### /opt/router-ops/inventory/access-map.yml # router-ops access inventory # Source of truth for access paths. # No private keys, public keys, WireGuard configs, passwords, or secrets. version: 2026-07-06 policy: - Do not create new SSH/WG keys unless explicitly requested. - Before suggesting access commands, read this inventory. - Do not print private keys or WireGuard client configs. - Prefer existing SSH aliases and existing key files. - Use ssh -n for nested SSH from Proxmox to OpenWRT inside heredocs. machines: router_ops: hostname: router-ops role: operations VM user: ops known_address: 192.168.30.84 wg_interface: router-ops-mgts wg_address: 10.250.100.4/32 wg_service: wg-quick@router-ops-mgts pve_wg_paid: hostname: pve-wg-paid role: Proxmox host for WG Paid / MGTS deployment ssh_alias_from_router_ops: pve-mgts ssh_user: root management_ip: 10.71.100.222 ssh_key_from_router_ops: ~/.ssh/router_ops_pve_mgts_ed25519 old_temporary_ddn_ip: 192.168.30.249 network: vmbr0: WAN bridge, no IPv4 on Proxmox host vmbr1: 10.71.100.222/24 internal LAN vmbr2: 192.168.99.1/24 emergency vmbr3: VM100-VM101 VPN transit bridge vmbr4: VM100-VM101 direct transit bridge routes: - 10.250.100.0/24 via 10.71.100.1 dev vmbr1 mgts_vm100_core: vmid: 100 hostname: VM100-OpenWRT-core role: OpenWRT core router for pve-wg-paid ssh_from_pve: user: root host: 10.71.100.1 key: /root/.ssh/pve_to_openwrt_mgts_ed25519 addresses: br_lan: 10.71.100.1/24 wg_remote: 10.250.100.1/24 direct_transit: 10.201.0.1/24 vpn_transit: 10.200.0.1/24 wg_remote: listen_udp: 51820 peers: support-mgts: 10.250.100.2/32 owner-mgts: 10.250.100.3/32 router-ops-mgts: 10.250.100.4/32 snapshots: - MGTS_RESTORED_BEFORE_FIRST_BOOT - MGTS_INTERNAL_LAN_RENUMBERED_OK - MGTS_VM100_WG_REMOTE_ROTATED_OK - MGTS_VM100_ROUTER_OPS_WG_PEER_OK mgts_vm101_edge: vmid: 101 hostname: VM101-OpenWRT-edge role: OpenWRT edge/WAN/VPN egress for pve-wg-paid ssh_from_pve: user: root host: 10.71.100.2 key: /root/.ssh/pve_to_openwrt_mgts_ed25519 addresses: wan_eth0: DHCP behind vmbr0 mgmt_eth2: 10.71.100.2/24 vpn_in_eth1: 10.200.0.2/24 direct_in_eth3: 10.201.0.2/24 route_back_to_admin_wg: 10.250.100.0/24 via 10.71.100.1 dev eth2 snapshots: - MGTS_RESTORED_BEFORE_FIRST_BOOT - MGTS_INTERNAL_LAN_RENUMBERED_OK - MGTS_VM101_CURRENT_20260702_OK wireguard: router_ops_mgts: local_machine: router_ops interface: router-ops-mgts address: 10.250.100.4/32 systemd_service: wg-quick@router-ops-mgts expected_service_state: enabled and active current_test_endpoint: wg-studio.secret-studio.ru:51820 server: mgts_vm100_core wg_remote 10.250.100.1 UDP 51820 allowed_ips: - 10.250.100.0/24 - 10.71.100.0/24 - 10.200.0.0/24 - 10.201.0.0/24 ssh_paths: router_ops_to_pve_wg_paid: from: router_ops to: pve_wg_paid command: ssh pve-mgts alias: pve-mgts expected_target: 10.71.100.222 expected_source: 10.250.100.4 key: ~/.ssh/router_ops_pve_mgts_ed25519 transport: WireGuard router-ops-mgts pve_wg_paid_to_mgts_vm100: from: pve_wg_paid to: mgts_vm100_core command: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1 key: /root/.ssh/pve_to_openwrt_mgts_ed25519 transport: vmbr1 internal LAN pve_wg_paid_to_mgts_vm101: from: pve_wg_paid to: mgts_vm101_edge command: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2 key: /root/.ssh/pve_to_openwrt_mgts_ed25519 transport: vmbr1 internal LAN deprecated_or_temporary: pve_mgts_old_ddn: alias: pve-mgts-old-ddn old_host: 192.168.30.249 status: deprecated reason: Proxmox vmbr0 now has no IPv4; management moved to WG/internal LAN. # ============================================================ # EXTENDED GLOBAL ACCESS INVENTORY # Added: known router-ops/home/client/dev machines. # No secrets here. Key paths only. # ============================================================ known_networks: