1435 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
admin	9c1dfdd71f	REPORT: the 2026-10-25 night — committed fixes, CI by hash, teardown. Docs only.	2026-10-25 23:53:46 +01:00
admin	fbec5cb499	R-1278: the install page says when a backup of an earlier install is kept and links the restore page (HU and EN). Red-proved. Commit only.	2026-10-25 23:32:01 +01:00
admin	7ea942a118	R-1281: FileBrowser is served on its own felhom-files network (traefik, and OnlyOffice while linked) and leaves traefik-public, so no app container reaches it. R-1126's check-then-publish gate unchanged. Red-proved. Commit only.	2026-10-25 22:26:45 +01:00
admin	838c834169	R-1286: a held app says why it is held — each hold reason gets its own sentence in the start gate, the boot sweep and --restore-holds (an unhealthy stop read as a failed restore). Red-proved. Commit only.	2026-10-25 22:05:23 +01:00
admin	b5863a96eb	R-1288: a restore of a set-aside unit sets the replaced install's unit aside at once, with no alarm. R-1282: the later media restart time is stored and resumed at start, once. Red-proved. Commit only.	2026-10-25 21:37:55 +01:00
admin	a79a292d72	R-1261: the line hold holds every running seeder, drops the record of an app removed while held, and puts back the qBittorrent slot it held (alternative speed). Red-proved. Commit only.	2026-10-25 20:38:28 +01:00
admin	fe9837708a	v0.343.0 released (global floor 17:53:42 UTC on the operator's yes): CHANGELOG header, REPORT	2026-10-25 19:02:08 +01:00
admin	e2a976198d	v0.343.0: release header; README — fix A (stable start), fix B (.fab downloads first), D47 set-aside line	2026-10-25 18:02:52 +01:00
admin	935e624f10	D47 follow-up: a set-aside tells the operator once (backup_run_failures, leg unit-set-aside, both identities, own run id). Red-proved. Commit only.	2026-10-25 17:19:08 +01:00
admin	3a1f09d29f	Fix A (found live on 9202): the container sampler reads docker inspect JSON — a -f template stopped at 'no entry for key Health' for every app without a healthcheck, so a healthy restore read 'not started'. Commit only.	2026-10-25 17:02:32 +01:00
admin	1ee0353dbd	Fix A: the container sampler keeps Docker's stderr in its error (a live run on 9202 logged only 'exit status 1'). Commit only.	2026-10-25 16:56:04 +01:00
admin	35232de80d	Fix A: the stable-start sampler says at DEBUG why a sample is not ok (a live run on 9202 judged a healthy app unstable; the reason was not logged). Commit only.	2026-10-25 16:43:57 +01:00
admin	2149a13378	Fix A, the page too: the restore's first verdict needs a stable 45 s after the 90 s health wait on every path, so an app that runs, crashes and restarts reads „not started yet”; the copy still waits the full 3 minutes. Red-proved. Commit only.	2026-10-25 13:06:06 +01:00
admin	7720439440	D49 = A follow-ups: (A) the undo copy is released only after a stable start — 3 min of running, healthy, no restart, one rule for the first verdict and the late-start watch; a watch ends only for a restore begun after it; (B, R-1279) the .fab import downloads first with the restores' D48 helper, before it removes anything. Red-proved. Commit only.	2026-10-25 12:45:33 +01:00
admin	e8d2151a77	Restore-truth run close-out: REPORT (D47, D48, R-1270, R-1271; CI by hash; live proofs on 9202). Commit only.	2026-10-25 11:00:09 +01:00
admin	1f8295918e	R-1270 follow-up (found live on 9202): remove with „delete its backups too” deletes the app's restore-undo folder too — a not-started restore's kept copy outlived the remove; the wiring test also pins the D47 set-aside removal. Red-proved. Commit only.	2026-10-25 10:36:20 +01:00
admin	1f9c863f79	D47 follow-up (found live on 9202): the kept-copies list („Megőrzött másolatok”) shows on a box without off-site too — it sat only inside the off-site card, so 9202 never listed a set-aside unit or a D25 copy; one named template, two call sites, parity fixtures unchanged. Red-proved. Commit only.	2026-10-25 10:01:56 +01:00
admin	bd9f4f7b74	R-1271 (P2): „use my kept data” never takes a copy dated in the future — a copy more than 10 minutes past the box's clock never counts as the newest (the newest true date wins, tie local); alone it is still offered, said and not recommended. Red-proved. Commit only.	2026-10-25 09:44:56 +01:00
