From fc886fb03e782c5cb3428cb844124ff23fe41d46 Mon Sep 17 00:00:00 2001 From: v Date: Sun, 25 Oct 2026 18:23:02 +0300 Subject: [PATCH] git --- .gitignore | 3 + state/collect_state.sh | 0 zarya-code.xml | 567 +++++++++++++++++++-------- zarya-state.xml | 849 ++++++++++++++++++++++++++++++++++++++++- 4 files changed, 1250 insertions(+), 169 deletions(-) create mode 100644 .gitignore mode change 100644 => 100755 state/collect_state.sh diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..f712070 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +/state/snapshots +zarya-code.xml +zarya-state.xml \ No newline at end of file diff --git a/state/collect_state.sh b/state/collect_state.sh old mode 100644 new mode 100755 diff --git a/zarya-code.xml b/zarya-code.xml index 66c4745..b694890 100644 --- a/zarya-code.xml +++ b/zarya-code.xml @@ -45,13 +45,20 @@ The content is organized as follows: bin/ + fc + gg + op zarya cmd/ a.sh disks.sh errors.sh + exec.sh + flux.sh + git-credential.sh logs.sh net.sh + nodes.sh pack.sh pods.sh run.sh @@ -81,64 +88,48 @@ state/ 03_vyos.sh 04_tier0.sh 05_k8s.sh + collect_state.sh config.env This section contains the contents of the repository's files. - + #!/bin/bash set -euo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -source "${ZARYA_DIR}/lib/common.sh" +if [[ $# -eq 0 ]]; then + echo "Использование: fc <файл>" + exit 1 +fi +if [[ -f "$1" ]]; then + wl-copy < "$1" + echo "'$1' +++" +else + echo "'$1'+++" +fi + -SUBCMD="${1:-help}" -shift || true + +#!/bin/bash +set -euo pipefail +if [[ -z "${1:-}" ]]; then + echo "Тема СВО не раскрыта: gg \"сообщение\"" + exit 1 +fi +git add . && git commit -m "$1" && git push + -case "${SUBCMD}" in - p|pod|pods) exec "${ZARYA_DIR}/cmd/pods.sh" "$@" ;; - e|err|errors) exec "${ZARYA_DIR}/cmd/errors.sh" "$@" ;; - l|log|logs) exec "${ZARYA_DIR}/cmd/logs.sh" "$@" ;; - n|net) exec "${ZARYA_DIR}/cmd/net.sh" "$@" ;; - d|df|disks) exec "${ZARYA_DIR}/cmd/disks.sh" "$@" ;; - unseal) exec "${ZARYA_DIR}/cmd/unseal.sh" "$@" ;; - login|start) exec "${ZARYA_DIR}/cmd/session.sh" "start" "$@" ;; - logout|clean) exec "${ZARYA_DIR}/cmd/session.sh" "clean" "$@" ;; - up) exec "${ZARYA_DIR}/cmd/up.sh" "$@" ;; - run) exec "${ZARYA_DIR}/cmd/run.sh" "$@" ;; - a|apply) exec "${ZARYA_DIR}/cmd/a.sh" "$@" ;; - snap) exec "${ZARYA_DIR}/cmd/snap.sh" "$@" ;; - pack) exec "${ZARYA_DIR}/cmd/pack.sh" "$@" ;; - reset|nuke) exec "${ZARYA_DIR}/layers/reset.sh" "$@" ;; - gc) exec "${ZARYA_DIR}/layers/gc.sh" "$@" ;; - help|--help|-h) - cat <] [-s ] [-A] Просмотр подов - z errors Мгновенный триаж сломанных сервисов - z logs [-f] [-t ] Логи любого сервиса без ввода неймспейса - z net Сетевой радар доступности узлов (1 сек) - z disks Срез пулов astra/terra и ZVOL томов K8s -Управление и сессия: - z login [TTL] Открытие смены (YubiKey + RAM) - z logout Мгновенная очистка RAM - z unseal Распечатывание OpenBao Vault -Деплой и IaC: - z up [layer] Макро-слои (host, net, tier0, talos, apps, all) - z run Плейбуки Ansible (01, 02) - z a [-auto-approve] OpenTofu apply в RAM-изоляции -Телеметрия и LLM: - z snap Снятие полного .md аудита в snapshots/ - z pack [code|state|atlas] Сборка контекста Repomix -EOF - ;; - *) - log_err "Неизвестная команда: ${SUBCMD}. Введите 'z help'." - exit 1 - ;; -esac + +#!/bin/bash +set -euo pipefail +if [[ $# -eq 0 ]]; then + echo "Использование: op <файл...>" + exit 1 +fi +for f in "$@"; do + printf "file://%s\r\n" "$(realpath "$f")" +done | wl-copy -t text/uri-list @@ -201,6 +192,47 @@ if [[ "$has_errors" == false ]]; then fi + +#!/bin/bash +set -euo pipefail +ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +source "${ZARYA_DIR}/lib/common.sh" +if [[ $# -eq 0 ]]; then + log_err "Использование: z exec <команда> [аргументы...]" + exit 1 +fi +run_isolated "$@" + + + +#!/bin/bash +set -uo pipefail +ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +source "${ZARYA_DIR}/lib/common.sh" +subcmd="${1:-status}" +shift || true +case "${subcmd}" in + sync|reconcile|s) + log_info "Принудительная конвергенция FluxCD..." + flux reconcile source git atlas-repo -n flux-system 2>/dev/null || true + flux reconcile kustomization infra-sync -n flux-system 2>/dev/null || true + flux reconcile kustomization apps-sync -n flux-system 2>/dev/null || true + log_ok "Синхронизация завершена." + ;; + logs|log|l) + log_info "Стриминг логов kustomize-controller..." + exec kubectl -n flux-system logs -l app.kubernetes.io/name=kustomize-controller --tail=50 -f + ;; + status|st) + echo -e "${BLUE}=== СТАТУС РЕПОЗИТОРИЕВ И KUSTOMIZATION (FLUX) ===${NC}" + kubectl -n flux-system get gitrepositories,kustomizations,helmreleases 2>/dev/null || log_err "Flux недоступен" + ;; + *) + kubectl -n flux-system get kustomizations 2>/dev/null || log_err "Flux недоступен" + ;; +esac + + #!/bin/bash set -uo pipefail @@ -264,34 +296,49 @@ check_target "Traefik L2 VIP" "10.0.30.200" 443 check_target "Perimeter VPS" "153.76.194.24" 443 - + #!/bin/bash -set -euo pipefail -ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -mode="${1:-state}" -case "${mode}" in - state) - echo "==> Снятие свежего аудита..." - "${ZARYA_DIR}/state/collect_state.sh" all >/dev/null 2>&1 || true - echo "==> Упаковка среза состояния Repomix (zarya-state.xml)..." - repomix --config "${ZARYA_DIR}/repomix.state.json" - echo "✔ Файл zarya-state.xml готов для отправки в LLM." - ;; - code) - echo "==> Упаковка кодовой базы zarya (zarya-code.xml)..." - repomix --config "${ZARYA_DIR}/repomix.config.json" - echo "✔ Файл zarya-code.xml готов." - ;; - atlas) - echo "==> Упаковка чистой инфраструктуры atlas (atlas-code.xml)..." - cd "${ATLAS_DIR}" && repomix - echo "✔ Файл atlas/repomix-output.xml готов." - ;; - *) - echo "Использование: z pack [state|code|atlas]" - exit 1 - ;; -esac +set -u +watch_mode=false +while [[ $# -gt 0 ]]; do + case "$1" in + -w|--watch) watch_mode=true; shift ;; + *) shift ;; + esac +done +render_nodes() { + local raw + raw=$(kubectl get nodes -L topology.kubernetes.io/zone,topology.kubernetes.io/region 2>/dev/null || true) + echo "$raw" | awk ' + BEGIN { + ERR = "\033[38;2;255;46;76m" + RUN = "\033[38;2;166;227;161m" + HEAD = "\033[38;2;147;154;183m" + RST = "\033[0m" + } + NR==1 { print HEAD $0 RST; next } + { + if ($2 ~ /Ready/ && $2 !~ /NotReady/) { + print RUN $0 RST + } + else { + print ERR $0 RST + } + }' +} +if [[ "$watch_mode" == true ]]; then + trap 'tput cnorm 2>/dev/null || true; echo ""; exit 0' INT TERM + tput civis 2>/dev/null || true + clear + while true; do + tput cup 0 0 2>/dev/null || true + render_nodes + tput ed 2>/dev/null || true + sleep 1 + done +else + render_nodes +fi @@ -727,99 +774,6 @@ log_warn() { echo -e "${YELLOW}⚠${NC} $*"; } log_err() { echo -e "${RED}✖${NC} $*"; } - -#!/bin/bash -# Network routing and terminal prerequisites -ensure_prerequisites() { - local target_ip="${VAULT_ADDR#*//}" - target_ip="${target_ip%%:*}" - if ! ip route get "${target_ip}" 2>/dev/null | grep -q "${VYOS_ROUTER_IP}"; then - log_info "Восстанавливаем маршрут к ${NET_PREFIX} через VyOS (${VYOS_ROUTER_IP})..." - sudo ip route replace "${NET_PREFIX}" via "${VYOS_ROUTER_IP}" 2>/dev/null || true - fi - # Регистрация Git Credential Helper (доменный и прямой IP Tier-0) - local target_helper="!${REPO_ROOT}/deploy.sh git-credential" - local current_helper - current_helper=$(git config --global --get credential."https://${GIT_HOST}".helper 2>/dev/null || true) - if [[ "${current_helper}" != "${target_helper}" ]]; then - git config --global credential."https://${GIT_HOST}".helper "${target_helper}" - fi - local direct_helper - direct_helper=$(git config --global --get credential."http://10.0.10.13:3000".helper 2>/dev/null || true) - if [[ "${direct_helper}" != "${target_helper}" ]]; then - git config --global credential."http://10.0.10.13:3000".helper "${target_helper}" - fi - # Нативная привязка IdentityFile для всех C2-хостов и LXC-контейнеров - local ssh_hosts="proxmox pve0 vyos vyos_router 10.0.