From 03df4c82201cbd8dc64e8f521989b77066628cac Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 28 Sep 2026 09:45:17 +0200 Subject: [PATCH] audits: golden 0.276.0 baked, vouched with agent 0.137.0; Day-0 test install; demo-hp thin-pool reclaim numbers (R-701) Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- .../phaseA-bake-ATTEMPT1-aborted.log | 19 ++ .../phaseA-bake-full.log | 322 ++++++++++++++++++ .../phaseA-day0-install.txt | 98 ++++++ .../phaseA-day0-installer.log | 119 +++++++ .../phaseA-golden-bake-ATTEMPT1-aborted.txt | 29 ++ .../phaseA-golden-bake.txt | 32 ++ .../phaseA-vouch.txt | 17 + .../phaseD1-reclaim.txt | 118 +++++++ .../tests/golden-0.276.0-2026-09-28/README.md | 23 ++ .../tests/golden-0.276.0-2026-09-28/bake.log | 322 ++++++++++++++++++ 10 files changed, 1099 insertions(+) create mode 100644 documentation/audits/evidence-golden-0276-2026-09-28/phaseA-bake-ATTEMPT1-aborted.log create mode 100644 documentation/audits/evidence-golden-0276-2026-09-28/phaseA-bake-full.log create mode 100644 documentation/audits/evidence-golden-0276-2026-09-28/phaseA-day0-install.txt create mode 100644 documentation/audits/evidence-golden-0276-2026-09-28/phaseA-day0-installer.log create mode 100644 documentation/audits/evidence-golden-0276-2026-09-28/phaseA-golden-bake-ATTEMPT1-aborted.txt create mode 100644 documentation/audits/evidence-golden-0276-2026-09-28/phaseA-golden-bake.txt create mode 100644 documentation/audits/evidence-golden-0276-2026-09-28/phaseA-vouch.txt create mode 100644 documentation/audits/evidence-golden-0276-2026-09-28/phaseD1-reclaim.txt create mode 100644 documentation/tests/golden-0.276.0-2026-09-28/README.md create mode 100644 documentation/tests/golden-0.276.0-2026-09-28/bake.log diff --git a/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-bake-ATTEMPT1-aborted.log b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-bake-ATTEMPT1-aborted.log new file mode 100644 index 00000000..a395f3bc --- /dev/null +++ b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-bake-ATTEMPT1-aborted.log @@ -0,0 +1,19 @@ +[golden] build-golden.sh v3.0.0 — baking controller gitea.dooplex.hu/admin/felhom-controller:0.276.0 +[golden] creating build LXC 9100 (nesting=1,keyctl=1, unprivileged; rootfs 32G + ONE data volume 24G @ /var/lib/felhom, backup=1) … + Logical volume "vm-9100-disk-0" created. + Logical volume pve/vm-9100-disk-0 changed. +Creating filesystem with 8388608 4k blocks and 2097152 inodes +Filesystem UUID: 8ce45e96-c0a8-4d00-890a-686fb4983b9f +Superblock backups stored on blocks: + 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, + 4096000, 7962624 + Logical volume "vm-9100-disk-1" created. + Logical volume pve/vm-9100-disk-1 changed. +Creating filesystem with 6291456 4k blocks and 1572864 inodes +Filesystem UUID: fec91df6-cc03-4af0-ae75-c07a9291f205 +Superblock backups stored on blocks: + 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, +extracting archive '/var/lib/vz/template/cache/debian-13-standard_13.6-1_arm64.tar.zst' + Logical volume "vm-9100-disk-0" successfully removed. + Logical volume "vm-9100-disk-1" successfully removed. +unable to create CT 9100 - received interrupt diff --git a/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-bake-full.log b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-bake-full.log new file mode 100644 index 00000000..75ff82a8 --- /dev/null +++ b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-bake-full.log @@ -0,0 +1,322 @@ +[golden] build-golden.sh v3.0.0 — baking controller gitea.dooplex.hu/admin/felhom-controller:0.276.0 +[golden] creating build LXC 9100 (nesting=1,keyctl=1, unprivileged; rootfs 32G + ONE data volume 24G @ /var/lib/felhom, backup=1) … + Logical volume "vm-9100-disk-0" created. + Logical volume pve/vm-9100-disk-0 changed. +Creating filesystem with 8388608 4k blocks and 2097152 inodes +Filesystem UUID: c64779db-a243-4147-b881-c0849deed2ec +Superblock backups stored on blocks: + 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, + 4096000, 7962624 + Logical volume "vm-9100-disk-1" created. + Logical volume pve/vm-9100-disk-1 changed. +Creating filesystem with 6291456 4k blocks and 1572864 inodes +Filesystem UUID: 56347c2a-e551-4fa8-a545-2730dee1cf35 +Superblock backups stored on blocks: + 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, +extracting