "Аппаратная проверка YubiKey и пароля подтверждена." -read -r -p "Введите 'CONFIRM-DESTRUCTION' для безвозвратного уничтожения: " confirm -if [[ "${confirm}" != "CONFIRM-DESTRUCTION" ]]; then - log_warn "Отмена операции." - exit 0 -fi -log_info "Снятие защиты и уничтожение виртуальных машин и контейнеров на Proxmox..." -ssh proxmox bash << 'SSHEOF' -for id in 100 201 202 203; do - qm stop $id --skiplock 1 2>/dev/null || true - qm destroy $id --purge 1 --destroy-unreferenced-disks 1 2>/dev/null || true -done -for id in 101 102 103 104 105; do - pct set $id -protection 0 2>/dev/null || true - pct stop $id --skiplock 1 2>/dev/null || true - pct destroy $id --purge 1 --force 1 2>/dev/null || true -done -SSHEOF -log_info "Очистка локального стейта OpenTofu..." -rm -f "${REPO_ROOT}/tofu/terraform.tfstate"* "${REPO_ROOT}/tofu/.terraform.tfstate.lock.info" -rm -f "${RAM_CACHE}" /dev/shm/.atlas_core -if [[ "${RESET_WIPE_HISTORY}" == "true" ]]; then - history -c 2>/dev/null || true -fi -log_ok "Сервер зачищен до голого железа." - - - -#!/bin/bash -set -euo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -export ATLAS_DIR="${ATLAS_DIR:-$HOME/Projects/atlas}" -export REPO_ROOT="${ATLAS_DIR}" -source "${ZARYA_DIR}/config.env" 2>/dev/null || true -source "${ZARYA_DIR}/lib/log.sh" -source "${ZARYA_DIR}/lib/net.sh" -source "${ZARYA_DIR}/lib/vault.sh" -source "${ZARYA_DIR}/lib/session.sh" - - - -import sys -import xml.etree.ElementTree as ET -import os -dump_file = sys.argv[1] -cache_file = sys.argv[2] -key_file = sys.argv[3] -ttl_sec = sys.argv[4] -pve_endpoint = sys.argv[5] -vault_addr = sys.argv[6] -tree = ET.parse(dump_file) -root = tree.getroot() -for h in root.findall(".//History"): - h.clear() -for g in root.findall(".//Group"): - name = g.find("./Name") - if name is not None and name.text == "Recycle Bin": - g.clear() -entries = {} -for entry in root.findall(".//Entry"): - title = "" - username = "" - password = "" - notes = "" - for string in entry.findall("./String"): - key_elem = string.find("./Key") - val_elem = string.find("./Value") - if key_elem is not None and val_elem is not None and key_elem.text: - k = key_elem.text - v = val_elem.text or "" - if k == "Title": title = v.strip() - elif k == "UserName": username = v.strip() - elif k == "Password": password = v.strip() - elif k == "Notes": notes = v.strip() - if title and title not in entries: - entries[title] = { - "username": username, - "password": password, - "notes": notes - } -ssh_loaded = False -for title in ("Atlas Core Key", "AtlasCoreKey", "Atlas Core"): - entry_data = entries.get(title, {}) - for field in ("password", "notes"): - val = entry_data.get(field, "") - if "-----BEGIN" in val or "PRIVATE KEY" in val: - with open(key_file, "w") as kf: - kf.write(val.strip() + "\n") - os.chmod(key_file, 0o600) - ssh_loaded = True - break - if ssh_loaded: - break -if not ssh_loaded: - sys.stderr.write("Внимание: приватный SSH-ключ не найден в полях Password/Notes записи Atlas Core Key.\n") -with open(cache_file, "w") as f: - f.write(f"# TTL_SECONDS={ttl_sec}\n") - f.write(f"export PROXMOX_VE_API_TOKEN={repr(entries.get('ProxmoxAPI', {}).get('password', ''))}\n") - f.write(f"export TF_VAR_proxmox_api_token={repr(entries.get('ProxmoxAPI', {}).get('password', ''))}\n") - f.write(f"export TF_VAR_state_passphrase={repr(entries.get('TofuState', {}).get('password', ''))}\n") - f.write(f"export PROXMOX_VE_ENDPOINT={repr(pve_endpoint)}\n") - f.write(f"export VAULT_ADDR={repr(vault_addr)}\n") - f.write(f"export VAULT_TOKEN={repr(entries.get('OpenBaoToken', {}).get('password', ''))}\n") - f.write(f"export VAULT_UNSEAL_KEY={repr(entries.get('OpenBaoUnseal', {}).get('password', ''))}\n") - f.write(f"export TECHNITIUM_PASSWORD={repr(entries.get('Technitium', {}).get('password', 'admin'))}\n") - f.write(f"export TF_VAR_vaultwarden_admin_token={repr(entries.get('VaultwardenAdmin', {}).get('password', ''))}\n") - f.write(f"export TF_VAR_forgejo_runner_token={repr(entries.get('ForgejoRunnerToken', {}).get('password', ''))}\n") - f.write(f"export TF_VAR_forgejo_oidc_client_id={repr(entries.get('ForgejoOIDC', {}).get('username', 'forgejo'))}\n") - f.write(f"export TF_VAR_forgejo_oidc_secret={repr(entries.get('ForgejoOIDC', {}).get('password', ''))}\n") - f.write(f"export ATLAS_PUSH_TOKEN={repr(entries.get('AtlasPushToken', {}).get('password', ''))}\n") - f.write(f"export VYOS_WG_PRIVATE_KEY={repr(entries.get('VyosWG', {}).get('password', ''))}\n") -os.chmod(cache_file, 0o600) - - - -#!/bin/bash -# Log formatting and color definitions -RED='\033[0;31m' -GREEN='\033[0;32m' -BLUE='\033[0;34m' -YELLOW='\033[1;33m' -NC='\033[0m' -log_info() { echo -e "${BLUE}==>${NC} $*"; } -log_ok() { echo -e "${GREEN}✔${NC} $*"; } -log_warn() { echo -e "${YELLOW}⚠${NC} $*"; } -log_err() { echo -e "${RED}✖${NC} $*"; } - - - -#!/bin/bash -# OpenBao Vault operations and Kubernetes Secret synchronization -sync_k8s_vault_token() { - if kubectl --request-timeout=2s cluster-info >/dev/null 2>&1; then - log_info "Синхронизация токена OpenBao в Kubernetes..." - local bao_tok - bao_tok=$(grep '^export VAULT_TOKEN=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'"'") - if [[ -n "${bao_tok}" ]]; then - kubectl create namespace external-secrets --dry-run=client -o yaml | kubectl apply -f - >/dev/null 2>&1 || true - kubectl -n external-secrets create secret generic openbao-token \ - --from-literal=token="${bao_tok}" \ - --dry-run=client -o yaml | kubectl apply -f - >/dev/null 2>&1 - kubectl -n external-secrets rollout restart deployment external-secrets >/dev/null 2>&1 || true - log_ok "Токен OpenBao в Kubernetes актуализирован." - fi - fi -} -unseal_vault() { - local unseal_key target_vault_addr seal_status resp - unseal_key=$(grep '^export VAULT_UNSEAL_KEY=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'"'") - target_vault_addr=$(grep '^export VAULT_ADDR=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'"'") - target_vault_addr="${target_vault_addr:-$VAULT_ADDR}" - seal_status=$(curl -s --connect-timeout 2 "${target_vault_addr}/v1/sys/seal-status" 2>/dev/null || echo "") - if [[ -z "${seal_status}" ]]; then - log_warn "OpenBao (${target_vault_addr}) недоступен. Пропуск ансила." - return 0 - fi - if echo "${seal_status}" | grep -q '"sealed":true'; then - log_info "OpenBao запечатан. Ансил..." - resp=$(printf '{"key":"%s"}' "${unseal_key}" | curl -s -X POST -H "Content-Type: application/json" --data-binary @- "${target_vault_addr}/v1/sys/unseal") - if echo "${resp}" | grep -q '"sealed":false'; then - log_ok "OpenBao успешно распечатан." - sync_k8s_vault_token - else - log_err "Ошибка ансила OpenBao: ${resp}" - return 1 - fi - else - log_ok "OpenBao распечатан." - sync_k8s_vault_token - fi -} - - - -#!/bin/bash -set -uo pipefail -REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" -echo "## 0. Рабочая станция администратора (Operator Environment)" -echo "### Инфраструктурные SSH-хосты (~/.ssh/config):" -echo '```text' -if [[ -f ~/.ssh/config ]]; then - awk '/^Host (router|proxmox|vyos|10\.|fin21|ded|incserv)/, /^$/' ~/.ssh/config -else - echo "Файл ~/.ssh/config не найден" -fi -echo '```' -echo "### Рабочие алиасы и функции оператора (Active Workflow Aliases):" -echo '```bash' -if [[ -f ~/.bashrc ]] && grep -q '# >>> ATLAS C2 WORKFLOW >>>' ~/.bashrc; then - sed -n '/# >>> ATLAS C2 WORKFLOW >>>/,/# <<< ATLAS C2 WORKFLOW <<>>' -else - echo "# Маркер # >>> ATLAS C2 WORKFLOW >>> не найден в ~/.bashrc" -fi -echo '```' -echo "### Статус RAM-кэша секретов (/dev/shm/.atlas_secrets_cache):" -echo '```text' -if [[ -f /dev/shm/.atlas_secrets_cache ]]; then - stat -c "Размер: %s байт | Права: %a | Создан: %y" /dev/shm/.atlas_secrets_cache -else - echo "Кэш секретов в RAM отсутствует" -fi -echo '```' -echo "### Проверка Git Credential Helper (git.svo88.space):" -echo '```text' -printf "protocol=https\nhost=git.svo88.space\n" | git credential fill 2>&1 | awk -F= '/^username/ {print "Username:", $2} /^password/ {print "Password: [PRESENT in RAM]"}' || echo "Credential helper не вернул учетных данных" -echo '```' -echo "### Ядро, память, ZRAM и параметры Coredump:" -echo '```text' -echo -n "Kernel: "; uname -r -echo -n "Swapon: "; swapon --show 2>&1 || echo "swapon недоступен" -zramctl 2>&1 || echo "zramctl недоступен" -echo "Coredump config:" -cat /etc/systemd/coredump.conf.d/*.conf 2>/dev/null || grep -E "Storage|ProcessSizeMax" /etc/systemd/coredump.conf 2>/dev/null || echo "Дефолтная конфигурация coredump" -echo '```' -echo "### Токены безопасности и ключи в ssh-agent:" -echo '```text' -echo "Active SSH Agent keys:" -ssh-add -l 2>&1 || true -echo "YubiKey / FIDO2 Status:" -ykman info 2>/dev/null || echo "Токен YubiKey не обнаружен" -echo '```' -echo "### Зеркала пакетов Pacman (Mirrorlist):" -echo '```text' -grep -E "^Server|^\[" /etc/pacman.conf /etc/pacman.d/* 2>/dev/null | head -n 15 || echo "Нет данных о зеркалах" -echo '```' -echo "### Маршрутизация на хосте (Routing to C2):" -echo '```text' -ip route show | grep -E "10.0.|192.168." || echo "Маршруты к ЦОД не обнаружены" -echo '```' -echo "### Версии локальных инструментов:" -echo '```text' -echo -n "OpenTofu: "; tofu version 2>/dev/null | head -n1 || echo "not installed" -echo -n "Kubectl: "; kubectl version --client -o yaml 2>/dev/null | grep gitVersion | head -n1 || echo "not installed" -echo -n "Talosctl: "; talosctl version --client --short 2>/dev/null || echo "not installed" -echo '```' -echo "### Состояние локального Git-репозитория (SSOT Source):" -echo '```text' -git -C "${REPO_ROOT}" status -sb -echo "Последний коммит: $(git -C "${REPO_ROOT}" log -1 --format='%h - %s (%cr)')" -echo "Remote URL: $(git -C "${REPO_ROOT}" remote -v 2>/dev/null | head -n1 | awk '{print $1, $2}' || echo 'no remote')" -echo '```' -echo "---" - - - -#!