=== STEP_034K CHECKPOINT PROVEN CANARY === timestamp=20260708-122335 mode=snapshot MGTS VM100/VM101 + read-only VM121 checkpoint snapshot_name=S034K_WGPAY_DSCP_CANARY_PROVEN forbidden: policy changes, rollback, peer disable, wg reload === MGTS Proxmox snapshots VM100/VM101 === date=Wed Jul 8 03:23:34 PM MSK 2026 --- before snapshot VM100 --- status: running `-> MGTS_RESTORED_BEFORE_FIRST_BOOT 2026-07-06 12:28:36 pve-wg-paid: VM100 restored from golden, before first boot `-> MGTS_INTERNAL_LAN_RENUMBERED_OK 2026-07-06 12:52:29 pve-wg-paid: VM100 LAN renumbered to 10.71.100.1, wg_remote 10.250.100.1 `-> MGTS_VM100_WG_REMOTE_ROTATED_OK 2026-07-06 13:04:15 pve-wg-paid: VM100 wg_remote keys rotated for 10.250.100.0/24; client configs stored on VM100 `-> MGTS_VM100_ROUTER_OPS_WG_PEER_OK 2026-07-06 14:08:27 pve-wg-paid: VM100 wg_remote has router-ops-mgts peer 10.250.100.4/32; management path via WG `-> MGTS_VM100_BEFORE_WG_PAID_CREATE 2026-07-06 17:37:41 Before creating wg_paid on MGTS VM100 for WG Paid migration `-> MGTS_VM100_WG_PAID_BASE_OK 2026-07-06 17:47:21 MGTS VM100: wg_paid created; 10.253.1.1/16; UDP 51830; firewall wg_paid; live wg set dummy peer add/remove OK `-> STEP_004B_WG_PAID_CLIENT_PATH_OK 2026-07-06 18:33:19 MGTS VM100: wg_paid live client smoke OK; client can reach 10.253.1.1 and internet via VM101 `-> STEP_004C_ACCESS_MAP_VM121_DIRECT_OK 2026-07-06 18:43:30 MGTS VM100: VM121 direct wg-mgts admin access documented in access-map `-> STEP_005_MGTS_EGRESS_PANEL_OK 2026-07-06 20:52:45 MGTS/WG Paid: VM100 PBR fixed; VM101 egress OK; vpn_user manual mode smoke OK; VM105 control panel identified; deferred UI/cleanup tasks recorded `-> STEP_028A_MGTS_WG_PAID_E2E_OK 2026-07-06 22:01:22 MGTS VM100: wg_paid target E2E smoke OK; peer lifecycle via agent OK; PBR direct/vpn route decision OK; final test peer removed `-> current You are here! --- create snapshot VM100 S034K_WGPAY_DSCP_CANARY_PROVEN --- snapshotting 'drive-sata1' (local-lvm:vm-100-disk-0) Logical volume "snap_vm-100-disk-0_S034K_WGPAY_DSCP_CANARY_PROVEN" created. snapshot_vm100_rc=0 --- after snapshot VM100 --- snapshot_vm100_visible_rc=0 --- before snapshot VM101 --- status: running `-> MGTS_RESTORED_BEFORE_FIRST_BOOT 2026-07-06 12:28:37 pve-wg-paid: VM101 restored from patched 91101, WAN link_down, before first boot `-> MGTS_INTERNAL_LAN_RENUMBERED_OK 2026-07-06 12:52:30 pve-wg-paid: VM101 mgmt renumbered to 10.71.100.2, route to 10.250.100.0 via VM100, WAN link_down `-> MGTS_VM101_CURRENT_20260702_OK 2026-07-06 13:01:44 pve-wg-paid: VM101 current backend 20260702 applied: vpn_user base, override backend, revive script; WAN still link_down `-> MGTS_BEFORE_WG_REMOTE_DNAT 2026-07-06 13:15:47 pve-wg-paid: before VM101 DNAT UDP 51820 to VM100 wg_remote `-> MGTS_VM101_WAN_DHCP_WG_REMOTE_DNAT_OK 2026-07-06 13:31:39 pve-wg-paid: VM101 WAN DHCP enabled, UDP 51820 DNAT to VM100 wg_remote; WG remote tested `-> MGTS_VM101_BEFORE_WG_PAID_DNAT_51830 2026-07-06 17:37:42 Before adding UDP 51830 DNAT to MGTS VM100 wg_paid `-> MGTS_VM101_WG_PAID_DNAT_51830_OK 2026-07-06 17:47:22 MGTS VM101: DNAT UDP 51830 to MGTS VM100 10.71.100.1:51830 `-> STEP_004B_WG_PAID_CLIENT_PATH_OK 2026-07-06 