admin
b7f0f7cef5
60 template directories, 58 offered. Records: onboarding/grocy.md and onboarding/lubelogger.md, all 61 checks answered, none open. Evidence: felhom.eu/documentation/audits/new-apps-2026-10-10/. Grocy 4.7.1 from lscr.io/linuxserver/grocy (grocy publishes no image of its own). SQLite in one volume, no HDD, ~30 MiB idle, amd64 + arm64, Hungarian UI 91.6 %. First admin class 3: it starts with its documented admin/admin and after_install replaces that password with a generated one. LubeLogger v1.7.3 from ghcr.io/hargata/lubelogger. LiteDB in one volume, no HDD, ~60 MiB idle, amd64 + arm64. First admin class 1 — and it has to be: the image ships EnableAuth=false, and with that the middleware mints a ticket with the IsRootUser role for every visitor. Measured on a default start: a stranger got 200 on /, on /api/vehicles and on /Home/Settings and CREATED A VEHICLE. The compose entrypoint exports EnableAuth=true and the SHA-256 of a generated name and password, so the app's own login is on before its first byte (at t+1 s nothing listening, at t+2 s /api/vehicles already 401). Two defects found by the walk and fixed before publishing: 1. An after_install command may not contain `$`. The controller runs every element through os.Expand and refuses one naming anything outside env:, so PHP cannot be inlined. On 9202 the first attempt came back `[pw argv dsn db i t e s n q h] not declared in env or has no value — not run` and the app sat behind its install hold with admin/admin in place. The code now lives in a file the compose entrypoint writes. Written into REUSE.md's after_install row as a trap. 2. Grocy's persisted config.php does not follow the image. The image copies config-dist.php only when that file is absent, so a volume written by 4.6.0 and started under 4.7.1 answered HTTP 500 on every page — AUTH_CLASS names a class 4.7 moved — while its log said migrations done. The entrypoint now deletes the file at every start. The 4.6.0 -> 4.7.1 edge failed before this and is proven after it, on both venues. Ladders, written by upgrade-test.py --write-ladder from both verdicts: grocy 4.6.0 -> 4.7.1 bench proven, box proven (guarded Update, 41 s) lubelogger v1.7.2 -> v1.7.3 bench proven, box proven (25.6 s) Checklist 6.3 came from a real failure, not a forced one: before the config.php fix the product undid the same step in 346 s with the data intact. REUSE.md: a fifth healthcheck family (bash /dev/tcp) for an image with no HTTP client at all, measured in both directions. Tool fixes made on the way: check-onboarding.py crashed on a Windows console while printing which ids were open; upgrade-test.py's read_text/write_text used the platform encoding and wrote a cp1250 em dash into a template full of Hungarian.
16 KiB
Onboarding record — grocy
app: grocy
opened: 2026-10-10
template_at: b38aa92317
0.1 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/FIT.md — MIT. GitHub's licence endpoint answers spdx_id: MIT for grocy/grocy and the file is LICENSE.md; we pull linuxserver.io's image and redistribute nothing.
0.2 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/FIT.md — v4.7.1 on 2026-09-04; three releases in 2026, 83 since 2017, issues answered, not archived.
0.3 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt ; felhom.eu/documentation/audits/new-apps-2026-10-10/FIT.md — lscr.io/linuxserver/grocy:4.7.1, amd64 and arm64, read from the manifest. There is NO image published by grocy itself: grocy/grocy on Docker Hub is 404 and grocy's own README answers "How to run using Docker" with one link, to linuxserver.io.
0.4 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt — a repo-wide grep at v4.7.1 finds two outbound hosts in the whole codebase: world.openfoodfacts.org for the barcode lookup the household asks for, and releases.grocy.info for demo pictures when MODE is not production. No update check, no analytics, nothing at start. Switch: GROCY_STOCK_BARCODE_LOOKUP_PLUGIN empty.
0.5 | n/a | it needs no internet at runtime at all; the first start downloads nothing and no feature requires a remote service
0.6 | n/a | the image exposes HTTP only and grocy speaks nothing else, so the tunnel costs the household nothing
0.7 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/checks.txt — grocy has no native app; it is an installable web app. Third-party phone apps use its REST API with the GROCY-API-KEY header. Measured on 9202 through traefik: no credentials 401, a wrong key 401, and a key minted through grocy's own page answered 200 on /api/system/info and on /api/stock.
0.8 | done | app-catalog-felhom.eu/templates/grocy/.felhom.yml — the Hungarian description and app_info.tagline say what a household gets.
0.9 | n/a | grocy never calls itself server-side and the bench ran it with no environment override at all
1.1 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/gates.txt — catalog_gates.py grocy green, image-pins and image-resolvable included.