home_ddn_lan: cidr: 192.168.30.0/24 gateway: 192.168.30.1 notes: - Main DDN/home LAN. - router-ops lives here as 192.168.30.84. client001_lan: cidr: 10.71.1.0/24 notes: - client001 commercial rollout LAN. pve_wg_paid_lan: cidr: 10.71.100.0/24 notes: - pve-wg-paid internal logical LAN. pve_wg_paid_admin_wg: cidr: 10.250.100.0/24 notes: - pve-wg-paid admin WireGuard net. client001_admin_wg: cidr: 10.250.1.0/24 client001_guest_wg: cidr: 10.252.1.0/24 extended_machines: home_vm100_core: hostname: VM100-OpenWRT-core role: home/DDN OpenWRT core router address: 192.168.30.1 ssh_user: root access_from_router_ops: ssh root@192.168.30.1 notes: - Current working/home VM100. - This is the right target for testing existing paid wg interface, not MGTS VM100. home_vm101_edge: hostname: VM101-OpenWRT-edge role: home/DDN OpenWRT edge / VPN egress address: 192.168.30.2 ssh_user: root access_from_router_ops: ssh root@192.168.30.2 home_vm103_wg_easy: hostname: VM103-wg-easy role: home/DDN wg-easy guest WG address: 192.168.30.189 ssh_user: root wg_easy_panel: http://192.168.30.189:51822 access_from_router_ops: ssh root@192.168.30.189 home_vm104_omr_server: hostname: DDN-OMR-SERVER role: OpenMPTCProuter server in DDN address: 192.168.30.186 ssh_user: root ssh_port: 65222 access_from_router_ops: ssh -p 65222 root@192.168.30.186 notes: - SSH is on port 65222, not 22. pve_ai: hostname: pve-ai role: Proxmox host with VM120/VM121/VM130 address: 192.168.30.81 ssh_user: root access_from_router_ops: ssh root@192.168.30.81 vm120_ubuntu_ai: hostname: ubuntu-ai role: local AI / Ollama / Open WebUI address: 192.168.30.82 ssh_user: root open_webui: http://192.168.30.82:3000 access_from_router_ops: ssh root@192.168.30.82 vm121_wg_access_dev: hostname: wg-access-dev role: WG Access backend/dev VM address: 192.168.30.83 ssh_user: root access_from_router_ops: ssh root@192.168.30.83 notes: - WG Access backend/dev. - Expire subscriptions timer and maintenance endpoint were tested here. vm130_router_ops: hostname: router-ops role: operations VM address: 192.168.30.84 ssh_user: ops base_dir: /opt/router-ops client001_pve: hostname: client001 Proxmox role: client001 Proxmox host address: 10.71.1.222 ssh_user: root access_from_reachable_admin_network: ssh root@10.71.1.222 notes: - Reachability depends on being on client001 LAN/admin WG path. client001_vm100_core: hostname: client001 VM100-OpenWRT-core role: client001 core router address: 10.71.1.1 ssh_user: root access_from_reachable_admin_network: ssh root@10.71.1.1 admin_wg: 10.250.1.1/24 guest_wg: 10.252.1.0/24 wg_remote_udp: 51820 client001_vm101_edge: hostname: client001 VM101-OpenWRT-edge role: client001 edge / VPN egress address: 10.71.1.2 ssh_user: root access_from_reachable_admin_network: ssh root@10.71.1.2 client001_vm103_wg_easy: hostname: client001 VM103-wg-easy role: client001 wg-easy guest WG address: 10.71.1.189 ssh_user: root wg_easy_panel: http://10.71.1.189:51822 access_from_reachable_admin_network: ssh root@10.71.1.189 # ============================================================ # SSH AUDIT SUMMARY 2026-07-06 # ============================================================ ssh_audit_20260706: report_path: /opt/router-ops/inventory/ssh-access-audit-20260706_131850.txt confirmed: pve_mgts: command: ssh pve-mgts key: ~/.ssh/router_ops_pve_mgts_ed25519 ssh_connection: 10.250.100.4 -> 10.71.100.222:22 result: SSH_OK home_vm100: command: ssh home-vm100 raw_command: ssh -i ~/.ssh/router_ops_ed25519 root@192.168.30.1 key: ~/.ssh/router_ops_ed25519 ssh_connection: 192.168.30.84 -> 192.168.30.1:22 result: SSH_OK pve_ai: command: ssh pve-ai raw_command: ssh -i ~/.ssh/router_ops_ed25519 root@192.168.30.81 key: ~/.ssh/router_ops_ed25519 ssh_connection: 192.168.30.84 -> 192.168.30.81:22 