diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..f712070
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+/state/snapshots
+zarya-code.xml
+zarya-state.xml
\ No newline at end of file
diff --git a/state/collect_state.sh b/state/collect_state.sh
old mode 100644
new mode 100755
diff --git a/zarya-code.xml b/zarya-code.xml
index 66c4745..b694890 100644
--- a/zarya-code.xml
+++ b/zarya-code.xml
@@ -45,13 +45,20 @@ The content is organized as follows:
bin/
+ fc
+ gg
+ op
zarya
cmd/
a.sh
disks.sh
errors.sh
+ exec.sh
+ flux.sh
+ git-credential.sh
logs.sh
net.sh
+ nodes.sh
pack.sh
pods.sh
run.sh
@@ -81,64 +88,48 @@ state/
03_vyos.sh
04_tier0.sh
05_k8s.sh
+ collect_state.sh
config.env
This section contains the contents of the repository's files.
-
+
#!/bin/bash
set -euo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-source "${ZARYA_DIR}/lib/common.sh"
+if [[ $# -eq 0 ]]; then
+ echo "Использование: fc <файл>"
+ exit 1
+fi
+if [[ -f "$1" ]]; then
+ wl-copy < "$1"
+ echo "'$1' +++"
+else
+ echo "'$1'+++"
+fi
+
-SUBCMD="${1:-help}"
-shift || true
+
+#!/bin/bash
+set -euo pipefail
+if [[ -z "${1:-}" ]]; then
+ echo "Тема СВО не раскрыта: gg \"сообщение\""
+ exit 1
+fi
+git add . && git commit -m "$1" && git push
+
-case "${SUBCMD}" in
- p|pod|pods) exec "${ZARYA_DIR}/cmd/pods.sh" "$@" ;;
- e|err|errors) exec "${ZARYA_DIR}/cmd/errors.sh" "$@" ;;
- l|log|logs) exec "${ZARYA_DIR}/cmd/logs.sh" "$@" ;;
- n|net) exec "${ZARYA_DIR}/cmd/net.sh" "$@" ;;
- d|df|disks) exec "${ZARYA_DIR}/cmd/disks.sh" "$@" ;;
- unseal) exec "${ZARYA_DIR}/cmd/unseal.sh" "$@" ;;
- login|start) exec "${ZARYA_DIR}/cmd/session.sh" "start" "$@" ;;
- logout|clean) exec "${ZARYA_DIR}/cmd/session.sh" "clean" "$@" ;;
- up) exec "${ZARYA_DIR}/cmd/up.sh" "$@" ;;
- run) exec "${ZARYA_DIR}/cmd/run.sh" "$@" ;;
- a|apply) exec "${ZARYA_DIR}/cmd/a.sh" "$@" ;;
- snap) exec "${ZARYA_DIR}/cmd/snap.sh" "$@" ;;
- pack) exec "${ZARYA_DIR}/cmd/pack.sh" "$@" ;;
- reset|nuke) exec "${ZARYA_DIR}/layers/reset.sh" "$@" ;;
- gc) exec "${ZARYA_DIR}/layers/gc.sh" "$@" ;;
- help|--help|-h)
- cat <] [-s ] [-A] Просмотр подов
- z errors Мгновенный триаж сломанных сервисов
- z logs [-f] [-t ] Логи любого сервиса без ввода неймспейса
- z net Сетевой радар доступности узлов (1 сек)
- z disks Срез пулов astra/terra и ZVOL томов K8s
-Управление и сессия:
- z login [TTL] Открытие смены (YubiKey + RAM)
- z logout Мгновенная очистка RAM
- z unseal Распечатывание OpenBao Vault
-Деплой и IaC:
- z up [layer] Макро-слои (host, net, tier0, talos, apps, all)
- z run Плейбуки Ansible (01, 02)
- z a [-auto-approve] OpenTofu apply в RAM-изоляции
-Телеметрия и LLM:
- z snap Снятие полного .md аудита в snapshots/
- z pack [code|state|atlas] Сборка контекста Repomix
-EOF
- ;;
- *)
- log_err "Неизвестная команда: ${SUBCMD}. Введите 'z help'."
- exit 1
- ;;
-esac
+
+#!/bin/bash
+set -euo pipefail
+if [[ $# -eq 0 ]]; then
+ echo "Использование: op <файл...>"
+ exit 1
+fi
+for f in "$@"; do
+ printf "file://%s\r\n" "$(realpath "$f")"
+done | wl-copy -t text/uri-list
@@ -201,6 +192,47 @@ if [[ "$has_errors" == false ]]; then
fi
+
+#!/bin/bash
+set -euo pipefail
+ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "${ZARYA_DIR}/lib/common.sh"
+if [[ $# -eq 0 ]]; then
+ log_err "Использование: z exec <команда> [аргументы...]"
+ exit 1
+fi
+run_isolated "$@"
+
+
+
+#!/bin/bash
+set -uo pipefail
+ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "${ZARYA_DIR}/lib/common.sh"
+subcmd="${1:-status}"
+shift || true
+case "${subcmd}" in
+ sync|reconcile|s)
+ log_info "Принудительная конвергенция FluxCD..."
+ flux reconcile source git atlas-repo -n flux-system 2>/dev/null || true
+ flux reconcile kustomization infra-sync -n flux-system 2>/dev/null || true
+ flux reconcile kustomization apps-sync -n flux-system 2>/dev/null || true
+ log_ok "Синхронизация завершена."
+ ;;
+ logs|log|l)
+ log_info "Стриминг логов kustomize-controller..."
+ exec kubectl -n flux-system logs -l app.kubernetes.io/name=kustomize-controller --tail=50 -f
+ ;;
+ status|st)
+ echo -e "${BLUE}=== СТАТУС РЕПОЗИТОРИЕВ И KUSTOMIZATION (FLUX) ===${NC}"
+ kubectl -n flux-system get gitrepositories,kustomizations,helmreleases 2>/dev/null || log_err "Flux недоступен"
+ ;;
+ *)
+ kubectl -n flux-system get kustomizations 2>/dev/null || log_err "Flux недоступен"
+ ;;
+esac
+
+
#!/bin/bash
set -uo pipefail
@@ -264,34 +296,49 @@ check_target "Traefik L2 VIP" "10.0.30.200" 443
check_target "Perimeter VPS" "153.76.194.24" 443
-
+
#!/bin/bash
-set -euo pipefail
-ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-mode="${1:-state}"
-case "${mode}" in
- state)
- echo "==> Снятие свежего аудита..."
- "${ZARYA_DIR}/state/collect_state.sh" all >/dev/null 2>&1 || true
- echo "==> Упаковка среза состояния Repomix (zarya-state.xml)..."
- repomix --config "${ZARYA_DIR}/repomix.state.json"
- echo "✔ Файл zarya-state.xml готов для отправки в LLM."
- ;;
- code)
- echo "==> Упаковка кодовой базы zarya (zarya-code.xml)..."
- repomix --config "${ZARYA_DIR}/repomix.config.json"
- echo "✔ Файл zarya-code.xml готов."
- ;;
- atlas)
- echo "==> Упаковка чистой инфраструктуры atlas (atlas-code.xml)..."
- cd "${ATLAS_DIR}" && repomix
- echo "✔ Файл atlas/repomix-output.xml готов."
- ;;
- *)
- echo "Использование: z pack [state|code|atlas]"
- exit 1
- ;;
-esac
+set -u
+watch_mode=false
+while [[ $# -gt 0 ]]; do
+ case "$1" in
+ -w|--watch) watch_mode=true; shift ;;
+ *) shift ;;
+ esac
+done
+render_nodes() {
+ local raw
+ raw=$(kubectl get nodes -L topology.kubernetes.io/zone,topology.kubernetes.io/region 2>/dev/null || true)
+ echo "$raw" | awk '
+ BEGIN {
+ ERR = "\033[38;2;255;46;76m"
+ RUN = "\033[38;2;166;227;161m"
+ HEAD = "\033[38;2;147;154;183m"
+ RST = "\033[0m"
+ }
+ NR==1 { print HEAD $0 RST; next }
+ {
+ if ($2 ~ /Ready/ && $2 !~ /NotReady/) {
+ print RUN $0 RST
+ }
+ else {
+ print ERR $0 RST
+ }
+ }'
+}
+if [[ "$watch_mode" == true ]]; then
+ trap 'tput cnorm 2>/dev/null || true; echo ""; exit 0' INT TERM
+ tput civis 2>/dev/null || true
+ clear
+ while true; do
+ tput cup 0 0 2>/dev/null || true
+ render_nodes
+ tput ed 2>/dev/null || true
+ sleep 1
+ done
+else
+ render_nodes
+fi
@@ -727,99 +774,6 @@ log_warn() { echo -e "${YELLOW}⚠${NC} $*"; }
log_err() { echo -e "${RED}✖${NC} $*"; }
-
-#!/bin/bash
-# Network routing and terminal prerequisites
-ensure_prerequisites() {
- local target_ip="${VAULT_ADDR#*//}"
- target_ip="${target_ip%%:*}"
- if ! ip route get "${target_ip}" 2>/dev/null | grep -q "${VYOS_ROUTER_IP}"; then
- log_info "Восстанавливаем маршрут к ${NET_PREFIX} через VyOS (${VYOS_ROUTER_IP})..."
