From c3020ee3a8d317fb9ac45d3a1d4f4fc84663e027 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sun, 28 Jun 2026 09:03:23 +0200 Subject: [PATCH] REPORT: v0.43.0 BUNDLE slice (canonical unit + Gitea publish + live install) Co-Authored-By: Claude Opus 4.8 (1M context) --- REPORT.md | 91 ++++++++++++++++++++++++++++--------------------------- 1 file changed, 47 insertions(+), 44 deletions(-) diff --git a/REPORT.md b/REPORT.md index 0baa675..2521e00 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,52 +1,55 @@ -# REPORT — build-golden.sh default fix + golden rebuild at current (2026-06-27) +# REPORT — felhom-agent v0.43.0 (BUNDLE slice: canonical unit + Gitea publish) -**Task class:** Risky/supervised, Part A only. **No agent binary change** — version stays **v0.42.0**. +**Date:** 2026-06-28 · **Baseline:** v0.42.0 @ `aaa276a` → **v0.43.0** @ `a8d14fc` -## What changed +## What shipped -`configs/build-golden.sh` — the `CONTROLLER_IMAGE` default (positional arg 6) was a stale -`gitea.dooplex.hu/admin/felhom-controller:0.43.0`. An argument-less build therefore baked a wildly old -controller, so fresh Day-0 boxes booted old (the demo started at 0.77). Bumped the default to the -**current** `…/felhom-controller:0.85.1`, with a comment that the version should still be passed -explicitly at each rebuild (a `make golden` that resolves the latest tag is a future Observation). +Day-0 no longer needs a hand-installed agent. The binary is **published to Gitea** and the +host-bootstrap script fetches → verifies (sha256 vs the hub-vouched manifest) → installs it. This +commit adds the **canonical systemd unit** and the publish tooling; the binary is a version-only +rebuild (no behavioural change). + +- **`configs/felhom-agent.service`** (NEW, canonical) — `User=felhom-agent` (the documented non-root + production model; `privileged.mode: "sudo"` + the sudoers allowlist), + `ExecStart=/usr/local/bin/felhom-agent --config /etc/felhom-agent/agent.json`, + `Restart=on-failure`, `StateDirectory=felhom-agent`. **No `NoNewPrivileges`** (would block the + `sudo` the agent needs) and **no mount-namespacing hardening** (would put the agent in a private + mount namespace, breaking `mount --make-shared`/`--bind` drive propagation into guests) — both + documented inline. +- **`scripts/publish-agent.sh`** (NEW) — build (optional) + PUT binary to + `/api/packages/admin/generic/felhom-agent//felhom-agent`, print `AGENT_VERSION`/`AGENT_SHA256`, + GET round-trip re-verify. Pinned version, idempotent (delete-then-PUT), asserts `--version` matches. +- **`configs/build-golden.sh`** — after vzdump, compute sha256 + PUT + `/api/packages/admin/generic/felhom-golden//golden.tar.zst`, print + `GOLDEN_VERSION`/`GOLDEN_SHA256`. Opt-in; local auto-discovery stays a fallback. +- **`configs/felhom-agent.sudoers`** (latent bug fix) — escaped the commas in the `lvs -o …` and + `lsblk -o …` argument lists. Bare commas are command separators in sudoers, so `visudo -cf` + **rejected** the file; it had never been visudo-validated live because the demo ran the agent + root+`direct` (sudoers unused). Surfaced by the live install's `visudo -cf` gate. +- **`cmd/felhom-agent/main.go`** — `version` 0.42.0 → 0.43.0. +- **README** — "Process model" section made canonical (non-root + publish/install). ## Green gate +`go build ./... && go vet ./... && go test ./...` — all green. `scripts/publish-agent.sh` + +`configs/build-golden.sh`: `bash -n` + `shellcheck -S warning` clean (the one SC2034 in build-golden.sh +is a pre-existing DHCP-wait loop counter, not this change). -- `bash -n configs/build-golden.sh` → OK. - -## Golden rebuild (live on felhom-pve) - -Ran the rebuild with the controller image passed **explicitly**: - -``` -build-golden.sh 9100 local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst \ - local-lvm local vmbr0 gitea.dooplex.hu/admin/felhom-controller:0.85.1 -``` -(`REGISTRY_USER`/`REGISTRY_TOKEN` sourced out-of-band from `/root/.golden-secrets.env`.) - -- **New golden archive volid:** `local:backup/vzdump-lxc-9100-2026_06_27-11_42_51.tar.zst` - (rootfs 32G + Docker-data 16G + user-data 8G; archive size ~574 MB; the vzdump log confirmed - *including mount point mp0 (/var/lib/docker)* and *mp1 (/mnt/sys_drive)* — neither excluded). - -### Baked-image verify (cheap, mandatory) — PASS - -In the build guest (started briefly, then stopped again): - -``` -/etc/felhom-controller-image → gitea.dooplex.hu/admin/felhom-controller:0.85.1 -docker images (felhom-controller) → gitea.dooplex.hu/admin/felhom-controller:0.85.1 379MB -``` - -New Day-0 provisions now ship **current** (the host-bootstrap script auto-discovers the newest golden, -so it picks up this rebuild with no further change). - -### Full verify (throwaway provision) — not performed - -Operator-gated/recommended only. The cheap verify already proves the archive carries 0.85.1; the real -demo 9201 was deliberately **not** re-provisioned (it is the Phase-2 floor test box). The build guest -9100 is left stopped (destroy with `pct destroy 9100 --purge` when no longer needed). +## Live (felhom-pve, demo-felhom) — proven +- Built + published **agent 0.43.0** via `publish-agent.sh` → sha256 `8b989917…`; GET round-trip OK. +- Published the existing **golden 0.85.1** (575 MiB) to Gitea → sha256 `f87031cc…`. +- **From-scratch install** (after moving the live root+direct agent fully aside): the script fetched + the binary from Gitea, **verified sha256 vs the hub manifest**, installed the non-root `felhom-agent` + user + binary + sudoers (`visudo -cf`-validated) + the canonical unit + config (0600 `felhom-agent`); + the service came up **active as non-root felhom-agent**, `--selftest=hub` landed a host-report, and + guest **9201 stayed managed** (present in the host-report). `sudo -n` confirmed live for + mkdir/smartctl/lvs (the escaped-comma sudoers works). +- **sha256 negative:** a deliberately-corrupted published binary made the install **abort** + ("Refusing to install (verify-before-use)", exit 1); the good binary was restored (sha re-verified). ## Observations - -- A `make golden` (or a `--latest` flag) that resolves the newest pullable controller tag at build time - would make the hand-bumped default unnecessary and prevent this class of drift entirely. +- **Non-root + PBS:** the `felhom-agent` user cannot read `/etc/pve/priv/storage/*.pw` (root-only on + pmxcfs), so PBS datastores are skipped with a WARN (graceful; PBS cadence is 0 on the demo). A + production host using PBS needs the agent granted read access to that key (group/ACL on pmxcfs, or a + sudoers entry) — follow-up, out of this slice. +- **`sudo` package** must be present for the non-root model; the host-install script now + `apt-get install`s it (a root+`direct` host won't have it).