# router-ops access inventory
# Source of truth for access paths.
# No private keys, public keys, WireGuard configs, passwords, or secrets.

version: 2026-07-06

policy:
  - Do not create new SSH/WG keys unless explicitly requested.
  - Before suggesting access commands, read this inventory.
  - Do not print private keys or WireGuard client configs.
  - Prefer existing SSH aliases and existing key files.
  - Use ssh -n for nested SSH from Proxmox to OpenWRT inside heredocs.

machines:
  router_ops:
    hostname: router-ops
    role: operations VM
    user: ops
    known_address: 192.168.30.84
    wg_interface: router-ops-mgts
    wg_address: 10.250.100.4/32
    wg_service: wg-quick@router-ops-mgts

  pve_wg_paid:
    hostname: pve-wg-paid
    role: Proxmox host for WG Paid / MGTS deployment
    ssh_alias_from_router_ops: pve-mgts
    ssh_user: root
    management_ip: 10.71.100.222
    ssh_key_from_router_ops: ~/.ssh/router_ops_pve_mgts_ed25519
    old_temporary_ddn_ip: 192.168.30.249
    network:
      vmbr0: WAN bridge, no IPv4 on Proxmox host
      vmbr1: 10.71.100.222/24 internal LAN
      vmbr2: 192.168.99.1/24 emergency
      vmbr3: VM100-VM101 VPN transit bridge
      vmbr4: VM100-VM101 direct transit bridge
    routes:
      - 10.250.100.0/24 via 10.71.100.1 dev vmbr1

  mgts_vm100_core:
    vmid: 100
    hostname: VM100-OpenWRT-core
    role: OpenWRT core router for pve-wg-paid
    ssh_from_pve:
      user: root
      host: 10.71.100.1
      key: /root/.ssh/pve_to_openwrt_mgts_ed25519
    addresses:
      br_lan: 10.71.100.1/24
      wg_remote: 10.250.100.1/24
      direct_transit: 10.201.0.1/24
      vpn_transit: 10.200.0.1/24
    wg_remote:
      listen_udp: 51820
      peers:
        support-mgts: 10.250.100.2/32
        owner-mgts: 10.250.100.3/32
        router-ops-mgts: 10.250.100.4/32
    snapshots:
      - MGTS_RESTORED_BEFORE_FIRST_BOOT
      - MGTS_INTERNAL_LAN_RENUMBERED_OK
      - MGTS_VM100_WG_REMOTE_ROTATED_OK
      - MGTS_VM100_ROUTER_OPS_WG_PEER_OK

  mgts_vm101_edge:
    vmid: 101
    hostname: VM101-OpenWRT-edge
    role: OpenWRT edge/WAN/VPN egress for pve-wg-paid
    ssh_from_pve:
      user: root
      host: 10.71.100.2
      key: /root/.ssh/pve_to_openwrt_mgts_ed25519
    addresses:
      wan_eth0: DHCP behind vmbr0
      mgmt_eth2: 10.71.100.2/24
      vpn_in_eth1: 10.200.0.2/24
      direct_in_eth3: 10.201.0.2/24
    route_back_to_admin_wg: 10.250.100.0/24 via 10.71.100.1 dev eth2
    snapshots:
      - MGTS_RESTORED_BEFORE_FIRST_BOOT
      - MGTS_INTERNAL_LAN_RENUMBERED_OK
      - MGTS_VM101_CURRENT_20260702_OK

wireguard:
  router_ops_mgts:
    local_machine: router_ops
    interface: router-ops-mgts
    address: 10.250.100.4/32
    systemd_service: wg-quick@router-ops-mgts
    expected_service_state: enabled and active
    current_test_endpoint: wg-studio.secret-studio.ru:51820
    server: mgts_vm100_core wg_remote 10.250.100.1 UDP 51820
    allowed_ips:
      - 10.250.100.0/24
      - 10.71.100.0/24
      - 10.200.0.0/24
      - 10.201.0.0/24

ssh_paths:
  router_ops_to_pve_wg_paid:
    from: router_ops
    to: pve_wg_paid
    command: ssh pve-mgts
    alias: pve-mgts
    expected_target: 10.71.100.222
    expected_source: 10.250.100.4
    key: ~/.ssh/router_ops_pve_mgts_ed25519
    transport: WireGuard router-ops-mgts

  pve_wg_paid_to_mgts_vm100:
    from: pve_wg_paid
    to: mgts_vm100_core
    command: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1
    key: /root/.ssh/pve_to_openwrt_mgts_ed25519
    transport: vmbr1 internal LAN

  pve_wg_paid_to_mgts_vm101:
    from: pve_wg_paid
    to: mgts_vm101_edge
    command: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2
    key: /root/.ssh/pve_to_openwrt_mgts_ed25519
    transport: vmbr1 internal LAN

deprecated_or_temporary:
  pve_mgts_old_ddn:
    alias: pve-mgts-old-ddn
    old_host: 192.168.30.249
    status: deprecated
    reason: Proxmox vmbr0 now has no IPv4; management moved to WG/internal LAN.

