BusyBox wget (+ node/python/curl one-shots, incl mealie's socket tuple) resolve
localhost -> IPv6 ::1 with no cross-family fallback; an IPv4-only-binding app
reads docker-unhealthy while serving (vaultwarden, re-run 2026-07-06). Escalates
that instance to the class. Scoped strictly to healthcheck test: lines
(diff-reviewed: no env/config/label changed; .felhom.yml already clean). New
REUSE.md convention row.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
Vaultwarden treats defined-but-empty SMTP_HOST/SMTP_FROM as "set"; with upstream
_enable_smtp defaulting true its validation errors out and the container
crash-loops on every fresh deploy with app-email off (the default). Gate the
SMTP group with _ENABLE_SMTP: compose default false (clean boot, mail off),
flipped "true" by the app-email injection via smtp_mapping.extra. Proven on the
pinned 1.33.2-alpine image (P1 repro exit 12 / P2 off boots / P3 on boots).
REUSE.md: strict-image TRAP row. Sweep note: the other 5 smtp-mapped templates
are campaign-boot-proven tolerant; no edits.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
calcom + nextcloud both send live via the :2526 plaintext listener (calcom signup =
Nodemailer; nextcloud password-reset = Symfony Mailer), both From <app>@felhom.eu.
calcom healthcheck: wget GET not --spider (HEAD 405s). CHANGELOG + REPORT.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
/api/health doesn't exist in cal.com v4.x (404) -> container stayed unhealthy ->
Traefik wouldn't route it. /api/auth/providers is a stable 200 once serving.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Cal.com's prisma schema declares directUrl=env(DATABASE_DIRECT_URL); without it the
startup 'prisma migrate deploy' fails (P1012) and the schema stays incomplete -> the app
500s. Set to the same direct Postgres URL. Pre-existing, never caught (bad image pin
meant calcom never deployed).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
calcom/cal.com:v4.8.7 is a git tag with no published Docker image; the manifest is
unknown. v4.6.9 is the nearest valid 4.x image (same EMAIL_SERVER_* env behavior).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The wget healthcheck always failed (exit 127, no wget in image) → container
unhealthy → Traefik refused to route it. Pre-existing, never caught because the
3.12.1 image pin didn't exist.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Live-validated on guest 9201 / controller v0.87.0: synced, deployed via the
real dashboard flow, all 3 containers healthy, /api/health UP through the public
edge. Records §1.3 image-probe findings and the deferred interactive-login item.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
New .felhom.yml field consumed by the controller's Megnyitás link. Audit of all 53 templates: only
gokapi (file-share index redirects away) and ghost (bare / is the public blog; admin at /ghost/) need it;
the rest serve/redirect usefully at root. onlyoffice is API-only (status page at /) — left at root.
Gokapi's bare root '/' redirects to RedirectUrl. It was the upstream default (github.com/Forceu/Gokapi),
so the controller's 'Megnyitás' link (always the bare subdomain root) landed on Gokapi's GitHub instead
of the app. Point it at https://${SUBDOMAIN}.${DOMAIN}/admin so the root + the controller link reach
the Gokapi login/panel.
App now auto-configures (no setup wizard), so first_steps described a flow that no longer happens.
Add default_creds 'Felhasználó: admin · jelszó a Beállítások oldalon' so the app-info page shows the
initial admin user like other apps; password stays on the Beállítások page (generated field).
Gokapi v1.9.6 has no env-var setup and otherwise exposes a public /setup (admin-takeover risk).
Entrypoint seeds config.json on first boot (admin, this app's URL, local storage, no-encryption so
it restarts without a prompt) with password/salts cleared, then runs the documented
--deployment-password one-shot to set the felhom-generated admin password before serving — claims
admin at first boot, never exposes /setup. Seed pinned to v1.9.6 (ConfigVersion 21).
Verified against Gokapi docs + the v1.9.6 binary: no env-var headless admin setup exists in any
version. Non-interactive setup requires a pre-seeded config.json + --deployment-password. Reverting
the non-functional env so the template isn't misleading; choosing a real fix path with the user.
Gokapi sat in maintenance mode since deploy because /setup was never completed and the
template provided no headless-setup env. GOKAPI_USERNAME/PASSWORD configure it on first
start; password is felhom-generated (deploy field, shown to customer). Fixes share.* maintenance page.
Surfaced during the unattended deploy sweep: a fresh gitea reported unhealthy because
the HC hit /api/v1/version (404 until install-lock); /api/healthz returns 200 while
serving. Fixed both the docker HC and the controller .felhom.yml probe; bumped
start_period to 90s for first-boot DB migration. Same class as the komga fix.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The .felhom.yml controller probe also pointed at the auth-gated /api/v1/actuator/health
(401) — that is what drives the dashboard 'Nem egészséges' state. Repoint to the
unauthenticated /actuator/health, matching the docker HC fix.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The /api/v1 prefix is auth-gated → old HC got 401 → curl -f failed → container
reported unhealthy while serving fine. Diagnosed live on guest 9201.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Intermediary-mount re-architecture: drives are visible in-guest at the stable
/mnt/felhom-drives/<name>. Composes already use ${HDD_PATH}/${USERDATA_PATH}
(injected + repointed by controller v0.67.0); this updates the UI placeholders,
templates.json defaults, and doc/script examples to the new convention.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The compose fed the +-joined PAPERLESS_OCR_LANGUAGE (e.g. hun+eng) into
PAPERLESS_OCR_LANGUAGES (the install list), so the image tried to apt-install a bogus
'tesseract-ocr-hun+eng' → hun pack missing → Django check crash-loop on the default
hun+eng. PAPERLESS_OCR_LANGUAGES must be space-separated; set a fixed superset
'eng hun deu' (verified each installs). Found live deploying paperless on guest 9201.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Address security review: reverting to root removed the user:1000 boundary, so add
security_opt no-new-privileges:true to block SUID-based escalation. Full cap_drop
is intentionally NOT applied — the images' root-init needs CHOWN/SETUID/SETGID to
set up /config and /metadata (dropping them reproduces the crash we hit at user:1000).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Live try-then-fallback: pinning user 1000:1000 crash-loops both — their named
config/metadata volumes are Docker-created root-owned and the pinned process can't
write them (komga: SQLite /config open fails; audiobookshelf: EACCES mkdir
/metadata/logs; neither has a PUID-style root-init chown). Reverted to root; they
rely on the setgid 2775 userdata dirs (files land group 1000 → FileBrowser browses/reads).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
admin