# Access Map — router-ops / WG Paid This file is the human-readable source of truth for access paths. No private keys. No public keys. No WireGuard client configs. No passwords or tokens. Allowed here: - machine names - roles - IP addresses - SSH aliases - key file paths - non-secret operational notes Rules: - Do not create new SSH/WG keys unless explicitly requested. - Before suggesting access commands, read /opt/router-ops/inventory/access-map.yml. - Prefer existing SSH aliases and existing key files. - Do not print private keys or WireGuard configs. - Use ssh -n for nested SSH from Proxmox to OpenWRT inside heredocs. ============================================================ MAIN ACCESS PATH TO PVE-WG-PAID ============================================================ router-ops WG router-ops-mgts 10.250.100.4/32 -> VM100 wg_remote 10.250.100.1/24 -> Proxmox pve-wg-paid 10.71.100.222 Command from router-ops: ssh pve-mgts Expected SSH path: source: 10.250.100.4 target: 10.71.100.222 ============================================================ MACHINES ============================================================ router-ops ---------- Role: operations VM User: ops Known address: 192.168.30.84 MGTS report service address: 10.71.100.84 WG interface: router-ops-mgts WG address: 10.250.100.4/32 Systemd service: wg-quick@router-ops-mgts Expected service state: enabled active ------------------------------------------------------------ pve-wg-paid ----------- Role: Proxmox host for WG Paid / MGTS deployment SSH alias from router-ops: pve-mgts SSH user: root Management IP: 10.71.100.222 SSH key path on router-ops: ~/.ssh/router_ops_pve_mgts_ed25519 Network: vmbr0: WAN bridge, no IPv4 on Proxmox host vmbr1: 10.71.100.222/24 internal LAN vmbr2: 192.168.99.1/24 emergency vmbr3: transit VPN bridge, no host IP vmbr4: transit direct bridge, no host IP Route back to WG admin net: 10.250.100.0/24 via 10.71.100.1 dev vmbr1 Old temporary DDN IP: 192.168.30.249 Old temporary DDN IP status: deprecated do not rely on it ------------------------------------------------------------ MGTS VM100 core --------------- VMID: 100 Hostname: VM100-OpenWRT-core Role: OpenWRT core router for pve-wg-paid SSH from Proxmox: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1 Addresses: br-lan: 10.71.100.1/24 wg_remote: 10.250.100.1/24 direct transit: 10.201.0.1/24 vpn transit: 10.200.0.1/24 wg_remote: listen UDP: 51820 wg_remote peers: support-mgts: 10.250.100.2/32 owner-mgts: 10.250.100.3/32 router-ops-mgts: 10.250.100.4/32 Snapshots: MGTS_RESTORED_BEFORE_FIRST_BOOT MGTS_INTERNAL_LAN_RENUMBERED_OK MGTS_VM100_WG_REMOTE_ROTATED_OK MGTS_VM100_ROUTER_OPS_WG_PEER_OK ------------------------------------------------------------ MGTS VM101 edge --------------- VMID: 101 Hostname: VM101-OpenWRT-edge Role: OpenWRT edge / WAN / VPN egress for pve-wg-paid SSH from Proxmox: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2 Addresses: WAN eth0: 95.165.105.4/20 static public address mgmt eth2: 10.71.100.2/24 vpn_in eth1: 10.200.0.2/24 direct_in eth3: 10.201.0.2/24 Route back to admin WG: 10.250.100.0/24 via 10.71.100.1 dev eth2 Snapshots: MGTS_RESTORED_BEFORE_FIRST_BOOT MGTS_INTERNAL_LAN_RENUMBERED_OK MGTS_VM101_CURRENT_20260702_OK ============================================================ OPERATING NOTES ============================================================ router-ops-mgts uses the permanent MGTS endpoint: wg-studio.secret-studio.ru:51820 HideMyName/AWG keys still need future replacement before production use. --- ## VM121 direct MGTS admin access Status: confirmed. Recorded: 2026-07-06T15:42:33 Purpose: VM121 wg-access-dev has its own direct administrative WireGuard access to MGTS 10.71.100.0/24. VM130/router-ops is only an operator/control node. VM130 is not a transit router for VM121. Direct admin WireGuard: VM121 interface: wg-mgts VM121 WG address: 10.250.100.121/32 MGTS server side: VM100 wg_remote MGTS WG server addr: 10.250.100.1/24 MGTS LAN reachable: 10.71.100.0/24 Confirmed reachable targets from VM121: 10.71.100.1 MGTS VM100 OpenWRT core 10.71.100.2 MGTS VM101 OpenWRT edge 10.71.100.222 MGTS Proxmox pve-wg-paid SSH access paths: router-ops -> pve-mgts: command: ssh pve-mgts target: 10.71.100.222 key path: ~/.ssh/router_ops_pve_mgts_ed25519 router-ops -> VM121: command: ssh vm121 target: 192.168.30.83 key path: ~/.ssh/router_ops_ed25519 pve-mgts -> MGTS VM100: command: ssh -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1 pve-mgts -> MGTS VM101: command: ssh -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2 Confirmed smoke tests: VM121 -> 10.71.100.1 OK VM121 -> 10.71.100.2 OK VM121 -> 