# Access Map — router-ops / WG Paid This file is the human-readable source of truth for access paths. No private keys. No public keys. No WireGuard client configs. No passwords or tokens. Allowed here: - machine names - roles - IP addresses - SSH aliases - key file paths - non-secret operational notes Rules: - Do not create new SSH/WG keys unless explicitly requested. - Before suggesting access commands, read /opt/router-ops/inventory/access-map.yml. - Prefer existing SSH aliases and existing key files. - Do not print private keys or WireGuard configs. - Use ssh -n for nested SSH from Proxmox to OpenWRT inside heredocs. ============================================================ MAIN ACCESS PATH TO PVE-WG-PAID ============================================================ Current transport is the direct studio LAN. The former router-ops-mgts administrative WireGuard path is retained only as disabled legacy/rollback configuration. router-ops 10.71.100.84 -> direct studio LAN 10.71.100.0/24 -> Proxmox pve-wg-paid 10.71.100.222 Command from router-ops: ssh pve-mgts Expected SSH path: source: 10.71.100.84 target: 10.71.100.222 ============================================================ MACHINES ============================================================ router-ops ---------- Role: operations VM User: ops Current studio LAN address: 10.71.100.84 Former DDN address: 192.168.30.84 historical; do not use as the current studio access path Role note: VM130/router-ops is the orchestration, release, evidence and publication control plane. It is not the public HTTP/TLS ingress and is not runtime transit. Legacy WG interface: router-ops-mgts Legacy WG address: 10.250.100.4/32 Systemd service: wg-quick@router-ops-mgts Current service state: disabled inactive ------------------------------------------------------------ pve-wg-paid ----------- Role: Proxmox host for WG Paid / MGTS deployment SSH alias from router-ops: pve-mgts SSH user: root Management IP: 10.71.100.222 SSH key path on router-ops: ~/.ssh/router_ops_pve_mgts_ed25519 Network: vmbr0: WAN bridge, no IPv4 on Proxmox host vmbr1: 10.71.100.222/24 internal LAN vmbr2: 192.168.99.1/24 emergency vmbr3: transit VPN bridge, no host IP vmbr4: transit direct bridge, no host IP Route back to WG admin net: 10.250.100.0/24 via 10.71.100.1 dev vmbr1 Old temporary DDN IP: 192.168.30.249 Old temporary DDN IP status: deprecated do not rely on it ------------------------------------------------------------ MGTS VM100 core --------------- VMID: 100 Hostname: VM100-OpenWRT-core Role: OpenWRT core router for pve-wg-paid SSH from Proxmox: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1 Addresses: br-lan: 10.71.100.1/24 wg_remote: 10.250.100.1/24 direct transit: 10.201.0.1/24 vpn transit: 10.200.0.1/24 wg_remote: listen UDP: 51820 wg_remote peers: support-mgts: 10.250.100.2/32 owner-mgts: 10.250.100.3/32 router-ops-mgts: 10.250.100.4/32 Snapshots: MGTS_RESTORED_BEFORE_FIRST_BOOT MGTS_INTERNAL_LAN_RENUMBERED_OK MGTS_VM100_WG_REMOTE_ROTATED_OK MGTS_VM100_ROUTER_OPS_WG_PEER_OK ------------------------------------------------------------ MGTS VM101 edge --------------- VMID: 101 Hostname: VM101-OpenWRT-edge Role: OpenWRT edge / WAN / VPN egress for pve-wg-paid SSH from Proxmox: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2 Addresses: WAN eth0: 