version: 2026-07-14-studio-lan-cutover
policy:
- Do not create new SSH/WG keys unless explicitly requested.
- Before suggesting access commands, read this inventory.
- Do not print private keys or WireGuard client configs.
- Prefer existing SSH aliases and existing key files.
- Use ssh -n for nested SSH from Proxmox to OpenWRT inside heredocs.
machines:
  router_ops:
    hostname: router-ops
    role: operations VM
    user: ops
    known_address: 10.71.100.84
    wg_interface: router-ops-mgts (legacy, disabled)
    wg_address: 10.250.100.4/32 (legacy)
    wg_service: wg-quick@router-ops-mgts (disabled, inactive)
    network: direct studio LAN 10.71.100.0/24 via eth0
    default_gateway: 10.71.100.1
  pve_wg_paid:
    hostname: pve-wg-paid
    role: Proxmox host for WG Paid / MGTS deployment
    ssh_alias_from_router_ops: pve-mgts
    ssh_user: root
    management_ip: 10.71.100.222
    ssh_key_from_router_ops: ~/.ssh/router_ops_pve_mgts_ed25519
    old_temporary_ddn_ip: 192.168.30.249
    network:
      vmbr0: WAN bridge; physical port enp14s0; no IPv4 on Proxmox host
      vmbr1: 10.71.100.222/24 internal LAN; physical port eno1
      vmbr2: 192.168.99.1/24 emergency
      vmbr3: VM100-VM101 VPN transit bridge
      vmbr4: VM100-VM101 direct transit bridge
    routes:
    - 10.250.100.0/24 via 10.71.100.1 dev vmbr1
  mgts_vm100_core:
    vmid: 100
    hostname: VM100-OpenWRT-core
    role: OpenWRT core router for pve-wg-paid
    ssh_from_pve:
      user: root
      host: 10.71.100.1
      key: /root/.ssh/pve_to_openwrt_mgts_ed25519
    addresses:
      br_lan: 10.71.100.1/24
      wg_remote: 10.250.100.1/24
      direct_transit: 10.201.0.1/24
      vpn_transit: 10.200.0.1/24
    wg_remote:
      listen_udp: 51820
      peers:
        support-mgts: 10.250.100.2/32
        owner-mgts: 10.250.100.3/32
        router-ops-mgts: 10.250.100.4/32
    snapshots:
    - MGTS_RESTORED_BEFORE_FIRST_BOOT
    - MGTS_INTERNAL_LAN_RENUMBERED_OK
    - MGTS_VM100_WG_REMOTE_ROTATED_OK
    - MGTS_VM100_ROUTER_OPS_WG_PEER_OK
  mgts_vm101_edge:
    vmid: 101
    hostname: VM101-OpenWRT-edge
    role: OpenWRT edge/WAN/VPN egress for pve-wg-paid
    ssh_from_pve:
      user: root
      host: 10.71.100.2
      key: /root/.ssh/pve_to_openwrt_mgts_ed25519
    addresses:
      wan_eth0: DHCP behind vmbr0
      mgmt_eth2: 10.71.100.2/24
      vpn_in_eth1: 10.200.0.2/24
      direct_in_eth3: 10.201.0.2/24
    route_back_to_admin_wg: 10.250.100.0/24 via 10.71.100.1 dev eth2
    snapshots:
    - MGTS_RESTORED_BEFORE_FIRST_BOOT
    - MGTS_INTERNAL_LAN_RENUMBERED_OK
    - MGTS_VM101_CURRENT_20260702_OK
wireguard:
  router_ops_mgts:
    local_machine: router_ops
    interface: router-ops-mgts
    address: 10.250.100.4/32
    systemd_service: wg-quick@router-ops-mgts
    expected_service_state: disabled and inactive
    current_test_endpoint: wg-studio.secret-studio.ru:51820
    server: mgts_vm100_core wg_remote 10.250.100.1 UDP 51820
    allowed_ips:
    - 10.250.100.0/24
    - 10.71.100.0/24
    - 10.200.0.0/24
    - 10.201.0.0/24
    status: legacy_disabled_after_studio_colocation
    current_transport_replacement: direct studio LAN 10.71.100.0/24
    retention: configuration retained for rollback/history; do not start while direct LAN route exists
ssh_paths:
  router_ops_to_pve_wg_paid:
    from: router_ops
    to: pve_wg_paid
    command: ssh pve-mgts
    alias: pve-mgts
    expected_target: 10.71.100.222
    expected_source: 10.71.100.84
    key: ~/.ssh/router_ops_pve_mgts_ed25519
    transport: direct studio LAN 10.71.100.0/24
  pve_wg_paid_to_mgts_vm100:
    from: pve_wg_paid