# ============================================================
# EXTENDED GLOBAL ACCESS INVENTORY
# Added: known router-ops/home/client/dev machines.
# No secrets here. Key paths only.
# ============================================================

known_networks:
  home_ddn_lan:
    cidr: 192.168.30.0/24
    gateway: 192.168.30.1
    notes:
      - Main DDN/home LAN.
      - router-ops lives here as 192.168.30.84.
  client001_lan:
    cidr: 10.71.1.0/24
    notes:
      - client001 commercial rollout LAN.
  pve_wg_paid_lan:
    cidr: 10.71.100.0/24
    notes:
      - pve-wg-paid internal logical LAN.
  pve_wg_paid_admin_wg:
    cidr: 10.250.100.0/24
    notes:
      - pve-wg-paid admin WireGuard net.
  client001_admin_wg:
    cidr: 10.250.1.0/24
  client001_guest_wg:
    cidr: 10.252.1.0/24

extended_machines:
  home_vm100_core:
    hostname: VM100-OpenWRT-core
    role: home/DDN OpenWRT core router
    address: 192.168.30.1
    ssh_user: root
    access_from_router_ops: ssh root@192.168.30.1
    notes:
      - Current working/home VM100.
      - This is the right target for testing existing paid wg interface, not MGTS VM100.

  home_vm101_edge:
    hostname: VM101-OpenWRT-edge
    role: home/DDN OpenWRT edge / VPN egress
    address: 192.168.30.2
    ssh_user: root
    access_from_router_ops: ssh root@192.168.30.2

  home_vm103_wg_easy:
    hostname: VM103-wg-easy
    role: home/DDN wg-easy guest WG
    address: 192.168.30.189
    ssh_user: root
    wg_easy_panel: http://192.168.30.189:51822
    access_from_router_ops: ssh root@192.168.30.189

  home_vm104_omr_server:
    hostname: DDN-OMR-SERVER
    role: OpenMPTCProuter server in DDN
    address: 192.168.30.186
    ssh_user: root
    ssh_port: 65222
    access_from_router_ops: ssh -p 65222 root@192.168.30.186
    notes:
      - SSH is on port 65222, not 22.

  pve_ai:
    hostname: pve-ai
    role: Proxmox host with VM120/VM121/VM130
    address: 192.168.30.81
    ssh_user: root
    access_from_router_ops: ssh root@192.168.30.81

  vm120_ubuntu_ai:
    hostname: ubuntu-ai
    role: local AI / Ollama / Open WebUI
    address: 192.168.30.82
    ssh_user: root
    open_webui: http://192.168.30.82:3000
    access_from_router_ops: ssh root@192.168.30.82

  vm121_wg_access_dev:
    hostname: wg-access-dev
    role: WG Access backend/dev VM
    address: 192.168.30.83
    ssh_user: root
    access_from_router_ops: ssh root@192.168.30.83
    notes:
      - WG Access backend/dev.
      - Expire subscriptions timer and maintenance endpoint were tested here.

  vm130_router_ops:
    hostname: router-ops
    role: operations VM
    address: 192.168.30.84
    ssh_user: ops
    base_dir: /opt/router-ops

  client001_pve:
    hostname: client001 Proxmox
    role: client001 Proxmox host
    address: 10.71.1.222
    ssh_user: root
    access_from_reachable_admin_network: ssh root@10.71.1.222
    notes:
      - Reachability depends on being on client001 LAN/admin WG path.

  client001_vm100_core:
    hostname: client001 VM100-OpenWRT-core
    role: client001 core router
    address: 10.71.1.1
    ssh_user: root
    access_from_reachable_admin_network: ssh root@10.71.1.1
    admin_wg: 10.250.1.1/24
    guest_wg: 10.252.1.0/24
    wg_remote_udp: 51820

  client001_vm101_edge:
    hostname: client001 VM101-OpenWRT-edge
    role: client001 edge / VPN egress
    address: 10.71.1.2
    ssh_user: root
    access_from_reachable_admin_network: ssh root@10.71.1.2

  client001_vm103_wg_easy:
    hostname: client001 VM103-wg-easy
    role: client001 wg-easy guest WG
    address: 10.71.1.189
    ssh_user: root
    wg_easy_panel: http://10.71.1.189:51822
    access_from_reachable_admin_network: ssh root@10.71.1.189

