20 lines
1.8 KiB
Markdown
20 lines
1.8 KiB
Markdown
# REPORT — night 2026-10-22: one change on `main`, one ready patch, nothing released
|
|
|
|
**What:** the night brief's agent parts. No agent release, no vouch (both forbidden tonight). Design read:
|
|
`03-host-agent.md` (the WireGuard tunnel, the config bundle), `06-offsite-connectivity.md`.
|
|
|
|
- **R-1204, `a0c88e5` (on `main`, unreleased).** The heartbeat's `wireguard` block gains `handshake_future_s` when the
|
|
last handshake lies more than 60 s in the future (`wgtunnel.handshakeFuture`) — the clock-ahead lock-out that the
|
|
clamped `last_handshake_age_s` hid. Red-proved (`TestR1204_AFutureHandshakeIsReported`). The hub's alarm on it is
|
|
hub 0.166.0 (felhom.eu, built, not deployed).
|
|
- **R-982 / D4 (operator 15:47: root SSH from the LAN by key only) — a ready patch, NOT on main (`7651461` moved it
|
|
out).** A bundle drop-in `/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf` (`PermitRootLogin prohibit-password`),
|
|
checked and reloaded by `felhom-os-apply`; proven on a fresh install from ISO 1.30.0 (nested VM 9343, destroyed):
|
|
password SSH refused, key works, the console and the PVE web login keep the password. Patches:
|
|
felhom.eu `audits/night-2026-10-22/P2-D4/felhom-agent-bundle-D4.patch` + `felhom.eu-installer-D4.patch`. They ship
|
|
with the next agent release (the operator's vouch) and the next installer tag.
|
|
- **Correction:** the CHANGELOG first said a push of the installer would publish it. Wrong: `/scripts/` is served from
|
|
the tag `installer-v1.35.0` (R-110). The decision to keep D4 as a patch stands on the other two reasons.
|
|
- **Gates:** `agent_gates.py --fast` green before each push. CI by commit: felhom.eu `REPORT-night-2026-10-22.md`.
|
|
- **Teardown:** VM 9343 destroyed on demo-hp (own id); its hub appliance (id 49) waits for the operator's Discard.
|