admin
94bc5febac
gates / gates (push) Successful in 1s
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
33 lines
2.4 KiB
Markdown
33 lines
2.4 KiB
Markdown
# REPORT — vaultwarden closed by default, paperless-ngx sized for a batch (2026-09-15)
|
||
|
||
Task: *before the volunteer — the big night's P1 fixes*, Part E. No image or version change.
|
||
|
||
## What changed
|
||
- **vaultwarden (R-512):** `SIGNUPS_ALLOWED` defaults to `false`; the select explains both choices; „Első lépések" is
|
||
invite-first (admin panel with the generated token → invite → create account); the compose header no longer tells
|
||
anyone to change a setting after install.
|
||
- **paperless-ngx (R-514, R-515):** `PAPERLESS_TASK_WORKERS=1`, `THREADS_PER_WORKER=1`, webserver `memory: 1280M`
|
||
(`mem_limit` hint 1664M); `default_creds: admin / admin` removed; first steps point at the generated password.
|
||
|
||
## Measured first
|
||
- **E.1 spike** (throwaway container on scratch 9202, SMTP off as on a box without app-email): stranger register **400**,
|
||
admin invite **200**, invited register **200**, second stranger **400**. So invite-first needs no controller change.
|
||
- **E.2** (1 worker × 1 thread, no cap): 20 three-page PDFs → **20/20**, `memory.peak` 783 294 464 B → cap = peak × 1.5
|
||
rounded up to 256M = **1280M**. Caveat: the PDFs carried text, so OCR on scanned images may need more.
|
||
|
||
## Proven live after the change (scratch 9202, deployed from the catalog through the controller API)
|
||
- Vaultwarden: container `SIGNUPS_ALLOWED=false`; stranger `send-verification-email` via traefik → **400 „Registration
|
||
not allowed or user already exists"**; the app page shows the invite steps (fragment 1, negative control 0).
|
||
*One invalid attempt first: a hand-built register body got 422 (did not parse) — marked invalid in the evidence.*
|
||
- Paperless: 20 PDFs posted at once → tasks **20 SUCCESS**, documents **20**, limit 1 342 177 280 B, `memory.peak`
|
||
**772 370 432 B**, OOMKilled false, 0 kernel OOM lines.
|
||
- Forcing an OOM (cap 128M) showed Docker reports nothing in an LXC guest (R-528, a controller/agent row). **Mistake,
|
||
stated:** restoring the cap on the throwaway with a broad `sed` also changed its redis cap; moot, the stack was removed.
|
||
|
||
## Teardown
|
||
Machine: scratch 9202's throwaway `paperless-ngx` and `vaultwarden` stopped and removed (volumes removed; the paperless
|
||
data folder on the scratch drive kept, the product default). Host: nothing. Hub: nothing (9202 reports to no hub).
|
||
|
||
## Gates
|
||
`catalog_gates.py --fast` OK on every push. Evidence: `felhom.eu/documentation/audits/evidence-p1fixes-2026-09-15/E1-*`, `E2-*`, `teardown-9202.txt`.
|