/bin/bash -set -uo pipefail -SSH_CMD="ssh -n -o BatchMode=yes -o ConnectTimeout=3 proxmox" -echo "## 1. Гипервизор Proxmox VE (192.168.1.177)" -echo "### Память хоста, Uptime и Температура CPU:" -echo '```text' -timeout 4s ${SSH_CMD} "uptime; echo ''; free -h; echo ''; sensors 2>/dev/null | grep -E 'Tctl|Package|temp1' || cat /sys/class/thermal/thermal_zone*/temp 2>/dev/null | awk '{print \"CPU Temp: \" \$1/1000 \"°C\"}'" 2>&1 || echo "PVE недоступен" -echo '```' -echo "### Здоровье физических дисков (SMART):" -echo '```text' -timeout 5s ${SSH_CMD} "for d in sda sdb sdc sdd sde sdf; do echo -n \"/dev/\$d: \"; smartctl -H /dev/\$d 2>/dev/null | grep -E 'result|PASSED|FAILED' || echo 'N/A'; done" 2>&1 || echo "SMART недоступен" -echo '```' -echo "### Статус шифрования ZFS (Encryption & Keys):" -echo '```text' -timeout 4s ${SSH_CMD} "zfs get encryption,keystatus,keyformat,keylocation astra terra 2>/dev/null" 2>&1 || echo "Ошибка сбора шифрования ZFS" -echo '```' -echo "### Здоровье и емкость ZFS-пулов:" -echo '```text' -timeout 4s ${SSH_CMD} "zpool list -o name,size,alloc,free,frag,cap,health; echo ''; zfs list -o name,used,avail,refer,mountpoint -r astra terra" 2>&1 || echo "Ошибка сбора ZFS" -echo '```' -echo "### Физическая емкость каталогов на /terra:" -echo '```text' -timeout 5s ${SSH_CMD} "du -sh /terra/* 2>/dev/null" 2>&1 || echo "Ошибка чтения /terra" -echo '```' -echo "### Блочные устройства хоста и тома ZVOL (lsblk):" -echo '```text' -timeout 4s ${SSH_CMD} "lsblk -o NAME,FSTYPE,SIZE,MOUNTPOINTS" 2>&1 || echo "Ошибка сбора lsblk" -echo '```' -echo "### Виртуальные диски K8s и ВМ (ZVOLs на astra):" -echo '```text' -timeout 4s ${SSH_CMD} "zfs list -t volume -o name,volsize,used,referenced" 2>&1 || echo "Ошибка чтения ZVOL" -echo '```' -echo "### Модули ядра (nfsd, zfs):" -echo '```text' -timeout 4s ${SSH_CMD} "lsmod | grep -E '^(nfsd|zfs) '" 2>&1 || echo "Модули не загружены" -echo '```' -echo "### Теги сетевых карт ВМ 100 (VyOS) в Proxmox:" -echo '```text' -timeout 4s ${SSH_CMD} "qm config 100 2>/dev/null | grep -E '^net[0-9]'" 2>&1 || echo "Ошибка чтения qm config 100" -echo '```' -echo "### Точки монтирования LXC-контейнеров (/etc/pve/lxc/*.conf):" -echo '```text' -timeout 4s ${SSH_CMD} "grep -H -E '^mp[0-9]:' /etc/pve/lxc/*.conf 2>/dev/null" 2>&1 || echo "Ошибка чтения lxc conf" -echo '```' -echo "### Флаги автостарта ВМ и Контейнеров (onboot):" -echo '```text' -timeout 4s ${SSH_CMD} "grep -H -E '^onboot:' /etc/pve/qemu-server/*.conf /etc/pve/lxc/*.conf 2>/dev/null" 2>&1 || echo "Ошибка чтения onboot" -echo '```' -echo "### Виртуальные машины (QEMU) и Контейнеры (LXC):" -echo '```text' -timeout 4s ${SSH_CMD} "qm list; echo ''; pct list" 2>&1 || echo "Ошибка получения списка ВМ/LXC" -echo '```' -echo "---" - - - -#!/bin/bash -set -uo pipefail -SSH_CMD="ssh -n -o BatchMode=yes -o ConnectTimeout=4 fin21" -echo "## 2. Периметр: Белый VPS (Host: fin21, IP: 153.76.194.24)" -echo "### WireGuard wg0 на VPS:" -echo '```text' -timeout 4s ${SSH_CMD} "sudo wg show wg0" 2>&1 || echo "VPS или WireGuard недоступен" -echo '```' -echo "### Статус системных сервисов (Edge Stack):" -echo '```text' -timeout 4s ${SSH_CMD} "sudo systemctl is-active wg-quick@wg0 haproxy xray nginx | paste -d' ' -s - | awk '{print \"WireGuard:\", \$1, \"| HAProxy:\", \$2, \"| Xray:\", \$3, \"| Nginx:\", \$4}'" 2>&1 || echo "Ошибка проверки systemd" -echo '```' -echo "### Прослушиваемые сокеты (Ports 80, 443, 4443, 8443, 51820):" -echo '```text' -timeout 4s ${SSH_CMD} "sudo ss -tulpn | grep -E '80|443|4443|8443|51820'" 2>&1 || echo "Ошибка ss" -echo '```' -echo "### Тест аварийной заглушки Nginx (127.0.0.1:8443):" -echo '```text' -timeout 3s ${SSH_CMD} "curl -k -s https://127.0.0.1:8443" 2>&1 || echo "Nginx fallback не отвечает" -echo '```' -echo "### Конфигурация SSH-демона (sshd runtime):" -echo '```text' -timeout 4s ${SSH_CMD} "sudo sshd -T | grep -E 'passwordauthentication|permitrootlogin'" 2>&1 || echo "Ошибка проверки sshd" -echo '```' -echo "---" - - - -#!/bin/bash -set -uo pipefail -SSH_CMD="ssh -n -o BatchMode=yes -o ConnectTimeout=3 vyos" -echo "## 3. Маршрутизатор VyOS (192.168.1.2)" -echo "### Сетевые интерфейсы и L2-транк (VLANs 10, 20, 30):" -echo '```text' -timeout 4s ${SSH_CMD} "/opt/vyatta/bin/vyatta-op-cmd-wrapper show interfaces" 2>&1 || echo "Ошибка получения интерфейсов" -echo '```' -echo "### ARP-таблица K8s-интерфейса eth1 (проверка связности с нодами):" -echo '```text' -timeout 4s ${SSH_CMD} "ip neigh show dev eth1 2>/dev/null" 2>&1 || echo "Ошибка чтения ARP" -echo '```' -echo "### DHCP-сервер и выданные лизы (Options 3, 6):" -echo '```text' -timeout 4s ${SSH_CMD} "/opt/vyatta/bin/vyatta-op-cmd-wrapper show dhcp server leases" 2>&1 || echo "Ошибка получения DHCP лизов" -echo '```' -echo "### Перехват DNS через DNAT (Rule 53 -> 127.0.0.42:53):" -echo '```text' -timeout 4s ${SSH_CMD} "/opt/vyatta/bin/vyatta-op-cmd-wrapper show nat destination rules" 2>&1 || echo "Ошибка получения NAT правил" -echo '```' -echo "### Контейнеры маршрутизатора (Sing-Box & Zapret2):" -echo '```text' -timeout 4s ${SSH_CMD} "/opt/vyatta/bin/vyatta-op-cmd-wrapper show container" 2>&1 || echo "Ошибка получения контейнеров" -echo '```' -echo "### Наличие /dev/net/tun внутри контейнера sing-box:" -echo '```text' -timeout 4s ${SSH_CMD} "sudo podman exec sing-box ls -l /dev/net/tun 2>/dev/null" 2>&1 || echo "Контейнер sing-box не запущен или tun отсутствует" -echo '```' -echo "### Задержка VLESS-канала через Clash API (Main-1-out -> fin21):" -echo '```text' -timeout 4s ${SSH_CMD} "curl -s http://127.0.0.1:9090/proxies/Main-1-out 2>/dev/null" 2>&1 || echo "Clash API недоступен" -echo '```' -echo "### Статус таймера автосинхронизации Git (singbox-sync):" -echo '```text' -timeout 4s ${SSH_CMD} "sudo systemctl status singbox-sync.timer --no-pager; echo ''; sudo journalctl -u singbox-sync.service -n 5 --no-pager" 2>&1 || echo "Ошибка проверки таймера" -echo '```' -echo "### Статус WireGuard туннеля wg0 и пинг до VPS:" -echo '```text' -timeout 4s ${SSH_CMD} "sudo wg show wg0; echo ''; /opt/vyatta/bin/vyatta-op-cmd-wrapper ping 10.8.0.1 count 2" 2>&1 || echo "VyOS или туннель недоступен" -echo '```' -echo "### Таблица маршрутизации (show ip route):" -echo '```text' -timeout 4s ${SSH_CMD} "/opt/vyatta/bin/vyatta-op-cmd-wrapper show ip route" 2>&1 || echo "Ошибка получения маршрутов" -echo '```' -echo "---" - - - -#!/bin/bash -set -uo pipefail -SSH_VYOS="ssh -n -o BatchMode=yes -o ConnectTimeout=3 vyos" -SSH_STORAGE="ssh -n -o BatchMode=yes -o ConnectTimeout=3 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -J vyos root@10.0.10.14" -echo "## 4. Сервисы Tier-0 (Air-Gap фундамент)" -echo "### Technitium DNS (10.0.10.11:53):" -echo "* **Внутренний домен (*.svo88.space -> 10.0.30.200):** $(timeout 3s ${SSH_VYOS} "dig @10.0.10.11 vw.svo88.space +short" 2>&1 | tr '\n' ' ')" -echo "* **Внешний резолв (google.com):** $(timeout 3s ${SSH_VYOS} "dig @10.0.10.11 google.com +short" 2>&1 | head -n1)" -echo "### OpenBao Vault (10.0.10.12:8200):" -echo '```json' -timeout 3s ${SSH_VYOS} "curl -s http://10.0.10.12:8200/v1/sys/seal-status" 2>&1 || echo '{"error": "Vault недоступен"}' -echo '```' -echo "### Zot OCI Registry (10.0.10.15:5000):" -echo '```json' -timeout 3s ${SSH_VYOS} "curl -s http://10.0.10.15:5000/v2/_catalog" 2>&1 || echo '{"error": "Zot недоступен"}' -echo '```' -echo "### Forgejo GitOps Server (10.0.10.13:3000):" -echo '```json' -timeout 3s ${SSH_VYOS} "curl -s http://10.0.10.13:3000/api/v1/version" 2>&1 || echo '{"error": "Forgejo недоступен"}' -echo '```' -echo "### Ядерный NFS nfsd (storage0 - 10.0.10.14):" -echo '```text' -timeout 4s ${SSH_STORAGE} "echo '== Активные экспорты ядра (exportfs):'; exportfs -v; echo ''; echo '== Емкость смонтированных ZFS-датасетов:'; df -h /media /torrents /backups /models; echo ''; echo '== Права точки монтирования OpenCloud:'; ls -ld /backups/opencloud-users" 2>&1 || echo "NFS (storage0) недоступен" -echo '```' -echo "---" - - - -#!/bin/bash -set -uo pipefail -REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" -TALOSCONFIG="${REPO_ROOT}/talos/clusterconfig/talosconfig" -KUBECONFIG_PATH="${HOME}/.kube/config" -echo "## 5. Kubernetes Платформа & Нагрузки" -echo "### Участники кластера Talos (OS-level):" -echo '```text' -timeout 5s talosctl --talosconfig="${TALOSCONFIG}" -n 10.0.20.10 -e 10.0.20.10 get members 2>&1 || echo "Talos API недоступен" -echo '```' -echo "### Ноды кластера K8s:" -echo '```text' -timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get nodes -o wide 2>&1 || echo "K8s API недоступен" -echo '```' -echo "### Топологические лейблы нод (Proxmox-CSI topology):" -echo '```text' -timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get nodes -L topology.kubernetes.io/zone,topology.kubernetes.io/region 2>&1 || echo "Не удалось получить лейблы нод" -echo '```' -echo "### Статус ExternalSecrets (Синхронизация из Vault):" -echo '```text' -timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get clustersecretstores,externalsecrets -A 2>&1 || echo "Не удалось получить ExternalSecrets" -echo '```' -echo "### Сетевой ingress, сертификаты TLS и L2 Fast-Path VIP:" -echo '```text' -timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get certificates,ingresses -A 2>&1 || echo "Не удалось получить Ingress/TLS" -echo '' -timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n kube-system get ciliuml2announcementpolicies,ciliumloadbalancerippools 