NEW NEW kontur+

bin/zarya

@@ -45,7 +45,7 @@ GitOps и оркестрация:
   z login [TTL]                             Открытие смены (YubiKey + RAM)
   z logout                                  Мгновенная очистка RAM
   z unseal                                  Распечатывание OpenBao Vault
-  z secret perimeter <node> [cmd]           Управление секретами периметра (ensure|show|rotate)
+  z secret kontur <node> [cmd]           Управление секретами периметра (ensure|show|rotate)
 Деплой и IaC:
   z up [layer]                              Макро-слои (host, net, tier0, talos, apps, all)
   z run <selector>                          Плейбуки Ansible (01, 02)

cmd/net.sh

@@ -24,9 +24,9 @@ check_target() {
 
 check_target "Proxmox"            "192.168.1.177" 8006
 check_target "Vyos"               "192.168.1.2"   22
-check_target "Technitium DNS"     "10.0.10.11"    53
+check_target "DNS"     "10.0.10.11"    53
-check_target "OpenBao Vault"      "10.0.10.12"    8200
+check_target "Vault"      "10.0.10.12"    8200
-check_target "Forgejo GitOps"     "10.0.10.13"    3000
+check_target "Git"     "10.0.10.13"    3000
-check_target "NFS Storage (NAS)"  "10.0.10.14"    2049
+check_target "NAS"  "10.0.10.14"    2049
-check_target "Traefik L2 VIP"     "10.0.30.200"   443
+check_target "Traefik"     "10.0.30.200"   443
-check_target "Perimeter VPS"      "153.76.194.24" 443
+check_target "Kontur"      "153.76.194.24" 443

cmd/secret.sh

@@ -5,17 +5,17 @@ source "${ZARYA_DIR}/lib/common.sh"
 SUBCMD="${1:-}"
 shift || true
 case "${SUBCMD}" in
-    perimeter|srv)
+    kontur|srv)
         NODE="${1:-}"
         ACTION="${2:-ensure}"
         if [[ -z "${NODE}" ]]; then
-            log_err "Использование: z secret perimeter <нода> [ensure|show|rotate]"
+            log_err "Использование: z secret kontur <нода> [ensure|show|rotate]"
             exit 1
         fi
-        run_isolated python3 "${ZARYA_DIR}/lib/perimeter_secrets.py" "${ACTION}" "${NODE}"
+        run_isolated python3 "${ZARYA_DIR}/lib/kontur_secrets.py" "${ACTION}" "${NODE}"
         ;;
     *)
-        log_err "Использование: z secret perimeter <нода> [ensure|show|rotate]"
+        log_err "Использование: z secret kontur <нода> [ensure|show|rotate]"
         exit 1
         ;;
 esac

config.env

@@ -5,7 +5,7 @@ RAM_KEY="/dev/shm/.atlas_core"
 VAULT_ADDR="http://10.0.10.12:8200"
 VYOS_ROUTER_IP="192.168.1.2"
 NET_PREFIX="10.0.0.0/16"
-GIT_HOST="git.svo88.space"
+GIT_HOST="git.svoo.tech"
 PVE_ENDPOINT="https://192.168.1.177:8006/"
 
 DEFAULT_SESSION_TTL=1

layers/00_host.sh

@@ -5,7 +5,7 @@ ensure_prerequisites
 load_secrets_to_ram
 
 log_info "[Layer 0: PVE Host] Подготовка хоста, шаблонов и базовых директорий ZFS..."
-ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/01_pve_host_day0.yml"
+ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/01_pve.yml"
 
 log_info "[Layer 0: PVE Host] Инициализация compute-скелетов ВМ и LXC через OpenTofu..."
 cd "${REPO_ROOT}/tofu" && tofu apply \
@@ -21,6 +21,6 @@ cd "${REPO_ROOT}/tofu" && tofu apply \
     -auto-approve
 
 log_info "[Layer 0: PVE Host] Применение постоянных ZFS-маунтов (mp) на созданные LXC..."
-ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/01_pve_host_day0.yml"
+ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/01_pve.yml"
 
 log_ok "Layer 0 готов: хост настроен, ВМ и LXC созданы, ZFS смонтирован."

layers/01_net.sh

@@ -4,6 +4,6 @@ source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
 ensure_prerequisites
 load_secrets_to_ram
 
