admin
fca85498e1
gates / gates (push) Successful in 8s
part4 (VM 323) was kept while Parts 1 and 3 read it — it was standing in the exact
failed half-B state and tearing it down first would have destroyed the evidence.
Destroyed after the diagnoses were committed (70b6260): VM, hub host, hub customer,
u629488-sub6, ep0 namespace, wg peer 10.77.0.7, all verified absent with demo-hp as
the positive control.
Final: demo-hp holds only VM 300 (drill-r50) and its own CT 9201; ep0 holds only
demo-felhom and demo-hp. 53.4 GB reclaimed across the three venues.
The cascade purges all escrow ciphertext, so R_C11_REWALK and R_PART4 in the
operator's credentials file are now inert.
110 lines
5.5 KiB
Markdown
110 lines
5.5 KiB
Markdown
# Teardown ledger — the campaign venues (2026-08-06)
|
|
|
|
Three throwaway appliances had accumulated, each with its own storage sub-account, hub record, tunnel
|
|
peer and off-site repository. **Two were destroyed here.** The third (`part4`, VM 323) was kept until
|
|
Parts 1 and 3 had banked their findings, and goes separately.
|
|
|
|
## What was matched, and how
|
|
|
|
Matched on **identity** — customer id → host id → off-site sub-account → wg peer — never on size. The
|
|
hub's own delete-preview (`GET /configs/<id>/delete`) was used as an independent enumeration and
|
|
agreed with the hand-built one in every field.
|
|
|
|
## The cascade is the hub's, not a hand-deletion
|
|
|
|
`POST /configs/<id>/delete` runs the designed teardown: leg 1 hosts (including
|
|
`DELETE FROM wg_peers WHERE host_id = ?`), leg 2 the committed reset with **external teardown FIRST**
|
|
(off-site store + PBS namespace destroyed), leg 3 residue, leg 4 the customer record and **all** escrow
|
|
ciphertext. Its own confirmation: „offsite tároló és PBS névtér megsemmisítve… Visszafordíthatatlan."
|
|
|
|
**Six gates, all of which had to be satisfied deliberately** — three acknowledgements
|
|
(`ack_hosts`/`ack_reset`/`ack_purge`), a type-to-confirm `confirm_id`, an `expect_hosts` race guard,
|
|
and — the one that shaped the whole operation — **the cascade refuses to delete a live host**:
|
|
|
|
> Delete refused: host c11-36d660 is ONLINE. Decommission the box first — the cascade never deletes a
|
|
> live host.
|
|
|
|
There is no hub decommission endpoint; the word appears only in that refusal. So both VMs were
|
|
**stopped** and the hub was allowed to age them past its `stale_threshold` (**30m**, from the deployed
|
|
`hub-config`) before the cascade would accept them. `rewalk` aged out at ~21 min of silence, `c11` at
|
|
~28 min — the two boxes' last reports had landed at different points in their cycles.
|
|
|
|
## Venue 1 — `c11` "Campaign 11"
|
|
|
|
| Layer | Item | After |
|
|
|---|---|---|
|
|
| Machine | `demo-hp` VM **321** `c11-appliance` (200 G + 50 G + 50 G + efidisk, **20 G on disk**) | `qm destroy 321 --purge` — absent from `qm list` |
|
|
| Hub host | `c11-36d660` | 0 occurrences |
|
|
| Hub customer | `c11` (residue 340 rows, 1 superseded blob) | 0 occurrences |
|
|
| Off-site | Storage Box sub-account **`u629488-sub4`** | 0 occurrences |
|
|
| Off-site | `ep0` PBS namespace **`c11`** | gone |
|
|
| Network | WireGuard peer **10.77.0.5** | 0 occurrences |
|
|
|
|
## Venue 2 — `rewalk` "Re-walk R-201"
|
|
|
|
| Layer | Item | After |
|
|
|---|---|---|
|
|
| Machine | `demo-hp` VM **322** `rewalk-appliance` (**17 G on disk**) | `qm destroy 322 --purge` — absent |
|
|
| Hub host | `rewalk-1ab77d` | 0 occurrences |
|
|
| Hub customer | `rewalk` (residue 93 rows) | 0 occurrences |
|
|
| Off-site | Storage Box sub-account **`u629488-sub5`** | 0 occurrences |
|
|
| Off-site | `ep0` PBS namespace **`rewalk`** | gone |
|
|
| Network | WireGuard peer **10.77.0.6** | 0 occurrences |
|
|
|
|
## Space returned, measured
|
|
|
|
`c11-scratch` used: **58,578,256 KiB → 21,228,640 KiB** = **37.3 GB reclaimed**, against 20 G + 17 G
|
|
measured before deletion. Free went 874.8 GB → 912.1 GB.
