git
This commit is contained in:
v
parent
4a4972553c
commit
fc886fb03e
3
.gitignore
vendored
Normal file
3
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,3 @@
|
||||||
|
/state/snapshots
|
||||||
|
zarya-code.xml
|
||||||
|
zarya-state.xml
|
||||||
0
state/collect_state.sh
Normal file → Executable file
0
state/collect_state.sh
Normal file → Executable file
567
zarya-code.xml
567
zarya-code.xml
|
|
@ -45,13 +45,20 @@ The content is organized as follows:
|
||||||
|
|
||||||
<directory_structure>
|
<directory_structure>
|
||||||
bin/
|
bin/
|
||||||
|
fc
|
||||||
|
gg
|
||||||
|
op
|
||||||
zarya
|
zarya
|
||||||
cmd/
|
cmd/
|
||||||
a.sh
|
a.sh
|
||||||
disks.sh
|
disks.sh
|
||||||
errors.sh
|
errors.sh
|
||||||
|
exec.sh
|
||||||
|
flux.sh
|
||||||
|
git-credential.sh
|
||||||
logs.sh
|
logs.sh
|
||||||
net.sh
|
net.sh
|
||||||
|
nodes.sh
|
||||||
pack.sh
|
pack.sh
|
||||||
pods.sh
|
pods.sh
|
||||||
run.sh
|
run.sh
|
||||||
|
|
@ -81,64 +88,48 @@ state/
|
||||||
03_vyos.sh
|
03_vyos.sh
|
||||||
04_tier0.sh
|
04_tier0.sh
|
||||||
05_k8s.sh
|
05_k8s.sh
|
||||||
|
collect_state.sh
|
||||||
config.env
|
config.env
|
||||||
</directory_structure>
|
</directory_structure>
|
||||||
|
|
||||||
<files>
|
<files>
|
||||||
This section contains the contents of the repository's files.
|
This section contains the contents of the repository's files.
|
||||||
|
|
||||||
<file path="bin/zarya">
|
<file path="bin/fc">
|
||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
if [[ $# -eq 0 ]]; then
|
||||||
source "${ZARYA_DIR}/lib/common.sh"
|
echo "Использование: fc <файл>"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
if [[ -f "$1" ]]; then
|
||||||
|
wl-copy < "$1"
|
||||||
|
echo "'$1' +++"
|
||||||
|
else
|
||||||
|
echo "'$1'+++"
|
||||||
|
fi
|
||||||
|
</file>
|
||||||
|
|
||||||
SUBCMD="${1:-help}"
|
<file path="bin/gg">
|
||||||
shift || true
|
#!/bin/bash
|
||||||
|
set -euo pipefail
|
||||||
|
if [[ -z "${1:-}" ]]; then
|
||||||
|
echo "Тема СВО не раскрыта: gg \"сообщение\""
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
git add . && git commit -m "$1" && git push
|
||||||
|
</file>
|
||||||
|
|
||||||
case "${SUBCMD}" in
|
<file path="bin/op">
|
||||||
p|pod|pods) exec "${ZARYA_DIR}/cmd/pods.sh" "$@" ;;
|
#!/bin/bash
|
||||||
e|err|errors) exec "${ZARYA_DIR}/cmd/errors.sh" "$@" ;;
|
set -euo pipefail
|
||||||
l|log|logs) exec "${ZARYA_DIR}/cmd/logs.sh" "$@" ;;
|
if [[ $# -eq 0 ]]; then
|
||||||
n|net) exec "${ZARYA_DIR}/cmd/net.sh" "$@" ;;
|
echo "Использование: op <файл...>"
|
||||||
d|df|disks) exec "${ZARYA_DIR}/cmd/disks.sh" "$@" ;;
|
exit 1
|
||||||
unseal) exec "${ZARYA_DIR}/cmd/unseal.sh" "$@" ;;
|
fi
|
||||||
login|start) exec "${ZARYA_DIR}/cmd/session.sh" "start" "$@" ;;
|
for f in "$@"; do
|
||||||
logout|clean) exec "${ZARYA_DIR}/cmd/session.sh" "clean" "$@" ;;
|
printf "file://%s\r\n" "$(realpath "$f")"
|
||||||
up) exec "${ZARYA_DIR}/cmd/up.sh" "$@" ;;
|
done | wl-copy -t text/uri-list
|
||||||
run) exec "${ZARYA_DIR}/cmd/run.sh" "$@" ;;
|
|
||||||
a|apply) exec "${ZARYA_DIR}/cmd/a.sh" "$@" ;;
|
|
||||||
snap) exec "${ZARYA_DIR}/cmd/snap.sh" "$@" ;;
|
|
||||||
pack) exec "${ZARYA_DIR}/cmd/pack.sh" "$@" ;;
|
|
||||||
reset|nuke) exec "${ZARYA_DIR}/layers/reset.sh" "$@" ;;
|
|
||||||
gc) exec "${ZARYA_DIR}/layers/gc.sh" "$@" ;;
|
|
||||||
help|--help|-h)
|
|
||||||
cat <<EOF
|
|
||||||
Zarya C2 Operator Interface (z)
|
|
||||||
Команды диагностики:
|
|
||||||
z pods [-w] [-n <ns>] [-s <query>] [-A] Просмотр подов
|
|
||||||
z errors Мгновенный триаж сломанных сервисов
|
|
||||||
z logs <service> [-f] [-t <N>] Логи любого сервиса без ввода неймспейса
|
|
||||||
z net Сетевой радар доступности узлов (1 сек)
|
|
||||||
z disks Срез пулов astra/terra и ZVOL томов K8s
|
|
||||||
Управление и сессия:
|
|
||||||
z login [TTL] Открытие смены (YubiKey + RAM)
|
|
||||||
z logout Мгновенная очистка RAM
|
|
||||||
z unseal Распечатывание OpenBao Vault
|
|
||||||
Деплой и IaC:
|
|
||||||
z up [layer] Макро-слои (host, net, tier0, talos, apps, all)
|
|
||||||
z run <selector> Плейбуки Ansible (01, 02)
|
|
||||||
z a [-auto-approve] OpenTofu apply в RAM-изоляции
|
|
||||||
Телеметрия и LLM:
|
|
||||||
z snap Снятие полного .md аудита в snapshots/
|
|
||||||
z pack [code|state|atlas] Сборка контекста Repomix
|
|
||||||
EOF
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
log_err "Неизвестная команда: ${SUBCMD}. Введите 'z help'."
|
|
||||||
exit 1
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
</file>
|
</file>
|
||||||
|
|
||||||
<file path="cmd/a.sh">
|
<file path="cmd/a.sh">
|
||||||
|
|
@ -201,6 +192,47 @@ if [[ "$has_errors" == false ]]; then
|
||||||
fi
|
fi
|
||||||
</file>
|
</file>
|
||||||
|
|
||||||
|
<file path="cmd/exec.sh">
|
||||||
|
#!/bin/bash
|
||||||
|
set -euo pipefail
|
||||||
|
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||||
|
source "${ZARYA_DIR}/lib/common.sh"
|
||||||
|
if [[ $# -eq 0 ]]; then
|
||||||
|
log_err "Использование: z exec <команда> [аргументы...]"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
run_isolated "$@"
|
||||||
|
</file>
|
||||||
|
|
||||||
|
<file path="cmd/flux.sh">
|
||||||
|
#!/bin/bash
|
||||||
|
set -uo pipefail
|
||||||
|
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||||
|
source "${ZARYA_DIR}/lib/common.sh"
|
||||||
|
subcmd="${1:-status}"
|
||||||
|
shift || true
|
||||||
|
case "${subcmd}" in
|
||||||
|
sync|reconcile|s)
|
||||||
|
log_info "Принудительная конвергенция FluxCD..."
|
||||||
|
flux reconcile source git atlas-repo -n flux-system 2>/dev/null || true
|
||||||
|
flux reconcile kustomization infra-sync -n flux-system 2>/dev/null || true
|
||||||
|
flux reconcile kustomization apps-sync -n flux-system 2>/dev/null || true
|
||||||
|
log_ok "Синхронизация завершена."
|
||||||
|
;;
|
||||||
|
logs|log|l)
|
||||||
|
log_info "Стриминг логов kustomize-controller..."
|
||||||
|
exec kubectl -n flux-system logs -l app.kubernetes.io/name=kustomize-controller --tail=50 -f
|
||||||
|
;;
|
||||||
|
status|st)
|
||||||
|
echo -e "${BLUE}=== СТАТУС РЕПОЗИТОРИЕВ И KUSTOMIZATION (FLUX) ===${NC}"
|
||||||
|
kubectl -n flux-system get gitrepositories,kustomizations,helmreleases 2>/dev/null || log_err "Flux недоступен"
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
kubectl -n flux-system get kustomizations 2>/dev/null || log_err "Flux недоступен"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
</file>
|
||||||
|
|
||||||
<file path="cmd/logs.sh">
|
<file path="cmd/logs.sh">
|
||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
set -uo pipefail
|
set -uo pipefail
|
||||||
|
|
@ -264,34 +296,49 @@ check_target "Traefik L2 VIP" "10.0.30.200" 443
|
||||||
check_target "Perimeter VPS" "153.76.194.24" 443
|
check_target "Perimeter VPS" "153.76.194.24" 443
|
||||||
</file>
|
</file>
|
||||||
|
|
||||||
<file path="cmd/pack.sh">
|
<file path="cmd/nodes.sh">
|
||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
set -euo pipefail
|
set -u
|
||||||
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
watch_mode=false
|
||||||
mode="${1:-state}"
|
while [[ $# -gt 0 ]]; do
|
||||||
case "${mode}" in
|
case "$1" in
|
||||||
state)
|
-w|--watch) watch_mode=true; shift ;;
|
||||||
echo "==> Снятие свежего аудита..."
|
*) shift ;;
|
||||||
"${ZARYA_DIR}/state/collect_state.sh" all >/dev/null 2>&1 || true
|
esac
|
||||||
echo "==> Упаковка среза состояния Repomix (zarya-state.xml)..."
|
done
|
||||||
repomix --config "${ZARYA_DIR}/repomix.state.json"
|
render_nodes() {
|
||||||
echo "✔ Файл zarya-state.xml готов для отправки в LLM."
|
local raw
|
||||||
;;
|
raw=$(kubectl get nodes -L topology.kubernetes.io/zone,topology.kubernetes.io/region 2>/dev/null || true)
|
||||||
code)
|
echo "$raw" | awk '
|
||||||
echo "==> Упаковка кодовой базы zarya (zarya-code.xml)..."
|
BEGIN {
|
||||||
repomix --config "${ZARYA_DIR}/repomix.config.json"
|
ERR = "\033[38;2;255;46;76m"
|
||||||
echo "✔ Файл zarya-code.xml готов."
|
RUN = "\033[38;2;166;227;161m"
|
||||||
;;
|
HEAD = "\033[38;2;147;154;183m"
|
||||||
atlas)
|
RST = "\033[0m"
|
||||||
echo "==> Упаковка чистой инфраструктуры atlas (atlas-code.xml)..."
|
}
|
||||||
cd "${ATLAS_DIR}" && repomix
|
NR==1 { print HEAD $0 RST; next }
|
||||||
echo "✔ Файл atlas/repomix-output.xml готов."
|
{
|
||||||
;;
|
if ($2 ~ /Ready/ && $2 !~ /NotReady/) {
|
||||||
*)
|
print RUN $0 RST
|
||||||
echo "Использование: z pack [state|code|atlas]"
|
}
|
||||||
exit 1
|
else {
|
||||||
;;
|
print ERR $0 RST
|
||||||
esac
|
}
|
||||||
|
}'
|
||||||
|
}
|
||||||
|
if [[ "$watch_mode" == true ]]; then
|
||||||
|
trap 'tput cnorm 2>/dev/null || true; echo ""; exit 0' INT TERM
|
||||||
|
tput civis 2>/dev/null || true
|
||||||
|
clear
|
||||||
|
while true; do
|
||||||
|
tput cup 0 0 2>/dev/null || true
|
||||||
|
render_nodes
|
||||||
|
tput ed 2>/dev/null || true
|
||||||
|
sleep 1
|
||||||
|
done
|
||||||
|
else
|
||||||
|
render_nodes
|
||||||
|
fi
|
||||||
</file>
|
</file>
|
||||||
|
|
||||||
<file path="cmd/pods.sh">
|
<file path="cmd/pods.sh">
|
||||||
|
|
@ -727,99 +774,6 @@ log_warn() { echo -e "${YELLOW}⚠${NC} $*"; }
|
||||||
log_err() { echo -e "${RED}✖${NC} $*"; }
|
log_err() { echo -e "${RED}✖${NC} $*"; }
|
||||||
</file>
|
</file>
|
||||||
|
|
||||||
<file path="lib/net.sh">
|
|
||||||
#!/bin/bash
|
|
||||||
# Network routing and terminal prerequisites
|
|
||||||
ensure_prerequisites() {
|
|
||||||
local target_ip="${VAULT_ADDR#*//}"
|
|
||||||
target_ip="${target_ip%%:*}"
|
|
||||||
if ! ip route get "${target_ip}" 2>/dev/null | grep -q "${VYOS_ROUTER_IP}"; then
|
|
||||||
log_info "Восстанавливаем маршрут к ${NET_PREFIX} через VyOS (${VYOS_ROUTER_IP})..."