95.165.105.4/20 static public address mgmt eth2: 10.71.100.2/24 vpn_in eth1: 10.200.0.2/24 direct_in eth3: 10.201.0.2/24 Route back to admin WG: 10.250.100.0/24 via 10.71.100.1 dev eth2 Snapshots: MGTS_RESTORED_BEFORE_FIRST_BOOT MGTS_INTERNAL_LAN_RENUMBERED_OK MGTS_VM101_CURRENT_20260702_OK ------------------------------------------------------------ MGTS VM103 public web ingress ----------------------------- Role: production public HTTP/HTTPS and trusted TLS ingress reports origin/mirror target access browser/static layer and strict auth/account proxy Studio LAN address: 10.71.100.86 SSH from router-ops: ssh -i "$HOME/.ssh/router_ops_ed25519" ops@10.71.100.86 Reports tree: /srv/wg-paid/reports Public DNAT owner upstream: VM101 forwards TCP 80/443 to 10.71.100.86 Runtime boundary: no WG peer lifecycle authority no selector authority no account/business DB authority ============================================================ OPERATING NOTES ============================================================ Legacy router-ops-mgts configuration references the permanent MGTS endpoint: wg-studio.secret-studio.ru:51820 Current router-ops transport is direct studio LAN; do not start the legacy WG service while the direct LAN path is present. HideMyName/AWG provider keys are outside this access-map update. --- ## VM121 direct MGTS admin access Status: confirmed current direct studio LAN. Legacy administrative WireGuard retained disabled. Purpose: VM121 wg-access-dev is on studio LAN 10.71.100.0/24 and reaches MGTS directly. VM130/router-ops is only an operator/control node. VM130 is not a transit router for VM121. Current VM121 address: 10.71.100.83/24 Legacy admin WireGuard: VM121 interface: wg-mgts VM121 WG address: 10.250.100.121/32 MGTS server side: VM100 wg_remote MGTS WG server addr: 10.250.100.1/24 status: disabled; configuration retained for rollback/history Current reachable MGTS targets from VM121 over direct studio LAN: 10.71.100.1 MGTS VM100 OpenWRT core 10.71.100.2 MGTS VM101 OpenWRT edge 10.71.100.222 MGTS Proxmox pve-wg-paid SSH access paths: router-ops -> pve-mgts: command: ssh pve-mgts target: 10.71.100.222 key path: ~/.ssh/router_ops_pve_mgts_ed25519 router-ops -> VM121: command: ssh vm121 target: 10.71.100.83 key path: ~/.ssh/router_ops_ed25519 pve-mgts -> MGTS VM100: command: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1 pve-mgts -> MGTS VM101: command: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2 Secrets policy: Private keys are not recorded here. Only key paths, public keys and fingerprints may be recorded. ## WG Studio / MGTS endpoint update Updated: 2026-07-08 11:50:45 Permanent MGTS public identity: - DNS: `wg-studio.secret-studio.ru` - Public IP: `95.165.105.4` - Admin WireGuard endpoint: `wg-studio.secret-studio.ru:51820` - WG Paid client endpoint: `wg-studio.secret-studio.ru:51830` Important access-map correction: - VM130/router-ops reaches MGTS VM101 through `ssh pve-mgts` and nested SSH from Proxmox; direct root SSH from VM130 is not the approved path. - VM101 MGTS edge address: `10.71.100.2` - WGPay clients are WireGuard peers, not DHCP clients; canary/source selection must use WG peer tunnel IP / AllowedIPs / subscription records, not DHCP leases. ## Public web / reports / access ingress — current after P26C4K Updated: 2026-08-22 Public DNS / HTTPS