|
|
|
|
## The positive control
|
|
|
|
An absence proves nothing unless the instrument can still find something. After each cascade the same
|
|
greps were run for **`part4`**, which must survive: host `part4-905bdb` still present (2 rows), wg peer
|
|
**10.77.0.7** still present, `ep0` namespace `part4` still present. So the zero counts above are
|
|
measurements, not a broken query.
|
|
|
|
`ep0` namespaces after both teardowns: `demo-felhom`, `demo-hp`, `part4` — exactly the three that
|
|
should remain. Nothing on `ep0` outside the campaign's own namespaces was touched.
|
|
|
|
## Untouched, as scoped
|
|
|
|
`demo-hp` itself and its guest 9201, `demo-felhom`, `drill-r50` (VM 300), DooPlex, the tester's box,
|
|
and every `ep0` namespace that is not the campaign's own.
|
|
|
|
|
|
## Venue 3 — `part4` "Part 4 - no hand upgrade" (destroyed after the findings were written)
|
|
|
|
Kept deliberately while Parts 1 and 3 read it: it was standing in the exact failed half-B state, and
|
|
tearing it down first would have destroyed the evidence. Destroyed only after the diagnoses were
|
|
committed (`70b6260`).
|
|
|
|
| Layer | Item | After |
|
|
|---|---|---|
|
|
| Machine | `demo-hp` VM **323** `part4-appliance` (**16 G on disk**) | `qm destroy 323 --purge` — absent |
|
|
| Hub host | `part4-905bdb` | 0 occurrences |
|
|
| Hub customer | `part4` (residue 66 rows) | 0 occurrences |
|
|
| Off-site | Storage Box sub-account **`u629488-sub6`** | 0 occurrences |
|
|
| Off-site | `ep0` PBS namespace **`part4`** | gone |
|
|
| Network | WireGuard peer **10.77.0.7** | 0 occurrences |
|
|
|
|
Positive control for this one: **`demo-hp-bb76ea`** must survive the same greps, and does (2 rows).
|
|
|
|
## Final state
|
|
|
|
- `demo-hp` guests: **VM 300 `drill-r50`** and **CT 9201** (demo-hp's own customer guest). All three
|
|
campaign appliances are gone.
|
|
- `ep0` namespaces: **`demo-felhom`, `demo-hp`** — only the two real demo boxes remain.
|
|
- `c11-scratch` used: **58,578,256 KiB → 5,184,912 KiB = 53.4 GB reclaimed** across the three venues
|
|
(20 G + 17 G + 16 G measured beforehand). Free 874.8 GB → 928.2 GB.
|
|
|
|
## Secrets that died with the venues
|
|
|
|
Each cascade purged the customer record **and all escrow ciphertext** (leg 4). The recovery codes for
|
|
these venues therefore no longer open anything: `R_C11_REWALK` and `R_PART4` in the operator's
|
|
credentials file are now inert and can be removed at the operator's convenience. The working copies
|
|
under `~/.config/part4/` on DooPlex were shredded.
|
|
|
|
**One operational note carried over from the walk:** the `part4` retrieval passphrase was leaked into
|
|
a session transcript on 2026-08-06 and rotated at the time; the customer it belonged to no longer
|
|
exists.
|