2>&1 || echo "Не удалось получить Cilium L2" -echo '' -timeout 3s curl -k -s -o /dev/null -w "Traefik VIP (10.0.30.200:443) HTTP Status: %{http_code}\n" https://10.0.30.200 2>&1 || echo "Traefik VIP недоступен" -echo '```' -echo "### Диски и тома (PVC / PV):" -echo '```text' -timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get pvc,pv -A 2>&1 || echo "Не удалось получить PVC" -echo '```' -echo "### Статус DaemonSet Proxmox-CSI Node:" -echo '```text' -timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n kube-system get daemonset proxmox-csi-plugin-node 2>&1 || echo "Не удалось получить DaemonSet CSI" -echo '```' -echo "### Статус пространства мониторинга (VictoriaMetrics & Grafana):" -echo '```text' -timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n monitoring get statefulsets,pods,pvc 2>&1 || echo "Не удалось получить мониторинг" -echo '```' -echo "### Логи ошибок Proxmox CSI Plugin (последние строки):" -echo '```text' -timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n kube-system logs -l app.kubernetes.io/name=proxmox-csi-plugin --tail=15 --prefix=true 2>&1 || echo "Нет логов CSI" -echo '```' -echo "### Синхронизация GitOps (FluxCD):" -echo '```text' -timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get gitrepositories,kustomizations,helmreleases -A 2>&1 || echo "Flux не установлен или недоступен" -echo '```' -echo "### Проблемные поды (Non-Running):" -echo '```text' -timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get pods -A --field-selector=status.phase!=Running 2>&1 || echo "Все поды в статусе Running" -echo '```' -echo "### Последние события-предупреждения (Warning Events):" -echo '```text' -timeout 5s kubectl --kubeconfig="${KUBECONFIG_PATH}" get events -A --field-selector type=Warning --sort-by='.lastTimestamp' 2>&1 | tail -n 15 || echo "Нет предупреждений" -echo '```' -echo "### Реальный объем данных OpenCloud (/var/lib/opencloud-users):" -echo '```text' -timeout 10s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n storage exec statefulset/opencloud -c opencloud -- du -sh /var/lib/opencloud-users 2>&1 || echo "Не удалось получить размер данных OpenCloud" -echo '```' - - - -#!/bin/bash -set -uo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -STATE_DIR="${ZARYA_DIR}/state" -SNAPSHOTS_DIR="${STATE_DIR}/snapshots" -TARGET="${1:-all}" -MODULES=( - "00_workstation.sh" - "01_pve.sh" - "02_vps.sh" - "03_vyos.sh" - "04_tier0.sh" - "05_k8s.sh" -) -mkdir -p "${SNAPSHOTS_DIR}" -generate_header() { - local mod_name="$1" - local timestamp branch short_hash commit_msg - timestamp=$(date -u +"%Y-%m-%d %H:%M:%S UTC") - branch=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" branch --show-current 2>/dev/null || echo "unknown") - short_hash=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" rev-parse --short HEAD 2>/dev/null || echo "none") - commit_msg=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" log -1 --format='%s' 2>/dev/null || echo "none") - cat < Сбор модуля: ${mod_name}..." - generate_header "${mod_name}" > "${tmp_file}" - if [[ -x "${script}" ]]; then - "${script}" >> "${tmp_file}" 2>&1 - else - bash "${script}" >> "${tmp_file}" 2>&1 - fi - mv "${tmp_file}" "${out_file}" -} -if [[ "${TARGET}" == "all" ]]; then - echo "==> Сбор полного аудита Sovereign C2 в ${SNAPSHOTS_DIR}..." - for mod in "${MODULES[@]}"; do - run_single_module "${mod}" - done - echo "✔ Все модули телеметрии успешно сохранены." -else - case "${TARGET}" in - 00_workstation|workstation|host) run_single_module "00_workstation.sh" ;; - 01_pve|pve) run_single_module "01_pve.sh" ;; - 02_vps|vps) run_single_module "02_vps.sh" ;; - 03_vyos|vyos|net) run_single_module "03_vyos.sh" ;; - 04_tier0|tier0) run_single_module "04_tier0.sh" ;; - 05_k8s|k8s|talos) run_single_module "05_k8s.sh" ;; - *) - echo "Неизвестный модуль: ${TARGET}" - exit 1 - ;; - esac -fi - - - -#!/bin/bash -# Atlas C2 Configuration SSOT - -KDBX_PATH="${HOME}/Projects/atlas-secrets.kdbx" -RAM_CACHE="/dev/shm/.atlas_secrets_cache" -RAM_KEY="/dev/shm/.atlas_core" - -VAULT_ADDR="http://10.0.10.12:8200" -VYOS_ROUTER_IP="192.168.1.2" -NET_PREFIX="10.0.0.0/16" -GIT_HOST="git.svo88.space" -PVE_ENDPOINT="https://192.168.1.177:8006/" - -DEFAULT_SESSION_TTL=1 - - - -#!/bin/bash -set -euo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" - -SUBCMD="${1:-help}" -shift || true - -case "${SUBCMD}" in - git-credential) exec "${ZARYA_DIR}/cmd/git-credential.sh" "$@" ;; - exec) exec "${ZARYA_DIR}/cmd/exec.sh" "$@" ;; - p|pod|pods) exec "${ZARYA_DIR}/cmd/pods.sh" "$@" ;; - node|nodes) exec "${ZARYA_DIR}/cmd/nodes.sh" "$@" ;; - flux) exec "${ZARYA_DIR}/cmd/flux.sh" "$@" ;; - e|err|errors) exec "${ZARYA_DIR}/cmd/errors.sh" "$@" ;; - l|log|logs) exec "${ZARYA_DIR}/cmd/logs.sh" "$@" ;; - n|net) exec "${ZARYA_DIR}/cmd/net.sh" "$@" ;; - d|df|disks) exec "${ZARYA_DIR}/cmd/disks.sh" "$@" ;; - unseal) exec "${ZARYA_DIR}/cmd/unseal.sh" "$@" ;; - login|start) exec "${ZARYA_DIR}/cmd/session.sh" "start" "$@" ;; - logout|clean) exec "${ZARYA_DIR}/cmd/session.sh" "clean" "$@" ;; - up) exec "${ZARYA_DIR}/cmd/up.sh" "$@" ;; - run) exec "${ZARYA_DIR}/cmd/run.sh" "$@" ;; - a|apply) exec "${ZARYA_DIR}/cmd/a.sh" "$@" ;; - snap) exec "${ZARYA_DIR}/cmd/snap.sh" "$@" ;; - pack) exec "${ZARYA_DIR}/cmd/pack.sh" "$@" ;; - reset|nuke) exec "${ZARYA_DIR}/layers/reset.sh" "$@" ;; - gc) exec "${ZARYA_DIR}/layers/gc.sh" "$@" ;; - help|--help|-h) - cat <] [-s ] [-A] Просмотр подов - z nodes [-w] Статус нод, роли, зона и регион - z errors Мгновенный триаж сломанных сервисов - z logs [-f] [-t ] Логи сервиса без ввода неймспейса - z net Сетевой радар доступности узлов (1 сек) - z disks Срез пулов astra/terra и томов K8s -GitOps и оркестрация: - z flux [status|sync|logs] Управление GitOps-конвергенцией - z exec <команда...> Вызов бинарников внутри RAM-изоляции -Сессия и доступы: - z login [TTL] Открытие смены (YubiKey + RAM) - z logout Мгновенная очистка RAM - z unseal Распечатывание OpenBao Vault -Деплой и IaC: - z up [layer] Макро-слои (host, net, tier0, talos, apps, all) - z run Плейбуки Ansible (01, 02) - z a [-auto-approve] OpenTofu apply в RAM-изоляции -Телеметрия и LLM: - z snap Снятие аудита в state/snapshots/ - z pack [all|atlas|code|state] Сборка контекстов Repomix для LLM -EOF - ;; - *) - log_err "Неизвестная команда: ${SUBCMD}. Введите 'z help'." - exit 1 - ;; -esac - - - -#!/bin/bash -set -euo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" -if [[ -f "${RAM_CACHE}" ]]; then - token=$(grep '^export ATLAS_PUSH_TOKEN=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'\'' ' || true) - if [[ -n "${token}" ]]; then - echo "username=atlas" - echo "password=${token}" - fi -fi -exit 0 - - - -#!/bin/bash -set -euo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" -mode="${1:-all}" -pack_atlas() { - log_info "==> [1/3] Упаковка чистой архитектуры Atlas (atlas-code.xml)..." - (cd "${ATLAS_DIR}" && repomix --config "${ATLAS_DIR}/repomix.config.json") - log_ok "Файл ${ATLAS_DIR}/atlas-code.xml готов." -} -pack_zarya() { - log_info "==> [2/3] Упаковка станции оператора Zarya (zarya-code.xml)..." - (cd "${ZARYA_DIR}" && repomix --config "${ZARYA_DIR}/repomix.config.json") - log_ok "Файл ${ZARYA_DIR}/zarya-code.xml готов." -} -pack_state() { - log_info "==> [3/3] Снятие живого аудита и упаковка телеметрии (zarya-state.xml)..." - "${ZARYA_DIR}/state/collect_state.sh" all - (cd "${ZARYA_DIR}" && repomix --config "${ZARYA_DIR}/repomix.state.json") - log_ok "Файл ${ZARYA_DIR}/zarya-state.xml готов." -} -case "${mode}" in - all) - pack_atlas - echo "" - pack_zarya - echo "" - pack_state - echo "" - log_ok "Все три контекста Repomix собраны без ошибок." - ;; - atlas) - pack_atlas - ;; - code) - pack_zarya - ;; - state) - pack_state - ;; - *) - log_err "Использование: z pack [all|atlas|code|state]" - exit 1 - ;; -esac - - - -#!/bin/bash -ensure_prerequisites() { - local target_ip="${VAULT_ADDR#*//}" - target_ip="${target_ip%%:*}" - if ! ip route get "${target_ip}" 2>/dev/null | grep -q "${VYOS_ROUTER_IP}"; then - log_info "Восстанавливаем маршрут к ${NET_PREFIX} через VyOS (${VYOS_ROUTER_IP})..." - sudo ip route replace "${NET_PREFIX}" via "${VYOS_ROUTER_IP}" 2>/dev/null || true - fi - local target_helper="!${ZARYA_DIR}/bin/zarya git-credential" - local current_helper - current_helper=$(git config --global --get credential."https://${GIT_HOST}".helper 2>/dev/null || true) - if [[ "${current_helper}" != "${target_helper}" ]]; then - git config --global credential."https://${GIT_HOST}".helper "${target_helper}" - fi - local direct_helper - direct_helper=$(git config --global --get credential."http://10.0.10.13:3000".helper 2>/dev/null || true) - if [[ "${direct_helper}" != "${target_helper}" ]]; then - git config --global credential."http://10.0.10.13:3000".helper "${target_helper}" - fi - local ssh_hosts="proxmox pve0 vyos vyos_router 10.0.* dns0 vault0 git0 storage0 registry0" - if [[ -f "${HOME}/.ssh/config" ]] && ! grep -q "IdentityFile ${RAM_KEY}" "${HOME}/.ssh/config"; then - printf "\nHost %s\n IdentityFile %s\n IdentitiesOnly yes\n" "${ssh_hosts}" "${RAM_KEY}" >> "${HOME}/.ssh/config" - fi -} - - - -#!