TP16.3 §2/§3 durch: cloudflared auf ap1/ap2/ap3, bf-public healthy mit 12 Connectoren

Merge von claude/nervous-williams-acf000 (d5b3ce3) plus Ergebnis der Vor-Ort-Session vom 2026-08-31. Ergebnis - je ein cloudflared 2026.6.1 auf ap1/ap2/ap3, bf-public healthy/12 (vorher 0 Connectoren), Flash je AP 54-55 MiB frei, WLAN zurueck. Drei Runbook-Fehler aufgedeckt und korrigiert (§2.2, §3.3, §3.5, §8) - Flash-Budget war Faktor 2,5 zu optimistisch: cloudflared entpackt 69,5 MiB (gemessen mit docker export), nicht 28 MB -- das offizielle Image passt auf keinen der drei APs. Ersatz: eigenes FROM-scratch-Image mit 35,3 MiB aus dem statisch gelinkten Binary, Binary-SHA e93824f6 gepinnt, Neubau byte-identisch. tools/build-cfd-image.py. - docker save schreibt seit Docker 25 OCI statt docker-v1 -> RouterOS meldet "no config found in manifest". tools/oci2docker.py als Konverter. - /container/envs nimmt list=, nicht name= (auch MikroMCPs manage_container_env ist dadurch fuer dieses Feld unbrauchbar). Weitere Funde - Der device-mode-Bestaetigungs-Boot installiert keine Pakete; erst Paket-Reboot, dann device-mode. - "A - AVAILABLE" in /system package print ist ein Download-Katalog, kein Paket auf dem Geraet (Gegenprobe am Core: 2,9 MB frei, listet 10,1 MB wifi-qcom als verfuegbar). - MikroMCPs export_config exportiert unvollstaendig (301 B statt 6,2 KiB). Offen und entscheidungsbeduerftig - Compliance 128/135: §3.4 verlangt Direkt-Writes fuer ip address/nat, die unter GC-Kontrolle stehen -> sechs neue extra-Drifts, zwei je AP. Inhaltlich richtig, gehoeren ins Soll -- kein Re-Baseline, kein Rueckbau. - Zwei Nautobot-Tokens sind in dieser Session ins Transkript geraten (unzureichende sed-Maskierung) -> Rotation noetig, TP30. Merkregel in CLAUDE.md ergaenzt. Merge-Konflikte aufgeloest - Nummernkonflikt: beide Branches hatten ein TP37. main behaelt TP37 (Nautobot als Netzwerkdoku, User-Okay 08-30), OOB-Mgmt wird TP38. Braucht noch Christophs Okay. - Drei CF-Rollback-Snapshots hatten gleichen Namen bei verschiedenem Inhalt -> aelterer Stand als *-vor-hostname-schnitt.json erhalten, keiner verworfen. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-31 16:15:13 +02:00
parent 6f8ba8c8b5 d5b3ce37ff
commit 60360fc3cc
17 changed files with 1624 additions and 14 deletions
--- a/docs/cf-backup/bf-mm-ingress-20260830-vor-hostname-schnitt.json
+++ b/docs/cf-backup/bf-mm-ingress-20260830-vor-hostname-schnitt.json
@@ -0,0 +1,44 @@
+{
+    "success": true,
+    "errors": [],
+    "messages": [],
+    "result": {
+        "tunnel_id": "7a322261-380a-447b-97d2-8ebce99f5ed1",
+        "version": 4,
+        "config": {
+            "ingress": [
+                {
+                    "service": "http://10.40.20.167:5678",
+                    "hostname": "n8n.emsenhuber.net"
+                },
+                {
+                    "service": "http://10.40.20.167:3001",
+                    "hostname": "n8n-mcp.emsenhuber.net"
+                },
+                {
+                    "service": "http://10.40.20.167:3000",
+                    "hostname": "gitea-mcp.emsenhuber.net"
+                },
+                {
+                    "service": "ssh://10.40.20.167:22",
+                    "hostname": "82unkpb5.emsenhuber.net"
+                },
+                {
+                    "service": "https://10.40.20.135:8007",
+                    "hostname": "pbs.emsenhuber.net",
+                    "originRequest": {
+                        "noTLSVerify": true
+                    }
+                },
+                {
+                    "service": "http_status:404"
+                }
+            ],
+            "warp-routing": {