1.2 | n/a | grocy has no database service: SQLite inside its own volume is what upstream packaging runs
1.3 | n/a | no MariaDB and no PostgreSQL sidecar exists in this template
1.4 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/evidence/MV-grocy/verdict.json ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/box-verdict-grocy-FAILED-prefix.json — the step INTO the pin, measured: the previous upstream release 4.6.0 installed and seeded, then moved to 4.7.1, migration observed, seed read back, healthy after. The first run of this edge FAILED and is kept: grocy's persisted config.php did not follow the image.
1.5 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/checks.txt — nginx master and php-fpm 8.5 master, workers as abc. PID 1 is s6-svscan, the image's supervisor, which is what the box probe reads.
1.6 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/checks.txt — grocy's own settings file names no key, secret, token or PEM at all; the only credential it has is the admin password the box generates, and every login route was then exercised.
1.7 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt — the image's s6 oneshots listed and init-grocy-config read in full. It has one start-time decision: it copies config-dist.php to /config/data/config.php only if that file is absent. That line is the 4.6 to 4.7 break, and the template's entrypoint answers it.
1.8 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/checks.txt — MODE production and DISABLE_AUTH false as the running app reads them; an unknown page 404 with zero stack-trace markers, through traefik too.
1.9 | n/a | no secret here encrypts stored data or signs a long-lived token; the admin password is a login grocy hashes
2.1 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/volume-persistence.txt — the runtime gate deployed grocy, exercised it and compared where the data landed against what the compose mounts.
2.2 | done | app-catalog-felhom.eu/templates/grocy/docker-compose.yml ; felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt — one named volume on NVMe holds the database, the settings and the pictures the household uploads. No HDD and no userdata path, deliberately: a fresh install is under a megabyte and there is no bulk data to browse.
2.3 | n/a | the template declares no HDD path, so there is no per-path backup class to set
2.4 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt — PUID and PGID 1000; everything under /config belongs to abc and php-fpm's workers run as abc, which is why after_install runs as abc too.
2.5 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/restore.txt — on 9202: the per-app backup the guarded Update took, then remove keeping the backups, then the household's own restore button, then the seed read back through grocy's own API with its three controls.
2.6 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/remove.txt — remove with data measured three times: 200, the named volume gone, the backup paths removed. What is left in the stack directory afterwards is the template pair the syncer keeps for all templates, not deployed state.
2.7 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/offsite-size.txt — the whole app is under a megabyte on a seeded install; grocy never decides how big an off-site snapshot is.
2.8 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/checks.txt — through traefik over https, as the household: PUT a file through grocy's own file API 204, GET it back 200 with the content matching, and the same GET with no credentials 401.
3.1 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/install.txt — class 3, measured: a fresh install's users table holds exactly one row, admin, and admin/admin signs in. No first-run screen; an unauthenticated page is 302 to /login and /api is 401.
3.2 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/checks.txt ; felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt — on 9202 through traefik: the documented default refused, the box's generated password signs in, a wrong password refused. Proven on the bench against both 4.7.1 and 4.6.0 first.
3.3 | n/a | grocy has no open first-run screen to gate; its first admin already exists with a password, which is 3.2's case
3.4 | n/a | grocy has no registration route at all and only a signed-in admin can add a user, measured on 9202
3.5 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/defaultpoll.txt ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/poll.txt — the documented default login POSTed once a second as a stranger from before the install press: 65 attempts, 0 signed in. 404 while nothing answered, then 401 behind the install hold, then invalid once the hold opened, which it only does after after_install has replaced the password.
3.6 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/checks.txt — 25 wrong passwords for the public name through traefik, then the household's right one: in at once, and the first member's session still live. No lock-out and no throttle, which is why the name is not generated here.
3.7 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/checks.txt — the household added a family member through grocy's own POST /api/users and that member signed in. app_info.add_people says where the page is, in both languages.
3.8 | done | app-catalog-felhom.eu/templates/grocy/.felhom.yml — the password is its own argument to the helper script; no value is pasted into program text.
3.9 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/checks.txt — the browser form with its https Origin and Referer signs in through traefik; the API route a phone app uses refuses without a key and with a wrong key, and answers a key minted through grocy's own page.
3.10 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/checks.txt — a repo-wide grep at v4.7.1 for REMOTE_ADDR, HTTP_X_FORWARDED_FOR and getClientIp finds nothing, and a failed sign-in carrying a forged leftmost X-Forwarded-For through traefik left that address nowhere in the app's log. Nothing is decided on it, so no router reset is needed.
4.1 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt — the image carries BusyBox wget and no curl, so the probe is the wget family, dialling 127.0.0.1 and /login which answers 200. Measured both ways: rc 0 against the app, rc 1 against a dead port.
4.2 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/gates.txt — gate probe-matches-compose green: the controller probe is api on port 80 at /login, which is what the compose healthcheck dials.
