== before 2026-10-18T10:39:55Z
demo-hp-bb76ea HTTP 200 user root@pam set_at 2026-07-21T16:24:27Z password_len 32 keys ['host_id', 'set_at', 'username']
== rotate (the installer from this session's tree, --rotate-recovery-only, on demo-hp) 2026-10-18T10:43:33Z

[0;32m[INFO][0m felhom-host-install v1.33.0 — mode=rotate-recovery-only

[0;32m[INFO][0m   agent config: /etc/felhom-agent/agent.json
[0;32m[INFO][0m   host_id: demo-hp-bb76ea (host key read from the agent config, not logged); hub: https://hub.felhom.eu
[0;32m[INFO][0m   hub answers (healthz 200)
[0;34m[STEP][0m 4b/8 break-glass credential (root@pam console password → hub vault)
[0;32m[INFO][0m   recovery password vaulted at the hub (stored) — now setting it on root@pam
[0;32m[OK][0m   root@pam password vaulted, set, and the PVE login takes it (retrieve via the operator /admin path; never logged here)
[1;33m[WARN][0m   NOTE: the root@pam password just CHANGED — the old one now fails at the PVE web GUI (:8006).
[1;33m[WARN][0m         Retrieve the new one at hub → host page (vaulted recovery credential).

[0;32m[OK][0m ROTATE-RECOVERY-ONLY complete — only root@pam's password changed (and its hub vault); agent, config, root files and guests untouched.
exit=0
== after
demo-hp-bb76ea HTTP 200 user root@pam set_at 2026-10-18T10:43:33Z password_len 32 keys ['host_id', 'set_at', 'username']
PVE ticket with the new value: 200
PVE ticket with the old value: 401
values differ: yes