# ============================================================
# SSH AUDIT SUMMARY 2026-07-06
# ============================================================

ssh_audit_20260706:
  report_path: /opt/router-ops/inventory/ssh-access-audit-20260706_131850.txt
  confirmed:
    pve_mgts:
      command: ssh pve-mgts
      key: ~/.ssh/router_ops_pve_mgts_ed25519
      ssh_connection: 10.250.100.4 -> 10.71.100.222:22
      result: SSH_OK
    home_vm100:
      command: ssh home-vm100
      raw_command: ssh -i ~/.ssh/router_ops_ed25519 root@192.168.30.1
      key: ~/.ssh/router_ops_ed25519
      ssh_connection: 192.168.30.84 -> 192.168.30.1:22
      result: SSH_OK
    pve_ai:
      command: ssh pve-ai
      raw_command: ssh -i ~/.ssh/router_ops_ed25519 root@192.168.30.81
      key: ~/.ssh/router_ops_ed25519
      ssh_connection: 192.168.30.84 -> 192.168.30.81:22
      result: SSH_OK
    vm120_ubuntu_ai:
      command: ssh ubuntu-ai
      raw_command: ssh -i ~/.ssh/router_ops_ed25519 root@192.168.30.82
      key: ~/.ssh/router_ops_ed25519
      ssh_connection: 192.168.30.84 -> 192.168.30.82:22
      result: SSH_OK
    vm121_wg_access_dev:
      command: ssh vm121
      alternate_command: ssh wg-access-dev
      raw_command: ssh -i ~/.ssh/router_ops_ed25519 root@192.168.30.83
      key: ~/.ssh/router_ops_ed25519
      ssh_connection: 192.168.30.84 -> 192.168.30.83:22
      result: SSH_OK

  not_confirmed_from_router_ops:
    home_vm101:
      address: 192.168.30.2
      result: permission denied with known router-ops keys
    home_vm103:
      address: 192.168.30.189
      result: permission denied with known router-ops keys
    home_vm104_omr:
      address: 192.168.30.186
      port: 65222
      result: permission denied with known router-ops keys

  currently_unreachable_from_router_ops:
    client001_pve:
      address: 10.71.1.222
      result: no route / timeout
    client001_vm100:
      address: 10.71.1.1
      result: no route / timeout
    client001_vm101:
      address: 10.71.1.2
      result: no route / timeout
    client001_vm103:
      address: 10.71.1.189
      result: no route / timeout

# ============================================================
# WG PAID LIVE PEER APPLY SUMMARY 2026-07-06
# ============================================================

wg_paid_live_peer_apply_20260706:
  status: OK
  marker: /opt/router-ops/inventory/STATUS-WG-PAID-LIVE-PEER-NO-RESTART-OK.txt
  tested_on: home-vm100
  interface: wg_paid
  address: 10.253.1.1/16
  listen_port: 51830
  result:
    - LIVE_WG_SET_NO_INTERFACE_RECREATE_OK
    - PEER_COUNT_RESTORED_OK
  source_audit:
    host: vm121
    agent_file: /opt/wg-access/agent/wg_access_agent.py
    observed:
      - wg set
      - enable_peer
      - disable_peer
    not_observed:
      - ifdown wg_paid
      - ifup wg_paid
      - network reload
      - network restart
  conclusion: paid peer add/remove does not require wg_paid restart

# STATUS 2026-07-06:
# WG Paid live peer add/remove verified on current home VM100.
# Paid peer management must use live wg set / wg set peer remove.
# Do not use UCI + ifdown/ifup for paid peer add/remove.
# Marker:
# /opt/router-ops/inventory/STATUS-WG-PAID-LIVE-PEER-NO-RESTART-OK.txt

# STATUS 2026-07-06:
# MGTS VM101 VPN-egress audit:
# - old HideMyName/AWG configs are present
# - vpn1 is configured/up and table 200 default route points to vpn1
# - vpn2 is configured/down
# - vpn3/vpn4 are absent
# - vpn_user base exists but disabled
# - wg userspace does not show active runtime interface/handshake
# - production requires a fresh HideMyName/AWG config/key for MGTS
# Marker:
# /opt/router-ops/inventory/STATUS-MGTS-VM101-VPN-EGRESS-OLD-AWG-PARTIAL.txt

wg_paid_mgts_direct_vm121:
  project: "WG Paid / pve-wg-paid"
  status: "confirmed"
  date: "2026-07-06"
  principle: "VM121 has direct admin WG access to MGTS; VM130 is not a transit router."