/bin/bash -load_secrets_to_ram() { - local hours="${1:-$DEFAULT_SESSION_TTL}" - local now - now=$(date +%s) - ensure_prerequisites - if [[ -f "${RAM_CACHE}" ]] && [[ -f "${RAM_KEY}" ]] && [[ -s "${RAM_KEY}" ]]; then - local created age cached_ttl - created=$(stat -c %Y "${RAM_CACHE}" 2>/dev/null || echo 0) - age=$(( now - created )) - cached_ttl=$(grep '^# TTL_SECONDS=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2 || echo 3600) - if [[ "${cached_ttl}" -ne 0 ]] && (( age >= cached_ttl )); then - log_warn "Время сессии истекло ($(( age / 60 )) мин >= $(( cached_ttl / 60 )) мин). Инвалидация кэша..." - rm -f "${RAM_CACHE}" "${RAM_KEY}" - else - return 0 - fi - fi - local ttl_seconds - if [[ "${hours}" -eq 0 ]]; then - ttl_seconds=0 - else - ttl_seconds=$(( hours * 3600 )) - fi - log_info "🔐 Вход в защищенный контур Zarya..." - read -s -p "Master Password: " KP_PASS - echo "" - local yk_args=() - if ykman info >/dev/null 2>&1; then - yk_args=("-y" "2") - log_info "YubiKey обнаружен. Приготовьтесь к аппаратному подтверждению (1 касание)..." - fi - local tmp_dump="/dev/shm/.kdbx_dump_${now}_$$.xml" - rm -f "${tmp_dump}" - touch "${tmp_dump}" - chmod 600 "${tmp_dump}" - if ! echo "${KP_PASS}" | keepassxc-cli export "${yk_args[@]}" "${KDBX_PATH}" -f xml > "${tmp_dump}" 2>/dev/null; then - log_err "Ошибка расшифровки базы KDBX (неверный пароль или таймаут касания YubiKey)" - rm -f "${tmp_dump}" - unset KP_PASS - return 1 - fi - unset KP_PASS - python3 "${ZARYA_DIR}/lib/kdbx_parser.py" "${tmp_dump}" "${RAM_CACHE}" "${RAM_KEY}" "${ttl_seconds}" "${PVE_ENDPOINT}" "${VAULT_ADDR}" - rm -f "${tmp_dump}" - log_ok "База расшифрована за 1 касание. Ключ и секреты в RAM (TTL: ${hours}ч)" -} -run_isolated() { - ensure_prerequisites - load_secrets_to_ram - ( - set -a - source "${RAM_CACHE}" - set +a - "$@" - ) -} - - - diff --git a/zarya-state.xml b/zarya-state.xml deleted file mode 100644 index 742b380..0000000 --- a/zarya-state.xml +++ /dev/null @@ -1,898 +0,0 @@ -This file is a merged representation of a subset of the codebase, containing specifically included files, combined into a single document by Repomix. -The content has been processed where empty lines have been removed. - - -This section contains a summary of this file. - - -This file contains a packed representation of a subset of the repository's contents that is considered the most important context. -It is designed to be easily consumable by AI systems for analysis, code review, -or other automated processes. - - - -The content is organized as follows: -1. This summary section -2. Repository information -3. Directory structure -4. Repository files (if enabled) -5. Multiple file entries, each consisting of: - - File path as an attribute - - Full contents of the file - - - -- This file should be treated as read-only. Any changes should be made to the - original repository files, not this packed version. -- When processing this file, use the file path to distinguish - between different files in the repository. -- Be aware that this file may contain sensitive information. Handle it with - the same level of security as you would the original repository. - - - -- Some files may have been excluded based on .gitignore rules and Repomix's configuration -- Binary files are not included in this packed representation. Please refer to the Repository Structure section for a complete list of file paths, including binary files -- Only files matching these patterns are included: state/snapshots/** -- Files matching default ignore patterns are excluded -- Empty lines have been removed from all files -- Files are sorted by Git change count (files with more changes are at the bottom) - - - - - -state/ - snapshots/ - 00_workstation.md - 01_pve.md - 02_vps.md - 03_vyos.md - 04_tier0.md - 05_k8s.md - - - -This section contains the contents of the repository's files. - - -# Sovereign C2 Runtime: 00_workstation -**Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git") -## 0. Рабочая станция администратора (Operator Environment) -### Инфраструктурные SSH-хосты (~/.ssh/config): -```text -Host proxmox pve0 - Hostname 192.168.1.177 - Port 22 - User root - -Host vyos vyos_router - Hostname 192.168.1.2 - Port 22 - User vyos - -Host 10.0.* dns0 vault0 git0 storage0 registry0 - User root - StrictHostKeyChecking no - UserKnownHostsFile /dev/null - LogLevel ERROR - -Host fin21 - Hostname 153.76.194.24 - Port 22 - User atlas - -Host incserv - Hostname 31.76.100.166 - Port 8765 - User root - -Host router - Hostname 192.168.1.1 - Port 1488 - User root - -Host proxmox pve0 vyos vyos_router fin21 10.0.* - IdentityFile /dev/shm/.atlas_core - IdentitiesOnly yes -``` -### Рабочие алиасы и функции оператора (Active Workflow Aliases): -```bash -# Маркер # >>> ATLAS C2 WORKFLOW >>> не найден в ~/.bashrc -``` -### Статус RAM-кэша секретов (/dev/shm/.atlas_secrets_cache): -```text -Размер: 1058 байт | Права: 600 | Создан: 2026-10-25 18:08:15.915202821 +0300 -``` -### Проверка Git Credential Helper (git.svo88.space): -```text -Username: atlas -Password: [PRESENT in RAM] -``` -### Ядро, память, ZRAM и параметры Coredump: -```text -Kernel: 7.2.5-3-omarchy -Swapon: NAME TYPE SIZE USED PRIO -/swap/swapfile file 13.5G 0B 0 -/dev/zram0 partition 13.5G 358M 100 -NAME ALGORITHM DISKSIZE DATA COMPR TOTAL STREAMS MOUNTPOINT -/dev/zram0 zstd 13.5G 331.5M 89.6M 95M [SWAP] -Coredump config: -#Storage=external -#ProcessSizeMax=32G -``` -### Токены безопасности и ключи в ssh-agent: -```text -Active SSH Agent keys: -The agent has no identities. -YubiKey / FIDO2 Status: -Device type: YubiKey 5 Nano -Serial number: 29508635 -Firmware version: 5.7.1 -Form factor: Nano (USB-A) -Enabled USB interfaces: OTP, FIDO, CCID - -Applications -Yubico OTP Enabled -FIDO U2F Enabled -FIDO2 Enabled -OATH Enabled -PIV Enabled -OpenPGP Enabled -YubiHSM Auth Enabled -``` -### Зеркала пакетов Pacman (Mirrorlist): -```text -/etc/pacman.conf:[options] -/etc/pacman.conf:[core] -/etc/pacman.conf:[extra] -/etc/pacman.conf:[multilib] -/etc/pacman.conf:[omarchy] -/etc/pacman.conf:Server = https://pkgs.omarchy.org/stable/$arch -/etc/pacman.d/mirrorlist:Server = https://stable-mirror.omarchy.org/$repo/os/$arch -/etc/pacman.d/mirrorlist.bak:Server = https://mirror.omarchy.org/$repo/os/$arch -/etc/pacman.d/mirrorlist.omarchy-upgrade-to-quattro.20260905155315.bak:Server = https://mirror.omarchy.org/$repo/os/$arch -Нет данных о зеркалах -``` -### Маршрутизация на хосте (Routing to C2): -```text -default via 192.168.1.2 dev enp34s0 proto dhcp src 192.168.1.247 metric 100 -10.0.0.0/16 via 192.168.1.2 dev enp34s0 proto static metric 100 -192.168.1.0/24 dev enp34s0 proto kernel scope link src 192.168.1.247 metric 100 -``` -### Версии локальных инструментов: -```text -OpenTofu: OpenTofu v1.12.1 -Kubectl: gitVersion: v1.36.4 -Talosctl: Client: -Talos v1.14.0 -``` -### Состояние локального Git-репозитория (SSOT Source): -```text -fatal: not a git repository (or any parent up to mount point /) -Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set). -fatal: not a git repository (or any parent up to mount point /) -Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set). -Последний коммит: -Remote URL: no remote -``` ---- - - - -# Sovereign C2 Runtime: 01_pve -**Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git") -## 1. Гипервизор Proxmox VE (192.168.1.177) -### Память хоста, Uptime и Температура CPU: -```text - 18:20:07 up 3:30, 1 user, load average: 1.59, 1.90, 1.69 - - total used free shared buff/cache available -Mem: 37Gi 30Gi 5.8Gi 75Mi 1.3Gi 6.6Gi -Swap: 0B 0B 0B - -``` -### Здоровье физических дисков (SMART): -```text -/dev/sda: SMART overall-health self-assessment test result: PASSED -/dev/sdb: SMART overall-health self-assessment test result: PASSED -/dev/sdc: SMART overall-health self-assessment test result: PASSED -/dev/sdd: SMART overall-health self-assessment test result: PASSED -/dev/sde: SMART overall-health self-assessment test result: PASSED -/dev/sdf: SMART overall-health self-assessment test result: PASSED -``` -### Статус шифрования ZFS (Encryption & Keys): -```text -NAME PROPERTY VALUE SOURCE -astra encryption aes-256-gcm - -astra keystatus available - -astra keyformat raw - -astra keylocation file:///etc/zfs/keys/astra.key local -terra encryption aes-256-gcm - -terra keystatus available - -terra keyformat raw - -terra keylocation file:///etc/zfs/keys/terra.key local -``` -### Здоровье и емкость ZFS-пулов: -```text -NAME SIZE ALLOC FREE FRAG CAP HEALTH -astra 2.78T 540G 2.25T 9% 18% ONLINE -terra 1.81T 345G 1.48T 0% 18% ONLINE - -NAME USED AVAIL REFER MOUNTPOINT -astra 360G 1.44T 55.0M /astra -astra/vm-100-cloudinit 128K 1.44T 128K - -astra/vm-100-disk-0 1.06G 1.44T 1.06G - -astra/vm-201-disk-0 1.38G 1.44T 1.38G - -astra/vm-202-disk-0 14.8G 1.44T 14.8G - -astra/vm-203-disk-0 20.4G 1.44T 20.4G - -astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 27.2M 1.44T 27.2M - -astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 8.61M 1.44T 8.61M - -astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 203M 1.44T 203M - -astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 714K 1.44T 714K - -astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 5.13M 1.44T 5.13M - -astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 884K 1.44T 884K - -astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 1.05M 1.44T 1.05M - -astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 416K 1.44T 416K - -astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 7.02M 1.44T 7.02M - -astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 320G 1.44T 320G - -astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 970K 1.44T 970K - -astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 375M 1.44T 375M - -astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 1.33M 1.44T 1.33M - -astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 2.54M 1.44T 2.54M - -astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 704M 1.44T 704M - -astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 14.5M 1.44T 14.5M - -astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 20.7M 1.44T 20.7M - -terra 345G 1.42T 12.6G /terra -terra/media 248K 1.42T 248K /terra/media -terra/s3 192K 1.42T 192K /terra/s3 -terra/vault 333G 1.42T 333G /terra/vault -``` -### Физическая емкость каталогов на /terra: -```text -68K /terra/media -4.6M /terra/models -171K /terra/packages -13G /terra/registry -8.5K /terra/s3 -4.3M /terra/torrents -333G /terra/vault -``` -### Блочные устройства хоста и тома ZVOL (lsblk): -```text -NAME FSTYPE SIZE MOUNTPOINTS -loop0 ext4 4G -loop1 ext4 4G -loop2 ext4 2G -loop3 ext4 8G -loop4 ext4 8G -sda 1.8T -├─sda1 zfs_member 1.8T -└─sda9 8M -sdb 953.9G -├─sdb1 zfs_member 953.9G -└─sdb9 8M -sdc 476.9G -├─sdc1 vfat 976M /boot/efi -├─sdc2 linux_raid_member 977M -│ └─md0 ext4 976M /boot -└─sdc3 linux_raid_member 445.3G - └─md1 crypto_LUKS 445.1G - └─md1_crypt ext4 445.1G / -sdd 953.9G -├─sdd1 zfs_member 953.9G -└─sdd9 8M -sde 447.1G -├─sde1 vfat 976M -├─sde2 linux_raid_member 977M -│ └─md0 ext4 976M /boot -└─sde3 linux_raid_member 445.2G - └─md1 crypto_LUKS 445.1G - └─md1_crypt ext4 445.1G / -sdf 953.9G -├─sdf1 zfs_member 953.9G -└─sdf9 8M -zd0 ext4 2G -zd16 ext4 10G -zd32 ext4 10G -zd48 ext4 20G -zd64 iso9660 4M -zd80 ext4 5G -zd96 ext4 5G -zd112 ext4 5G -zd128 ext4 5G -zd144 100G -├─zd144p1 vfat 100M -├─zd144p2 1M -├─zd144p3 xfs 2G -├─zd144p4 1M -├─zd144p5 xfs 100M -└─zd144p6 xfs 97.8G -zd160 ext4 30G -zd176 ext4 30G -zd192 ext4 400G -zd208 ext4 100G -zd224 100G -├─zd224p1 vfat 100M -├─zd224p2 1M -├─zd224p3 xfs 2G -├─zd224p4 1M -├─zd224p5 xfs 100M -└─zd224p6 xfs 97.8G -zd240 10G -├─zd240p1 1M -├─zd240p2 vfat 256M -└─zd240p3 ext4 9G -zd256 ext4 100G -zd272 20G -├─zd272p1 vfat 100M -├─zd272p2 1M -├─zd272p3 xfs 2G -├─zd272p4 1M -├─zd272p5 xfs 100M -└─zd272p6 xfs 17.8G -zd288 ext4 20G -zd304 ext4 15G -zd320 ext4 5G -zd336 ext4 30G -``` -### Виртуальные диски K8s и ВМ (ZVOLs на astra): -```text -NAME VOLSIZE USED REFER -astra/vm-100-cloudinit 4M 128K 128K -astra/vm-100-disk-0 10G 1.06G 1.06G -astra/vm-201-disk-0 20G 1.38G 1.38G -astra/vm-202-disk-0 100G 14.8G 14.8G -astra/vm-203-disk-0 100G 20.4G 20.4G -astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10G 27.2M 27.2M -astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100G 8.61M 8.61M -astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100G 203M 203M -astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5G 714K 714K -astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20G 5.13M 5.13M -astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10G 884K 884K -astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15G 1.05M 1.05M -astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2G 416K 416K -astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5G 7.02M 7.02M -astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400G 320G 320G -astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5G 970K 970K -astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5G 375M 375M -astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20G 1.33M 1.33M -astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5G 2.54M 2.54M -astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30G 704M 704M -astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30G 14.5M 14.5M -astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30G 20.7M 20.7M -``` -### Модули ядра (nfsd, zfs): -```text -zfs 6262784 44 -nfsd 1011712 3 -``` -### Теги сетевых карт ВМ 100 (VyOS) в Proxmox: -```text -net0: virtio=BC:24:11:DC:6D:EC,bridge=vmbr0,firewall=0 -net1: virtio=BC:24:11:3F:CB:C9,bridge=vmbr0,firewall=0,tag=20 -net2: virtio=BC:24:11:EA:32:2F,bridge=vmbr0,firewall=0,tag=30 -net3: virtio=BC:24:11:59:E8:8D,bridge=vmbr0,firewall=0,tag=10 -``` -### Точки монтирования LXC-контейнеров (/etc/pve/lxc/*.conf): -```text -/etc/pve/lxc/101.conf:mp0: /astra/data/dns0,mp=/opt/technitium/dns/config -/etc/pve/lxc/102.conf:mp0: /astra/data/vault0,mp=/var/lib/bao/data -/etc/pve/lxc/103.conf:mp0: /astra/data/git0,mp=/var/lib/forgejo -/etc/pve/lxc/104.conf:mp0: /terra/media,mp=/media -/etc/pve/lxc/104.conf:mp1: /terra/torrents,mp=/torrents -/etc/pve/lxc/104.conf:mp2: /terra/vault,mp=/backups -/etc/pve/lxc/104.conf:mp3: /terra/models,mp=/models -/etc/pve/lxc/104.conf:mp4: /terra/packages,mp=/packages -/etc/pve/lxc/105.conf:mp0: /terra/registry,mp=/mnt/registry -``` -### Флаги автостарта ВМ и Контейнеров (onboot): -```text -/etc/pve/qemu-server/100.conf:onboot: 1 -/etc/pve/qemu-server/201.conf:onboot: 1 -/etc/pve/qemu-server/202.conf:onboot: 1 -/etc/pve/qemu-server/203.conf:onboot: 1 -/etc/pve/lxc/101.conf:onboot: 1 -/etc/pve/lxc/102.conf:onboot: 1 -/etc/pve/lxc/103.conf:onboot: 1 -/etc/pve/lxc/104.conf:onboot: 1 -/etc/pve/lxc/105.conf:onboot: 1 -``` -### Виртуальные машины (QEMU) и Контейнеры (LXC): -```text - VMID NAME STATUS MEM(MB) BOOTDISK(GB) PID - 100 vyos-router running 2048 10.00 2594 - 201 talos-master-1 running 2560 20.00 2698 - 202 talos-worker-1 running 10240 100.00 3869 - 203 talos-worker-2 running 10240 100.00 4919 - -VMID Status Lock Name -101 running dns0 -102 running vault0 -103 running git0 -104 running storage0 -105 running registry0 -``` ---- - - - -# Sovereign C2 Runtime: 02_vps -**Срез:** 2026-10-25 15:20:12 UTC | **Git:** master@10fbe14 ("git") -## 2. Периметр: Белый VPS (Host: fin21, IP: 153.76.194.24) -### WireGuard wg0 на VPS: -```text -interface: wg0 - public key: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY= - private key: (hidden) - listening port: 51820 - -peer: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4= - endpoint: 45.93.6.172:46777 - allowed ips: 10.8.0.2/32, 10.0.30.200/32 - latest handshake: 3 hours, 28 minutes, 44 seconds ago - transfer: 64.06 MiB received, 54.22 MiB sent -``` -### Статус системных сервисов (Edge Stack): -```text -WireGuard: active | HAProxy: active | Xray: active | Nginx: active -``` -### Прослушиваемые сокеты (Ports 80, 443, 4443, 8443, 51820): -```text -udp UNCONN 0 0 0.0.0.0:51820 0.0.0.0:* -udp UNCONN 0 0 [::]:51820 [::]:* -tcp LISTEN 0 4096 127.0.0.1:4443 0.0.0.0:* users:(("haproxy",pid=862,fd=10)) -tcp LISTEN 0 511 127.0.0.1:8443 0.0.0.0:* users:(("nginx",pid=739,fd=5),("nginx",pid=735,fd=5)) -tcp LISTEN 0 4096 0.0.0.0:80 0.0.0.0:* users:(("haproxy",pid=862,fd=9)) -tcp LISTEN 0 4096 *:443 *:* users:(("xray",pid=690,fd=3)) -``` -### Тест аварийной заглушки Nginx (127.0.0.1:8443): -```text -Atlas Sovereign Home Server is currently offline for maintenance. -``` -### Конфигурация SSH-демона (sshd runtime): -```text -permitrootlogin no -passwordauthentication yes -``` ---- - - - -# Sovereign C2 Runtime: 03_vyos -**Срез:** 2026-10-25 15:20:15 UTC | **Git:** master@10fbe14 ("git") -## 3. Маршрутизатор VyOS (192.168.1.2) -### Сетевые интерфейсы и L2-транк (VLANs 10, 20, 30): -```text -Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down -Interface IP Address MAC VRF MTU S/L Description ------------ -------------- ----------------- ------- ----- ----- ------------------- -eth0 192.168.1.2/24 bc:24:11:dc:6d:ec default 1500 u/u WAN_TRUNK -eth1 10.0.20.1/24 bc:24:11:3f:cb:c9 default 1500 u/u K8S -eth2 10.0.10.1/24 bc:24:11:59:e8:8d default 1500 u/u TIER0 -eth3 10.0.30.1/24 bc:24:11:ea:32:2f default 1500 u/u LAN_CLIENTS -lo 127.0.0.1/8 00:00:00:00:00:00 default 65536 u/u - ::1/128 -tun0 172.19.0.1/30 n/a default 65535 u/u -wg0 10.8.0.2/24 n/a default 1420 u/u TUNNEL_TO_VPS_FIN21 -``` -### ARP-таблица K8s-интерфейса eth1 (проверка связности с нодами): -```text -10.0.20.11 lladdr bc:24:11:12:c5:1b REACHABLE -10.0.20.12 lladdr bc:24:11:ef:1a:d4 STALE -10.0.20.10 lladdr bc:24:11:71:b6:82 REACHABLE -fe80::be24:11ff:fe12:c51b lladdr bc:24:11:12:c5:1b STALE -fe80::be24:11ff:feef:1ad4 lladdr bc:24:11:ef:1a:d4 STALE -fe80::be24:11ff:fe71:b682 lladdr bc:24:11:71:b6:82 STALE -``` -### DHCP-сервер и выданные лизы (Options 3, 6): -```text -IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname Origin ------------- ----------------- ------- ------------------- ------------------- ----------- ----------- -------------- -------- -10.0.20.10 bc:24:11:71:b6:82 active 2026-10-25 11:51:32 2026-10-26 11:51:32 20:31:16 K8S talos-master-1 local -10.0.20.11 bc:24:11:12:c5:1b active 2026-10-25 12:29:01 2026-10-26 12:29:01 21:08:45 K8S talos-worker-1 local -10.0.20.12 bc:24:11:ef:1a:d4 active 2026-10-25 12:29:04 2026-10-26 12:29:04 21:08:48 K8S talos-worker-2 local -10.0.30.100 bc:24:11:eb:38:63 active 2026-10-25 12:29:02 2026-10-26 12:29:02 21:08:46 LAN_CLIENTS talos-worker-1 local -10.0.30.101 bc:24:11:bb:00:d3 active 2026-10-25 12:29:05 2026-10-26 12:29:05 21:08:49 LAN_CLIENTS talos-worker-2 local -``` -### Перехват DNS через DNAT (Rule 53 -> 127.0.0.42:53): -```text -Rule Source Destination Proto In-Int Translation ------- --------- ------------- -------- -------- ------------- -53 0.0.0.0/0 0.0.0.0/0 TCP, UDP LAN 127.0.0.42 - sport any dport 53 port 53 -``` -### Контейнеры маршрутизатора (Sing-Box & Zapret2): -```text -CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES -9217a0a6ac83 ghcr.io/sagernet/sing-box:latest run -c /etc/sing-... 