HYBRID FASE 2 — CHECKLIST APPLY AMAN
====================================
Tanggal        : 2026-06-13
Prasyarat      : Failover Fase 1 aktif (mikrotik-failover-phase1-backup.txt)
Restore gagal  : scripts/restore-failover-phase1-mikrotik.ps1

IP laptop admin (mgmt bypass): 192.168.0.33
SSH saat apply               : admin@192.168.0.1 port 255  (BUKAN 10.100.1.1)


SEBELUM APPLY FASE 2 PENUH
--------------------------

  [ ] Jalankan PREP terlebih dahulu (sekali saja):
        .\scripts\apply-hybrid-prep-mikrotik.ps1
        Verifikasi: hybrid mgmt bypass laptop + office-to-server-bypass

  [ ] Failover Fase 1 terverifikasi:
        /ip route print where comment~"failover"
        sfp-sfpplus1 RUNNING, DHCP bound

  [ ] Laptop di jaringan office (Ethernet 192.168.0.x)

  [ ] Buka 2 sesi SSH cadangan:
        ssh -i ~/.ssh/id_rsa_mikrotik -o IdentitiesOnly=yes -m hmac-sha1 -p 255 admin@192.168.0.1

  [ ] Aktifkan Safe Mode di Winbox atau terminal (disarankan)

  [ ] Siapkan perintah restore di clipboard:
        .\scripts\restore-failover-phase1-mikrotik.ps1

  [ ] Jika IP laptop berubah, edit baris ini di mikrotik-hybrid.rsc:
        hybrid mgmt bypass laptop → src-address=<IP-baru>


APPLY
-----

  .\scripts\apply-hybrid-mikrotik.ps1

  Default SSH ke 192.168.0.1 — koneksi tidak lewat PCC server segment.


SETELAH APPLY — VERIFIKASI
--------------------------

  [ ] Rule ada: hybrid mgmt bypass laptop (src 192.168.0.33)
  [ ] PCC hybrid enabled (mode BOTH-UP jika kedua GW hidup)
  [ ] Netwatch hybrid monitor ISP1 + ISP2 status=up
  [ ] Dari laptop: ping 8.8.8.8, ping 10.100.1.24
  [ ] Dari laptop: https://console.gisportal.id (opsional)
  [ ] /log print where message~"HYBRID" → mode BOTH-UP


JIKA GAGAL / SSH PUTUS
----------------------

  1. Sesi SSH cadangan ke 192.168.0.1
  2. .\scripts\restore-failover-phase1-mikrotik.ps1 -HostAddr 192.168.0.1
  3. Verifikasi Failover Fase 1 (mikrotik-failover-phase1-backup.txt)


PROTEKSI MANAGEMENT
-------------------

Rule mangle (paling atas):
  hybrid mgmt bypass laptop
  src-address=192.168.0.33 action=accept

Tidak pernah di-disable oleh script hybrid-set-mode-*.
Laptop admin tidak kena PCC → SSH & akses server stabil saat apply.


FILE TERKAIT
------------

  server/mikrotik-hybrid-prep.rsc
  scripts/apply-hybrid-prep-mikrotik.ps1
  server/mikrotik-hybrid.rsc
  server/mikrotik-hybrid-apply-checklist.txt  (dokumen ini)
  server/mikrotik-hybrid-design.txt
  server/mikrotik-failover-phase1-backup.txt
  scripts/apply-hybrid-mikrotik.ps1
  scripts/restore-failover-phase1-mikrotik.ps1