- sudo ip route replace "${NET_PREFIX}" via "${VYOS_ROUTER_IP}" 2>/dev/null || true
- fi
- # Регистрация Git Credential Helper (доменный и прямой IP Tier-0)
- local target_helper="!${REPO_ROOT}/deploy.sh git-credential"
- local current_helper
- current_helper=$(git config --global --get credential."https://${GIT_HOST}".helper 2>/dev/null || true)
- if [[ "${current_helper}" != "${target_helper}" ]]; then
- git config --global credential."https://${GIT_HOST}".helper "${target_helper}"
- fi
- local direct_helper
- direct_helper=$(git config --global --get credential."http://10.0.10.13:3000".helper 2>/dev/null || true)
- if [[ "${direct_helper}" != "${target_helper}" ]]; then
- git config --global credential."http://10.0.10.13:3000".helper "${target_helper}"
- fi
- # Нативная привязка IdentityFile для всех C2-хостов и LXC-контейнеров
- local ssh_hosts="proxmox pve0 vyos vyos_router 10.0.* dns0 vault0 git0 storage0 registry0"
- if [[ -f "${HOME}/.ssh/config" ]] && ! grep -q "IdentityFile ${RAM_KEY}" "${HOME}/.ssh/config"; then
- printf "\nHost %s\n IdentityFile %s\n IdentitiesOnly yes\n" "${ssh_hosts}" "${RAM_KEY}" >> "${HOME}/.ssh/config"
- fi
-}
-
-
-
-#!/bin/bash
-# Session state in RAM tmpfs and YubiKey integration
-load_secrets_to_ram() {
- local hours="${1:-$DEFAULT_SESSION_TTL}"
- local now
- now=$(date +%s)
- ensure_prerequisites
- # Валидация сессии по наличию непустых кэша секретов и SSH-ключа
- if [[ -f "${RAM_CACHE}" ]] && [[ -f "${RAM_KEY}" ]] && [[ -s "${RAM_KEY}" ]]; then
- local created age cached_ttl
- created=$(stat -c %Y "${RAM_CACHE}" 2>/dev/null || echo 0)
- age=$(( now - created ))
- cached_ttl=$(grep '^# TTL_SECONDS=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2 || echo 3600)
- if [[ "${cached_ttl}" -ne 0 ]] && (( age >= cached_ttl )); then
- log_warn "Время сессии истекло ($(( age / 60 )) мин >= $(( cached_ttl / 60 )) мин). Инвалидация кэша..."
- rm -f "${RAM_CACHE}" "${RAM_KEY}"
- else
- return 0
- fi
- fi
- local ttl_seconds
- if [[ "${hours}" -eq 0 ]]; then
- ttl_seconds=0
- else
- ttl_seconds=$(( hours * 3600 ))
- fi
- log_info "🔐 Вход в защищенный контур C2..."
- read -s -p "Master Password: " KP_PASS
- echo ""
- local yk_args=()
- if ykman info >/dev/null 2>&1; then
- yk_args=("-y" "2")
- log_info "YubiKey обнаружен. Приготовьтесь к аппаратному подтверждению (1 касание)..."
- fi
- # Атомарный 1-Touch экспорт всей базы KDBX в RAM (ровно 1 касание YubiKey на всю сессию)
- local tmp_dump="/dev/shm/.kdbx_dump_${now}_$$.xml"
- rm -f "${tmp_dump}"
- touch "${tmp_dump}"
- chmod 600 "${tmp_dump}"
- if ! echo "${KP_PASS}" | keepassxc-cli export "${yk_args[@]}" "${KDBX_PATH}" -f xml > "${tmp_dump}" 2>/dev/null; then
- log_err "Ошибка расшифровки базы KDBX (неверный пароль или таймаут касания YubiKey)"
- rm -f "${tmp_dump}"
- unset KP_PASS
- return 1
- fi
- unset KP_PASS
- python3 "${REPO_ROOT}/scripts/lib/kdbx_parser.py" "${tmp_dump}" "${RAM_CACHE}" "${RAM_KEY}" "${ttl_seconds}" "${PVE_ENDPOINT}" "${VAULT_ADDR}"
- rm -f "${tmp_dump}"
- log_ok "База расшифрована за 1 касание. Ключ и секреты в RAM (TTL: ${hours}ч)"
-}
-run_isolated() {
- ensure_prerequisites
- load_secrets_to_ram
- (
- set -a
- source "${RAM_CACHE}"
- set +a
- "$@"
- )
-}
-
-
#!/bin/bash
# OpenBao Vault operations and Kubernetes Secret synchronization
@@ -1161,6 +1115,71 @@ timeout 10s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n storage exec statefulse
echo '```'
+
+#!/bin/bash
+set -uo pipefail
+ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+STATE_DIR="${ZARYA_DIR}/state"
+SNAPSHOTS_DIR="${STATE_DIR}/snapshots"
+TARGET="${1:-all}"
+MODULES=(
+ "00_workstation.sh"
+ "01_pve.sh"
+ "02_vps.sh"
+ "03_vyos.sh"
+ "04_tier0.sh"
+ "05_k8s.sh"
+)
+mkdir -p "${SNAPSHOTS_DIR}"
+generate_header() {
+ local mod_name="$1"
+ local timestamp branch short_hash commit_msg
+ timestamp=$(date -u +"%Y-%m-%d %H:%M:%S UTC")
+ branch=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" branch --show-current 2>/dev/null || echo "unknown")
+ short_hash=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" rev-parse --short HEAD 2>/dev/null || echo "none")
+ commit_msg=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" log -1 --format='%s' 2>/dev/null || echo "none")
+ cat < Сбор модуля: ${mod_name}..."
+ generate_header "${mod_name}" > "${tmp_file}"
+ if [[ -x "${script}" ]]; then
+ "${script}" >> "${tmp_file}" 2>&1
+ else
+ bash "${script}" >> "${tmp_file}" 2>&1
+ fi
+ mv "${tmp_file}" "${out_file}"
+}
+if [[ "${TARGET}" == "all" ]]; then
+ echo "==> Сбор полного аудита Sovereign C2 в ${SNAPSHOTS_DIR}..."
+ for mod in "${MODULES[@]}"; do
+ run_single_module "${mod}"
+ done
+ echo "✔ Все модули телеметрии успешно сохранены."
+else
+ case "${TARGET}" in
+ 00_workstation|workstation|host) run_single_module "00_workstation.sh" ;;
+ 01_pve|pve) run_single_module "01_pve.sh" ;;
+ 02_vps|vps) run_single_module "02_vps.sh" ;;
+ 03_vyos|vyos|net) run_single_module "03_vyos.sh" ;;
+ 04_tier0|tier0) run_single_module "04_tier0.sh" ;;
+ 05_k8s|k8s|talos) run_single_module "05_k8s.sh" ;;
+ *)
+ echo "Неизвестный модуль: ${TARGET}"
+ exit 1
+ ;;
+ esac
+fi
+
+
#!/bin/bash
# Atlas C2 Configuration SSOT
@@ -1178,4 +1197,216 @@ PVE_ENDPOINT="https://192.168.1.177:8006/"
DEFAULT_SESSION_TTL=1
+
+#!/bin/bash
+set -euo pipefail
+ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "${ZARYA_DIR}/lib/common.sh"
+
+SUBCMD="${1:-help}"
+shift || true
+
+case "${SUBCMD}" in
+ git-credential) exec "${ZARYA_DIR}/cmd/git-credential.sh" "$@" ;;
+ exec) exec "${ZARYA_DIR}/cmd/exec.sh" "$@" ;;
+ p|pod|pods) exec "${ZARYA_DIR}/cmd/pods.sh" "$@" ;;
+ node|nodes) exec "${ZARYA_DIR}/cmd/nodes.sh" "$@" ;;
+ flux) exec "${ZARYA_DIR}/cmd/flux.sh" "$@" ;;
+ e|err|errors) exec "${ZARYA_DIR}/cmd/errors.sh" "$@" ;;
+ l|log|logs) exec "${ZARYA_DIR}/cmd/logs.sh" "$@" ;;
+ n|net) exec "${ZARYA_DIR}/cmd/net.sh" "$@" ;;
+ d|df|disks) exec "${ZARYA_DIR}/cmd/disks.sh" "$@" ;;
+ unseal) exec "${ZARYA_DIR}/cmd/unseal.sh" "$@" ;;
+ login|start) exec "${ZARYA_DIR}/cmd/session.sh" "start" "$@" ;;
+ logout|clean) exec "${ZARYA_DIR}/cmd/session.sh" "clean" "$@" ;;
+ up) exec "${ZARYA_DIR}/cmd/up.sh" "$@" ;;
+ run) exec "${ZARYA_DIR}/cmd/run.sh" "$@" ;;
+ a|apply) exec "${ZARYA_DIR}/cmd/a.sh" "$@" ;;
+ snap) exec "${ZARYA_DIR}/cmd/snap.sh" "$@" ;;
+ pack) exec "${ZARYA_DIR}/cmd/pack.sh" "$@" ;;
+ reset|nuke) exec "${ZARYA_DIR}/layers/reset.sh" "$@" ;;
+ gc) exec "${ZARYA_DIR}/layers/gc.sh" "$@" ;;
+ help|--help|-h)
+ cat <] [-s ] [-A] Просмотр подов
+ z nodes [-w] Статус нод, роли, зона и регион
+ z errors Мгновенный триаж сломанных сервисов
+ z logs [-f] [-t ] Логи сервиса без ввода неймспейса
+ z net Сетевой радар доступности узлов (1 сек)
+ z disks Срез пулов astra/terra и томов K8s
+GitOps и оркестрация:
+ z flux [status|sync|logs] Управление GitOps-конвергенцией
+ z exec <команда...> Вызов бинарников внутри RAM-изоляции
+Сессия и доступы:
+ z login [TTL] Открытие смены (YubiKey + RAM)
+ z logout Мгновенная очистка RAM
+ z unseal Распечатывание OpenBao Vault
+Деплой и IaC:
+ z up [layer] Макро-слои (host, net, tier0, talos, apps, all)
+ z run Плейбуки Ansible (01, 02)
+ z a [-auto-approve] OpenTofu apply в RAM-изоляции
+Телеметрия и LLM:
+ z snap Снятие аудита в state/snapshots/
+ z pack [all|atlas|code|state] Сборка контекстов Repomix для LLM
+EOF
+ ;;
+ *)
+ log_err "Неизвестная команда: ${SUBCMD}. Введите 'z help'."