3 hours ago Up 3 hours sing-box -c7e27e9bb9fc docker.io/vernette/ss-zapret2:latest /etc/zapret/run.s... 3 hours ago Up 3 hours 1080/tcp, 8388/tcp zapret2 -``` -### Наличие /dev/net/tun внутри контейнера sing-box: -```text -crw-rw-rw- 1 root root 10, 200 Oct 25 11:51 /dev/net/tun -``` -### Задержка VLESS-канала через Clash API (Main-1-out -> fin21): -```text -{"type": "VLESS", "name": "Main-1-out", "udp": true, "history": [{"time":"2026-10-25T15:19:30.52662628Z","delay":122}]}``` -### Статус таймера автосинхронизации Git (singbox-sync): -```text -● singbox-sync.timer - Periodic Sing-Box Config Git Sync Timer - Loaded: loaded (/etc/systemd/system/singbox-sync.timer; enabled; preset: enabled) - Active: active (waiting) since Sun 2026-10-25 11:51:13 UTC; 3h 29min ago - Trigger: Sun 2026-10-25 15:20:23 UTC; 6s left - Triggers: ● singbox-sync.service - -Oct 25 11:51:13 vyos-router systemd[1]: Started Periodic Sing-Box Config Git Sync Timer. - -Oct 25 15:19:23 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully. -Oct 25 15:19:23 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync. -Oct 25 15:19:53 vyos-router systemd[1]: Starting Automated Sing-Box Config Git Sync... -Oct 25 15:19:54 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully. -Oct 25 15:19:54 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync. -``` -### Статус WireGuard туннеля wg0 и пинг до VPS: -```text -interface: wg0 - public key: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4= - private key: (hidden) - listening port: 34756 - -peer: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY= - endpoint: 153.76.194.24:51820 - allowed ips: 10.8.0.0/24 - latest handshake: 3 hours, 28 minutes, 47 seconds ago - transfer: 1.12 KiB received, 282.34 KiB sent - persistent keepalive: every 25 seconds - -VyOS или туннель недоступен -``` -### Таблица маршрутизации (show ip route): -```text -Codes: K - kernel route, C - connected, L - local, S - static, - R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, t - Table-Direct, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -IPv4 unicast VRF default: -S>* 0.0.0.0/0 [1/0] via 192.168.1.1, eth0, weight 1, 03:28:52 -C>* 10.0.10.0/24 is directly connected, eth2, weight 1, 03:28:58 -L>* 10.0.10.1/32 is directly connected, eth2, weight 1, 03:28:58 -C>* 10.0.20.0/24 is directly connected, eth1, weight 1, 03:28:58 -L>* 10.0.20.1/32 is directly connected, eth1, weight 1, 03:28:58 -C>* 10.0.30.0/24 is directly connected, eth3, weight 1, 03:28:58 -L>* 10.0.30.1/32 is directly connected, eth3, weight 1, 03:28:58 -C>* 10.8.0.0/24 is directly connected, wg0, weight 1, 03:28:57 -L>* 10.8.0.2/32 is directly connected, wg0, weight 1, 03:28:57 -C>* 172.19.0.0/30 is directly connected, tun0, weight 1, 03:28:55 -L>* 172.19.0.1/32 is directly connected, tun0, weight 1, 03:28:55 -C>* 192.168.1.0/24 is directly connected, eth0, weight 1, 03:28:58 -L>* 192.168.1.2/32 is directly connected, eth0, weight 1, 03:28:58 -``` ---- - - - -# Sovereign C2 Runtime: 04_tier0 -**Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git") -## 4. Сервисы Tier-0 (Air-Gap фундамент) -### Technitium DNS (10.0.10.11:53): -* **Внутренний домен (*.svo88.space -> 10.0.30.200):** 10.0.30.200 -* **Внешний резолв (google.com):** 173.194.220.100 -### OpenBao Vault (10.0.10.12:8200): -```json -{"type":"shamir","initialized":true,"sealed":false,"t":1,"n":1,"progress":0,"nonce":"","version":"2.0.1","build_date":"2024-09-03T19:57:34Z","migration":false,"cluster_name":"vault-cluster-74026fc7","cluster_id":"79b6d270-a6b1-b082-39be-aeb24d8841f5","recovery_seal":false,"storage_type":"file"} -``` -### Zot OCI Registry (10.0.10.15:5000): -```json -{"repositories":["alpine","docker.io/getmeili/meilisearch","docker.io/grafana/loki","docker.io/jellyfin/jellyfin","docker.io/library/alpine","docker.io/library/busybox","docker.io/library/nginx","docker.io/library/postgres","docker.io/library/redis","docker.io/library/traefik","docker.io/netboxcommunity/netbox","docker.io/opencloudeu/opencloud-rolling","docker.io/owncloud/ocis","docker.io/searxng/searxng","docker.io/vaultwarden/server","docker.io/victoriametrics/victoria-metrics","docker.io/xream/sub-store","ghcr.io/anatol/pacoloco","ghcr.io/donkie/spoolman","ghcr.io/external-secrets/external-secrets","ghcr.io/fluxcd/helm-controller","ghcr.io/fluxcd/image-automation-controller","ghcr.io/fluxcd/image-reflector-controller","ghcr.io/fluxcd/kustomize-controller","ghcr.io/fluxcd/notification-controller","ghcr.io/fluxcd/source-controller","ghcr.io/fluxcd/source-watcher","ghcr.io/goauthentik/server","ghcr.io/immich-app/postgres","ghcr.io/karakeep-app/karakeep","ghcr.io/karakeep-app/karakeep-chrome","ghcr.io/kiwix/kiwix-serve","ghcr.io/sergelogvinov/proxmox-csi-controller","ghcr.io/sergelogvinov/proxmox-csi-node","ghcr.io/siderolabs/kubelet","ghcr.io/sysadminsmedia/homebox","ghcr.io/triliumnext/notes","ghcr.io/triliumnext/trilium","ghcr.io/we-promise/sure","ghcr.io/xiao-villamor/printstash","k8s.io/coredns/coredns","k8s.io/kube-apiserver","k8s.io/kube-controller-manager","k8s.io/kube-proxy","k8s.io/kube-scheduler","k8s.io/sig-storage/csi-attacher","k8s.io/sig-storage/csi-provisioner","k8s.io/sig-storage/csi-resizer","k8s.io/sig-storage/livenessprobe","quay.io/invidious/invidious","quay.io/invidious/invidious-companion","quay.io/jetstack/cert-manager-cainjector"]}``` -### Forgejo GitOps Server (10.0.10.13:3000): -```json -{"version":"7.0.4+gitea-1.21.11"} -``` -### Ядерный NFS nfsd (storage0 - 10.0.10.14): -```text -== Активные экспорты ядра (exportfs): -/media 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) -/torrents 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) -/backups 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) -/models 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) -/packages 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) -/media 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) -/torrents 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) -/backups 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) -/models 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) -/packages 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) - -== Емкость смонтированных ZFS-датасетов: -Filesystem Size Used Available Use% Mounted on -terra/media 1.4T 1.0M 1.4T 0% /media -terra 1.4T 12.6G 1.4T 1% /torrents -terra/vault 1.7T 332.6G 1.4T 19% /backups -terra 1.4T 12.6G 1.4T 1% /torrents - -== Права точки монтирования OpenCloud: -drwxrws--- 5 1000 1000 5 Oct 25 12:31 /backups/opencloud-users -``` ---- - - - -# Sovereign C2 Runtime: 05_k8s -**Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git") -## 5. Kubernetes Платформа & Нагрузки -### Участники кластера Talos (OS-level): -```text -10.0.20.10: error getting server version: error constructing client: failed to create client connection: failed to resolve configuration context: talos config file is empty -Talos API недоступен -``` -### Ноды кластера K8s: -```text -NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME -talos-1il-vwa Ready control-plane 3h26m v1.37.0 10.0.20.10 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4 -talos-worker-1 Ready 171m v1.37.0 10.0.20.11 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4 -talos-worker-2 Ready 170m v1.37.0 10.0.20.12 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4 -``` -### Топологические лейблы нод (Proxmox-CSI topology): -```text -NAME STATUS ROLES AGE VERSION ZONE REGION -talos-1il-vwa Ready control-plane 3h26m v1.37.0 -talos-worker-1 Ready 171m v1.37.0 pve0 atlas -talos-worker-2 Ready 170m v1.37.0 pve0 atlas -``` -### Статус ExternalSecrets (Синхронизация из Vault): -```text -NAME AGE STATUS CAPABILITIES READY -clustersecretstore.external-secrets.io/openbao-backend 33d Valid ReadWrite True - -NAMESPACE NAME STORETYPE STORE REFRESH INTERVAL STATUS READY LAST SYNC -authentik externalsecret.external-secrets.io/authentik-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 49m -databases externalsecret.external-secrets.io/all-db-passwords ClusterSecretStore openbao-backend 1h SecretSynced True 20m -databases externalsecret.external-secrets.io/postgres-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m -documents externalsecret.external-secrets.io/paperless-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m -flux-system externalsecret.external-secrets.io/atlas-repo-auth ClusterSecretStore openbao-backend 1h SecretSyncedError False 3d1h -infra externalsecret.external-secrets.io/netbox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m -kube-system externalsecret.external-secrets.io/proxmox-csi-config ClusterSecretStore openbao-backend 1h SecretSynced True 20m -media externalsecret.external-secrets.io/immich-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m -media externalsecret.external-secrets.io/invidious-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m -monitoring externalsecret.external-secrets.io/grafana-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m -security externalsecret.external-secrets.io/vaultwarden-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m -tools externalsecret.external-secrets.io/homebox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m -tools externalsecret.external-secrets.io/karakeep-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m -tools externalsecret.external-secrets.io/printstash-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m -tools externalsecret.external-secrets.io/searxng-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m -tools externalsecret.external-secrets.io/sure-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m -``` -### Сетевой ingress, сертификаты TLS и L2 Fast-Path VIP: -```text -NAMESPACE NAME READY SECRET AGE -authentik certificate.cert-manager.io/auth-svo88-tls True auth-svo88-tls 27d -devices certificate.cert-manager.io/print-svo88-tls True print-svo88-tls 7d5h -documents certificate.cert-manager.io/paperless-svo88-tls True paperless-svo88-tls 26d -documents certificate.cert-manager.io/trilium-svo88-tls True trilium-svo88-tls 21d -infra certificate.cert-manager.io/dns-svo88-tls True dns-svo88-tls 26d -infra