|
|
||||||
sudo ip route replace "${NET_PREFIX}" via "${VYOS_ROUTER_IP}" 2>/dev/null || true
|
|
||||||
fi
|
|
||||||
# Регистрация Git Credential Helper (доменный и прямой IP Tier-0)
|
|
||||||
local target_helper="!${REPO_ROOT}/deploy.sh git-credential"
|
|
||||||
local current_helper
|
|
||||||
current_helper=$(git config --global --get credential."https://${GIT_HOST}".helper 2>/dev/null || true)
|
|
||||||
if [[ "${current_helper}" != "${target_helper}" ]]; then
|
|
||||||
git config --global credential."https://${GIT_HOST}".helper "${target_helper}"
|
|
||||||
fi
|
|
||||||
local direct_helper
|
|
||||||
direct_helper=$(git config --global --get credential."http://10.0.10.13:3000".helper 2>/dev/null || true)
|
|
||||||
if [[ "${direct_helper}" != "${target_helper}" ]]; then
|
|
||||||
git config --global credential."http://10.0.10.13:3000".helper "${target_helper}"
|
|
||||||
fi
|
|
||||||
# Нативная привязка IdentityFile для всех C2-хостов и LXC-контейнеров
|
|
||||||
local ssh_hosts="proxmox pve0 vyos vyos_router 10.0.* dns0 vault0 git0 storage0 registry0"
|
|
||||||
if [[ -f "${HOME}/.ssh/config" ]] && ! grep -q "IdentityFile ${RAM_KEY}" "${HOME}/.ssh/config"; then
|
|
||||||
printf "\nHost %s\n IdentityFile %s\n IdentitiesOnly yes\n" "${ssh_hosts}" "${RAM_KEY}" >> "${HOME}/.ssh/config"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
</file>
|
|
||||||
|
|
||||||
<file path="lib/session.sh">
|
|
||||||
#!/bin/bash
|
|
||||||
# Session state in RAM tmpfs and YubiKey integration
|
|
||||||
load_secrets_to_ram() {
|
|
||||||
local hours="${1:-$DEFAULT_SESSION_TTL}"
|
|
||||||
local now
|
|
||||||
now=$(date +%s)
|
|
||||||
ensure_prerequisites
|
|
||||||
# Валидация сессии по наличию непустых кэша секретов и SSH-ключа
|
|
||||||
if [[ -f "${RAM_CACHE}" ]] && [[ -f "${RAM_KEY}" ]] && [[ -s "${RAM_KEY}" ]]; then
|
|
||||||
local created age cached_ttl
|
|
||||||
created=$(stat -c %Y "${RAM_CACHE}" 2>/dev/null || echo 0)
|
|
||||||
age=$(( now - created ))
|
|
||||||
cached_ttl=$(grep '^# TTL_SECONDS=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2 || echo 3600)
|
|
||||||
if [[ "${cached_ttl}" -ne 0 ]] && (( age >= cached_ttl )); then
|
|
||||||
log_warn "Время сессии истекло ($(( age / 60 )) мин >= $(( cached_ttl / 60 )) мин). Инвалидация кэша..."
|
|
||||||
rm -f "${RAM_CACHE}" "${RAM_KEY}"
|
|
||||||
else
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
local ttl_seconds
|
|
||||||
if [[ "${hours}" -eq 0 ]]; then
|
|
||||||
ttl_seconds=0
|
|
||||||
else
|
|
||||||
ttl_seconds=$(( hours * 3600 ))
|
|
||||||
fi
|
|
||||||
log_info "🔐 Вход в защищенный контур C2..."
|
|
||||||
read -s -p "Master Password: " KP_PASS
|
|
||||||
echo ""
|
|
||||||
local yk_args=()
|
|
||||||
if ykman info >/dev/null 2>&1; then
|
|
||||||
yk_args=("-y" "2")
|
|
||||||
log_info "YubiKey обнаружен. Приготовьтесь к аппаратному подтверждению (1 касание)..."
|
|
||||||
fi
|
|
||||||
# Атомарный 1-Touch экспорт всей базы KDBX в RAM (ровно 1 касание YubiKey на всю сессию)
|
|
||||||
local tmp_dump="/dev/shm/.kdbx_dump_${now}_$$.xml"
|
|
||||||
rm -f "${tmp_dump}"
|
|
||||||
touch "${tmp_dump}"
|
|
||||||
chmod 600 "${tmp_dump}"
|
|
||||||
if ! echo "${KP_PASS}" | keepassxc-cli export "${yk_args[@]}" "${KDBX_PATH}" -f xml > "${tmp_dump}" 2>/dev/null; then
|
|
||||||
log_err "Ошибка расшифровки базы KDBX (неверный пароль или таймаут касания YubiKey)"
|
|
||||||
rm -f "${tmp_dump}"
|
|
||||||
unset KP_PASS
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
unset KP_PASS
|
|
||||||
python3 "${REPO_ROOT}/scripts/lib/kdbx_parser.py" "${tmp_dump}" "${RAM_CACHE}" "${RAM_KEY}" "${ttl_seconds}" "${PVE_ENDPOINT}" "${VAULT_ADDR}"
|
|
||||||
rm -f "${tmp_dump}"
|
|
||||||
log_ok "База расшифрована за 1 касание. Ключ и секреты в RAM (TTL: ${hours}ч)"
|
|
||||||
}
|
|
||||||
run_isolated() {
|
|
||||||
ensure_prerequisites
|
|
||||||
load_secrets_to_ram
|
|
||||||
(
|
|
||||||
set -a
|
|
||||||
source "${RAM_CACHE}"
|
|
||||||
set +a
|
|
||||||
"$@"
|
|
||||||
)
|
|
||||||
}
|
|
||||||
</file>
|
|
||||||
|
|
||||||
<file path="lib/vault.sh">
|
<file path="lib/vault.sh">
|
||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
# OpenBao Vault operations and Kubernetes Secret synchronization
|
# OpenBao Vault operations and Kubernetes Secret synchronization
|
||||||
|
|
@ -1161,6 +1115,71 @@ timeout 10s kubectl --kubeconfig="${KUBECONFIG_PATH}" -n storage exec statefulse
|
||||||
echo '```'
|
echo '```'
|
||||||
</file>
|
</file>
|
||||||
|
|
||||||
|
<file path="state/collect_state.sh">
|
||||||
|
#!/bin/bash
|
||||||
|
set -uo pipefail
|
||||||
|
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||||
|
STATE_DIR="${ZARYA_DIR}/state"
|
||||||
|
SNAPSHOTS_DIR="${STATE_DIR}/snapshots"
|
||||||
|
TARGET="${1:-all}"
|
||||||
|
MODULES=(
|
||||||
|
"00_workstation.sh"
|
||||||
|
"01_pve.sh"
|
||||||
|
"02_vps.sh"
|
||||||
|
"03_vyos.sh"
|
||||||
|
"04_tier0.sh"
|
||||||
|
"05_k8s.sh"
|
||||||
|
)
|
||||||
|
mkdir -p "${SNAPSHOTS_DIR}"
|
||||||
|
generate_header() {
|
||||||
|
local mod_name="$1"
|
||||||
|
local timestamp branch short_hash commit_msg
|
||||||
|
timestamp=$(date -u +"%Y-%m-%d %H:%M:%S UTC")
|
||||||
|
branch=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" branch --show-current 2>/dev/null || echo "unknown")
|
||||||
|
short_hash=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" rev-parse --short HEAD 2>/dev/null || echo "none")
|
||||||
|
commit_msg=$(git -C "${ATLAS_DIR:-$HOME/Projects/atlas}" log -1 --format='%s' 2>/dev/null || echo "none")
|
||||||
|
cat <<EOF
|
||||||
|
# Sovereign C2 Runtime: ${mod_name}
|
||||||
|
**Срез:** ${timestamp} | **Git:** ${branch}@${short_hash} ("${commit_msg}")
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
run_single_module() {
|
||||||
|
local mod="$1"
|
||||||
|
local mod_name="${mod%.sh}"
|
||||||
|
local script="${STATE_DIR}/${mod}"
|
||||||
|
local out_file="${SNAPSHOTS_DIR}/${mod_name}.md"
|
||||||
|
local tmp_file="${out_file}.tmp"
|
||||||
|
echo " -> Сбор модуля: ${mod_name}..."
|
||||||
|
generate_header "${mod_name}" > "${tmp_file}"
|
||||||
|
if [[ -x "${script}" ]]; then
|
||||||
|
"${script}" >> "${tmp_file}" 2>&1
|
||||||
|
else
|
||||||
|
bash "${script}" >> "${tmp_file}" 2>&1
|
||||||
|
fi
|
||||||
|
mv "${tmp_file}" "${out_file}"
|
||||||
|
}
|
||||||
|
if [[ "${TARGET}" == "all" ]]; then
|
||||||
|
echo "==> Сбор полного аудита Sovereign C2 в ${SNAPSHOTS_DIR}..."
|
||||||
|
for mod in "${MODULES[@]}"; do
|
||||||
|
run_single_module "${mod}"
|
||||||
|
done
|
||||||
|
echo "✔ Все модули телеметрии успешно сохранены."
