09:03:07 ##### bookstack — controller gitea.dooplex.hu/admin/felhom-controller:0.285.0
11:03:07   [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['ADMIN_PASSWORD']
11:03:07   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
11:04:07   [1] deployed, controller state=running, pinned={'bookstack': 'lscr.io/linuxserver/bookstack:26.09.1', 'bookstack-db': 'mariadb:12.3'}
09:04:07 deploy: True
09:04:16 generated password length: 30
09:04:16 positive control — right password: ok
09:04:17 stranger wrong try 1: wrong
09:04:17 stranger wrong try 2: wrong
09:04:18 stranger wrong try 3: wrong
09:04:18 stranger wrong try 4: wrong
09:04:19 stranger wrong try 5: wrong
09:04:19 stranger wrong try 6: locked
09:04:19 household, RIGHT password, right after: locked
09:04:34   +0.3 min right password: locked
09:04:50   +0.5 min right password: locked
09:05:05   +0.8 min right password: locked
09:05:20   +1.0 min right password: ok
09:05:20 RESULT bookstack: the right password worked again after 1.0 min
09:05:21 a wrong one after: wrong | right again: ok
09:05:24 
11:05:29   [X] stop -> 200 {'ok': True, 'message': 'Stack bookstack stop completed'}
11:06:01   [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'bookstack', 'volumes_removed': ['bookstack_bookstack_config', 'bookstack_bookstack_db_data'], 'hdd_paths_removed': [], 'hdd_pa
11:06:09   [X] after remove: deployed=False leftovers='/opt/docker/stacks/bookstack'
09:06:09 removed; deployed = False
09:06:12 ##### grafana — controller gitea.dooplex.hu/admin/felhom-controller:0.285.0
11:06:12   [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['GF_SECURITY_ADMIN_PASSWORD']
11:06:12   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
11:06:53   [1] deployed, controller state=running, pinned={'grafana': 'grafana/grafana:13.2.3'}
09:06:53 deploy: True
09:07:01 generated password length: 30
09:07:01 positive control — right password: ok
09:07:01 stranger wrong try 1: wrong
09:07:01 stranger wrong try 2: wrong
09:07:01 stranger wrong try 3: wrong
09:07:01 stranger wrong try 4: wrong
09:07:01 stranger wrong try 5: wrong
09:07:01 stranger wrong try 6: wrong
09:07:01 household, RIGHT password, right after: wrong
09:07:17   +0.3 min right password: wrong
09:07:32   +0.5 min right password: wrong
09:07:47   +0.8 min right password: wrong
09:08:02   +1.0 min right password: wrong
09:08:17   +1.3 min right password: wrong
09:08:32   +1.5 min right password: wrong
09:08:47   +1.8 min right password: wrong
09:09:02   +2.0 min right password: wrong
09:09:17   +2.3 min right password: wrong
09:09:32   +2.5 min right password: wrong
09:09:47   +2.8 min right password: wrong
09:10:02   +3.0 min right password: wrong
09:10:17   +3.3 min right password: wrong
09:10:32   +3.5 min right password: wrong
09:10:47   +3.8 min right password: wrong
09:11:02   +4.0 min right password: wrong
09:11:17   +4.3 min right password: wrong
09:11:32   +4.5 min right password: wrong
09:11:47   +4.8 min right password: wrong
09:12:02   +5.0 min right password: ok
09:12:02 RESULT grafana: the right password worked again after 5.0 min
09:12:02 a wrong one after: wrong | right again: ok
09:12:02 ## grafana: the TRICKLE — 5 wrong, then one wrong try per minute for 8 minutes; the right password each minute
09:12:02 burst wrong 1: wrong
09:12:02 burst wrong 2: wrong
09:12:02 burst wrong 3: wrong
09:12:02 burst wrong 4: wrong
09:12:02 burst wrong 5: wrong
09:13:02   minute 1: stranger wrong -> wrong, household right -> wrong
09:14:02   minute 2: stranger wrong -> wrong, household right -> wrong
09:15:02   minute 3: stranger wrong -> wrong, household right -> wrong
09:16:03   minute 4: stranger wrong -> wrong, household right -> wrong
09:17:03   minute 5: stranger wrong -> wrong, household right -> ok
09:18:03   minute 6: stranger wrong -> wrong, household right -> ok
09:19:03   minute 7: stranger wrong -> wrong, household right -> ok
09:20:03   minute 8: stranger wrong -> wrong, household right -> ok
09:20:03 stop the trickle; wait for the right password:
09:20:18   +0.3 min right password: ok
09:20:18 RESULT grafana trickle: open again 0.3 min after the last wrong try