+ exit 1
+ ;;
+esac
+
+
+
+#!/bin/bash
+set -euo pipefail
+ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "${ZARYA_DIR}/lib/common.sh"
+if [[ -f "${RAM_CACHE}" ]]; then
+ token=$(grep '^export ATLAS_PUSH_TOKEN=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'\'' ' || true)
+ if [[ -n "${token}" ]]; then
+ echo "username=atlas"
+ echo "password=${token}"
+ fi
+fi
+exit 0
+
+
+
+#!/bin/bash
+set -euo pipefail
+ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "${ZARYA_DIR}/lib/common.sh"
+mode="${1:-all}"
+pack_atlas() {
+ log_info "==> [1/3] Упаковка чистой архитектуры Atlas (atlas-code.xml)..."
+ (cd "${ATLAS_DIR}" && repomix --config "${ATLAS_DIR}/repomix.config.json")
+ log_ok "Файл ${ATLAS_DIR}/atlas-code.xml готов."
+}
+pack_zarya() {
+ log_info "==> [2/3] Упаковка станции оператора Zarya (zarya-code.xml)..."
+ (cd "${ZARYA_DIR}" && repomix --config "${ZARYA_DIR}/repomix.config.json")
+ log_ok "Файл ${ZARYA_DIR}/zarya-code.xml готов."
+}
+pack_state() {
+ log_info "==> [3/3] Снятие живого аудита и упаковка телеметрии (zarya-state.xml)..."
+ "${ZARYA_DIR}/state/collect_state.sh" all
+ (cd "${ZARYA_DIR}" && repomix --config "${ZARYA_DIR}/repomix.state.json")
+ log_ok "Файл ${ZARYA_DIR}/zarya-state.xml готов."
+}
+case "${mode}" in
+ all)
+ pack_atlas
+ echo ""
+ pack_zarya
+ echo ""
+ pack_state
+ echo ""
+ log_ok "Все три контекста Repomix собраны без ошибок."
+ ;;
+ atlas)
+ pack_atlas
+ ;;
+ code)
+ pack_zarya
+ ;;
+ state)
+ pack_state
+ ;;
+ *)
+ log_err "Использование: z pack [all|atlas|code|state]"
+ exit 1
+ ;;
+esac
+
+
+
+#!/bin/bash
+ensure_prerequisites() {
+ local target_ip="${VAULT_ADDR#*//}"
+ target_ip="${target_ip%%:*}"
+ if ! ip route get "${target_ip}" 2>/dev/null | grep -q "${VYOS_ROUTER_IP}"; then
+ log_info "Восстанавливаем маршрут к ${NET_PREFIX} через VyOS (${VYOS_ROUTER_IP})..."
+ sudo ip route replace "${NET_PREFIX}" via "${VYOS_ROUTER_IP}" 2>/dev/null || true
+ fi
+ local target_helper="!${ZARYA_DIR}/bin/zarya git-credential"
+ local current_helper
+ current_helper=$(git config --global --get credential."https://${GIT_HOST}".helper 2>/dev/null || true)
+ if [[ "${current_helper}" != "${target_helper}" ]]; then
+ git config --global credential."https://${GIT_HOST}".helper "${target_helper}"
+ fi
+ local direct_helper
+ direct_helper=$(git config --global --get credential."http://10.0.10.13:3000".helper 2>/dev/null || true)
+ if [[ "${direct_helper}" != "${target_helper}" ]]; then
+ git config --global credential."http://10.0.10.13:3000".helper "${target_helper}"
+ fi
+ local ssh_hosts="proxmox pve0 vyos vyos_router 10.0.* dns0 vault0 git0 storage0 registry0"
+ if [[ -f "${HOME}/.ssh/config" ]] && ! grep -q "IdentityFile ${RAM_KEY}" "${HOME}/.ssh/config"; then
+ printf "\nHost %s\n IdentityFile %s\n IdentitiesOnly yes\n" "${ssh_hosts}" "${RAM_KEY}" >> "${HOME}/.ssh/config"
+ fi
+}
+
+
+
+#!/bin/bash
+load_secrets_to_ram() {
+ local hours="${1:-$DEFAULT_SESSION_TTL}"
+ local now
+ now=$(date +%s)
+ ensure_prerequisites
+ if [[ -f "${RAM_CACHE}" ]] && [[ -f "${RAM_KEY}" ]] && [[ -s "${RAM_KEY}" ]]; then
+ local created age cached_ttl
+ created=$(stat -c %Y "${RAM_CACHE}" 2>/dev/null || echo 0)
+ age=$(( now - created ))
+ cached_ttl=$(grep '^# TTL_SECONDS=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2 || echo 3600)
+ if [[ "${cached_ttl}" -ne 0 ]] && (( age >= cached_ttl )); then
+ log_warn "Время сессии истекло ($(( age / 60 )) мин >= $(( cached_ttl / 60 )) мин). Инвалидация кэша..."
+ rm -f "${RAM_CACHE}" "${RAM_KEY}"
+ else
+ return 0
+ fi
+ fi
+ local ttl_seconds
+ if [[ "${hours}" -eq 0 ]]; then
+ ttl_seconds=0
+ else
+ ttl_seconds=$(( hours * 3600 ))
+ fi
+ log_info "🔐 Вход в защищенный контур Zarya..."
+ read -s -p "Master Password: " KP_PASS
+ echo ""
+ local yk_args=()
+ if ykman info >/dev/null 2>&1; then
+ yk_args=("-y" "2")
+ log_info "YubiKey обнаружен. Приготовьтесь к аппаратному подтверждению (1 касание)..."
+ fi
+ local tmp_dump="/dev/shm/.kdbx_dump_${now}_$$.xml"
+ rm -f "${tmp_dump}"
+ touch "${tmp_dump}"
+ chmod 600 "${tmp_dump}"
+ if ! echo "${KP_PASS}" | keepassxc-cli export "${yk_args[@]}" "${KDBX_PATH}" -f xml > "${tmp_dump}" 2>/dev/null; then
+ log_err "Ошибка расшифровки базы KDBX (неверный пароль или таймаут касания YubiKey)"
+ rm -f "${tmp_dump}"
+ unset KP_PASS
+ return 1
+ fi
+ unset KP_PASS
+ python3 "${ZARYA_DIR}/lib/kdbx_parser.py" "${tmp_dump}" "${RAM_CACHE}" "${RAM_KEY}" "${ttl_seconds}" "${PVE_ENDPOINT}" "${VAULT_ADDR}"
+ rm -f "${tmp_dump}"
+ log_ok "База расшифрована за 1 касание. Ключ и секреты в RAM (TTL: ${hours}ч)"
+}
+run_isolated() {
+ ensure_prerequisites
+ load_secrets_to_ram
+ (
+ set -a
+ source "${RAM_CACHE}"
+ set +a
+ "$@"
+ )
+}
+
+
diff --git a/zarya-state.xml b/zarya-state.xml
index 6ca7bc4..742b380 100644
--- a/zarya-state.xml
+++ b/zarya-state.xml
@@ -42,10 +42,857 @@ The content is organized as follows:
-
+state/
+ snapshots/
+ 00_workstation.md
+ 01_pve.md
+ 02_vps.md
+ 03_vyos.md
+ 04_tier0.md
+ 05_k8s.md
This section contains the contents of the repository's files.