|
||||||
|
else
|
||||||
|
case "${TARGET}" in
|
||||||
|
00_workstation|workstation|host) run_single_module "00_workstation.sh" ;;
|
||||||
|
01_pve|pve) run_single_module "01_pve.sh" ;;
|
||||||
|
02_vps|vps) run_single_module "02_vps.sh" ;;
|
||||||
|
03_vyos|vyos|net) run_single_module "03_vyos.sh" ;;
|
||||||
|
04_tier0|tier0) run_single_module "04_tier0.sh" ;;
|
||||||
|
05_k8s|k8s|talos) run_single_module "05_k8s.sh" ;;
|
||||||
|
*)
|
||||||
|
echo "Неизвестный модуль: ${TARGET}"
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
fi
|
||||||
|
</file>
|
||||||
|
|
||||||
<file path="config.env">
|
<file path="config.env">
|
||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
# Atlas C2 Configuration SSOT
|
# Atlas C2 Configuration SSOT
|
||||||
|
|
@ -1178,4 +1197,216 @@ PVE_ENDPOINT="https://192.168.1.177:8006/"
|
||||||
DEFAULT_SESSION_TTL=1
|
DEFAULT_SESSION_TTL=1
|
||||||
</file>
|
</file>
|
||||||
|
|
||||||
|
<file path="bin/zarya">
|
||||||
|
#!/bin/bash
|
||||||
|
set -euo pipefail
|
||||||
|
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||||
|
source "${ZARYA_DIR}/lib/common.sh"
|
||||||
|
|
||||||
|
SUBCMD="${1:-help}"
|
||||||
|
shift || true
|
||||||
|
|
||||||
|
case "${SUBCMD}" in
|
||||||
|
git-credential) exec "${ZARYA_DIR}/cmd/git-credential.sh" "$@" ;;
|
||||||
|
exec) exec "${ZARYA_DIR}/cmd/exec.sh" "$@" ;;
|
||||||
|
p|pod|pods) exec "${ZARYA_DIR}/cmd/pods.sh" "$@" ;;
|
||||||
|
node|nodes) exec "${ZARYA_DIR}/cmd/nodes.sh" "$@" ;;
|
||||||
|
flux) exec "${ZARYA_DIR}/cmd/flux.sh" "$@" ;;
|
||||||
|
e|err|errors) exec "${ZARYA_DIR}/cmd/errors.sh" "$@" ;;
|
||||||
|
l|log|logs) exec "${ZARYA_DIR}/cmd/logs.sh" "$@" ;;
|
||||||
|
n|net) exec "${ZARYA_DIR}/cmd/net.sh" "$@" ;;
|
||||||
|
d|df|disks) exec "${ZARYA_DIR}/cmd/disks.sh" "$@" ;;
|
||||||
|
unseal) exec "${ZARYA_DIR}/cmd/unseal.sh" "$@" ;;
|
||||||
|
login|start) exec "${ZARYA_DIR}/cmd/session.sh" "start" "$@" ;;
|
||||||
|
logout|clean) exec "${ZARYA_DIR}/cmd/session.sh" "clean" "$@" ;;
|
||||||
|
up) exec "${ZARYA_DIR}/cmd/up.sh" "$@" ;;
|
||||||
|
run) exec "${ZARYA_DIR}/cmd/run.sh" "$@" ;;
|
||||||
|
a|apply) exec "${ZARYA_DIR}/cmd/a.sh" "$@" ;;
|
||||||
|
snap) exec "${ZARYA_DIR}/cmd/snap.sh" "$@" ;;
|
||||||
|
pack) exec "${ZARYA_DIR}/cmd/pack.sh" "$@" ;;
|
||||||
|
reset|nuke) exec "${ZARYA_DIR}/layers/reset.sh" "$@" ;;
|
||||||
|
gc) exec "${ZARYA_DIR}/layers/gc.sh" "$@" ;;
|
||||||
|
help|--help|-h)
|
||||||
|
cat <<EOF
|
||||||
|
ZARYA Operator Interface (z)
|
||||||
|
Диагностика и мониторинг:
|
||||||
|
z pods [-w] [-n <ns>] [-s <query>] [-A] Просмотр подов
|
||||||
|
z nodes [-w] Статус нод, роли, зона и регион
|
||||||
|
z errors Мгновенный триаж сломанных сервисов
|
||||||
|
z logs <service> [-f] [-t <N>] Логи сервиса без ввода неймспейса
|
||||||
|
z net Сетевой радар доступности узлов (1 сек)
|
||||||
|
z disks Срез пулов astra/terra и томов K8s
|
||||||
|
GitOps и оркестрация:
|
||||||
|
z flux [status|sync|logs] Управление GitOps-конвергенцией
|
||||||
|
z exec <команда...> Вызов бинарников внутри RAM-изоляции
|
||||||
|
Сессия и доступы:
|
||||||
|
z login [TTL] Открытие смены (YubiKey + RAM)
|
||||||
|
z logout Мгновенная очистка RAM
|
||||||
|
z unseal Распечатывание OpenBao Vault
|
||||||
|
Деплой и IaC:
|
||||||
|
z up [layer] Макро-слои (host, net, tier0, talos, apps, all)
|
||||||
|
z run <selector> Плейбуки Ansible (01, 02)
|
||||||
|
z a [-auto-approve] OpenTofu apply в RAM-изоляции
|
||||||
|
Телеметрия и LLM:
|
||||||
|
z snap Снятие аудита в state/snapshots/
|
||||||
|
z pack [all|atlas|code|state] Сборка контекстов Repomix для LLM
|
||||||
|
EOF
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
log_err "Неизвестная команда: ${SUBCMD}. Введите 'z help'."
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
</file>
|
||||||
|
|
||||||
|
<file path="cmd/git-credential.sh">
|
||||||
|
#!/bin/bash
|
||||||
|
set -euo pipefail
|
||||||
|
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||||
|
source "${ZARYA_DIR}/lib/common.sh"
|
||||||
|
if [[ -f "${RAM_CACHE}" ]]; then
|
||||||
|
token=$(grep '^export ATLAS_PUSH_TOKEN=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2- | tr -d '"'\'' ' || true)
|
||||||
|
if [[ -n "${token}" ]]; then
|
||||||
|
echo "username=atlas"
|
||||||
|
echo "password=${token}"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
|
</file>
|
||||||
|
|
||||||
|
<file path="cmd/pack.sh">
|
||||||
|
#!/bin/bash
|
||||||
|
set -euo pipefail
|
||||||
|
ZARYA_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||||
|
source "${ZARYA_DIR}/lib/common.sh"
|
||||||
|
mode="${1:-all}"
|
||||||
|
pack_atlas() {
|
||||||
|
log_info "==> [1/3] Упаковка чистой архитектуры Atlas (atlas-code.xml)..."
|
||||||
|
(cd "${ATLAS_DIR}" && repomix --config "${ATLAS_DIR}/repomix.config.json")
|
||||||
|
log_ok "Файл ${ATLAS_DIR}/atlas-code.xml готов."
|
||||||
|
}
|
||||||
|
pack_zarya() {
|
||||||
|
log_info "==> [2/3] Упаковка станции оператора Zarya (zarya-code.xml)..."
|
||||||
|
(cd "${ZARYA_DIR}" && repomix --config "${ZARYA_DIR}/repomix.config.json")
|
||||||
|
log_ok "Файл ${ZARYA_DIR}/zarya-code.xml готов."
|
||||||
|
}
|
||||||
|
pack_state() {
|
||||||
|
log_info "==> [3/3] Снятие живого аудита и упаковка телеметрии (zarya-state.xml)..."
|
||||||
|
"${ZARYA_DIR}/state/collect_state.sh" all
|
||||||
|
(cd "${ZARYA_DIR}" && repomix --config "${ZARYA_DIR}/repomix.state.json")
|
||||||
|
log_ok "Файл ${ZARYA_DIR}/zarya-state.xml готов."
|
||||||
|
}
|
||||||
|
case "${mode}" in
|
||||||
|
all)
|
||||||
|
pack_atlas
|
||||||
|
echo ""
|
||||||
|
pack_zarya
|
||||||
|
echo ""
|
||||||
|
pack_state
|
||||||
|
echo ""
|
||||||
|
log_ok "Все три контекста Repomix собраны без ошибок."
|
||||||
|
;;
|
||||||
|
atlas)
|
||||||
|
pack_atlas
|
||||||
|
;;
|
||||||
|
code)
|
||||||
|
pack_zarya
|
||||||
|
;;
|
||||||
|
state)
|
||||||
|
pack_state
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
log_err "Использование: z pack [all|atlas|code|state]"
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
</file>
|
||||||
|
|
||||||
|
<file path="lib/net.sh">
|
||||||
|
#!/bin/bash
|
||||||
|
ensure_prerequisites() {
|
||||||
|
local target_ip="${VAULT_ADDR#*//}"
|
||||||
|
target_ip="${target_ip%%:*}"
|
||||||
|
if ! ip route get "${target_ip}" 2>/dev/null | grep -q "${VYOS_ROUTER_IP}"; then
|
||||||
|
log_info "Восстанавливаем маршрут к ${NET_PREFIX} через VyOS (${VYOS_ROUTER_IP})..."
|
||||||
|
sudo ip route replace "${NET_PREFIX}" via "${VYOS_ROUTER_IP}" 2>/dev/null || true
|
||||||
|
fi
|
||||||
|
local target_helper="!${ZARYA_DIR}/bin/zarya git-credential"
|
||||||
|
local current_helper
|
||||||
|
current_helper=$(git config --global --get credential."https://${GIT_HOST}".helper 2>/dev/null || true)
|
||||||
|
if [[ "${current_helper}" != "${target_helper}" ]]; then
|
||||||
|
git config --global credential."https://${GIT_HOST}".helper "${target_helper}"
|
||||||
|
fi
|
||||||
|
local direct_helper
|
||||||
|
direct_helper=$(git config --global --get credential."http://10.0.10.13:3000".helper 2>/dev/null || true)
|
||||||
|
if [[ "${direct_helper}" != "${target_helper}" ]]; then
|
||||||
|
git config --global credential."http://10.0.10.13:3000".helper "${target_helper}"
|
||||||
|
fi
|
||||||
|
local ssh_hosts="proxmox pve0 vyos vyos_router 10.0.* dns0 vault0 git0 storage0 registry0"
|
||||||
|
if [[ -f "${HOME}/.ssh/config" ]] && ! grep -q "IdentityFile ${RAM_KEY}" "${HOME}/.ssh/config"; then
|
||||||
|
printf "\nHost %s\n IdentityFile %s\n IdentitiesOnly yes\n" "${ssh_hosts}" "${RAM_KEY}" >> "${HOME}/.ssh/config"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
</file>
|
||||||
|
|
||||||
|
<file path="lib/session.sh">
|
||||||
|
#!/bin/bash
|
||||||
|
load_secrets_to_ram() {
|
||||||
|
local hours="${1:-$DEFAULT_SESSION_TTL}"
|
||||||
|
local now
|
||||||
|
now=$(date +%s)
|
||||||
|
ensure_prerequisites
|
||||||
|
if [[ -f "${RAM_CACHE}" ]] && [[ -f "${RAM_KEY}" ]] && [[ -s "${RAM_KEY}" ]]; then
|
||||||
|
local created age cached_ttl
|
||||||
|
created=$(stat -c %Y "${RAM_CACHE}" 2>/dev/null || echo 0)
|
||||||
|
age=$(( now - created ))
|
||||||
|
cached_ttl=$(grep '^# TTL_SECONDS=' "${RAM_CACHE}" 2>/dev/null | cut -d= -f2 || echo 3600)
|
||||||
|
if [[ "${cached_ttl}" -ne 0 ]] && (( age >= cached_ttl )); then
|
||||||
|
log_warn "Время сессии истекло ($(( age / 60 )) мин >= $(( cached_ttl / 60 )) мин). Инвалидация кэша..."
|
||||||
|
rm -f "${RAM_CACHE}" "${RAM_KEY}"
|
||||||
|
else
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
local ttl_seconds
|
||||||
|
if [[ "${hours}" -eq 0 ]]; then
|
||||||
|
ttl_seconds=0
|
||||||
|
else
|
||||||
|
ttl_seconds=$(( hours * 3600 ))
|
||||||
|
fi
|
||||||
|
log_info "🔐 Вход в защищенный контур Zarya..."
|
||||||
|
read -s -p "Master Password: " KP_PASS
|
||||||
|
echo ""
|
||||||
|
local yk_args=()
|
||||||
|
if ykman info >/dev/null 2>&1; then
|
||||||
|
yk_args=("-y" "2")
|
||||||
|
log_info "YubiKey обнаружен. Приготовьтесь к аппаратному подтверждению (1 касание)..."
|
||||||
|
fi
|
||||||
|
local tmp_dump="/dev/shm/.kdbx_dump_${now}_$$.xml"
|
||||||
|
rm -f "${tmp_dump}"
|
||||||
|
touch "${tmp_dump}"
|
||||||
|
chmod 600 "${tmp_dump}"
|
||||||
|
if ! echo "${KP_PASS}" | keepassxc-cli export "${yk_args[@]}" "${KDBX_PATH}" -f xml > "${tmp_dump}" 2>/dev/null; then
|
||||||
|
log_err "Ошибка расшифровки базы KDBX (неверный пароль или таймаут касания YubiKey)"
|
||||||
|
rm -f "${tmp_dump}"
|
||||||
|
unset KP_PASS
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
unset KP_PASS
|
||||||
|
python3 "${ZARYA_DIR}/lib/kdbx_parser.py" "${tmp_dump}" "${RAM_CACHE}" "${RAM_KEY}" "${ttl_seconds}" "${PVE_ENDPOINT}" "${VAULT_ADDR}"
|
||||||
|
rm -f "${tmp_dump}"
|
||||||
|
log_ok "База расшифрована за 1 касание. Ключ и секреты в RAM (TTL: ${hours}ч)"
|
||||||
|
}
|
||||||
|
run_isolated() {
|
||||||
|
ensure_prerequisites
|
||||||
|
load_secrets_to_ram
|
||||||
|
(
|
||||||
|
set -a
|
||||||
|
source "${RAM_CACHE}"
|
||||||
|
set +a
|
||||||
|
"$@"
|
||||||
|
)
|
||||||
|
}
|
||||||
|
</file>
|
||||||
|
|
||||||
</files>
|
</files>
|
||||||
|
|
|
||||||
849
zarya-state.xml
849
zarya-state.xml
|
|
@ -42,10 +42,857 @@ The content is organized as follows:
|
||||||
</file_summary>
|
</file_summary>
|
||||||
|
|
||||||
<directory_structure>
|
<directory_structure>
|
||||||
|
state/
|
||||||
|
snapshots/
|
||||||
|
00_workstation.md
|
||||||
|
01_pve.md
|
||||||
|
02_vps.md
|
||||||
|
03_vyos.md
|
||||||
|
04_tier0.md
|
||||||
|
05_k8s.md
|
||||||
</directory_structure>
|
</directory_structure>
|
||||||
|
|
||||||
<files>
|
<files>
|
||||||
This section contains the contents of the repository's files.
