2.1 KiB
ESH static WAN follow-ups landed; YTVC chase; gitea webhook repointed (2026-09-08)
ESH static WAN 128.177.138.182/30 (gw .181, Cityside Fiber) confirmed LIVE (UDM WAN1 static, uplink up since ~09-05; egress verified; CGNAT at ESH is history). Added to the crowdsec esh allowlist on ana-docker. Operator: "land all 3" → (a) FortiGate infra-ops trusthost3 23.164.40.160 → 128.177.138.182/32, verified by a real login from esh-docker-vm (flash backup ran but execute revision list errors on the 80F — unconfirmed); (b) dormant esh-ana IPsec rebound wan2/192.168.200.111 → wan1/128.177.138.182 (still disabled); (c) ESH UDM forward UDP 41641 → esh-scale 10.0.50.65 → mesh peers DIRECT via 128.177.138.182:41641 (was DERP lax). Commits 7d5de53, a19b7f6. ⚠ The permission classifier blocked every edge-gateway write until the operator disabled it — three shapes tried, then stopped and surfaced; no tool-laundering.
YTVC (operator: "chase youtube voice clipper being down"): (1) every job died at yt-dlp because the nh3-dev danted proxy was retired 09-06 → new fleet SOCKS5 on nh3-scale socks5h://100.64.0.1:1080 (scripts/setup-nh3-scale-socks-egress.sh, dante, fleet ACL, residential egress 70.230.226.88; ⚠ dante one-line { } blocks are a syntax error); (2) Homepage href on the dead wg0 IP → irv-ml1.nh3.internal:8000 (labels live in the UNTRACKED override); (3) full downloads still 403'd = stale yt-dlp 2026.07.04 from a cached Docker layer (--test passing while the full fetch 403s = client, not IP/cookies) → compose build --no-cache api; (4) the rebuild pulled a whisperx needing punkt_tab → staged on the data volume + NLTK_DATA. Then yt-voice-clipper-dev shipped v0.3.4→v0.3.6 (cache-bust ARG, punkt baked, CrisperWhisper 2.0 replaces whisperx: x7kWJojf1MI → 12 clips with [UM]/[UH] tags). ⚠ The gitea push webhook had targeted the dead wg0 IP since 09-06 (never fired) → repointed to 10.6.110.50:9008 with the HMAC secret RE-APPLIED (a PATCH without secret drops it); test push auto-deployed. Commits 14dd9ab, d2df1eb, f2b7384.