admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: v0.107.0 README (key-auth-first + wipe) + REPORT (deployed, one-off cleanup done)

Browse Source 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-09 22:46:25 +02:00
parent a38c743926
commit fec2e8fd84
2 changed files with 44 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/README.md
+7
View File
@@ -750,6 +750,13 @@ not just those with HDD data. Non-HDD apps can configure destination, method, an
> nothing persisted, retried on the next config refresh/restart; a consumed-but-failed install logs a loud
> "password is spent — reset on the hub"). The 15-min hub-report → config-refresh cycle is the trigger, so
> descriptor-to-applied latency is ≤ ~15 min.
> - **Key-auth-first (v0.107.0):** on a descriptor change, if the ALREADY-INSTALLED key still authenticates
> (`SFTPKeyAuthProber`, pinned to the freshly-verified host key — the probe never bypasses the fingerprint
> verify), the bridge re-pins + reconfigures WITHOUT consuming a one-time password. Fresh guests fall
> through to the full consume+install path. The hub's "Re-issue offsite credentials" (v0.39.0) is the
> recovery for a genuinely-spent password on a fresh guest.
> - **Staged-secret wipe (v0.107.0):** confirm-escrow calls the agent's `DELETE /escrow/stage-secret`
> (agent ≥ v0.78.0) whenever `EscrowState` flips to `escrowed` — best-effort, loud-logged on failure.
> **NAS network storage (v0.92.0, Part A2; pairs with agent v0.50.0).** A customer NAS share (NFS or SMB)
> is a **distinct storage KIND** from a physical drive (`StoragePath.Kind == "network"`), for **bulk media**.