* dns0 vault0 git0 storage0 registry0" - if [[ -f "${HOME}/.ssh/config" ]] && ! grep -q "IdentityFile ${RAM_KEY}" "${HOME}/.ssh/config"; then - printf "\nHost %s\n IdentityFile %s\n IdentitiesOnly yes\n" "${ssh_hosts}" "${RAM_KEY}" >> "${HOME}/.ssh/config" - fi -} - - - -#!/bin/bash -# Session state in RAM tmpfs and YubiKey integration -load_secrets_to_ram() { - local hours="${1:-$DEFAULT_SESSION_TTL}" - local now - now=$(date +%s) - ensure_prerequisites - # Валидация сессии по наличию непустых кэша секретов и SSH-ключа - if [[ -f "${RAM_CACHE}" ]] && [[ -f "${RAM_KEY}" ]] && [[ -s "${RAM_KEY}" ]]; then - local created age cached_ttl - created=$(stat -c %Y "${RAM_CACHE}" 2>/dev/null || echo 0) - age=$(( now - created )) - cached_ttl=$(grep '^# TTL_SECONDS=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2 || echo 3600) - if [[ "${cached_ttl}" -ne 0 ]] && (( age >= cached_ttl )); then - log_warn "Время сессии истекло ($(( age / 60 )) мин >= $(( cached_ttl / 60 )) мин). Инвалидация кэша..." - rm -f "${RAM_CACHE}" "${RAM_KEY}" - else - return 0 - fi - fi - local ttl_seconds - if [[ "${hours}" -eq 0 ]]; then - ttl_seconds=0 - else - ttl_seconds=$(( hours * 3600 )) - fi - log_info "🔐 Вход в защищенный контур C2..." - read -s -p "Master Password: " KP_PASS - echo "" - local yk_args=() - if ykman info >/dev/null 2>&1; then - yk_args=("-y" "2") - log_info "YubiKey обнаружен. Приготовьтесь к аппаратному подтверждению (1 касание)..." - fi - # Атомарный 1-Touch экспорт всей базы KDBX в RAM (ровно 1 касание YubiKey на всю сессию) - local tmp_dump="/dev/shm/.kdbx_dump_${now}_$$.xml" - rm -f "${tmp_dump}" - touch "${tmp_dump}" - chmod 600 "${tmp_dump}" - if ! echo "${KP_PASS}" | keepassxc-cli export "${yk_args[@]}" "${KDBX_PATH}" -f xml > "${tmp_dump}" 2>/dev/null; then - log_err "Ошибка расшифровки базы KDBX (неверный пароль или таймаут касания YubiKey)" - rm -f "${tmp_dump}" - unset KP_PASS - return 1 - fi - unset KP_PASS - python3 "${REPO_ROOT}/scripts/lib/kdbx_parser.py" "${tmp_dump}" "${RAM_CACHE}" "${RAM_KEY}" "${ttl_seconds}" "${PVE_ENDPOINT}" "${VAULT_ADDR}" - rm -f "${tmp_dump}" - log_ok "База расшифрована за 1 касание. Ключ и секреты в RAM (TTL: ${hours}ч)" -} -run_isolated() { - ensure_prerequisites - load_secrets_to_ram - ( - set -a - source "${RAM_CACHE}" - set +a - "$@" - ) -} - - #!/bin/bash # OpenBao Vault operations and Kubernetes Secret synchronization @@ -1161,6 +1115,71 @@ timeout 10s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n storage exec statefulse echo '```' + +#!/bin/bash +set -uo pipefail +ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +STATE_DIR="${ZARYA_DIR}/state" +SNAPSHOTS_DIR="${STATE_DIR}/snapshots" +TARGET="${1:-all}" +MODULES=( + "00_workstation.sh" + "01_pve.sh" + "02_vps.sh" + "03_vyos.sh" + "04_tier0.sh" + "05_k8s.sh" +) +mkdir -p "${SNAPSHOTS_DIR}" +generate_header() { + local mod_name="$1" + local timestamp branch short_hash commit_msg + timestamp=$(date -u +"%Y-%m-%d %H:%M:%S UTC") + branch=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" branch --show-current 2>/dev/null || echo "unknown") + short_hash=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" rev-parse --short HEAD 2>/dev/null || echo "none") + commit_msg=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" log -1 --format='%s' 2>/dev/null || echo "none") + cat < Сбор модуля: ${mod_name}..." + generate_header "${mod_name}" > "${tmp_file}" + if [[ -x "${script}" ]]; then + "${script}" >> "${tmp_file}" 2>&1 + else + bash "${script}" >> "${tmp_file}" 2>&1 + fi + mv "${tmp_file}" "${out_file}" +} +if [[ "${TARGET}" == "all" ]]; then + echo "==> Сбор полного аудита Sovereign C2 в ${SNAPSHOTS_DIR}..." + for mod in "${MODULES[@]}"; do + run_single_module "${mod}" + done + echo "✔ Все модули телеметрии успешно сохранены." +else + case "${TARGET}" in + 00_workstation|workstation|host) run_single_module "00_workstation.sh" ;; + 01_pve|pve) run_single_module "01_pve.sh" ;; + 02_vps|vps) run_single_module "02_vps.sh" ;; + 03_vyos|vyos|net) run_single_module "03_vyos.sh" ;; + 04_tier0|tier0) run_single_module "04_tier0.sh" ;; + 05_k8s|k8s|talos) run_single_module "05_k8s.sh" ;; + *) + echo "Неизвестный модуль: ${TARGET}" + exit 1 + ;; + esac +fi + + #!/bin/bash # Atlas C2 Configuration SSOT @@ -1178,4 +1197,216 @@ PVE_ENDPOINT="https://192.168.1.177:8006/" DEFAULT_SESSION_TTL=1 + +#!/bin/bash +set -euo pipefail +ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +source "${ZARYA_DIR}/lib/common.sh" + +SUBCMD="${1:-help}" +shift || true + +case "${SUBCMD}" in + git-credential) exec "${ZARYA_DIR}/cmd/git-credential.sh" "$@" ;; + exec) exec "${ZARYA_DIR}/cmd/exec.sh" "$@" ;; + p|pod|pods) exec "${ZARYA_DIR}/cmd/pods.sh" "$@" ;; + node|nodes) exec "${ZARYA_DIR}/cmd/nodes.sh" "$@" ;; + flux) exec "${ZARYA_DIR}/cmd/flux.sh" "$@" ;; + e|err|errors) exec "${ZARYA_DIR}/cmd/errors.sh" "$@" ;; + l|log|logs) exec "${ZARYA_DIR}/cmd/logs.sh" "$@" ;; + n|net) exec "${ZARYA_DIR}/cmd/net.sh" "$@" ;; + d|df|disks) exec "${ZARYA_DIR}/cmd/disks.sh" "$@" ;; + unseal) exec "${ZARYA_DIR}/cmd/unseal.sh" "$@" ;; + login|start) exec "${ZARYA_DIR}/cmd/session.sh" "start" "$@" ;; + logout|clean) exec "${ZARYA_DIR}/cmd/session.sh" "clean" "$@" ;; + up) exec "${ZARYA_DIR}/cmd/up.sh" "$@" ;; + run) exec "${ZARYA_DIR}/cmd/run.sh" "$@" ;; + a|apply) exec "${ZARYA_DIR}/cmd/a.sh" "$@" ;; + snap) exec "${ZARYA_DIR}/cmd/snap.sh" "$@" ;; + pack) exec "${ZARYA_DIR}/cmd/pack.sh" "$@" ;; + reset|nuke) exec "${ZARYA_DIR}/layers/reset.sh" "$@" ;; + gc) exec "${ZARYA_DIR}/layers/gc.sh" "$@" ;; + help|--help|-h) + cat <] [-s ] [-A] Просмотр подов + z nodes [-w] Статус нод, роли, зона и регион + z errors Мгновенный триаж сломанных сервисов + z logs [-f] [-t ] Логи сервиса без ввода неймспейса + z net Сетевой радар доступности узлов (1 сек) + z disks Срез пулов astra/terra и томов K8s +GitOps и оркестрация: + z flux [status|sync|logs] Управление GitOps-конвергенцией + z exec <команда...> Вызов бинарников внутри RAM-изоляции +Сессия и доступы: + z login [TTL] Открытие смены (YubiKey + RAM) + z logout Мгновенная очистка RAM + z unseal Распечатывание OpenBao Vault +Деплой и IaC: + z up [layer] Макро-слои (host, net, tier0, talos, apps, all) + z run Плейбуки Ansible (01, 02) + z a [-auto-approve] OpenTofu apply в RAM-изоляции +Телеметрия и LLM: + z snap Снятие аудита в state/snapshots/ + z pack [all|atlas|code|state] Сборка контекстов Repomix для LLM +EOF + ;; + *) + log_err "Неизвестная команда: ${SUBCMD}. Введите 'z help'." + exit 1 + ;; +esac + + + +#!/bin/bash +set -euo pipefail +ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +source "${ZARYA_DIR}/lib/common.sh" +if [[ -f "${RAM_CACHE}" ]]; then + token=$(grep '^export ATLAS_PUSH_TOKEN=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'\'' ' || true) + if [[ -n "${token}" ]]; then + echo "username=atlas" + echo "password=${token}" + fi +fi +exit 0 + + + +#!/bin/bash +set -euo pipefail +ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +source "${ZARYA_DIR}/lib/common.sh" +mode="${1:-all}" +pack_atlas() { + log_info "==> [1/3] Упаковка чистой архитектуры Atlas (atlas-code.xml)..." + (cd "${ATLAS_DIR}" && repomix --config "${ATLAS_DIR}/repomix.config.json") + log_ok "Файл ${ATLAS_DIR}/atlas-code.xml готов." +} +pack_zarya() { + log_info "==> [2/3] Упаковка станции оператора Zarya (zarya-code.xml)..." + (cd "${ZARYA_DIR}" && repomix --config "${ZARYA_DIR}/repomix.config.json") + log_ok "Файл ${ZARYA_DIR}/zarya-code.xml готов." +} +pack_state() { + log_info "==> [3/3] Снятие живого аудита и упаковка телеметрии (zarya-state.xml)..." + "${ZARYA_DIR}/state/collect_state.sh" all + (cd "${ZARYA_DIR}" && repomix --config "${ZARYA_DIR}/repomix.state.json") + log_ok "Файл ${ZARYA_DIR}/zarya-state.xml готов." +} +case "${mode}" in + all) + pack_atlas + echo "" + pack_zarya + echo "" + pack_state + echo "" + log_ok "Все три контекста Repomix собраны без ошибок." + ;; + atlas) + pack_atlas + ;; + code) + pack_zarya + ;; + state) + pack_state + ;; + *) + log_err "Использование: z pack [all|atlas|code|state]" + exit 1 + ;; +esac + + + +#!