09:20:21 logger=authn.service t=2026-10-01T11:16:02.977306539+02:00 level=info msg="Failed to authenticate request" client=auth.client.form error="[password-auth.failed] too many consecutive incorrect login at
logger=context userId=0 orgId=0 uname= t=2026-10-01T11:16:02.978088015+02:00 level=info msg="Request Completed" method=POST path=/login status=401 remote_addr=192.168.0.180 time_ms=1 duration=1.228039
logger=authn.service t=2026-10-01T11:16:03.000927142+02:00 level=info msg="Failed to authenticate request" client=auth.client.form error="[password-auth.failed] too many consecutive incorrect login at
logger=context userId=0 orgId=0 uname= t=2026-10-01T11:16:03.001553164+02:00 level=info msg="Request Completed" method=POST path=/login status=401 remote_addr=192.168.0.180 time_ms=1 duration=1.066954
11:20:22   [X] stop -> 200 {'ok': True, 'message': 'Stack grafana stop completed'}
11:20:54   [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'grafana', 'volumes_removed': ['grafana_grafana_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alk
11:21:02   [X] after remove: deployed=False leftovers='/opt/docker/stacks/grafana'
09:21:02 removed; deployed = False
09:21:05 ##### calibre-web — controller gitea.dooplex.hu/admin/felhom-controller:0.285.0
11:21:08   [1] made the drive paths this app requires: ['/mnt/felhom-drives/scratch_hdd/userdata/calibre-web']
11:21:08   [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH', 'ADMIN_PASSWORD']
11:21:08   [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
11:21:48   [1] deployed, controller state=running, pinned={'calibre-web': 'crocodilestick/calibre-web-automated:v4.0.8'}
09:21:48 deploy: True
09:21:57 generated password length: 30
09:21:57 positive control — right password: ok
09:21:57 stranger wrong try 1: wrong
09:21:57 stranger wrong try 2: wrong
09:21:58 stranger wrong try 3: wrong
09:21:58 stranger wrong try 4: locked
09:21:58 household, RIGHT password, right after: locked
09:23:08   +1.2 min right password: ok
09:23:08 RESULT calibre-web: the right password worked again after 1.2 min
09:23:08 a wrong one after: wrong | right again: ok
09:23:08 ## calibre-web: OPDS basic auth (the book-feed door) — 60 wrong tries as a stranger
09:23:13 OPDS wrong tries: {'locked': 57, 'wrong': 3}
09:23:13 OPDS right password after: locked | the login form, right password: ok
09:23:13 ## calibre-web: the DAILY limit — 40 wrong tries at the 3/minute pace (~14 min), then the right password
09:26:18   wrong try 10: wrong
09:29:23   wrong try 20: wrong
09:32:28   wrong try 30: wrong
09:36:34   wrong try 40: wrong
09:37:36 household, RIGHT password after 40: locked
09:39:46 household, RIGHT password 2 min later (past the minute window): locked
09:39:54 restart the app (the limiter's store is in memory): restarted
09:39:59 household, RIGHT password after the restart: ok
09:40:02 [2026-10-01 11:39:46,068]  INFO {flask-limiter:1102} ratelimit 40 per 1 day (admin) exceeded at endpoint: web.login_post
[cwa-init] Checking for leftover lock files from previous instance...
[cwa-init] No leftover lock files to remove. Ending service...
[2026-10-01 11:39:56,532]  WARN {py.warnings:110} /lsiopy/lib/python3.13/site-packages/flask_limiter/extension.py:324: UserWarning: Using the in-memory storage for tracking rate limits as no storage w
11:40:13   [X] stop -> 200 {'ok': True, 'message': 'Stack calibre-web stop completed'}
11:40:18   [X] remove (with drive data) -> 409 {'ok': False, 'error': 'A(z) /mnt/felhom-drives/scratch_hdd/userdata/calibre-web tárhely jelenleg nem elérhető — az alkalmazás nem távolítható el, amíg a meghaj
11:40:18   [X] refused because the drive path cannot be resolved (R-442, fail-closed and right) — removing the app and KEEPING the drive data instead
11:40:45   [X] remove (keeping drive data) -> 200 {'ok': True, 'data': {'removed': 'calibre-web', 'volumes_removed': ['calibre-web_calibre_web_config'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'back
11:40:53   [X] after remove: deployed=False leftovers='/opt/docker/stacks/calibre-web'
09:40:53 removed; deployed = False