    to: mgts_vm100_core
    command: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1
    key: /root/.ssh/pve_to_openwrt_mgts_ed25519
    transport: vmbr1 internal LAN
  pve_wg_paid_to_mgts_vm101:
    from: pve_wg_paid
    to: mgts_vm101_edge
    command: ssh -n -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2
    key: /root/.ssh/pve_to_openwrt_mgts_ed25519
    transport: vmbr1 internal LAN
deprecated_or_temporary:
  pve_mgts_old_ddn:
    alias: pve-mgts-old-ddn
    old_host: 192.168.30.249
    status: deprecated
    reason: Proxmox vmbr0 now has no IPv4; management moved to WG/internal LAN.
known_networks:
  home_ddn_lan:
    cidr: 192.168.30.0/24
    gateway: 192.168.30.1
    notes:
    - Main DDN/home LAN.
    - Former location of VM120/VM121/VM130 before the 2026-07-14 studio migration.
  client001_lan:
    cidr: 10.71.1.0/24
    notes:
    - client001 commercial rollout LAN.
  pve_wg_paid_lan:
    cidr: 10.71.100.0/24
    notes:
    - pve-wg-paid internal logical LAN.
  pve_wg_paid_admin_wg:
    cidr: 10.250.100.0/24
    notes:
    - pve-wg-paid admin WireGuard net.
  client001_admin_wg:
    cidr: 10.250.1.0/24
  client001_guest_wg:
    cidr: 10.252.1.0/24
extended_machines:
  home_vm100_core:
    hostname: VM100-OpenWRT-core
    role: home/DDN OpenWRT core router
    address: 192.168.30.1
    ssh_user: root
    access_from_router_ops: ssh root@192.168.30.1
    notes:
    - Current working/home VM100.
    - This is the right target for testing existing paid wg interface, not MGTS VM100.
  home_vm101_edge:
    hostname: VM101-OpenWRT-edge
    role: home/DDN OpenWRT edge / VPN egress
    address: 192.168.30.2
    ssh_user: root
    access_from_router_ops: ssh root@192.168.30.2
  home_vm103_wg_easy:
    hostname: VM103-wg-easy
    role: home/DDN wg-easy guest WG
    address: 192.168.30.189
    ssh_user: root
    wg_easy_panel: http://192.168.30.189:51822
    access_from_router_ops: ssh root@192.168.30.189
  home_vm104_omr_server:
    hostname: DDN-OMR-SERVER
    role: OpenMPTCProuter server in DDN
    address: 192.168.30.186
    ssh_user: root
    ssh_port: 65222
    access_from_router_ops: ssh -p 65222 root@192.168.30.186
    notes:
    - SSH is on port 65222, not 22.
  pve_ai:
    hostname: pve-ai
    role: Proxmox host with VM120/VM121/VM130
    address: 10.71.100.81
    ssh_user: root
    access_from_router_ops: ssh root@10.71.100.81
  vm120_ubuntu_ai:
    hostname: ubuntu-ai
    role: local AI / Ollama / Open WebUI
    address: 10.71.100.82
    ssh_user: root
    open_webui: http://10.71.100.82:3000
    access_from_router_ops: ssh root@10.71.100.82
  vm121_wg_access_dev:
    hostname: wg-access-dev
    role: WG Access backend/dev VM
    address: 10.71.100.83
    ssh_user: root
    access_from_router_ops: ssh root@10.71.100.83
    notes:
    - WG Access backend/dev.
    - Expire subscriptions timer and maintenance endpoint were tested here.
  vm130_router_ops:
    hostname: router-ops
    role: operations VM
    address: 10.71.100.84
    ssh_user: ops
    base_dir: /opt/router-ops
  client001_pve:
    hostname: client001 Proxmox
    role: client001 Proxmox host
    address: 10.71.1.222
    ssh_user: root
    access_from_reachable_admin_network: ssh root@10.71.1.222
    notes:
    - Reachability depends on being on client001 LAN/admin WG path.
  client001_vm100_core:
    hostname: client001 VM100-OpenWRT-core
    role: client001 core router
    address: 10.71.1.1
    ssh_user: root
    access_from_reachable_admin_network: ssh root@10.71.1.1
    admin_wg: 10.250.1.1/24
    guest_wg: 10.252.1.0/24
    wg_remote_udp: 51820
  client001_vm101_edge:
    hostname: client001 VM101-OpenWRT-edge
    role: client001 edge / VPN egress
    address: 10.71.1.2
    ssh_user: root
    access_from_reachable_admin_network: ssh root@10.71.1.2
  client001_vm103_wg_easy:
    hostname: client001 VM103-wg-easy
    role: client001 wg-easy guest WG
    address: 10.71.1.189
    ssh_user: root
    wg_easy_panel: http://10.71.1.189:51822
    access_from_reachable_admin_network: ssh root@10.71.1.189
ssh_audit_20260706:
  report_path: /opt/router-ops/inventory/ssh-access-audit-20260706_131850.txt
  confirmed:
    pve_mgts:
      command: ssh pve-mgts
      key: ~/.ssh/router_ops_pve_mgts_ed25519
      ssh_connection: 10.250.100.4 -> 10.71.100.222:22
      result: SSH_OK
    home_vm100:
      command: ssh home-vm100
      raw_command: ssh -i ~/.ssh/router_ops_ed25519 root@192.168.30.1
      key: ~/.ssh/router_ops_ed25519
      ssh_connection: 192.168.30.84 -> 192.168.30.1:22
      result: SSH_OK
    pve_ai:
      command: ssh pve-ai
      raw_command: ssh -i ~/.ssh/router_ops_ed25519 root@192.168.30.81
      key: ~/.ssh/router_ops_ed25519
      ssh_connection: 192.168.30.84 -> 192.168.30.81:22
      result: SSH_OK
    vm120_ubuntu_ai:
      command: ssh ubuntu-ai
      raw_command: ssh -i ~/.ssh/router_ops_ed25519 root@192.168.30.82
      key: ~/.ssh/router_ops_ed25519
      ssh_connection: 192.168.30.84 -> 192.168.30.82:22
      result: SSH_OK
    vm121_wg_access_dev:
      command: ssh vm121
      alternate_command: ssh wg-access-dev
      raw_command: ssh -i ~/.ssh/router_ops_ed25519 root@192.168.30.83
      key: ~/.ssh/router_ops_ed25519
      ssh_connection: 192.168.30.84 -> 192.168.30.83:22
      result: SSH_OK
  not_confirmed_from_router_ops:
    home_vm101:
      address: 192.168.30.2
      result: permission denied with known router-ops keys
    home_vm103:
      address: 192.168.30.189
      result: permission denied with known router-ops keys
    home_vm104_omr:
      address: 192.168.30.186
      port: 65222
      result: permission denied with known router-ops keys
  currently_unreachable_from_router_ops:
    client001_pve:
      address: 10.71.1.222
      result: no route / timeout
    client001_vm100:
      address: 10.71.1.1
      result: no route / timeout
    client001_vm101:
      address: 10.71.1.2
      result: no route / timeout
    client001_vm103:
      address: 10.71.1.189
      result: no route / timeout
wg_paid_live_peer_apply_20260706:
  status: OK
  marker: /opt/router-ops/inventory/STATUS-WG-PAID-LIVE-PEER-NO-RESTART-OK.txt
  tested_on: home-vm100
  interface: wg_paid
  address: 10.253.1.1/16
  listen_port: 51830
  result:
  - LIVE_WG_SET_NO_INTERFACE_RECREATE_OK
  - PEER_COUNT_RESTORED_OK
  source_audit:
    host: vm121
    agent_file: /opt/wg-access/agent/wg_access_agent.py
    observed:
    - wg set
    - enable_peer
    - disable_peer
    not_observed:
    - ifdown wg_paid
    - ifup wg_paid
    - network reload
    - network restart
  conclusion: paid peer add/remove does not require wg_paid restart
wg_paid_mgts_direct_vm121:
  project: WG Paid / pve-wg-paid
  status: legacy_admin_wireguard_disabled_after_studio_colocation
  date: '2026-07-06'
  principle: VM121 uses direct studio LAN 10.71.100.0/24; VM130 is an operator node, not a transit router.
  admin_wireguard:
    interface_on_vm121: wg-mgts
    vm121_wg_address: 10.250.100.121/32
    server_side: MGTS VM100 wg_remote
    server_wg_address: 10.250.100.1/24
    reachable_networks:
    - 10.71.100.0/24
    status: disabled
    replacement: direct LAN 10.71.100.0/24
  mgts_targets:
    vm100_core:
      ip: 10.71.100.1
      role: OpenWRT core; wg_remote; wg_paid server