+
+# Sovereign C2 Runtime: 00_workstation
+**Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git")
+## 0. Рабочая станция администратора (Operator Environment)
+### Инфраструктурные SSH-хосты (~/.ssh/config):
+```text
+Host proxmox pve0
+ Hostname 192.168.1.177
+ Port 22
+ User root
+
+Host vyos vyos_router
+ Hostname 192.168.1.2
+ Port 22
+ User vyos
+
+Host 10.0.* dns0 vault0 git0 storage0 registry0
+ User root
+ StrictHostKeyChecking no
+ UserKnownHostsFile /dev/null
+ LogLevel ERROR
+
+Host fin21
+ Hostname 153.76.194.24
+ Port 22
+ User atlas
+
+Host incserv
+ Hostname 31.76.100.166
+ Port 8765
+ User root
+
+Host router
+ Hostname 192.168.1.1
+ Port 1488
+ User root
+
+Host proxmox pve0 vyos vyos_router fin21 10.0.*
+ IdentityFile /dev/shm/.atlas_core
+ IdentitiesOnly yes
+```
+### Рабочие алиасы и функции оператора (Active Workflow Aliases):
+```bash
+# Маркер # >>> ATLAS C2 WORKFLOW >>> не найден в ~/.bashrc
+```
+### Статус RAM-кэша секретов (/dev/shm/.atlas_secrets_cache):
+```text
+Размер: 1058 байт | Права: 600 | Создан: 2026-10-25 18:08:15.915202821 +0300
+```
+### Проверка Git Credential Helper (git.svo88.space):
+```text
+Username: atlas
+Password: [PRESENT in RAM]
+```
+### Ядро, память, ZRAM и параметры Coredump:
+```text
+Kernel: 7.2.5-3-omarchy
+Swapon: NAME TYPE SIZE USED PRIO
+/swap/swapfile file 13.5G 0B 0
+/dev/zram0 partition 13.5G 358M 100
+NAME ALGORITHM DISKSIZE DATA COMPR TOTAL STREAMS MOUNTPOINT
+/dev/zram0 zstd 13.5G 331.5M 89.6M 95M [SWAP]
+Coredump config:
+#Storage=external
+#ProcessSizeMax=32G
+```
+### Токены безопасности и ключи в ssh-agent:
+```text
+Active SSH Agent keys:
+The agent has no identities.
+YubiKey / FIDO2 Status:
+Device type: YubiKey 5 Nano
+Serial number: 29508635
+Firmware version: 5.7.1
+Form factor: Nano (USB-A)
+Enabled USB interfaces: OTP, FIDO, CCID
+
+Applications
+Yubico OTP Enabled
+FIDO U2F Enabled
+FIDO2 Enabled
+OATH Enabled
+PIV Enabled
+OpenPGP Enabled
+YubiHSM Auth Enabled
+```
+### Зеркала пакетов Pacman (Mirrorlist):
+```text
+/etc/pacman.conf:[options]
+/etc/pacman.conf:[core]
+/etc/pacman.conf:[extra]
+/etc/pacman.conf:[multilib]
+/etc/pacman.conf:[omarchy]
+/etc/pacman.conf:Server = https://pkgs.omarchy.org/stable/$arch
+/etc/pacman.d/mirrorlist:Server = https://stable-mirror.omarchy.org/$repo/os/$arch
+/etc/pacman.d/mirrorlist.bak:Server = https://mirror.omarchy.org/$repo/os/$arch
+/etc/pacman.d/mirrorlist.omarchy-upgrade-to-quattro.20260905155315.bak:Server = https://mirror.omarchy.org/$repo/os/$arch
+Нет данных о зеркалах
+```
+### Маршрутизация на хосте (Routing to C2):
+```text
+default via 192.168.1.2 dev enp34s0 proto dhcp src 192.168.1.247 metric 100
+10.0.0.0/16 via 192.168.1.2 dev enp34s0 proto static metric 100
+192.168.1.0/24 dev enp34s0 proto kernel scope link src 192.168.1.247 metric 100
+```
+### Версии локальных инструментов:
+```text
+OpenTofu: OpenTofu v1.12.1
+Kubectl: gitVersion: v1.36.4
+Talosctl: Client:
+Talos v1.14.0
+```
+### Состояние локального Git-репозитория (SSOT Source):
+```text
+fatal: not a git repository (or any parent up to mount point /)
+Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
+fatal: not a git repository (or any parent up to mount point /)
+Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
+Последний коммит:
+Remote URL: no remote
+```
+---
+
+
+
+# Sovereign C2 Runtime: 01_pve
+**Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git")
+## 1. Гипервизор Proxmox VE (192.168.1.177)
+### Память хоста, Uptime и Температура CPU:
+```text
+ 18:20:07 up 3:30, 1 user, load average: 1.59, 1.90, 1.69
+
+ total used free shared buff/cache available
+Mem: 37Gi 30Gi 5.8Gi 75Mi 1.3Gi 6.6Gi
+Swap: 0B 0B 0B
+
+```
+### Здоровье физических дисков (SMART):
+```text
+/dev/sda: SMART overall-health self-assessment test result: PASSED
+/dev/sdb: SMART overall-health self-assessment test result: PASSED
+/dev/sdc: SMART overall-health self-assessment test result: PASSED
+/dev/sdd: SMART overall-health self-assessment test result: PASSED
+/dev/sde: SMART overall-health self-assessment test result: PASSED
+/dev/sdf: SMART overall-health self-assessment test result: PASSED
+```
+### Статус шифрования ZFS (Encryption & Keys):
+```text
+NAME PROPERTY VALUE SOURCE
+astra encryption aes-256-gcm -
+astra keystatus available -
+astra keyformat raw -
+astra keylocation file:///etc/zfs/keys/astra.key local
+terra encryption aes-256-gcm -
+terra keystatus available -
+terra keyformat raw -
+terra keylocation file:///etc/zfs/keys/terra.key local
+```
+### Здоровье и емкость ZFS-пулов:
+```text
+NAME SIZE ALLOC FREE FRAG CAP HEALTH
+astra 2.78T 540G 2.25T 9% 18% ONLINE
+terra 1.81T 345G 1.48T 0% 18% ONLINE
+
+NAME USED AVAIL REFER MOUNTPOINT
+astra 360G 1.44T 55.0M /astra
+astra/vm-100-cloudinit 128K 1.44T 128K -
+astra/vm-100-disk-0 1.06G 1.44T 1.06G -
+astra/vm-201-disk-0 1.38G 1.44T 1.38G -
+astra/vm-202-disk-0 14.8G 1.44T 14.8G -
+astra/vm-203-disk-0 20.4G 1.44T 20.4G -
+astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 27.2M 1.44T 27.2M -
+astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 8.61M 1.44T 8.61M -
+astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 203M 1.44T 203M -
+astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 714K 1.44T 714K -
+astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 5.13M 1.44T 5.13M -
+astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 884K 1.44T 884K -
+astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 1.05M 1.44T 1.05M -
+astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 416K 1.44T 416K -
+astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 7.02M 1.44T 7.02M -
+astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 320G 1.44T 320G -
+astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 970K 1.44T 970K -
+astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 375M 1.44T 375M -
+astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 1.33M 1.44T 1.33M -
+astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 2.54M 1.44T 2.54M -
+astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 704M 1.44T 704M -
+astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 14.5M 1.44T 14.5M -
+astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 20.7M 1.44T 20.7M -
+terra 345G 1.42T 12.6G /terra
+terra/media 248K 1.42T 248K /terra/media
+terra/s3 192K 1.42T 192K /terra/s3
+terra/vault 333G 1.42T 333G /terra/vault
+```
+### Физическая емкость каталогов на /terra:
+```text
+68K /terra/media
+4.6M /terra/models
+171K /terra/packages
+13G /terra/registry
+8.5K /terra/s3
+4.3M /terra/torrents
+333G /terra/vault
+```
+### Блочные устройства хоста и тома ZVOL (lsblk):
+```text
+NAME FSTYPE SIZE MOUNTPOINTS
+loop0 ext4 4G
+loop1 ext4 4G
+loop2 ext4 2G
+loop3 ext4 8G
+loop4 ext4 8G
+sda 1.8T
+├─sda1 zfs_member 1.8T
+└─sda9 8M
+sdb 953.9G
+├─sdb1 zfs_member 953.9G
+└─sdb9 8M
+sdc 476.9G
+├─sdc1 vfat 976M /boot/efi
+├─sdc2 linux_raid_member 977M
+│ └─md0 ext4 976M /boot
+└─sdc3 linux_raid_member 445.3G
+ └─md1 crypto_LUKS 445.1G
+ └─md1_crypt ext4 445.1G /
+sdd 953.9G
+├─sdd1 zfs_member 953.9G
+└─sdd9 8M
+sde 447.1G
+├─sde1 vfat 976M
+├─sde2 linux_raid_member 977M
+│ └─md0 ext4 976M /boot
+└─sde3 linux_raid_member 445.2G
+ └─md1 crypto_LUKS 445.1G
+ └─md1_crypt ext4 445.1G /
+sdf 953.9G
+├─sdf1 zfs_member 953.9G
+└─sdf9 8M
+zd0 ext4 2G
+zd16 ext4 10G
+zd32 ext4 10G
+zd48 ext4 20G
+zd64 iso9660 4M
+zd80 ext4 5G
+zd96 ext4 5G
+zd112 ext4 5G
+zd128 ext4 5G
+zd144 100G
+├─zd144p1 vfat 100M
+├─zd144p2 1M
+├─zd144p3 xfs 2G
+├─zd144p4 1M
+├─zd144p5 xfs 100M
+└─zd144p6 xfs 97.8G
+zd160 ext4 30G
+zd176 ext4 30G
+zd192 ext4 400G
+zd208 ext4 100G
+zd224 100G
+├─zd224p1 vfat 100M
+├─zd224p2 1M
+├─zd224p3 xfs 2G
+├─zd224p4 1M
+├─zd224p5 xfs 100M
+└─zd224p6 xfs 97.8G
+zd240 10G
+├─zd240p1 1M
+├─zd240p2 vfat 256M
+└─zd240p3 ext4 9G
+zd256 ext4 100G
+zd272 20G
+├─zd272p1 vfat 100M
+├─zd272p2 1M
+├─zd272p3 xfs 2G
+├─zd272p4 1M
+├─zd272p5 xfs 100M
+└─zd272p6 xfs 17.8G
+zd288 ext4 20G
+zd304 ext4 15G
+zd320 ext4 5G
+zd336 ext4 30G
+```
+### Виртуальные диски K8s и ВМ (ZVOLs на astra):
