diff --git a/documentation/architecture/09-update-architecture.md b/documentation/architecture/09-update-architecture.md index d16b5c9c..7e304ab5 100644 --- a/documentation/architecture/09-update-architecture.md +++ b/documentation/architecture/09-update-architecture.md @@ -915,6 +915,14 @@ its length, and both fixes cost something the household would notice — operato 127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer. *Operator ruling 2026-10-05.* (R-861) +### 2026-10-14 (22:13) — https-only is P1; drive events = option A (recorded before the night run) + +244. **R-1033 is P1.** Every public name of every box must answer only over https; plain `http://` (login pages + included) lets a password travel unencrypted to Cloudflare. *Operator ruling 2026-10-14 22:13.* +245. **Drive events = option A.** On a drive added, removed or back, the box restarts the media apps; it makes a new + drive ready inside each media app; it pauses torrents before a safe removal; and it adds guards only where a + measurement shows loss. *Operator ruling 2026-10-14 22:13.* (R-1023; `15-media-library.md` §10) + ### 2026-10-14 (evening, ~21:20) — the media folders and the N100 (recorded before the work; the media-folder-fix brief) 242. **D9 = A, with a limit.** The media apps keep today's `media` folder — nothing on a drive moves. Sonarr and Radarr diff --git a/documentation/audits/https-only-2026-10-14/1A-1-zones-and-keys.txt b/documentation/audits/https-only-2026-10-14/1A-1-zones-and-keys.txt new file mode 100644 index 00000000..01610e6f --- /dev/null +++ b/documentation/audits/https-only-2026-10-14/1A-1-zones-and-keys.txt @@ -0,0 +1,24 @@ +== tester-1: domain=enkicsifelhom.hu token present=True length=53 + verify -> 200 status=active + zones the key sees -> 200: [('enkicsifelhom.hu', "Nagyfenyvesi.viktor@gmail.com's Account", 'active')] + GET always_use_https -> 403 value=null editable=None ['Authentication error'] + GET ssl -> 403 value=null editable=None ['Unauthorized to access requested resource'] + GET security_header -> 403 value=null editable=None ['Unauthorized to access requested resource'] + GET min_tls_version -> 403 value=null editable=None ['Unauthorized to access requested resource'] + GET automatic_https_rewrites -> 403 value=null editable=None ['Authentication error'] +== demo-hp: domain=enkisfelhom.hu token present=True length=53 + verify -> 200 status=active + zones the key sees -> 200: [('enkisfelhom.hu', "Nagyfenyvesi.viktor@gmail.com's Account", 'active')] + GET always_use_https -> 403 value=null editable=None ['Authentication error'] + GET ssl -> 403 value=null editable=None ['Unauthorized to access requested resource'] + GET security_header -> 403 value=null editable=None ['Unauthorized to access requested resource'] + GET min_tls_version -> 403 value=null editable=None ['Unauthorized to access requested resource'] + GET automatic_https_rewrites -> 403 value=null editable=None ['Authentication error'] +== demo-felhom: domain=demo-felhom.eu token present=True length=53 + verify -> 200 status=active + zones the key sees -> 200: [('demo-felhom.eu', "Nagyfenyvesi.viktor@gmail.com's Account", 'active')] + GET always_use_https -> 403 value=null editable=None ['Authentication error'] + GET ssl -> 403 value=null editable=None ['Unauthorized to access requested resource'] + GET security_header -> 403 value=null editable=None ['Unauthorized to access requested resource'] + GET min_tls_version -> 403 value=null editable=None ['Unauthorized to access requested resource'] + GET automatic_https_rewrites -> 403 value=null editable=None ['Authentication error'] diff --git a/documentation/audits/https-only-2026-10-14/1A-2-xfp-echo.txt b/documentation/audits/https-only-2026-10-14/1A-2-xfp-echo.txt new file mode 100644 index 00000000..bd83d5f0 --- /dev/null +++ b/documentation/audits/https-only-2026-10-14/1A-2-xfp-echo.txt @@ -0,0 +1,22 @@ +# 1A-2 — what the app behind traefik receives (throwaway traefik/whoami on Tester 1, public name xfp-echo.enkicsifelhom.hu) 2026-10-14T22:25:01+02:00 +== https://xfp-echo.enkicsifelhom.hu/p?q=1 +HTTP/2 200 +Hostname: 0ec23dad2648 +Host: xfp-echo.enkicsifelhom.hu +Cf-Connecting-Ip: +Cf-Visitor: {"scheme":"https"} +X-Forwarded-For: +X-Forwarded-Port: 443 +X-Forwarded-Proto: https +X-Real-Ip: +== http://xfp-echo.enkicsifelhom.hu/p?q=1 +HTTP/1.1 200 OK +Hostname: 0ec23dad2648 +Host: xfp-echo.enkicsifelhom.hu +Cf-Connecting-Ip: +Cf-Visitor: {"scheme":"http"} +X-Forwarded-For: +X-Forwarded-Port: 443 +X-Forwarded-Proto: http +X-Real-Ip: +echo container removed: 0 left diff --git a/documentation/audits/https-only-2026-10-14/1A-3-4.txt b/documentation/audits/https-only-2026-10-14/1A-3-4.txt new file mode 100644 index 00000000..e04c3ffd --- /dev/null +++ b/documentation/audits/https-only-2026-10-14/1A-3-4.txt @@ -0,0 +1,13 @@ +# 1A-3 / 1A-4 2026-10-14T22:25:16+02:00 +== Sonarr behind https: the redirect it builds +HTTP/2 302 +location: http://sonarr.enkicsifelhom.hu/login?returnUrl=%2F +== Sonarr's own setting that decides whom it believes: +Enabled +192.168.0.0/24 +traefik on: 172.16.253.3 172.18.0.10 +== LAN path: http:/// with a Host header (port 80, traefik web entrypoint) +HTTP/1.1 301 Moved Permanently +Location: https://felhom.enkicsifelhom.hu/login +== LAN path, https port: the HSTS header today +HTTP/2 200 diff --git a/documentation/audits/https-only-2026-10-14/1A-5-ruleset-phases.txt b/documentation/audits/https-only-2026-10-14/1A-5-ruleset-phases.txt new file mode 100644 index 00000000..d67c4b30 --- /dev/null +++ b/documentation/audits/https-only-2026-10-14/1A-5-ruleset-phases.txt @@ -0,0 +1,18 @@ +== tester-1 enkicsifelhom.hu + GET rulesets -> 200: [('http_request_sanitize', 'managed', 'Cloudflare Normalization Ruleset'), ('http_request_firewall_managed', 'managed', 'Cloudflare Managed Free Ruleset'), ('ddos_l7', 'managed', 'DDoS L7 ruleset')] [] + GET phase http_request_firewall_custom -> 404 rules=0 ['could not find entrypoint ruleset in the http_request_firewall_custom phase'] + GET phase http_request_dynamic_redirect -> 403 rules=0 ['request is not authorized'] + GET phase http_response_headers_transform -> 403 rules=0 ['request is not authorized'] + GET phase http_request_redirect -> 400 rules=0 ['phase "http_request_redirect" not allowed at zone level'] +== demo-hp enkisfelhom.hu + GET rulesets -> 200: [('http_request_sanitize', 'managed', 'Cloudflare Normalization Ruleset'), ('http_request_firewall_managed', 'managed', 'Cloudflare Managed Free Ruleset'), ('ddos_l7', 'managed', 'DDoS L7 ruleset'), ('http_request_firewall_custom', 'zone', 'felhom custom rules')] [] + GET phase http_request_firewall_custom -> 200 rules=1 [] + GET phase http_request_dynamic_redirect -> 403 rules=0 ['request is not authorized'] + GET phase http_response_headers_transform -> 403 rules=0 ['request is not authorized'] + GET phase http_request_redirect -> 400 rules=0 ['phase "http_request_redirect" not allowed at zone level'] +== demo-felhom demo-felhom.eu + GET rulesets -> 200: [('http_request_sanitize', 'managed', 'Cloudflare Normalization Ruleset'), ('http_request_firewall_managed', 'managed', 'Cloudflare Managed Free Ruleset'), ('ddos_l7', 'managed', 'DDoS L7 ruleset'), ('http_request_firewall_custom', 'zone', 'felhom custom rules')] [] + GET phase http_request_firewall_custom -> 200 rules=1 [] + GET phase http_request_dynamic_redirect -> 403 rules=0 ['request is not authorized'] + GET phase http_response_headers_transform -> 403 rules=0 ['request is not authorized'] + GET phase http_request_redirect -> 400 rules=0 ['phase "http_request_redirect" not allowed at zone level'] diff --git a/documentation/audits/https-only-2026-10-14/1A-6-traefik-redirect-bench.txt b/documentation/audits/https-only-2026-10-14/1A-6-traefik-redirect-bench.txt new file mode 100644 index 00000000..7a70f51d --- /dev/null +++ b/documentation/audits/https-only-2026-10-14/1A-6-traefik-redirect-bench.txt @@ -0,0 +1,37 @@ +Unable to find image 'traefik/whoami:v1.10.3' locally +v1.10.3: Pulling from traefik/whoami +0b8c4591162f: Pulling fs layer +733db08f86a6: Pulling fs layer +a5d67c72e18d: Pulling fs layer +0b8c4591162f: Download complete +733db08f86a6: Verifying Checksum +733db08f86a6: Download complete +a5d67c72e18d: Verifying Checksum +a5d67c72e18d: Download complete +0b8c4591162f: Pull complete +733db08f86a6: Pull complete +a5d67c72e18d: Pull complete +Digest: sha256:43a68d10b9dfcfc3ffbfe4dd42100dc9aeaf29b3a5636c856337a5940f1b4f1c +Status: Downloaded newer image for traefik/whoami:v1.10.3 +Unable to find image 'traefik:v3.7.13' locally +v3.7.13: Pulling from library/traefik +e2de96513ba9: Already exists +b686a4f73445: Pulling fs layer +78cb21c375ca: Pulling fs layer +acb2f33459b1: Pulling fs layer +acb2f33459b1: Verifying Checksum +acb2f33459b1: Download complete +b686a4f73445: Download complete +b686a4f73445: Pull complete +78cb21c375ca: Verifying Checksum +78cb21c375ca: Download complete +78cb21c375ca: Pull complete +acb2f33459b1: Pull complete +Digest: sha256:24841fe2de7304c149343d877d2923b4c8800a38ba015dea9174c23b20e344a0 +Status: Downloaded newer image for traefik:v3.7.13 +trusted peer (like cloudflared), XFP=http, /p?q=1 -> HTTP/2 301 location: https://app.example.test/p?q=1 +trusted peer, XFP=https, /p?q=1 -> HTTP/2 200 strict-transport-security: max-age=86400 +trusted peer, no XFP, /p?q=1 -> HTTP/2 200 strict-transport-security: max-age=86400 +UNtrusted peer (LAN, a container), XFP=http (must be ignored) -> HTTP/2 200 strict-transport-security: max-age=86400 +trusted peer, XFP=http, a name with no route -> HTTP/2 404 +cleaned: 0