# REPORT — vaultwarden closed by default, paperless-ngx sized for a batch (2026-09-15)

Task: *before the volunteer — the big night's P1 fixes*, Part E. No image or version change.

## What changed
- **vaultwarden (R-512):** `SIGNUPS_ALLOWED` defaults to `false`; the select explains both choices; „Első lépések" is
  invite-first (admin panel with the generated token → invite → create account); the compose header no longer tells
  anyone to change a setting after install.
- **paperless-ngx (R-514, R-515):** `PAPERLESS_TASK_WORKERS=1`, `THREADS_PER_WORKER=1`, webserver `memory: 1280M`
  (`mem_limit` hint 1664M); `default_creds: admin / admin` removed; first steps point at the generated password.

## Measured first
- **E.1 spike** (throwaway container on scratch 9202, SMTP off as on a box without app-email): stranger register **400**,
  admin invite **200**, invited register **200**, second stranger **400**. So invite-first needs no controller change.
- **E.2** (1 worker × 1 thread, no cap): 20 three-page PDFs → **20/20**, `memory.peak` 783 294 464 B → cap = peak × 1.5
  rounded up to 256M = **1280M**. Caveat: the PDFs carried text, so OCR on scanned images may need more.

## Proven live after the change (scratch 9202, deployed from the catalog through the controller API)
- Vaultwarden: container `SIGNUPS_ALLOWED=false`; stranger `send-verification-email` via traefik → **400 „Registration
  not allowed or user already exists"**; the app page shows the invite steps (fragment 1, negative control 0).
  *One invalid attempt first: a hand-built register body got 422 (did not parse) — marked invalid in the evidence.*
- Paperless: 20 PDFs posted at once → tasks **20 SUCCESS**, documents **20**, limit 1 342 177 280 B, `memory.peak`
  **772 370 432 B**, OOMKilled false, 0 kernel OOM lines.
- Forcing an OOM (cap 128M) showed Docker reports nothing in an LXC guest (R-528, a controller/agent row). **Mistake,
  stated:** restoring the cap on the throwaway with a broad `sed` also changed its redis cap; moot, the stack was removed.

## Teardown
Machine: scratch 9202's throwaway `paperless-ngx` and `vaultwarden` stopped and removed (volumes removed; the paperless
data folder on the scratch drive kept, the product default). Host: nothing. Hub: nothing (9202 reports to no hub).

## Gates
`catalog_gates.py --fast` OK on every push. Evidence: `felhom.eu/documentation/audits/evidence-p1fixes-2026-09-15/E1-*`, `E2-*`, `teardown-9202.txt`.