=== STEP_034E4D FIX DOC NOTE + CLASSIFICATION === timestamp=20260708-115554 mode=docs fix + read-only classification final_wgpay_endpoint=wg-studio.secret-studio.ru:51830 forbidden: docker restart, backend restart, wg reload, peer creation === patch DEFERRED_TASKS note safely === UPDATED_DEFERRED_TASKS=1 --- DEFERRED_TASKS.md.before +++ DEFERRED_TASKS.md.after @@ -24,9 +24,11 @@ - make `docker compose up -d --force-recreate backend` safe and repeatable. - -Endpoint migration note, added 2026-07-08 11:54:42: -- WG Paid public client endpoint source has been changed to in . -- Historical STATUS/backups may still mention older internal smoke endpoints; those are not active source. -- Running backend container must be restarted/recreated separately before it reads the new . - + +Endpoint migration note, added 2026-07-08 11:55:55: +- WG Paid public client endpoint source is now: wg-studio.secret-studio.ru:51830 +- Active source file: /opt/wg-access/.env +- Internal DNAT target remains intentionally internal: VM101 UDP 51830 -> VM100 10.71.100.1:51830 +- Historical STATUS/tmp/backups may still mention older smoke endpoints; those are not active source. +- Running backend container must be restarted/recreated separately before it reads the new .env. + === active endpoint source classification === --- source files that can affect generated client Endpoint --- /opt/wg-access/.env:13:WG_CLIENT_ENDPOINT=wg-studio.secret-studio.ru:51830 /opt/wg-access/backend/app/services/wireguard.py:77:def build_client_config(private_key: str, tunnel_ip: str, preshared_key: str) -> str: /opt/wg-access/backend/app/services/wireguard.py:79: endpoint = os.environ.get("WG_CLIENT_ENDPOINT", "").strip() /opt/wg-access/backend/app/services/wireguard.py:102: f"Endpoint = {endpoint}", /opt/wg-access/backend/app/api/admin.py:17: build_client_config, /opt/wg-access/backend/app/api/admin.py:103: client_config: str /opt/wg-access/backend/app/api/admin.py:130: client_config = build_client_config(private_key, tunnel_ip, preshared_key) /opt/wg-access/backend/app/api/admin.py:175: client_config=client_config, /opt/wg-access/backend/app/api/dev.py:15: build_client_config, /opt/wg-access/backend/app/api/dev.py:41: client_config: str /opt/wg-access/backend/app/api/dev.py:62: client_config = build_client_config(private_key, tunnel_ip, preshared_key) /opt/wg-access/backend/app/api/dev.py:104: client_config=client_config, --- allowed internal DNAT references, not client endpoint source --- /opt/wg-access/DEFERRED_TASKS.md:12: VM101 DNAT UDP 51830 -> MGTS VM100 10.71.100.1:51830 /opt/wg-access/DEFERRED_TASKS.md:31:- Internal DNAT target remains intentionally internal: VM101 UDP 51830 -> VM100 10.71.100.1:51830 /opt/wg-access/STATUS-STEP-028A_MGTS_WG_PAID_E2E_OK.txt:30: endpoint used for internal smoke: 10.71.100.1:51830 /opt/wg-access/STATUS-STEP-028A_MGTS_WG_PAID_E2E_OK.txt:55: WG_CLIENT_ENDPOINT=10.71.100.1:51830 /opt/wg-access/STATUS-STEP-028A_MGTS_WG_PAID_E2E_OK.txt:61: internal smoke endpoint 10.71.100.1:51830, /opt/wg-access/STATUS-STEP-028A_MGTS_WG_PAID_E2E_OK.txt:65: Replace WG_CLIENT_ENDPOINT=10.71.100.1:51830 with real external MGTS DNS/IP endpoint after MGTS static IP is known. --- historical leftovers, ignored --- /opt/wg-access/STATUS-STEP-013_WG_HANDSHAKE_VM121_TO_VM100_OK.txt:23: 192.168.30.1:51830 /opt/wg-access/STATUS-STEP-016_CLIENT_CONFIG_RESPONSE_OK.txt:16: WG_CLIENT_ENDPOINT=192.168.30.1:51830 /opt/wg-access/.env.BEFORE_MGTS_CLIENTCFG_20260706-185027:13:WG_CLIENT_ENDPOINT=192.168.30.1:51830 /opt/wg-access/STATUS-STEP-017_GENERATED_CLIENT_CONFIG_HANDSHAKE_OK.txt:28: Endpoint = 192.168.30.1:51830 /opt/wg-access/tmp/mgts-smoke-20260706-184120/client.mgts.conf:9:Endpoint = 10.71.100.1:51830 /opt/wg-access/tmp/mgts-smoke-20260706-184120/client.conf:8:Endpoint = 192.168.30.1:51830 /opt/wg-access/tmp/mgts-smoke-20260706-184120/create.json:1:{"user_id":"13783bf9-94bb-4c90-b1c6-685a956a5c43","subscription_id":"8adb06a9-713a-46b0-8759-d11c28a797fc","peer_id":"3d03a7a2-c009-48a4-b6ff-214326d26fc0","job_id":"814ba665-f6e5-4ba4-b1ba-8af1ec4954e6","node_id":"ddn-test","tunnel_ip":"10.253.1.10","paid_until":"2026-08-05T18:41:20.288079Z","private_key":"mNbbZcMCcS+SLGtfAFFNJSOzR/2etvxnicYjL/unF38=","public_key":"zUUEdc+Lac9C6fmMDVosuO3ZIYHIUDWi34UVgdjhbCU=","preshared_key":"jDmX4j1ipVr4r45cRb4nbKaeBqQYQeeaCpsBG4U2sMQ=","client_config":"[Interface]\nPrivateKey = mNbbZcMCcS+SLGtfAFFNJSOzR/2etvxnicYjL/unF38=\nAddress = 10.253.1.10/32\n\n[Peer]\nPublicKey = rNdcZimQJKT6nb4wPmUFN/95bZfKDDsXsp1ie8nn1SU=\nPresharedKey = jDmX4j1ipVr4r45cRb4nbKaeBqQYQeeaCpsBG4U2sMQ=\nEndpoint = 192.168.30.1:51830\nAllowedIPs = 10.253.1.1/32\nPersistentKeepalive = 25\n"} /opt/wg-access/STATUS-STEP-028A_MGTS_WG_PAID_E2E_OK.txt:30: endpoint used for internal smoke: 10.71.100.1:51830 /opt/wg-access/STATUS-STEP-028A_MGTS_WG_PAID_E2E_OK.txt:55: WG_CLIENT_ENDPOINT=10.71.100.1:51830 /opt/wg-access/STATUS-STEP-028A_MGTS_WG_PAID_E2E_OK.txt:61: internal smoke endpoint 10.71.100.1:51830, /opt/wg-access/STATUS-STEP-028A_MGTS_WG_PAID_E2E_OK.txt:65: Replace WG_CLIENT_ENDPOINT=10.71.100.1:51830 with real external MGTS DNS/IP endpoint after MGTS static IP is known. /opt/wg-access/.env.BEFORE_MGTS_CLIENTCFG_20260706-185140:13:WG_CLIENT_ENDPOINT=10.71.100.1:51830 === running backend env, old expected until restart === backend_container=wgaccess-backend WG_CLIENT_ENDPOINT=10.71.100.1:51830 === health === {"status":"ok","service":"wg-access-backend","environment":"dev"} {"status":"ok","db":1} === no forbidden actions proof === no_docker_restart=1 no_backend_restart=1 no_wg_reload=1 no_peer_create=1 vm121_doc_note_classification_done=1 vm121_remote_backup_dir=/root/router-ops-backups/endpoint-doc-note-fix-20260708-115555 === STEP_034E4D RESULT === updated_deferred_tasks=1 active_final_client_endpoint_source_lines=1 active_old_client_endpoint_source_lines=0 allowed_internal_dnat_lines=6 running_backend_old_endpoint_lines=1 running_backend_final_endpoint_lines=0 backend_health_ok_lines=2 no_docker_restart_lines=1 no_wg_reload_lines=1 no_peer_create_lines=1 decision=PASS_DOC_NOTE_AND_ENDPOINT_CLASSIFICATION