  admin_wireguard:
    interface_on_vm121: "wg-mgts"
    vm121_wg_address: "10.250.100.121/32"
    server_side: "MGTS VM100 wg_remote"
    server_wg_address: "10.250.100.1/24"
    reachable_networks:
      - "10.71.100.0/24"

  mgts_targets:
    vm100_core:
      ip: "10.71.100.1"
      role: "OpenWRT core; wg_remote; wg_paid server"
      ssh_from: "pve-mgts"
      ssh_command: "ssh root@10.71.100.1"
    vm101_edge:
      ip: "10.71.100.2"
      role: "OpenWRT edge; transit/direct/vpn egress"
      ssh_from: "pve-mgts"
      ssh_command: "ssh root@10.71.100.2"
    proxmox:
      ip: "10.71.100.222"
      role: "pve-wg-paid"
      ssh_from: "router-ops"
      ssh_alias: "pve-mgts"

  router_ops_aliases:
    pve_mgts: "ssh pve-mgts"
    vm121: "ssh vm121"

  wg_paid:
    server: "MGTS VM100"
    interface: "wg_paid"
    address: "10.253.1.1/16"
    listen_port_udp: 51830
    test_client_used:
      address: "10.253.254.121/32"
      result: "handshake OK; ping 10.253.1.1 OK; internet OK; cleaned up"

  documentation:
    markdown: "/opt/router-ops/inventory/access-map-wg-paid-mgts.md"

  secrets_policy:
    private_keys_recorded: false
    public_key_fingerprints_only: true
wg_paid_vm121_direct_mgts_admin:
  project: "WG Paid / pve-wg-paid"
  status: "confirmed"
  recorded: "2026-07-06T15:42:33"
  principle: "VM121 has direct admin WireGuard access to MGTS; VM130 is not a transit router."

  vm121:
    role: "wg-access-dev"
    ssh_alias_from_router_ops: "vm121"
    ssh_target: "192.168.30.83"
    ssh_key_path_from_router_ops: "~/.ssh/router_ops_ed25519"
    admin_wg_interface: "wg-mgts"
    admin_wg_address: "10.250.100.121/32"

  mgts:
    management_lan: "10.71.100.0/24"
    wg_remote_server: "MGTS VM100"
    wg_remote_server_ip: "10.71.100.1"
    wg_remote_server_address: "10.250.100.1/24"

  reachable_targets:
    vm100_core:
      ip: "10.71.100.1"
      role: "OpenWRT core; wg_remote; wg_paid"
      ssh_from_pve_mgts: "ssh -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1"
    vm101_edge:
      ip: "10.71.100.2"
      role: "OpenWRT edge; transit/direct/vpn egress"
      ssh_from_pve_mgts: "ssh -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2"
    pve_mgts:
      ip: "10.71.100.222"
      role: "Proxmox pve-wg-paid"
      ssh_alias_from_router_ops: "pve-mgts"
      ssh_key_path_from_router_ops: "~/.ssh/router_ops_pve_mgts_ed25519"

  wg_paid:
    server: "MGTS VM100"
    interface: "wg_paid"
    address: "10.253.1.1/16"
    listen_port_udp: 51830
    temp_smoke_client:
      address: "10.253.254.121/32"
      result: "handshake OK; ping 10.253.1.1 OK; internet OK; cleaned up"
      external_ip_during_test: "94.45.208.160"

  secrets_policy:
    private_keys_recorded: false
    key_paths_recorded: true
    fingerprints_allowed: true



# STEP_034E3_XSMAP_WG_STUDIO_BEGIN
# Permanent MGTS public identity:
#   dns: wg-studio.secret-studio.ru
#   public_ip: 95.165.105.4
#   admin_wg_endpoint: wg-studio.secret-studio.ru:51820
#   wgpaid_client_endpoint: wg-studio.secret-studio.ru:51830
# Access-map correction:
#   VM130/router-ops -> VM101 MGTS edge access was added and must remain documented.
#   VM101 MGTS edge IP: 10.71.100.2
#   WGPay clients are WireGuard peers, not DHCP leases.
# STEP_034E3_XSMAP_WG_STUDIO_END
