From 42af088308ab34c18812f974c19fc56e0fdc4b33 Mon Sep 17 00:00:00 2001
From: kisfenyo <nagyfenyvesi.viktor@gmail.com>
Date: Thu, 9 Jul 2026 22:07:28 +0200
Subject: [PATCH] readme: document the offsite provisioning apply-bridge (SLICE
 2, v0.106.x)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
---
 controller/README.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/controller/README.md b/controller/README.md
index 3777c35..dd1b6a2 100644
--- a/controller/README.md
+++ b/controller/README.md
@@ -737,6 +737,19 @@ not just those with HDD data. Non-HDD apps can configure destination, method, an
 >   target. Image: `restic` + `openssh-client` (re-added; restic's sftp backend shells out to `ssh`).
 > - UI: the "Külső (NAS) mentés" section on the backups page (configure target, per-app toggles, run-now,
 >   restore, status). Config: `settings.OffboxTarget` + per-app `AppBackupPrefs.Offbox`. Daily at 04:15.
+> - **Hub-driven provisioning apply-bridge (v0.106.x, SLICE 2; pairs with hub v0.38.x — validated live
+>   2026-07-09).** When the hub provisions the offsite tier (a Hetzner Storage Box sub-account or dedicated
+>   box), the served `controller.yaml` gains an `offsite:` section (host/user/port/repo_path/quota_gb +
+>   **`host_fingerprint`**) and `internal/offsiteapply.Bridge` reconciles it at startup: scan + **verify the
+>   box host key against `host_fingerprint` (no blind TOFU)** → generate an ed25519 keypair → **consume the
+>   hub's one-time transient password** (`POST /api/v1/offsite/consume-password/{id}`, single-use) → install
+>   the pubkey (`sshpass -e ssh-copy-id -p 23 -s -f`, **pinned known_hosts, `StrictHostKeyChecking=yes`**;
+>   the installer ensures `~/.ssh` exists — ssh-copy-id's SFTP mode needs it) → verify key-only auth →
+>   configure the offbox target → `EscrowState="pending"` (the fork-4 gate above still holds) → persist a
+>   descriptor-hash marker LAST. **Idempotent** (marker → no re-consume) and **fail-safe** (any failure →
+>   nothing persisted, retried on the next config refresh/restart; a consumed-but-failed install logs a loud
+>   "password is spent — reset on the hub"). The 15-min hub-report → config-refresh cycle is the trigger, so
+>   descriptor-to-applied latency is ≤ ~15 min.
 
 > **NAS network storage (v0.92.0, Part A2; pairs with agent v0.50.0).** A customer NAS share (NFS or SMB)
 > is a **distinct storage KIND** from a physical drive (`StoragePath.Kind == "network"`), for **bulk media**.