|
This section contains the contents of the repository's files.
|
||||||
|
|
||||||
|
<file path="state/snapshots/00_workstation.md">
|
||||||
|
# Sovereign C2 Runtime: 00_workstation
|
||||||
|
**Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git")
|
||||||
|
## 0. Рабочая станция администратора (Operator Environment)
|
||||||
|
### Инфраструктурные SSH-хосты (~/.ssh/config):
|
||||||
|
```text
|
||||||
|
Host proxmox pve0
|
||||||
|
Hostname 192.168.1.177
|
||||||
|
Port 22
|
||||||
|
User root
|
||||||
|
|
||||||
|
Host vyos vyos_router
|
||||||
|
Hostname 192.168.1.2
|
||||||
|
Port 22
|
||||||
|
User vyos
|
||||||
|
|
||||||
|
Host 10.0.* dns0 vault0 git0 storage0 registry0
|
||||||
|
User root
|
||||||
|
StrictHostKeyChecking no
|
||||||
|
UserKnownHostsFile /dev/null
|
||||||
|
LogLevel ERROR
|
||||||
|
|
||||||
|
Host fin21
|
||||||
|
Hostname 153.76.194.24
|
||||||
|
Port 22
|
||||||
|
User atlas
|
||||||
|
|
||||||
|
Host incserv
|
||||||
|
Hostname 31.76.100.166
|
||||||
|
Port 8765
|
||||||
|
User root
|
||||||
|
|
||||||
|
Host router
|
||||||
|
Hostname 192.168.1.1
|
||||||
|
Port 1488
|
||||||
|
User root
|
||||||
|
|
||||||
|
Host proxmox pve0 vyos vyos_router fin21 10.0.*
|
||||||
|
IdentityFile /dev/shm/.atlas_core
|
||||||
|
IdentitiesOnly yes
|
||||||
|
```
|
||||||
|
### Рабочие алиасы и функции оператора (Active Workflow Aliases):
|
||||||
|
```bash
|
||||||
|
# Маркер # >>> ATLAS C2 WORKFLOW >>> не найден в ~/.bashrc
|
||||||
|
```
|
||||||
|
### Статус RAM-кэша секретов (/dev/shm/.atlas_secrets_cache):
|
||||||
|
```text
|
||||||
|
Размер: 1058 байт | Права: 600 | Создан: 2026-10-25 18:08:15.915202821 +0300
|
||||||
|
```
|
||||||
|
### Проверка Git Credential Helper (git.svo88.space):
|
||||||
|
```text
|
||||||
|
Username: atlas
|
||||||
|
Password: [PRESENT in RAM]
|
||||||
|
```
|
||||||
|
### Ядро, память, ZRAM и параметры Coredump:
|
||||||
|
```text
|
||||||
|
Kernel: 7.2.5-3-omarchy
|
||||||
|
Swapon: NAME TYPE SIZE USED PRIO
|
||||||
|
/swap/swapfile file 13.5G 0B 0
|
||||||
|
/dev/zram0 partition 13.5G 358M 100
|
||||||
|
NAME ALGORITHM DISKSIZE DATA COMPR TOTAL STREAMS MOUNTPOINT
|
||||||
|
/dev/zram0 zstd 13.5G 331.5M 89.6M 95M [SWAP]
|
||||||
|
Coredump config:
|
||||||
|
#Storage=external
|
||||||
|
#ProcessSizeMax=32G
|
||||||
|
```
|
||||||
|
### Токены безопасности и ключи в ssh-agent:
|
||||||
|
```text
|
||||||
|
Active SSH Agent keys:
|
||||||
|
The agent has no identities.
|
||||||
|
YubiKey / FIDO2 Status:
|
||||||
|
Device type: YubiKey 5 Nano
|
||||||
|
Serial number: 29508635
|
||||||
|
Firmware version: 5.7.1
|
||||||
|
Form factor: Nano (USB-A)
|
||||||
|
Enabled USB interfaces: OTP, FIDO, CCID
|
||||||
|
|
||||||
|
Applications
|
||||||
|
Yubico OTP Enabled
|
||||||
|
FIDO U2F Enabled
|
||||||
|
FIDO2 Enabled
|
||||||
|
OATH Enabled
|
||||||
|
PIV Enabled
|
||||||
|
OpenPGP Enabled
|
||||||
|
YubiHSM Auth Enabled
|
||||||
|
```
|
||||||
|
### Зеркала пакетов Pacman (Mirrorlist):
|
||||||
|
```text
|
||||||
|
/etc/pacman.conf:[options]
|
||||||
|
/etc/pacman.conf:[core]
|
||||||
|
/etc/pacman.conf:[extra]
|
||||||
|
/etc/pacman.conf:[multilib]
|
||||||
|
/etc/pacman.conf:[omarchy]
|
||||||
|
/etc/pacman.conf:Server = https://pkgs.omarchy.org/stable/$arch
|
||||||
|
/etc/pacman.d/mirrorlist:Server = https://stable-mirror.omarchy.org/$repo/os/$arch
|
||||||
|
/etc/pacman.d/mirrorlist.bak:Server = https://mirror.omarchy.org/$repo/os/$arch
|
||||||
|
/etc/pacman.d/mirrorlist.omarchy-upgrade-to-quattro.20260905155315.bak:Server = https://mirror.omarchy.org/$repo/os/$arch
|
||||||
|
Нет данных о зеркалах
|
||||||
|
```
|
||||||
|
### Маршрутизация на хосте (Routing to C2):
|
||||||
|
```text
|
||||||
|
default via 192.168.1.2 dev enp34s0 proto dhcp src 192.168.1.247 metric 100
|
||||||
|
10.0.0.0/16 via 192.168.1.2 dev enp34s0 proto static metric 100
|
||||||
|
192.168.1.0/24 dev enp34s0 proto kernel scope link src 192.168.1.247 metric 100
|
||||||
|
```
|
||||||
|
### Версии локальных инструментов:
|
||||||
|
```text
|
||||||
|
OpenTofu: OpenTofu v1.12.1
|
||||||
|
Kubectl: gitVersion: v1.36.4
|
||||||
|
Talosctl: Client:
|
||||||
|
Talos v1.14.0
|
||||||
|
```
|
||||||
|
### Состояние локального Git-репозитория (SSOT Source):
|
||||||
|
```text
|
||||||
|
fatal: not a git repository (or any parent up to mount point /)
|
||||||
|
Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
|
||||||
|
fatal: not a git repository (or any parent up to mount point /)
|
||||||
|
Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
|
||||||
|
Последний коммит:
|
||||||
|
Remote URL: no remote
|
||||||
|
```
|
||||||
|
---
|
||||||
|
</file>
|
||||||
|
|
||||||
|
<file path="state/snapshots/01_pve.md">
|
||||||
|
# Sovereign C2 Runtime: 01_pve
|
||||||
|
**Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git")
|
||||||
|
## 1. Гипервизор Proxmox VE (192.168.1.177)
|
||||||
|
### Память хоста, Uptime и Температура CPU:
|
||||||
|
```text
|
||||||
|
18:20:07 up 3:30, 1 user, load average: 1.59, 1.90, 1.69
|
||||||
|
|
||||||
|
total used free shared buff/cache available
|
||||||
|
Mem: 37Gi 30Gi 5.8Gi 75Mi 1.3Gi 6.6Gi
|
||||||
|
Swap: 0B 0B 0B
|
||||||
|
|
||||||
|
```
|
||||||
|
### Здоровье физических дисков (SMART):
|
||||||
|
```text
|
||||||
|
/dev/sda: SMART overall-health self-assessment test result: PASSED
|
||||||
|
/dev/sdb: SMART overall-health self-assessment test result: PASSED
|
||||||
|
/dev/sdc: SMART overall-health self-assessment test result: PASSED
|
||||||
|
/dev/sdd: SMART overall-health self-assessment test result: PASSED
|
||||||
|
/dev/sde: SMART overall-health self-assessment test result: PASSED
|
||||||
|
/dev/sdf: SMART overall-health self-assessment test result: PASSED
|
||||||
|
```
|
||||||
|
### Статус шифрования ZFS (Encryption & Keys):
|
||||||
|
```text
|
||||||
|
NAME PROPERTY VALUE SOURCE
|
||||||
|
astra encryption aes-256-gcm -
|
||||||
|
astra keystatus available -
|
||||||
|
astra keyformat raw -
|
||||||
|
astra keylocation file:///etc/zfs/keys/astra.key local
|
||||||
|
terra encryption aes-256-gcm -
|
||||||
|
terra keystatus available -
|
||||||
|
terra keyformat raw -
|
||||||
|
terra keylocation file:///etc/zfs/keys/terra.key local
|
||||||
|
```
|
||||||
|
### Здоровье и емкость ZFS-пулов:
|
||||||
|
```text
|
||||||
|
NAME SIZE ALLOC FREE FRAG CAP HEALTH
|
||||||
|
astra 2.78T 540G 2.25T 9% 18% ONLINE
|
||||||
|
terra 1.81T 345G 1.48T 0% 18% ONLINE
|
||||||
|
|
||||||
|
NAME USED AVAIL REFER MOUNTPOINT
|
||||||
|
astra 360G 1.44T 55.0M /astra
|
||||||
|
astra/vm-100-cloudinit 128K 1.44T 128K -
|
||||||
|
astra/vm-100-disk-0 1.06G 1.44T 1.06G -
|
||||||
|
astra/vm-201-disk-0 1.38G 1.44T 1.38G -
|
||||||
|
astra/vm-202-disk-0 14.8G 1.44T 14.8G -
|
||||||
|
astra/vm-203-disk-0 20.4G 1.44T 20.4G -
|
||||||
|
astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 27.2M 1.44T 27.2M -
|
||||||
|
astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 8.61M 1.44T 8.61M -
|
||||||
|
astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 203M 1.44T 203M -
|
||||||
|
astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 714K 1.44T 714K -
|
||||||
|
astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 5.13M 1.44T 5.13M -
|
||||||
|
astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 884K 1.44T 884K -
|
||||||
|
astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 1.05M 1.44T 1.05M -
|
||||||
|
astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 416K 1.44T 416K -
|
||||||
|
astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 7.02M 1.44T 7.02M -
|
||||||
|
astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 320G 1.44T 320G -
|
||||||
|
astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 970K 1.44T 970K -
|
||||||
|
astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 375M 1.44T 375M -
|
||||||
|
astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 1.33M 1.44T 1.33M -
|
||||||
|
astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 2.54M 1.44T 2.54M -
|
||||||
|
astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 704M 1.44T 704M -
|
||||||
|
astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 14.5M 1.44T 14.5M -
|
||||||
|
astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 20.7M 1.44T 20.7M -
|
||||||
|
terra 345G 1.42T 12.6G /terra
|
||||||
|
terra/media 248K 1.42T 248K /terra/media