endpoints: - `reports.secret-studio.ru` - `reports001.secret-studio.ru` - `access.secret-studio.ru` Current public ingress path: ```text Internet 95.165.105.4 TCP 80/443 -> MGTS VM101 -> DNAT TCP 80/443 to 10.71.100.86 -> VM103 Caddy ``` VM103: ```text address: 10.71.100.86 role: production public HTTP/HTTPS and trusted TLS ingress SSH from router-ops: ssh -i "$HOME/.ssh/router_ops_ed25519" ops@10.71.100.86 ``` Host ownership: ```text reports.secret-studio.ru -> VM103 /srv/wg-paid/reports reports001.secret-studio.ru -> same VM103 reports tree access.secret-studio.ru -> / = 204 -> /health = 200 access-ok -> /login = browser login page -> /auth/magic = fragment-token landing -> strict auth/account proxy to VM121 ``` `/v2/admin/*` and `/v2/agent/*` are not publicly proxied. Canonical magic-link URL: ```text https://access.secret-studio.ru/auth/magic#token={token} ``` Publication ownership: ```text VM130 /opt/router-ops/public -> publish/mirror hook -> VM103 /srv/wg-paid/reports ``` VM130 Caddy is retained as rollback-origin only. VM130 is no longer the public TCP 80/443 DNAT target. Report cache semantics: ```text /latest/* no-cache, max-age=0, must-revalidate /old/* public, max-age=31536000, immutable ``` Cloudflare Quick Tunnel URLs are legacy and must not be generated or treated as current publication state. --- ## 2026-08-12 — BEACH OMR / MGTS primary integration — CURRENT / VERIFIED ### Primary OMR server ```text MGTS VM102 VMID: 102 LAN: 10.71.100.85/24 gateway: 10.71.100.1 public IP: 95.165.105.4 SSH: 65222/tcp Xray: 65248/tcp OpenVPN: 65301/tcp OMR API: 65500/tcp HTTPS ``` SSH from router-ops: ```text ssh -i ~/.ssh/router_ops_ed25519 -p 65222 debian@10.71.100.85 ``` ### Public ingress path ```text BEACH / Internet -> VM101 WAN 95.165.105.4 -> DNAT -> VM100 Direct transit -> VM102 10.71.100.85 ``` VM101 persistent DNAT sections: ```text firewall.beach_omr_xray_65248 firewall.beach_omr_openvpn_65301 firewall.beach_omr_api_65500 ``` ### Required symmetric return path on VM101 ```text priority 10005: iif eth0 to 10.71.100.85/32 lookup 210 table 210: 10.71.100.85 via 10.201.0.1 dev eth3 ``` Persistent UCI sections: ```text network.beach_omr_return_route network.beach_omr_return_rule ``` `/etc/config/network` on VM101 contains private keys and is intentionally not tracked wholesale in Machine Git. Do not add the whole file to Git. ### VM100 BEACH-owned integration ```text /etc/nftables.d/92-beach-omr-routing.nft SHA256=d2fe6162d731d17ae2092ce5b8dc1e52d7ef4fa375c5468d75789fc589a470ea ``` It provides VM102 Direct transport classification, narrow no-SNAT, DSCP cleanup and narrow inbound permits for TCP 65248/65301/65500. Existing Router five-slot PBR semantics remain authoritative and were preserved. ### Machine Git at BEACH acceptance — historical proof ```text VM100 HEAD=35c424e53504e8b5e2da227a869f29417fdbe14c TREE=dd082a27a7f35f43efa8bd07b222ce86200edda1 VM101 HEAD=5bc942f5908a2c8fcd92606f9d9e8d50974039f0 TREE=38805542a21bccf9a48097c464f09c3f0172b00d /etc/config/firewall SHA256=0b568b80b377730a981358e0cba88648e2fb898a3f9e08cfd25e41cc14a8555b ``` These hashes are retained only as BEACH acceptance evidence. They are not current canonical baselines. Before any future WG Paid / MGTS mutation, use the current canonical baselines below and still read live HEAD/TREE before mutation. ### Final