Night 2026-10-14: 09 §3 decisions 244-245 (R-1033 P1; drive events option A); https-only spike evidence (box keys lack Zone Settings; X-Forwarded-Proto measured through the tunnel; traefik redirect proven on the bench)

2026-10-14 22:37:54 +02:00
parent 5a03fd4a57
commit 0144be8cdd
6 changed files with 122 additions and 0 deletions
@@ -915,6 +915,14 @@ its length, and both fixes cost something the household would notice — operato
 127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer.
     *Operator ruling 2026-10-05.* (R-861)

+### 2026-10-14 (22:13) — https-only is P1; drive events = option A (recorded before the night run)
+
+244. **R-1033 is P1.** Every public name of every box must answer only over https; plain `http://` (login pages
+     included) lets a password travel unencrypted to Cloudflare. *Operator ruling 2026-10-14 22:13.*
+245. **Drive events = option A.** On a drive added, removed or back, the box restarts the media apps; it makes a new
+     drive ready inside each media app; it pauses torrents before a safe removal; and it adds guards only where a
+     measurement shows loss. *Operator ruling 2026-10-14 22:13.* (R-1023; `15-media-library.md` §10)
+
 ### 2026-10-14 (evening, ~21:20) — the media folders and the N100 (recorded before the work; the media-folder-fix brief)