+```text
+NAME VOLSIZE USED REFER
+astra/vm-100-cloudinit 4M 128K 128K
+astra/vm-100-disk-0 10G 1.06G 1.06G
+astra/vm-201-disk-0 20G 1.38G 1.38G
+astra/vm-202-disk-0 100G 14.8G 14.8G
+astra/vm-203-disk-0 100G 20.4G 20.4G
+astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10G 27.2M 27.2M
+astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100G 8.61M 8.61M
+astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100G 203M 203M
+astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5G 714K 714K
+astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20G 5.13M 5.13M
+astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10G 884K 884K
+astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15G 1.05M 1.05M
+astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2G 416K 416K
+astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5G 7.02M 7.02M
+astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400G 320G 320G
+astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5G 970K 970K
+astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5G 375M 375M
+astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20G 1.33M 1.33M
+astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5G 2.54M 2.54M
+astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30G 704M 704M
+astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30G 14.5M 14.5M
+astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30G 20.7M 20.7M
+```
+### Модули ядра (nfsd, zfs):
+```text
+zfs 6262784 44
+nfsd 1011712 3
+```
+### Теги сетевых карт ВМ 100 (VyOS) в Proxmox:
+```text
+net0: virtio=BC:24:11:DC:6D:EC,bridge=vmbr0,firewall=0
+net1: virtio=BC:24:11:3F:CB:C9,bridge=vmbr0,firewall=0,tag=20
+net2: virtio=BC:24:11:EA:32:2F,bridge=vmbr0,firewall=0,tag=30
+net3: virtio=BC:24:11:59:E8:8D,bridge=vmbr0,firewall=0,tag=10
+```
+### Точки монтирования LXC-контейнеров (/etc/pve/lxc/*.conf):
+```text
+/etc/pve/lxc/101.conf:mp0: /astra/data/dns0,mp=/opt/technitium/dns/config
+/etc/pve/lxc/102.conf:mp0: /astra/data/vault0,mp=/var/lib/bao/data
+/etc/pve/lxc/103.conf:mp0: /astra/data/git0,mp=/var/lib/forgejo
+/etc/pve/lxc/104.conf:mp0: /terra/media,mp=/media
+/etc/pve/lxc/104.conf:mp1: /terra/torrents,mp=/torrents
+/etc/pve/lxc/104.conf:mp2: /terra/vault,mp=/backups
+/etc/pve/lxc/104.conf:mp3: /terra/models,mp=/models
+/etc/pve/lxc/104.conf:mp4: /terra/packages,mp=/packages
+/etc/pve/lxc/105.conf:mp0: /terra/registry,mp=/mnt/registry
+```
+### Флаги автостарта ВМ и Контейнеров (onboot):
+```text
+/etc/pve/qemu-server/100.conf:onboot: 1
+/etc/pve/qemu-server/201.conf:onboot: 1
+/etc/pve/qemu-server/202.conf:onboot: 1
+/etc/pve/qemu-server/203.conf:onboot: 1
+/etc/pve/lxc/101.conf:onboot: 1
+/etc/pve/lxc/102.conf:onboot: 1
+/etc/pve/lxc/103.conf:onboot: 1
+/etc/pve/lxc/104.conf:onboot: 1
+/etc/pve/lxc/105.conf:onboot: 1
+```
+### Виртуальные машины (QEMU) и Контейнеры (LXC):
+```text
+ VMID NAME STATUS MEM(MB) BOOTDISK(GB) PID
+ 100 vyos-router running 2048 10.00 2594
+ 201 talos-master-1 running 2560 20.00 2698
+ 202 talos-worker-1 running 10240 100.00 3869
+ 203 talos-worker-2 running 10240 100.00 4919
+
+VMID Status Lock Name
+101 running dns0
+102 running vault0
+103 running git0
+104 running storage0
+105 running registry0
+```
+---
+
+
+
+# Sovereign C2 Runtime: 02_vps
+**Срез:** 2026-10-25 15:20:12 UTC | **Git:** master@10fbe14 ("git")
+## 2. Периметр: Белый VPS (Host: fin21, IP: 153.76.194.24)
+### WireGuard wg0 на VPS:
+```text
+interface: wg0
+ public key: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY=
+ private key: (hidden)
+ listening port: 51820
+
+peer: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4=
+ endpoint: 45.93.6.172:46777
+ allowed ips: 10.8.0.2/32, 10.0.30.200/32
+ latest handshake: 3 hours, 28 minutes, 44 seconds ago
+ transfer: 64.06 MiB received, 54.22 MiB sent
+```
+### Статус системных сервисов (Edge Stack):
+```text
+WireGuard: active | HAProxy: active | Xray: active | Nginx: active
+```
+### Прослушиваемые сокеты (Ports 80, 443, 4443, 8443, 51820):
+```text
+udp UNCONN 0 0 0.0.0.0:51820 0.0.0.0:*
+udp UNCONN 0 0 [::]:51820 [::]:*
+tcp LISTEN 0 4096 127.0.0.1:4443 0.0.0.0:* users:(("haproxy",pid=862,fd=10))
+tcp LISTEN 0 511 127.0.0.1:8443 0.0.0.0:* users:(("nginx",pid=739,fd=5),("nginx",pid=735,fd=5))
+tcp LISTEN 0 4096 0.0.0.0:80 0.0.0.0:* users:(("haproxy",pid=862,fd=9))
+tcp LISTEN 0 4096 *:443 *:* users:(("xray",pid=690,fd=3))
+```
+### Тест аварийной заглушки Nginx (127.0.0.1:8443):
+```text
+Atlas Sovereign Home Server is currently offline for maintenance.
+```
+### Конфигурация SSH-демона (sshd runtime):
+```text
+permitrootlogin no
+passwordauthentication yes
+```
+---
+
+
+
+# Sovereign C2 Runtime: 03_vyos
+**Срез:** 2026-10-25 15:20:15 UTC | **Git:** master@10fbe14 ("git")
+## 3. Маршрутизатор VyOS (192.168.1.2)
+### Сетевые интерфейсы и L2-транк (VLANs 10, 20, 30):
+```text
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface IP Address MAC VRF MTU S/L Description
+----------- -------------- ----------------- ------- ----- ----- -------------------
+eth0 192.168.1.2/24 bc:24:11:dc:6d:ec default 1500 u/u WAN_TRUNK
+eth1 10.0.20.1/24 bc:24:11:3f:cb:c9 default 1500 u/u K8S
+eth2 10.0.10.1/24 bc:24:11:59:e8:8d default 1500 u/u TIER0
+eth3 10.0.30.1/24 bc:24:11:ea:32:2f default 1500 u/u LAN_CLIENTS
+lo 127.0.0.1/8 00:00:00:00:00:00 default 65536 u/u
+ ::1/128
+tun0 172.19.0.1/30 n/a default 65535 u/u
+wg0 10.8.0.2/24 n/a default 1420 u/u TUNNEL_TO_VPS_FIN21
+```
+### ARP-таблица K8s-интерфейса eth1 (проверка связности с нодами):
+```text
+10.0.20.11 lladdr bc:24:11:12:c5:1b REACHABLE
+10.0.20.12 lladdr bc:24:11:ef:1a:d4 STALE
+10.0.20.10 lladdr bc:24:11:71:b6:82 REACHABLE
+fe80::be24:11ff:fe12:c51b lladdr bc:24:11:12:c5:1b STALE
+fe80::be24:11ff:feef:1ad4 lladdr bc:24:11:ef:1a:d4 STALE
+fe80::be24:11ff:fe71:b682 lladdr bc:24:11:71:b6:82 STALE
+```
+### DHCP-сервер и выданные лизы (Options 3, 6):
+```text
+IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname Origin
+------------ ----------------- ------- ------------------- ------------------- ----------- ----------- -------------- --------
+10.0.20.10 bc:24:11:71:b6:82 active 2026-10-25 11:51:32 2026-10-26 11:51:32 20:31:16 K8S talos-master-1 local
+10.0.20.11 bc:24:11:12:c5:1b active 2026-10-25 12:29:01 2026-10-26 12:29:01 21:08:45 K8S talos-worker-1 local
+10.0.20.12 bc:24:11:ef:1a:d4 active 2026-10-25 12:29:04 2026-10-26 12:29:04 21:08:48 K8S talos-worker-2 local
+10.0.30.100 bc:24:11:eb:38:63 active 2026-10-25 12:29:02 2026-10-26 12:29:02 21:08:46 LAN_CLIENTS talos-worker-1 local
+10.0.30.101 bc:24:11:bb:00:d3 active 2026-10-25 12:29:05 2026-10-26 12:29:05 21:08:49 LAN_CLIENTS talos-worker-2 local
+```
+### Перехват DNS через DNAT (Rule 53 -> 127.0.0.42:53):
+```text
+Rule Source Destination Proto In-Int Translation
+------ --------- ------------- -------- -------- -------------
+53 0.0.0.0/0 0.0.0.0/0 TCP, UDP LAN 127.0.0.42
+ sport any dport 53 port 53
+```
+### Контейнеры маршрутизатора (Sing-Box & Zapret2):
+```text
+CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
+9217a0a6ac83 ghcr.io/sagernet/sing-box:latest run -c /etc/sing-... 3 hours ago Up 3 hours sing-box
+c7e27e9bb9fc docker.io/vernette/ss-zapret2:latest /etc/zapret/run.s... 3 hours ago Up 3 hours 1080/tcp, 8388/tcp zapret2
+```
+### Наличие /dev/net/tun внутри контейнера sing-box:
+```text
+crw-rw-rw- 1 root root 10, 200 Oct 25 11:51 /dev/net/tun
+```
+### Задержка VLESS-канала через Clash API (Main-1-out -> fin21):
+```text
+{"type": "VLESS", "name": "Main-1-out", "udp": true, "history": [{"time":"2026-10-25T15:19:30.52662628Z","delay":122}]}```
+### Статус таймера автосинхронизации Git (singbox-sync):
+```text
+● singbox-sync.timer - Periodic Sing-Box Config Git Sync Timer
+ Loaded: loaded (/etc/systemd/system/singbox-sync.timer; enabled; preset: enabled)
+ Active: active (waiting) since Sun 2026-10-25 11:51:13 UTC; 3h 29min ago
+ Trigger: Sun 2026-10-25 15:20:23 UTC; 6s left
+ Triggers: ● singbox-sync.service
+
+Oct 25 11:51:13 vyos-router systemd[1]: Started Periodic Sing-Box Config Git Sync Timer.
