G1: publicar console.ligbox.com.br via Traefik CT114 e VM123.

DNS Cloudflare, routers Traefik, bind LAN 0.0.0.0:8100, rollback e script de validação — Spec 019 F0 mínimo.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/network/VM123_INVENTARIO.md

@@ -10,6 +10,7 @@
 | vm123-finance-stack-fossbilling-1 | **8092** | FOSSBilling |
 | vm123-finance-stack-odoo-1 | 8069 | Odoo |
 | openpanel | 2083 | OpenPanel |
+| openpanel_dns | **53** (UDP/TCP) | BIND9 — DNS autoritativo OpenPanel · público via `95.216.14.162` |
 | phpmyadmin | 8888 | phpMyAdmin |
 | caddy | 443/2019 | Proxy |
 | + DB/redis | interno | — |
@@ -20,8 +21,9 @@
 |------|-------|
 | Compose | `/opt/ligbox-ops-console/docker-compose.yml` |
 | Container | `ligbox-ops-console-ui` |
-| Porta | `127.0.0.1:8100` |
+| Porta | `0.0.0.0:8100` (LAN — Traefik CT114) |
-| Health | `curl http://127.0.0.1:8100/health` → `ok` |
+| Health | `curl http://10.10.10.123:8100/health` → `ok` |
+| URL pública | `https://console.ligbox.com.br` → **✅ G1 2026-06-25** |
 | Rede Docker | `ligbox-console` (bridge dedicada) |
 | Imagem | `ligbox/ops-console:latest` |
 
@@ -44,3 +46,5 @@
 - Traefik/Caddy: `console.ligbox.com.br` → `127.0.0.1:8100`
 - API VM122 hub chamados (substituir mock.js)
 - Spec 012 SOC Carbonio (futuro)
+
+**DNS53:** ver [Spec 028 DNS53](../../specs/028-openpanel-ce-ligbox-reengineering/DNS53_OPENPANEL_PORTA53.md)

specs/019-ops-console-active-operations/deploy/.env.example

@@ -9,7 +9,8 @@ CONSOLE_HOST_PORT=8100
 
 # Bind: 127.0.0.1 se Traefik no CT114 alcança via LAN
 #       10.10.10.123 se Traefik aponta directo ao IP da VM
-CONSOLE_BIND=127.0.0.1
+# 0.0.0.0 — Traefik CT114 alcança via LAN 10.10.10.123:8100 (G1)
+CONSOLE_BIND=0.0.0.0
 
 # Build-time (Vite) — URL pública da API VM122
 VITE_API_URL=https://api.ops.ligbox.com.br

specs/019-ops-console-active-operations/deploy/scripts/verify-console-g1.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# G1 — validação console.ligbox.com.br (Spec 019 mínimo)
+set -euo pipefail
+
+PUBLIC_URL="${CONSOLE_PUBLIC_URL:-https://console.ligbox.com.br}"
+LAN_URL="${CONSOLE_LAN_URL:-http://10.10.10.123:8100}"
+ONBOARD_SMOKE="${ONBOARD_SMOKE_URL:-https://onboard.ligbox.com.br/onboard}"
+
+failures=0
+ok() { echo "OK   [g1]: $*"; }
+fail() { echo "FAIL [g1]: $*"; failures=$((failures + 1)); }
+
+code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 10 "$LAN_URL/health" 2>/dev/null || echo "000")
+[[ "$code" == "200" ]] && ok "VM123 LAN health $code" || fail "VM123 LAN health $code"
+
+code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 15 "$PUBLIC_URL/health" 2>/dev/null || echo "000")
+[[ "$code" == "200" ]] && ok "Public health $code" || fail "Public health $code"
+
+code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 15 "$PUBLIC_URL/" 2>/dev/null || echo "000")
+[[ "$code" == "200" ]] && ok "Public SPA $code" || fail "Public SPA $code"
+
+code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 15 "$ONBOARD_SMOKE" 2>/dev/null || echo "000")
+[[ "$code" == "200" ]] && ok "Onboard smoke (026) $code" || fail "Onboard smoke (026) $code"
+
+if [[ "$failures" -gt 0 ]]; then
+  echo "G1 validation FAILED ($failures)"
+  exit 1
+fi
+echo "G1 validation PASSED"
+exit 0

specs/019-ops-console-active-operations/deploy/traefik/G1-EXEC-20260625.md

@@ -0,0 +1,43 @@
+# G1 — Execução console.ligbox.com.br
+
+**Data:** 2026-06-25  
+**Executor:** Cursor Agent (Roger)  
+**Spec:** 019 F0 mínimo
+
+## Entregue
+
+| Item | Estado |
+|------|--------|
+| DNS Cloudflare `console.ligbox.com.br` A → `95.216.14.146` | ✅ |
+| Traefik CT114 routers HTTPS + HTTP redirect | ✅ |
+| Service `vm123-console-Service` → `10.10.10.123:8100` | ✅ |
+| VM123 `CONSOLE_BIND=0.0.0.0` (era 127.0.0.1) | ✅ |
+| Container `ligbox-ops-console-ui` healthy | ✅ |
+| `https://console.ligbox.com.br/health` | ✅ 200 (CT114) |
+| Smoke Spec 026 onboard | ✅ 200 |
+
+## Backups / versionamento
+
+| Host | Artefacto |
+|------|-----------|
+| CT114 | `dynamic.yml.bak-g1-20260625-111047` |
+| CT114 | `dynamic.yml.bak-g1-svc-20260625-111253` |
+| CT114 | git commit `e1b7541` em `/root/traefik` |
+| VM123 | `.env.bak-g1-*` em `/opt/ligbox-ops-console/` |
+| Repo | `deploy/traefik/G1-ROLLBACK.md` |
+
+## Não alterado (G1 mínimo)
+
+- VM122 Desk / API
+- VM112 Wizard
+- Redirects `desk` → `console`
+- CT130 runtime
+
+## Validação
+
+```bash
+./specs/019-ops-console-active-operations/deploy/scripts/verify-console-g1.sh
+# CT114: curl -s https://console.ligbox.com.br/health  → ok
+```
+
+**Nota:** CT130 pode falhar DNS local até pfSense cache propagar `console` — WAN e CT114 OK.