|
||||||
|
terra/s3 192K 1.42T 192K /terra/s3
|
||||||
|
terra/vault 333G 1.42T 333G /terra/vault
|
||||||
|
```
|
||||||
|
### Физическая емкость каталогов на /terra:
|
||||||
|
```text
|
||||||
|
68K /terra/media
|
||||||
|
4.6M /terra/models
|
||||||
|
171K /terra/packages
|
||||||
|
13G /terra/registry
|
||||||
|
8.5K /terra/s3
|
||||||
|
4.3M /terra/torrents
|
||||||
|
333G /terra/vault
|
||||||
|
```
|
||||||
|
### Блочные устройства хоста и тома ZVOL (lsblk):
|
||||||
|
```text
|
||||||
|
NAME FSTYPE SIZE MOUNTPOINTS
|
||||||
|
loop0 ext4 4G
|
||||||
|
loop1 ext4 4G
|
||||||
|
loop2 ext4 2G
|
||||||
|
loop3 ext4 8G
|
||||||
|
loop4 ext4 8G
|
||||||
|
sda 1.8T
|
||||||
|
├─sda1 zfs_member 1.8T
|
||||||
|
└─sda9 8M
|
||||||
|
sdb 953.9G
|
||||||
|
├─sdb1 zfs_member 953.9G
|
||||||
|
└─sdb9 8M
|
||||||
|
sdc 476.9G
|
||||||
|
├─sdc1 vfat 976M /boot/efi
|
||||||
|
├─sdc2 linux_raid_member 977M
|
||||||
|
│ └─md0 ext4 976M /boot
|
||||||
|
└─sdc3 linux_raid_member 445.3G
|
||||||
|
└─md1 crypto_LUKS 445.1G
|
||||||
|
└─md1_crypt ext4 445.1G /
|
||||||
|
sdd 953.9G
|
||||||
|
├─sdd1 zfs_member 953.9G
|
||||||
|
└─sdd9 8M
|
||||||
|
sde 447.1G
|
||||||
|
├─sde1 vfat 976M
|
||||||
|
├─sde2 linux_raid_member 977M
|
||||||
|
│ └─md0 ext4 976M /boot
|
||||||
|
└─sde3 linux_raid_member 445.2G
|
||||||
|
└─md1 crypto_LUKS 445.1G
|
||||||
|
└─md1_crypt ext4 445.1G /
|
||||||
|
sdf 953.9G
|
||||||
|
├─sdf1 zfs_member 953.9G
|
||||||
|
└─sdf9 8M
|
||||||
|
zd0 ext4 2G
|
||||||
|
zd16 ext4 10G
|
||||||
|
zd32 ext4 10G
|
||||||
|
zd48 ext4 20G
|
||||||
|
zd64 iso9660 4M
|
||||||
|
zd80 ext4 5G
|
||||||
|
zd96 ext4 5G
|
||||||
|
zd112 ext4 5G
|
||||||
|
zd128 ext4 5G
|
||||||
|
zd144 100G
|
||||||
|
├─zd144p1 vfat 100M
|
||||||
|
├─zd144p2 1M
|
||||||
|
├─zd144p3 xfs 2G
|
||||||
|
├─zd144p4 1M
|
||||||
|
├─zd144p5 xfs 100M
|
||||||
|
└─zd144p6 xfs 97.8G
|
||||||
|
zd160 ext4 30G
|
||||||
|
zd176 ext4 30G
|
||||||
|
zd192 ext4 400G
|
||||||
|
zd208 ext4 100G
|
||||||
|
zd224 100G
|
||||||
|
├─zd224p1 vfat 100M
|
||||||
|
├─zd224p2 1M
|
||||||
|
├─zd224p3 xfs 2G
|
||||||
|
├─zd224p4 1M
|
||||||
|
├─zd224p5 xfs 100M
|
||||||
|
└─zd224p6 xfs 97.8G
|
||||||
|
zd240 10G
|
||||||
|
├─zd240p1 1M
|
||||||
|
├─zd240p2 vfat 256M
|
||||||
|
└─zd240p3 ext4 9G
|
||||||
|
zd256 ext4 100G
|
||||||
|
zd272 20G
|
||||||
|
├─zd272p1 vfat 100M
|
||||||
|
├─zd272p2 1M
|
||||||
|
├─zd272p3 xfs 2G
|
||||||
|
├─zd272p4 1M
|
||||||
|
├─zd272p5 xfs 100M
|
||||||
|
└─zd272p6 xfs 17.8G
|
||||||
|
zd288 ext4 20G
|
||||||
|
zd304 ext4 15G
|
||||||
|
zd320 ext4 5G
|
||||||
|
zd336 ext4 30G
|
||||||
|
```
|
||||||
|
### Виртуальные диски K8s и ВМ (ZVOLs на astra):
|
||||||
|
```text
|
||||||
|
NAME VOLSIZE USED REFER
|
||||||
|
astra/vm-100-cloudinit 4M 128K 128K
|
||||||
|
astra/vm-100-disk-0 10G 1.06G 1.06G
|
||||||
|
astra/vm-201-disk-0 20G 1.38G 1.38G
|
||||||
|
astra/vm-202-disk-0 100G 14.8G 14.8G
|
||||||
|
astra/vm-203-disk-0 100G 20.4G 20.4G
|
||||||
|
astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10G 27.2M 27.2M
|
||||||
|
astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100G 8.61M 8.61M
|
||||||
|
astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100G 203M 203M
|
||||||
|
astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5G 714K 714K
|
||||||
|
astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20G 5.13M 5.13M
|
||||||
|
astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10G 884K 884K
|
||||||
|
astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15G 1.05M 1.05M
|
||||||
|
astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2G 416K 416K
|
||||||
|
astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5G 7.02M 7.02M
|
||||||
|
astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400G 320G 320G
|
||||||
|
astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5G 970K 970K
|
||||||
|
astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5G 375M 375M
|
||||||
|
astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20G 1.33M 1.33M
|
||||||
|
astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5G 2.54M 2.54M
|
||||||
|
astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30G 704M 704M
|
||||||
|
astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30G 14.5M 14.5M
|
||||||
|
astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30G 20.7M 20.7M
|
||||||
|
```
|
||||||
|
### Модули ядра (nfsd, zfs):
|
||||||
|
```text
|
||||||
|
zfs 6262784 44
|
||||||
|
nfsd 1011712 3
|
||||||
|
```
|
||||||
|
### Теги сетевых карт ВМ 100 (VyOS) в Proxmox:
|
||||||
|
```text
|
||||||
|
net0: virtio=BC:24:11:DC:6D:EC,bridge=vmbr0,firewall=0
|
||||||
|
net1: virtio=BC:24:11:3F:CB:C9,bridge=vmbr0,firewall=0,tag=20
|
||||||
|
net2: virtio=BC:24:11:EA:32:2F,bridge=vmbr0,firewall=0,tag=30
|
||||||
|
net3: virtio=BC:24:11:59:E8:8D,bridge=vmbr0,firewall=0,tag=10
|
||||||
|
```
|
||||||
|
### Точки монтирования LXC-контейнеров (/etc/pve/lxc/*.conf):
|
||||||
|
```text
|
||||||
|
/etc/pve/lxc/101.conf:mp0: /astra/data/dns0,mp=/opt/technitium/dns/config
|
||||||
|
/etc/pve/lxc/102.conf:mp0: /astra/data/vault0,mp=/var/lib/bao/data
|
||||||
|
/etc/pve/lxc/103.conf:mp0: /astra/data/git0,mp=/var/lib/forgejo
|
||||||
|
/etc/pve/lxc/104.conf:mp0: /terra/media,mp=/media
|
||||||
|
/etc/pve/lxc/104.conf:mp1: /terra/torrents,mp=/torrents
|
||||||
|
/etc/pve/lxc/104.conf:mp2: /terra/vault,mp=/backups
|
||||||
|
/etc/pve/lxc/104.conf:mp3: /terra/models,mp=/models
|
||||||
|
/etc/pve/lxc/104.conf:mp4: /terra/packages,mp=/packages
|
||||||
|
/etc/pve/lxc/105.conf:mp0: /terra/registry,mp=/mnt/registry
|
||||||
|
```
|
||||||
|
### Флаги автостарта ВМ и Контейнеров (onboot):
|
||||||
|
```text
|
||||||
|
/etc/pve/qemu-server/100.conf:onboot: 1
|
||||||
|
/etc/pve/qemu-server/201.conf:onboot: 1
|
||||||
|
/etc/pve/qemu-server/202.conf:onboot: 1
|
||||||
|
/etc/pve/qemu-server/203.conf:onboot: 1
|
||||||
|
/etc/pve/lxc/101.conf:onboot: 1
|
||||||
|
/etc/pve/lxc/102.conf:onboot: 1
|
||||||
|
/etc/pve/lxc/103.conf:onboot: 1
|
||||||
|
/etc/pve/lxc/104.conf:onboot: 1
|
||||||
|
/etc/pve/lxc/105.conf:onboot: 1
|
||||||
|
```
|
||||||
|
### Виртуальные машины (QEMU) и Контейнеры (LXC):
|
||||||
|
```text
|
||||||
|
VMID NAME STATUS MEM(MB) BOOTDISK(GB) PID
|
||||||
|
100 vyos-router running 2048 10.00 2594
|
||||||
|
201 talos-master-1 running 2560 20.00 2698
|
||||||
|
202 talos-worker-1 running 10240 100.00 3869
|
||||||
|
203 talos-worker-2 running 10240 100.00 4919
|
||||||
|
|
||||||
|
VMID Status Lock Name
|
||||||
|
101 running dns0
|
||||||
|
102 running vault0
|
||||||
|
103 running git0
|
||||||
|
104 running storage0
|
||||||
|
105 running registry0
|
||||||
|
```
|
||||||
|
---
|
||||||
|
</file>
|
||||||
|
|
||||||
|
<file path="state/snapshots/02_vps.md">
|
||||||
|
# Sovereign C2 Runtime: 02_vps
|
||||||
|
**Срез:** 2026-10-25 15:20:12 UTC | **Git:** master@10fbe14 ("git")
|
||||||
|
## 2. Периметр: Белый VPS (Host: fin21, IP: 153.76.194.24)
|
||||||
|
### WireGuard wg0 на VPS:
|
||||||
|
```text
|
||||||
|
interface: wg0
|
||||||
|
public key: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY=
|
||||||
|
private key: (hidden)
|
||||||
|
listening port: 51820
|
||||||
|
|
||||||
|
peer: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4=
|
||||||
|
endpoint: 45.93.6.172:46777
|
||||||
|
allowed ips: 10.8.0.2/32, 10.0.30.200/32
|
||||||
|
latest handshake: 3 hours, 28 minutes, 44 seconds ago
|
||||||
|
transfer: 64.06 MiB received, 54.22 MiB sent
|
||||||
|
```
|
||||||
|
### Статус системных сервисов (Edge Stack):
|
||||||
|
```text
|
||||||
|
WireGuard: active | HAProxy: active | Xray: active | Nginx: active
|
||||||
|
```
|
||||||
|
### Прослушиваемые сокеты (Ports 80, 443, 4443, 8443, 51820):
|
||||||
|
```text
|
||||||
|
udp UNCONN 0 0 0.0.0.0:51820 0.0.0.0:*
|
||||||
|
udp UNCONN 0 0 [::]:51820 [::]:*
|
||||||
|
tcp LISTEN 0 4096 127.0.0.1:4443 0.0.0.0:* users:(("haproxy",pid=862,fd=10))
|
||||||
|
tcp LISTEN 0 511 127.0.0.1:8443 0.0.0.0:* users:(("nginx",pid=739,fd=5),("nginx",pid=735,fd=5))
|
||||||
|
tcp LISTEN 0 4096 0.0.0.0:80 0.0.0.0:* users:(("haproxy",pid=862,fd=9))
|
||||||
|
tcp LISTEN 0 4096 *:443 *:* users:(("xray",pid=690,fd=3))
|
||||||
|
```
|
||||||
|
### Тест аварийной заглушки Nginx (127.0.0.1:8443):
|
||||||
|
```text
|
||||||
|
Atlas Sovereign Home Server is currently offline for maintenance.
