The frontend healthcheck ran 'wget --spider', but the image is distroless: no
shell, no wget, no curl, and node itself is only reachable at an absolute path
(/nodejs/bin/node, off PATH). The probe therefore ENOENT'd on every run, the
container stayed permanently unhealthy, and Traefik -- which will not route to
an unhealthy container -- returned 404 to the customer even though the app was
serving 200 on :3000 the whole time.
Replaced with the Node-exec family using the absolute interpreter path.
Live-verified on the demo box.
Campaign 7 catalog sweep.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE
MAJOR: immich v3.0.0 drops pgvecto.rs support and requires VectorChord. Our pin
was already VectorChord, so fresh deploys are unaffected; an in-place update from
a pgvecto.rs-era install would need the upstream migration first.
Postgres sidecar moved to the vectorchord/pgvectors extension versions immich
v3.0.3 ships in its own compose (0.4.3 / 0.2.0), keeping our PG major (16)
rather than upstream's 14 to avoid a needless major change.
NOTE (recorded, not fixed): upstream v3 migrated redis -> valkey:9. Kept
redis:7-alpine here; the swap is a structural change, not a pin bump.
Campaign 7 catalog sweep.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE
MAJOR (bookstack): v26.05 needs storage/fonts writable for PDF export; revision
viewing is now a separate permission. Fresh deploys unaffected; flagged for the
future in-place update path.
MAJOR (mariadb): 11.6 -> 12.3.
Campaign 7 catalog sweep.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE
Adds the referential-coupling backup: block to every app that binds
${HDD_PATH}/${USERDATA_PATH} (immich, paperless-ngx, nextcloud, calibre-web,
audiobookshelf, komga, navidrome, radarr, sonarr, emby, jellyfin, plex, romm).
Each lists its userdata:/hdd: binds with class mandatory|optional|excluded
(operator-ruled + spike SQ2).
Requires controller v0.132.0 (deployed) which parses+validates these blocks.
INERT — no backup tier changes behavior yet (Task 3/4 consume it). All 13
verified against the shipped parser: parse-clean, every bind resolves explicit.
audiobookshelf media/audiobooks = optional (PENDING Viktor veto to excluded).
Ref: felhom.eu/documentation/audits/SPIKE-backup-classification-2026-07-14.md
bentopdf :latest -> v2.8.6; calibre-web :latest -> v4.0.6 (== running digest on
demo 9201, c31a738b - pin is a no-op); papra :latest -> 26.6.1-rootless (latest
was the rootless variant); recipe-importer :latest -> v0.9.11 (tag pre-existed,
digest-equal, no retag needed); termix :latest -> 2.5.0.
All five pins digest-identical to what :latest resolved to on 2026-07-12.
New gate scripts/check-image-pins.py (catches floating tags AND untagged refs;
red-proofed both shapes). Standing rule in CLAUDE.md + REUSE.md row.
BusyBox wget (+ node/python/curl one-shots, incl mealie's socket tuple) resolve
localhost -> IPv6 ::1 with no cross-family fallback; an IPv4-only-binding app
reads docker-unhealthy while serving (vaultwarden, re-run 2026-07-06). Escalates
that instance to the class. Scoped strictly to healthcheck test: lines
(diff-reviewed: no env/config/label changed; .felhom.yml already clean). New
REUSE.md convention row.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
Vaultwarden treats defined-but-empty SMTP_HOST/SMTP_FROM as "set"; with upstream
_enable_smtp defaulting true its validation errors out and the container
crash-loops on every fresh deploy with app-email off (the default). Gate the
SMTP group with _ENABLE_SMTP: compose default false (clean boot, mail off),
flipped "true" by the app-email injection via smtp_mapping.extra. Proven on the
pinned 1.33.2-alpine image (P1 repro exit 12 / P2 off boots / P3 on boots).
REUSE.md: strict-image TRAP row. Sweep note: the other 5 smtp-mapped templates
are campaign-boot-proven tolerant; no edits.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
calcom + nextcloud both send live via the :2526 plaintext listener (calcom signup =
Nodemailer; nextcloud password-reset = Symfony Mailer), both From <app>@felhom.eu.
calcom healthcheck: wget GET not --spider (HEAD 405s). CHANGELOG + REPORT.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
/api/health doesn't exist in cal.com v4.x (404) -> container stayed unhealthy ->
Traefik wouldn't route it. /api/auth/providers is a stable 200 once serving.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Cal.com's prisma schema declares directUrl=env(DATABASE_DIRECT_URL); without it the
startup 'prisma migrate deploy' fails (P1012) and the schema stays incomplete -> the app
500s. Set to the same direct Postgres URL. Pre-existing, never caught (bad image pin
meant calcom never deployed).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
calcom/cal.com:v4.8.7 is a git tag with no published Docker image; the manifest is
unknown. v4.6.9 is the nearest valid 4.x image (same EMAIL_SERVER_* env behavior).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The wget healthcheck always failed (exit 127, no wget in image) → container
unhealthy → Traefik refused to route it. Pre-existing, never caught because the
3.12.1 image pin didn't exist.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
New .felhom.yml field consumed by the controller's Megnyitás link. Audit of all 53 templates: only
gokapi (file-share index redirects away) and ghost (bare / is the public blog; admin at /ghost/) need it;
the rest serve/redirect usefully at root. onlyoffice is API-only (status page at /) — left at root.
Gokapi's bare root '/' redirects to RedirectUrl. It was the upstream default (github.com/Forceu/Gokapi),
so the controller's 'Megnyitás' link (always the bare subdomain root) landed on Gokapi's GitHub instead
of the app. Point it at https://${SUBDOMAIN}.${DOMAIN}/admin so the root + the controller link reach
the Gokapi login/panel.