+
+Oct 25 15:19:23 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully.
+Oct 25 15:19:23 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync.
+Oct 25 15:19:53 vyos-router systemd[1]: Starting Automated Sing-Box Config Git Sync...
+Oct 25 15:19:54 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully.
+Oct 25 15:19:54 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync.
+```
+### Статус WireGuard туннеля wg0 и пинг до VPS:
+```text
+interface: wg0
+ public key: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4=
+ private key: (hidden)
+ listening port: 34756
+
+peer: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY=
+ endpoint: 153.76.194.24:51820
+ allowed ips: 10.8.0.0/24
+ latest handshake: 3 hours, 28 minutes, 47 seconds ago
+ transfer: 1.12 KiB received, 282.34 KiB sent
+ persistent keepalive: every 25 seconds
+
+VyOS или туннель недоступен
+```
+### Таблица маршрутизации (show ip route):
+```text
+Codes: K - kernel route, C - connected, L - local, S - static,
+ R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+ T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+ f - OpenFabric, t - Table-Direct,
+ > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+ t - trapped, o - offload failure
+
+IPv4 unicast VRF default:
+S>* 0.0.0.0/0 [1/0] via 192.168.1.1, eth0, weight 1, 03:28:52
+C>* 10.0.10.0/24 is directly connected, eth2, weight 1, 03:28:58
+L>* 10.0.10.1/32 is directly connected, eth2, weight 1, 03:28:58
+C>* 10.0.20.0/24 is directly connected, eth1, weight 1, 03:28:58
+L>* 10.0.20.1/32 is directly connected, eth1, weight 1, 03:28:58
+C>* 10.0.30.0/24 is directly connected, eth3, weight 1, 03:28:58
+L>* 10.0.30.1/32 is directly connected, eth3, weight 1, 03:28:58
+C>* 10.8.0.0/24 is directly connected, wg0, weight 1, 03:28:57
+L>* 10.8.0.2/32 is directly connected, wg0, weight 1, 03:28:57
+C>* 172.19.0.0/30 is directly connected, tun0, weight 1, 03:28:55
+L>* 172.19.0.1/32 is directly connected, tun0, weight 1, 03:28:55
+C>* 192.168.1.0/24 is directly connected, eth0, weight 1, 03:28:58
+L>* 192.168.1.2/32 is directly connected, eth0, weight 1, 03:28:58
+```
+---
+
+
+
+# Sovereign C2 Runtime: 04_tier0
+**Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git")
+## 4. Сервисы Tier-0 (Air-Gap фундамент)
+### Technitium DNS (10.0.10.11:53):
+* **Внутренний домен (*.svo88.space -> 10.0.30.200):** 10.0.30.200
+* **Внешний резолв (google.com):** 173.194.220.100
+### OpenBao Vault (10.0.10.12:8200):
+```json
+{"type":"shamir","initialized":true,"sealed":false,"t":1,"n":1,"progress":0,"nonce":"","version":"2.0.1","build_date":"2024-09-03T19:57:34Z","migration":false,"cluster_name":"vault-cluster-74026fc7","cluster_id":"79b6d270-a6b1-b082-39be-aeb24d8841f5","recovery_seal":false,"storage_type":"file"}
+```
+### Zot OCI Registry (10.0.10.15:5000):
+```json
+{"repositories":["alpine","docker.io/getmeili/meilisearch","docker.io/grafana/loki","docker.io/jellyfin/jellyfin","docker.io/library/alpine","docker.io/library/busybox","docker.io/library/nginx","docker.io/library/postgres","docker.io/library/redis","docker.io/library/traefik","docker.io/netboxcommunity/netbox","docker.io/opencloudeu/opencloud-rolling","docker.io/owncloud/ocis","docker.io/searxng/searxng","docker.io/vaultwarden/server","docker.io/victoriametrics/victoria-metrics","docker.io/xream/sub-store","ghcr.io/anatol/pacoloco","ghcr.io/donkie/spoolman","ghcr.io/external-secrets/external-secrets","ghcr.io/fluxcd/helm-controller","ghcr.io/fluxcd/image-automation-controller","ghcr.io/fluxcd/image-reflector-controller","ghcr.io/fluxcd/kustomize-controller","ghcr.io/fluxcd/notification-controller","ghcr.io/fluxcd/source-controller","ghcr.io/fluxcd/source-watcher","ghcr.io/goauthentik/server","ghcr.io/immich-app/postgres","ghcr.io/karakeep-app/karakeep","ghcr.io/karakeep-app/karakeep-chrome","ghcr.io/kiwix/kiwix-serve","ghcr.io/sergelogvinov/proxmox-csi-controller","ghcr.io/sergelogvinov/proxmox-csi-node","ghcr.io/siderolabs/kubelet","ghcr.io/sysadminsmedia/homebox","ghcr.io/triliumnext/notes","ghcr.io/triliumnext/trilium","ghcr.io/we-promise/sure","ghcr.io/xiao-villamor/printstash","k8s.io/coredns/coredns","k8s.io/kube-apiserver","k8s.io/kube-controller-manager","k8s.io/kube-proxy","k8s.io/kube-scheduler","k8s.io/sig-storage/csi-attacher","k8s.io/sig-storage/csi-provisioner","k8s.io/sig-storage/csi-resizer","k8s.io/sig-storage/livenessprobe","quay.io/invidious/invidious","quay.io/invidious/invidious-companion","quay.io/jetstack/cert-manager-cainjector"]}```
+### Forgejo GitOps Server (10.0.10.13:3000):
+```json
+{"version":"7.0.4+gitea-1.21.11"}
+```
+### Ядерный NFS nfsd (storage0 - 10.0.10.14):
+```text
+== Активные экспорты ядра (exportfs):
+/media 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
+/torrents 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
+/backups 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
+/models 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
+/packages 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
+/media 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
+/torrents 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
+/backups 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
+/models 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
+/packages 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
+
+== Емкость смонтированных ZFS-датасетов:
+Filesystem Size Used Available Use% Mounted on
+terra/media 1.4T 1.0M 1.4T 0% /media
+terra 1.4T 12.6G 1.4T 1% /torrents
+terra/vault 1.7T 332.6G 1.4T 19% /backups
+terra 1.4T 12.6G 1.4T 1% /torrents
+
+== Права точки монтирования OpenCloud:
+drwxrws--- 5 1000 1000 5 Oct 25 12:31 /backups/opencloud-users
+```
+---
+
+
+
+# Sovereign C2 Runtime: 05_k8s
+**Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git")
+## 5. Kubernetes Платформа & Нагрузки
+### Участники кластера Talos (OS-level):
+```text
+10.0.20.10: error getting server version: error constructing client: failed to create client connection: failed to resolve configuration context: talos config file is empty
+Talos API недоступен
+```
+### Ноды кластера K8s:
+```text
+NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
+talos-1il-vwa Ready control-plane 3h26m v1.37.0 10.0.20.10 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
+talos-worker-1 Ready 171m v1.37.0 10.0.20.11 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
+talos-worker-2 Ready 170m v1.37.0 10.0.20.12 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
+```
+### Топологические лейблы нод (Proxmox-CSI topology):
+```text
+NAME STATUS ROLES AGE VERSION ZONE REGION
+talos-1il-vwa Ready control-plane 3h26m v1.37.0
+talos-worker-1 Ready 171m v1.37.0 pve0 atlas
+talos-worker-2 Ready 170m v1.37.0 pve0 atlas
+```
+### Статус ExternalSecrets (Синхронизация из Vault):
+```text
+NAME AGE STATUS CAPABILITIES READY
+clustersecretstore.external-secrets.io/openbao-backend 33d Valid ReadWrite True
+
+NAMESPACE NAME STORETYPE STORE REFRESH INTERVAL STATUS READY LAST SYNC
+authentik externalsecret.external-secrets.io/authentik-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 49m
+databases externalsecret.external-secrets.io/all-db-passwords ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+databases externalsecret.external-secrets.io/postgres-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+documents externalsecret.external-secrets.io/paperless-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+flux-system externalsecret.external-secrets.io/atlas-repo-auth ClusterSecretStore openbao-backend 1h SecretSyncedError False 3d1h
+infra externalsecret.external-secrets.io/netbox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+kube-system externalsecret.external-secrets.io/proxmox-csi-config ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+media externalsecret.external-secrets.io/immich-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+media externalsecret.external-secrets.io/invidious-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+monitoring externalsecret.external-secrets.io/grafana-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+security externalsecret.external-secrets.io/vaultwarden-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+tools externalsecret.external-secrets.io/homebox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+tools externalsecret.external-secrets.io/karakeep-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+tools externalsecret.external-secrets.io/printstash-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+tools externalsecret.external-secrets.io/searxng-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+tools externalsecret.external-secrets.io/sure-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
+```
+### Сетевой ingress, сертификаты TLS и L2 Fast-Path VIP:
+```text
+NAMESPACE NAME READY SECRET AGE
+authentik certificate.cert-manager.io/auth-svo88-tls True auth-svo88-tls 27d
+devices certificate.cert-manager.io/print-svo88-tls True print-svo88-tls 7d5h
+documents certificate.cert-manager.io/paperless-svo88-tls True paperless-svo88-tls 26d
+documents certificate.cert-manager.io/trilium-svo88-tls True trilium-svo88-tls 21d
+infra certificate.cert-manager.io/dns-svo88-tls True dns-svo88-tls 26d
+infra certificate.cert-manager.io/git-svo88-tls True git-svo88-tls 27d
+infra certificate.cert-manager.io/netbox-svo88-tls True netbox-svo88-tls 26d
+infra certificate.cert-manager.io/pkg-svo88-tls True pkg-svo88-tls 6d20h
+infra certificate.cert-manager.io/pve-svo88-tls True pve-svo88-tls 26d