/bin/bash +ensure_prerequisites() { + local target_ip="${VAULT_ADDR#*//}" + target_ip="${target_ip%%:*}" + if ! ip route get "${target_ip}" 2>/dev/null | grep -q "${VYOS_ROUTER_IP}"; then + log_info "Восстанавливаем маршрут к ${NET_PREFIX} через VyOS (${VYOS_ROUTER_IP})..." + sudo ip route replace "${NET_PREFIX}" via "${VYOS_ROUTER_IP}" 2>/dev/null || true + fi + local target_helper="!${ZARYA_DIR}/bin/zarya git-credential" + local current_helper + current_helper=$(git config --global --get credential."https://${GIT_HOST}".helper 2>/dev/null || true) + if [[ "${current_helper}" != "${target_helper}" ]]; then + git config --global credential."https://${GIT_HOST}".helper "${target_helper}" + fi + local direct_helper + direct_helper=$(git config --global --get credential."http://10.0.10.13:3000".helper 2>/dev/null || true) + if [[ "${direct_helper}" != "${target_helper}" ]]; then + git config --global credential."http://10.0.10.13:3000".helper "${target_helper}" + fi + local ssh_hosts="proxmox pve0 vyos vyos_router 10.0.* dns0 vault0 git0 storage0 registry0" + if [[ -f "${HOME}/.ssh/config" ]] && ! grep -q "IdentityFile ${RAM_KEY}" "${HOME}/.ssh/config"; then + printf "\nHost %s\n IdentityFile %s\n IdentitiesOnly yes\n" "${ssh_hosts}" "${RAM_KEY}" >> "${HOME}/.ssh/config" + fi +} + + + +#!/bin/bash +load_secrets_to_ram() { + local hours="${1:-$DEFAULT_SESSION_TTL}" + local now + now=$(date +%s) + ensure_prerequisites + if [[ -f "${RAM_CACHE}" ]] && [[ -f "${RAM_KEY}" ]] && [[ -s "${RAM_KEY}" ]]; then + local created age cached_ttl + created=$(stat -c %Y "${RAM_CACHE}" 2>/dev/null || echo 0) + age=$(( now - created )) + cached_ttl=$(grep '^# TTL_SECONDS=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2 || echo 3600) + if [[ "${cached_ttl}" -ne 0 ]] && (( age >= cached_ttl )); then + log_warn "Время сессии истекло ($(( age / 60 )) мин >= $(( cached_ttl / 60 )) мин). Инвалидация кэша..." + rm -f "${RAM_CACHE}" "${RAM_KEY}" + else + return 0 + fi + fi + local ttl_seconds + if [[ "${hours}" -eq 0 ]]; then + ttl_seconds=0 + else + ttl_seconds=$(( hours * 3600 )) + fi + log_info "🔐 Вход в защищенный контур Zarya..." + read -s -p "Master Password: " KP_PASS + echo "" + local yk_args=() + if ykman info >/dev/null 2>&1; then + yk_args=("-y" "2") + log_info "YubiKey обнаружен. Приготовьтесь к аппаратному подтверждению (1 касание)..." + fi + local tmp_dump="/dev/shm/.kdbx_dump_${now}_$$.xml" + rm -f "${tmp_dump}" + touch "${tmp_dump}" + chmod 600 "${tmp_dump}" + if ! echo "${KP_PASS}" | keepassxc-cli export "${yk_args[@]}" "${KDBX_PATH}" -f xml > "${tmp_dump}" 2>/dev/null; then + log_err "Ошибка расшифровки базы KDBX (неверный пароль или таймаут касания YubiKey)" + rm -f "${tmp_dump}" + unset KP_PASS + return 1 + fi + unset KP_PASS + python3 "${ZARYA_DIR}/lib/kdbx_parser.py" "${tmp_dump}" "${RAM_CACHE}" "${RAM_KEY}" "${ttl_seconds}" "${PVE_ENDPOINT}" "${VAULT_ADDR}" + rm -f "${tmp_dump}" + log_ok "База расшифрована за 1 касание. Ключ и секреты в RAM (TTL: ${hours}ч)" +} +run_isolated() { + ensure_prerequisites + load_secrets_to_ram + ( + set -a + source "${RAM_CACHE}" + set +a + "$@" + ) +} + + diff --git a/zarya-state.xml b/zarya-state.xml index 6ca7bc4..742b380 100644 --- a/zarya-state.xml +++ b/zarya-state.xml @@ -42,10 +42,857 @@ The content is organized as follows: - +state/ + snapshots/ + 00_workstation.md + 01_pve.md + 02_vps.md + 03_vyos.md + 04_tier0.md + 05_k8s.md This section contains the contents of the repository's files. + +# Sovereign C2 Runtime: 00_workstation +**Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git") +## 0. Рабочая станция администратора (Operator Environment) +### Инфраструктурные SSH-хосты (~/.ssh/config): +```text +Host proxmox pve0 + Hostname 192.168.1.177 + Port 22 + User root + +Host vyos vyos_router + Hostname 192.168.1.2 + Port 22 + User vyos + +Host 10.0.* dns0 vault0 git0 storage0 registry0 + User root + StrictHostKeyChecking no + UserKnownHostsFile /dev/null + LogLevel ERROR + +Host fin21 + Hostname 153.76.194.24 + Port 22 + User atlas + +Host incserv + Hostname 31.76.100.166 + Port 8765 + User root + +Host router + Hostname 192.168.1.1 + Port 1488 + User root + +Host proxmox pve0 vyos vyos_router fin21 10.0.* + IdentityFile /dev/shm/.atlas_core + IdentitiesOnly yes +``` +### Рабочие алиасы и функции оператора (Active Workflow Aliases): +```bash +# Маркер # >>> ATLAS C2 WORKFLOW >>> не найден в ~/.bashrc +``` +### Статус RAM-кэша секретов (/dev/shm/.atlas_secrets_cache): +```text +Размер: 1058 байт | Права: 600 | Создан: 2026-10-25 18:08:15.915202821 +0300 +``` +### Проверка Git Credential Helper (git.svo88.space): +```text +Username: atlas +Password: [PRESENT in RAM] +``` +### Ядро, память, ZRAM и параметры Coredump: +```text +Kernel: 7.2.5-3-omarchy +Swapon: NAME TYPE SIZE USED PRIO +/swap/swapfile file 13.5G 0B 0 +/dev/zram0 partition 13.5G 358M 100 +NAME ALGORITHM DISKSIZE DATA COMPR TOTAL STREAMS MOUNTPOINT +/dev/zram0 zstd 13.5G 331.5M 89.6M 95M [SWAP] +Coredump config: +#Storage=external +#ProcessSizeMax=32G +``` +### Токены безопасности и ключи в ssh-agent: +```text +Active SSH Agent keys: +The agent has no identities. +YubiKey / FIDO2 Status: +Device type: YubiKey 5 Nano +Serial number: 29508635 +Firmware version: 5.7.1 +Form factor: Nano (USB-A) +Enabled USB interfaces: OTP, FIDO, CCID + +Applications +Yubico OTP Enabled +FIDO U2F Enabled +FIDO2 Enabled +OATH Enabled +PIV Enabled +OpenPGP Enabled +YubiHSM Auth Enabled +``` +### Зеркала пакетов Pacman (Mirrorlist): +```text +/etc/pacman.conf:[options] +/etc/pacman.conf:[core] +/etc/pacman.conf:[extra] +/etc/pacman.conf:[multilib] +/etc/pacman.conf:[omarchy] +/etc/pacman.conf:Server = https://pkgs.omarchy.org/stable/$arch +/etc/pacman.d/mirrorlist:Server = https://stable-mirror.omarchy.org/$repo/os/$arch +/etc/pacman.d/mirrorlist.bak:Server = https://mirror.omarchy.org/$repo/os/$arch +/etc/pacman.d/mirrorlist.omarchy-upgrade-to-quattro.20260905155315.bak:Server = https://mirror.omarchy.org/$repo/os/$arch +Нет данных о зеркалах +``` +### Маршрутизация на хосте (Routing to C2): +```text +default via 192.168.1.2 dev enp34s0 proto dhcp src 192.168.1.247 metric 100 +10.0.0.0/16 via 192.168.1.2 dev enp34s0 proto static metric 100 +192.168.1.0/24 dev enp34s0 proto kernel scope link src 192.168.1.247 metric 100 +``` +### Версии локальных инструментов: +```text +OpenTofu: OpenTofu v1.12.1 +Kubectl: gitVersion: v1.36.4 +Talosctl: Client: +Talos v1.14.0 +``` +### Состояние локального Git-репозитория (SSOT Source): +```text +fatal: not a git repository (or any parent up to mount point /) +Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set). +fatal: not a git repository (or any parent up to mount point /) +Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set). +Последний коммит: +Remote URL: no remote +``` +--- + + + +# Sovereign C2 Runtime: 01_pve +**Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git") +## 1. Гипервизор Proxmox VE (192.168.1.177) +### Память хоста, Uptime и Температура CPU: +```text + 18:20:07 up 3:30, 1 user, load average: 1.59, 1.90, 1.69 + + total used free shared buff/cache available +Mem: 37Gi 30Gi 5.8Gi 75Mi 1.3Gi 6.6Gi +Swap: 0B 0B 0B + +``` +### Здоровье физических дисков (SMART): +```text +/dev/sda: SMART overall-health self-assessment test result: PASSED +/dev/sdb: SMART overall-health self-assessment test result: PASSED +/dev/sdc: SMART overall-health self-assessment test result: PASSED +/dev/sdd: SMART overall-health self-assessment test result: PASSED +/dev/sde: SMART overall-health self-assessment test result: PASSED +/dev/sdf: SMART overall-health self-assessment test result: PASSED +``` +### Статус шифрования ZFS (Encryption & Keys): +```text +NAME PROPERTY VALUE SOURCE +astra encryption aes-256-gcm - +astra keystatus available - +astra keyformat raw - +astra keylocation file:///etc/zfs/keys/astra.key local +terra encryption aes-256-gcm - +terra keystatus available - +terra keyformat raw - +terra keylocation file:///etc/zfs/keys/terra.key local +``` +### Здоровье и емкость ZFS-пулов: +```text +NAME SIZE ALLOC FREE FRAG CAP HEALTH +astra 2.78T 540G 2.25T 9% 18% ONLINE +terra 1.81T 345G 1.48T 0% 18% ONLINE + +NAME USED AVAIL REFER MOUNTPOINT +astra 360G 1.44T 55.0M /astra +astra/vm-100-cloudinit 128K 1.44T 128K - +astra/vm-100-disk-0 1.06G 1.44T 1.06G - +astra/vm-201-disk-0 1.38G 1.44T 1.38G - +astra/vm-202-disk-0 14.8G 1.44T 14.8G - +astra/vm-203-disk-0 20.4G 1.44T 20.4G - +astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 27.2M 1.44T 27.2M - +astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 8.61M 1.44T 8.61M - +astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 203M 1.44T 203M - +astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 714K 1.44T 714K - +astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 5.13M 1.44T 5.13M - +astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 884K 1.44T 884K - +astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 1.05M 1.44T 1.05M - +astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 416K 1.44T 416K - +astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 7.02M 1.44T 7.02M - +astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 320G 1.44T 320G - +astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 970K 1.44T 970K - +astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 375M 1.44T 375M - +astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 1.33M 1.44T 1.33M - +astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 2.54M 1.44T 2.54M - +astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 704M 1.44T 704M - +astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 14.5M 1.44T 14.5M - +astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 20.7M 1.44T 20.7M - +terra 345G 1.42T 12.6G /terra +terra/media 248K 1.42T 248K /terra/media +terra/s3 192K 1.42T 192K /terra/s3 +terra/vault 333G 1.42T 333G /terra/vault +``` +### Физическая емкость каталогов на /terra: +```text +68K /terra/media +4.6M /terra/models +171K /terra/packages +13G /terra/registry +8.5K /terra/s3 +4.3M /terra/torrents +333G /terra/vault +``` +### Блочные устройства хоста и тома ZVOL (lsblk): +```text +NAME FSTYPE SIZE MOUNTPOINTS +loop0 ext4 4G +loop1 ext4 4G +loop2 ext4 2G +loop3 ext4 8G +loop4 ext4 8G +sda 1.8T +├─sda1 zfs_member 1.8T +└─sda9 8M +sdb 953.9G +├─sdb1 zfs_member 953.9G +└─sdb9 8M +sdc 476.9G +├─sdc1 vfat 976M /boot/efi +├─sdc2 linux_raid_member 977M +│ └─md0 ext4 976M /boot +└─sdc3 linux_raid_member 445.3G + └─md1 crypto_LUKS 445.1G + └─md1_crypt ext4 445.1G / +sdd 953.9G +├─sdd1 zfs_member 953.9G +└─sdd9 8M +sde 447.1G +├─sde1 vfat 976M +├─sde2 linux_raid_member 977M +│ └─md0 ext4 976M /boot +└─sde3 linux_raid_member 445.2G + └─md1 crypto_LUKS 445.1G + └─md1_crypt ext4 445.1G / +sdf 953.9G +├─sdf1 zfs_member 953.9G +└─sdf9 8M +zd0 ext4 2G +zd16 ext4 10G +zd32 ext4 10G +zd48 ext4 20G +zd64 iso9660 4M +zd80 ext4 5G +zd96 ext4 5G +zd112 ext4 5G +zd128 ext4 5G +zd144 100G +├─zd144p1 vfat 100M +├─zd144p2 1M +├─zd144p3 xfs 2G +├─zd144p4 1M +├─zd144p5 xfs 100M +└─zd144p6 xfs 97.8G +zd160 ext4 30G +zd176 ext4 30G +zd192 ext4 400G +zd208 ext4 100G +zd224 100G +├─zd224p1 vfat 100M +├─zd224p2 1M +├─zd224p3 xfs 2G +├─zd224p4 1M +├─zd224p5 xfs 100M +└─zd224p6 xfs 97.8G +zd240 10G +├─zd240p1 1M +├─zd240p2 vfat 256M +└─zd240p3 ext4 9G +zd256 ext4 100G +zd272 20G +├─zd272p1 vfat 100M +├─zd272p2 1M +├─zd272p3 xfs 2G +├─zd272p4 1M +├─zd272p5 xfs 100M +└─zd272p6 xfs 17.8G +zd288 ext4 20G +zd304 ext4 15G +zd320 ext4 5G +zd336 ext4 30G +``` +### Виртуальные диски K8s и ВМ (ZVOLs на astra): +```text +NAME VOLSIZE USED REFER +astra/vm-100-cloudinit 4M 128K 128K +astra/vm-100-disk-0 10G 1.06G 1.06G +astra/vm-201-disk-0 20G 1.38G 1.38G +astra/vm-202-disk-0 100G 14.8G 14.8G +astra/vm-203-disk-0 100G 20.4G 20.4G +astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10G 27.2M 27.2M +astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100G 8.61M 8.61M +astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100G 203M 203M +astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5G 714K 714K +astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20G 5.13M 5.13M +astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10G 884K 884K +astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15G 1.05M 1.05M +astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2G 416K 416K +astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5G 7.02M 7.02M +astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400G 320G 320G +astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5G 970K 970K +astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5G 375M 375M +astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20G 1.33M 1.33M +astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5G 2.54M 2.54M +astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30G 704M 704M +astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30G 14.5M 14.5M +astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30G 20.7M 20.7M +``` +### Модули ядра (nfsd, zfs): +```text +zfs 6262784 44 +nfsd 1011712 3 +``` +### Теги сетевых карт ВМ 100 (VyOS) в Proxmox: +```text +net0: virtio=BC:24:11:DC:6D:EC,bridge=vmbr0,firewall=0 +net1: virtio=BC:24:11:3F:CB:C9,bridge=vmbr0,firewall=0,tag=20 +net2: virtio=BC:24:11:EA:32:2F,bridge=vmbr0,firewall=0,tag=30 +net3: virtio=BC:24:11:59:E8:8D,bridge=vmbr0,firewall=0,tag=10 +``` +### Точки монтирования LXC-контейнеров (/etc/pve/lxc/*.conf): +```text +/etc/pve/lxc/101.conf:mp0: /astra/data/dns0,mp=/opt/technitium/dns/config +/etc/pve/lxc/102.conf:mp0: /astra/data/vault0,mp=/var/lib/bao/data +/etc/pve/lxc/103.conf:mp0: /astra/data/git0,mp=/var/lib/forgejo +/etc/pve/lxc/104.conf:mp0: /terra/media,mp=/media +/etc/pve/lxc/104.conf:mp1: /terra/torrents,mp=/torrents +/etc/pve/lxc/104.conf:mp2: /terra/vault,mp=/backups +/etc/pve/lxc/104.conf:mp3: /terra/models,mp=/models +/etc/pve/lxc/104.conf:mp4: /terra/packages,mp=/packages +/etc/pve/lxc/105.conf:mp0: /terra/registry,mp=/mnt/registry +``` +### Флаги автостарта ВМ и Контейнеров (onboot): +```text +/etc/pve/qemu-server/100.conf:onboot: 1 +/etc/pve/qemu-server/201.conf:onboot: 1 +/etc/pve/qemu-server/202.conf:onboot: 1 +/etc/pve/qemu-server/203.conf:onboot: 1 +/etc/pve/lxc/101.conf:onboot: 1 +/etc/pve/lxc/102.conf:onboot: 1 +/etc/pve/lxc/103.conf:onboot: 1 +/etc/pve/lxc/104.conf:onboot: 1 +/etc/pve/lxc/105.conf:onboot: 1 +``` +### Виртуальные машины (QEMU) и Контейнеры (LXC): +```text + VMID NAME STATUS MEM(MB) BOOTDISK(GB) PID + 100 vyos-router running 2048 10.00 2594 + 201 talos-master-1 running 2560 20.00 2698 + 202 talos-worker-1 running 10240 100.00 3869 + 203 talos-worker-2 running 10240 100.00 4919 + +VMID Status Lock Name +101 running dns0 +102 running vault0 +103 running git0 +104 running storage0 +105 running registry0 +``` +--- + + + +# Sovereign C2 Runtime: 02_vps +**Срез:** 2026-10-25 15:20:12 UTC | **Git:** master@10fbe14 ("git") +## 2. Периметр: Белый VPS (Host: fin21, IP: 153.76.194.24) +### WireGuard wg0 на VPS: +```text +interface: wg0 + public key: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY= + private key: (hidden) + listening port: 51820 + +peer: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4= + endpoint: 45.93.6.172:46777 + allowed ips: 10.8.0.2/32, 10.0.30.200/32 + latest handshake: 3 hours, 28 minutes, 44 seconds ago + transfer: 64.06 MiB received, 54.22 MiB sent +``` +### Статус системных сервисов (Edge Stack): +```text +WireGuard: active | HAProxy: active | Xray: active | Nginx: active +``` +### Прослушиваемые сокеты (Ports 80, 443, 4443, 8443, 51820): +```text +udp UNCONN 0 0 0.0.0.0:51820 0.0.0.0:* +udp UNCONN 0 0 [::]:51820 [::]:* +tcp LISTEN 0 4096 127.0.0.1:4443 0.0.0.0:* users:(("haproxy",pid=862,fd=10)) +tcp LISTEN 0 511 127.0.0.1:8443 0.0.0.0:* users:(("nginx",pid=739,fd=5),("nginx",pid=735,fd=5)) +tcp LISTEN 0 4096 0.0.0.0:80 0.0.0.0:* users:(("haproxy",pid=862,fd=9)) +tcp LISTEN 0 4096 *:443 *:* users:(("xray",pid=690,fd=3)) +``` +### Тест аварийной