Live drive: §8 removal+protected guards PASS (F18); §11 misc PASS (F19); F8 plaintext secrets extended

2026-06-14 00:49:09 +02:00
parent 20463dbaa0
commit 3b98c7309a
1 changed files with 12 additions and 2 deletions
@@ -75,8 +75,13 @@ The demo dashboard has **no password set**, so the controller's `RequireAuth` an
 ### F7 — API `state` lags Docker health by ~10s after deploy — LOW
 - mealie's container reported `(healthy)` in `docker ps` ~12s before `GET /api/stacks/mealie` flipped from `starting` to `running`. Cosmetic polling lag; transient. **Severity: LOW.**

-### F8 — cloudflared `TUNNEL_TOKEN` stored in plaintext in docker-compose.yml — LOW/INFO
- The cloudflared infra stack's compose holds `TUNNEL_TOKEN=<redacted>` in plaintext on disk (not `enc:`-wrapped like app.yaml secrets). May be acceptable for an infra/base-bringup stack, but worth confirming against the "secrets must be encrypted at rest" posture. Token redacted here. **Severity: LOW/INFO.**
+### F8 — Infrastructure secrets stored in plaintext on the guest rootfs — LOW/INFO
+- The cloudflared infra stack's compose holds `TUNNEL_TOKEN=<redacted>` in plaintext; `/etc/felhom-controller/controller.yaml` holds `hub.api_key`, `infrastructure.cf_api_token`, and `infrastructure.cf_tunnel_token` in **plaintext** (not `enc:`-wrapped like app.yaml secrets). These live on the guest rootfs (in PBS snapshots) and the controller needs them at runtime, so it may be acceptable, but it diverges from the "secrets encrypted at rest" posture applied to app secrets. All redacted here. **Severity: LOW/INFO.**
+
+### F19 — §11 misc (monitoring, settings, sync, geo, assets, hub reporting) — mostly PASS — INFO
+- **Per-container metrics: accurate.** `/api/metrics/containers/summary` reports romm `mem_usage_mb=278.1, limit 512`; `docker stats romm` = `277.8MiB/512MiB` — matches, and uses the correct **per-container cgroup limits**. `/api/metrics/containers/{name}` returns a CPU/memory time-series (works). **Contrast with F1:** only the *system/guest* memory metric is wrong (host 16GB), not the container metrics.
+- **Settings page** `/settings` → 200. **Sync** (`POST /api/sync`, "Sablonok frissítése") → works ("Sablonok naprakészek — nincs változás"). **Geo** `/api/geo/status` → reachable (`allowed:[HU], cf_configured:true, enabled:false`). **Asset sync** `/api/assets/status` → `not_configured` (assets not synced from hub on this demo — note, not necessarily a bug).
+- **Hub reporting: works.** Logs: `Hub connectivity: https://hub.felhom.eu reachable (HTTP 200)`, `Hub report pushed successfully (7658 bytes)`, periodic `hub-report every 15m`, startup report sent. **Severity: INFO (PASS).**

 ### F9 — felhom-usb HDD is NOT passed through to guest 9201 → HDD apps undeployable; disk APIs misrepresent it as available — CRITICAL
 - **Area:** §2 HDD deploy / §7b data migration / §11 storage.
@@ -158,5 +163,10 @@ The demo dashboard has **no password set**, so the controller's `RequireAuth` an
 - **What does work:** secret recovery (3/3 from the guest's own app.yaml), the fail-closed data-key gate (Phase 2b, proven previously), and the app coming back healthy. The orchestration is fine; the data-replay step is simply missing.
 - **Verdict:** broken. **Severity: CRITICAL** (restore advertised as data recovery does not restore data). Also: `/backup/restore` reads `snapshot_id` but **ignores it** (`RestoreFromRecoveryUnit` takes only the stack name) — there is no point-in-time selection; "restore" always means "re-create from the single latest unit."

+### F18 — Removal + protected-stack guards — PASS — INFO
+- **Protected stacks** (traefik, cloudflared, filebrowser, felhom-controller): both `stop` and `remove` **refused server-side** with clear messages (`cannot stop protected stack X` / `stack "X" is protected and cannot be removed`); all confirmed still running. **PASS.**
+- **Full removal** (code-server): stop → remove → container gone, no orphaned volume (`docker volume ls` empty), `state=not_deployed`, route `code.demo-felhom.eu` → 404 (Traefik route withdrawn with the container). Remove response carries explicit data-handling fields (`volumes_removed`, `hdd_paths_removed`, `hdd_paths_preserved`). **PASS.**
+- **Verdict:** removal and protection guards work correctly. **Severity: INFO (PASS).**
+
 ### F4 — `/api/stacks/rescan` returns "stack not found: rescan" — LOW
 - The runbook's documented rescan endpoint `GET /api/stacks/rescan` is routed as a stack name lookup → `{"ok":false,"error":"stack not found: rescan"}`. Either the route was removed/renamed or the runbook is stale. (Sync/rescan is reachable via `POST /api/sync`.) Cosmetic but documents a stale/missing endpoint.