This file is a merged representation of a subset of the codebase, containing specifically included files, combined into a single document by Repomix. The content has been processed where empty lines have been removed. This section contains a summary of this file. This file contains a packed representation of a subset of the repository's contents that is considered the most important context. It is designed to be easily consumable by AI systems for analysis, code review, or other automated processes. The content is organized as follows: 1. This summary section 2. Repository information 3. Directory structure 4. Repository files (if enabled) 5. Multiple file entries, each consisting of: - File path as an attribute - Full contents of the file - This file should be treated as read-only. Any changes should be made to the original repository files, not this packed version. - When processing this file, use the file path to distinguish between different files in the repository. - Be aware that this file may contain sensitive information. Handle it with the same level of security as you would the original repository. - Some files may have been excluded based on .gitignore rules and Repomix's configuration - Binary files are not included in this packed representation. Please refer to the Repository Structure section for a complete list of file paths, including binary files - Only files matching these patterns are included: state/snapshots/** - Files matching default ignore patterns are excluded - Empty lines have been removed from all files - Files are sorted by Git change count (files with more changes are at the bottom) state/ snapshots/ 00_workstation.md 01_pve.md 02_vps.md 03_vyos.md 04_tier0.md 05_k8s.md This section contains the contents of the repository's files. # Sovereign C2 Runtime: 00_workstation **Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git") ## 0. Рабочая станция администратора (Operator Environment) ### Инфраструктурные SSH-хосты (~/.ssh/config): ```text Host proxmox pve0 Hostname 192.168.1.177 Port 22 User root Host vyos vyos_router Hostname 192.168.1.2 Port 22 User vyos Host 10.0.* dns0 vault0 git0 storage0 registry0 User root StrictHostKeyChecking no UserKnownHostsFile /dev/null LogLevel ERROR Host fin21 Hostname 153.76.194.24 Port 22 User atlas Host incserv Hostname 31.76.100.166 Port 8765 User root Host router Hostname 192.168.1.1 Port 1488 User root Host proxmox pve0 vyos vyos_router fin21 10.0.* IdentityFile /dev/shm/.atlas_core IdentitiesOnly yes ``` ### Рабочие алиасы и функции оператора (Active Workflow Aliases): ```bash # Маркер # >>> ATLAS C2 WORKFLOW >>> не найден в ~/.bashrc ``` ### Статус RAM-кэша секретов (/dev/shm/.atlas_secrets_cache): ```text Размер: 1058 байт | Права: 600 | Создан: 2026-10-25 18:08:15.915202821 +0300 ``` ### Проверка Git Credential Helper (git.svo88.space): ```text Username: atlas Password: [PRESENT in RAM] ``` ### Ядро, память, ZRAM и параметры Coredump: ```text Kernel: 7.2.5-3-omarchy Swapon: NAME TYPE SIZE USED PRIO /swap/swapfile file 13.5G 0B 0 /dev/zram0 partition 13.5G 358M 100 NAME ALGORITHM DISKSIZE DATA COMPR TOTAL STREAMS MOUNTPOINT /dev/zram0 zstd 13.5G 331.5M 89.6M 95M [SWAP] Coredump config: #Storage=external #ProcessSizeMax=32G ``` ### Токены безопасности и ключи в ssh-agent: ```text Active SSH Agent keys: The agent has no identities. YubiKey / FIDO2 Status: Device type: YubiKey 5 Nano Serial number: 29508635 Firmware version: 5.7.1 Form factor: Nano (USB-A) Enabled USB interfaces: OTP, FIDO, CCID Applications Yubico OTP Enabled FIDO U2F Enabled FIDO2 Enabled OATH Enabled PIV Enabled OpenPGP Enabled YubiHSM Auth Enabled ``` ### Зеркала пакетов Pacman (Mirrorlist): ```text /etc/pacman.conf:[options] /etc/pacman.conf:[core] /etc/pacman.conf:[extra] /etc/pacman.conf:[multilib] /etc/pacman.conf:[omarchy] /etc/pacman.conf:Server = https://pkgs.omarchy.org/stable/$arch /etc/pacman.d/mirrorlist:Server = https://stable-mirror.omarchy.org/$repo/os/$arch /etc/pacman.d/mirrorlist.bak:Server = https://mirror.omarchy.org/$repo/os/$arch /etc/pacman.d/mirrorlist.omarchy-upgrade-to-quattro.20260905155315.bak:Server = https://mirror.omarchy.org/$repo/os/$arch Нет данных о зеркалах ``` ### Маршрутизация на хосте (Routing to C2): ```text default via 192.168.1.2 dev enp34s0 proto dhcp src 192.168.1.247 metric 100 10.0.0.0/16 via 192.168.1.2 dev enp34s0 proto static metric 100 192.168.1.0/24 dev enp34s0 proto kernel scope link src 192.168.1.247 metric 100 ``` ### Версии локальных инструментов: ```text OpenTofu: OpenTofu v1.12.1 Kubectl: gitVersion: v1.36.4 Talosctl: Client: Talos v1.14.0 ``` ### Состояние локального Git-репозитория (SSOT Source): ```text fatal: not a git repository (or any parent up to mount point /) Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set). fatal: not a git repository (or any parent up to mount point /) Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set). Последний коммит: Remote URL: no remote ``` --- # Sovereign C2 Runtime: 01_pve **Срез:** 2026-10-25 15:20:06 UTC | **Git:** master@10fbe14 ("git") ## 1. Гипервизор Proxmox VE (192.168.1.177) ### Память хоста, Uptime и Температура CPU: ```text 18:20:07 up 3:30, 1 user, load average: 1.59, 1.90, 1.69 total used free shared buff/cache available Mem: 37Gi 30Gi 5.8Gi 75Mi 1.3Gi 6.6Gi Swap: 0B 0B 0B ``` ### Здоровье физических дисков (SMART): ```text /dev/sda: SMART overall-health self-assessment test result: PASSED /dev/sdb: SMART overall-health self-assessment test result: PASSED /dev/sdc: SMART overall-health self-assessment test result: PASSED /dev/sdd: SMART overall-health self-assessment test result: PASSED /dev/sde: SMART overall-health self-assessment test result: PASSED /dev/sdf: SMART overall-health self-assessment test result: PASSED ``` ### Статус шифрования ZFS (Encryption & Keys): ```text NAME PROPERTY VALUE SOURCE astra encryption aes-256-gcm - astra keystatus available - astra keyformat raw - astra keylocation file:///etc/zfs/keys/astra.key local terra encryption aes-256-gcm - terra keystatus available - terra keyformat raw - terra keylocation file:///etc/zfs/keys/terra.key local ``` ### Здоровье и емкость ZFS-пулов: ```text NAME SIZE ALLOC FREE FRAG CAP HEALTH astra 2.78T 540G 2.25T 9% 18% ONLINE terra 1.81T 345G 1.48T 0% 18% ONLINE NAME USED AVAIL REFER MOUNTPOINT astra 360G 1.44T 55.0M /astra astra/vm-100-cloudinit 128K 1.44T 128K - astra/vm-100-disk-0 1.06G 1.44T 1.06G - astra/vm-201-disk-0 1.38G 1.44T 1.38G - astra/vm-202-disk-0 14.8G 1.44T 14.8G - astra/vm-203-disk-0 20.4G 1.44T 20.4G - astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 27.2M 1.44T 27.2M - astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 8.61M 1.44T 8.61M - astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 203M 1.44T 203M - astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 714K 1.44T 714K - astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 5.13M 1.44T 5.13M - astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 884K 1.44T 884K - astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 1.05M 1.44T 1.05M - astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 416K 1.44T 416K - astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 7.02M 1.44T 7.02M - astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 320G 1.44T 320G - astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 970K 1.44T 970K - astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 375M 1.44T 375M - astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 1.33M 1.44T 1.33M - astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 2.54M 1.44T 2.54M - astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 704M 1.44T 704M - astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 14.5M 1.44T 14.5M - astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 20.7M 1.44T 20.7M - terra 345G 1.42T 12.6G /terra terra/media 248K 1.42T 248K /terra/media terra/s3 192K 1.42T 192K /terra/s3 terra/vault 333G 1.42T 333G /terra/vault ``` ### Физическая емкость каталогов на /terra: ```text 68K /terra/media 4.6M /terra/models 171K /terra/packages 13G /terra/registry 8.5K /terra/s3 4.3M /terra/torrents 333G /terra/vault ``` ### Блочные устройства хоста и тома ZVOL (lsblk): ```text NAME FSTYPE SIZE MOUNTPOINTS loop0 ext4 4G loop1 ext4 4G loop2 ext4 2G loop3 ext4 8G loop4 ext4 8G sda 1.8T ├─sda1 zfs_member 1.8T └─sda9 8M sdb 953.9G ├─sdb1 zfs_member 953.9G └─sdb9 8M sdc 476.9G ├─sdc1 vfat 976M /boot/efi ├─sdc2 linux_raid_member 977M │ └─md0 ext4 976M /boot └─sdc3 linux_raid_member 445.3G └─md1 crypto_LUKS 445.1G └─md1_crypt ext4 445.1G / sdd 953.9G ├─sdd1 zfs_member 953.9G └─sdd9 8M sde 447.1G ├─sde1 vfat 976M ├─sde2 linux_raid_member 977M │ └─md0 ext4 976M /boot └─sde3 linux_raid_member 445.2G └─md1 crypto_LUKS 445.1G └─md1_crypt ext4 445.1G / sdf 953.9G ├─sdf1 zfs_member 953.9G └─sdf9 8M zd0 ext4 2G zd16 ext4 10G zd32 ext4 10G zd48 ext4 20G zd64 iso9660 4M zd80 ext4 5G zd96 ext4 5G zd112 ext4 5G zd128 ext4 5G zd144 100G ├─zd144p1 vfat 100M ├─zd144p2 1M ├─zd144p3 xfs 2G ├─zd144p4 1M ├─zd144p5 xfs 100M └─zd144p6 xfs 97.8G zd160 ext4 30G zd176 ext4 30G zd192 ext4 400G zd208 ext4 100G zd224 100G ├─zd224p1 vfat 100M ├─zd224p2 1M ├─zd224p3 xfs 2G ├─zd224p4 1M ├─zd224p5 xfs 100M └─zd224p6 xfs 97.8G zd240 10G ├─zd240p1 1M ├─zd240p2 vfat 256M └─zd240p3 ext4 9G zd256 ext4 100G zd272 20G ├─zd272p1 vfat 100M ├─zd272p2 1M ├─zd272p3 xfs 2G ├─zd272p4 1M ├─zd272p5 xfs 100M └─zd272p6 xfs 17.8G zd288 ext4 20G zd304 ext4 15G zd320 ext4 5G zd336 ext4 30G ``` ### Виртуальные диски K8s и ВМ (ZVOLs на astra): ```text NAME VOLSIZE USED REFER astra/vm-100-cloudinit 4M 128K 128K astra/vm-100-disk-0 10G 1.06G 1.06G astra/vm-201-disk-0 20G 1.38G 1.38G astra/vm-202-disk-0 100G 14.8G 14.8G astra/vm-203-disk-0 100G 20.4G 20.4G astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10G 27.2M 27.2M astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100G 8.61M 8.61M astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100G 203M 203M astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5G 714K 714K astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20G 5.13M 5.13M astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10G 884K 884K astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15G 1.05M 1.05M astra/vm-9999-pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2G 416K 416K astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5G 7.02M 7.02M astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400G 320G 320G astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5G 970K 970K astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5G 375M 375M astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20G 1.33M 1.33M astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5G 2.54M 2.54M astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30G 704M 704M astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30G 14.5M 14.5M astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30G 20.7M 20.7M ``` ### Модули ядра (nfsd, zfs): ```text zfs 6262784 44 nfsd 1011712 3 ``` ### Теги сетевых карт ВМ 100 (VyOS) в Proxmox: ```text net0: virtio=BC:24:11:DC:6D:EC,bridge=vmbr0,firewall=0 net1: virtio=BC:24:11:3F:CB:C9,bridge=vmbr0,firewall=0,tag=20 net2: virtio=BC:24:11:EA:32:2F,bridge=vmbr0,firewall=0,tag=30 net3: virtio=BC:24:11:59:E8:8D,bridge=vmbr0,firewall=0,tag=10 ``` ### Точки монтирования LXC-контейнеров (/etc/pve/lxc/*.conf): ```text /etc/pve/lxc/101.conf:mp0: /astra/data/dns0,mp=/opt/technitium/dns/config /etc/pve/lxc/102.conf:mp0: /astra/data/vault0,mp=/var/lib/bao/data /etc/pve/lxc/103.conf:mp0: /astra/data/git0,mp=/var/lib/forgejo /etc/pve/lxc/104.conf:mp0: /terra/media,mp=/media /etc/pve/lxc/104.conf:mp1: /terra/torrents,mp=/torrents /etc/pve/lxc/104.conf:mp2: /terra/vault,mp=/backups /etc/pve/lxc/104.conf:mp3: /terra/models,mp=/models /etc/pve/lxc/104.conf:mp4: /terra/packages,mp=/packages /etc/pve/lxc/105.conf:mp0: /terra/registry,mp=/mnt/registry ``` ### Флаги автостарта ВМ и Контейнеров (onboot): ```text /etc/pve/qemu-server/100.conf:onboot: 