felhom-controller/REPORT.md

REPORT — v0.327.0: FileBrowser published only after its default login is checked; real memory amounts in the install check (2026-10-17)

Brief „FileBrowser never on its default password (D11 = A), real memory amounts (D10 = A), CI failure mail, STATUS". Full report: felhom.eu REPORT-filebrowser-memory-ci-2026-10-17.md. Evidence: felhom.eu documentation/audits/filebrowser-memory-ci-2026-10-17/.

1. What changed

• R-1126: internal/infra/infra.go (FileBrowser on felhom-filebrowser, not traefik-public), internal/stacks/filebrowser_gate.go (join, check, publish by container ID), internal/stacks/infra.go and internal/web/handlers.go (call sites).
• R-1125: err.stacks.not_enough_memory and deploy.nincs_eleg_memoria_foglalas_telepites reworded (HU/EN); stacks.InstallMemory shared by the check and the install page.

2. Tests (each red-proved)

TestFileBrowserRender_R1126_NotPublicAtStart, TestFileBrowserGate_PublishedOnlyAfterTheCheck, TestFileBrowserGate_ConnectsTheCheckedContainerById, TestR1125_NotEnoughMemorySaysWhatToDo, TestR1125_InstallMemoryIsTheChecksReading. Fixtures: two re-captured as *_r1125; every other byte-identical.

3. Live (scratch 9202)

FileBrowser + its data removed: 143 probes through Traefik, the default login never 200. Install of a 150 MB app with 50 MB free: refused (400) in HU and EN, nothing installed; the page showed the same numbers as the check (2,798 vs 2,698).

4. Observations

1. FileBrowser's own admin-password setting re-applies at every start (measured). NOT-A-FINDING: why Path 2 was built.
2. The install page used /proc's host-wide memory, not the check's reading. NOT-A-FINDING: fixed in this release.
3. A TOCTOU in the first gate (connect by name). NOT-A-FINDING: found by the commit security review, fixed before release.