заглушки Nginx (127.0.0.1:8443): +```text +Atlas Sovereign Home Server is currently offline for maintenance. +``` +### Конфигурация SSH-демона (sshd runtime): +```text +permitrootlogin no +passwordauthentication yes +``` +--- + + + +# Sovereign C2 Runtime: 03_vyos +**Срез:** 2026-10-25 15:20:15 UTC | **Git:** master@10fbe14 ("git") +## 3. Маршрутизатор VyOS (192.168.1.2) +### Сетевые интерфейсы и L2-транк (VLANs 10, 20, 30): +```text +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address MAC VRF MTU S/L Description +----------- -------------- ----------------- ------- ----- ----- ------------------- +eth0 192.168.1.2/24 bc:24:11:dc:6d:ec default 1500 u/u WAN_TRUNK +eth1 10.0.20.1/24 bc:24:11:3f:cb:c9 default 1500 u/u K8S +eth2 10.0.10.1/24 bc:24:11:59:e8:8d default 1500 u/u TIER0 +eth3 10.0.30.1/24 bc:24:11:ea:32:2f default 1500 u/u LAN_CLIENTS +lo 127.0.0.1/8 00:00:00:00:00:00 default 65536 u/u + ::1/128 +tun0 172.19.0.1/30 n/a default 65535 u/u +wg0 10.8.0.2/24 n/a default 1420 u/u TUNNEL_TO_VPS_FIN21 +``` +### ARP-таблица K8s-интерфейса eth1 (проверка связности с нодами): +```text +10.0.20.11 lladdr bc:24:11:12:c5:1b REACHABLE +10.0.20.12 lladdr bc:24:11:ef:1a:d4 STALE +10.0.20.10 lladdr bc:24:11:71:b6:82 REACHABLE +fe80::be24:11ff:fe12:c51b lladdr bc:24:11:12:c5:1b STALE +fe80::be24:11ff:feef:1ad4 lladdr bc:24:11:ef:1a:d4 STALE +fe80::be24:11ff:fe71:b682 lladdr bc:24:11:71:b6:82 STALE +``` +### DHCP-сервер и выданные лизы (Options 3, 6): +```text +IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname Origin +------------ ----------------- ------- ------------------- ------------------- ----------- ----------- -------------- -------- +10.0.20.10 bc:24:11:71:b6:82 active 2026-10-25 11:51:32 2026-10-26 11:51:32 20:31:16 K8S talos-master-1 local +10.0.20.11 bc:24:11:12:c5:1b active 2026-10-25 12:29:01 2026-10-26 12:29:01 21:08:45 K8S talos-worker-1 local +10.0.20.12 bc:24:11:ef:1a:d4 active 2026-10-25 12:29:04 2026-10-26 12:29:04 21:08:48 K8S talos-worker-2 local +10.0.30.100 bc:24:11:eb:38:63 active 2026-10-25 12:29:02 2026-10-26 12:29:02 21:08:46 LAN_CLIENTS talos-worker-1 local +10.0.30.101 bc:24:11:bb:00:d3 active 2026-10-25 12:29:05 2026-10-26 12:29:05 21:08:49 LAN_CLIENTS talos-worker-2 local +``` +### Перехват DNS через DNAT (Rule 53 -> 127.0.0.42:53): +```text +Rule Source Destination Proto In-Int Translation +------ --------- ------------- -------- -------- ------------- +53 0.0.0.0/0 0.0.0.0/0 TCP, UDP LAN 127.0.0.42 + sport any dport 53 port 53 +``` +### Контейнеры маршрутизатора (Sing-Box & Zapret2): +```text +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +9217a0a6ac83 ghcr.io/sagernet/sing-box:latest run -c /etc/sing-... 3 hours ago Up 3 hours sing-box +c7e27e9bb9fc docker.io/vernette/ss-zapret2:latest /etc/zapret/run.s... 3 hours ago Up 3 hours 1080/tcp, 8388/tcp zapret2 +``` +### Наличие /dev/net/tun внутри контейнера sing-box: +```text +crw-rw-rw- 1 root root 10, 200 Oct 25 11:51 /dev/net/tun +``` +### Задержка VLESS-канала через Clash API (Main-1-out -> fin21): +```text +{"type": "VLESS", "name": "Main-1-out", "udp": true, "history": [{"time":"2026-10-25T15:19:30.52662628Z","delay":122}]}``` +### Статус таймера автосинхронизации Git (singbox-sync): +```text +● singbox-sync.timer - Periodic Sing-Box Config Git Sync Timer + Loaded: loaded (/etc/systemd/system/singbox-sync.timer; enabled; preset: enabled) + Active: active (waiting) since Sun 2026-10-25 11:51:13 UTC; 3h 29min ago + Trigger: Sun 2026-10-25 15:20:23 UTC; 6s left + Triggers: ● singbox-sync.service + +Oct 25 11:51:13 vyos-router systemd[1]: Started Periodic Sing-Box Config Git Sync Timer. + +Oct 25 15:19:23 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully. +Oct 25 15:19:23 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync. +Oct 25 15:19:53 vyos-router systemd[1]: Starting Automated Sing-Box Config Git Sync... +Oct 25 15:19:54 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully. +Oct 25 15:19:54 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync. +``` +### Статус WireGuard туннеля wg0 и пинг до VPS: +```text +interface: wg0 + public key: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4= + private key: (hidden) + listening port: 34756 + +peer: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY= + endpoint: 153.76.194.24:51820 + allowed ips: 10.8.0.0/24 + latest handshake: 3 hours, 28 minutes, 47 seconds ago + transfer: 1.12 KiB received, 282.34 KiB sent + persistent keepalive: every 25 seconds + +VyOS или туннель недоступен +``` +### Таблица маршрутизации (show ip route): +```text +Codes: K - kernel route, C - connected, L - local, S - static, + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, t - Table-Direct, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +IPv4 unicast VRF default: +S>* 0.0.0.0/0 [1/0] via 192.168.1.1, eth0, weight 1, 03:28:52 +C>* 10.0.10.0/24 is directly connected, eth2, weight 1, 03:28:58 +L>* 10.0.10.1/32 is directly connected, eth2, weight 1, 03:28:58 +C>* 10.0.20.0/24 is directly connected, eth1, weight 1, 03:28:58 +L>* 10.0.20.1/32 is directly connected, eth1, weight 1, 03:28:58 +C>* 10.0.30.0/24 is directly connected, eth3, weight 1, 03:28:58 +L>* 10.0.30.1/32 is directly connected, eth3, weight 1, 03:28:58 +C>* 10.8.0.0/24 is directly connected, wg0, weight 1, 03:28:57 +L>* 10.8.0.2/32 is directly connected, wg0, weight 1, 03:28:57 +C>* 172.19.0.0/30 is directly connected, tun0, weight 1, 03:28:55 +L>* 172.19.0.1/32 is directly connected, tun0, weight 1, 03:28:55 +C>* 192.168.1.0/24 is directly connected, eth0, weight 1, 03:28:58 +L>* 192.168.1.2/32 is directly connected, eth0, weight 1, 03:28:58 +``` +--- + + + +# Sovereign C2 Runtime: 04_tier0 +**Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git") +## 4. Сервисы Tier-0 (Air-Gap фундамент) +### Technitium DNS (10.0.10.11:53): +* **Внутренний домен (*.svo88.space -> 10.0.30.200):** 10.0.30.200 +* **Внешний резолв (google.com):** 173.194.220.100 +### OpenBao Vault (10.0.10.12:8200): +```json +{"type":"shamir","initialized":true,"sealed":false,"t":1,"n":1,"progress":0,"nonce":"","version":"2.0.1","build_date":"2024-09-03T19:57:34Z","migration":false,"cluster_name":"vault-cluster-74026fc7","cluster_id":"79b6d270-a6b1-b082-39be-aeb24d8841f5","recovery_seal":false,"storage_type":"file"} +``` +### Zot OCI Registry (10.0.10.15:5000): +```json +{"repositories":["alpine","docker.io/getmeili/meilisearch","docker.io/grafana/loki","docker.io/jellyfin/jellyfin","docker.io/library/alpine","docker.io/library/busybox","docker.io/library/nginx","docker.io/library/postgres","docker.io/library/redis","docker.io/library/traefik","docker.io/netboxcommunity/netbox","docker.io/opencloudeu/opencloud-rolling","docker.io/owncloud/ocis","docker.io/searxng/searxng","docker.io/vaultwarden/server","docker.io/victoriametrics/victoria-metrics","docker.io/xream/sub-store","ghcr.io/anatol/pacoloco","ghcr.io/donkie/spoolman","ghcr.io/external-secrets/external-secrets","ghcr.io/fluxcd/helm-controller","ghcr.io/fluxcd/image-automation-controller","ghcr.io/fluxcd/image-reflector-controller","ghcr.io/fluxcd/kustomize-controller","ghcr.io/fluxcd/notification-controller","ghcr.io/fluxcd/source-controller","ghcr.io/fluxcd/source-watcher","ghcr.io/goauthentik/server","ghcr.io/immich-app/postgres","ghcr.io/karakeep-app/karakeep","ghcr.io/karakeep-app/karakeep-chrome","ghcr.io/kiwix/kiwix-serve","ghcr.io/sergelogvinov/proxmox-csi-controller","ghcr.io/sergelogvinov/proxmox-csi-node","ghcr.io/siderolabs/kubelet","ghcr.io/sysadminsmedia/homebox","ghcr.io/triliumnext/notes","ghcr.io/triliumnext/trilium","ghcr.io/we-promise/sure","ghcr.io/xiao-villamor/printstash","k8s.io/coredns/coredns","k8s.io/kube-apiserver","k8s.io/kube-controller-manager","k8s.io/kube-proxy","k8s.io/kube-scheduler","k8s.io/sig-storage/csi-attacher","k8s.io/sig-storage/csi-provisioner","k8s.io/sig-storage/csi-resizer","k8s.io/sig-storage/livenessprobe","quay.io/invidious/invidious","quay.io/invidious/invidious-companion","quay.io/jetstack/cert-manager-cainjector"]}``` +### Forgejo