      ssh_from: pve-mgts
      ssh_command: ssh root@10.71.100.1
    vm101_edge:
      ip: 10.71.100.2
      role: OpenWRT edge; transit/direct/vpn egress
      ssh_from: pve-mgts
      ssh_command: ssh root@10.71.100.2
    proxmox:
      ip: 10.71.100.222
      role: pve-wg-paid
      ssh_from: router-ops
      ssh_alias: pve-mgts
  router_ops_aliases:
    pve_mgts: ssh pve-mgts
    vm121: ssh vm121
  wg_paid:
    server: MGTS VM100
    interface: wg_paid
    address: 10.253.1.1/16
    listen_port_udp: 51830
    test_client_used:
      address: 10.253.254.121/32
      result: handshake OK; ping 10.253.1.1 OK; internet OK; cleaned up
  documentation:
    markdown: /opt/router-ops/inventory/access-map-wg-paid-mgts.md
  secrets_policy:
    private_keys_recorded: false
    public_key_fingerprints_only: true
  legacy_principle: VM121 has direct admin WG access to MGTS; VM130 is not a transit router.
  current_principle: VM121 uses direct studio LAN 10.71.100.0/24; VM130 is an operator node, not a transit router.
  current_transport: direct LAN
wg_paid_vm121_direct_mgts_admin:
  project: WG Paid / pve-wg-paid
  status: legacy_admin_wireguard_disabled_after_studio_colocation
  recorded: '2026-07-06T15:42:33'
  principle: VM121 uses direct studio LAN 10.71.100.0/24; VM130 is an operator node, not a transit router.
  vm121:
    role: wg-access-dev
    ssh_alias_from_router_ops: vm121
    ssh_target: 10.71.100.83
    ssh_key_path_from_router_ops: ~/.ssh/router_ops_ed25519
    admin_wg_interface: wg-mgts (legacy, disabled)
    admin_wg_address: 10.250.100.121/32
    admin_wg_status: disabled; configuration retained
  mgts:
    management_lan: 10.71.100.0/24
    wg_remote_server: MGTS VM100
    wg_remote_server_ip: 10.71.100.1
    wg_remote_server_address: 10.250.100.1/24
  reachable_targets:
    vm100_core:
      ip: 10.71.100.1
      role: OpenWRT core; wg_remote; wg_paid
      ssh_from_pve_mgts: ssh -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.1
    vm101_edge:
      ip: 10.71.100.2
      role: OpenWRT edge; transit/direct/vpn egress
      ssh_from_pve_mgts: ssh -i /root/.ssh/pve_to_openwrt_mgts_ed25519 root@10.71.100.2
    pve_mgts:
      ip: 10.71.100.222
      role: Proxmox pve-wg-paid
      ssh_alias_from_router_ops: pve-mgts
      ssh_key_path_from_router_ops: ~/.ssh/router_ops_pve_mgts_ed25519
  wg_paid:
    server: MGTS VM100
    interface: wg_paid
    address: 10.253.1.1/16
    listen_port_udp: 51830
    temp_smoke_client:
      address: 10.253.254.121/32
      result: handshake OK; ping 10.253.1.1 OK; internet OK; cleaned up
      external_ip_during_test: 94.45.208.160
  secrets_policy:
    private_keys_recorded: false
    key_paths_recorded: true
    fingerprints_allowed: true
  legacy_principle: VM121 has direct admin WireGuard access to MGTS; VM130 is not a transit router.
  current_principle: VM121 uses direct studio LAN 10.71.100.0/24; VM130 is an operator node, not a transit router.
  current_transport: direct LAN
current_studio_lan:
  status: confirmed
  confirmed_at: '2026-07-14'
  cidr: 10.71.100.0/24
  gateway: 10.71.100.1
  topology:
    pve_wg_paid:
      management_ip: 10.71.100.222/24
      wan_bridge: vmbr0 <- enp14s0
      lan_bridge: vmbr1 <- eno1
    pve_irrigation_ai:
      management_ip: 10.71.100.81/24
      lan_bridge: vmbr0 <- eno1
    vm120_ubuntu_ai: 10.71.100.82/24
    vm121_wg_access_dev: 10.71.100.83/24
    vm130_router_ops: 10.71.100.84/24
  access_principle: VM120, VM121, VM130, both Proxmox hosts, MGTS VM100 and MGTS VM101 use direct studio LAN access; legacy
    admin WireGuard paths are disabled.