10.71.100.222 OK wg_paid live temp client smoke: temp client: 10.253.254.121/32 target: 10.253.1.1 handshake: OK server ping: OK internet: OK external IP during smoke: 94.45.208.160 cleanup: temp peer/client removed Secrets policy: Private keys are not recorded here. Only key paths, public keys and fingerprints may be recorded. ## WG Studio / MGTS endpoint update Updated: 2026-07-08 11:50:45 Permanent MGTS public identity: - DNS: `wg-studio.secret-studio.ru` - Public IP: `95.165.105.4` - Admin WireGuard endpoint: `wg-studio.secret-studio.ru:51820` - WG Paid client endpoint: `wg-studio.secret-studio.ru:51830` Important access-map correction: - VM130/router-ops reaches MGTS VM101 through `ssh pve-mgts` and nested SSH from Proxmox; direct root SSH from VM130 is not the approved path. - VM101 MGTS edge address: `10.71.100.2` - WGPay clients are WireGuard peers, not DHCP clients; canary/source selection must use WG peer tunnel IP / AllowedIPs / subscription records, not DHCP leases. ## Permanent report publication Updated: 2026-07-15 Public HTTPS endpoints: - Root: `https://reports.secret-studio.ru/` - Current canonical objects: `https://reports.secret-studio.ru/latest/` - History and rollback: `https://reports.secret-studio.ru/old/` Publication path: - Public DNS `reports.secret-studio.ru` resolves to `95.165.105.4`. - MGTS VM101 forwards public TCP 80/443 to VM130 Caddy at `10.71.100.84`. - VM130 serves the publication tree from `/opt/router-ops/public`. - From VM130, direct TLS verification uses `--resolve reports.secret-studio.ru:443:10.71.100.84`; `curl -k` is forbidden. - Cloudflare Quick Tunnel URLs are legacy and must not be generated, stored as current state, or printed by active publication tools. --- ## 2026-08-12 — BEACH OMR / MGTS primary integration — CURRENT / VERIFIED ### Primary OMR server ```text MGTS VM102 VMID: 102 LAN: 10.71.100.85/24 gateway: 10.71.100.1 public IP: 95.165.105.4 SSH: 65222/tcp Xray: 65248/tcp OpenVPN: 65301/tcp OMR API: 65500/tcp HTTPS ``` SSH from router-ops: ```text ssh -i ~/.ssh/router_ops_ed25519 -p 65222 debian@10.71.100.85 ``` ### Public ingress path ```text BEACH / Internet -> VM101 WAN 95.165.105.4 -> DNAT -> VM100 Direct transit -> VM102 10.71.100.85 ``` VM101 persistent DNAT sections: ```text firewall.beach_omr_xray_65248 firewall.beach_omr_openvpn_65301 firewall.beach_omr_api_65500 ``` ### Required symmetric return path on VM101 ```text priority 10005: iif eth0 to 10.71.100.85/32 lookup 210 table 210: 10.71.100.85 via 10.201.0.1 dev eth3 ``` Persistent UCI sections: ```text network.beach_omr_return_route network.beach_omr_return_rule ``` `/etc/config/network` on VM101 contains private keys and is intentionally not tracked wholesale in Machine Git. Do not add the whole file to Git. ### VM100 BEACH-owned integration ```text /etc/nftables.d/92-beach-omr-routing.nft SHA256=d2fe6162d731d17ae2092ce5b8dc1e52d7ef4fa375c5468d75789fc589a470ea ``` It provides VM102 Direct transport classification, narrow no-SNAT, DSCP cleanup and narrow inbound permits for TCP 65248/65301/65500. Existing Router five-slot PBR semantics remain authoritative and were preserved. ### Current canonical shared-core Machine Git freeze ```text VM100 HEAD=35c424e53504e8b5e2da227a869f29417fdbe14c TREE=dd082a27a7f35f43efa8bd07b222ce86200edda1 VM101 HEAD=5bc942f5908a2c8fcd92606f9d9e8d50974039f0 TREE=38805542a21bccf9a48097c464f09c3f0172b00d /etc/config/firewall SHA256=0b568b80b377730a981358e0cba88648e2fb898a3f9e08cfd25e41cc14a8555b ``` Before any future WG Paid / MGTS mutation, read live HEAD/TREE first. Do not use pre-BEACH freezes as expected current state. ### Final proof ```text RESULT=PASS_MGTS_PRIMARY_OMR_END_TO_END ``` Final public ingress counters: ```text VM101: Xray 65248=1382 packets; OpenVPN 65301=3; API 65500=61 VM100: Xray 65248=1386 packets; OpenVPN 65301=3; API 65500=61 ``` BEACH VM110: ```text LAN=192.168.100.1 BEACH PVE=192.168.100.254 tun0=10.255.252.2/24 Xray=95.165.105.4:65248 OpenVPN=95.165.105.4:65301 VPS API=95.165.105.4:65500 both LTE paths=PASS client Internet=PASS ``` Direct SSH from router-ops to BEACH VM110/PVE is currently not available. ### DDN access from router-ops — current ```text ssh home-vm100 -> 192.168.30.1 ssh home-vm101 -> 192.168.30.2 ``` Temporary reverse SSH ports are no longer required for these two paths. ### Operational protection VM100 and VM101 are shared infrastructure. Reconcile current Machine Git HEAD/TREE before mutation, preserve BEACH rules, never wholesale-track VM101 `/etc/config/network`, use `cd /` for path-scoped Machine Git operations, and use the proven `setsid` timed-rollback pattern for risky OpenWrt live changes.