1 /etc/pve/qemu-server/201.conf:onboot: 1 /etc/pve/qemu-server/202.conf:onboot: 1 /etc/pve/qemu-server/203.conf:onboot: 1 /etc/pve/lxc/101.conf:onboot: 1 /etc/pve/lxc/102.conf:onboot: 1 /etc/pve/lxc/103.conf:onboot: 1 /etc/pve/lxc/104.conf:onboot: 1 /etc/pve/lxc/105.conf:onboot: 1 ``` ### Виртуальные машины (QEMU) и Контейнеры (LXC): ```text VMID NAME STATUS MEM(MB) BOOTDISK(GB) PID 100 vyos-router running 2048 10.00 2594 201 talos-master-1 running 2560 20.00 2698 202 talos-worker-1 running 10240 100.00 3869 203 talos-worker-2 running 10240 100.00 4919 VMID Status Lock Name 101 running dns0 102 running vault0 103 running git0 104 running storage0 105 running registry0 ``` --- # Sovereign C2 Runtime: 02_vps **Срез:** 2026-10-25 15:20:12 UTC | **Git:** master@10fbe14 ("git") ## 2. Периметр: Белый VPS (Host: fin21, IP: 153.76.194.24) ### WireGuard wg0 на VPS: ```text interface: wg0 public key: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY= private key: (hidden) listening port: 51820 peer: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4= endpoint: 45.93.6.172:46777 allowed ips: 10.8.0.2/32, 10.0.30.200/32 latest handshake: 3 hours, 28 minutes, 44 seconds ago transfer: 64.06 MiB received, 54.22 MiB sent ``` ### Статус системных сервисов (Edge Stack): ```text WireGuard: active | HAProxy: active | Xray: active | Nginx: active ``` ### Прослушиваемые сокеты (Ports 80, 443, 4443, 8443, 51820): ```text udp UNCONN 0 0 0.0.0.0:51820 0.0.0.0:* udp UNCONN 0 0 [::]:51820 [::]:* tcp LISTEN 0 4096 127.0.0.1:4443 0.0.0.0:* users:(("haproxy",pid=862,fd=10)) tcp LISTEN 0 511 127.0.0.1:8443 0.0.0.0:* users:(("nginx",pid=739,fd=5),("nginx",pid=735,fd=5)) tcp LISTEN 0 4096 0.0.0.0:80 0.0.0.0:* users:(("haproxy",pid=862,fd=9)) tcp LISTEN 0 4096 *:443 *:* users:(("xray",pid=690,fd=3)) ``` ### Тест аварийной заглушки Nginx (127.0.0.1:8443): ```text Atlas Sovereign Home Server is currently offline for maintenance. ``` ### Конфигурация SSH-демона (sshd runtime): ```text permitrootlogin no passwordauthentication yes ``` --- # Sovereign C2 Runtime: 03_vyos **Срез:** 2026-10-25 15:20:15 UTC | **Git:** master@10fbe14 ("git") ## 3. Маршрутизатор VyOS (192.168.1.2) ### Сетевые интерфейсы и L2-транк (VLANs 10, 20, 30): ```text Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down Interface IP Address MAC VRF MTU S/L Description ----------- -------------- ----------------- ------- ----- ----- ------------------- eth0 192.168.1.2/24 bc:24:11:dc:6d:ec default 1500 u/u WAN_TRUNK eth1 10.0.20.1/24 bc:24:11:3f:cb:c9 default 1500 u/u K8S eth2 10.0.10.1/24 bc:24:11:59:e8:8d default 1500 u/u TIER0 eth3 10.0.30.1/24 bc:24:11:ea:32:2f default 1500 u/u LAN_CLIENTS lo 127.0.0.1/8 00:00:00:00:00:00 default 65536 u/u ::1/128 tun0 172.19.0.1/30 n/a default 65535 u/u wg0 10.8.0.2/24 n/a default 1420 u/u TUNNEL_TO_VPS_FIN21 ``` ### ARP-таблица K8s-интерфейса eth1 (проверка связности с нодами): ```text 10.0.20.11 lladdr bc:24:11:12:c5:1b REACHABLE 10.0.20.12 lladdr bc:24:11:ef:1a:d4 STALE 10.0.20.10 lladdr bc:24:11:71:b6:82 REACHABLE fe80::be24:11ff:fe12:c51b lladdr bc:24:11:12:c5:1b STALE fe80::be24:11ff:feef:1ad4 lladdr bc:24:11:ef:1a:d4 STALE fe80::be24:11ff:fe71:b682 lladdr bc:24:11:71:b6:82 STALE ``` ### DHCP-сервер и выданные лизы (Options 3, 6): ```text IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname Origin ------------ ----------------- ------- ------------------- ------------------- ----------- ----------- -------------- -------- 10.0.20.10 bc:24:11:71:b6:82 active 2026-10-25 11:51:32 2026-10-26 11:51:32 20:31:16 K8S talos-master-1 local 10.0.20.11 bc:24:11:12:c5:1b active 2026-10-25 12:29:01 2026-10-26 12:29:01 21:08:45 K8S talos-worker-1 local 10.0.20.12 bc:24:11:ef:1a:d4 active 2026-10-25 12:29:04 2026-10-26 12:29:04 21:08:48 K8S talos-worker-2 local 10.0.30.100 bc:24:11:eb:38:63 active 2026-10-25 12:29:02 2026-10-26 12:29:02 21:08:46 LAN_CLIENTS talos-worker-1 local 10.0.30.101 bc:24:11:bb:00:d3 active 2026-10-25 12:29:05 2026-10-26 12:29:05 21:08:49 LAN_CLIENTS talos-worker-2 local ``` ### Перехват DNS через DNAT (Rule 53 -> 127.0.0.42:53): ```text Rule Source Destination Proto In-Int Translation ------ --------- ------------- -------- -------- ------------- 53 0.0.0.0/0 0.0.0.0/0 TCP, UDP LAN 127.0.0.42 sport any dport 53 port 53 ``` ### Контейнеры маршрутизатора (Sing-Box & Zapret2): ```text CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 9217a0a6ac83 ghcr.io/sagernet/sing-box:latest run -c /etc/sing-... 3 hours ago Up 3 hours sing-box c7e27e9bb9fc docker.io/vernette/ss-zapret2:latest /etc/zapret/run.s... 3 hours ago Up 3 hours 1080/tcp, 8388/tcp zapret2 ``` ### Наличие /dev/net/tun внутри контейнера sing-box: ```text crw-rw-rw- 1 root root 10, 200 Oct 25 11:51 /dev/net/tun ``` ### Задержка VLESS-канала через Clash API (Main-1-out -> fin21): ```text {"type": "VLESS", "name": "Main-1-out", "udp": true, "history": [{"time":"2026-10-25T15:19:30.52662628Z","delay":122}]}``` ### Статус таймера автосинхронизации Git (singbox-sync): ```text ● singbox-sync.timer - Periodic Sing-Box Config Git Sync Timer Loaded: loaded (/etc/systemd/system/singbox-sync.timer; enabled; preset: enabled) Active: active (waiting) since Sun 2026-10-25 11:51:13 UTC; 3h 29min ago Trigger: Sun 2026-10-25 15:20:23 UTC; 6s left Triggers: ● singbox-sync.service Oct 25 11:51:13 vyos-router systemd[1]: Started Periodic Sing-Box Config Git Sync Timer. Oct 25 15:19:23 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully. Oct 25 15:19:23 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync. Oct 25 15:19:53 vyos-router systemd[1]: Starting Automated Sing-Box Config Git Sync... Oct 25 15:19:54 vyos-router systemd[1]: singbox-sync.service: Deactivated successfully. Oct 25 15:19:54 vyos-router systemd[1]: Finished Automated Sing-Box Config Git Sync. ``` ### Статус WireGuard туннеля wg0 и пинг до VPS: ```text interface: wg0 public key: yYiGIZK3nTqxmMm6OXDkeniwtsAJkM6ozcGibexitR4= private key: (hidden) listening port: 34756 peer: tS0m/x/dVCs8+N+mtSH3PENWpEUymJDiuPNWrCySMWY= endpoint: 153.76.194.24:51820 allowed ips: 10.8.0.0/24 latest handshake: 3 hours, 28 minutes, 47 seconds ago transfer: 1.12 KiB received, 282.34 KiB sent persistent keepalive: every 25 seconds VyOS или туннель недоступен ``` ### Таблица маршрутизации (show ip route): ```text Codes: K - kernel route, C - connected, L - local, S - static, R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, f - OpenFabric, t - Table-Direct, > - selected route, * - FIB route, q - queued, r - rejected, b - backup t - trapped, o - offload failure IPv4 unicast VRF default: S>* 0.0.0.0/0 [1/0] via 192.168.1.1, eth0, weight 1, 03:28:52 C>* 10.0.10.0/24 is directly connected, eth2, weight 1, 03:28:58 L>* 10.0.10.1/32 is directly connected, eth2, weight 1, 03:28:58 C>* 10.0.20.0/24 is directly connected, eth1, weight 1, 03:28:58 L>* 10.0.20.1/32 is directly connected, eth1, weight 1, 03:28:58 C>* 10.0.30.0/24 is directly connected, eth3, weight 1, 03:28:58 L>* 10.0.30.1/32 is directly connected, eth3, weight 1, 03:28:58 C>* 10.8.0.0/24 is directly connected, wg0, weight 1, 03:28:57 L>* 10.8.0.2/32 is directly connected, wg0, weight 1, 03:28:57 C>* 172.19.0.0/30 is directly connected, tun0, weight 1, 03:28:55 L>* 172.19.0.1/32 is directly connected, tun0, weight 1, 03:28:55 C>* 192.168.1.0/24 is directly connected, eth0, weight 1, 03:28:58 L>* 192.168.1.2/32 is directly connected, eth0, weight 1, 03:28:58 ``` --- # Sovereign C2 Runtime: 04_tier0 **Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git") ## 4. Сервисы Tier-0 (Air-Gap фундамент) ### Technitium DNS (10.0.10.11:53): * **Внутренний домен (*.svo88.space -> 10.0.30.200):** 10.0.30.200 * **Внешний резолв (google.com):** 173.194.220.100 ### OpenBao Vault (10.0.10.12:8200): ```json {"type":"shamir","initialized":true,"sealed":false,"t":1,"n":1,"progress":0,"nonce":"","version":"2.0.1","build_date":"2024-09-03T19:57:34Z","migration":false,"cluster_name":"vault-cluster-74026fc7","cluster_id":"79b6d270-a6b1-b082-39be-aeb24d8841f5","recovery_seal":false,"storage_type":"file"} ``` ### Zot OCI Registry (10.0.10.15:5000): ```json {"repositories":["alpine","docker.io/getmeili/meilisearch","docker.io/grafana/loki","docker.io/jellyfin/jellyfin","docker.io/library/alpine","docker.io/library/busybox","docker.io/library/nginx","docker.io/library/postgres","docker.io/library/redis","docker.io/library/traefik","docker.io/netboxcommunity/netbox","docker.io/opencloudeu/opencloud-rolling","docker.io/owncloud/ocis","docker.io/searxng/searxng","docker.io/vaultwarden/server","docker.io/victoriametrics/victoria-metrics","docker.io/xream/sub-store","ghcr.io/anatol/pacoloco","ghcr.io/donkie/spoolman","ghcr.io/external-secrets/external-secrets","ghcr.io/fluxcd/helm-controller","ghcr.io/fluxcd/image-automation-controller","ghcr.io/fluxcd/image-reflector-controller","ghcr.io/fluxcd/kustomize-controller","ghcr.io/fluxcd/notification-controller","ghcr.io/fluxcd/source-controller","ghcr.io/fluxcd/source-watcher","ghcr.io/goauthentik/server","ghcr.io/immich-app/postgres","ghcr.io/karakeep-app/karakeep","ghcr.io/karakeep-app/karakeep-chrome","ghcr.io/kiwix/kiwix-serve","ghcr.io/sergelogvinov/proxmox-csi-controller","ghcr.io/sergelogvinov/proxmox-csi-node","ghcr.io/siderolabs/kubelet","ghcr.io/sysadminsmedia/homebox","ghcr.io/triliumnext/notes","ghcr.io/triliumnext/trilium","ghcr.io/we-promise/sure","ghcr.io/xiao-villamor/printstash","k8s.io/coredns/coredns","k8s.io/kube-apiserver","k8s.io/kube-controller-manager","k8s.io/kube-proxy","k8s.io/kube-scheduler","k8s.io/sig-storage/csi-attacher","k8s.io/sig-storage/csi-provisioner","k8s.io/sig-storage/csi-resizer","k8s.io/sig-storage/livenessprobe","quay.io/invidious/invidious","quay.io/invidious/invidious-companion","quay.io/jetstack/cert-manager-cainjector"]}``` ### Forgejo GitOps Server (10.0.10.13:3000): ```json {"version":"7.0.4+gitea-1.21.11"} ``` ### Ядерный NFS nfsd (storage0 - 10.0.10.14): ```text == Активные экспорты ядра (exportfs): /media 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) /torrents 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) /backups 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) /models 127.0.0.1(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) /packages 127.0.0.1(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) /media 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) /torrents 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) /backups 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) /models 10.0.0.0/16(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) /packages 10.0.0.0/16(async,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash) == Емкость смонтированных ZFS-датасетов: Filesystem Size Used Available Use% Mounted on terra/media 1.4T 1.0M 1.4T 0% /media terra 1.4T 12.6G 1.4T 1% /torrents terra/vault 1.7T 332.6G 1.4T 19% /backups terra 1.4T 12.6G 1.4T 1% /torrents == Права точки монтирования OpenCloud: drwxrws--- 5 1000 1000 5 Oct 25 12:31 /backups/opencloud-users ``` --- # Sovereign C2 Runtime: 05_k8s **Срез:** 2026-10-25 15:20:22 UTC | **Git:** master@10fbe14 ("git") ## 5. Kubernetes Платформа & Нагрузки ### Участники кластера Talos (OS-level): ```text 10.0.20.10: error getting server version: error constructing client: failed to create client connection: failed to resolve configuration context: talos config file is empty Talos API недоступен ``` ### Ноды кластера K8s: ```text NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME talos-1il-vwa Ready control-plane 3h26m v1.37.0 10.0.20.10 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4 talos-worker-1 Ready 171m v1.37.0 10.0.20.11 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4 talos-worker-2 Ready 170m v1.37.0 10.0.20.12 Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4 ``` ### Топологические лейблы нод (Proxmox-CSI topology): ```text NAME STATUS ROLES AGE VERSION ZONE REGION talos-1il-vwa Ready control-plane 3h26m v1.37.0 talos-worker-1 Ready 171m v1.37.0 pve0 atlas talos-worker-2 Ready 170m