+                "enabled": false
+            }
+        },
+        "source": "cloudflare",
+        "created_at": "2026-07-27T13:53:23.512528Z"
+    }
+}
--- a/docs/cf-backup/bf-mm-ingress-20260830-vor-tp16.3-schnitt.json
+++ b/docs/cf-backup/bf-mm-ingress-20260830-vor-tp16.3-schnitt.json
@@ -1 +1,20 @@
-{"success":true,"errors":[],"messages":[],"result":{"tunnel_id":"7a322261-380a-447b-97d2-8ebce99f5ed1","version":4,"config":{"ingress":[{"service":"http://10.40.20.167:5678","hostname":"n8n.emsenhuber.net"},{"service":"http://10.40.20.167:3001","hostname":"n8n-mcp.emsenhuber.net"},{"service":"http://10.40.20.167:3000","hostname":"gitea-mcp.emsenhuber.net"},{"service":"ssh://10.40.20.167:22","hostname":"82unkpb5.emsenhuber.net"},{"service":"https://10.40.20.135:8007","hostname":"pbs.emsenhuber.net","originRequest":{"noTLSVerify":true}},{"service":"http_status:404"}],"warp-routing":{"enabled":false}},"source":"cloudflare","created_at":"2026-07-27T13:53:23.512528Z"}}
+{
+  "tunnel_id": "7a322261-380a-447b-97d2-8ebce99f5ed1",
+  "version": 6,
+  "config": {
+    "ingress": [
+      {
+        "service": "http://10.40.20.167:5678",
+        "hostname": "n8n.emsenhuber.net"
+      },
+      {
+        "service": "http_status:404"
+      }
+    ],
+    "warp-routing": {
+      "enabled": false
+    }
+  },
+  "source": "cloudflare",
+  "created_at": "2026-08-30T10:19:30.297725Z"
+}
--- a/docs/cf-backup/bf-nas-ingress-20260830-vor-hostname-schnitt.json
+++ b/docs/cf-backup/bf-nas-ingress-20260830-vor-hostname-schnitt.json
@@ -0,0 +1,41 @@
+{
+    "success": true,
+    "errors": [],
+    "messages": [],
+    "result": {
+        "tunnel_id": "220c9958-401b-4111-9451-f3db09bba2d5",
+        "version": 6,
+        "config": {
+            "ingress": [
+                {
+                    "service": "http://10.40.20.157:3000",
+                    "hostname": "gitea.emsenhuber.net"
+                },
+                {
+                    "service": "http://10.40.20.173:3000",
+                    "hostname": "pve-mcp.emsenhuber.net"
+                },
+                {
+                    "service": "http://10.40.20.127",
+                    "hostname": "vw.emsenhuber.net"
+                },
+                {
+                    "service": "http://10.40.20.10:8080",
+                    "hostname": "ds-bf.emsenhuber.net"
+                },
+                {
+                    "service": "ssh://10.40.20.10:22",
+                    "hostname": "3k23uow7.emsenhuber.net"
+                },
+                {
+                    "service": "http_status:404"
+                }
+            ],
+            "warp-routing": {
+                "enabled": true
+            }
+        },
+        "source": "cloudflare",
+        "created_at": "2026-08-29T17:30:22.531419Z"
+    }
+}
--- a/docs/cf-backup/bf-nas-ingress-20260830-vor-tp16.3-schnitt.json
+++ b/docs/cf-backup/bf-nas-ingress-20260830-vor-tp16.3-schnitt.json
@@ -1 +1,24 @@
-{"success":true,"errors":[],"messages":[],"result":{"tunnel_id":"220c9958-401b-4111-9451-f3db09bba2d5","version":6,"config":{"ingress":[{"service":"http://10.40.20.157:3000","hostname":"gitea.emsenhuber.net"},{"service":"http://10.40.20.173:3000","hostname":"pve-mcp.emsenhuber.net"},{"service":"http://10.40.20.127","hostname":"vw.emsenhuber.net"},{"service":"http://10.40.20.10:8080","hostname":"ds-bf.emsenhuber.net"},{"service":"ssh://10.40.20.10:22","hostname":"3k23uow7.emsenhuber.net"},{"service":"http_status:404"}],"warp-routing":{"enabled":true}},"source":"cloudflare","created_at":"2026-08-29T17:30:22.531419Z"}}
+{
+  "tunnel_id": "220c9958-401b-4111-9451-f3db09bba2d5",
+  "version": 7,