GitOps Server (10.0.10.13:3000): +```json +{"version":"7.0.4+gitea-1.21.11"} +``` +### Ядерный NFS nfsd (storage0 - 10.0.10.14): +```text +== Активные экспорты ядра (exportfs): +/media 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) +/torrents 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) +/backups 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) +/models 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) +/packages 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) +/media 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) +/torrents 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) +/backups 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) +/models 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) +/packages 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) + +== Емкость смонтированных ZFS-датасетов: +Filesystem Size Used Available Use% Mounted on +terra/media 1.4T 1.0M 1.4T 0% /media +terra 1.4T 12.6G 1.4T 1% /torrents +terra/vault 1.7T 332.6G 1.4T 19% /backups +terra 1.4T 12.6G 1.4T 1% /torrents + +== Права точки монтирования OpenCloud: +drwxrws--- 5 1000 1000 5 Oct 25 12:31 /backups/opencloud-users +``` +--- + + + +# Sovereign C2 Runtime: 05_k8s +**Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git") +## 5. Kubernetes Платформа & Нагрузки +### Участники кластера Talos (OS-level): +```text +10.0.20.10: error getting server version: error constructing client: failed to create client connection: failed to resolve configuration context: talos config file is empty +Talos API недоступен +``` +### Ноды кластера K8s: +```text +NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME +talos-1il-vwa Ready control-plane 3h26m v1.37.0 10.0.20.10 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4 +talos-worker-1 Ready 171m v1.37.0 10.0.20.11 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4 +talos-worker-2 Ready 170m v1.37.0 10.0.20.12 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4 +``` +### Топологические лейблы нод (Proxmox-CSI topology): +```text +NAME STATUS ROLES AGE VERSION ZONE REGION +talos-1il-vwa Ready control-plane 3h26m v1.37.0 +talos-worker-1 Ready 171m v1.37.0 pve0 atlas +talos-worker-2 Ready 170m v1.37.0 pve0 atlas +``` +### Статус ExternalSecrets (Синхронизация из Vault): +```text +NAME AGE STATUS CAPABILITIES READY +clustersecretstore.external-secrets.io/openbao-backend 33d Valid ReadWrite True + +NAMESPACE NAME STORETYPE STORE REFRESH INTERVAL STATUS READY LAST SYNC +authentik externalsecret.external-secrets.io/authentik-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 49m +databases externalsecret.external-secrets.io/all-db-passwords ClusterSecretStore openbao-backend 1h SecretSynced True 20m +databases externalsecret.external-secrets.io/postgres-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m +documents externalsecret.external-secrets.io/paperless-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m +flux-system externalsecret.external-secrets.io/atlas-repo-auth ClusterSecretStore openbao-backend 1h SecretSyncedError False 3d1h +infra externalsecret.external-secrets.io/netbox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m +kube-system externalsecret.external-secrets.io/proxmox-csi-config ClusterSecretStore openbao-backend 1h SecretSynced True 20m +media externalsecret.external-secrets.io/immich-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m +media externalsecret.external-secrets.io/invidious-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m +monitoring externalsecret.external-secrets.io/grafana-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m +security externalsecret.external-secrets.io/vaultwarden-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m +tools externalsecret.external-secrets.io/homebox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m +tools externalsecret.external-secrets.io/karakeep-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m +tools externalsecret.external-secrets.io/printstash-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m +tools externalsecret.external-secrets.io/searxng-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m +tools externalsecret.external-secrets.io/sure-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m +``` +### Сетевой ingress, сертификаты TLS и L2 Fast-Path VIP: +```text +NAMESPACE NAME READY SECRET AGE +authentik certificate.cert-manager.io/auth-svo88-tls True auth-svo88-tls 27d +devices certificate.cert-manager.io/print-svo88-tls True print-svo88-tls 7d5h +documents certificate.cert-manager.io/paperless-svo88-tls True paperless-svo88-tls 26d +documents certificate.cert-manager.io/trilium-svo88-tls True trilium-svo88-tls 21d +infra certificate.cert-manager.io/dns-svo88-tls True dns-svo88-tls 26d +infra certificate.cert-manager.io/git-svo88-tls True git-svo88-tls 27d +infra certificate.cert-manager.io/netbox-svo88-tls True netbox-svo88-tls 26d +infra certificate.cert-manager.io/pkg-svo88-tls True pkg-svo88-tls 6d20h +infra certificate.cert-manager.io/pve-svo88-tls True pve-svo88-tls 26d +infra certificate.cert-manager.io/vault-svo88-tls True vault-svo88-tls 26d +infra certificate.cert-manager.io/zot-svo88-tls True zot-svo88-tls 27d +media certificate.cert-manager.io/immich-svo88-tls True immich-svo88-tls 25d +media certificate.cert-manager.io/jellyfin-svo88-tls True jellyfin-svo88-tls 21d +media certificate.cert-manager.io/metube-svo88-tls True metube-svo88-tls 21d +media certificate.cert-manager.io/yt-svo88-tls True yt-svo88-tls 21d +security certificate.cert-manager.io/vw-svo88-tls True vw-svo88-tls 31d +storage certificate.cert-manager.io/opencloud-svo88-tls True opencloud-svo88-tls 26d +tools certificate.cert-manager.io/dash-svo88-tls True dash-svo88-tls 21d +tools certificate.cert-manager.io/finance-svo88-tls True finance-svo88-tls 26d +tools certificate.cert-manager.io/homebox-svo88-tls True homebox-svo88-tls 27d +tools certificate.cert-manager.io/keep-svo88-tls True keep-svo88-tls 21d +tools certificate.cert-manager.io/printstash-svo88-tls True printstash-svo88-tls 27d +tools certificate.cert-manager.io/search-svo88-tls True search-svo88-tls 26d +tools certificate.cert-manager.io/spoolman-svo88-tls True spoolman-svo88-tls 7d5h +tools certificate.cert-manager.io/sub-store-svo88-tls True sub-store-svo88-tls 3d9h + +NAMESPACE NAME CLASS HOSTS ADDRESS PORTS AGE +authentik ingress.networking.k8s.io/authentik traefik auth.svo88.space 10.0.30.200 80, 443 27d +devices ingress.networking.k8s.io/qidi-printer traefik print.svo88.space 10.0.30.200 80, 443 7d5h +documents ingress.networking.k8s.io/paperless traefik paperless.svo88.space 10.0.30.200 80, 443 26d +documents ingress.networking.k8s.io/trilium traefik trilium.svo88.space 10.0.30.200 80, 443 21d +infra ingress.networking.k8s.io/forgejo-git traefik git.svo88.space 10.0.30.200 80, 443 27d +infra ingress.networking.k8s.io/netbox traefik netbox.svo88.space 10.0.30.200 80, 443 26d +infra ingress.networking.k8s.io/openbao-vault traefik vault.svo88.space 10.0.30.200 80, 443 26d +infra ingress.networking.k8s.io/pkg-custom traefik pkg.svo88.space 10.0.30.200 80 6d20h +infra ingress.networking.k8s.io/pkg-server traefik pkg.svo88.space 10.0.30.200 80, 443 6d20h +infra ingress.networking.k8s.io/proxmox-ve traefik pve.svo88.space 10.0.30.200 80, 443 26d +infra ingress.networking.k8s.io/technitium-dns traefik dns.svo88.space 10.0.30.200 80, 443 26d +infra ingress.networking.k8s.io/zot-registry traefik zot.svo88.space 10.0.30.200 80, 443 27d +media ingress.networking.k8s.io/immich traefik immich.svo88.space 10.0.30.200 80, 443 25d +media ingress.networking.k8s.io/invidious traefik yt.svo88.space 10.0.30.200 80, 443 21d +media ingress.networking.k8s.io/jellyfin traefik jellyfin.svo88.space 10.0.30.200 80, 443 21d +media ingress.networking.k8s.io/metube traefik metube.svo88.space 10.0.30.200 80, 443 21d +security ingress.networking.k8s.io/vaultwarden traefik vw.svo88.space 10.0.30.200 80, 