# AGENTS.md — Cold Start

> Project: `Mikrotik/`
> Sesi: [docs/ai-session-summary.md](./docs/ai-session-summary.md)
> Peta: [docs/context-index.md](./docs/context-index.md)
> Env: [.env.example](./.env.example)

## Apa ini?

Gateway perimeter GeoNet — MikroTik CCR2004 (`10.100.1.1`), NAT publik, dual-WAN hybrid failover, VPN, split-DNS. SSOT config backup & arsitektur.

## Aturan kritis

- SSH: **port 255**, `-m hmac-sha1`, key `~/.ssh/id_rsa_mikrotik` (lihat `server-connection/scripts/ssh-mikrotik.ps1`)
- **Jangan** commit password / `export show-sensitive` — redaksi `nasFtpPass` di backup `.rsc`
- Ubah routing/NAT hanya setelah backup + catat di `docs/version.md`
- DNS publik domain (SPF/DKIM) **bukan** di MikroTik — di registrar
- No commit kecuali user minta
- SSH oleh agent wajib persetujuan user

## Lanjut kerja

```
1. AGENTS.md → docs/ai-session-summary.md → STOP
2. docs/architecture/system-overview.md, docs/server.md, backups/
```

## Pointer

| Butuh | Buka |
|-------|------|
| Arsitektur | [docs/architecture/system-overview.md](./docs/architecture/system-overview.md) |
| NAT mail `.28` | [docs/notes/nat-mail-gisportal.md](./docs/notes/nat-mail-gisportal.md) |
| Restore | [backups/README.md](./backups/README.md) |
| Script deploy | `server-connection/scripts/apply-failover-mikrotik.ps1` |
| Legacy audit | `server-connection/server/mikrotik-audit.txt` |