result: SSH_OK vm120_ubuntu_ai: command: ssh ubuntu-ai raw_command: ssh -i ~/.ssh/router_ops_ed25519 root@192.168.30.82 key: ~/.ssh/router_ops_ed25519 ssh_connection: 192.168.30.84 -> 192.168.30.82:22 result: SSH_OK vm121_wg_access_dev: command: ssh vm121 alternate_command: ssh wg-access-dev raw_command: ssh -i ~/.ssh/router_ops_ed25519 root@192.168.30.83 key: ~/.ssh/router_ops_ed25519 ssh_connection: 192.168.30.84 -> 192.168.30.83:22 result: SSH_OK not_confirmed_from_router_ops: home_vm101: address: 192.168.30.2 result: permission denied with known router-ops keys home_vm103: address: 192.168.30.189 result: permission denied with known router-ops keys home_vm104_omr: address: 192.168.30.186 port: 65222 result: permission denied with known router-ops keys currently_unreachable_from_router_ops: client001_pve: address: 10.71.1.222 result: no route / timeout client001_vm100: address: 10.71.1.1 result: no route / timeout client001_vm101: address: 10.71.1.2 result: no route / timeout client001_vm103: address: 10.71.1.189 result: no route / timeout # ============================================================ # WG PAID LIVE PEER APPLY SUMMARY 2026-07-06 # ============================================================ wg_paid_live_peer_apply_20260706: status: OK marker: /opt/router-ops/inventory/STATUS-WG-PAID-LIVE-PEER-NO-RESTART-OK.txt tested_on: home-vm100 interface: wg_paid address: 10.253.1.1/16 listen_port: 51830 result: - LIVE_WG_SET_NO_INTERFACE_RECREATE_OK - PEER_COUNT_RESTORED_OK source_audit: host: vm121 agent_file: /opt/wg-access/agent/wg_access_agent.py observed: - wg set - enable_peer - disable_peer not_observed: - ifdown wg_paid - ifup wg_paid - network reload - network restart conclusion: paid peer add/remove does not require wg_paid restart # STATUS 2026-07-06: # WG Paid live peer add/remove verified on current home VM100. # Paid peer management must use live wg set / wg set peer remove. # Do not use UCI + ifdown/ifup for paid peer add/remove. # Marker: # /opt/router-ops/inventory/STATUS-WG-PAID-LIVE-PEER-NO-RESTART-OK.txt # STATUS 2026-07-06: # MGTS VM101 VPN-egress audit: # - old HideMyName/AWG configs are present # - vpn1 is configured/up and table 200 default route points to vpn1 # - vpn2 is configured/down # - vpn3/vpn4 are absent # - vpn_user base exists but disabled # - wg userspace does not show active runtime interface/handshake # - production requires a fresh HideMyName/AWG config/key for MGTS # Marker: # /opt/router-ops/inventory/STATUS-MGTS-VM101-VPN-EGRESS-OLD-AWG-PARTIAL.txt wg_paid_mgts_direct_vm121: project: "WG Paid / pve-wg-paid" status: "confirmed" date: "2026-07-06" principle: "VM121 has direct admin WG access to MGTS; VM130 is not a transit router." admin_wireguard: interface_on_vm121: "wg-mgts" vm121_wg_address: "10.250.100.121/32" server_side: "MGTS VM100 wg_remote" server_wg_address: "10.250.100.1/24" reachable_networks: - "10.71.100.0/24" mgts_targets: vm100_core: ip: "10.71.100.1" role: "OpenWRT core; wg_remote; wg_paid server" ssh_from: "pve-mgts" ssh_command: "ssh root@10.71.100.1" vm101_edge: ip: "10.71.100.2" role: "OpenWRT edge; transit/direct/vpn egress" ssh_from: "pve-mgts" ssh_command: "ssh root@10.71.100.2" proxmox: ip: "10.71.100.222" role: "pve-wg-paid" ssh_from: "router-ops" ssh_alias: "pve-mgts" router_ops_aliases: pve_mgts: "ssh pve-mgts" vm121: "ssh vm121" wg_paid: server: "MGTS VM100" interface: "wg_paid" address: "10.253.1.1/16" listen_port_udp: 51830 test_client_used: address: "10.253.254.121/32" result: "handshake OK; ping 10.253.1.1 OK; internet OK; cleaned up" documentation: markdown: "/opt/router-ops/inventory/access-map-wg-paid-mgts.md" secrets_policy: private_keys_recorded: false public_key_fingerprints_only: true wg_paid_vm121_direct_mgts_admin: