602 Commits

Author	SHA1	Message	Date
admin	63dcccfeec	v0.341.0: the night update takes a security_fix ladder step (D39 = B, 09 §3 decision 255, R-1239); every other leg guard unchanged; the leg names the CVE ids; MinAgent 0.158.1 ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-23 13:09:52 +02:00
admin	caaa86eb3c	v0.340.0: release — the capped night copy that never outlives the controller (R-1214 + stray-copy fix), Immich's model cache out of backups (R-49), no import over a stopped app (R-1187 c), the catch-up checks (R-1189 d, C5); MinAgent 0.158.1	2026-10-23 08:19:45 +02:00
admin	1babfe94f6	Second-drive copy: two races closed — the start-up/retry removal holds the destination's lock (a copy this process starts is never removed), and a run records itself in one step with the restore check, every leg asking again; red-proved, race-clean; unreleased	2026-10-22 22:58:33 +02:00
admin	9d9e4041c9	Second review of the night's own code: a stray clears when a later removal works (N2), the start-up check never removes this process's own copy (N3), one copy per destination at a time (N4), RunTier2 refuses during a restore for every caller (N5), the import refusal no longer advises removal (N9); red-proved, race-clean; README; REPORT; unreleased	2026-10-22 22:45:42 +02:00
admin	943c517550	Review fixes for 0.340.0: C5 a catch-up releases the whole-guest backup when its backup legs end (red-proved); C3 the R-1187 c refusal text fits an unhealthy app; C6 two comments; C8 README backup.volumes wording; unreleased	2026-10-22 21:25:48 +02:00
admin	912e59210d	Stray-copy fix: the copy container runs with --no-healthcheck (the image's controller health check showed it as starting on the 9202 proof); unreleased	2026-10-22 20:39:05 +02:00
admin	66a69d4954	Stray-copy fix: the capped second-drive copy container never outlives the copy — fixed name + label, removed by name on any error (the timeout included), every leftover removed at start before the scheduler and web server; a restore is refused while a copy runs or may still run; --mount (refuses a path the daemon does not see) and the image ID with --pull never (review); red-proved; unreleased	2026-10-22 20:20:35 +02:00
admin	ae394670c1	R-1214: the capped copy refuses any path with a symlink in it (security review: a link under /mnt pointing outside resolves elsewhere for the daemon); red-proved; unreleased	2026-10-22 17:51:14 +02:00
admin	03c0a693b8	R-1214: the second-drive copy runs in a 512 MB memory-capped container for /mnt paths (its page cache no longer evicts the apps) — measured on 9202; guarded against a path the daemon sees differently; unreleased	2026-10-22 17:47:19 +02:00
admin	d5f88a2182	R-1187 (c): refuse a .fab import over an installed app that is not running (it merged old and bundle data); R-1189 (d): the off-site proof + integrity check run after a catch-up; unreleased	2026-10-22 17:27:56 +02:00
admin	6a17c95815	R-49 (D21 = B): a template may exclude a named volume from every backup (backup.volumes, class excluded) — Immich's model cache; guarded, red-proved; unreleased	2026-10-22 16:21:38 +02:00
admin	fc5a20f40a	v0.339.0: release — the household's mail list never overwritten (R-1199 reopened), the swap sentence only when swap is really short (R-1216); MinAgent 0.158.1	2026-10-22 12:57:24 +02:00
admin	add310c80a	R-1199 reopened: a box with no list of its own reads the household's from the hub and adopts it, pushes its default once only when no household saved one; every push names its source; an empty saved list stays empty; R-1216 (D28 = A): the install page's swap sentence only when host swap is really short (shared case table); unreleased	2026-10-22 12:13:26 +02:00
admin	7900a32695	v0.338.0: release (operator yes 2026-10-22) — D22 restore put-back, first-hour words, swap sentence, R-1199; MinAgent 0.158.1	2026-10-22 09:51:27 +02:00
admin	f0abdd0eda	CHANGELOG: blank line before v0.337.0	2026-10-21 23:41:10 +02:00
admin	ba22f9b2d9	R-1199: a box whose household never saved its notification choice pushes the default list its page shows at start, so the hub mails by it; unreleased	2026-10-21 23:40:21 +02:00
admin	5776d54901	W21 sharing switched on without a password asks for it and says why it waits; W25 failed off-site run shows the household a sentence built from the classifier, raw text only to log and operator; W28 share restore skips the controller's drop-zone share; unreleased	2026-10-21 23:19:07 +02:00
admin	28b05d6d68	W13 new-drive pages pre-fill the next free hdd_N and answer a bad name visibly; W14 drive operator detail behind Részletek; W29 plain decommission names no move; unreleased	2026-10-21 22:51:08 +02:00
