WRKLOG-2026-02-23

# Issue cert from Vault
vault write -format=json pki_int/issue/domus-client \
  common_name="wazuh.inside.domusdigitalis.dev" \
  ttl="8760h" > /tmp/wazuh-cert.json

# Extract components
jq -r '.data.certificate' /tmp/wazuh-cert.json > /tmp/wazuh.crt
jq -r '.data.private_key' /tmp/wazuh-cert.json > /tmp/wazuh.key
jq -r '.data.ca_chain[]' /tmp/wazuh-cert.json > /tmp/wazuh-ca.crt

# Copy to k3s node
scp /tmp/wazuh.crt /tmp/wazuh.key /tmp/wazuh-ca.crt k3s-master-01:/tmp/

# Create secret (on k3s-master-01)
kubectl -n wazuh create secret generic dashboard-certs-vault \
  --from-file=cert.pem=/tmp/wazuh.crt \
  --from-file=key.pem=/tmp/wazuh.key \
  --from-file=root-ca.pem=/tmp/wazuh-ca.crt \
  --dry-run=client -o yaml | kubectl apply -f -

# Patch deployment (volume index 1, not 0!)
kubectl -n wazuh patch deployment wazuh-dashboard --type=json -p='[
  {"op": "replace", "path": "/spec/template/spec/volumes/1/secret/secretName", "value": "dashboard-certs-vault"}
]'

# Restart
kubectl -n wazuh rollout restart deployment/wazuh-dashboard

NAME                               READY   STATUS    AGE
wazuh-dashboard-566bfbdc97-xxx     1/1     Running   ~30m
wazuh-indexer-0                    1/1     Running   ~30m
wazuh-manager-master-0             1/1     Running   ~30m
wazuh-manager-worker-0             1/1     Running   ~30m

CURRENT STATE: [What you observe]
PROBLEM: [Why it's an issue - user impact]
KEEP: [What should NOT change]
CHANGE: [Specific modifications needed]
DESIRED OUTCOME: [What success looks like]

CURRENT STATE: Connection labels render with #ffffff text
PROBLEM: Poor contrast against #e3f2fd container - hard to read
KEEP: The dark blue hexagon fill (#0d47a1)
CHANGE: Text color to dark navy (#1a237e) for contrast
DESIRED OUTCOME: Labels clearly visible without straining

sudo named-checkzone 1.50.10.in-addr.arpa /var/named/10.50.1.rev
zone 1.50.10.in-addr.arpa/IN: loaded serial 2026022301
OK

dig +short -x 10.50.1.120 @localhost
# (empty result - NXDOMAIN)

sudo awk '/120|121|122/ {print NR": ["$0"]"}' /var/named/10.50.1.rev

sudo sed -i '/IN[[:space:]]*PTR/s/^[[:space:]]*//' /var/named/10.50.1.rev
sudo rndc reload 1.50.10.in-addr.arpa

# View all credential secrets decoded
for secret in dashboard-cred indexer-cred wazuh-api-cred wazuh-authd-pass; do
  echo "=== $secret ==="
  kubectl -n wazuh get secret $secret -o json | jq -r '.data | to_entries[] | "\(.key): \(.value | @base64d)"'
done

# Check what secrets a pod uses
kubectl -n wazuh get pod -l app=wazuh-dashboard -o yaml | awk '/secretKeyRef/,/name:/'

# Find ConfigMap name
kubectl get pod wazuh-indexer-0 -o json | jq -r '.spec.volumes[] | select(.configMap) | .configMap.name'

# Quick TLS check
curl -vI https://wazuh.inside.domusdigitalis.dev:8443 2>&1 | grep -E "subject:|issuer:|expire|SSL|CN"

# Extract key details with awk
curl -vI --silent https://wazuh.inside.domusdigitalis.dev:8443 2>&1 | awk '/subject:|issuer:|expire date|SSL connection/'

# Calculate days until expiry
EXPIRE=$(curl -vI --silent https://wazuh.inside.domusdigitalis.dev:8443 2>&1 | awk '/expire date:/ {print $4, $5, $6, $7}')
echo "Expires: $EXPIRE ($(( ($(date -d "$EXPIRE" +%s) - $(date +%s)) / 86400 )) days)"