4.3 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/install.txt — on a cold first install on 9202: deployed in 30 s, every container healthy 36 s after the press, RestartCount 0.
4.4 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/checks.txt — the negative control: docker stop, and the controller read stopped within 5 s with the front door 404; docker start and it was running again 10 s later.
4.5 | done | app-catalog-felhom.eu/templates/grocy/docker-compose.yml — container_name grocy is exactly the stack name, and there are no sidecars to be mistaken for it.
5.1 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/mem-grocy.csv ; felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/evidence/MV-grocy/verdict.json ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/remove.txt — on the bench with swap 0, sampled from the container's birth every 2 s: peak anon 27.2 MiB, 6.7 per cent of the 384 M limit, peak swap 0, oom_kill 0, restarts 0. On the box the same app peaked at 45.7 and 86.6 MiB across two installs, 0 swap, 0 kills.
5.2 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/evidence/MV-grocy/verdict.json — the 10-minute soak after the readback: 605 s, 10343 requests all answered, peak anon 6.7 per cent of the limit, cgroup peak including the page cache 25.4 per cent, 0 oom_kills, 0 restarts.
5.3 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/gates.txt — gate mem-limit-sum green: one service at 384M and mem_limit 384M, and the compose header says the same.
5.4 | n/a | grocy is PHP behind nginx, not a Node or Java runtime that sizes a heap from the limit
5.5 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt — amd64 and arm64, so pi_compatible true; the image is about 275 MB to pull.
6.1 | done | app-catalog-felhom.eu/scripts/upgrade_fixtures_box.py ; felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/evidence/MV-grocy/verdict.json — the Grocy fixture seeds and reads back through grocy's own routes: its login, a product, and the stock route, then the stock read back for the name and the amount. It proves itself on every verify: no cookie must be 401, a session from a wrong password must be 401, and a product id that cannot exist must be 404, or the readback is declared unusable.
6.2 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/evidence/MV-grocy/verdict.json ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/box-verdict-grocy.json ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/step.txt — bench proven and box proven, the box through the product's own guarded Update in 41 s. Written into the template by upgrade-test.py --write-ladder, never by hand.
6.3 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/box-verdict-grocy-FAILED-prefix.json ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/step.txt — the undo was measured on a REAL failure, not a forced one: before the config.php fix the same step went backing-up, pulling, copying, verifying, undoing, undone in 346 s, the app came back on 4.6.0 and the seed read back with all three controls. The bench's own bare abort, which takes no backup, loses the data; only the product's backup-first undo returns it.
6.4 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/evidence/MV-grocy/verdict.json — files_changed is empty: grocy rewrites no file at start, so there is no files_may_change mark to carry.
6.5 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/FIT.md ; felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/partA-probes.txt — linuxserver.io rebuilds weekly and re-pushes the plain version tag: 4.7.1 changed from ls342 to ls343 with the same grocy inside. The catalog pins the plain tag as its four other linuxserver apps do, and retest-floating.py is the monthly instrument for that class. The tag shape itself is stable.
7.1 | n/a | grocy sends no mail at all; its own settings file names no SMTP, sendmail or mail function
8.1 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/gates.txt — gate copy-i18n green with grocy in the freeze: 20 Hungarian strings, 20 with English, informal te, no keruk.
8.2 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/checks.txt ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/install.txt — every claim on the app page was followed on 9202: the tagline, the use cases, the first steps, default_creds which the page hides once after_install has replaced it, and add_people, since a family member really can be added that way and signs in.
8.3 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/bench/grocy/shots — grocy's own icon with its single fill made white like the other logos, and three screenshots of the app's own Hungarian UI taken on the bench from this template; installed as felhom.eu/website/assets/grocy-logo.svg and grocy-screenshot-1..3.webp.
8.4 | done | app-catalog-felhom.eu/README.md ; app-catalog-felhom.eu/FIRST-ADMIN.md ; app-catalog-felhom.eu/templates/grocy/.felhom.yml — both README tables, the FIRST-ADMIN row, category home and catalog_since 2026-10-10.
8.5 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/site-count.txt — the count moved in every place the website states it, both language sets, with a control that no old count is left.
9.1 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/gates.txt — catalog_gates.py grocy exit 0, every gate in the table.
9.2 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/install.txt ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/checks.txt ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/step.txt ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/restore.txt ; felhom.eu/documentation/audits/new-apps-2026-10-10/box/grocy/remove.txt — a fresh install on 9202 from the drill catalog, walked as the household and as a stranger, start to finish, twice: the second time after the after_install defect was fixed.
9.3 | done | felhom.eu/documentation/audits/new-apps-2026-10-10/README.md — this record; the two defects found are in the register and in the catalog CHANGELOG.
9.4 | done | app-catalog-felhom.eu/templates/grocy ; app-catalog-felhom.eu/onboarding/grocy.md — published to the live catalog in one commit.