# router-ops inventory

This directory is the operational source of truth for access paths, node roles, SSH aliases, WireGuard management paths, and non-secret deployment metadata.

Important files:

- access-map.yml
  Machine-readable access inventory.

- access-map.md
  Human-readable access map.

Rules:

- No private keys.
- No public keys unless explicitly needed and approved.
- No WireGuard client configs.
- No passwords.
- No tokens.
- Key file paths are allowed.
- SSH aliases are allowed.
- IP addresses and roles are allowed.

## WG Paid / MGTS access map

Current WG Paid / MGTS access documentation:

- `/opt/router-ops/inventory/access-map-wg-paid-mgts.md`

Important rule:

```text
VM121 has direct wg-mgts access to MGTS 10.71.100.0/24.
VM130/router-ops is not a transit node for VM121.
```
## VM121 direct MGTS admin access

Documented in:

- /opt/router-ops/inventory/access-map.md
- /opt/router-ops/inventory/access-map.yml

Key rule:

    VM121 has direct wg-mgts access to MGTS 10.71.100.0/24.
    VM130/router-ops is not a transit router for VM121.



<!-- STEP_034E3_XSMAP_WG_STUDIO_BEGIN -->
## WG Studio / MGTS endpoint update

Updated: 2026-07-08 11:50:45

Permanent MGTS public identity:

- DNS: `wg-studio.secret-studio.ru`
- Public IP: `95.165.105.4`
- Admin WireGuard endpoint: `wg-studio.secret-studio.ru:51820`
- WG Paid client endpoint: `wg-studio.secret-studio.ru:51830`

Important access-map correction:

- VM130/router-ops now has direct SSH access to MGTS VM101 and this must stay represented in the map.
- VM101 MGTS edge address: `10.71.100.2`
- WGPay clients are WireGuard peers, not DHCP clients; canary/source selection must use WG peer tunnel IP / AllowedIPs / subscription records, not DHCP leases.

<!-- STEP_034E3_XSMAP_WG_STUDIO_END -->