felhom-controller/REPORT-cloudflared-0.345.1.md

REPORT — controller v0.345.1: cloudflared 2026.10.3 (security), 2026-10-26 evening (attended)

A sibling of REPORT.md, not an overwrite: the night session (D53, R-1218/1219/1220) owns REPORT.md tonight and writes into this repo at the same time.

In plain words

• What: Cloudflare said on 2026-10-20 that cloudflared before 2026.10.2 trusts eight bad certificate issuers (eMudhra, weak keys). Every Felhom box ran cloudflared 2026.9.3 in its guest. Controller 0.345.1 = the released 0.345.0 + only the new cloudflared pin 2026.10.3. Nothing from tonight's main is in it.
• Did it work: yes. Every box with a tunnel (Tester 1, demo-hp, demo-felhom) runs controller 0.345.1 and cloudflared 2026.10.3, healthy; the hub says „running (connected)" for all three; all 29 public names still redirect http → https. Tester4 moved to 0.345.1 by the global floor (it has no tunnel). Tester 2 has no box.
• Gaps: the tunnel was down about 2 s (Tester 1), 4 s (demo-felhom) and 11 s (demo-hp) while cloudflared restarted.

What changed

Where	What
tag v0.345.1 = f3204024 (on 6bfb784)	infra.CloudflaredImage → cloudflare/cloudflared:2026.10.3; test TestEnsureCloudflared_ANewImageRecreatesTheTunnel; CHANGELOG entry
main a1c65b3d	the same change, plus build.sh: a --push may build from the pushed tag v<VERSION> when it is HEAD (operator's yes, this session); 4 new cases in scripts/test_build_push_once.sh

• Red-proofs: the new reconcile test failed with the „compose changed" check removed; the build cases failed both ways (tag branch accepting anything: 4 of 20 fail; tag branch removed: 1 of 20 fails).
• Gates --fast green on both commits; go test ./... green on the tag commit (internal/stacks 450 s under the night session's load). CI by commit: a1c65b3d job 2392 success; f3204024 job 2393 success (run_attempt 1 each).
• Image gitea.dooplex.hu/admin/felhom-controller:0.345.1 (and :latest) digest sha256:7cfdf7e1f835628de9c7d536e0a60c06bad5bbe19e8133765cc0a6bb732dbff6, built from f3204024.
• cloudflared image index digest sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39.
• How a box takes it: controller/internal/stacks/infra.go ensureCloudflared — the rendered compose differs (the image: line) → compose up -d recreates the container. Seen on all three boxes: [infra] cloudflared compose changed … recreating cloudflared 1–2 s after [selfupdate] Post-update startup: update successful (0.345.0 → 0.345.1).

For the night session

main carries the bump (a1c65b3d). Your next release from main keeps cloudflared 2026.10.3 — no action needed. Your CHANGELOG „Unreleased" block is unchanged; the v0.345.1 section sits between it and v0.345.0.

Evidence: felhom.eu documentation/audits/cloudflared-2026.10.3-2026-10-26/. Register: R-1300 (closed), R-1301 (opened). Full session report: felhom.eu REPORT-cloudflared-2026-10-26.md.