certificate.cert-manager.io/git-svo88-tls True git-svo88-tls 27d -infra certificate.cert-manager.io/netbox-svo88-tls True netbox-svo88-tls 26d -infra certificate.cert-manager.io/pkg-svo88-tls True pkg-svo88-tls 6d20h -infra certificate.cert-manager.io/pve-svo88-tls True pve-svo88-tls 26d -infra certificate.cert-manager.io/vault-svo88-tls True vault-svo88-tls 26d -infra certificate.cert-manager.io/zot-svo88-tls True zot-svo88-tls 27d -media certificate.cert-manager.io/immich-svo88-tls True immich-svo88-tls 25d -media certificate.cert-manager.io/jellyfin-svo88-tls True jellyfin-svo88-tls 21d -media certificate.cert-manager.io/metube-svo88-tls True metube-svo88-tls 21d -media certificate.cert-manager.io/yt-svo88-tls True yt-svo88-tls 21d -security certificate.cert-manager.io/vw-svo88-tls True vw-svo88-tls 31d -storage certificate.cert-manager.io/opencloud-svo88-tls True opencloud-svo88-tls 26d -tools certificate.cert-manager.io/dash-svo88-tls True dash-svo88-tls 21d -tools certificate.cert-manager.io/finance-svo88-tls True finance-svo88-tls 26d -tools certificate.cert-manager.io/homebox-svo88-tls True homebox-svo88-tls 27d -tools certificate.cert-manager.io/keep-svo88-tls True keep-svo88-tls 21d -tools certificate.cert-manager.io/printstash-svo88-tls True printstash-svo88-tls 27d -tools certificate.cert-manager.io/search-svo88-tls True search-svo88-tls 26d -tools certificate.cert-manager.io/spoolman-svo88-tls True spoolman-svo88-tls 7d5h -tools certificate.cert-manager.io/sub-store-svo88-tls True sub-store-svo88-tls 3d9h - -NAMESPACE NAME CLASS HOSTS ADDRESS PORTS AGE -authentik ingress.networking.k8s.io/authentik traefik auth.svo88.space 10.0.30.200 80, 443 27d -devices ingress.networking.k8s.io/qidi-printer traefik print.svo88.space 10.0.30.200 80, 443 7d5h -documents ingress.networking.k8s.io/paperless traefik paperless.svo88.space 10.0.30.200 80, 443 26d -documents ingress.networking.k8s.io/trilium traefik trilium.svo88.space 10.0.30.200 80, 443 21d -infra ingress.networking.k8s.io/forgejo-git traefik git.svo88.space 10.0.30.200 80, 443 27d -infra ingress.networking.k8s.io/netbox traefik netbox.svo88.space 10.0.30.200 80, 443 26d -infra ingress.networking.k8s.io/openbao-vault traefik vault.svo88.space 10.0.30.200 80, 443 26d -infra ingress.networking.k8s.io/pkg-custom traefik pkg.svo88.space 10.0.30.200 80 6d20h -infra ingress.networking.k8s.io/pkg-server traefik pkg.svo88.space 10.0.30.200 80, 443 6d20h -infra ingress.networking.k8s.io/proxmox-ve traefik pve.svo88.space 10.0.30.200 80, 443 26d -infra ingress.networking.k8s.io/technitium-dns traefik dns.svo88.space 10.0.30.200 80, 443 26d -infra ingress.networking.k8s.io/zot-registry traefik zot.svo88.space 10.0.30.200 80, 443 27d -media ingress.networking.k8s.io/immich traefik immich.svo88.space 10.0.30.200 80, 443 25d -media ingress.networking.k8s.io/invidious traefik yt.svo88.space 10.0.30.200 80, 443 21d -media ingress.networking.k8s.io/jellyfin traefik jellyfin.svo88.space 10.0.30.200 80, 443 21d -media ingress.networking.k8s.io/metube traefik metube.svo88.space 10.0.30.200 80, 443 21d -security ingress.networking.k8s.io/vaultwarden traefik vw.svo88.space 10.0.30.200 80, 443 31d -storage ingress.networking.k8s.io/opencloud traefik opencloud.svo88.space 10.0.30.200 80, 443 26d -tools ingress.networking.k8s.io/dashboard traefik dash.svo88.space 10.0.30.200 80, 443 21d -tools ingress.networking.k8s.io/homebox traefik homebox.svo88.space 10.0.30.200 80, 443 27d -tools ingress.networking.k8s.io/karakeep traefik keep.svo88.space 10.0.30.200 80, 443 21d -tools ingress.networking.k8s.io/printstash traefik printstash.svo88.space 10.0.30.200 80, 443 27d -tools ingress.networking.k8s.io/searxng traefik search.svo88.space 10.0.30.200 80, 443 26d -tools ingress.networking.k8s.io/spoolman traefik spoolman.svo88.space 10.0.30.200 80, 443 7d5h -tools ingress.networking.k8s.io/sub-store traefik sub-store.svo88.space 10.0.30.200 80, 443 3d9h -tools ingress.networking.k8s.io/sure-finance traefik finance.svo88.space 10.0.30.200 80, 443 26d - -NAME AGE -ciliuml2announcementpolicy.cilium.io/lan-fastpath-announcement 35d - -NAME DISABLED CONFLICTING IPS AVAILABLE AGE -ciliumloadbalancerippool.cilium.io/lan-ingress-pool false False 0 35d - -Traefik VIP (10.0.30.200:443) HTTP Status: 404 -``` -### Диски и тома (PVC / PV): -```text -NAMESPACE NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE -databases persistentvolumeclaim/postgres-data-postgres-core-0 Bound pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO proxmox-csi-db 32d -documents persistentvolumeclaim/paperless-data-pvc Bound pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO proxmox-csi-general 32d -documents persistentvolumeclaim/trilium-data-pvc Bound pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO proxmox-csi-general 21d -infra persistentvolumeclaim/netbox-media-pvc Bound pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO proxmox-csi-general 32d -infra persistentvolumeclaim/nfs-packages-pvc Bound nfs-packages-pv 200Gi RWX 6d20h -media persistentvolumeclaim/immich-db-pvc Bound pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO proxmox-csi-db 25d -media persistentvolumeclaim/immich-library-pvc Bound pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO proxmox-csi-general 25d -media persistentvolumeclaim/jellyfin-config-pvc Bound pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO proxmox-csi-general 21d -media persistentvolumeclaim/nfs-kiwix-pvc Bound nfs-kiwix-pv 200Gi ROX 32d -media persistentvolumeclaim/nfs-media-pvc Bound nfs-media-pv 1Ti RWX 21d -media persistentvolumeclaim/nfs-torrents-pvc Bound nfs-torrents-pv 500Gi RWX 32d -monitoring persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general 16d -monitoring persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general 16d -monitoring persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general 16d -security persistentvolumeclaim/vaultwarden-data-pvc Bound pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO proxmox-csi-general 32d -storage persistentvolumeclaim/nfs-opencloud-users-pvc Bound nfs-opencloud-users-pv 600Gi RWX 21d -storage persistentvolumeclaim/opencloud-data-pvc Bound pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO proxmox-csi-general 16d -tools persistentvolumeclaim/homebox-data-pvc Bound pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO proxmox-csi-general 32d -tools persistentvolumeclaim/karakeep-data-pvc Bound pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO proxmox-csi-general 21d -tools persistentvolumeclaim/karakeep-meili-pvc Bound pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO proxmox-csi-general 21d -tools persistentvolumeclaim/printstash-models-pvc Bound printstash-models-pv 100Gi RWX 32d -tools persistentvolumeclaim/spoolman-data-pvc Bound pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO proxmox-csi-general 7d5h -tools persistentvolumeclaim/sub-store-data-pvc Bound pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO proxmox-csi-general 3d9h - -NAMESPACE NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS VOLUMEATTRIBUTESCLASS REASON AGE - persistentvolume/nfs-kiwix-pv 200Gi ROX Retain Bound media/nfs-kiwix-pvc 32d - persistentvolume/nfs-media-pv 1Ti RWX Retain Bound media/nfs-media-pvc 21d - persistentvolume/nfs-opencloud-users-pv 600Gi RWX Retain Bound storage/nfs-opencloud-users-pvc 21d - persistentvolume/nfs-packages-pv 200Gi RWX Retain Bound infra/nfs-packages-pvc 6d20h - persistentvolume/nfs-torrents-pv 500Gi RWX Retain Bound media/nfs-torrents-pvc 32d - persistentvolume/printstash-models-pv 100Gi RWX Retain Bound tools/printstash-models-pvc 32d - persistentvolume/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO Delete Bound documents/trilium-data-pvc proxmox-csi-general 21d - persistentvolume/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO Delete Bound storage/opencloud-data-pvc proxmox-csi-general 16d - persistentvolume/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO Delete Bound databases/postgres-data-postgres-core-0 proxmox-csi-db 32d - persistentvolume/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO Delete Bound tools/karakeep-meili-pvc proxmox-csi-general 21d - persistentvolume/pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO Delete Bound media/jellyfin-config-pvc proxmox-csi-general 21d - persistentvolume/pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO Delete Bound infra/netbox-media-pvc proxmox-csi-general 32d - persistentvolume/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO Delete Bound tools/karakeep-data-pvc proxmox-csi-general 21d - persistentvolume/pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO Delete Bound tools/sub-store-data-pvc proxmox-csi-general 3d9h - persistentvolume/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO Delete Bound security/vaultwarden-data-pvc proxmox-csi-general 32d - persistentvolume/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO Delete Bound media/immich-library-pvc proxmox-csi-general 25d - persistentvolume/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO Delete Bound tools/homebox-data-pvc proxmox-csi-general 32d - persistentvolume/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO Delete Bound monitoring/grafana-data-pvc proxmox-csi-general 16d - persistentvolume/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO Delete Bound monitoring/victoria-metrics-pvc proxmox-csi-general 16d - persistentvolume/pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO Delete Bound tools/spoolman-data-pvc proxmox-csi-general 7d5h - persistentvolume/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO Delete Bound media/immich-db-pvc proxmox-csi-db 25d - persistentvolume/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO Delete Bound monitoring/loki-data-pvc proxmox-csi-general 16d - persistentvolume/pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO Delete Bound documents/paperless-data-pvc proxmox-csi-general 32d -``` -### Статус DaemonSet Proxmox-CSI Node: -```text -NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE -proxmox-csi-plugin-node 2 2 2 2 2 33d -``` -### Статус пространства мониторинга (VictoriaMetrics & Grafana): -```text -NAME READY AGE -statefulset.apps/grafana 1/1 16d -statefulset.apps/loki 1/1 16d -statefulset.apps/victoriametrics 1/1 16d - -NAME READY STATUS RESTARTS AGE -pod/grafana-0 1/1 Running 0 169m -pod/loki-0 1/1 Running 0 169m -pod/victoriametrics-0 1/1 Running 0 169m - -NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE -persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general 16d -persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general 16d -persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general 16d -``` -### Логи ошибок Proxmox CSI Plugin (последние строки): -```text -Defaulted container "proxmox-csi-plugin-controller" out of: proxmox-csi-plugin-controller, csi-attacher, csi-provisioner, csi-resizer, liveness-probe -Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe -Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.012208 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4" nodeID="talos-worker-2" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.131792 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb" nodeID="talos-worker-2" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.206486 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7" nodeID="talos-worker-2" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.277975 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.352701 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.430266 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780" nodeID="talos-worker-2" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.509551 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2" nodeID="talos-worker-2" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669146 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790776828491-7787-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\"}" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669198 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.681187 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID="" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873038 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790090280571-543-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\"}" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873096 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.882474 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID="" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.084431 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2" -[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.357862 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:29.408317 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3\",\"volume_path\":\"/var/lib/kubelet/pods/b6ccf3ff-f0fc-411e-b5aa-5bbd61174578/volumes/kubernetes.io~csi/pvc-6eb8c148-32b0-45af-8945-2799d04875a3/mount\"}" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.576536 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.577998 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945\",\"volume_path\":\"/var/lib/kubelet/pods/f3402b78-9a95-4a5c-89c9-7535456d39e0/volumes/kubernetes.io~csi/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945/mount\"}" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.887356 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.888572 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\",\"volume_path\":\"/var/lib/kubelet/pods/ce3b896c-9957-4a70-b713-265ab487c32b/volumes/kubernetes.io~csi/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f/mount\"}" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.095236 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.096521 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780\",\"volume_path\":\"/var/lib/kubelet/pods/919bd05a-93f8-44e3-850e-7a8dd2a570d6/volumes/kubernetes.io~csi/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780/mount\"}" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.657181 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.658240 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b/mount\"}" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.659625 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.660965 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb/mount\"}" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.981192 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.982711 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242\",\"volume_path\":\"/var/lib/kubelet/pods/fa9abffb-f2c3-470f-9ee7-7bd93688270c/volumes/kubernetes.io~csi/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242/mount\"}" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.278791 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.280160 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd\",\"volume_path\":\"/var/lib/kubelet/pods/9ce6cd32-c936-4d17-8597-3efdb4845bc8/volumes/kubernetes.io~csi/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd/mount\"}" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:03.366763 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.621786 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.622940 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.802709 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.804175 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.307289 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.308598 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf\",\"volume_path\":\"/var/lib/kubelet/pods/288247da-f98a-4d43-9f15-e882d4c7acb5/volumes/kubernetes.io~csi/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf/mount\"}" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.015178 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.016475 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a\",\"volume_path\":\"/var/lib/kubelet/pods/096b52fa-6650-4996-8813-dd472343cf8e/volumes/kubernetes.io~csi/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a/mount\"}" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.754757 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.755939 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.979195 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.980398 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.775598 1 node.go:524] "NodeGetCapabilities: called" -[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.776955 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}" -``` -### Синхронизация GitOps (FluxCD): -```text -NAMESPACE NAME URL AGE READY STATUS -flux-system gitrepository.source.toolkit.fluxcd.io/atlas-repo http://10.0.10.13:3000/atlas/atlas.git 33d True stored artifact for revision 'master@sha1:10fbe14ef463bef034856278733f9ad3155cd866' - -NAMESPACE NAME AGE READY STATUS -flux-system kustomization.kustomize.toolkit.fluxcd.io/apps-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866 -flux-system kustomization.kustomize.toolkit.fluxcd.io/infra-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866 - -NAMESPACE NAME AGE READY STATUS -cert-manager helmrelease.helm.toolkit.fluxcd.io/cert-manager 33d True Helm upgrade succeeded for release cert-manager/cert-manager.v2 with chart cert-manager@v1.21.3 -external-secrets helmrelease.helm.toolkit.fluxcd.io/external-secrets 33d True Helm upgrade succeeded for release external-secrets/external-secrets.v5 with chart external-secrets@2.14.0 -kube-system helmrelease.helm.toolkit.fluxcd.io/cilium 33d True Helm upgrade succeeded for release kube-system/cilium.v6 with chart cilium@1.15.5 -kube-system helmrelease.helm.toolkit.fluxcd.io/proxmox-csi-plugin 33d True Helm upgrade succeeded for release kube-system/proxmox-csi-plugin.v4 with chart proxmox-csi-plugin@0.5.12 -``` -### Проблемные поды (Non-Running): -```text -NAMESPACE NAME READY STATUS RESTARTS AGE -databases postgres-init-databases-4lk9r 0/1 Completed 0 169m -``` -### Последние события-предупреждения (Warning Events): -```text -NAMESPACE LAST SEEN TYPE REASON OBJECT MESSAGE -traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use -traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use -traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use -traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use -monitoring 51m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-7tjsw" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods") -monitoring 34m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-t6n9v" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods") -monitoring 17m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-rsbtk" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods") -flux-system 16m Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider -flux-system 3m34s Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider -monitoring 73s Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-xsj4k" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods") -``` -### Реальный объем данных OpenCloud (/var/lib/opencloud-users): -```text -331.7G /var/lib/opencloud-users -``` - - -