|
||||||
|
```
|
||||||
|
### Конфигурация SSH-демона (sshd runtime):
|
||||||
|
```text
|
||||||
|
permitrootlogin no
|
||||||
|
passwordauthentication yes
|
||||||
|
```
|
||||||
|
---
|
||||||
|
</file>
|
||||||
|
|
||||||
|
<file path="state/snapshots/03_vyos.md">
|
||||||
|
# Sovereign C2 Runtime: 03_vyos
|
||||||
|
**Срез:** 2026-10-25 15:20:15 UTC | **Git:** master@10fbe14 ("git")
|
||||||
|
## 3. Маршрутизатор VyOS (192.168.1.2)
|
||||||
|
### Сетевые интерфейсы и L2-транк (VLANs 10, 20, 30):
|
||||||
|
```text
|
||||||
|
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
|
||||||
|
Interface IP Address MAC VRF MTU S/L Description
|
||||||
|
----------- -------------- ----------------- ------- ----- ----- -------------------
|
||||||
|
eth0 192.168.1.2/24 bc:24:11:dc:6d:ec default 1500 u/u WAN_TRUNK
|
||||||
|
eth1 10.0.20.1/24 bc:24:11:3f:cb:c9 default 1500 u/u K8S
|
||||||
|
eth2 10.0.10.1/24 bc:24:11:59:e8:8d default 1500 u/u TIER0
|
||||||
|
eth3 10.0.30.1/24 bc:24:11:ea:32:2f default 1500 u/u LAN_CLIENTS
|
||||||
|
lo 127.0.0.1/8 00:00:00:00:00:00 default 65536 u/u
|
||||||
|
::1/128
|
||||||
|
tun0 172.19.0.1/30 n/a default 65535 u/u
|
||||||
|
wg0 10.8.0.2/24 n/a default 1420 u/u TUNNEL_TO_VPS_FIN21
|
||||||
|
```
|
||||||
|
### ARP-таблица K8s-интерфейса eth1 (проверка связности с нодами):
|
||||||
|
```text
|
||||||
|
10.0.20.11 lladdr bc:24:11:12:c5:1b REACHABLE
|
||||||
|
10.0.20.12 lladdr bc:24:11:ef:1a:d4 STALE
|
||||||
|
10.0.20.10 lladdr bc:24:11:71:b6:82 REACHABLE
|
||||||
|
fe80::be24:11ff:fe12:c51b lladdr bc:24:11:12:c5:1b STALE
|
||||||
|
fe80::be24:11ff:feef:1ad4 lladdr bc:24:11:ef:1a:d4 STALE
|
||||||
|
fe80::be24:11ff:fe71:b682 lladdr bc:24:11:71:b6:82 STALE
|
||||||
|
```
|
||||||
|
### DHCP-сервер и выданные лизы (Options 3, 6):
|
||||||
|
```text
|
||||||
|
IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname Origin
|
||||||
|
------------ ----------------- ------- ------------------- ------------------- ----------- ----------- -------------- --------
|
||||||
|
10.0.20.10 bc:24:11:71:b6:82 active 2026-10-25 11:51:32 2026-10-26 11:51:32 20:31:16 K8S talos-master-1 local
|
||||||
|
10.0.20.11 bc:24:11:12:c5:1b active 2026-10-25 12:29:01 2026-10-26 12:29:01 21:08:45 K8S talos-worker-1 local
|
||||||
|
10.0.20.12 bc:24:11:ef:1a:d4 active 2026-10-25 12:29:04 2026-10-26 12:29:04 21:08:48 K8S talos-worker-2 local
|
||||||
|
10.0.30.100 bc:24:11:eb:38:63 active 2026-10-25 12:29:02 2026-10-26 12:29:02 21:08:46 LAN_CLIENTS talos-worker-1 local
|
||||||
|
10.0.30.101 bc:24:11:bb:00:d3 active 2026-10-25 12:29:05 2026-10-26 12:29:05 21:08:49 LAN_CLIENTS talos-worker-2 local
|
||||||
|
```
|
||||||
|
### Перехват DNS через DNAT (Rule 53 -> 127.0.0.42:53):
|
||||||
|
```text
|
||||||
|
Rule Source Destination Proto In-Int Translation
|
||||||
|
------ --------- ------------- -------- -------- -------------
|
||||||
|
53 0.0.0.0/0 0.0.0.0/0 TCP, UDP LAN 127.0.0.42
|
||||||
|
sport any dport 53 port 53
|
||||||
|
```
|
||||||
|
### Контейнеры маршрутизатора (Sing-Box & Zapret2):
|
||||||
|
```text
|
||||||
|
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
|
||||||
|
9217a0a6ac83 ghcr.io/sagernet/sing-box:latest run -c /etc/sing-... 3 hours ago Up 3 hours sing-box
|
||||||
|
c7e27e9bb9fc docker.io/vernette/ss-zapret2:latest /etc/zapret/run.s... 3 hours ago Up 3 hours 1080/tcp, 8388/tcp zapret2
|
||||||
|
```
|
||||||
|
### Наличие /dev/net/tun внутри контейнера sing-box:
|
||||||
|
```text
|
||||||
|
crw-rw-rw- 1 root root 10, 200 Oct 25 11:51 /dev/net/tun
|
||||||
|
```
|
||||||
|
### Задержка VLESS-канала через Clash API (Main-1-out -> fin21):
|
||||||
|
```text
|
||||||
|
{"type": "VLESS", "name": "Main-1-out", "udp": true, "history": [{"time":"2026-10-25T15:19:30.52662628Z","delay":122}]}```
|
||||||
|
### Статус таймера автосинхронизации Git (singbox-sync):
|
||||||
|
```text
|
||||||
|
● singbox-sync.timer - Periodic Sing-Box Config Git Sync Timer
|
||||||
|
Loaded: loaded (/etc/systemd/system/singbox-sync.timer; enabled; preset: enabled)
|
||||||
|
Active: active (waiting) since Sun 2026-10-25 11:51:13 UTC; 3h 29min ago
|
||||||
|
Trigger: Sun 2026-10-25 15:20:23 UTC; 6s left
|
||||||
|
Triggers: ● singbox-sync.service
|
||||||
|
|
||||||
|
Oct 25 11:51:13 vyos-router systemd[1]: Started Periodic Sing-Box Config Git Sync Timer.
|
||||||
|
|
||||||
|
Oct 25 15:19:23 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully.
|
||||||
|
Oct 25 15:19:23 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync.
|
||||||
|
Oct 25 15:19:53 vyos-router systemd[1]: Starting Automated Sing-Box Config Git Sync...
|
||||||
|
Oct 25 15:19:54 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully.
|
||||||
|
Oct 25 15:19:54 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync.
|
||||||
|
```
|
||||||
|
### Статус WireGuard туннеля wg0 и пинг до VPS:
|
||||||
|
```text
|
||||||
|
interface: wg0
|
||||||
|
public key: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4=
|
||||||
|
private key: (hidden)
|
||||||
|
listening port: 34756
|
||||||
|
|
||||||
|
peer: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY=
|
||||||
|
endpoint: 153.76.194.24:51820
|
||||||
|
allowed ips: 10.8.0.0/24
|
||||||
|
latest handshake: 3 hours, 28 minutes, 47 seconds ago
|
||||||
|
transfer: 1.12 KiB received, 282.34 KiB sent
|
||||||
|
persistent keepalive: every 25 seconds
|
||||||
|
|
||||||
|
VyOS или туннель недоступен
|
||||||
|
```
|
||||||
|
### Таблица маршрутизации (show ip route):
|
||||||
|
```text
|
||||||
|
Codes: K - kernel route, C - connected, L - local, S - static,
|
||||||
|
R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
|
||||||
|
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
|
||||||
|
f - OpenFabric, t - Table-Direct,
|
||||||
|
> - selected route, * - FIB route, q - queued, r - rejected, b - backup
|
||||||
|
t - trapped, o - offload failure
|
||||||
|
|
||||||
|
IPv4 unicast VRF default:
|
||||||
|
S>* 0.0.0.0/0 [1/0] via 192.168.1.1, eth0, weight 1, 03:28:52
|
||||||
|
C>* 10.0.10.0/24 is directly connected, eth2, weight 1, 03:28:58
|
||||||
|
L>* 10.0.10.1/32 is directly connected, eth2, weight 1, 03:28:58
|
||||||
|
C>* 10.0.20.0/24 is directly connected, eth1, weight 1, 03:28:58
|
||||||
|
L>* 10.0.20.1/32 is directly connected, eth1, weight 1, 03:28:58
|
||||||
|
C>* 10.0.30.0/24 is directly connected, eth3, weight 1, 03:28:58
|
||||||
|
L>* 10.0.30.1/32 is directly connected, eth3, weight 1, 03:28:58
|
||||||
|
C>* 10.8.0.0/24 is directly connected, wg0, weight 1, 03:28:57
|
||||||
|
L>* 10.8.0.2/32 is directly connected, wg0, weight 1, 03:28:57
|
||||||
|
C>* 172.19.0.0/30 is directly connected, tun0, weight 1, 03:28:55
|
||||||
|
L>* 172.19.0.1/32 is directly connected, tun0, weight 1, 03:28:55
|
||||||
|
C>* 192.168.1.0/24 is directly connected, eth0, weight 1, 03:28:58
|
||||||
|
L>* 192.168.1.2/32 is directly connected, eth0, weight 1, 03:28:58
|
||||||
|
```
|
||||||
|
---
|
||||||
|
</file>
|
||||||
|
|
||||||
|
<file path="state/snapshots/04_tier0.md">
|
||||||
|
# Sovereign C2 Runtime: 04_tier0
|
||||||
|
**Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git")
|
||||||
|
## 4. Сервисы Tier-0 (Air-Gap фундамент)
|
||||||
|
### Technitium DNS (10.0.10.11:53):
|
||||||
|
* **Внутренний домен (*.svo88.space -> 10.0.30.200):** 10.0.30.200
|
||||||
|
* **Внешний резолв (google.com):** 173.194.220.100
|
||||||
|
### OpenBao Vault (10.0.10.12:8200):
|
||||||
|
```json
|
||||||
|
{"type":"shamir","initialized":true,"sealed":false,"t":1,"n":1,"progress":0,"nonce":"","version":"2.0.1","build_date":"2024-09-03T19:57:34Z","migration":false,"cluster_name":"vault-cluster-74026fc7","cluster_id":"79b6d270-a6b1-b082-39be-aeb24d8841f5","recovery_seal":false,"storage_type":"file"}
|
||||||
|
```
|
||||||
|
### Zot OCI Registry (10.0.10.15:5000):
|
||||||
|
```json
|
||||||
|
{"repositories":["alpine","docker.io/getmeili/meilisearch","docker.io/grafana/loki","docker.io/jellyfin/jellyfin","docker.io/library/alpine","docker.io/library/busybox","docker.io/library/nginx","docker.io/library/postgres","docker.io/library/redis","docker.io/library/traefik","docker.io/netboxcommunity/netbox","docker.io/opencloudeu/opencloud-rolling","docker.io/owncloud/ocis","docker.io/searxng/searxng","docker.io/vaultwarden/server","docker.io/victoriametrics/victoria-metrics","docker.io/xream/sub-store","ghcr.io/anatol/pacoloco","ghcr.io/donkie/spoolman","ghcr.io/external-secrets/external-secrets","ghcr.io/fluxcd/helm-controller","ghcr.io/fluxcd/image-automation-controller","ghcr.io/fluxcd/image-reflector-controller","ghcr.io/fluxcd/kustomize-controller","ghcr.io/fluxcd/notification-controller","ghcr.io/fluxcd/source-controller","ghcr.io/fluxcd/source-watcher","ghcr.io/goauthentik/server","ghcr.io/immich-app/postgres","ghcr.io/karakeep-app/karakeep","ghcr.io/karakeep-app/karakeep-chrome","ghcr.io/kiwix/kiwix-serve","ghcr.io/sergelogvinov/proxmox-csi-controller","ghcr.io/sergelogvinov/proxmox-csi-node","ghcr.io/siderolabs/kubelet","ghcr.io/sysadminsmedia/homebox","ghcr.io/triliumnext/notes","ghcr.io/triliumnext/trilium","ghcr.io/we-promise/sure","ghcr.io/xiao-villamor/printstash","k8s.io/coredns/coredns","k8s.io/kube-apiserver","k8s.io/kube-controller-manager","k8s.io/kube-proxy","k8s.io/kube-scheduler","k8s.io/sig-storage/csi-attacher","k8s.io/sig-storage/csi-provisioner","k8s.io/sig-storage/csi-resizer","k8s.io/sig-storage/livenessprobe","quay.io/invidious/invidious","quay.io/invidious/invidious-companion","quay.io/jetstack/cert-manager-cainjector"]}```
|
||||||
|
### Forgejo GitOps Server (10.0.10.13:3000):
|
||||||
|
```json
|
||||||
|
{"version":"7.0.4+gitea-1.21.11"}
|
||||||
|
```
|
||||||
|
### Ядерный NFS nfsd (storage0 - 10.0.10.14):
|
||||||
|
```text
|
||||||
|
== Активные экспорты ядра (exportfs):
|
||||||
|
/media 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||||
|
/torrents 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||||
|
/backups 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||||
|
/models 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||||
|
/packages 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||||
|
/media 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||||
|
/torrents 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||||
|
/backups 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||||
|
/models 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||||
|
/packages 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)
|
||||||
|
|
||||||
|
== Емкость смонтированных ZFS-датасетов:
|
||||||
|
Filesystem Size Used Available Use% Mounted on
|
||||||
|
terra/media 1.4T 1.0M 1.4T 0% /media
|
||||||
|
terra 1.4T 12.6G 1.4T 1% /torrents
|
||||||
|
terra/vault 1.7T 332.6G 1.4T 19% /backups
|
||||||
|
terra 1.4T 12.6G 1.4T 1% /torrents
|
||||||
|
|
||||||
|
== Права точки монтирования OpenCloud:
|
||||||
|
drwxrws--- 5 1000 1000 5 Oct 25 12:31 /backups/opencloud-users
|
||||||
|
```
|
||||||
|
---
|
||||||
|
</file>
|
||||||
|
|
||||||
|
<file path="state/snapshots/05_k8s.md">
|
||||||
|
# Sovereign C2 Runtime: 05_k8s
|
||||||
|
**Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git")
|
||||||
|
## 5. Kubernetes Платформа & Нагрузки
|
||||||
|
### Участники кластера Talos (OS-level):
|
||||||
|
```text
|
||||||
|
10.0.20.10: error getting server version: error constructing client: failed to create client connection: failed to resolve configuration context: talos config file is empty
|
||||||
|
Talos API недоступен
|
||||||
|
```
|
||||||
|
### Ноды кластера K8s:
|
||||||
|
```text
|
||||||
|
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
|
||||||
|
talos-1il-vwa Ready control-plane 3h26m v1.37.0 10.0.20.10 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
|
||||||
|
talos-worker-1 Ready <none> 171m v1.37.0 10.0.20.11 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
|
||||||
|
talos-worker-2 Ready <none> 170m v1.37.0 10.0.20.12 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
|
||||||
|
```
|
||||||
|