project: "WG Paid / pve-wg-paid" status: "confirmed" recorded: "2026-07-06T15:42:33" principle: "VM121 has direct admin WireGuard access to MGTS; VM130 is not a transit router." vm121: role: "wg-access-dev" ssh_alias_from_router_ops: "vm121" ssh_target: "192.168.30.83" ssh_key_path_from_router_ops: "~/.ssh/router_ops_ed25519" admin_wg_interface: "wg-mgts" admin_wg_address: "10.250.100.121/32" mgts: management_lan: "10.71.100.0/24" wg_remote_server: "MGTS VM100" wg_remote_server_ip: "10.71.100.1" wg_remote_server_address: "10.250.100.1/24" reachable_targets: vm100_core: ip: "10.71.100.1" role: "OpenWRT core; wg_remote; wg_paid" ssh_from_pve_mgts: "ssh -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1" vm101_edge: ip: "10.71.100.2" role: "OpenWRT edge; transit/direct/vpn egress" ssh_from_pve_mgts: "ssh -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2" pve_mgts: ip: "10.71.100.222" role: "Proxmox pve-wg-paid" ssh_alias_from_router_ops: "pve-mgts" ssh_key_path_from_router_ops: "~/.ssh/router_ops_pve_mgts_ed25519" wg_paid: server: "MGTS VM100" interface: "wg_paid" address: "10.253.1.1/16" listen_port_udp: 51830 temp_smoke_client: address: "10.253.254.121/32" result: "handshake OK; ping 10.253.1.1 OK; internet OK; cleaned up" external_ip_during_test: "94.45.208.160" secrets_policy: private_keys_recorded: false key_paths_recorded: true fingerprints_allowed: true # STEP_034E3_XSMAP_WG_STUDIO_BEGIN # Permanent MGTS public identity: # dns: wg-studio.secret-studio.ru # public_ip: 95.165.105.4 # admin_wg_endpoint: wg-studio.secret-studio.ru:51820 # wgpaid_client_endpoint: wg-studio.secret-studio.ru:51830 # Access-map correction: # VM130/router-ops -> VM101 MGTS edge access was added and must remain documented. # VM101 MGTS edge IP: 10.71.100.2 # WGPay clients are WireGuard peers, not DHCP leases. # STEP_034E3_XSMAP_WG_STUDIO_END ### /opt/router-ops/inventory/access-map.md # Access Map — router-ops / WG Paid This file is the human-readable source of truth for access paths. No private keys. No public keys. No WireGuard client configs. No passwords or tokens. Allowed here: - machine names - roles - IP addresses - SSH aliases - key file paths - non-secret notes Rules: - Do not create new SSH/WG keys unless explicitly requested. - Before suggesting access commands, read /opt/router-ops/inventory/access-map.yml. - Prefer existing SSH aliases and existing key files. - Do not print private keys or WireGuard configs. - Use ssh -n for nested SSH from Proxmox to OpenWRT inside heredocs. ============================================================ MAIN ACCESS PATH TO PVE-WG-PAID ============================================================ router-ops WG router-ops-mgts 10.250.100.4/32 -> VM100 wg_remote 10.250.100.1/24 -> Proxmox pve-wg-paid 10.71.100.222 Command from router-ops: ssh pve-mgts Expected SSH path: source: 10.250.100.4 target: 10.71.100.222 ============================================================ MACHINES ============================================================ router-ops ---------- Role: operations VM User: ops Known address: 192.168.30.84 WG interface: router-ops-mgts WG address: 10.250.100.4/32 Systemd service: wg-quick@router-ops-mgts Expected service state: enabled active ------------------------------------------------------------ pve-wg-paid ----------- Role: Proxmox host for WG Paid / MGTS deployment SSH alias from router-ops: pve-mgts SSH user: root Management IP: 10.71.100.222 SSH key path on router-ops: ~/.ssh/router_ops_pve_mgts_ed25519 Network: vmbr0: WAN bridge, no IPv4 on Proxmox host vmbr1: 10.71.100.222/24 internal LAN vmbr2: 192.168.99.1/24 emergency vmbr3: transit VPN bridge, no host IP vmbr4: transit direct bridge, no host IP Route back to WG admin net: 10.250.100.0/24 via 