# XS Map Latest — WG Paid / MGTS

Updated: 20260708-114926

## Permanent MGTS public endpoint

- Public IP: `95.165.105.4`
- DNS: `wg-studio.secret-studio.ru`

## Endpoints to use going forward

| Purpose | Endpoint |
|---|---|
| Admin WireGuard access to MGTS | `wg-studio.secret-studio.ru:51820` |
| WG Paid client configs | `wg-studio.secret-studio.ru:51830` |

## Important correction

DHCP leases are not the source of truth for WGPay clients. WGPay clients are WireGuard peers, so canary/source selection must use:

- WG peer
- tunnel IP / AllowedIPs
- subscription / peer records from WG Access on VM121

## Access path that must be represented in XS Map

During MGTS port-forward work, direct access from VM130/router-ops to VM101 was missing. Keys and SSH alias were created. This must be represented in the canonical access map.

Required logical path:

```text
VM130 / router-ops
  -> MGTS admin WireGuard / mgmt path
  -> VM101 OpenWRT edge at 10.71.100.2
```

Expected inventory fields to preserve:

- SSH alias for VM101 from router-ops / VM130
- hostname/IP: `10.71.100.2`
- key path used by the alias
- jump path, if any
- relationship to PVE/MGTS and VM100/VM101

## Current SSH alias excerpts, redacted

See: [ssh-aliases-redacted.txt](ssh-aliases-redacted.txt)

## Current access-map copy, redacted

See: [access-map-current-redacted.txt](access-map-current-redacted.txt)

## Next apply tasks

1. Update canonical `/opt/router-ops/inventory/access-map.yml`.
2. Update canonical `/opt/router-ops/inventory/access-map.md`.
3. Ensure VM130/router-ops -> VM101 alias/key/path is present.
4. Replace temporary MGTS endpoints:
   - `192.168.30.218:51820`
   - `95.165.105.4:51820`
   - `95.165.105.4:51830`
5. Final values:
   - admin WG: `wg-studio.secret-studio.ru:51820`
   - WG Paid: `wg-studio.secret-studio.ru:51830`