Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When gateway file contains multiple IPs, generate multipath routes
with nexthop per gateway (weight 1 each). Kernel distributes traffic
per-flow across gateways.

Single gateway:  route replace IP via GW table T
Multiple:        route replace IP table T nexthop via GW1 weight 1 nexthop via GW2 weight 1
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Directory name is now a logical group name (egw, ogw) with gateway
and table specified in files, same as routes6.d/. Unify process_v4
and process_v6 into a single process_routes function.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Drop iif interface restriction so policy routes apply to both
forwarded and locally-generated traffic. Suppress harmless
"FIB table does not exist" errors on first flush.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Split .list files into pure-IP (antifilter) and domain lists.
Pure IP files go through cat directly, avoiding slow per-line
bash processing of 155k entries through cat_expanded and is_ipv4.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

154k lines of ipresolve.lst made while-read loop extremely slow.
Use grep to instantly separate IPs from domains.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace ipset+mangle approach with pure ip route tables.
Configuration via routes.d/ (IPv4) and routes6.d/ (IPv6) directories
where each subdirectory = gateway and .list symlinks = domain/IP lists.

Features:
- Hash-based change detection (skip if lists unchanged)
- Double check: file hash + resolved IPs diff
- Batch route loading via ip -batch
- Automatic cleanup of orphaned state
- --show/--force/--add/--del/--flush options

Also adds is_ipv6() and get_ipv6_list_bulk() to functions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add echo before each append (>>) to ensure trailing newline,
preventing IP corruption when files are concatenated.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add get_ipv4_list_bulk() to functions that resolves all domains at once
via adnshost instead of sequential dig calls. Falls back to dig for
domains with deep CNAME chains. DNS resolution: ~134s -> ~6s.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Automatically add HTTP/<FQDN> SPN to machine account and update
keytab when joining domain or refreshing keytab. This allows web
services to use system keytab /etc/krb5.keytab instead of separate
service account keytabs.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Remove --use-kerberos=required from leave (doesn't work with broken machine account)
- Replace --use-kerberos=required with -U $ADMIN for join (more reliable)
- Add comment explaining why --use-kerberos=required doesn't work
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Use dnshostname=$(hostname -f) to register correct dNSHostName
  (e.g. host.office.etersoft.ru instead of host.etersoft.ru)
- Replace deprecated -k with --use-kerberos=required
- Add idempotency: check testjoin status before joining
- If already joined, verify keytab has correct FQDN
- If machine account is broken, leave and rejoin

Note: requires msDS-AllowedDNSSuffixes on DC to include the DNS subdomain
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Add comprehensive system administration instructions:
- Debugging principles
- Email sending via mail command
- Remote access tools (xpra, xfreerdp)
- Package management with epm
- Service management with serv
- VPN servers and access creation
- NFS group management with samba-tool
- Miscellaneous notes (Saby, gpush, etc)

- Split report into "Изменения" and "Проверка распространения" sections
- Show before→after values for each changed subdomain
- Add separate propagation check for each subdomain
- Remove generic A/AAAA format in favor of explicit subdomain listing

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

- Add comprehensive eterban section with commands and usage
- Document access to priv.etersoft.ru (ssh -p 32 without root@)
- Add eterban log locations and settings
- Make DNS verification mandatory after changes
- Add Cloudflare DNS to verification checklist
- Improve DNS report format template

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

- Server access (ssh dhash, ssh ipfs@dhash)
- Remote API access: ipfs --api=/ip4/91.232.225.49/tcp/5001
- Diagnostic commands
- Known issues: FD exhaustion, daily restart timer

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- check_upgrade_desktop.yml: replaced by upgrade_desktop.yml
- forZabbix/: no longer used
- gluster_update_from_task.retry: temp file

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Document how to connect to Proxmox VMs via SPICE from CLI:
- pvesh API for obtaining credentials
- Correct .vv file format (proxy must use short hostname!)
- Script for Claude Code automation
- DISPLAY detection for remote GUI launch

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Add warning() function for non-fatal errors
- Skip missing filters with warning instead of exit
- Better visual separation between test runs
- Change fatal to warning for partial regex matches

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Replace etertimemachine with custom crdate function that:
- Creates daily snapshots with hardlinks
- Copies base/ directories separately (not hardlinked)
- Maintains 'last' symlink atomically

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

upgrade_desktop.yml: use epm full-upgrade instead of manual steps
upgrade_telegram.yml: use epm play telegram

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Chrome deprecated AuthServerWhitelist/AuthNegotiateDelegateWhitelist
in favor of AuthServerAllowlist/AuthNegotiateDelegateAllowlist.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- DNS: ns1.etersoft.ru structure, zone files, nameservers
- NFS: servers, 16 groups workaround, FS-Cache setup
- Fail2ban: eterban integration with priv.etersoft.ru
- Proxmox: VM management, SPICE connection hints
- SSH: ALT Linux sshd_config path, StreamLocalBindUnlink
- Various admin workflow notes

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>