admin
78fdec2897
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
45 lines
3.3 KiB
Markdown
45 lines
3.3 KiB
Markdown
# REPORT — controller v0.106.1 + offsite provisioning LIVE end-to-end validation — **PASS**
|
|
|
|
**Date:** 2026-07-09 · **Class:** operational validation (supervised runbook) + hotfix. Baseline v0.106.0 →
|
|
**v0.106.1** (live on guest 9201). Pairs with hub v0.38.1. **Full record:**
|
|
`felhom.eu/documentation/audits/VALIDATION-offsite-provisioning-e2e-2026-07-09.md`.
|
|
|
|
## What happened
|
|
First live run of the SLICE 2 apply-bridge, driven end-to-end through the real pipeline (no hand-set state):
|
|
hub provisioned sub-account 269008 (`u629488-sub1`) on the new dedicated-project pool box (611714) →
|
|
descriptor v6 + one-time password → controller `config-refresh` (15-min report ACK) → self-restart →
|
|
**bridge applied cleanly**: scan + fingerprint verify (BEFORE consume) → keypair → consume-once →
|
|
`sshpass -e ssh-copy-id -s -f` with the **pinned known_hosts (`StrictHostKeyChecking=yes`)** → SFTP key-auth
|
|
verify → offbox configured → `EscrowState="pending"` → marker persisted.
|
|
|
|
## v0.106.1 — the one live bug (F3)
|
|
`ssh-copy-id -s` (SFTP mode) mktemp's its batch file under `~/.ssh`; the container image ships without
|
|
`/root/.ssh` → the install died **locally** after the password was consumed. Fail-safe held exactly as
|
|
designed (loud "password is spent" log, no marker, no offbox config; the password never left the box).
|
|
Fix: `SSHCopyIDInstaller` ensures `~/.ssh` (0700) exists. Container probes (throwaway key + wrong password,
|
|
no secrets) isolated the bug AND proved the pin chain sound: pinned single-line known_hosts verifies cleanly;
|
|
wrong password fails as `Permission denied` (sshpass exit 5).
|
|
|
|
## Live proofs (all green)
|
|
- **Consume-once:** hub `one_time_secrets.consumed_at` set, single row (read-only DB check).
|
|
- **Fail-safe, twice:** the stale-v4 descriptor run hit consume→404 → clean abort + retry note; the F3 run
|
|
hit install-fail → "password is spent — reset on the hub", no marker, no half-configured offbox.
|
|
- **fork-4 run gate:** manual `POST /backup/offbox/run` while pending → refused
|
|
("A NAS-mentés a kulcs letétbe helyezésére vár."). No ciphertext before escrow.
|
|
- **Restart idempotency:** bootstrap restart → zero bridge activity (marker no-op), no re-consume.
|
|
- **Closing the loop (Option A, Viktor-approved):** the repo password was already escrowed (preserved by
|
|
`WriteOffboxSecrets` — the DR-inject seam), so confirm-escrow was truthful without a new ceremony →
|
|
`escrowed` → first run: **restic repo initialized, 2 apps (audiobookshelf, immich), 2 snapshots, 34s** —
|
|
independently verified by SFTP-listing the repo objects with the bridge-installed key + pinned host key.
|
|
|
|
## Standing state
|
|
Demo offbox targets the NEW box (`u629488-sub1…:/home/felhom-repo`), `escrowed`, un-paused, daily schedule.
|
|
Old-box offsite (`u629193-sub1`) untouched — frozen archive until a NEW-box restore round-trip is verified.
|
|
|
|
## Open follow-ups (controller-relevant)
|
|
- F2 (hub): fresh-subaccount DNS lag → first-save scan 502; retry-with-backoff in `ProvisionOffsite`.
|
|
- F4 (hub): no password-reset path — the recovery the controller's "reset on the hub" message references
|
|
doesn't exist yet; today's recovery is delete-subaccount + re-save.
|
|
- SLICE 3 (escrow auto-confirm — replaces the manual confirm exercised here), SLICE 4 (soft-quota).
|
|
- NEW-box restore round-trip, then retire the old sub-account.
|