===== local_access_map =====
CMD: sh -c command -v access-map >/dev/null 2>&1 && access-map || true

# Access Map — router-ops / WG Paid

This file is the human-readable source of truth for access paths.

No private keys.
No public keys.
No WireGuard client configs.
No passwords or tokens.

Allowed here:
- machine names
- roles
- IP addresses
- SSH aliases
- key file paths
- non-secret operational notes

Rules:
- Do not create new SSH/WG keys unless explicitly requested.
- Before suggesting access commands, read /opt/router-ops/inventory/access-map.yml.
- Prefer existing SSH aliases and existing key files.
- Do not print private keys or WireGuard configs.
- Use ssh -n for nested SSH from Proxmox to OpenWRT inside heredocs.

============================================================
MAIN ACCESS PATH TO PVE-WG-PAID
============================================================

router-ops
  WG router-ops-mgts 10.250.100.4/32
    -> VM100 wg_remote 10.250.100.1/24
      -> Proxmox pve-wg-paid 10.71.100.222

Command from router-ops:

  ssh pve-mgts

Expected SSH path:

  source: 10.250.100.4
  target: 10.71.100.222

============================================================
MACHINES
============================================================

router-ops
----------

Role:
  operations VM

User:
  ops

Known address:
  192.168.30.84

WG interface:
  router-ops-mgts

WG address:
  10.250.100.4/32

Systemd service:
  wg-quick@router-ops-mgts

Expected service state:
  enabled
  active

------------------------------------------------------------

pve-wg-paid
-----------

Role:
  Proxmox host for WG Paid / MGTS deployment

SSH alias from router-ops:
  pve-mgts

SSH user:
  root

Management IP:
  10.71.100.222

SSH key path on router-ops:
  ~/.ssh/router_ops_pve_mgts_ed25519

Network:
  vmbr0: WAN bridge, no IPv4 on Proxmox host
  vmbr1: 10.71.100.222/24 internal LAN
  vmbr2: 192.168.99.1/24 emergency
  vmbr3: transit VPN bridge, no host IP
  vmbr4: transit direct bridge, no host IP

Route back to WG admin net:
  10.250.100.0/24 via 10.71.100.1 dev vmbr1

Old temporary DDN IP:
  192.168.30.249

Old temporary DDN IP status:
  deprecated
  do not rely on it

------------------------------------------------------------

MGTS VM100 core
---------------

VMID:
  100

Hostname:
  VM100-OpenWRT-core

Role:
  OpenWRT core router for pve-wg-paid

SSH from Proxmox:

  ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1

Addresses:
  br-lan: 10.71.100.1/24
  wg_remote: 10.250.100.1/24
  direct transit: 10.201.0.1/24
  vpn transit: 10.200.0.1/24

wg_remote:
  listen UDP: 51820

wg_remote peers:
  support-mgts: 10.250.100.2/32
  owner-mgts: 10.250.100.3/32
  router-ops-mgts: 10.250.100.4/32

Snapshots:
  MGTS_RESTORED_BEFORE_FIRST_BOOT
  MGTS_INTERNAL_LAN_RENUMBERED_OK
  MGTS_VM100_WG_REMOTE_ROTATED_OK
  MGTS_VM100_ROUTER_OPS_WG_PEER_OK

------------------------------------------------------------

MGTS VM101 edge
---------------

VMID:
  101

Hostname:
  VM101-OpenWRT-edge

Role:
  OpenWRT edge / WAN / VPN egress for pve-wg-paid

SSH from Proxmox:

  ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2

Addresses:
  WAN eth0: DHCP behind vmbr0
  mgmt eth2: 10.71.100.2/24
  vpn_in eth1: 10.200.0.2/24
  direct_in eth3: 10.201.0.2/24

Route back to admin WG:
  10.250.100.0/24 via 10.71.100.1 dev eth2

Snapshots:
  MGTS_RESTORED_BEFORE_FIRST_BOOT
  MGTS_INTERNAL_LAN_RENUMBERED_OK
  MGTS_VM101_CURRENT_20260702_OK

============================================================
TEMPORARY NOTES
============================================================

router-ops-mgts currently uses temporary DDN test endpoint:

  192.168.30.218:51820

On MGTS site, update endpoint to real public IP/DNS or MGTS router forward/DMZ address.

HideMyName/AWG keys still need future replacement before production use.
---

## VM121 direct MGTS admin access

Status: confirmed.
Recorded: 2026-07-06T15:42:33

Purpose:

    VM121 wg-access-dev has its own direct administrative WireGuard access to MGTS 10.71.100.0/24.
    VM130/router-ops is only an operator/control node.
    VM130 is not a transit router for VM121.

Direct admin WireGuard:

    VM121 interface:       wg-mgts
    VM121 WG address:     10.250.100.121/32
    MGTS server side:     VM100 wg_remote
    MGTS WG server addr:  10.250.100.1/24
    MGTS LAN reachable:   10.71.100.0/24

Confirmed reachable targets from VM121:

    10.71.100.1    MGTS VM100 OpenWRT core
    10.71.100.2    MGTS VM101 OpenWRT edge
    10.71.100.222  MGTS Proxmox pve-wg-paid

SSH access paths:

    router-ops -> pve-mgts:
      command:   ssh pve-mgts
      target:    10.71.100.222
      key path:  ~/.ssh/router_ops_pve_mgts_ed25519

    router-ops -> VM121:
      command:   ssh vm121
      target:    192.168.30.83
      key path:  ~/.ssh/router_ops_ed25519

    pve-mgts -> MGTS VM100:
      command:   ssh -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1

    pve-mgts -> MGTS VM101:
      command:   ssh -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2

Confirmed smoke tests:

    VM121 -> 10.71.100.1    OK
    VM121 -> 10.71.100.2    OK
    VM121 -> 10.71.100.222  OK

    wg_paid live temp client smoke:
      temp client: 10.253.254.121/32
      target:      10.253.1.1
      handshake:   OK
      server ping: OK
      internet:    OK
      external IP during smoke: 94.45.208.160
      cleanup:     temp peer/client removed

Secrets policy:

    Private keys are not recorded here.
    Only key paths, public keys and fingerprints may be recorded.


rc=0