admin	8c1e290f63	W12 family names keep their accents, login made without them; W9 banner link colour; W10 recovery-code page one plain line; W11/W24 remote page hides provider login and key fields behind Haladó; unreleased	2026-10-21 22:35:24 +02:00
admin	37b79caad9	install page: say when the host has too little swap behind the guest (R-1192 follow-up); restore record log says when a cut restore was put back; unreleased	2026-10-21 22:11:16 +02:00
admin	d582feb245	D22: every restore puts the data back exactly on failure and after a power cut (R-1177, R-1195); whole restore asks the unit first (R-1178); no mirror during a restore (R-1180); W22 restore refusals in Hungarian; unreleased	2026-10-21 21:19:46 +02:00
admin	7848d4aaac	CHANGELOG: v0.337.0 (MinAgent 0.158.1)	2026-10-21 15:58:43 +02:00
admin	5929b8e345	kept second-drive copies (D25: R-1175, R-1181, R-1179); .fab import keeps the family gate (R-1191); stale restore temp (R-1188 c); the overcommit sentence made true (R-1192); escrow before the floor (R-1176); unreleased	2026-10-21 15:46:10 +02:00
admin	8f5bea0148	R-1182: a finished off-site abandonment closes on the hub's abandon_purge_done (hub v0.163.0 keeps other copies' packages); unreleased	2026-10-21 13:36:12 +02:00
admin	01c967e49e	monitoring page: storage labels follow the reader's language (W26, rehearsal 2026-10-20); unreleased	2026-10-20 22:36:19 +02:00
admin	7ca59e2de3	CHANGELOG + CONTEXT: v0.336.0 release line (the previous commit carried only REPORT)	2026-10-20 10:58:00 +02:00
admin	93fb251ea9	R-893 option A (operator D20): a failed off-site restore puts the app's live volumes and definition back exactly and starts it; fit check before the stop; the held sentence made true (R-1169)	2026-10-20 09:17:00 +02:00
admin	a03c25aa1f	security-scan gate (shared felhom.eu/scripts/security_scan_gate.py) in the fast set and CI, warn-first, with the accepted-hits file and decoys (R-986)	2026-10-19 21:11:31 +02:00
admin	15ea002458	v0.335.0: no app stop for a tier the agent will refuse because its host is busy (host_busy pre-check, R-921)	2026-10-19 20:05:52 +02:00
admin	546eef37bd	v0.334.0: a live box refreshes its config with its own hub key (GET /box-config; R-1159, operator D19)	2026-10-19 15:55:10 +02:00
admin	a6fa3c01d2	v0.333.0 (unreleased): the R-1155 check reads every token source FileBrowser reads, Basic auth included (security review)	2026-10-19 11:43:52 +02:00
admin	c809dd3bc6	v0.333.0: the file manager's own token ends with the dashboard sign-out (R-1155); the recovery-code page says the code becomes live after the check (R-1161)	2026-10-19 11:30:59 +02:00
admin	601bdba253	v0.332.0 (live rc.2 + security review): the pass redirect is absolute; no pass for a cross-site request; no dot-segments in to (R-1100)	2026-10-19 05:03:57 +02:00
admin	9bdd8f8fe8	v0.332.0: one sign-in for the file manager — a dashboard pass, a host-only files cookie, a per-box secret header (R-1100, operator D16)	2026-10-19 04:56:56 +02:00
admin	ba4a6f060b	The escrow wizard sends the typed-back words to the box; the new package reaches the hub only when they match (R-1151 controller half, unreleased; works with every agent)	2026-10-19 03:19:02 +02:00
admin	8ae9178138	v0.331.0: a removal deletes the volumes still labelled with the app's project that its definition no longer declares (R-1117) ... compose down --volumes removes only the current definition's volumes; a volume a template dropped (or an older restore re-created) survived 'remove with data' on 9202 (nextcloud_nextcloud_redis_data). Red-proofed.	2026-10-18 22:42:52 +02:00
admin	772ef36f5f	v0.331.0: OnlyOffice opens and saves from FileBrowser and Nextcloud; FileBrowser back at once after a restart (R-1018) ... FileBrowser config carries server.internalUrl http://filebrowser:80 (OnlyOffice fetched the public files address and got 403); Nextcloud's DocumentServerInternalUrl gets its trailing slash (every save was lost: http://onlyoffice:80cache/...); RestartStack("filebrowser") runs the R-1126 gate at once (files.<domain> was 502 for up to 5 min after the link switched). Each red-proofed. MinAgent 0.158.1.	2026-10-18 21:05:04 +02:00
admin	615940de35	CI workflow: the failure mail links the public run page, by run id (R-1135) ... The alarm step built its link from GITHUB_SERVER_URL, which on this runner is the in-cluster Gitea address, and from the run NUMBER, which Gitea 1.26 reads as a run id first (felhom.eu /actions/runs/1116 opened run id 1116 = run number 613). Now https://gitea.dooplex.hu + GITHUB_RUN_ID, and the link is printed into the job log as ALARM-LINK. Same change in all four repos.	2026-10-18 20:34:59 +02:00