-log_info "[Layer 1: VyOS & Perimeter] Накатка конфигурации сети..."
+log_info "[Layer 1: VyOS & Kontur] Накатка конфигурации сети..."
-ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/02_vyos_network_day0.yml"
+ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/02_vyos.yml"
 log_ok "Layer 1 готов."

layers/02_tier0.sh

@@ -5,7 +5,7 @@ ensure_prerequisites
 load_secrets_to_ram
 
 log_info "[Layer 2: Tier-0 Air-Gap] Развертывание базовой инфраструктуры (Registry, DNS, Vault)..."
-for pb in 03_zot_registry.yml 04_technitium_dns.yml 05_openbao_vault.yml; do
+for pb in 03_reg.yml 04_dns.yml 05_vault.yml; do
     ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/${pb}"
 done
 
@@ -16,7 +16,7 @@ log_info "[Layer 2: Tier-0 Air-Gap] Наполнение Vault секретам
 cd "${REPO_ROOT}/tofu" && tofu apply -auto-approve
 
 log_info "[Layer 2: Tier-0 Air-Gap] Развертывание зависимых сервисов (Forgejo, NAS Storage)..."
-for pb in 06_forgejo_git.yml 07_nas_storage.yml; do
+for pb in 06_git.yml 07_nas.yml; do
     ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/${pb}"
 done
 

lib/kontur_secrets.py

@@ -22,7 +22,7 @@ if not vault_token:
     sys.stderr.write("VAULT_TOKEN not found in environment\n")
     sys.exit(1)
 
-endpoint = f"{vault_addr}/v1/secret/data/perimeter/{node}"
+endpoint = f"{vault_addr}/v1/secret/data/kontur/{node}"
 
 existing_data = None
 req_get = urllib.request.Request(endpoint, headers={"X-Vault-Token": vault_token})
@@ -76,7 +76,7 @@ payload = {
         "reality_private_key": v_priv,
         "reality_public_key": v_pub,
         "reality_short_id": secrets.token_hex(4),
-        "reality_server_name": "ng.w.svo88.space",
+        "reality_server_name": "sss.svoo.tech",
         "awg_server_private_key": awg_s_priv,
         "awg_server_public_key": awg_s_pub,
         "awg_router_private_key": awg_r_priv,

state/00_workstation.sh

@@ -32,9 +32,9 @@ else
 fi
 echo '```'
 
-echo "### Проверка Git Credential Helper (git.svo88.space):"
+echo "### Проверка Git Credential Helper (git.svoo.tech):"
 echo '```text'
-printf "protocol=https\nhost=git.svo88.space\n" | git credential fill 2>&1 | awk -F= '/^username/ {print "Username:", $2} /^password/ {print "Password: [PRESENT in RAM]"}' || echo "Credential helper не вернул учетных данных"
+printf "protocol=https\nhost=git.svoo.tech\n" | git credential fill 2>&1 | awk -F= '/^username/ {print "Username:", $2} /^password/ {print "Password: [PRESENT in RAM]"}' || echo "Credential helper не вернул учетных данных"
 echo '```'
 
 echo "### Ядро, память, ZRAM и параметры Coredump:"

state/04_tier0.sh

@@ -4,7 +4,7 @@ SSH_VYOS="ssh -n -o BatchMode=yes -o ConnectTimeout=3 vyos"
 SSH_STORAGE="ssh -n -o BatchMode=yes -o ConnectTimeout=3 -J vyos nas.t0"
 echo "## 4. Сервисы Tier-0 (Air-Gap фундамент)"
 echo "### Technitium DNS (10.0.10.11:53):"
-echo "* **Внутренний домен (*.svo88.space -> 10.0.30.200):** $(timeout 3s ${SSH_VYOS} "dig @10.0.10.11 vw.svo88.space +short" 2>&1 | tr '\n' ' ')"
+echo "* **Внутренний домен (*.svoo.tech -> 10.0.30.200):** $(timeout 3s ${SSH_VYOS} "dig @10.0.10.11 vw.svoo.tech +short" 2>&1 | tr '\n' ' ')"
 echo "* **Внешний резолв (google.com):** $(timeout 3s ${SSH_VYOS} "dig @10.0.10.11 google.com +short" 2>&1 | head -n1)"
 echo "### OpenBao Vault (10.0.10.12:8200):"
 echo '```json'