specs/019-ops-console-active-operations/deploy/traefik/G1-ROLLBACK.md

@@ -0,0 +1,42 @@
+# G1 Rollback — console.ligbox.com.br
+
+**Data deploy:** 2026-06-25  
+**Host:** CT114 (`10.10.10.114`) · `dynamic.yml`
+
+## Reverter Traefik (CT114)
+
+```bash
+ssh root@10.10.10.114
+cd /root/traefik
+ls -lt dynamic.yml.bak-g1-* | head -1   # escolher backup pré-G1
+cp dynamic.yml.bak-g1-YYYYMMDD-HHMMSS dynamic.yml
+docker logs traefik --tail 20              # confirmar sem erro YAML
+curl -sI https://onboard.ligbox.com.br/onboard | head -1   # smoke 026
+```
+
+## Reverter bind VM123 (se necessário)
+
+```bash
+ssh root@10.10.10.123
+cp /opt/ligbox-ops-console/.env.bak-g1-* /opt/ligbox-ops-console/.env
+# ou: CONSOLE_BIND=127.0.0.1
+cd /opt/ligbox-ops-console && docker compose up -d --force-recreate
+```
+
+
+Apagar ou desactivar registo `console.ligbox.com.br` A → `95.216.14.146`.
+
+## VM123
+
+O container `ligbox-ops-console-ui` pode permanecer — não afecta outros stacks.
+
+```bash
+ssh root@10.10.10.123 'curl -s http://127.0.0.1:8100/health'   # deve responder ok
+```
+
+## O que G1 mínimo NÃO alterou
+
+- `desk.ligbox.com.br` (VM122) — inalterado
+- VM112 wizard — inalterado
+- VM122 API — inalterado
+- Redirects legacy (desk → console) — **não aplicados** neste G1

specs/019-ops-console-active-operations/deploy/traefik/console-ligbox-g1-snippet.yml

@@ -0,0 +1,28 @@
+# G1 — console.ligbox.com.br → VM123:8100 (ligbox-ops-console-ui)
+# Aplicado em CT114 /root/traefik/dynamic.yml em 2026-06-25
+# Rollback: specs/019-ops-console-active-operations/deploy/traefik/G1-ROLLBACK.md
+
+# --- routers (inserir após ligbox-ops-api-Router) ---
+    ligbox-console-Router:
+      rule: Host(`console.ligbox.com.br`)
+      service: vm123-console-Service
+      entryPoints:
+      - websecure
+      tls:
+        certResolver: letsencrypt
+      middlewares:
+      - default-headers
+    ligbox-console-http-Router:
+      rule: Host(`console.ligbox.com.br`)
+      service: vm123-console-Service
+      entryPoints:
+      - web
+      middlewares:
+      - redirect-https
+
+# --- services (inserir após ligbox-ops-api-Service) ---
+    vm123-console-Service:
+      loadBalancer:
+        servers:
+        - url: http://10.10.10.123:8100
+        passHostHeader: true

specs/019-ops-console-active-operations/tasks.md

@@ -6,11 +6,11 @@
 
 ## F0 — Pré-deploy VM123
 
-- [ ] T001 Inventariar VM123 no Proxmox (IP, hostname, serviços existentes)
+- [x] T001 Inventariar VM123 no Proxmox (IP, hostname, serviços existentes)
-- [ ] T002 Executar `deploy/scripts/preflight-vm123.sh` e documentar resultado
+- [x] T002 Executar `deploy/scripts/preflight-vm123.sh` e documentar resultado
-- [ ] T003 Confirmar porta livre (default 8100) ou definir `CONSOLE_HOST_PORT` no `.env`
+- [x] T003 Confirmar porta livre (default 8100) ou definir `CONSOLE_HOST_PORT` no `.env`
-- [ ] T004 DNS `console.ligbox.com.br` → Traefik CT114
+- [x] T004 DNS `console.ligbox.com.br` → Traefik CT114 **(G1 2026-06-25)**
-- [ ] T005 Router Traefik → `http://10.10.10.123:8100` (ou bind local + proxy)
+- [x] T005 Router Traefik → `http://10.10.10.123:8100` **(G1 2026-06-25)**
 
 ---
 
@@ -52,7 +52,7 @@
 - [ ] T038 `WazuhDeepLinkButton` API
 - [ ] T039 Auth JWT → API VM122
 - [x] T040 Deploy Docker VM123 — **ligbox-ops-console-ui UP :8100**
-- [ ] T041 Traefik console.ligbox.com.br
+- [x] T041 Traefik console.ligbox.com.br **(G1 2026-06-25 — HTTPS 200 via CT114)**
 
 ---