v1.37.0 pve0 atlas ``` ### Статус ExternalSecrets (Синхронизация из Vault): ```text NAME AGE STATUS CAPABILITIES READY clustersecretstore.external-secrets.io/openbao-backend 33d Valid ReadWrite True NAMESPACE NAME STORETYPE STORE REFRESH INTERVAL STATUS READY LAST SYNC authentik externalsecret.external-secrets.io/authentik-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 49m databases externalsecret.external-secrets.io/all-db-passwords ClusterSecretStore openbao-backend 1h SecretSynced True 20m databases externalsecret.external-secrets.io/postgres-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m documents externalsecret.external-secrets.io/paperless-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m flux-system externalsecret.external-secrets.io/atlas-repo-auth ClusterSecretStore openbao-backend 1h SecretSyncedError False 3d1h infra externalsecret.external-secrets.io/netbox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m kube-system externalsecret.external-secrets.io/proxmox-csi-config ClusterSecretStore openbao-backend 1h SecretSynced True 20m media externalsecret.external-secrets.io/immich-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m media externalsecret.external-secrets.io/invidious-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m monitoring externalsecret.external-secrets.io/grafana-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m security externalsecret.external-secrets.io/vaultwarden-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m tools externalsecret.external-secrets.io/homebox-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m tools externalsecret.external-secrets.io/karakeep-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m tools externalsecret.external-secrets.io/printstash-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m tools externalsecret.external-secrets.io/searxng-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m tools externalsecret.external-secrets.io/sure-credentials ClusterSecretStore openbao-backend 1h SecretSynced True 20m ``` ### Сетевой ingress, сертификаты TLS и L2 Fast-Path VIP: ```text NAMESPACE NAME READY SECRET AGE authentik certificate.cert-manager.io/auth-svo88-tls True auth-svo88-tls 27d devices certificate.cert-manager.io/print-svo88-tls True print-svo88-tls 7d5h documents certificate.cert-manager.io/paperless-svo88-tls True paperless-svo88-tls 26d documents certificate.cert-manager.io/trilium-svo88-tls True trilium-svo88-tls 21d infra certificate.cert-manager.io/dns-svo88-tls True dns-svo88-tls 26d infra certificate.cert-manager.io/git-svo88-tls True git-svo88-tls 27d infra certificate.cert-manager.io/netbox-svo88-tls True netbox-svo88-tls 26d infra certificate.cert-manager.io/pkg-svo88-tls True pkg-svo88-tls 6d20h infra certificate.cert-manager.io/pve-svo88-tls True pve-svo88-tls 26d infra certificate.cert-manager.io/vault-svo88-tls True vault-svo88-tls 26d infra certificate.cert-manager.io/zot-svo88-tls True zot-svo88-tls 27d media certificate.cert-manager.io/immich-svo88-tls True immich-svo88-tls 25d media certificate.cert-manager.io/jellyfin-svo88-tls True jellyfin-svo88-tls 21d media certificate.cert-manager.io/metube-svo88-tls True metube-svo88-tls 21d media certificate.cert-manager.io/yt-svo88-tls True yt-svo88-tls 21d security certificate.cert-manager.io/vw-svo88-tls True vw-svo88-tls 31d storage certificate.cert-manager.io/opencloud-svo88-tls True opencloud-svo88-tls 26d tools certificate.cert-manager.io/dash-svo88-tls True dash-svo88-tls 21d tools certificate.cert-manager.io/finance-svo88-tls True finance-svo88-tls 26d tools certificate.cert-manager.io/homebox-svo88-tls True homebox-svo88-tls 27d tools certificate.cert-manager.io/keep-svo88-tls True keep-svo88-tls 21d tools certificate.cert-manager.io/printstash-svo88-tls True printstash-svo88-tls 27d tools certificate.cert-manager.io/search-svo88-tls True search-svo88-tls 26d tools certificate.cert-manager.io/spoolman-svo88-tls True spoolman-svo88-tls 7d5h tools certificate.cert-manager.io/sub-store-svo88-tls True sub-store-svo88-tls 3d9h NAMESPACE NAME CLASS HOSTS ADDRESS PORTS AGE authentik ingress.networking.k8s.io/authentik traefik auth.svo88.space 10.0.30.200 80, 443 27d devices ingress.networking.k8s.io/qidi-printer traefik print.svo88.space 10.0.30.200 80, 443 7d5h documents ingress.networking.k8s.io/paperless traefik paperless.svo88.space 10.0.30.200 80, 443 26d documents ingress.networking.k8s.io/trilium traefik trilium.svo88.space 10.0.30.200 80, 443 21d infra ingress.networking.k8s.io/forgejo-git traefik git.svo88.space 10.0.30.200 80, 443 27d infra ingress.networking.k8s.io/netbox traefik netbox.svo88.space 10.0.30.200 80, 443 26d infra ingress.networking.k8s.io/openbao-vault traefik vault.svo88.space 10.0.30.200 80, 443 26d infra ingress.networking.k8s.io/pkg-custom traefik pkg.svo88.space 10.0.30.200 80 6d20h infra ingress.networking.k8s.io/pkg-server traefik pkg.svo88.space 10.0.30.200 80, 443 6d20h infra ingress.networking.k8s.io/proxmox-ve traefik pve.svo88.space 10.0.30.200 80, 443 26d infra ingress.networking.k8s.io/technitium-dns traefik dns.svo88.space 10.0.30.200 80, 443 26d infra ingress.networking.k8s.io/zot-registry traefik zot.svo88.space 10.0.30.200 80, 443 27d media ingress.networking.k8s.io/immich traefik immich.svo88.space 10.0.30.200 80, 443 25d media ingress.networking.k8s.io/invidious traefik yt.svo88.space 10.0.30.200 80, 443 21d media ingress.networking.k8s.io/jellyfin traefik jellyfin.svo88.space 10.0.30.200 80, 443 21d media ingress.networking.k8s.io/metube traefik metube.svo88.space 10.0.30.200 80, 443 21d security ingress.networking.k8s.io/vaultwarden traefik vw.svo88.space 10.0.30.200 80, 443 31d storage ingress.networking.k8s.io/opencloud traefik opencloud.svo88.space 10.0.30.200 80, 443 26d tools ingress.networking.k8s.io/dashboard traefik dash.svo88.space 10.0.30.200 80, 443 21d tools ingress.networking.k8s.io/homebox traefik homebox.svo88.space 10.0.30.200 80, 443 27d tools ingress.networking.k8s.io/karakeep traefik