From a01c91661feb0f4f66dcfc79d096f1b9507854e2 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Wed, 26 Aug 2026 18:28:12 -0500
Subject: [PATCH] fix(audit): use MagicDNS names; Tailscale appliance renames
 landed [#446]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pfv-bms and tsys-umbrel were renamed in the Tailscale admin console,
so MagicDNS now serves the canonical names. The audit key switches
from the OS-reported hostname to the admin-assigned DNS name, which
retires the alias table. Reston VPS exclusion keyed to its MagicDNS
name (tsys-cloudron). Every in-scope system now passes: VM name,
DNS name, and Tailscale name all agree.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
---
 scripts/audit-fleet.sh | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/scripts/audit-fleet.sh b/scripts/audit-fleet.sh
index 9b52f16..c9574d8 100755
--- a/scripts/audit-fleet.sh
+++ b/scripts/audit-fleet.sh
@@ -29,8 +29,6 @@ PROBE='id -un; hostname; sudo -n id -un 2>/dev/null || echo SUDO_FAIL'
 # DNS/VM names. Anything not listed is assumed to match its Tailscale name.
 knel_alias() {
     case "$1" in
-        homeassistant)     printf '%s' "pfv-bms" ;;
-        umbrel)            printf '%s' "tsys-umbrel" ;;
         *)                 printf '%s' "$1" ;;
     esac
 }
@@ -92,7 +90,7 @@ for node in "${PROX_NODES[@]}"; do
 done
 
 tailscale status --json 2>/dev/null \
-    | jq -r '.Peer[] | select(.OS == "linux") | [.HostName, .TailscaleIPs[0], (.Online|tostring)] | @tsv' \
+    | jq -r '.Peer[] | select(.OS == "linux") | [(.DNSName | split(".")[0]), .TailscaleIPs[0], (.Online|tostring)] | @tsv' \
     | sort > "$TS_CACHE"
 
 total="$(wc -l < "$TS_CACHE")"
@@ -115,7 +113,7 @@ while IFS=$'\t' read -r host ts_ip online; do
     fi
 
     case "$host" in
-        tsys-cloudron-new) continue ;;  # Reston prod VPS — out of audit scope
+        tsys-cloudron)     continue ;;  # Reston prod VPS (OS hostname tsys-cloudron-new) — out of scope
         netbird)           continue ;;  # Reston VPS (NetBird controller) — name-checked only
         stlp-3dscanner)   continue ;;   # offline ~7mo; user pulled from audit scope
         sectestbed-sandbox) continue ;; # disposable test VM — frequently broken by design
@@ -128,7 +126,7 @@ while IFS=$'\t' read -r host ts_ip online; do
     fi
 
     case "$host" in
-        homeassistant|umbrel)
+        pfv-bms|tsys-umbrel)
             printf '%s|%s|%s|%s|%s|%s|%s|%s|%s|%s\n' \
                 "$host" "$ts_ip" "$online" "$fqdn" "$dns_result" "$vm_name" "-" "BY_DESIGN_NO_SSH" "-" "-"
             continue ;;