+infra certificate.cert-manager.io/vault-svo88-tls True vault-svo88-tls 26d
+infra certificate.cert-manager.io/zot-svo88-tls True zot-svo88-tls 27d
+media certificate.cert-manager.io/immich-svo88-tls True immich-svo88-tls 25d
+media certificate.cert-manager.io/jellyfin-svo88-tls True jellyfin-svo88-tls 21d
+media certificate.cert-manager.io/metube-svo88-tls True metube-svo88-tls 21d
+media certificate.cert-manager.io/yt-svo88-tls True yt-svo88-tls 21d
+security certificate.cert-manager.io/vw-svo88-tls True vw-svo88-tls 31d
+storage certificate.cert-manager.io/opencloud-svo88-tls True opencloud-svo88-tls 26d
+tools certificate.cert-manager.io/dash-svo88-tls True dash-svo88-tls 21d
+tools certificate.cert-manager.io/finance-svo88-tls True finance-svo88-tls 26d
+tools certificate.cert-manager.io/homebox-svo88-tls True homebox-svo88-tls 27d
+tools certificate.cert-manager.io/keep-svo88-tls True keep-svo88-tls 21d
+tools certificate.cert-manager.io/printstash-svo88-tls True printstash-svo88-tls 27d
+tools certificate.cert-manager.io/search-svo88-tls True search-svo88-tls 26d
+tools certificate.cert-manager.io/spoolman-svo88-tls True spoolman-svo88-tls 7d5h
+tools certificate.cert-manager.io/sub-store-svo88-tls True sub-store-svo88-tls 3d9h
+
+NAMESPACE NAME CLASS HOSTS ADDRESS PORTS AGE
+authentik ingress.networking.k8s.io/authentik traefik auth.svo88.space 10.0.30.200 80, 443 27d
+devices ingress.networking.k8s.io/qidi-printer traefik print.svo88.space 10.0.30.200 80, 443 7d5h
+documents ingress.networking.k8s.io/paperless traefik paperless.svo88.space 10.0.30.200 80, 443 26d
+documents ingress.networking.k8s.io/trilium traefik trilium.svo88.space 10.0.30.200 80, 443 21d
+infra ingress.networking.k8s.io/forgejo-git traefik git.svo88.space 10.0.30.200 80, 443 27d
+infra ingress.networking.k8s.io/netbox traefik netbox.svo88.space 10.0.30.200 80, 443 26d
+infra ingress.networking.k8s.io/openbao-vault traefik vault.svo88.space 10.0.30.200 80, 443 26d
+infra ingress.networking.k8s.io/pkg-custom traefik pkg.svo88.space 10.0.30.200 80 6d20h
+infra ingress.networking.k8s.io/pkg-server traefik pkg.svo88.space 10.0.30.200 80, 443 6d20h
+infra ingress.networking.k8s.io/proxmox-ve traefik pve.svo88.space 10.0.30.200 80, 443 26d
+infra ingress.networking.k8s.io/technitium-dns traefik dns.svo88.space 10.0.30.200 80, 443 26d
+infra ingress.networking.k8s.io/zot-registry traefik zot.svo88.space 10.0.30.200 80, 443 27d
+media ingress.networking.k8s.io/immich traefik immich.svo88.space 10.0.30.200 80, 443 25d
+media ingress.networking.k8s.io/invidious traefik yt.svo88.space 10.0.30.200 80, 443 21d
+media ingress.networking.k8s.io/jellyfin traefik jellyfin.svo88.space 10.0.30.200 80, 443 21d
+media ingress.networking.k8s.io/metube traefik metube.svo88.space 10.0.30.200 80, 443 21d
+security ingress.networking.k8s.io/vaultwarden traefik vw.svo88.space 10.0.30.200 80, 443 31d
+storage ingress.networking.k8s.io/opencloud traefik opencloud.svo88.space 10.0.30.200 80, 443 26d
+tools ingress.networking.k8s.io/dashboard traefik dash.svo88.space 10.0.30.200 80, 443 21d
+tools ingress.networking.k8s.io/homebox traefik homebox.svo88.space 10.0.30.200 80, 443 27d
+tools ingress.networking.k8s.io/karakeep traefik keep.svo88.space 10.0.30.200 80, 443 21d
+tools ingress.networking.k8s.io/printstash traefik printstash.svo88.space 10.0.30.200 80, 443 27d
+tools ingress.networking.k8s.io/searxng traefik search.svo88.space 10.0.30.200 80, 443 26d
+tools ingress.networking.k8s.io/spoolman traefik spoolman.svo88.space 10.0.30.200 80, 443 7d5h
+tools ingress.networking.k8s.io/sub-store traefik sub-store.svo88.space 10.0.30.200 80, 443 3d9h
+tools ingress.networking.k8s.io/sure-finance traefik finance.svo88.space 10.0.30.200 80, 443 26d
+
+NAME AGE
+ciliuml2announcementpolicy.cilium.io/lan-fastpath-announcement 35d
+
+NAME DISABLED CONFLICTING IPS AVAILABLE AGE
+ciliumloadbalancerippool.cilium.io/lan-ingress-pool false False 0 35d
+
+Traefik VIP (10.0.30.200:443) HTTP Status: 404
+```
+### Диски и тома (PVC / PV):
+```text
+NAMESPACE NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE
+databases persistentvolumeclaim/postgres-data-postgres-core-0 Bound pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO proxmox-csi-db 32d
+documents persistentvolumeclaim/paperless-data-pvc Bound pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO proxmox-csi-general 32d
+documents persistentvolumeclaim/trilium-data-pvc Bound pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO proxmox-csi-general 21d
+infra persistentvolumeclaim/netbox-media-pvc Bound pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO proxmox-csi-general 32d
+infra persistentvolumeclaim/nfs-packages-pvc Bound nfs-packages-pv 200Gi RWX 6d20h
+media persistentvolumeclaim/immich-db-pvc Bound pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO proxmox-csi-db 25d
+media persistentvolumeclaim/immich-library-pvc Bound pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO proxmox-csi-general 25d
+media persistentvolumeclaim/jellyfin-config-pvc Bound pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO proxmox-csi-general 21d
+media persistentvolumeclaim/nfs-kiwix-pvc Bound nfs-kiwix-pv 200Gi ROX 32d
+media persistentvolumeclaim/nfs-media-pvc Bound nfs-media-pv 1Ti RWX 21d
+media persistentvolumeclaim/nfs-torrents-pvc Bound nfs-torrents-pv 500Gi RWX 32d
+monitoring persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general 16d
+monitoring persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general 16d
+monitoring persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general 16d
+security persistentvolumeclaim/vaultwarden-data-pvc Bound pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO proxmox-csi-general 32d
+storage persistentvolumeclaim/nfs-opencloud-users-pvc Bound nfs-opencloud-users-pv 600Gi RWX 21d
+storage persistentvolumeclaim/opencloud-data-pvc Bound pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO proxmox-csi-general 16d
+tools persistentvolumeclaim/homebox-data-pvc Bound pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO proxmox-csi-general 32d
+tools persistentvolumeclaim/karakeep-data-pvc Bound pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO proxmox-csi-general 21d
+tools persistentvolumeclaim/karakeep-meili-pvc Bound pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO proxmox-csi-general 21d
+tools persistentvolumeclaim/printstash-models-pvc Bound printstash-models-pv 100Gi RWX 32d
+tools persistentvolumeclaim/spoolman-data-pvc Bound pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO proxmox-csi-general 7d5h
+tools persistentvolumeclaim/sub-store-data-pvc Bound pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO proxmox-csi-general 3d9h
+
+NAMESPACE NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS VOLUMEATTRIBUTESCLASS REASON AGE
+ persistentvolume/nfs-kiwix-pv 200Gi ROX Retain Bound media/nfs-kiwix-pvc 32d
+ persistentvolume/nfs-media-pv 1Ti RWX Retain Bound media/nfs-media-pvc 21d
+ persistentvolume/nfs-opencloud-users-pv 600Gi RWX Retain Bound storage/nfs-opencloud-users-pvc 21d
+ persistentvolume/nfs-packages-pv 200Gi RWX Retain Bound infra/nfs-packages-pvc 6d20h
+ persistentvolume/nfs-torrents-pv 500Gi RWX Retain Bound media/nfs-torrents-pvc 32d
+ persistentvolume/printstash-models-pv 100Gi RWX Retain Bound tools/printstash-models-pvc 32d
+ persistentvolume/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO Delete Bound documents/trilium-data-pvc proxmox-csi-general 21d
+ persistentvolume/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO Delete Bound storage/opencloud-data-pvc proxmox-csi-general 16d
+ persistentvolume/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO Delete Bound databases/postgres-data-postgres-core-0 proxmox-csi-db 32d
+ persistentvolume/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO Delete Bound tools/karakeep-meili-pvc proxmox-csi-general 21d
+ persistentvolume/pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO Delete Bound media/jellyfin-config-pvc proxmox-csi-general 21d
+ persistentvolume/pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO Delete Bound infra/netbox-media-pvc proxmox-csi-general 32d
+ persistentvolume/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO Delete Bound tools/karakeep-data-pvc proxmox-csi-general 21d
+ persistentvolume/pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO Delete Bound tools/sub-store-data-pvc proxmox-csi-general 3d9h
+ persistentvolume/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO Delete Bound security/vaultwarden-data-pvc proxmox-csi-general 32d
+ persistentvolume/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO Delete Bound media/immich-library-pvc proxmox-csi-general 25d
+ persistentvolume/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO Delete Bound tools/homebox-data-pvc proxmox-csi-general 32d
+ persistentvolume/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO Delete Bound monitoring/grafana-data-pvc proxmox-csi-general 16d
+ persistentvolume/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO Delete Bound monitoring/victoria-metrics-pvc proxmox-csi-general 16d
+ persistentvolume/pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO Delete Bound tools/spoolman-data-pvc proxmox-csi-general 7d5h
+ persistentvolume/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO Delete Bound media/immich-db-pvc proxmox-csi-db 25d
+ persistentvolume/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO Delete Bound monitoring/loki-data-pvc proxmox-csi-general 16d