18:33:20 MGTS VM101: current direct egress OK for wg_paid smoke; before installing paid HideMyName key `-> STEP_004C_ACCESS_MAP_VM121_DIRECT_OK 2026-07-06 18:43:31 MGTS VM101: VM121 direct wg-mgts admin access documented in access-map `-> STEP_005_MGTS_EGRESS_PANEL_OK 2026-07-06 20:52:47 MGTS/WG Paid: VM100 PBR fixed; VM101 egress OK; vpn_user manual mode smoke OK; VM105 control panel identified; deferred UI/cleanup tasks recorded `-> STEP_028A_MGTS_WG_PAID_E2E_OK 2026-07-06 22:01:24 MGTS VM101: edge/DNAT side preserved after wg_paid MGTS E2E smoke; UDP 51830 DNAT path configured `-> S029A_EGRESS_PRE_20260708-082358 2026-07-08 11:23:58 VM101 before in-place egress rework; keep WAN/DNAT untouched `-> S031A_PRE_APPLY_20260708-102627 2026-07-08 13:26:30 VM101 before first egress apply/deploy; preserve WAN/DNAT/VM100 `-> S031H_3SLOT_OK_20260708-104500 2026-07-08 13:45:04 VM101 isolated 3-slot egress pool OK: vpn3/vpn4/vpn5 up, tables 203-205, no policy switch `-> S032C_FW_POOL_OK_20260708-105809 2026-07-08 13:58:14 VM101 egress pool firewall integration OK: vpn3/vpn4/vpn5 in vpn_out, no policy switch `-> current You are here! --- create snapshot VM101 S034K_WGPAY_DSCP_CANARY_PROVEN --- snapshotting 'drive-sata1' (local-lvm:vm-101-disk-0) Logical volume "snap_vm-101-disk-0_S034K_WGPAY_DSCP_CANARY_PROVEN" created. snapshot_vm101_rc=0 --- after snapshot VM101 --- snapshot_vm101_visible_rc=0 pve_snapshot_done=1 === VM121 DB/API checkpoint read-only === remote_backup_dir=/root/router-ops-backups/checkpoint-proven-canary-20260708-122342 === containers === NAMES CONTAINER ID STATUS PORTS wgaccess-backend 0f265f639e32 Up 26 minutes 0.0.0.0:18080->8000/tcp wgaccess-postgres 91c0111d2bca Up 42 hours (healthy) 127.0.0.1:15432->5432/tcp backend_container=wgaccess-backend postgres_container=wgaccess-postgres === health === {"status":"ok","service":"wg-access-backend","environment":"dev"} {"status":"ok","db":1} === peers/jobs checkpoint === peers_curl_rc=0 jobs_curl_rc=0 peer_count 21 job_count 37 pending_job_count 0 canary_peer_found=True canary_peer_enabled=True canary_peer_node_id=ddn-test canary_peer_tunnel_ip=10.253.1.10 canary_tunnel_ip_matches=True canary_job_found=True canary_job_status=completed canary_job_action=enable_peer canary_job_attempts=1 === pg_dump checkpoint === pg_dump_rc=0 pg_dump_path=/root/router-ops-backups/checkpoint-proven-canary-20260708-122342/wg-access-db-after-canary-proven.dump -rw-r--r-- 1 root root 24K Jul 8 12:23 /root/router-ops-backups/checkpoint-proven-canary-20260708-122342/wg-access-db-after-canary-proven.dump === current endpoint env === WG_CLIENT_ENDPOINT=wg-studio.secret-studio.ru:51830 === safety proof === no_policy_change=1 no_peer_disable=1 no_wg_reload=1 no_backend_restart=1 vm121_checkpoint_done=1 === STEP_034K RESULT === snapshot_name=S034K_WGPAY_DSCP_CANARY_PROVEN snapshot_vm100_rc=0 snapshot_vm100_visible_rc=0 snapshot_vm101_rc=0 snapshot_vm101_visible_rc=0 peer_count=21 job_count=37 pending_job_count=0 canary_peer_found=True canary_peer_enabled=True canary_tunnel_ip_matches=True canary_job_status=completed pg_dump_rc=0 endpoint_final_lines=1 backend_health_ok_lines=2 decision=PASS_PROVEN_CANARY_CHECKPOINT