### Топологические лейблы нод (Proxmox-CSI topology):
|
||||||
|
```text
|
||||||
|
NAME STATUS ROLES AGE VERSION ZONE REGION
|
||||||
|
talos-1il-vwa Ready control-plane 3h26m v1.37.0
|
||||||
|
talos-worker-1 Ready <none> 171m v1.37.0 pve0 atlas
|
||||||
|
talos-worker-2 Ready <none> 170m v1.37.0 pve0 atlas
|
||||||
|
```
|
||||||
|
### Статус ExternalSecrets (Синхронизация из Vault):
|
||||||
|
```text
|
||||||
|
NAME AGE STATUS CAPABILITIES READY
|
||||||
|
clustersecretstore.external-secrets.io/openbao-backend 33d Valid ReadWrite True
|
||||||
|
|
||||||
|
NAMESPACE NAME STORETYPE STORE REFRESH INTERVAL STATUS READY LAST SYNC
|
||||||
|
authentik externalsecret.external-secrets.io/authentik-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 49m
|
||||||
|
databases externalsecret.external-secrets.io/all-db-passwords ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
databases externalsecret.external-secrets.io/postgres-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
documents externalsecret.external-secrets.io/paperless-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
flux-system externalsecret.external-secrets.io/atlas-repo-auth ClusterSecretStore openbao-backend 1h SecretSyncedError False 3d1h
|
||||||
|
infra externalsecret.external-secrets.io/netbox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
kube-system externalsecret.external-secrets.io/proxmox-csi-config ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
media externalsecret.external-secrets.io/immich-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
media externalsecret.external-secrets.io/invidious-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
monitoring externalsecret.external-secrets.io/grafana-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
security externalsecret.external-secrets.io/vaultwarden-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
tools externalsecret.external-secrets.io/homebox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
tools externalsecret.external-secrets.io/karakeep-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
tools externalsecret.external-secrets.io/printstash-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
tools externalsecret.external-secrets.io/searxng-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
tools externalsecret.external-secrets.io/sure-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m
|
||||||
|
```
|
||||||
|
### Сетевой ingress, сертификаты TLS и L2 Fast-Path VIP:
|
||||||
|
```text
|
||||||
|
NAMESPACE NAME READY SECRET AGE
|
||||||
|
authentik certificate.cert-manager.io/auth-svo88-tls True auth-svo88-tls 27d
|
||||||
|
devices certificate.cert-manager.io/print-svo88-tls True print-svo88-tls 7d5h
|
||||||
|
documents certificate.cert-manager.io/paperless-svo88-tls True paperless-svo88-tls 26d
|
||||||
|
documents certificate.cert-manager.io/trilium-svo88-tls True trilium-svo88-tls 21d
|
||||||
|
infra certificate.cert-manager.io/dns-svo88-tls True dns-svo88-tls 26d
|
||||||
|
infra certificate.cert-manager.io/git-svo88-tls True git-svo88-tls 27d
|
||||||
|
infra certificate.cert-manager.io/netbox-svo88-tls True netbox-svo88-tls 26d
|
||||||
|
infra certificate.cert-manager.io/pkg-svo88-tls True pkg-svo88-tls 6d20h
|
||||||
|
infra certificate.cert-manager.io/pve-svo88-tls True pve-svo88-tls 26d
|
||||||
|
infra certificate.cert-manager.io/vault-svo88-tls True vault-svo88-tls 26d
|
||||||
|
infra certificate.cert-manager.io/zot-svo88-tls True zot-svo88-tls 27d
|
||||||
|
media certificate.cert-manager.io/immich-svo88-tls True immich-svo88-tls 25d
|
||||||
|
media certificate.cert-manager.io/jellyfin-svo88-tls True jellyfin-svo88-tls 21d
|
||||||
|
media certificate.cert-manager.io/metube-svo88-tls True metube-svo88-tls 21d
|
||||||
|
media certificate.cert-manager.io/yt-svo88-tls True yt-svo88-tls 21d
|
||||||
|
security certificate.cert-manager.io/vw-svo88-tls True vw-svo88-tls 31d
|
||||||
|
storage certificate.cert-manager.io/opencloud-svo88-tls True opencloud-svo88-tls 26d
|
||||||
|
tools certificate.cert-manager.io/dash-svo88-tls True dash-svo88-tls 21d
|
||||||
|
tools certificate.cert-manager.io/finance-svo88-tls True finance-svo88-tls 26d
|
||||||
|
tools certificate.cert-manager.io/homebox-svo88-tls True homebox-svo88-tls 27d
|
||||||
|
tools certificate.cert-manager.io/keep-svo88-tls True keep-svo88-tls 21d
|
||||||
|
tools certificate.cert-manager.io/printstash-svo88-tls True printstash-svo88-tls 27d
|
||||||
|
tools certificate.cert-manager.io/search-svo88-tls True search-svo88-tls 26d
|
||||||
|
tools certificate.cert-manager.io/spoolman-svo88-tls True spoolman-svo88-tls 7d5h
|
||||||
|
tools certificate.cert-manager.io/sub-store-svo88-tls True sub-store-svo88-tls 3d9h
|
||||||
|
|
||||||
|
NAMESPACE NAME CLASS HOSTS ADDRESS PORTS AGE
|
||||||
|
authentik ingress.networking.k8s.io/authentik traefik auth.svo88.space 10.0.30.200 80, 443 27d
|
||||||
|
devices ingress.networking.k8s.io/qidi-printer traefik print.svo88.space 10.0.30.200 80, 443 7d5h
|
||||||
|
documents ingress.networking.k8s.io/paperless traefik paperless.svo88.space 10.0.30.200 80, 443 26d
|
||||||
|
documents ingress.networking.k8s.io/trilium traefik trilium.svo88.space 10.0.30.200 80, 443 21d
|
||||||
|
infra ingress.networking.k8s.io/forgejo-git traefik git.svo88.space 10.0.30.200 80, 443 27d
|
||||||
|
infra ingress.networking.k8s.io/netbox traefik netbox.svo88.space 10.0.30.200 80, 443 26d
|
||||||
|
infra ingress.networking.k8s.io/openbao-vault traefik vault.svo88.space 10.0.30.200 80, 443 26d
|
||||||
|
infra ingress.networking.k8s.io/pkg-custom traefik pkg.svo88.space 10.0.30.200 80 6d20h
|
||||||
|
infra ingress.networking.k8s.io/pkg-server traefik pkg.svo88.space 10.0.30.200 80, 443 6d20h
|
||||||
|
infra ingress.networking.k8s.io/proxmox-ve traefik pve.svo88.space 10.0.30.200 80, 443 26d
|
||||||
|
infra ingress.networking.k8s.io/technitium-dns traefik dns.svo88.space 10.0.30.200 80, 443 26d
|
||||||
|
infra ingress.networking.k8s.io/zot-registry traefik zot.svo88.space 10.0.30.200 80, 443 27d
|
||||||
|
media ingress.networking.k8s.io/immich traefik immich.svo88.space 10.0.30.200 80, 443 25d
|
||||||
|
media ingress.networking.k8s.io/invidious traefik yt.svo88.space 10.0.30.200 80, 443 21d
|
||||||
|
media ingress.networking.k8s.io/jellyfin traefik jellyfin.svo88.space 10.0.30.200 80, 443 21d
|
||||||
|
media ingress.networking.k8s.io/metube traefik metube.svo88.space 10.0.30.200 80, 443 21d
|
||||||
|
security ingress.networking.k8s.io/vaultwarden traefik vw.svo88.space 10.0.30.200 80, 443 31d
|
||||||
|
storage ingress.networking.k8s.io/opencloud traefik opencloud.svo88.space 10.0.30.200 80, 443 26d
|
||||||
|
tools ingress.networking.k8s.io/dashboard traefik dash.svo88.space 10.0.30.200 80, 443 21d
|
||||||
|
tools ingress.networking.k8s.io/homebox traefik homebox.svo88.space 10.0.30.200 80, 443 27d
|
||||||
|
tools ingress.networking.k8s.io/karakeep traefik keep.svo88.space 10.0.30.200 80, 443 21d
|
||||||
|
tools ingress.networking.k8s.io/printstash traefik printstash.svo88.space 10.0.30.200 80, 443 27d
|
||||||
|
tools ingress.networking.k8s.io/searxng traefik search.svo88.space 10.0.30.200 80, 443 26d
|
||||||
|
tools ingress.networking.k8s.io/spoolman traefik spoolman.svo88.space 10.0.30.200 80, 443 7d5h
|
||||||
|
tools ingress.networking.k8s.io/sub-store traefik sub-store.svo88.space 10.0.30.200 80, 443 3d9h
|
||||||
|
tools ingress.networking.k8s.io/sure-finance traefik finance.svo88.space 10.0.30.200 80, 443 26d
|
||||||
|
|
||||||
|
NAME AGE
|
||||||
|
ciliuml2announcementpolicy.cilium.io/lan-fastpath-announcement 35d
|
||||||
|
|
||||||
|
NAME DISABLED CONFLICTING IPS AVAILABLE AGE
|
||||||
|
ciliumloadbalancerippool.cilium.io/lan-ingress-pool false False 0 35d
|
||||||
|
|
||||||
|
Traefik VIP (10.0.30.200:443) HTTP Status: 404
|
||||||
|
```
|
||||||
|
### Диски и тома (PVC / PV):
|
||||||
|
```text
|
||||||
|
NAMESPACE NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE
|
||||||
|
databases persistentvolumeclaim/postgres-data-postgres-core-0 Bound pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO proxmox-csi-db <unset> 32d
|
||||||
|
documents persistentvolumeclaim/paperless-data-pvc Bound pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO proxmox-csi-general <unset> 32d
|
||||||
|
documents persistentvolumeclaim/trilium-data-pvc Bound pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO proxmox-csi-general <unset> 21d
|
||||||
|
infra persistentvolumeclaim/netbox-media-pvc Bound pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO proxmox-csi-general <unset> 32d
|
||||||
|
infra persistentvolumeclaim/nfs-packages-pvc Bound nfs-packages-pv 200Gi RWX <unset> 6d20h
|
||||||
|
media persistentvolumeclaim/immich-db-pvc Bound pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO proxmox-csi-db <unset> 25d
|
||||||
|
media persistentvolumeclaim/immich-library-pvc Bound pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO proxmox-csi-general <unset> 25d
|
||||||
|
media persistentvolumeclaim/jellyfin-config-pvc Bound pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO proxmox-csi-general <unset> 21d
|
||||||
|
media persistentvolumeclaim/nfs-kiwix-pvc Bound nfs-kiwix-pv 200Gi ROX <unset> 32d
|
||||||
|
media persistentvolumeclaim/nfs-media-pvc Bound nfs-media-pv 1Ti RWX <unset> 21d
|
||||||
|
media persistentvolumeclaim/nfs-torrents-pvc Bound nfs-torrents-pv 500Gi RWX <unset> 32d
|
||||||
|
monitoring persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general <unset> 16d
|
||||||
|
monitoring persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general <unset> 16d
|
||||||
|
monitoring persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general <unset> 16d
|
||||||
|
security persistentvolumeclaim/vaultwarden-data-pvc Bound pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO proxmox-csi-general <unset> 32d
|
||||||
|
storage persistentvolumeclaim/nfs-opencloud-users-pvc Bound nfs-opencloud-users-pv 600Gi RWX <unset> 21d
|
||||||
|
storage persistentvolumeclaim/opencloud-data-pvc Bound pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO proxmox-csi-general <unset> 16d
|
||||||
|
tools persistentvolumeclaim/homebox-data-pvc Bound pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO proxmox-csi-general <unset> 32d
|
||||||
|
tools persistentvolumeclaim/karakeep-data-pvc Bound pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO proxmox-csi-general <unset> 21d
|
||||||
|
tools persistentvolumeclaim/karakeep-meili-pvc Bound pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO proxmox-csi-general <unset> 21d
|
||||||
|
tools persistentvolumeclaim/printstash-models-pvc Bound printstash-models-pv 100Gi RWX <unset> 32d
|
||||||
|
tools persistentvolumeclaim/spoolman-data-pvc Bound pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO proxmox-csi-general <unset> 7d5h
|
||||||
|
tools persistentvolumeclaim/sub-store-data-pvc Bound pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO proxmox-csi-general <unset> 3d9h
|
||||||
|
|
||||||
|
NAMESPACE NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS VOLUMEATTRIBUTESCLASS REASON AGE
|
||||||
|
persistentvolume/nfs-kiwix-pv 200Gi ROX Retain Bound media/nfs-kiwix-pvc <unset> 32d
|
||||||
|
persistentvolume/nfs-media-pv 1Ti RWX Retain Bound media/nfs-media-pvc <unset> 21d
|
||||||
|
persistentvolume/nfs-opencloud-users-pv 600Gi RWX Retain Bound storage/nfs-opencloud-users-pvc <unset> 21d
|
||||||
|
persistentvolume/nfs-packages-pv 200Gi RWX Retain Bound infra/nfs-packages-pvc <unset> 6d20h
|
||||||
|
persistentvolume/nfs-torrents-pv 500Gi RWX Retain Bound media/nfs-torrents-pvc <unset> 32d
|
||||||
|
persistentvolume/printstash-models-pv 100Gi RWX Retain Bound tools/printstash-models-pvc <unset> 32d
|
||||||
|
persistentvolume/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO Delete Bound documents/trilium-data-pvc proxmox-csi-general <unset> 21d
|
||||||
|
persistentvolume/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO Delete Bound storage/opencloud-data-pvc proxmox-csi-general <unset> 16d