admin	2d71270858	D48: a restore downloads first — every restore path resolves and pulls every image of the definition that will run before the stop, under the image-work lock held until the restore returns; a failed pull refuses with the app untouched (a deleted version and a busy registry read differently), one operator line. Red-proved. Commit only.	2026-10-25 09:38:28 +01:00
admin	b680db85cb	R-1270 (P2): a restore whose app does not reach running in time is never a success — every restore path returns ErrRestoreNotStarted, the household reads that the data is back but the app has not started yet, one operator alarm; the data stays, the undo copy is kept, a late start turns the record into a success and releases the copy. Red-proved. Commit only.	2026-10-25 09:33:26 +01:00
admin	02daebe9c5	D47 / R-1269 (P2): a new install never writes into an earlier install's backup — every install has an identity (install_id), the unit records it, every unit writer asks first; another install's unit is set aside whole (backups/set-aside/<app>/<stamp>, a D25 kept copy, „Visszaállítás” + „Eltávolítás” on the restore page); a move that fails refuses the write. Red-proved. Commit only.	2026-10-25 09:27:48 +01:00
admin	e1613aea8d	Restore-holes run close-out: README, CONTEXT, REPORT; the interrupted-restore log line names a waiting put-back. Commit only.	2026-10-24 21:03:34 +02:00
admin	c9b4b82dc7	R-1253 (P2): an export that stops its app refuses while another operation (a restore) holds the app-stop marker — its Undo is never replaced. Commit only.	2026-10-24 20:29:59 +02:00
admin	518a13592d	R-1252 (P2): a rejected or absent backup block never deletes second-drive copies — reconcile only on a valid classification; a rejected block is said on the app's status and once a day to the operator (backup_run_failures); kept copies stay kept (H2); Remove drops the kept records it deleted (H9). Commit only.	2026-10-24 20:07:16 +02:00
admin	062f9b41d9	R-1251: sync the restore copy's folders before the marker names it (a cut left undo.json as .tmp on Tester 1); the interrupted-restore record says the put-back waits, not 'run it again'. Commit only.	2026-10-24 19:36:32 +02:00
admin	bb2809dc68	R-1251 (P1): a pending put-back blocks every start — a cut restore's copy on an unbound drive waits (a restore hold), is poured back when the drive binds before any start; a failed put-back holds the app (H2); Stop during a restore still puts back (H7). Commit only, unreleased.	2026-10-24 19:07:02 +02:00
admin	2449223f10	Review round 2 docs: REUSE.md — D22 released (v0.338.0), recordInstalledImages callers, a row for the stray-copy seams; no code change	2026-10-24 16:00:25 +02:00
admin	b01bb4b88d	Review round 2: a media restart no longer starts an app the household stopped (R-721); the file manager's header name file appears whole (R-1100 race, 44/300 -> 0/300); both red-proved; unreleased	2026-10-24 15:26:56 +02:00
admin	321df1f87a	README §8e + REPORT: R-1250 hold, live proof on demo-hp	2026-10-24 13:48:15 +02:00
admin	046b808792	upwatch: hold a seeding torrent app for one line test, then put its limit back exactly (R-1250) ... When the agent waits for quiet and qBittorrent or Transmission runs: record the limit first, hold at 1 KiB/s, ask the agent for a test on request, put the old limit back (deferred; a household change during the test stays). Start-up puts back a limit a killed controller left; the 50 % rule skips while a hold record exists. Commit only.	2026-10-24 13:19:07 +02:00
admin	bddc477e22	CHANGELOG: v0.342.0 released (the upload and CPU watch, the tested line, qBittorrent's limit); REPORT	2026-10-24 10:28:53 +02:00
admin	42cda07b42	v0.342.0 (unreleased): the watch's start line no longer says the line is learnt only from the off-site push	2026-10-24 09:58:13 +02:00
admin	ed1011b088	v0.342.0 (unreleased): the upload watch reads the host's weekly line test (GET /host/line-test, agent >= 0.164.0); qBittorrent's limit = 50 % of the TESTED line only (D41), the watch uses the higher of test and push floor, the system page names the source; red-proved	2026-10-24 08:59:57 +02:00
admin	60e487db51	docs: v0.342.0 (unreleased) — CONTEXT note and REPORT for the upload watch; live proofs on scratch 9202	2026-10-23 22:56:39 +02:00
