felhom-controller/REPORT.md

REPORT — controller v0.69.0: remove dead infra-backup stubs + unused restic-password report field (2026-06-16)

Deployed: controller v0.69.0 on guest 9201 / felhom-pve (bootstrap-managed; healthy, hub-reporting OK). Scope: controller half of Phase-1 Infra Backup retirement (hub v0.12.0). See felhom.eu/documentation/audits/SPIKE-infra-backup-2026-06-15.md. Commit 9f59bc2.

What changed (pure dead-code removal — no behaviour change)

• Removed report.Pusher.PushInfraBackup (internal/report/pusher.go) — pushed the infra-backup payload to the now-removed hub endpoint POST /api/v1/infra-backup. Dead since slice 8C; no callers.
• Removed notify.Notifier.NotifyBackupCompleted (internal/notify/notifier.go) and the backup_completed event — caller-less since whole-guest backup moved to the agent in slice 8C. The hub's backup-deadline check now reads the agent host-report's PBS snapshots instead. NotifyBackupFailed and the DB-dump notifiers are untouched and still used.
• Removed report.BackupReport.ResticPassword (internal/report/types.go, json:"restic_password").

STEP-2 gate — confirmed before removing ResticPassword

The task required proving the live builder leaves ResticPassword empty (else it would be an ongoing restic-password leak to the hub). Confirmed two ways:

• Source: buildBackupReport (internal/report/builder.go) constructs BackupReport{Enabled:…} + LastDBDump only; the comment at the disk-tier seam states restic/snapshot fields are left zero. No code anywhere assigns BackupReport.ResticPassword.
• Live data (hub DB, read-only): the latest controller reports (v0.68.3) carry no restic_password field at all. So no ongoing leak — safe to remove.

Flagged (separate, worse historical finding — not in this task's scope): the hub's legacy reports table holds thousands of historical rows with a plaintext restic_password value from old controller versions that DID populate it. The current controller does not, and this removal makes the field structurally unsendable, but the historical rows persist on the hub — a distinct purge/rotation decision for the operator.

Verification

• go build ./... && go test ./... — green; go vet clean. No residual references to PushInfraBackup / NotifyBackupCompleted / BackupReport.ResticPassword (the config.go ResticPasswordFile is the separate restic-password-file path config, intentionally untouched).
• Built felhom-controller:0.69.0, deployed to guest 9201 via the bootstrap mechanism (docker pull → /etc/felhom-controller-image → restart felhom-controller-bootstrap.service).
• Live: container Up … (healthy) on 0.69.0; startup clean (no errors/panics); hub connectivity HTTP 200; Hub report pushed successfully (8309 bytes) — confirming the caller-less removal causes no behaviour change and reporting still works.

Out of scope

Credential rotation (operator); the historical reports-table restic_password rows (flagged above); the Komga healthcheck.