beach_omr_mgts_primary_20260812:
  status: PASS_MGTS_PRIMARY_OMR_END_TO_END
  date: 2026-08-12
  ownership: shared WG Paid / MGTS infrastructure with BEACH OMR integration

  vm102:
    vmid: 102
    role: primary BEACH OMR server
    management_ip: 10.71.100.85
    gateway: 10.71.100.1
    public_ip: 95.165.105.4
    ssh_from_router_ops: "ssh -i ~/.ssh/router_ops_ed25519 -p 65222 debian@10.71.100.85"
    services:
      ssh_tcp: 65222
      xray_tcp: 65248
      openvpn_tcp: 65301
      omr_api_https: 65500

  ingress:
    path: "BEACH -> VM101 WAN -> VM100 Direct -> VM102"
    vm101_dnat:
      xray: "TCP 65248 -> 10.71.100.85:65248"
      openvpn: "TCP 65301 -> 10.71.100.85:65301"
      api: "TCP 65500 -> 10.71.100.85:65500"

  vm101_return_policy:
    purpose: "keep WAN-DNAT request/reply on VM101 -> VM100 -> VM102 symmetric path"
    rule: "priority 10005 iif eth0 to 10.71.100.85/32 lookup 210"
    table_210: "10.71.100.85 via 10.201.0.1 dev eth3"
    persistent_sections:
      - network.beach_omr_return_route
      - network.beach_omr_return_rule
    source_file: /etc/config/network
    machine_git: intentionally_untracked
    warning: "/etc/config/network contains private keys; never add wholesale to Machine Git"

  vm100_beach_file:
    path: /etc/nftables.d/92-beach-omr-routing.nft
    sha256: d2fe6162d731d17ae2092ce5b8dc1e52d7ef4fa375c5468d75789fc589a470ea
    purpose:
      - VM102 cs6 server transport into existing Direct branch
      - narrow no-SNAT for VM102 Direct server transport
      - DSCP cleanup on Direct egress
      - narrow inbound allows for TCP 65248, 65301 and 65500
    existing_router_pbr_preserved: true

  canonical_machine_git:
    vm100:
      git_dir: /root/.vm100-source.git
      head: 35c424e53504e8b5e2da227a869f29417fdbe14c
      tree: dd082a27a7f35f43efa8bd07b222ce86200edda1
      beach_file_sha256: d2fe6162d731d17ae2092ce5b8dc1e52d7ef4fa375c5468d75789fc589a470ea
    vm101:
      git_dir: /root/.vm101-source.git
      head: 5bc942f5908a2c8fcd92606f9d9e8d50974039f0
      tree: 38805542a21bccf9a48097c464f09c3f0172b00d
      firewall_sha256: 0b568b80b377730a981358e0cba88648e2fb898a3f9e08cfd25e41cc14a8555b

  final_public_counter_proof:
    vm101:
      xray_65248_packets: 1382
      openvpn_65301_packets: 3
      api_65500_packets: 61
    vm100:
      xray_65248_packets: 1386
      openvpn_65301_packets: 3
      api_65500_packets: 61

  beach_vm110:
    lan_ip: 192.168.100.1
    beach_pve_lan_ip: 192.168.100.254
    primary_vps: 95.165.105.4
    tun0: 10.255.252.2/24
    xray: "95.165.105.4:65248"
    openvpn: "95.165.105.4:65301"
    omr_api: "95.165.105.4:65500"
    both_lte_paths_verified: true
    client_internet_verified: true
    direct_ssh_from_router_ops: false

  operational_rules:
    - "VM100/VM101 are shared infrastructure"
    - "reconcile current Machine Git HEAD/TREE before Router mutations"
    - "preserve BEACH OMR DNAT, return-policy and nft rules"
    - "do not add VM101 /etc/config/network wholesale to Machine Git"
    - "use cd / for path-scoped Machine Git operations"
    - "use proven setsid timed rollback for risky OpenWrt live changes"
    - "avoid firewall/network restart for narrow shared-core changes"

ddn_router_ops_access_20260811:
  status: confirmed
  temporary_reverse_ports_required: false
  home_vm100:
    alias: home-vm100
    address: 192.168.30.1
    command: "ssh home-vm100"
  home_vm101:
    alias: home-vm101
    address: 192.168.30.2
    command: "ssh home-vm101"
  note: "Both aliases were proven after temporary reverse SSH ports were closed."
