Initial skills documentation — 25 categories, all SKILL.md + references + scripts

2026-07-15 17:42:20 -04:00
commit 1b4fcd4427
976 changed files with 188344 additions and 0 deletions
@@ -0,0 +1,47 @@
+# MikroTik WISP Router Backup Pipeline
+
+## Pipeline Architecture
+
+```
+Core (netcup) → L2TP/IPsec VPN → MikroTik Router (WireGuard tunnel interface)
+                            ↓
+              SSH export config → gzip → S3 upload (mikrotik-ccr-backups)
+```
+
+## Key Configuration
+
+| Setting | Value |
+|---------|-------|
+| Router IP (via VPN tunnel) | 10.77.0.2 |
+| LAN IP (NOT via VPN) | 192.168.88.1 |
+| SSH port | 22 (restricted to 10.77.0.0/24) |
+| Backup frequency | 6:00 AM daily |
+| S3 bucket | `mikrotik-ccr-backups` |
+| Script | `/root/.hermes/scripts/run-wisp-backup.sh` |
+| Config | `/root/.hermes/scripts/wisp-backup/config.yaml` |
+| Method | paramiko SSH → `/export` → gzip → S3 upload |
+
+## Diagnosis
+
+When the backup fails:
+1. Check cron: `cronjob action=list` — look for `home-router-daily-backup` status
+2. Check VPN: `ipsec status` or `xl2tpd` — tunnel must be up
+3. Check IP: router must be reachable on `10.77.0.2` (tunnel), NOT `192.168.88.1` (LAN)
+4. Check for stuck exports: SSH in and check for `.in_progress` files
+5. Check paramiko: `python3 -c "import paramiko"`
+
+## Pitfalls
+
+- **Wrong IP in config** — The tower IP was set to `192.168.88.1` (LAN) instead of `10.77.0.2` (VPN tunnel). SSH is restricted to 10.77.0.0/24.
+- **Missing paramiko** — `wisp-backup.py` requires paramiko. Install with `pip install paramiko`.
+- **Missing VPN stack** — `xl2tpd` and `strongswan-starter` packages may not be installed on the backup server.
+- **Stuck exports** — If a previous export failed, the router retains a `.in_progress` file. Clean it via SSH: `ssh admin@10.77.0.2 /file remove [filename].in_progress`
+- **Wrong cron script** — The cron was using `home-router-backup.sh` (old WireGuard script) instead of `run-wisp-backup.sh`.
+
+## Verification
+
+```bash
+aws s3 ls s3://mikrotik-ccr-backups/wisp-backups/configs/home/ \
+  --endpoint-url https://s3.us-east-1.wasabisys.com
+```
+Files are named: `home-gateway-YYYY-MM-DD.rsc.gz`