keep.svo88.space 10.0.30.200 80, 443 21d tools ingress.networking.k8s.io/printstash traefik printstash.svo88.space 10.0.30.200 80, 443 27d tools ingress.networking.k8s.io/searxng traefik search.svo88.space 10.0.30.200 80, 443 26d tools ingress.networking.k8s.io/spoolman traefik spoolman.svo88.space 10.0.30.200 80, 443 7d5h tools ingress.networking.k8s.io/sub-store traefik sub-store.svo88.space 10.0.30.200 80, 443 3d9h tools ingress.networking.k8s.io/sure-finance traefik finance.svo88.space 10.0.30.200 80, 443 26d NAME AGE ciliuml2announcementpolicy.cilium.io/lan-fastpath-announcement 35d NAME DISABLED CONFLICTING IPS AVAILABLE AGE ciliumloadbalancerippool.cilium.io/lan-ingress-pool false False 0 35d Traefik VIP (10.0.30.200:443) HTTP Status: 404 ``` ### Диски и тома (PVC / PV): ```text NAMESPACE NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE databases persistentvolumeclaim/postgres-data-postgres-core-0 Bound pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO proxmox-csi-db 32d documents persistentvolumeclaim/paperless-data-pvc Bound pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO proxmox-csi-general 32d documents persistentvolumeclaim/trilium-data-pvc Bound pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO proxmox-csi-general 21d infra persistentvolumeclaim/netbox-media-pvc Bound pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO proxmox-csi-general 32d infra persistentvolumeclaim/nfs-packages-pvc Bound nfs-packages-pv 200Gi RWX 6d20h media persistentvolumeclaim/immich-db-pvc Bound pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO proxmox-csi-db 25d media persistentvolumeclaim/immich-library-pvc Bound pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO proxmox-csi-general 25d media persistentvolumeclaim/jellyfin-config-pvc Bound pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO proxmox-csi-general 21d media persistentvolumeclaim/nfs-kiwix-pvc Bound nfs-kiwix-pv 200Gi ROX 32d media persistentvolumeclaim/nfs-media-pvc Bound nfs-media-pv 1Ti RWX 21d media persistentvolumeclaim/nfs-torrents-pvc Bound nfs-torrents-pv 500Gi RWX 32d monitoring persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general 16d monitoring persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general 16d monitoring persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general 16d security persistentvolumeclaim/vaultwarden-data-pvc Bound pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO proxmox-csi-general 32d storage persistentvolumeclaim/nfs-opencloud-users-pvc Bound nfs-opencloud-users-pv 600Gi RWX 21d storage persistentvolumeclaim/opencloud-data-pvc Bound pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO proxmox-csi-general 16d tools persistentvolumeclaim/homebox-data-pvc Bound pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO proxmox-csi-general 32d tools persistentvolumeclaim/karakeep-data-pvc Bound pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO proxmox-csi-general 21d tools persistentvolumeclaim/karakeep-meili-pvc Bound pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO proxmox-csi-general 21d tools persistentvolumeclaim/printstash-models-pvc Bound printstash-models-pv 100Gi RWX 32d tools persistentvolumeclaim/spoolman-data-pvc Bound pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO proxmox-csi-general 7d5h tools persistentvolumeclaim/sub-store-data-pvc Bound pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO proxmox-csi-general 3d9h NAMESPACE NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS VOLUMEATTRIBUTESCLASS REASON AGE persistentvolume/nfs-kiwix-pv 200Gi ROX Retain Bound media/nfs-kiwix-pvc 32d persistentvolume/nfs-media-pv 1Ti RWX Retain Bound media/nfs-media-pvc 21d persistentvolume/nfs-opencloud-users-pv 600Gi RWX Retain Bound storage/nfs-opencloud-users-pvc 21d persistentvolume/nfs-packages-pv 200Gi RWX Retain Bound infra/nfs-packages-pvc 6d20h persistentvolume/nfs-torrents-pv 500Gi RWX Retain Bound media/nfs-torrents-pvc 32d persistentvolume/printstash-models-pv 100Gi RWX Retain Bound tools/printstash-models-pvc 32d persistentvolume/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8 10Gi RWO Delete Bound documents/trilium-data-pvc proxmox-csi-general 21d persistentvolume/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945 100Gi RWO Delete Bound storage/opencloud-data-pvc proxmox-csi-general 16d persistentvolume/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd 100Gi RWO Delete Bound databases/postgres-data-postgres-core-0 proxmox-csi-db 32d persistentvolume/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b 5Gi RWO Delete Bound tools/karakeep-meili-pvc proxmox-csi-general 21d persistentvolume/pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7 20Gi RWO Delete Bound media/jellyfin-config-pvc proxmox-csi-general 21d persistentvolume/pvc-6eb8c148-32b0-45af-8945-2799d04875a3 10Gi RWO Delete Bound infra/netbox-media-pvc proxmox-csi-general 32d persistentvolume/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb 15Gi RWO Delete Bound tools/karakeep-data-pvc proxmox-csi-general 21d persistentvolume/pvc-79601320-1a12-492e-82bc-8ed0fcf61205 2Gi RWO Delete Bound tools/sub-store-data-pvc proxmox-csi-general 3d9h persistentvolume/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f 5Gi RWO Delete Bound security/vaultwarden-data-pvc proxmox-csi-general 32d persistentvolume/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9 400Gi RWO Delete Bound media/immich-library-pvc proxmox-csi-general 25d persistentvolume/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780 5Gi RWO Delete Bound tools/homebox-data-pvc proxmox-csi-general 32d persistentvolume/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO Delete Bound monitoring/grafana-data-pvc proxmox-csi-general 16d persistentvolume/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO Delete Bound monitoring/victoria-metrics-pvc proxmox-csi-general 16d persistentvolume/pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2 5Gi RWO Delete Bound tools/spoolman-data-pvc