443 31d +storage ingress.networking.k8s.io/opencloud traefik opencloud.svo88.space 10.0.30.200 80, 443 26d +tools ingress.networking.k8s.io/dashboard traefik dash.svo88.space 10.0.30.200 80, 443 21d +tools ingress.networking.k8s.io/homebox traefik homebox.svo88.space 10.0.30.200 80, 443 27d +tools ingress.networking.k8s.io/karakeep traefik keep.svo88.space 10.0.30.200 80, 443 21d +tools ingress.networking.k8s.io/printstash traefik printstash.svo88.space 10.0.30.200 80, 443 27d +tools ingress.networking.k8s.io/searxng traefik search.svo88.space 10.0.30.200 80, 443 26d +tools ingress.networking.k8s.io/spoolman traefik spoolman.svo88.space 10.0.30.200 80, 443 7d5h +tools ingress.networking.k8s.io/sub-store traefik sub-store.svo88.space 10.0.30.200 80, 443 3d9h +tools ingress.networking.k8s.io/sure-finance traefik finance.svo88.space 10.0.30.200 80, 443 26d + +NAME AGE +ciliuml2announcementpolicy.cilium.io/lan-fastpath-announcement 35d + +NAME DISABLED CONFLICTING IPS AVAILABLE AGE +ciliumloadbalancerippool.cilium.io/lan-ingress-pool false False 0 35d + +Traefik VIP (10.0.30.200:443) HTTP Status: 404 +``` +### Диски и тома (PVC / PV): +```text +NAMESPACE NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE +databases persistentvolumeclaim/postgres-data-postgres-core-0 Bound pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO proxmox-csi-db 32d +documents persistentvolumeclaim/paperless-data-pvc Bound pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO proxmox-csi-general 32d +documents persistentvolumeclaim/trilium-data-pvc Bound pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO proxmox-csi-general 21d +infra persistentvolumeclaim/netbox-media-pvc Bound pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO proxmox-csi-general 32d +infra persistentvolumeclaim/nfs-packages-pvc Bound nfs-packages-pv 200Gi RWX 6d20h +media persistentvolumeclaim/immich-db-pvc Bound pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO proxmox-csi-db 25d +media persistentvolumeclaim/immich-library-pvc Bound pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO proxmox-csi-general 25d +media persistentvolumeclaim/jellyfin-config-pvc Bound pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO proxmox-csi-general 21d +media persistentvolumeclaim/nfs-kiwix-pvc Bound nfs-kiwix-pv 200Gi ROX 32d +media persistentvolumeclaim/nfs-media-pvc Bound nfs-media-pv 1Ti RWX 21d +media persistentvolumeclaim/nfs-torrents-pvc Bound nfs-torrents-pv 500Gi RWX 32d +monitoring persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general 16d +monitoring persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general 16d +monitoring persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general 16d +security persistentvolumeclaim/vaultwarden-data-pvc Bound pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO proxmox-csi-general 32d +storage persistentvolumeclaim/nfs-opencloud-users-pvc Bound nfs-opencloud-users-pv 600Gi RWX 21d +storage persistentvolumeclaim/opencloud-data-pvc Bound pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO proxmox-csi-general 16d +tools persistentvolumeclaim/homebox-data-pvc Bound pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO proxmox-csi-general 32d +tools persistentvolumeclaim/karakeep-data-pvc Bound pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO proxmox-csi-general 21d +tools persistentvolumeclaim/karakeep-meili-pvc Bound pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO proxmox-csi-general 21d +tools persistentvolumeclaim/printstash-models-pvc Bound printstash-models-pv 100Gi RWX 32d +tools persistentvolumeclaim/spoolman-data-pvc Bound pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO proxmox-csi-general 7d5h +tools persistentvolumeclaim/sub-store-data-pvc Bound pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO proxmox-csi-general 3d9h + +NAMESPACE NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS VOLUMEATTRIBUTESCLASS REASON AGE + persistentvolume/nfs-kiwix-pv 200Gi ROX Retain Bound media/nfs-kiwix-pvc 32d + persistentvolume/nfs-media-pv 1Ti RWX Retain Bound media/nfs-media-pvc 21d + persistentvolume/nfs-opencloud-users-pv 600Gi RWX Retain Bound storage/nfs-opencloud-users-pvc 21d + persistentvolume/nfs-packages-pv 200Gi RWX Retain Bound infra/nfs-packages-pvc 6d20h + persistentvolume/nfs-torrents-pv 500Gi RWX Retain Bound media/nfs-torrents-pvc 32d + persistentvolume/printstash-models-pv 100Gi RWX Retain Bound tools/printstash-models-pvc 32d + persistentvolume/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO Delete Bound documents/trilium-data-pvc proxmox-csi-general 21d + persistentvolume/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO Delete Bound storage/opencloud-data-pvc proxmox-csi-general 16d + persistentvolume/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO Delete Bound databases/postgres-data-postgres-core-0 proxmox-csi-db 32d + persistentvolume/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO Delete Bound tools/karakeep-meili-pvc proxmox-csi-general 21d + persistentvolume/pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO Delete Bound media/jellyfin-config-pvc proxmox-csi-general 21d + persistentvolume/pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO Delete Bound infra/netbox-media-pvc proxmox-csi-general 32d + persistentvolume/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO Delete Bound tools/karakeep-data-pvc proxmox-csi-general 21d + persistentvolume/pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO Delete Bound tools/sub-store-data-pvc proxmox-csi-general 3d9h + persistentvolume/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO Delete Bound security/vaultwarden-data-pvc proxmox-csi-general 32d + persistentvolume/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO Delete Bound media/immich-library-pvc proxmox-csi-general 25d + persistentvolume/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO Delete Bound tools/homebox-data-pvc proxmox-csi-general 32d + persistentvolume/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO Delete Bound monitoring/grafana-data-pvc proxmox-csi-general 16d + persistentvolume/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO Delete Bound monitoring/victoria-metrics-pvc proxmox-csi-general 16d + persistentvolume/pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO Delete Bound tools/spoolman-data-pvc proxmox-csi-general 7d5h + persistentvolume/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO Delete Bound media/immich-db-pvc proxmox-csi-db 25d + persistentvolume/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO Delete Bound monitoring/loki-data-pvc proxmox-csi-general 16d + persistentvolume/pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO Delete Bound documents/paperless-data-pvc proxmox-csi-general 32d +``` +### Статус DaemonSet Proxmox-CSI Node: +```text +NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE +proxmox-csi-plugin-node 2 2 2 2 2 33d +``` +### Статус пространства мониторинга (VictoriaMetrics & Grafana): +```text +NAME READY AGE +statefulset.apps/grafana 1/1 16d +statefulset.apps/loki 1/1 16d +statefulset.apps/victoriametrics 1/1 16d + +NAME READY STATUS RESTARTS AGE +pod/grafana-0 1/1 Running 0 169m +pod/loki-0 1/1 Running 0 169m +pod/victoriametrics-0 1/1 Running 0 169m + +NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE +persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general 16d +persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general 16d +persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general 16d +``` +### Логи ошибок Proxmox CSI Plugin (последние строки): +```text +Defaulted container "proxmox-csi-plugin-controller" out of: proxmox-csi-plugin-controller, csi-attacher, csi-provisioner, csi-resizer, liveness-probe +Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe +Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.012208 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4" nodeID="talos-worker-2" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.131792 