# Validate issuer is Vault PKI
curl -vI --silent https://wazuh.inside.domusdigitalis.dev:8443 2>&1 | awk '/issuer:/ {print ($0 ~ /DOMUS-ISSUING-CA/) ? "✓ Vault PKI" : "✗ Unknown CA"}'

curl -vI https://ise-01.inside.domusdigitalis.dev:8443 2>&1 | awk '/subject:|issuer:|expire/'
# subject: CN=ise-01.inside.domusdigitalis.dev
# expire date: Feb 11 08:49:10 2027 GMT
# issuer: CN=DOMUS-ISSUING-CA

# Issue cert
vault write -format=json pki_int/issue/domus-client \
  common_name="<service>.inside.domusdigitalis.dev" \
  ttl="8760h" > /tmp/<service>-cert.json

# Extract (including CA chain for full trust)
jq -r '.data.certificate' /tmp/<service>-cert.json > /tmp/<service>.crt
jq -r '.data.private_key' /tmp/<service>-cert.json > /tmp/<service>.key
jq -r '.data.ca_chain[]' /tmp/<service>-cert.json >> /tmp/<service>.crt

# Copy to k3s node
scp /tmp/<service>.crt /tmp/<service>.key k3s-master-01:/tmp/

# Create TLS secret
kubectl -n monitoring create secret tls <service>-tls \
  --cert=/tmp/<service>.crt \
  --key=/tmp/<service>.key

# Custom-columns IngressRoute listing (shows hostname config)
kubectl get ingressroute -n monitoring -o custom-columns=NAME:.metadata.name,HOST:.spec.routes[0].match

# DNS resolution with host+awk (clean hostname → IP output)
for h in grafana prometheus alertmanager; do
  host ${h}.inside.domusdigitalis.dev | awk '{print $1, $NF}'
done

# BPF lb map analysis
kubectl -n kube-system exec ds/cilium -- cilium bpf lb list | awk '
/NodePort/ {
  if (/non-routable/) print "NON-ROUTABLE:", $1
  else print "ROUTABLE:", $1
}'

# tc filter check (empty = no BPF on interface)
tc filter show dev eth0 ingress

# Cilium drop monitor
kubectl -n kube-system exec ds/cilium -- cilium monitor --type drop

# Firewall port list (sorted)
sudo firewall-cmd --list-ports | tr ' ' '\n' | sort -t/ -k1 -n

# Install MetalLB
helm repo add metallb https://metallb.github.io/metallb
helm repo update
helm install metallb metallb/metallb -n metallb-system --create-namespace

# Configure IP pool (verified free first)
cat <<'EOF' | kubectl apply -f -
apiVersion: metallb.io/v1beta1
kind: IPAddressPool
metadata:
  name: mgmt-pool
  namespace: metallb-system
spec:
  addresses:
  - 10.50.1.130-10.50.1.140
---
apiVersion: metallb.io/v1beta1
kind: L2Advertisement
metadata:
  name: mgmt-l2
  namespace: metallb-system
spec:
  ipAddressPools:
  - mgmt-pool
EOF

netapi pfsense dns update --id 7 -h grafana -d inside.domusdigitalis.dev -i 10.50.1.130 --descr "Grafana (MetalLB)"
netapi pfsense dns update --id 37 -h prometheus -d inside.domusdigitalis.dev -i 10.50.1.130 --descr "Prometheus (MetalLB)"
netapi pfsense dns update --id 4 -h alertmanager -d inside.domusdigitalis.dev -i 10.50.1.130 --descr "AlertManager (MetalLB)"

curl -ks https://grafana.inside.domusdigitalis.dev | head -1  # HTTP/2 302
curl -ks https://prometheus.inside.domusdigitalis.dev/-/healthy  # Healthy
curl -ks https://alertmanager.inside.domusdigitalis.dev/-/healthy  # OK

Error Code: 40087
Error Name: LW_ERROR_CLOCK_SKEW

w32tm /config /manualpeerlist:"10.50.1.1" /syncfromflags:manual /reliable:yes /update
Restart-Service w32time
w32tm /resync /force

Certificate invalid: name is not a listed principal

# Add gabriel to vault-ssh-sign script
sed -i 's/PRINCIPALS="adminerosado,admin,ansible,evanusmodestus,root"/PRINCIPALS="adminerosado,admin,ansible,evanusmodestus,gabriel,root"/' ~/.local/bin/vault-ssh-sign

# Re-sign
vault-ssh-sign

# Test
ssh -o CertificateFile=~/.ssh/id_ed25519_vault-cert.pub gabriel@modestus-p50 whoami