proxmox-csi-general 7d5h persistentvolume/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242 30Gi RWO Delete Bound media/immich-db-pvc proxmox-csi-db 25d persistentvolume/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO Delete Bound monitoring/loki-data-pvc proxmox-csi-general 16d persistentvolume/pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4 30Gi RWO Delete Bound documents/paperless-data-pvc proxmox-csi-general 32d ``` ### Статус DaemonSet Proxmox-CSI Node: ```text NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE proxmox-csi-plugin-node 2 2 2 2 2 33d ``` ### Статус пространства мониторинга (VictoriaMetrics & Grafana): ```text NAME READY AGE statefulset.apps/grafana 1/1 16d statefulset.apps/loki 1/1 16d statefulset.apps/victoriametrics 1/1 16d NAME READY STATUS RESTARTS AGE pod/grafana-0 1/1 Running 0 169m pod/loki-0 1/1 Running 0 169m pod/victoriametrics-0 1/1 Running 0 169m NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS VOLUMEATTRIBUTESCLASS AGE persistentvolumeclaim/grafana-data-pvc Bound pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf 5Gi RWO proxmox-csi-general 16d persistentvolumeclaim/loki-data-pvc Bound pvc-fd1afe82-6d46-464d-bd8c-159690678f3a 30Gi RWO proxmox-csi-general 16d persistentvolumeclaim/victoria-metrics-pvc Bound pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f 20Gi RWO proxmox-csi-general 16d ``` ### Логи ошибок Proxmox CSI Plugin (последние строки): ```text Defaulted container "proxmox-csi-plugin-controller" out of: proxmox-csi-plugin-controller, csi-attacher, csi-provisioner, csi-resizer, liveness-probe Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe Defaulted container "proxmox-csi-plugin-node" out of: proxmox-csi-plugin-node, csi-node-driver-registrar, liveness-probe [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.012208 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-fed30933-a9f3-42c0-b29a-d8c35dbd6cc4" nodeID="talos-worker-2" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.131792 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb" nodeID="talos-worker-2" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.206486 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5dd23675-8684-49c8-a7f6-f01f751f27a7" nodeID="talos-worker-2" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.277975 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.352701 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.430266 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780" nodeID="talos-worker-2" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.509551 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-e54b6545-1c5f-4284-a517-6cad984ef1b2" nodeID="talos-worker-2" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669146 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790776828491-7787-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\"}" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.669198 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.681187 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID="" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873038 1 controller.go:513] "ControllerPublishVolume: called" args="{\"node_id\":\"talos-worker-2\",\"volume_capability\":{\"access_mode\":{\"mode\":\"SINGLE_NODE_MULTI_WRITER\"},\"mount\":{\"fs_type\":\"ext4\"}},\"volume_context\":{\"backup\":\"0\",\"cache\":\"none\",\"discard\":\"on\",\"iothread\":\"1\",\"replicate\":\"0\",\"ssd\":\"1\",\"storage\":\"astra\",\"storage.kubernetes.io/csiProvisionerIdentity\":\"1790090280571-543-csi.proxmox.sinextra.dev\"},\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\"}" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.873096 1 controller.go:554] "ControllerPublishVolume: VM ID not found in NodeID, will lookup by node name" nodeID="talos-worker-2" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:43.882474 1 controller.go:1112] "failed to get proxmox VMID from ProviderID" nodeID="talos-worker-2" providerID="" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.084431 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b" nodeID="talos-worker-2" [pod/proxmox-csi-plugin-controller-6cc485545-8r8rn/proxmox-csi-plugin-controller] I1025 12:31:44.357862 1 controller.go:605] "ControllerPublishVolume: volume published" cluster="atlas" volumeID="atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f" nodeID="talos-worker-2" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:29.408317 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-6eb8c148-32b0-45af-8945-2799d04875a3\",\"volume_path\":\"/var/lib/kubelet/pods/b6ccf3ff-f0fc-411e-b5aa-5bbd61174578/volumes/kubernetes.io~csi/pvc-6eb8c148-32b0-45af-8945-2799d04875a3/mount\"}" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.576536 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:37.577998 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945\",\"volume_path\":\"/var/lib/kubelet/pods/f3402b78-9a95-4a5c-89c9-7535456d39e0/volumes/kubernetes.io~csi/pvc-21f70a1b-cfd9-4a66-97df-3a7f3eb11945/mount\"}" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.887356 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:47.888572 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f\",\"volume_path\":\"/var/lib/kubelet/pods/ce3b896c-9957-4a70-b713-265ab487c32b/volumes/kubernetes.io~csi/pvc-7abe1930-1af6-4a2b-a448-bb5ac36f559f/mount\"}" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.095236 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:49.096521 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780\",\"volume_path\":\"/var/lib/kubelet/pods/919bd05a-93f8-44e3-850e-7a8dd2a570d6/volumes/kubernetes.io~csi/pvc-a240047c-9f33-415c-b4d0-f4d3cf2da780/mount\"}" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.657181 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.658240 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-5c7cb4da-0c08-4910-b16b-455d794bfe1b/mount\"}" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.659625 