+  "config": {
+    "ingress": [
+      {
+        "service": "http://10.40.20.157:3000",
+        "hostname": "gitea.emsenhuber.net"
+      },
+      {
+        "service": "http://10.40.20.127",
+        "hostname": "vw.emsenhuber.net"
+      },
+      {
+        "service": "http_status:404"
+      }
+    ],
+    "warp-routing": {
+      "enabled": true
+    }
+  },
+  "source": "cloudflare",
+  "created_at": "2026-08-30T08:50:21.241084Z"
+}
--- a/docs/cf-backup/bf-public-ingress-20260830-vor-tp16.3-schnitt.json
+++ b/docs/cf-backup/bf-public-ingress-20260830-vor-tp16.3-schnitt.json
@@ -1 +1,44 @@
-{"success":true,"errors":[],"messages":[],"result":{"tunnel_id":"48d3b0b6-7233-4781-a76a-1de4a5e957ce","version":2,"config":{"ingress":[{"service":"http://10.40.20.40:80","hostname":"vw.emsenhuber.net","originRequest":{"noTLSVerify":true}},{"service":"http://10.40.20.40:80","hostname":"hass.emsenhuber.net","originRequest":{"noTLSVerify":true}},{"service":"http://10.40.20.40:80","hostname":"n8n.emsenhuber.net","originRequest":{"noTLSVerify":true}},{"service":"http://10.40.20.40:80","hostname":"gitea.emsenhuber.net","originRequest":{"noTLSVerify":true}},{"service":"http_status:404"}],"warp-routing":{"enabled":false}},"source":"cloudflare","created_at":"2026-08-27T05:45:54.534390Z"}}
+{
+  "tunnel_id": "48d3b0b6-7233-4781-a76a-1de4a5e957ce",
+  "version": 2,
+  "config": {
+    "ingress": [
+      {
+        "service": "http://10.40.20.40:80",
+        "hostname": "vw.emsenhuber.net",
+        "originRequest": {
+          "noTLSVerify": true
+        }
+      },
+      {
+        "service": "http://10.40.20.40:80",
+        "hostname": "hass.emsenhuber.net",
+        "originRequest": {
+          "noTLSVerify": true
+        }
+      },
+      {
+        "service": "http://10.40.20.40:80",
+        "hostname": "n8n.emsenhuber.net",
+        "originRequest": {
+          "noTLSVerify": true
+        }
+      },
+      {
+        "service": "http://10.40.20.40:80",
+        "hostname": "gitea.emsenhuber.net",
+        "originRequest": {
+          "noTLSVerify": true
+        }
+      },
+      {
+        "service": "http_status:404"
+      }
+    ],
+    "warp-routing": {
+      "enabled": false
+    }
+  },
+  "source": "cloudflare",
+  "created_at": "2026-08-27T05:45:54.534390Z"
+}
--- a/docs/cf-backup/bf-pve-ingress-20260830-vor-hostname-schnitt.json
+++ b/docs/cf-backup/bf-pve-ingress-20260830-vor-hostname-schnitt.json
@@ -0,0 +1,59 @@
+{
+    "success": true,
+    "errors": [],
+    "messages": [],
+    "result": {
+        "tunnel_id": "f7fdf3a6-b67d-4567-93b1-b0f273794d09",
+        "version": 3,
+        "config": {
+            "ingress": [
+                {
+                    "service": "https://10.40.20.100:8006",
+                    "hostname": "pve.emsenhuber.net",
+                    "originRequest": {
+                        "noTLSVerify": true
+                    }
+                },
+                {
+                    "service": "ssh://10.40.20.100:22",
+                    "hostname": "j44d6tua.emsenhuber.net"
+                },
+                {
+                    "service": "http://10.40.20.232",
+                    "hostname": "ccu.emsenhuber.net"
+                },
+                {
+                    "service": "http://10.40.20.107:8081",
+                    "hostname": "iobroker.emsenhuber.net"
+                },
+                {
+                    "service": "http://10.40.20.106:8080",
+                    "hostname": "z2m25.emsenhuber.net"
+                },
+                {
+                    "service": "https://10.40.20.126:9443",