10.71.100.1 dev vmbr1 Old temporary DDN IP: 192.168.30.249 Old temporary DDN IP status: deprecated do not rely on it ------------------------------------------------------------ MGTS VM100 core --------------- VMID: 100 Hostname: VM100-OpenWRT-core Role: OpenWRT core router for pve-wg-paid SSH from Proxmox: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1 Addresses: br-lan: 10.71.100.1/24 wg_remote: 10.250.100.1/24 direct transit: 10.201.0.1/24 vpn transit: 10.200.0.1/24 wg_remote: listen UDP: 51820 wg_remote peers: support-mgts: 10.250.100.2/32 owner-mgts: 10.250.100.3/32 router-ops-mgts: 10.250.100.4/32 Snapshots: MGTS_RESTORED_BEFORE_FIRST_BOOT MGTS_INTERNAL_LAN_RENUMBERED_OK MGTS_VM100_WG_REMOTE_ROTATED_OK MGTS_VM100_ROUTER_OPS_WG_PEER_OK ------------------------------------------------------------ MGTS VM101 edge --------------- VMID: 101 Hostname: VM101-OpenWRT-edge Role: OpenWRT edge / WAN / VPN egress for pve-wg-paid SSH from Proxmox: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2 Addresses: WAN eth0: DHCP behind vmbr0 mgmt eth2: 10.71.100.2/24 vpn_in eth1: 10.200.0.2/24 direct_in eth3: 10.201.0.2/24 Route back to admin WG: 10.250.100.0/24 via 10.71.100.1 dev eth2 Snapshots: MGTS_RESTORED_BEFORE_FIRST_BOOT MGTS_INTERNAL_LAN_RENUMBERED_OK MGTS_VM101_CURRENT_20260702_OK ============================================================ TEMPORARY NOTES ============================================================ router-ops-mgts currently uses temporary DDN test endpoint: wg-studio.secret-studio.ru:51820 On MGTS site, update endpoint to real public IP/DNS or MGTS router forward/DMZ address. HideMyName/AWG keys still need future replacement before production use. --- ## VM121 direct MGTS admin access Status: confirmed. Recorded: 2026-07-06T15:42:33 Purpose: VM121 wg-access-dev has its own direct administrative WireGuard access to MGTS 10.71.100.0/24. VM130/router-ops is only an operator/control node. VM130 is not a transit router for VM121. Direct admin WireGuard: VM121 interface: wg-mgts VM121 WG address: 10.250.100.121/32 MGTS server side: VM100 wg_remote MGTS WG server addr: 10.250.100.1/24 MGTS LAN reachable: 10.71.100.0/24 Confirmed reachable targets from VM121: 10.71.100.1 MGTS VM100 OpenWRT core 10.71.100.2 MGTS VM101 OpenWRT edge 10.71.100.222 MGTS Proxmox pve-wg-paid SSH access paths: router-ops -> pve-mgts: command: ssh pve-mgts target: 10.71.100.222 key path: ~/.ssh/router_ops_pve_mgts_ed25519 router-ops -> VM121: command: ssh vm121 target: 192.168.30.83 key path: ~/.ssh/router_ops_ed25519 pve-mgts -> MGTS VM100: command: ssh -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1 pve-mgts -> MGTS VM101: command: ssh -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2 Confirmed smoke tests: VM121 -> 10.71.100.1 OK VM121 -> 10.71.100.2 OK VM121 -> 10.71.100.222 OK wg_paid live temp client smoke: temp client: 10.253.254.121/32 target: 10.253.1.1 handshake: OK server ping: OK internet: OK external IP during smoke: 94.45.208.160 cleanup: temp peer/client removed Secrets policy: Private keys are not recorded here. Only key paths, public keys and fingerprints may be recorded. ## WG Studio / MGTS endpoint update Updated: 2026-07-08 11:50:45 Permanent MGTS public identity: - DNS: `wg-studio.secret-studio.ru` - Public IP: `95.165.105.4` - Admin WireGuard endpoint: `wg-studio.secret-studio.ru:51820` - WG Paid client endpoint: `wg-studio.secret-studio.ru:51830` Important access-map correction: - VM130/router-ops now has direct SSH access to MGTS VM101 and this must stay represented in the map. - VM101 MGTS edge address: `10.71.100.2` - WGPay clients are WireGuard peers, not DHCP clients; canary/source selection must use WG peer tunnel IP / AllowedIPs / subscription records, not DHCP leases.