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb" nodeID="talos-worker-2" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.206486 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7" nodeID="talos-worker-2" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.277975 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.352701 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.430266 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780" nodeID="talos-worker-2" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.509551 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2" nodeID="talos-worker-2" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669146 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790776828491-7787-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\"}" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669198 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.681187 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID="" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873038 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790090280571-543-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\"}" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873096 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.882474 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID="" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.084431 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2" +[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.357862 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:29.408317 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3\",\"volume_path\":\"/var/lib/kubelet/pods/b6ccf3ff-f0fc-411e-b5aa-5bbd61174578/volumes/kubernetes.io~csi/pvc-6eb8c148-32b0-45af-8945-2799d04875a3/mount\"}" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.576536 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.577998 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945\",\"volume_path\":\"/var/lib/kubelet/pods/f3402b78-9a95-4a5c-89c9-7535456d39e0/volumes/kubernetes.io~csi/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945/mount\"}" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.887356 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.888572 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\",\"volume_path\":\"/var/lib/kubelet/pods/ce3b896c-9957-4a70-b713-265ab487c32b/volumes/kubernetes.io~csi/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f/mount\"}" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.095236 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.096521 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780\",\"volume_path\":\"/var/lib/kubelet/pods/919bd05a-93f8-44e3-850e-7a8dd2a570d6/volumes/kubernetes.io~csi/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780/mount\"}" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.657181 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.658240 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b/mount\"}" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.659625 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.660965 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb/mount\"}" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.981192 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.982711 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242\",\"volume_path\":\"/var/lib/kubelet/pods/fa9abffb-f2c3-470f-9ee7-7bd93688270c/volumes/kubernetes.io~csi/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242/mount\"}" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.278791 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.280160 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd\",\"volume_path\":\"/var/lib/kubelet/pods/9ce6cd32-c936-4d17-8597-3efdb4845bc8/volumes/kubernetes.io~csi/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd/mount\"}" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:03.366763 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.621786 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.622940 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.802709 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.804175 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.307289 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.308598 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf\",\"volume_path\":\"/var/lib/kubelet/pods/288247da-f98a-4d43-9f15-e882d4c7acb5/volumes/kubernetes.io~csi/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf/mount\"}" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.015178 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.016475 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a\",\"volume_path\":\"/var/lib/kubelet/pods/096b52fa-6650-4996-8813-dd472343cf8e/volumes/kubernetes.io~csi/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a/mount\"}" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.754757 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.755939 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.979195 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.980398 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.775598 1 node.go:524] "NodeGetCapabilities: called" +[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.776955 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}" +``` +### Синхронизация GitOps (FluxCD): +```text +NAMESPACE NAME URL AGE READY STATUS +flux-system gitrepository.source.toolkit.fluxcd.io/atlas-repo http://10.0.10.13:3000/atlas/atlas.git 33d True stored artifact for revision 'master@sha1:10fbe14ef463bef034856278733f9ad3155cd866' + +NAMESPACE NAME AGE READY STATUS +flux-system kustomization.kustomize.toolkit.fluxcd.io/apps-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866 +flux-system kustomization.kustomize.toolkit.fluxcd.io/infra-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866 + +NAMESPACE NAME AGE READY STATUS +cert-manager helmrelease.helm.toolkit.fluxcd.io/cert-manager 33d True Helm upgrade succeeded for release cert-manager/cert-manager.v2 with chart cert-manager@v1.21.3 +external-secrets helmrelease.helm.toolkit.fluxcd.io/external-secrets 33d True Helm upgrade succeeded for release external-secrets/external-secrets.v5 with chart external-secrets@2.14.0 +kube-system helmrelease.helm.toolkit.fluxcd.io/cilium 33d True Helm upgrade succeeded for release kube-system/cilium.v6 with chart cilium@1.15.5 +kube-system helmrelease.helm.toolkit.fluxcd.io/proxmox-csi-plugin 33d True Helm upgrade succeeded for release kube-system/proxmox-csi-plugin.v4 with chart proxmox-csi-plugin@0.5.12 +``` +### Проблемные поды (Non-Running): +```text +NAMESPACE NAME READY STATUS RESTARTS AGE +databases postgres-init-databases-4lk9r 0/1 Completed 0 169m +``` +### Последние события-предупреждения (Warning Events): +```text +NAMESPACE LAST SEEN TYPE REASON OBJECT MESSAGE +traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use +traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use +traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use +traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use +monitoring 51m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-7tjsw" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods") +monitoring 34m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-t6n9v" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods") +monitoring 17m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-rsbtk" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods") +flux-system 16m Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider +flux-system 3m34s Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider +monitoring 73s Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-xsj4k" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods") +``` +### Реальный объем данных OpenCloud (/var/lib/opencloud-users): +```text +331.7G /var/lib/opencloud-users +``` + +