admin/app-catalog-felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
b7f0f7cef55869d5131634bab8565745340d7ee3
app-catalog-felhom.eu/CONTEXT.md
T
admin b7f0f7cef5
gates / gates (push) Failing after 14m4s
Details
Grocy and LubeLogger: two new apps, each with its complete record 
60 template directories, 58 offered. Records: onboarding/grocy.md and
onboarding/lubelogger.md, all 61 checks answered, none open. Evidence:
felhom.eu/documentation/audits/new-apps-2026-10-10/.

Grocy 4.7.1 from lscr.io/linuxserver/grocy (grocy publishes no image of its
own). SQLite in one volume, no HDD, ~30 MiB idle, amd64 + arm64, Hungarian UI
91.6 %. First admin class 3: it starts with its documented admin/admin and
after_install replaces that password with a generated one.

LubeLogger v1.7.3 from ghcr.io/hargata/lubelogger. LiteDB in one volume, no
HDD, ~60 MiB idle, amd64 + arm64. First admin class 1 — and it has to be: the
image ships EnableAuth=false, and with that the middleware mints a ticket with
the IsRootUser role for every visitor. Measured on a default start: a stranger
got 200 on /, on /api/vehicles and on /Home/Settings and CREATED A VEHICLE.
The compose entrypoint exports EnableAuth=true and the SHA-256 of a generated
name and password, so the app's own login is on before its first byte (at t+1 s
nothing listening, at t+2 s /api/vehicles already 401).

Two defects found by the walk and fixed before publishing:

1. An after_install command may not contain `$`. The controller runs every
   element through os.Expand and refuses one naming anything outside env:, so
   PHP cannot be inlined. On 9202 the first attempt came back
   `[pw argv dsn db i t e s n q h] not declared in env or has no value — not
   run` and the app sat behind its install hold with admin/admin in place. The
   code now lives in a file the compose entrypoint writes. Written into
   REUSE.md's after_install row as a trap.

2. Grocy's persisted config.php does not follow the image. The image copies
   config-dist.php only when that file is absent, so a volume written by 4.6.0
   and started under 4.7.1 answered HTTP 500 on every page — AUTH_CLASS names a
   class 4.7 moved — while its log said migrations done. The entrypoint now
   deletes the file at every start. The 4.6.0 -> 4.7.1 edge failed before this
   and is proven after it, on both venues.

Ladders, written by upgrade-test.py --write-ladder from both verdicts:
  grocy       4.6.0 -> 4.7.1   bench proven, box proven (guarded Update, 41 s)
  lubelogger  v1.7.2 -> v1.7.3 bench proven, box proven (25.6 s)
Checklist 6.3 came from a real failure, not a forced one: before the config.php
fix the product undid the same step in 346 s with the data intact.

REUSE.md: a fifth healthcheck family (bash /dev/tcp) for an image with no HTTP
client at all, measured in both directions.

Tool fixes made on the way: check-onboarding.py crashed on a Windows console
while printing which ids were open; upgrade-test.py's read_text/write_text used
the platform encoding and wrote a cp1250 em dash into a template full of
Hungarian.
2026-10-10 12:31:34 +02:00

5.6 KiB
Raw Blame History

CONTEXT — app-catalog-felhom.eu working state

Created with the REUSE.md rollout (2026-07-03). History: CHANGELOG.md; format spec: README.md.