|
||||||
|
persistentvolume/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO Delete Bound databases/postgres-data-postgres-core-0 proxmox-csi-db <unset> 32d
|
||||||
|
persistentvolume/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO Delete Bound tools/karakeep-meili-pvc proxmox-csi-general <unset> 21d
|
||||||
|
persistentvolume/pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO Delete Bound media/jellyfin-config-pvc proxmox-csi-general <unset> 21d
|
||||||
|
persistentvolume/pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO Delete Bound infra/netbox-media-pvc proxmox-csi-general <unset> 32d
|
||||||
|
persistentvolume/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO Delete Bound tools/karakeep-data-pvc proxmox-csi-general <unset> 21d
|
||||||
|
persistentvolume/pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO Delete Bound tools/sub-store-data-pvc proxmox-csi-general <unset> 3d9h
|
||||||
|
persistentvolume/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO Delete Bound security/vaultwarden-data-pvc proxmox-csi-general <unset> 32d
|
||||||
|
persistentvolume/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO Delete Bound media/immich-library-pvc proxmox-csi-general <unset> 25d
|
||||||
|
persistentvolume/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO Delete Bound tools/homebox-data-pvc proxmox-csi-general <unset> 32d
|
||||||
|
persistentvolume/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO Delete Bound monitoring/grafana-data-pvc proxmox-csi-general <unset> 16d
|
||||||
|
persistentvolume/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO Delete Bound monitoring/victoria-metrics-pvc proxmox-csi-general <unset> 16d
|
||||||
|
persistentvolume/pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO Delete Bound tools/spoolman-data-pvc proxmox-csi-general <unset> 7d5h
|
||||||
|
persistentvolume/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO Delete Bound media/immich-db-pvc proxmox-csi-db <unset> 25d
|
||||||
|
persistentvolume/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO Delete Bound monitoring/loki-data-pvc proxmox-csi-general <unset> 16d
|
||||||
|
persistentvolume/pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO Delete Bound documents/paperless-data-pvc proxmox-csi-general <unset> 32d
|
||||||
|
```
|
||||||
|
### Статус DaemonSet Proxmox-CSI Node:
|
||||||
|
```text
|
||||||
|
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
|
||||||
|
proxmox-csi-plugin-node 2 2 2 2 2 <none> 33d
|
||||||
|
```
|
||||||
|
### Статус пространства мониторинга (VictoriaMetrics & Grafana):
|
||||||
|
```text
|
||||||
|
NAME READY AGE
|
||||||
|
statefulset.apps/grafana 1/1 16d
|
||||||
|
statefulset.apps/loki 1/1 16d
|
||||||
|
statefulset.apps/victoriametrics 1/1 16d
|
||||||
|
|
||||||
|
NAME READY STATUS RESTARTS AGE
|
||||||
|
pod/grafana-0 1/1 Running 0 169m
|
||||||
|
pod/loki-0 1/1 Running 0 169m
|
||||||
|
pod/victoriametrics-0 1/1 Running 0 169m
|
||||||
|
|
||||||
|
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE
|
||||||
|
persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general <unset> 16d
|
||||||
|
persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general <unset> 16d
|
||||||
|
persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general <unset> 16d
|
||||||
|
```
|
||||||
|
### Логи ошибок Proxmox CSI Plugin (последние строки):
|
||||||
|
```text
|
||||||
|
Defaulted container "proxmox-csi-plugin-controller" out of: proxmox-csi-plugin-controller, csi-attacher, csi-provisioner, csi-resizer, liveness-probe
|
||||||
|
Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe
|
||||||
|
Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.012208 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4" nodeID="talos-worker-2"
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.131792 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb" nodeID="talos-worker-2"
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.206486 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7" nodeID="talos-worker-2"
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.277975 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2"
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.352701 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2"
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.430266 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780" nodeID="talos-worker-2"
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.509551 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2" nodeID="talos-worker-2"
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669146 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790776828491-7787-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\"}"
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669198 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2"
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.681187 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID=""
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873038 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790090280571-543-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\"}"
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873096 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2"
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.882474 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID=""
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.084431 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2"
|
||||||
|
[pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.357862 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:29.408317 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3\",\"volume_path\":\"/var/lib/kubelet/pods/b6ccf3ff-f0fc-411e-b5aa-5bbd61174578/volumes/kubernetes.io~csi/pvc-6eb8c148-32b0-45af-8945-2799d04875a3/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.576536 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.577998 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945\",\"volume_path\":\"/var/lib/kubelet/pods/f3402b78-9a95-4a5c-89c9-7535456d39e0/volumes/kubernetes.io~csi/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.887356 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.888572 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\",\"volume_path\":\"/var/lib/kubelet/pods/ce3b896c-9957-4a70-b713-265ab487c32b/volumes/kubernetes.io~csi/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.095236 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.096521 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780\",\"volume_path\":\"/var/lib/kubelet/pods/919bd05a-93f8-44e3-850e-7a8dd2a570d6/volumes/kubernetes.io~csi/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.657181 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.658240 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.659625 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.660965 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.981192 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.982711 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242\",\"volume_path\":\"/var/lib/kubelet/pods/fa9abffb-f2c3-470f-9ee7-7bd93688270c/volumes/kubernetes.io~csi/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.278791 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.280160 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd\",\"volume_path\":\"/var/lib/kubelet/pods/9ce6cd32-c936-4d17-8597-3efdb4845bc8/volumes/kubernetes.io~csi/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:03.366763 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.621786 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.622940 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.802709 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.804175 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.307289 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.308598 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf\",\"volume_path\":\"/var/lib/kubelet/pods/288247da-f98a-4d43-9f15-e882d4c7acb5/volumes/kubernetes.io~csi/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.015178 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.016475 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a\",\"volume_path\":\"/var/lib/kubelet/pods/096b52fa-6650-4996-8813-dd472343cf8e/volumes/kubernetes.io~csi/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.754757 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.755939 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.979195 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.980398 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.775598 1 node.go:524] "NodeGetCapabilities: called"
|
||||||
|
[pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.776955 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}"
|
||||||
|
```
|
||||||
|
### Синхронизация GitOps (FluxCD):
|
||||||
|
```text
|
||||||
|
NAMESPACE NAME URL AGE READY STATUS
|
||||||
|
flux-system gitrepository.source.toolkit.fluxcd.io/atlas-repo http://10.0.10.13:3000/atlas/atlas.git 33d True stored artifact for revision 'master@sha1:10fbe14ef463bef034856278733f9ad3155cd866'
|
||||||
|
|
||||||
|
NAMESPACE NAME AGE READY STATUS
|
||||||
|
flux-system kustomization.kustomize.toolkit.fluxcd.io/apps-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866
|
||||||
|
flux-system kustomization.kustomize.toolkit.fluxcd.io/infra-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866
|
||||||
|
|
||||||
|
NAMESPACE NAME AGE READY STATUS
|
||||||
|
cert-manager helmrelease.helm.toolkit.fluxcd.io/cert-manager 33d True Helm upgrade succeeded for release cert-manager/cert-manager.v2 with chart cert-manager@v1.21.3
|
||||||
|
external-secrets helmrelease.helm.toolkit.fluxcd.io/external-secrets 33d True Helm upgrade succeeded for release external-secrets/external-secrets.v5 with chart external-secrets@2.14.0
|
||||||
|
kube-system helmrelease.helm.toolkit.fluxcd.io/cilium 33d True Helm upgrade succeeded for release kube-system/cilium.v6 with chart cilium@1.15.5
|
||||||
|
kube-system helmrelease.helm.toolkit.fluxcd.io/proxmox-csi-plugin 33d True Helm upgrade succeeded for release kube-system/proxmox-csi-plugin.v4 with chart proxmox-csi-plugin@0.5.12
|
||||||
|
```
|
||||||
|
### Проблемные поды (Non-Running):
|
||||||
|
```text
|
||||||
|
NAMESPACE NAME READY STATUS RESTARTS AGE
|
||||||
|
databases postgres-init-databases-4lk9r 0/1 Completed 0 169m
|
||||||
|
```
|
||||||
|
### Последние события-предупреждения (Warning Events):
|
||||||
|
```text
|
||||||
|
NAMESPACE LAST SEEN TYPE REASON OBJECT MESSAGE
|
||||||
|
traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use
|
||||||
|
traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use
|
||||||
|
traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use
|
||||||
|
traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use
|
||||||
|
monitoring 51m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-7tjsw" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
|
||||||
|
monitoring 34m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-t6n9v" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
|
||||||
|
monitoring 17m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-rsbtk" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
|
||||||
|
flux-system 16m Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider
|
||||||
|
flux-system 3m34s Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider
|
||||||
|
monitoring 73s Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-xsj4k" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods")
|
||||||
|
```
|
||||||
|
### Реальный объем данных OpenCloud (/var/lib/opencloud-users):
|
||||||
|
```text
|
||||||
|
331.7G /var/lib/opencloud-users
|
||||||
|
```
|
||||||
|
</file>
|
||||||
|
|
||||||
</files>
|
</files>
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue