=== STEP_034E4C CLASSIFY ENDPOINT LEFTOVERS === timestamp=20260708-115441 mode=docs cleanup + read-only runtime check final_wgpay_endpoint=wg-studio.secret-studio.ru:51830 forbidden: docker restart, backend restart, wg reload, peer creation === active source files grep === /opt/wg-access/DEFERRED_TASKS.md:8: WG_CLIENT_ENDPOINT=10.71.100.1:51830 /opt/wg-access/DEFERRED_TASKS.md:12: VM101 DNAT UDP 51830 -> MGTS VM100 10.71.100.1:51830 /opt/wg-access/.env:13:WG_CLIENT_ENDPOINT=wg-studio.secret-studio.ru:51830 /opt/wg-access/backend/app/services/wireguard.py:79: endpoint = os.environ.get("WG_CLIENT_ENDPOINT", "").strip() /opt/wg-access/backend/app/services/wireguard.py:86: raise RuntimeError("WG_CLIENT_ENDPOINT is not configured") /opt/wg-access/.env.BEFORE_MGTS_CLIENTCFG_20260706-185027:13:WG_CLIENT_ENDPOINT=192.168.30.1:51830 /opt/wg-access/.env.BEFORE_MGTS_CLIENTCFG_20260706-185140:13:WG_CLIENT_ENDPOINT=10.71.100.1:51830 === historical/docs/backups leftovers === /opt/wg-access/DEFERRED_TASKS.md:8: WG_CLIENT_ENDPOINT=10.71.100.1:51830 /opt/wg-access/DEFERRED_TASKS.md:12: VM101 DNAT UDP 51830 -> MGTS VM100 10.71.100.1:51830 /opt/wg-access/STATUS-STEP-013_WG_HANDSHAKE_VM121_TO_VM100_OK.txt:23: 192.168.30.1:51830 /opt/wg-access/STATUS-STEP-016_CLIENT_CONFIG_RESPONSE_OK.txt:16: WG_CLIENT_ENDPOINT=192.168.30.1:51830 /opt/wg-access/.env.BEFORE_MGTS_CLIENTCFG_20260706-185027:13:WG_CLIENT_ENDPOINT=192.168.30.1:51830 /opt/wg-access/STATUS-STEP-017_GENERATED_CLIENT_CONFIG_HANDSHAKE_OK.txt:28: Endpoint = 192.168.30.1:51830 /opt/wg-access/tmp/mgts-smoke-20260706-184120/client.mgts.conf:9:Endpoint = 10.71.100.1:51830 /opt/wg-access/tmp/mgts-smoke-20260706-184120/client.conf:8:Endpoint = 192.168.30.1:51830 /opt/wg-access/tmp/mgts-smoke-20260706-184120/create.json:1:{"user_id":"13783bf9-94bb-4c90-b1c6-685a956a5c43","subscription_id":"8adb06a9-713a-46b0-8759-d11c28a797fc","peer_id":"3d03a7a2-c009-48a4-b6ff-214326d26fc0","job_id":"814ba665-f6e5-4ba4-b1ba-8af1ec4954e6","node_id":"ddn-test","tunnel_ip":"10.253.1.10","paid_until":"2026-08-05T18:41:20.288079Z","private_key":"mNbbZcMCcS+SLGtfAFFNJSOzR/2etvxnicYjL/unF38=","public_key":"zUUEdc+Lac9C6fmMDVosuO3ZIYHIUDWi34UVgdjhbCU=","preshared_key":"jDmX4j1ipVr4r45cRb4nbKaeBqQYQeeaCpsBG4U2sMQ=","client_config":"[Interface]\nPrivateKey /opt/wg-access/STATUS-STEP-028A_MGTS_WG_PAID_E2E_OK.txt:30: endpoint used for internal smoke: 10.71.100.1:51830 /opt/wg-access/STATUS-STEP-028A_MGTS_WG_PAID_E2E_OK.txt:55: WG_CLIENT_ENDPOINT=10.71.100.1:51830 /opt/wg-access/STATUS-STEP-028A_MGTS_WG_PAID_E2E_OK.txt:61: internal smoke endpoint 10.71.100.1:51830, /opt/wg-access/STATUS-STEP-028A_MGTS_WG_PAID_E2E_OK.txt:65: Replace WG_CLIENT_ENDPOINT=10.71.100.1:51830 with real external MGTS DNS/IP endpoint after MGTS static IP is known. /opt/wg-access/.env.BEFORE_MGTS_CLIENTCFG_20260706-185140:13:WG_CLIENT_ENDPOINT=10.71.100.1:51830 === patch DEFERRED_TASKS.md if it still says to replace old endpoint === UPDATED_DEFERRED_TASKS=1 --- DEFERRED_TASKS.md.before +++ DEFERRED_TASKS.md.after @@ -5,7 +5,7 @@ Current backend `.env` uses internal smoke endpoint: - WG_CLIENT_ENDPOINT=10.71.100.1:51830 + WG_CLIENT_ENDPOINT=wg-studio.secret-studio.ru:51830 Before production client delivery, replace with the real external MGTS endpoint / DNS that reaches: @@ -22,3 +22,11 @@ - build a real backend image with dependencies baked in; - avoid relying on manual `pip install` inside a running container; - make `docker compose up -d --force-recreate backend` safe and repeatable. + + + +Endpoint migration note, added 2026-07-08 11:54:42: +- WG Paid public client endpoint source has been changed to in . +- Historical STATUS/backups may still mention older internal smoke endpoints; those are not active source. +- Running backend container must be restarted/recreated separately before it reads the new . + === active source files grep after docs cleanup === /opt/wg-access/DEFERRED_TASKS.md:8: WG_CLIENT_ENDPOINT=wg-studio.secret-studio.ru:51830 /opt/wg-access/DEFERRED_TASKS.md:12: VM101 DNAT UDP 51830 -> MGTS VM100 10.71.100.1:51830 /opt/wg-access/.env:13:WG_CLIENT_ENDPOINT=wg-studio.secret-studio.ru:51830 /opt/wg-access/backend/app/services/wireguard.py:79: endpoint = os.environ.get("WG_CLIENT_ENDPOINT", "").strip() /opt/wg-access/backend/app/services/wireguard.py:86: raise RuntimeError("WG_CLIENT_ENDPOINT is not configured") /opt/wg-access/.env.BEFORE_MGTS_CLIENTCFG_20260706-185027:13:WG_CLIENT_ENDPOINT=192.168.30.1:51830 /opt/wg-access/.env.BEFORE_MGTS_CLIENTCFG_20260706-185140:13:WG_CLIENT_ENDPOINT=10.71.100.1:51830 === running backend env, expected old until controlled restart === backend_container=wgaccess-backend WG_CLIENT_ENDPOINT=10.71.100.1:51830 === health === {"status":"ok","service":"wg-access-backend","environment":"dev"} {"status":"ok","db":1} === no forbidden actions proof === no_docker_restart=1 no_backend_restart=1 no_wg_reload=1 no_peer_create=1 vm121_endpoint_leftovers_classified_done=1 vm121_remote_backup_dir=/root/router-ops-backups/endpoint-leftovers-backup-20260708-115441 === STEP_034E4C RESULT === updated_deferred_tasks=1 active_final_endpoint_lines=2 active_old_endpoint_remaining_lines=1 historical_old_endpoint_lines=13 running_backend_old_endpoint_lines=1 running_backend_final_endpoint_lines=0 backend_health_ok_lines=2 no_docker_restart_lines=1 no_wg_reload_lines=1 no_peer_create_lines=1 decision=BLOCK_ACTIVE_OLD_REMAINS