proof ```text RESULT=PASS_MGTS_PRIMARY_OMR_END_TO_END ``` Final public ingress counters: ```text VM101: Xray 65248=1382 packets; OpenVPN 65301=3; API 65500=61 VM100: Xray 65248=1386 packets; OpenVPN 65301=3; API 65500=61 ``` BEACH VM110: ```text LAN=192.168.100.1 BEACH PVE=192.168.100.254 tun0=10.255.252.2/24 Xray=95.165.105.4:65248 OpenVPN=95.165.105.4:65301 VPS API=95.165.105.4:65500 both LTE paths=PASS client Internet=PASS ``` Direct SSH from router-ops to BEACH VM110/PVE is currently not available. ### DDN access from router-ops — current ```text ssh home-vm100 -> 192.168.30.1 ssh home-vm101 -> 192.168.30.2 ``` Temporary reverse SSH ports are no longer required for these two paths. ### Operational protection VM100 and VM101 are shared infrastructure. Reconcile current Machine Git HEAD/TREE before mutation, preserve BEACH rules, never wholesale-track VM101 `/etc/config/network`, use `cd /` for path-scoped Machine Git operations, and use the proven `setsid` timed-rollback pattern for risky OpenWrt live changes. --- ## 2026-08-22 — WG Paid canonical access/runtime checkpoint after P26C4K P26C4K accepted state: ```text RESULT=PASS_P26C4K_CONTROLLED_REAL_MAGIC_LINK_BROWSER_SESSION_ACTIVATION EXTERNAL_ONBOARDING_ACTIVE=true BUSINESS_ROWS_AFTER_ACTIVATION=0 NEXT=P27_TRUSTED_USER_ONBOARDING_AND_OPERATIONAL_MONITORING ``` Runtime ownership: ```text VM100 wg_paid peer lifecycle, selector assignment/membership, PBR/nft VM101 five egress slots, health/recovery, selector->egress mapping, public DNAT VM103 public HTTP/HTTPS, trusted TLS, reports origin, access browser/static/proxy VM121 accounts/auth/profiles/credentials/jobs/SMTP VM130 orchestration/release/evidence/publication; not runtime transit ``` Public WG path: ```text Internet client -> wg-studio.secret-studio.ru:51830 -> VM101 -> VM100 wg_paid ``` Current canonical Machine Git baselines: ```text VM100 COMMIT=8c5d11b7e4b119757ea16b46775b26e0ac903d7c TREE=f25aab0f1886647b52a11ccebe080894bd06542a FILES=34 ARCHIVE_SHA256=18548cd276705906958ee10552f9ec874c0b504f30dd26aa4514030bbb0e9a5a VM101 COMMIT=d0fcf8d22d6d4b897de7b7fee53c2f062d51b936 TREE=b1f9bde032609e406e387e8e169ff441413df5df FILES=59 ARCHIVE_SHA256=832fd1fa1474632184c54f678912bb6515b6848cffb44f1cc38c2b83c928d556 VM103 COMMIT=cdff394927413cc5e0fe722424c063a0546630e6 TREE=8180f9bf3ec0ba61beecbe828b9ee59fb5300cd9 FILES=12 ARCHIVE_SHA256=283de810081025531c08209113afd692f40b852e31efb0de35cccf816c0fc220 VM121 COMMIT=acfffc68c5111ce115b9a8967fb71997546f869d TREE=3573122442de2941213604c4637ca34aa0401988 FILES=53 ARCHIVE_SHA256=397d8d0b35b8fdac396acdd4e83f52e92ebfb216201eae0b8d176fb7e5e2d271 VM130 COMMIT=8b4cb23997c59e8a2e55d9b85a982a719f7cb12d TREE=bcb734c62fdfdd7199ec224089ecb7afe34aad48 FILES=82 ARCHIVE_SHA256=6ef3e0ea2bf27bdb5333528e78fa151109083f84a753637164d89ef12cfceb73 ``` Canonical source publications: ```text VM100 https://reports.secret-studio.ru/latest/20260816-094040_vm100_git_source_8c5d11b7e4b1/ VM101 https://reports.secret-studio.ru/latest/20260821-133542_vm101_git_source_d0fcf8d22d6d/ VM103 https://reports.secret-studio.ru/latest/20260821-155442_vm103_git_source_cdff39492741/ VM121 https://reports.secret-studio.ru/latest/20260821-085954_vm121_git_source_acfffc68c511/ VM130 https://reports.secret-studio.ru/latest/20260821-124210_vm130_git_source_8b4cb23997c5/ ```