+                    "hostname": "portainer.emsenhuber.net",
+                    "originRequest": {
+                        "noTLSVerify": true
+                    }
+                },
+                {
+                    "service": "http://10.40.20.105:8123",
+                    "hostname": "hass.emsenhuber.net"
+                },
+                {
+                    "service": "http://10.40.20.105:9583",
+                    "hostname": "ha-mcp.emsenhuber.net"
+                },
+                {
+                    "service": "http_status:404"
+                }
+            ],
+            "warp-routing": {
+                "enabled": true
+            }
+        },
+        "source": "cloudflare",
+        "created_at": "2026-07-16T11:36:24.193655Z"
+    }
+}
--- a/docs/cf-backup/bf-pve-ingress-20260830-vor-tp16.3-schnitt.json
+++ b/docs/cf-backup/bf-pve-ingress-20260830-vor-tp16.3-schnitt.json
@@ -1 +1,20 @@
-{"success":true,"errors":[],"messages":[],"result":{"tunnel_id":"f7fdf3a6-b67d-4567-93b1-b0f273794d09","version":3,"config":{"ingress":[{"service":"https://10.40.20.100:8006","hostname":"pve.emsenhuber.net","originRequest":{"noTLSVerify":true}},{"service":"ssh://10.40.20.100:22","hostname":"j44d6tua.emsenhuber.net"},{"service":"http://10.40.20.232","hostname":"ccu.emsenhuber.net"},{"service":"http://10.40.20.107:8081","hostname":"iobroker.emsenhuber.net"},{"service":"http://10.40.20.106:8080","hostname":"z2m25.emsenhuber.net"},{"service":"https://10.40.20.126:9443","hostname":"portainer.emsenhuber.net","originRequest":{"noTLSVerify":true}},{"service":"http://10.40.20.105:8123","hostname":"hass.emsenhuber.net"},{"service":"http://10.40.20.105:9583","hostname":"ha-mcp.emsenhuber.net"},{"service":"http_status:404"}],"warp-routing":{"enabled":true}},"source":"cloudflare","created_at":"2026-07-16T11:36:24.193655Z"}}
+{
+  "tunnel_id": "f7fdf3a6-b67d-4567-93b1-b0f273794d09",
+  "version": 4,
+  "config": {
+    "ingress": [
+      {
+        "service": "http://10.40.20.105:8123",
+        "hostname": "hass.emsenhuber.net"
+      },
+      {
+        "service": "http_status:404"
+      }
+    ],
+    "warp-routing": {
+      "enabled": true
+    }
+  },
+  "source": "cloudflare",
+  "created_at": "2026-08-30T08:50:25.151983Z"
+}
--- a/docs/cf-backup/cnames-tunnel-20260830-vor-tp16.3-schnitt.json
+++ b/docs/cf-backup/cnames-tunnel-20260830-vor-tp16.3-schnitt.json
@@ -0,0 +1,44 @@
+[
+  {
+    "name": "ds-fm.emsenhuber.net",
+    "type": "CNAME",
+    "content": "b697d124-53bf-4a33-8fcf-384cced4db1a.cfargotunnel.com",
+    "proxied": true,
+    "id": "0da61c6143bfd0d5f9c47ca4b4147b06"
+  },
+  {
+    "name": "gateway-fm.emsenhuber.net",
+    "type": "CNAME",
+    "content": "b697d124-53bf-4a33-8fcf-384cced4db1a.cfargotunnel.com",
+    "proxied": true,
+    "id": "54ac8b816765b45191469678891389bd"
+  },
+  {
+    "name": "gitea.emsenhuber.net",
+    "type": "CNAME",
+    "content": "220c9958-401b-4111-9451-f3db09bba2d5.cfargotunnel.com",
+    "proxied": true,
+    "id": "3d6053529f99fc5832d9956ee6e8834c"
+  },
+  {
+    "name": "hass.emsenhuber.net",
+    "type": "CNAME",
+    "content": "f7fdf3a6-b67d-4567-93b1-b0f273794d09.cfargotunnel.com",
+    "proxied": true,
+    "id": "0841148f401b5db40fa02f69d0f0e848"
+  },
+  {
+    "name": "n8n.emsenhuber.net",
+    "type": "CNAME",
+    "content": "7a322261-380a-447b-97d2-8ebce99f5ed1.cfargotunnel.com",
+    "proxied": true,
+    "id": "40b311a40e41fbeae85ca097a4036e6c"
+  },
+  {
+    "name": "vw.emsenhuber.net",
+    "type": "CNAME",
+    "content": "220c9958-401b-4111-9451-f3db09bba2d5.cfargotunnel.com",
+    "proxied": true,
+    "id": "2971d3ba9410e841b35ec58ffda59be4"
+  }
+]