{ "changes": { "backend_restart_done": "NO", "db_changed": "NO", "firewall_reload_done": "NO", "manager_invoked": "NO", "mapper_changed": "NO", "network_reload_done": "NO", "new_peer_created": "NO", "policy_changed": "NO", "private_material_published": "NO", "remote_script_executed": "NO", "selector_changed": "NO_REMOTE_DRY_RUN_ONLY", "wg_reload_done": "NO" }, "mode": "REMOTE_SCRIPT_PLAN_V2_DRY_RUN", "plans": { "bad_conflict": { "rc": 2, "result": { "action": "error", "apply_performed": false, "contract_valid": false, "error_count": 1, "errors": [ "same_ip_conflict" ], "exact_line": "10.253.1.13 cs5 canary_vpn2", "idempotent_noop": false, "mode": "remote-dry-run", "payload_summary": { "fwmark": "0x202", "interface_name": "vpn2", "manager_id": "hmn_pool", "provider_type": "hmn_amneziawg", "selector_class": "cs5", "selector_label": "canary_vpn2", "slot_code": "vpn2", "table_id": 202, "tunnel_ip": "10.253.1.13" }, "remote_commands_executed": false, "remote_script": "#!/bin/sh\nset -u\n\nCONF=/etc/router-wgpay-selector.d/peers.conf\nSERVICE=router-wgpay-canary\nLINE='10.253.1.13 cs5 canary_vpn2'\nTUNNEL_IP=10.253.1.13\nSELECTOR_CLASS=cs5\nBACKUP=\"/root/peers.conf.before-agent-selector-apply-$(date +%Y%m%d-%H%M%S)\"\nROLLBACK=\"/root/rollback-agent-selector-apply.sh\"\n\necho \"remote_script_schema=wg-access-agent-selector-remote-script-v2\"\necho \"remote_script_action=error\"\n\ntest -f \"$CONF\"\n\ncp \"$CONF\" \"$BACKUP\"\necho \"selector_backup_path=$BACKUP\"\n\ncat > \"$ROLLBACK\" </dev/null || /etc/init.d/$SERVICE start\n\ngrep -Fxq \"$LINE\" \"$CONF\"\n/etc/init.d \"$SERVICE\" enabled 2>/dev/null || /etc/init.d/$SERVICE enabled\nnft -a list ruleset 2>/dev/null | grep -q \"$TUNNEL_IP.*$SELECTOR_CLASS\"\n\necho \"postcheck_selector_line_present=YES\"\necho \"postcheck_selector_service_enabled=YES\"\necho \"postcheck_nft_rule_visible=YES\"\n", "remote_script_contains_actual_backup_rollback": true, "remote_script_contains_placeholder_backup": false, "remote_script_contains_runtime_backup_date": true, "remote_script_executed": false, "remote_script_line_count": 42, "remote_script_model": "single_shell_script", "remote_script_sha256": "3673c36be3545d5bddbcaa7de7e2727d9ed4aebc9dd4b1df075060736549ff3a", "requires_wg_peer_before_real_apply": true, "schema": "wg-access-agent-selector-remote-plan-v2", "selector_plan": { "action": "error", "apply_performed": false, "contract_valid": false, "errors": [ "same_ip_conflict" ], "exact_line": "10.253.1.13 cs5 canary_vpn2", "exact_present": false, "idempotent_noop": false, "mode": "dry-run", "payload_summary": { "fwmark": "0x202", "interface_name": "vpn2", "manager_id": "hmn_pool", "peer_id": "DRY_RUN_BAD_PEER_ID", "provider_type": "hmn_amneziawg", "selector_class": "cs5", "selector_label": "canary_vpn2", "slot_code": "vpn2", "subscription_id": "DRY_RUN_BAD_SUBSCRIPTION_ID", "table_id": 202, "tunnel_ip": "10.253.1.13" }, "same_ip_conflict_count": 1, "same_selector_class_conflict_count": 0, "same_selector_label_conflict_count": 0, "schema": "wg-access-agent-selector-apply-plan-v1", "selector_entry_count_after_planned": 4, "selector_entry_count_before": 4, "slot_status": "healthy", "warnings": [], "would_append": false }, "selector_plan_rc": 2, "target": { "host": "10.71.100.1", "name": "vm100", "selector_conf": "/etc/router-wgpay-selector.d/peers.conf", "selector_service": "router-wgpay-canary" }, "would_append": false } }, "existing_cs4": { "rc": 0, "result": { "action": "noop", "apply_performed": false, "contract_valid": true, "error_count": 0, "errors": [], "exact_line": "10.253.1.13 cs4 canary_vpn1", "idempotent_noop": true, "mode": "remote-dry-run", "payload_summary": { "fwmark": "0x201", "interface_name": "vpn1", "manager_id": "hmn_pool", "provider_type": "hmn_amneziawg", "selector_class": "cs4", "selector_label": "canary_vpn1", "slot_code": "vpn1", "table_id": 201, "tunnel_ip": "10.253.1.13" }, "remote_commands_executed": false, "remote_script": "#!/bin/sh\nset -u\n\nCONF=/etc/router-wgpay-selector.d/peers.conf\nSERVICE=router-wgpay-canary\nLINE='10.253.1.13 cs4 canary_vpn1'\nTUNNEL_IP=10.253.1.13\nSELECTOR_CLASS=cs4\nBACKUP=\"/root/peers.conf.before-agent-selector-apply-$(date +%Y%m%d-%H%M%S)\"\nROLLBACK=\"/root/rollback-agent-selector-apply.sh\"\n\necho \"remote_script_schema=wg-access-agent-selector-remote-script-v2\"\necho \"remote_script_action=noop\"\n\ntest -f \"$CONF\"\n\ncp \"$CONF\" \"$BACKUP\"\necho \"selector_backup_path=$BACKUP\"\n\ncat > \"$ROLLBACK\" </dev/null || /etc/init.d/$SERVICE start\n\ngrep -Fxq \"$LINE\" \"$CONF\"\n/etc/init.d \"$SERVICE\" enabled 2>/dev/null || /etc/init.d/$SERVICE enabled\nnft -a list ruleset 2>/dev/null | grep -q \"$TUNNEL_IP.*$SELECTOR_CLASS\"\n\necho \"postcheck_selector_line_present=YES\"\necho \"postcheck_selector_service_enabled=YES\"\necho \"postcheck_nft_rule_visible=YES\"\n", "remote_script_contains_actual_backup_rollback": true, "remote_script_contains_placeholder_backup": false, "remote_script_contains_runtime_backup_date": true, "remote_script_executed": false, "remote_script_line_count": 42, "remote_script_model": "single_shell_script", "remote_script_sha256": "99d9301dd8b4029b20126ce2c384be9efb8da4969edfddbecff3b0e95910f4fd", "requires_wg_peer_before_real_apply": true, "schema": "wg-access-agent-selector-remote-plan-v2", "selector_plan": { "action": "noop", "apply_performed": false, "contract_valid": true, "errors": [], "exact_line": "10.253.1.13 cs4 canary_vpn1", "exact_present": true, "idempotent_noop": true, "mode": "dry-run", "payload_summary": { "fwmark": "0x201", "interface_name": "vpn1", "manager_id": "hmn_pool", "peer_id": "219a1f63-ec47-4f72-9663-c1a17d82301e", "provider_type": "hmn_amneziawg", "selector_class": "cs4", "selector_label": "canary_vpn1", "slot_code": "vpn1", "subscription_id": "b782fb4e-b43c-4b76-966e-28a145b80485", "table_id": 201, "tunnel_ip": "10.253.1.13" }, "same_ip_conflict_count": 0, "same_selector_class_conflict_count": 0, "same_selector_label_conflict_count": 0, "schema": "wg-access-agent-selector-apply-plan-v1", "selector_entry_count_after_planned": 4, "selector_entry_count_before": 4, "slot_status": "healthy", "warnings": [], "would_append": false }, "selector_plan_rc": 0, "target": { "host": "10.71.100.1", "name": "vm100", "selector_conf": "/etc/router-wgpay-selector.d/peers.conf", "selector_service": "router-wgpay-canary" }, "would_append": false } }, "future_cs5": { "rc": 0, "result": { "action": "append", "apply_performed": false, "contract_valid": true, "error_count": 0, "errors": [], "exact_line": "10.253.1.14 cs5 canary_vpn2", "idempotent_noop": false, "mode": "remote-dry-run", "payload_summary": { "fwmark": "0x202", "interface_name": "vpn2", "manager_id": "hmn_pool", "provider_type": "hmn_amneziawg", "selector_class": "cs5", "selector_label": "canary_vpn2", "slot_code": "vpn2", "table_id": 202, "tunnel_ip": "10.253.1.14" }, "remote_commands_executed": false, "remote_script": "#!/bin/sh\nset -u\n\nCONF=/etc/router-wgpay-selector.d/peers.conf\nSERVICE=router-wgpay-canary\nLINE='10.253.1.14 cs5 canary_vpn2'\nTUNNEL_IP=10.253.1.14\nSELECTOR_CLASS=cs5\nBACKUP=\"/root/peers.conf.before-agent-selector-apply-$(date +%Y%m%d-%H%M%S)\"\nROLLBACK=\"/root/rollback-agent-selector-apply.sh\"\n\necho \"remote_script_schema=wg-access-agent-selector-remote-script-v2\"\necho \"remote_script_action=append\"\n\ntest -f \"$CONF\"\n\ncp \"$CONF\" \"$BACKUP\"\necho \"selector_backup_path=$BACKUP\"\n\ncat > \"$ROLLBACK\" <> \"$CONF\"\n echo \"selector_apply_action=append\"\nfi\n\n\n/etc/init.d \"$SERVICE\" start 2>/dev/null || /etc/init.d/$SERVICE start\n\ngrep -Fxq \"$LINE\" \"$CONF\"\n/etc/init.d \"$SERVICE\" enabled 2>/dev/null || /etc/init.d/$SERVICE enabled\nnft -a list ruleset 2>/dev/null | grep -q \"$TUNNEL_IP.*$SELECTOR_CLASS\"\n\necho \"postcheck_selector_line_present=YES\"\necho \"postcheck_selector_service_enabled=YES\"\necho \"postcheck_nft_rule_visible=YES\"\n", "remote_script_contains_actual_backup_rollback": true, "remote_script_contains_placeholder_backup": false, "remote_script_contains_runtime_backup_date": true, "remote_script_executed": false, "remote_script_line_count": 46, "remote_script_model": "single_shell_script", "remote_script_sha256": "91c763b6ead64963c4a20153bf0d7c0a7a617b291ab3e3371946a3bcb7365ee5", "requires_wg_peer_before_real_apply": true, "schema": "wg-access-agent-selector-remote-plan-v2", "selector_plan": { "action": "append", "apply_performed": false, "contract_valid": true, "errors": [], "exact_line": "10.253.1.14 cs5 canary_vpn2", "exact_present": false, "idempotent_noop": false, "mode": "dry-run", "payload_summary": { "fwmark": "0x202", "interface_name": "vpn2", "manager_id": "hmn_pool", "peer_id": "DRY_RUN_FUTURE_PEER_ID", "provider_type": "hmn_amneziawg", "selector_class": "cs5", "selector_label": "canary_vpn2", "slot_code": "vpn2", "subscription_id": "DRY_RUN_FUTURE_SUBSCRIPTION_ID", "table_id": 202, "tunnel_ip": "10.253.1.14" }, "same_ip_conflict_count": 0, "same_selector_class_conflict_count": 0, "same_selector_label_conflict_count": 0, "schema": "wg-access-agent-selector-apply-plan-v1", "selector_entry_count_after_planned": 5, "selector_entry_count_before": 4, "slot_status": "healthy", "warnings": [], "would_append": true }, "selector_plan_rc": 0, "target": { "host": "10.71.100.1", "name": "vm100", "selector_conf": "/etc/router-wgpay-selector.d/peers.conf", "selector_service": "router-wgpay-canary" }, "would_append": true } } }, "previous": { "check_tool_exists_rc": 0, "prev040g_check_rc": 0, "prev040g_facts_rc": 0 }, "publish": { "local_index": "http://192.168.30.84:8099/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/", "published_dir": "/opt/router-ops/public/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260708-170306_step040h_remote_script_plan_v2_dry_run", "trycf_index": "https://maple-movie-urls-cigarettes.trycloudflare.com/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/", "trycf_report": "https://maple-movie-urls-cigarettes.trycloudflare.com/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260708-170306_step040h_remote_script_plan_v2_dry_run/" }, "schema": "router-step-facts-v1", "step": "STEP_040H_REMOTE_SCRIPT_PLAN_V2_DRY_RUN", "vm100_after": { "selector_active_lines": [ "10.253.1.10 cs1 canary_vpn3", "10.253.1.11 cs2 canary_vpn4", "10.253.1.12 cs3 canary_vpn5", "10.253.1.13 cs4 canary_vpn1" ], "vm100_cs4_peer_visible_rc": 0, "vm100_cs5_peer_visible_rc": 1, "vm100_nft_cs4_rule_visible_rc": 0, "vm100_nft_cs5_rule_visible_rc": 1, "vm100_selector_active_entry_count": 4, "vm100_selector_conf_exists_rc": 0, "vm100_selector_cs4_present_rc": 0, "vm100_selector_cs5_any_present_rc": 1, "vm100_selector_cs5_exact_present_rc": 1, "vm100_selector_service_enabled_rc": 0, "vm100_wg_paid_peer_count": 4 }, "vm100_before": { "selector_active_lines": [ "10.253.1.10 cs1 canary_vpn3", "10.253.1.11 cs2 canary_vpn4", "10.253.1.12 cs3 canary_vpn5", "10.253.1.13 cs4 canary_vpn1" ], "vm100_cs4_peer_visible_rc": 0, "vm100_cs5_peer_visible_rc": 1, "vm100_nft_cs4_rule_visible_rc": 0, "vm100_nft_cs5_rule_visible_rc": 1, "vm100_selector_active_entry_count": 4, "vm100_selector_conf_exists_rc": 0, "vm100_selector_cs4_present_rc": 0, "vm100_selector_cs5_any_present_rc": 1, "vm100_selector_cs5_exact_present_rc": 1, "vm100_selector_service_enabled_rc": 0, "vm100_wg_paid_peer_count": 4 }, "vm101": { "slots": { "vpn1": { "fwmark": "0x201", "interface_name": "vpn1", "label": "canary_vpn1", "selector_class": "cs4", "status": "healthy", "table_id": 201 }, "vpn2": { "fwmark": "0x202", "interface_name": "vpn2", "label": "canary_vpn2", "selector_class": "cs5", "status": "healthy", "table_id": 202 }, "vpn3": { "fwmark": "0x203", "interface_name": "vpn3", "label": "canary_vpn3", "selector_class": "cs1", "status": "healthy", "table_id": 203 }, "vpn4": { "fwmark": "0x204", "interface_name": "vpn4", "label": "canary_vpn4", "selector_class": "cs2", "status": "healthy", "table_id": 204 }, "vpn5": { "fwmark": "0x205", "interface_name": "vpn5", "label": "canary_vpn5", "selector_class": "cs3", "status": "healthy", "table_id": 205 } }, "vm101_slot_registry_exists_rc": 0, "vm101_status_json_parse_rc": 0, "vm101_status_run_rc": 0, "vm101_status_schema": "router-egress-slots-status-v1", "vm101_status_slot_count": 5, "vm101_status_tool_exists_rc": 0 }, "vm121": { "install": { "vm121_backup_dir": "/root/router-ops-backups/STEP_040H_REMOTE_SCRIPT_PLAN_V2_20260708-170308", "vm121_planner_backup_rc": 0, "vm121_planner_exists_rc": 0, "vm121_planner_install_rc": 0, "vm121_planner_path": "/usr/local/sbin/wg-access-agent-selector-remote-plan.py", "vm121_rollback_create_rc": 0, "vm121_rollback_path": "/root/rollback-step040h-agent-selector-remote-plan-v2.sh", "vm121_selector_helper_exists_rc": 0 } } }