admin	6c6bd87664	v0.330.0: „Végleges leszerelés — mégis" asks the agent's disk list first and starts again the apps it stopped when the agent refuses (R-1144) ... Red-proofed twice. MinAgent 0.158.1.	2026-10-18 13:06:09 +02:00
admin	03ab121b25	v0.329.0 (review): an app named like another app's appdata folder gets no root; USERDATA_PATH is always derived, never the app's env ... Security review of 2fe6341 (same night, before any release). Both red-proofed.	2026-10-17 23:22:54 +02:00
admin	2fe634141f	v0.329.0: each app reaches only its own appdata folder; empty allow-list; drive retirement asks the agent first; plain no-durable-id refusal; :latest only for a release ... R-1142: the HDD_PATH root is appdata/<own folder>, with a compiled-in folder map (paperless-ngx -> paperless). R-981: the allow-list is empty (homepage's socket served no Felhom feature). R-1063: finalizeDecommissionWith asks the agent before it marks the drive or moves the default; the 403/409 come back typed and reach the household as a plain 409. R-1069: the agent's no-durable-id format refusal is ErrNoDurableID and a plain sentence. R-1143: build.sh carries :latest only for x.y.z. Each pinned by a red-proofed test. MinAgent 0.158.1.	2026-10-17 23:11:56 +02:00
admin	99f9117296	v0.328.0 (unreleased): live finding on 9201 (rc.4) — roots resolved through their nearest existing ancestor; no symlink resolve for the placeholder check ... Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 16:52:09 +02:00
admin	09ac87a843	v0.328.0 (unreleased): security review round 3 — under HDD_PATH only appdata/ is a data root (not backups/) ... Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 16:49:17 +02:00
admin	36c4aa4e69	v0.328.0 (unreleased): security review round 2 — nearest-ancestor symlink resolve (fail closed), any extends refused, the entry binds a literal image and its exact healthcheck, no variable in a bind's options ... Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 16:46:32 +02:00
admin	24d937d6e4	v0.328.0 (unreleased): the security review's four findings — the entry is bound to its image and start; symlinks out of a root; the missed classes; roots only under the drive namespace or system data ... Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 16:42:18 +02:00
admin	6d90374f63	v0.328.0: the catalog allow-list — the box refuses container rights a template asks for and the box does not give (R-971, D2 = A) ... internal/privpolicy checks the RENDERED compose (privileged, cap_add, devices, host namespaces, security_opt, sysctls, volumes_from, build/include/extends, env_file/config files outside the stack dir, aliasing named volumes, binds outside the box's data roots, the Docker socket, propagation, ${VAR} in a privileged key) against an allow-list compiled into the controller (one entry: homepage's read-only socket). Asked before every compose write: the 15-minute sync, the guarded update/ladder step, the install, both settings changes, both restores (before the stop). A refusal writes nothing, keeps the app on its last good compose, raises the operator-only event app_definition_refused once per definition and puts one line on the app page. The sync never copies a template named like a controller infra stack. Structural guard TestAllowList_IsWiredIntoEveryComposeWriter. Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 16:34:12 +02:00
admin	71fbef6bbe	v0.327.1: files.<domain> reaches FileBrowser again — a file route by name, not Docker labels ... v0.327.0's box walk: files.<domain> timed out on demo-hp and the N100. With labels, Traefik kept the address it chose at container start (on felhom-filebrowser, before the gate joined traefik-public). FileBrowser now carries no Traefik labels; dynamic/filebrowser.yml routes files.<domain> to http://filebrowser:80 by name, resolved per connection and only while the gate keeps it on traefik-public. Test extended, red-proved. Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 13:56:45 +02:00
admin	0c6ce9500c	v0.327.0: CHANGELOG, CONTEXT, REPORT (and the R-1129 correction) ... Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 13:42:42 +02:00
admin	411d7761d9	CI workflow: a manual proof that the failure mail can be sent (R-1129) ... workflow_dispatch with input force_alarm (default false). A dispatch-only step prints the RESEND_API_KEY length (never the key) and, when forced, fails so the alarm step sends its real mail, subject marked FORCED TEST. Push runs are unchanged. No controller release, no code change. Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 12:49:43 +02:00
admin	3e8d027677	Row numbers: R-1120 -> R-1126, R-1122 -> R-1128 (a parallel session took R-1118..R-1122) ... Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-17 11:58:53 +02:00