admin	a9c1997fbc	v0.342.0 (unreleased): the upload and CPU watch — an app that sends or burns far more than its own numbers explain is one operator-only alarm; the line learnt from the off-site push; qBittorrent's default upload limit (never over the household's) ... internal/upwatch: exact per-container counters from the Docker Engine API, per-app judging (upload >= max(5 Mbit/s, 25% of the line) for 15 min; CPU >= max(150%, 50% x cores) for 30 min), explainers qBittorrent / Transmission / Plex, app_unexplained_upload / app_unexplained_cpu + _cleared (hub 0.169.0). The off-site push is sampled once a second for the line (a lower bound). qBittorrent limit = 50% of the line, the household's limit always wins. 20 red-proofs. Spike + design: felhom.eu audits/SPIKE-upload-watch-2026-10-23.md, architecture/08 section 9. Not released.	2026-10-23 21:26:09 +02:00
admin	277e99839d	docs: v0.341.0 released — global floor 11:24 UTC on the operator's yes, MinAgent 0.158.1; the live proofs in REPORT (no code change) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-23 13:30:54 +02:00
admin	63dcccfeec	v0.341.0: the night update takes a security_fix ladder step (D39 = B, 09 §3 decision 255, R-1239); every other leg guard unchanged; the leg names the CVE ids; MinAgent 0.158.1 ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb	2026-10-23 13:09:52 +02:00
admin	32e61d5d1d	REPORT: day 2026-10-23 — controller 0.340.0 released (floor 06:41 UTC, MinAgent 0.158.1)	2026-10-23 11:07:44 +02:00
admin	caaa86eb3c	v0.340.0: release — the capped night copy that never outlives the controller (R-1214 + stray-copy fix), Immich's model cache out of backups (R-49), no import over a stopped app (R-1187 c), the catch-up checks (R-1189 d, C5); MinAgent 0.158.1	2026-10-23 08:19:45 +02:00
admin	23f77f93ba	night 2026-10-23 docs: CONTEXT (0.340.0 candidate), REPORT (both review rounds, rc.8 re-proof), the OffsiteStateAwaitingRecoveryKey comment corrected (its hub claim was measured false: felhom.eu R-1230); no behaviour change	2026-10-23 00:05:34 +02:00
admin	1babfe94f6	Second-drive copy: two races closed — the start-up/retry removal holds the destination's lock (a copy this process starts is never removed), and a run records itself in one step with the restore check, every leg asking again; red-proved, race-clean; unreleased	2026-10-22 22:58:33 +02:00
admin	9d9e4041c9	Second review of the night's own code: a stray clears when a later removal works (N2), the start-up check never removes this process's own copy (N3), one copy per destination at a time (N4), RunTier2 refuses during a restore for every caller (N5), the import refusal no longer advises removal (N9); red-proved, race-clean; README; REPORT; unreleased	2026-10-22 22:45:42 +02:00
admin	943c517550	Review fixes for 0.340.0: C5 a catch-up releases the whole-guest backup when its backup legs end (red-proved); C3 the R-1187 c refusal text fits an unhealthy app; C6 two comments; C8 README backup.volumes wording; unreleased	2026-10-22 21:25:48 +02:00
admin	912e59210d	Stray-copy fix: the copy container runs with --no-healthcheck (the image's controller health check showed it as starting on the 9202 proof); unreleased	2026-10-22 20:39:05 +02:00
admin	66a69d4954	Stray-copy fix: the capped second-drive copy container never outlives the copy — fixed name + label, removed by name on any error (the timeout included), every leftover removed at start before the scheduler and web server; a restore is refused while a copy runs or may still run; --mount (refuses a path the daemon does not see) and the image ID with --pull never (review); red-proved; unreleased	2026-10-22 20:20:35 +02:00
admin	df78b6caae	night 2026-10-22: README (backup.volumes excluded, the capped second-drive copy), CONTEXT, REPORT — four fixes on main, not released (0.340.0 next) ... Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS	2026-10-22 18:11:45 +02:00
admin	ae394670c1	R-1214: the capped copy refuses any path with a symlink in it (security review: a link under /mnt pointing outside resolves elsewhere for the daemon); red-proved; unreleased	2026-10-22 17:51:14 +02:00
admin	03c0a693b8	R-1214: the second-drive copy runs in a 512 MB memory-capped container for /mnt paths (its page cache no longer evicts the apps) — measured on 9202; guarded against a path the daemon sees differently; unreleased	2026-10-22 17:47:19 +02:00
admin	d5f88a2182	R-1187 (c): refuse a .fab import over an installed app that is not running (it merged old and bundle data); R-1189 (d): the off-site proof + integrity check run after a catch-up; unreleased	2026-10-22 17:27:56 +02:00
admin	6a17c95815	R-49 (D21 = B): a template may exclude a named volume from every backup (backup.volumes, class excluded) — Immich's model cache; guarded, red-proved; unreleased	2026-10-22 16:21:38 +02:00