App now auto-configures (no setup wizard), so first_steps described a flow that no longer happens.
Add default_creds 'Felhasználó: admin · jelszó a Beállítások oldalon' so the app-info page shows the
initial admin user like other apps; password stays on the Beállítások page (generated field).
Gokapi v1.9.6 has no env-var setup and otherwise exposes a public /setup (admin-takeover risk).
Entrypoint seeds config.json on first boot (admin, this app's URL, local storage, no-encryption so
it restarts without a prompt) with password/salts cleared, then runs the documented
--deployment-password one-shot to set the felhom-generated admin password before serving — claims
admin at first boot, never exposes /setup. Seed pinned to v1.9.6 (ConfigVersion 21).
Verified against Gokapi docs + the v1.9.6 binary: no env-var headless admin setup exists in any
version. Non-interactive setup requires a pre-seeded config.json + --deployment-password. Reverting
the non-functional env so the template isn't misleading; choosing a real fix path with the user.
Gokapi sat in maintenance mode since deploy because /setup was never completed and the
template provided no headless-setup env. GOKAPI_USERNAME/PASSWORD configure it on first
start; password is felhom-generated (deploy field, shown to customer). Fixes share.* maintenance page.
Surfaced during the unattended deploy sweep: a fresh gitea reported unhealthy because
the HC hit /api/v1/version (404 until install-lock); /api/healthz returns 200 while
serving. Fixed both the docker HC and the controller .felhom.yml probe; bumped
start_period to 90s for first-boot DB migration. Same class as the komga fix.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The .felhom.yml controller probe also pointed at the auth-gated /api/v1/actuator/health
(401) — that is what drives the dashboard 'Nem egészséges' state. Repoint to the
unauthenticated /actuator/health, matching the docker HC fix.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The /api/v1 prefix is auth-gated → old HC got 401 → curl -f failed → container
reported unhealthy while serving fine. Diagnosed live on guest 9201.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Intermediary-mount re-architecture: drives are visible in-guest at the stable
/mnt/felhom-drives/<name>. Composes already use ${HDD_PATH}/${USERDATA_PATH}
(injected + repointed by controller v0.67.0); this updates the UI placeholders,
templates.json defaults, and doc/script examples to the new convention.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The compose fed the +-joined PAPERLESS_OCR_LANGUAGE (e.g. hun+eng) into
PAPERLESS_OCR_LANGUAGES (the install list), so the image tried to apt-install a bogus
'tesseract-ocr-hun+eng' → hun pack missing → Django check crash-loop on the default
hun+eng. PAPERLESS_OCR_LANGUAGES must be space-separated; set a fixed superset
'eng hun deu' (verified each installs). Found live deploying paperless on guest 9201.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Address security review: reverting to root removed the user:1000 boundary, so add
security_opt no-new-privileges:true to block SUID-based escalation. Full cap_drop
is intentionally NOT applied — the images' root-init needs CHOWN/SETUID/SETGID to
set up /config and /metadata (dropping them reproduces the crash we hit at user:1000).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Live try-then-fallback: pinning user 1000:1000 crash-loops both — their named
config/metadata volumes are Docker-created root-owned and the pinned process can't
write them (komga: SQLite /config open fails; audiobookshelf: EACCES mkdir
/metadata/logs; neither has a PUID-style root-init chown). Reverted to root; they
rely on the setgid 2775 userdata dirs (files land group 1000 → FileBrowser browses/reads).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The override pointed at a v1-era node /app/extra/healthcheck.mjs that does not
exist in louislam/uptime-kuma:2, so the container was permanently unhealthy and
Traefik withheld the route → the app URL 404'd despite the app running. Point at
the correct binary (extra/healthcheck, WORKDIR /app) and use the image's timing
(180s start_period) to avoid transient unhealthy→404 on first boot.
SECRET_KEY ("Titkosítási kulcs") is a data-encrypting key — regenerating it on
restore would render stored data unreadable. data_key:true makes the controller
recover it from the guest's own app.yaml (live/PBS) and fail closed if it can't,
rather than ever regenerating. Pairs with controller v0.53.0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Model A binds the guest mount /mnt/<drive> directly onto the host's
<drive>/felhom-data namespace, so the guest mount already IS felhom-data.
The templates' ${HDD_PATH}/felhom-data/appdata/<app> therefore double-nested
to <drive>/felhom-data/felhom-data/appdata/<app> on disk, diverging from the
provenance-aware backup helpers (NamespaceRoot(drive,true) -> single-nested).
Change all four HDD app templates (romm, nextcloud, immich, paperless-ngx)
to ${HDD_PATH}/appdata/<app>, matching AppDataDir(NamespaceRoot(HDD_PATH,true)).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add 'nextcloud' to NEXTCLOUD_TRUSTED_DOMAINS so internal callbacks
from other containers (e.g. OnlyOffice Document Server) arriving with
Host: nextcloud are not rejected. Only affects initial install — for
existing deployments, the integration handler sets it via occ.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Fixes mixed content errors when OO is behind Traefik HTTPS reverse
proxy. Without this, OO Document Server generates http:// URLs for
editor resources, which browsers block on HTTPS pages.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Declares FileBrowser and Nextcloud as integration targets for the
new app-to-app integration framework in the controller.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The !include directives for automations/scripts/scenes reference files
that don't exist on fresh install, causing HA to enter recovery mode
which ignores trusted_proxies. Simplified to minimal config with just
default_config and http block - HA adds the rest during onboarding.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
HA rejects proxied requests (400 Bad Request) without trusted_proxies
in configuration.yaml. Uses entrypoint wrapper pattern (like romm) to
ensure the http config block exists before HA starts.
Handles both fresh deploys (creates full configuration.yaml) and
existing installs (appends http block if missing).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
admin