  • 2026-10-10 — Grocy and LubeLogger added; Monica STOPPED at checklist 0.2 (operator decision, R-927). The operator's decision of 2026-10-10 was to add Grocy, Monica and LubeLogger, chosen from audits/pikapods-scan-2026-10-10/FINDINGS.md §2 because no catalog app covers what they do. Grocy and LubeLogger are published with complete records (onboarding/grocy.md, onboarding/lubelogger.md); Monica is not built — no release in 17 months, no stable release in 29, the stable branch dead since 2024-05-04, and an upstream notice that the hosted instance and its data go at the end of December 2026 before a rewrite. 60 template directories, 58 offered. Two conventions earned here and written into REUSE.md: an after_install command may not contain $ (the controller expands every $name and refuses one it was not given — PHP cannot be inlined, and the way out is a file the compose entrypoint writes), and a fifth healthcheck family for an image with no HTTP client at all (bash /dev/tcp, measured in both directions). Grocy also needed its persisted config.php made a derived file: the image copies it once and never again, so a 4.6 → 4.7 move answered HTTP 500 on every page.
  • 2026-10-02 (afternoon) — the persistence re-sweep: the gate now sends requests (R-801), an empty declared volume is UNDETERMINED (R-788), and it calls the app's own fixture seed. All 58: CLEAN 40 · UNDETERMINED 18 · BROKEN 0. papra 768M (R-803). Remove keeps the household's userdata — 09 §3 decision 67 (controller v0.288.0 names it).
  • 2026-10-02 — THE FAMILY GATE in the catalog (controller v0.287.0, golden 0.287.0): family_gate: / family_gate_except: / min_controller:; gate family-gate. Grimmory (exceptions OPDS/Kobo/KOReader/Komga) and MeTube (none) published with complete records. A family app's exceptions must be literal prefixes and each measured as a stranger + a look-alike; never an exception on an app with no login. Licences of all 58 templates read (felhom.eu/documentation/audits/licences-2026-10-02/TABLE.md); decisions are operator rows R-784, R-789..R-795.
  • 2026-10-01 (night, later) — the visitor's address (R-753, controller v0.286.1): traefik now keeps the tunnel's X-Forwarded-For chain; readers take it from the RIGHT. Leftmost readers carry <router>-xff (19 apps); a right-walking reader gets 172.16.0.0/12 (bookstack done; kimai, zipline, vikunja, nextcloud open — R-776). Checklist 3.10. SparkyFitness record added; its licence is non-commercial only (R-784, operator). Licence sweep of the catalog owed (R-787).
  • 2026-10-01 (night) — FIRST NEW APPS through the checklist: Radicale 195129c, Karakeep 882ac14, Dawarich 72247a3 published with complete records; Grimmory tested but held (R-775, operator); Grimoire/MeTube/Pinchflat stopped on the fit check; Invidious/moonlight-web fit only (felhom.eu/documentation/audits/new-apps-2026-10-01/FIT.md).
  • Ruling 2026-10-01 (operator) — wger HIDDEN (lifecycle: hidden) until R-762 and R-763 are fixed; the fix session un-hides it.
  • 2026-10-01 (evening) — THE NEW-APP CHECKLIST. NEW-APP-CHECKLIST.md (60 rows, since per id) + onboarding/ (_TEMPLATE.md, wger.md pilot, EXISTING-APPS-GAPS.md) + gate onboarding (check-onboarding.py, --fast, decoys). The 53 published apps exempt by name (operator default, may reverse). A new app = template + complete record in one commit. Open from the pilot: R-758..R-764 (R-762/R-763 P2 on wger).
  • 2026-09-24 (morning) — STEP DEFINITIONS (5ed599c). Every ladder entry but the newest has its own compose at templates/<app>/steps/<ladder.step_key(to)>.yml (sha256 of to, canonical JSON, 16 hex = controller stacks.StepKey); gate rule 4 + decoys; the writer keeps the superseded step; 8 backfilled (steps_backfill.py, one-off, from the NEWEST commit naming the step's images). Controller v0.268.0 reads them: one press = one step (proven live, romm two steps). R-653/R-656 fixed in the bench; the two suites that typed live pins now read them (R-663). Open: R-652, R-655, R-664 (a step has no .felhom.yml of its own).
  • 2026-09-24 (night 2026-09-23) — THE TEST RECORD. An image: move needs a proven update_ladder: entry (scripts/ladder.py; gates check-test-record.py + check-test-record-move.py; the only writer upgrade-test.py --write-ladder). 21 older moves backfilled; 12 steps published tonight. Harness v3: box fixtures on the bench (upgrade_boxport.py), anon memory (09 decision 22), files_may_change. Open: R-652, R-653, R-655 (adventurelog), R-656; the box does not read the ladder yet (09 §6.4 part 5).
  • 2026-07-12 — :latest banned from catalog — pin rule recorded. 5 templates pinned (bentopdf v2.8.6, calibre-web v4.0.6 = running digest on 9201, papra 26.6.1-rootless, recipe-importer v0.9.11, termix 2.5.0; all digest-equal to that day's :latest — no-op for running apps). Standing rule in CLAUDE.md + gate scripts/check-image-pins.py (run after any compose change). Deployed apps pin to their RUNNING digest; pin ≠ upgrade.
  • 2026-07-03 — CLAUDE.md expanded (repo purpose, push-to-main deploy contract, pointers); still intentionally light.
  • 2026-07-03 — REUSE.md exists at the repo root (catalog conventions, healthcheck families, canonical example app = paperless-ngx, traps); maintenance rule active: update it in the same commit that changes a catalog-wide convention.
Reference in New Issue View Git Blame Copy Permalink