 242. **D9 = A, with a limit.** The media apps keep today's `media` folder — nothing on a drive moves. Sonarr and Radarr
@@ -0,0 +1,24 @@
+== tester-1: domain=enkicsifelhom.hu token present=True length=53
+   verify -> 200 status=active
+   zones the key sees -> 200: [('enkicsifelhom.hu', "Nagyfenyvesi.viktor@gmail.com's Account", 'active')]
+   GET always_use_https -> 403 value=null editable=None ['Authentication error']
+   GET ssl -> 403 value=null editable=None ['Unauthorized to access requested resource']
+   GET security_header -> 403 value=null editable=None ['Unauthorized to access requested resource']
+   GET min_tls_version -> 403 value=null editable=None ['Unauthorized to access requested resource']
+   GET automatic_https_rewrites -> 403 value=null editable=None ['Authentication error']
+== demo-hp: domain=enkisfelhom.hu token present=True length=53
+   verify -> 200 status=active
+   zones the key sees -> 200: [('enkisfelhom.hu', "Nagyfenyvesi.viktor@gmail.com's Account", 'active')]
+   GET always_use_https -> 403 value=null editable=None ['Authentication error']
+   GET ssl -> 403 value=null editable=None ['Unauthorized to access requested resource']
+   GET security_header -> 403 value=null editable=None ['Unauthorized to access requested resource']
+   GET min_tls_version -> 403 value=null editable=None ['Unauthorized to access requested resource']
+   GET automatic_https_rewrites -> 403 value=null editable=None ['Authentication error']
+== demo-felhom: domain=demo-felhom.eu token present=True length=53
+   verify -> 200 status=active
+   zones the key sees -> 200: [('demo-felhom.eu', "Nagyfenyvesi.viktor@gmail.com's Account", 'active')]
+   GET always_use_https -> 403 value=null editable=None ['Authentication error']
+   GET ssl -> 403 value=null editable=None ['Unauthorized to access requested resource']
+   GET security_header -> 403 value=null editable=None ['Unauthorized to access requested resource']
+   GET min_tls_version -> 403 value=null editable=None ['Unauthorized to access requested resource']
+   GET automatic_https_rewrites -> 403 value=null editable=None ['Authentication error']
@@ -0,0 +1,22 @@
+# 1A-2 — what the app behind traefik receives (throwaway traefik/whoami on Tester 1, public name xfp-echo.enkicsifelhom.hu) 2026-10-14T22:25:01+02:00
+== https://xfp-echo.enkicsifelhom.hu/p?q=1
+HTTP/2 200 
+Hostname: 0ec23dad2648
+Host: xfp-echo.enkicsifelhom.hu
+Cf-Connecting-Ip: <a public address>
+Cf-Visitor: {"scheme":"https"}
+X-Forwarded-For: <a public address>
+X-Forwarded-Port: 443
+X-Forwarded-Proto: https
+X-Real-Ip: <a public address>
+== http://xfp-echo.enkicsifelhom.hu/p?q=1
+HTTP/1.1 200 OK
+Hostname: 0ec23dad2648
+Host: xfp-echo.enkicsifelhom.hu
+Cf-Connecting-Ip: <a public address>
+Cf-Visitor: {"scheme":"http"}
+X-Forwarded-For: <a public address>
+X-Forwarded-Port: 443
+X-Forwarded-Proto: http
+X-Real-Ip: <a public address>
+echo container removed: 0 left
@@ -0,0 +1,13 @@
+# 1A-3 / 1A-4  2026-10-14T22:25:16+02:00
+== Sonarr behind https: the redirect it builds
+HTTP/2 302 
+location: http://sonarr.enkicsifelhom.hu/login?returnUrl=%2F
+== Sonarr's own setting that decides whom it believes:
+<AuthenticationRequired>Enabled
+<TrustedNetworks>192.168.0.0/24
+traefik on: 172.16.253.3 172.18.0.10 
+== LAN path: http://<guest address>/ with a Host header (port 80, traefik web entrypoint)
+HTTP/1.1 301 Moved Permanently
+Location: https://felhom.enkicsifelhom.hu/login
+== LAN path, https port: the HSTS header today
+HTTP/2 200 
@@ -0,0 +1,18 @@
+== tester-1 enkicsifelhom.hu
+   GET rulesets -> 200: [('http_request_sanitize', 'managed', 'Cloudflare Normalization Ruleset'), ('http_request_firewall_managed', 'managed', 'Cloudflare Managed Free Ruleset'), ('ddos_l7', 'managed', 'DDoS L7 ruleset')] []
+   GET phase http_request_firewall_custom       -> 404 rules=0 ['could not find entrypoint ruleset in the http_request_firewall_custom phase']
+   GET phase http_request_dynamic_redirect      -> 403 rules=0 ['request is not authorized']
+   GET phase http_response_headers_transform    -> 403 rules=0 ['request is not authorized']
+   GET phase http_request_redirect              -> 400 rules=0 ['phase "http_request_redirect" not allowed at zone level']
+== demo-hp enkisfelhom.hu
+   GET rulesets -> 200: [('http_request_sanitize', 'managed', 'Cloudflare Normalization Ruleset'), ('http_request_firewall_managed', 'managed', 'Cloudflare Managed Free Ruleset'), ('ddos_l7', 'managed', 'DDoS L7 ruleset'), ('http_request_firewall_custom', 'zone', 'felhom custom rules')] []
+   GET phase http_request_firewall_custom       -> 200 rules=1 []
+   GET phase http_request_dynamic_redirect      -> 403 rules=0 ['request is not authorized']
+   GET phase http_response_headers_transform    -> 403 rules=0 ['request is not authorized']
+   GET phase http_request_redirect              -> 400 rules=0 ['phase "http_request_redirect" not allowed at zone level']
+== demo-felhom demo-felhom.eu
+   GET rulesets -> 200: [('http_request_sanitize', 'managed', 'Cloudflare Normalization Ruleset'), ('http_request_firewall_managed', 'managed', 'Cloudflare Managed Free Ruleset'), ('ddos_l7', 'managed', 'DDoS L7 ruleset'), ('http_request_firewall_custom', 'zone', 'felhom custom rules')] []
+   GET phase http_request_firewall_custom       -> 200 rules=1 []
+   GET phase http_request_dynamic_redirect      -> 403 rules=0 ['request is not authorized']
+   GET phase http_response_headers_transform    -> 403 rules=0 ['request is not authorized']
+   GET phase http_request_redirect              -> 400 rules=0 ['phase "http_request_redirect" not allowed at zone level']
@@ -0,0 +1,37 @@
+Unable to find image 'traefik/whoami:v1.10.3' locally
+v1.10.3: Pulling from traefik/whoami
+0b8c4591162f: Pulling fs layer
+733db08f86a6: Pulling fs layer
+a5d67c72e18d: Pulling fs layer
+0b8c4591162f: Download complete
+733db08f86a6: Verifying Checksum
+733db08f86a6: Download complete
+a5d67c72e18d: Verifying Checksum
+a5d67c72e18d: Download complete
+0b8c4591162f: Pull complete
+733db08f86a6: Pull complete
+a5d67c72e18d: Pull complete
+Digest: sha256:43a68d10b9dfcfc3ffbfe4dd42100dc9aeaf29b3a5636c856337a5940f1b4f1c
+Status: Downloaded newer image for traefik/whoami:v1.10.3
+Unable to find image 'traefik:v3.7.13' locally
+v3.7.13: Pulling from library/traefik
+e2de96513ba9: Already exists
+b686a4f73445: Pulling fs layer
+78cb21c375ca: Pulling fs layer
+acb2f33459b1: Pulling fs layer
+acb2f33459b1: Verifying Checksum
+acb2f33459b1: Download complete
+b686a4f73445: Download complete
+b686a4f73445: Pull complete
+78cb21c375ca: Verifying Checksum
+78cb21c375ca: Download complete
+78cb21c375ca: Pull complete
+acb2f33459b1: Pull complete
+Digest: sha256:24841fe2de7304c149343d877d2923b4c8800a38ba015dea9174c23b20e344a0
+Status: Downloaded newer image for traefik:v3.7.13
+trusted peer (like cloudflared), XFP=http,  /p?q=1 -> HTTP/2 301  location: https://app.example.test/p?q=1 
+trusted peer,                    XFP=https, /p?q=1 -> HTTP/2 200  strict-transport-security: max-age=86400 
+trusted peer,                    no XFP,    /p?q=1 -> HTTP/2 200  strict-transport-security: max-age=86400 
+UNtrusted peer (LAN, a container), XFP=http (must be ignored) -> HTTP/2 200  strict-transport-security: max-age=86400 
+trusted peer, XFP=http, a name with no route -> HTTP/2 404  
+cleaned: 0