+ persistentvolume/pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO Delete Bound documents/paperless-data-pvc proxmox-csi-general 32d
+```
+### Статус DaemonSet Proxmox-CSI Node:
+```text
+NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
+proxmox-csi-plugin-node 2 2 2 2 2 33d
+```
+### Статус пространства мониторинга (VictoriaMetrics & Grafana):
+```text
+NAME READY AGE
+statefulset.apps/grafana 1/1 16d
+statefulset.apps/loki 1/1 16d
+statefulset.apps/victoriametrics 1/1 16d
+
+NAME READY STATUS RESTARTS AGE
+pod/grafana-0 1/1 Running 0 169m
+pod/loki-0 1/1 Running 0 169m
+pod/victoriametrics-0 1/1 Running 0 169m
+
+NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE
+persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general 16d
+persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general 16d
+persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general 16d
+```
+### Логи ошибок Proxmox CSI Plugin (последние строки):
+```text
+Defaulted container "proxmox-csi-plugin-controller" out of: proxmox-csi-plugin-controller, csi-attacher, csi-provisioner, csi-resizer, liveness-probe
+Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe
+Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.012208 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4" nodeID="talos-worker-2"
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.131792 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb" nodeID="talos-worker-2"
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.206486 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7" nodeID="talos-worker-2"
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.277975 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2"
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.352701 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2"
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.430266 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780" nodeID="talos-worker-2"
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.509551 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2" nodeID="talos-worker-2"
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669146 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790776828491-7787-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\"}"
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669198 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2"
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.681187 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID=""
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873038 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790090280571-543-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\"}"
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873096 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2"
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.882474 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID=""
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.084431 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2"
+[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.357862 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:29.408317 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3\",\"volume_path\":\"/var/lib/kubelet/pods/b6ccf3ff-f0fc-411e-b5aa-5bbd61174578/volumes/kubernetes.io~csi/pvc-6eb8c148-32b0-45af-8945-2799d04875a3/mount\"}"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.576536 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.577998 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945\",\"volume_path\":\"/var/lib/kubelet/pods/f3402b78-9a95-4a5c-89c9-7535456d39e0/volumes/kubernetes.io~csi/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945/mount\"}"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.887356 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.888572 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\",\"volume_path\":\"/var/lib/kubelet/pods/ce3b896c-9957-4a70-b713-265ab487c32b/volumes/kubernetes.io~csi/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f/mount\"}"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.095236 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.096521 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780\",\"volume_path\":\"/var/lib/kubelet/pods/919bd05a-93f8-44e3-850e-7a8dd2a570d6/volumes/kubernetes.io~csi/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780/mount\"}"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.657181 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.658240 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b/mount\"}"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.659625 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.660965 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb/mount\"}"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.981192 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.982711 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242\",\"volume_path\":\"/var/lib/kubelet/pods/fa9abffb-f2c3-470f-9ee7-7bd93688270c/volumes/kubernetes.io~csi/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242/mount\"}"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.278791 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.280160 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd\",\"volume_path\":\"/var/lib/kubelet/pods/9ce6cd32-c936-4d17-8597-3efdb4845bc8/volumes/kubernetes.io~csi/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd/mount\"}"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:03.366763 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.621786 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.622940 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.802709 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.804175 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.307289 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.308598 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf\",\"volume_path\":\"/var/lib/kubelet/pods/288247da-f98a-4d43-9f15-e882d4c7acb5/volumes/kubernetes.io~csi/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf/mount\"}"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.015178 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.016475 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a\",\"volume_path\":\"/var/lib/kubelet/pods/096b52fa-6650-4996-8813-dd472343cf8e/volumes/kubernetes.io~csi/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a/mount\"}"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.754757 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.755939 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.979195 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.980398 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.775598 1 node.go:524] "NodeGetCapabilities: called"
+[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.776955 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}"
+```
+### Синхронизация GitOps (FluxCD):
+```text
+NAMESPACE NAME URL AGE READY STATUS
+flux-system gitrepository.source.toolkit.fluxcd.io/atlas-repo http://10.0.10.13:3000/atlas/atlas.git 33d True stored artifact for revision 'master@sha1:10fbe14ef463bef034856278733f9ad3155cd866'
+
+NAMESPACE NAME AGE READY STATUS
+flux-system kustomization.kustomize.toolkit.fluxcd.io/apps-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866
+flux-system kustomization.kustomize.toolkit.fluxcd.io/infra-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866
+
+NAMESPACE NAME AGE READY STATUS
+cert-manager helmrelease.helm.toolkit.fluxcd.io/cert-manager 33d True Helm upgrade succeeded for release cert-manager/cert-manager.v2 with chart cert-manager@v1.21.3
+external-secrets helmrelease.helm.toolkit.fluxcd.io/external-secrets 33d True Helm upgrade succeeded for release external-secrets/external-secrets.v5 with chart external-secrets@2.14.0
+kube-system helmrelease.helm.toolkit.fluxcd.io/cilium 33d True Helm upgrade succeeded for release kube-system/cilium.v6 with chart cilium@1.15.5
+kube-system helmrelease.helm.toolkit.fluxcd.io/proxmox-csi-plugin 33d True Helm upgrade succeeded for release kube-system/proxmox-csi-plugin.v4 with chart proxmox-csi-plugin@0.5.12
+```
+### Проблемные поды (Non-Running):
+```text
+NAMESPACE NAME READY STATUS RESTARTS AGE
+databases postgres-init-databases-4lk9r 0/1 Completed 0 169m
+```
+### Последние события-предупреждения (Warning Events):
+```text
+NAMESPACE LAST SEEN TYPE REASON OBJECT MESSAGE
+traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use
+traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use
+traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use
+traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use
+monitoring 51m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-7tjsw" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
+monitoring 34m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-t6n9v" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
+monitoring 17m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-rsbtk" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
+flux-system 16m Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider
+flux-system 3m34s Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider
+monitoring 73s Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-xsj4k" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
+```
+### Реальный объем данных OpenCloud (/var/lib/opencloud-users):
+```text
+331.7G /var/lib/opencloud-users
+```
+
+