app-catalog-felhom.eu/REPORT.md

REPORT — vaultwarden closed by default, paperless-ngx sized for a batch (2026-09-15)

Task: before the volunteer — the big night's P1 fixes, Part E. No image or version change.

What changed

• vaultwarden (R-512): SIGNUPS_ALLOWED defaults to false; the select explains both choices; „Első lépések" is invite-first (admin panel with the generated token → invite → create account); the compose header no longer tells anyone to change a setting after install.
• paperless-ngx (R-514, R-515): PAPERLESS_TASK_WORKERS=1, THREADS_PER_WORKER=1, webserver memory: 1280M (mem_limit hint 1664M); default_creds: admin / admin removed; first steps point at the generated password.

Measured first

• E.1 spike (throwaway container on scratch 9202, SMTP off as on a box without app-email): stranger register 400, admin invite 200, invited register 200, second stranger 400. So invite-first needs no controller change.
• E.2 (1 worker × 1 thread, no cap): 20 three-page PDFs → 20/20, memory.peak 783 294 464 B → cap = peak × 1.5 rounded up to 256M = 1280M. Caveat: the PDFs carried text, so OCR on scanned images may need more.

Proven live after the change (scratch 9202, deployed from the catalog through the controller API)

• Vaultwarden: container SIGNUPS_ALLOWED=false; stranger send-verification-email via traefik → 400 „Registration not allowed or user already exists"; the app page shows the invite steps (fragment 1, negative control 0). One invalid attempt first: a hand-built register body got 422 (did not parse) — marked invalid in the evidence.
• Paperless: 20 PDFs posted at once → tasks 20 SUCCESS, documents 20, limit 1 342 177 280 B, memory.peak 772 370 432 B, OOMKilled false, 0 kernel OOM lines.
• Forcing an OOM (cap 128M) showed Docker reports nothing in an LXC guest (R-528, a controller/agent row). Mistake, stated: restoring the cap on the throwaway with a broad sed also changed its redis cap; moot, the stack was removed.

Teardown

Machine: scratch 9202's throwaway paperless-ngx and vaultwarden stopped and removed (volumes removed; the paperless data folder on the scratch drive kept, the product default). Host: nothing. Hub: nothing (9202 reports to no hub).

Gates

catalog_gates.py --fast OK on every push. Evidence: felhom.eu/documentation/audits/evidence-p1fixes-2026-09-15/E1-*, E2-*, teardown-9202.txt.