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:19:53.660965 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb\",\"volume_path\":\"/var/lib/kubelet/pods/6f2a60b0-1a3a-405b-9344-59e91ed09b23/volumes/kubernetes.io~csi/pvc-740959a7-8178-4ff0-90e8-4b2f1bf76feb/mount\"}" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.981192 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:09.982711 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242\",\"volume_path\":\"/var/lib/kubelet/pods/fa9abffb-f2c3-470f-9ee7-7bd93688270c/volumes/kubernetes.io~csi/pvc-f2bc2379-4ec8-4c89-92c8-f3ee7e02f242/mount\"}" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.278791 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-grhkv/proxmox-csi-plugin-node] I1025 15:20:11.280160 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd\",\"volume_path\":\"/var/lib/kubelet/pods/9ce6cd32-c936-4d17-8597-3efdb4845bc8/volumes/kubernetes.io~csi/pvc-30c91980-762a-4fcc-ad6a-3ae0f6763ccd/mount\"}" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:03.366763 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.621786 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:32.622940 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.802709 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:18:52.804175 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.307289 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:11.308598 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf\",\"volume_path\":\"/var/lib/kubelet/pods/288247da-f98a-4d43-9f15-e882d4c7acb5/volumes/kubernetes.io~csi/pvc-c10b6a5c-7372-4061-96cc-edcae1972bcf/mount\"}" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.015178 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:37.016475 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-fd1afe82-6d46-464d-bd8c-159690678f3a\",\"volume_path\":\"/var/lib/kubelet/pods/096b52fa-6650-4996-8813-dd472343cf8e/volumes/kubernetes.io~csi/pvc-fd1afe82-6d46-464d-bd8c-159690678f3a/mount\"}" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.754757 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:54.755939 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8\",\"volume_path\":\"/var/lib/kubelet/pods/acf12f16-e6fd-4934-a561-577be079d7fa/volumes/kubernetes.io~csi/pvc-16daf271-579d-473a-b2cd-2ae23f8c71f8/mount\"}" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.979195 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:19:57.980398 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9\",\"volume_path\":\"/var/lib/kubelet/pods/71957a25-d462-4eed-a51a-25bec487e7d6/volumes/kubernetes.io~csi/pvc-a0d0830f-fa85-4b93-8e30-e49b144971f9/mount\"}" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.775598 1 node.go:524] "NodeGetCapabilities: called" [pod/proxmox-csi-plugin-node-lmq9g/proxmox-csi-plugin-node] I1025 15:20:20.776955 1 node.go:415] "NodeGetVolumeStats: called" args="{\"volume_id\":\"atlas/pve0/astra/vm-9999-pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f\",\"volume_path\":\"/var/lib/kubelet/pods/baea777b-a7d7-404b-b642-f7e41d3b74de/volumes/kubernetes.io~csi/pvc-c8060f22-70b0-4167-b6bb-f609cd128a0f/mount\"}" ``` ### Синхронизация GitOps (FluxCD): ```text NAMESPACE NAME URL AGE READY STATUS flux-system gitrepository.source.toolkit.fluxcd.io/atlas-repo http://10.0.10.13:3000/atlas/atlas.git 33d True stored artifact for revision 'master@sha1:10fbe14ef463bef034856278733f9ad3155cd866' NAMESPACE NAME AGE READY STATUS flux-system kustomization.kustomize.toolkit.fluxcd.io/apps-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866 flux-system kustomization.kustomize.toolkit.fluxcd.io/infra-sync 33d True Applied revision: master@sha1:10fbe14ef463bef034856278733f9ad3155cd866 NAMESPACE NAME AGE READY STATUS cert-manager helmrelease.helm.toolkit.fluxcd.io/cert-manager 33d True Helm upgrade succeeded for release cert-manager/cert-manager.v2 with chart cert-manager@v1.21.3 external-secrets helmrelease.helm.toolkit.fluxcd.io/external-secrets 33d True Helm upgrade succeeded for release external-secrets/external-secrets.v5 with chart external-secrets@2.14.0 kube-system helmrelease.helm.toolkit.fluxcd.io/cilium 33d True Helm upgrade succeeded for release kube-system/cilium.v6 with chart cilium@1.15.5 kube-system helmrelease.helm.toolkit.fluxcd.io/proxmox-csi-plugin 33d True Helm upgrade succeeded for release kube-system/proxmox-csi-plugin.v4 with chart proxmox-csi-plugin@0.5.12 ``` ### Проблемные поды (Non-Running): ```text NAMESPACE NAME READY STATUS RESTARTS AGE databases postgres-init-databases-4lk9r 0/1 Completed 0 169m ``` ### Последние события-предупреждения (Warning Events): ```text NAMESPACE LAST SEEN TYPE REASON OBJECT MESSAGE traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use traefik 42m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-worker-1 failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.11:30366: bind: address already in use traefik 12m Warning FailedToStartServiceHealthcheck service/traefik node talos-1il-vwa failed to start healthcheck "traefik/traefik" on port 30366: listen tcp4 10.0.20.10:30366: bind: address already in use monitoring 51m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-7tjsw" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods") monitoring 34m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-t6n9v" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods") monitoring 17m Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-rsbtk" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods") flux-system 16m Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider flux-system 3m34s Warning UpdateFailed externalsecret/atlas-repo-auth could not get secret data from provider monitoring 73s Warning FailedCreate daemonset/vector-agent Error creating: pods "vector-agent-xsj4k" is forbidden: violates PodSecurity "baseline:latest": hostPath volumes (volume "var-log-pods") ``` ### Реальный объем данных OpenCloud (/var/lib/opencloud-users): ```text 331.7G /var/lib/opencloud-users ```