archive '/var/lib/vz/template/cache/debian-13-standard_13.6-1_amd64.tar.zst' +Total bytes read: 553512960 (528MiB, 99MiB/s) +Detected container architecture: amd64 +Creating SSH host key 'ssh_host_ed25519_key' - this may take some time ... +done: SHA256:PsR1PU2mkORG3CivPB1Stfxvqwdf/QFQKrkV//XsCxM root@felhom-golden +Creating SSH host key 'ssh_host_rsa_key' - this may take some time ... +done: SHA256:TQ/uh4UC2ER8Zns09RsE1JKalcrZ0NAagjoHBhh5kCE root@felhom-golden +Creating SSH host key 'ssh_host_ecdsa_key' - this may take some time ... +done: SHA256:wrzsFK4uVo8VraL66qO95u3GZOxIZb3twi0l216mEqk root@felhom-golden +[golden] starting + installing Docker (official repo, trixie channel) … +apt-listchanges: Can't set locale; make sure $LC_* and $LANG are correct! +perl: warning: Setting locale failed. +perl: warning: Please check that your locale settings: + LANGUAGE = (unset), + LC_ALL = (unset), + LC_CTYPE = (unset), + LC_NUMERIC = (unset), + LC_COLLATE = (unset), + LC_TIME = (unset), + LC_MESSAGES = (unset), + LC_MONETARY = (unset), + LC_ADDRESS = (unset), + LC_IDENTIFICATION = (unset), + LC_MEASUREMENT = (unset), + LC_PAPER = (unset), + LC_TELEPHONE = (unset), + LC_NAME = (unset), + LANG = "en_US.UTF-8" + are supported and installed on your system. +perl: warning: Falling back to the standard locale ("C"). +locale: Cannot set LC_CTYPE to default locale: No such file or directory +locale: Cannot set LC_MESSAGES to default locale: No such file or directory +locale: Cannot set LC_ALL to default locale: No such file or directory +apt-listchanges: Can't set locale; make sure $LC_* and $LANG are correct! +perl: warning: Setting locale failed. +perl: warning: Please check that your locale settings: + LANGUAGE = (unset), + LC_ALL = (unset), + LC_CTYPE = (unset), + LC_NUMERIC = (unset), + LC_COLLATE = (unset), + LC_TIME = (unset), + LC_MESSAGES = (unset), + LC_MONETARY = (unset), + LC_ADDRESS = (unset), + LC_IDENTIFICATION = (unset), + LC_MEASUREMENT = (unset), + LC_PAPER = (unset), + LC_TELEPHONE = (unset), + LC_NAME = (unset), + LANG = "en_US.UTF-8" + are supported and installed on your system. +perl: warning: Falling back to the standard locale ("C"). +locale: Cannot set LC_CTYPE to default locale: No such file or directory +locale: Cannot set LC_MESSAGES to default locale: No such file or directory +locale: Cannot set LC_ALL to default locale: No such file or directory +[golden] baking daemon.json: classic overlay2 driver (containerd-snapshotter OFF) + log rotation … +[golden] wiring the single data volume (R-165 variant V-c): /var/lib/felhom/{docker,sys_drive} -> binds … +[golden] verifying Docker works in the build guest (storage driver should be overlay2 on the ext4 data volume) … +Unable to find image 'hello-world:latest' locally +latest: Pulling from library/hello-world +4f55086f7dd0: Pulling fs layer +4f55086f7dd0: Verifying Checksum +4f55086f7dd0: Download complete +4f55086f7dd0: Pull complete +Digest: sha256:5e23090353324d887c48ad5e5c56d294eab81588df9605b07d1afe895f9cc8f8 +Status: Downloaded newer image for hello-world:latest + docker OK (overlay2; data-root /var/lib/docker) + /var/lib/docker is a real mount: /dev/mapper/pve-vm--9100--disk--1[/docker] ext4 + /mnt/sys_drive is a real mount: /dev/mapper/pve-vm--9100--disk--1[/sys_drive] ext4 + both paths are ONE filesystem: /dev/mapper/pve-vm--9100--disk--1 23317576 +[golden] baking the in-guest controller image gitea.dooplex.hu/admin/felhom-controller:0.276.0 (no registry cred at deploy) … + +WARNING! Your credentials are stored unencrypted in '/root/.docker/config.json'. +Configure a credential helper to remove this warning. See +https://docs.docker.com/go/credential-store/ + +0.276.0: Pulling from admin/felhom-controller +a8ac7f6c67ab: Pulling fs layer +bf30769d36e7: Pulling fs layer +044b66fbe46c: Pulling fs layer +b5c41a28e83f: Pulling fs layer +b4ded44ea1b4: Pulling fs layer +259199823aa4: Pulling fs layer +b5c41a28e83f: Waiting +b4ded44ea1b4: Waiting +259199823aa4: Waiting +a8ac7f6c67ab: Verifying Checksum +a8ac7f6c67ab: Download complete +044b66fbe46c: Verifying Checksum +044b66fbe46c: Download complete +b5c41a28e83f: Verifying Checksum +b5c41a28e83f: Download complete +b4ded44ea1b4: Verifying Checksum +b4ded44ea1b4: Download complete +259199823aa4: Verifying Checksum +259199823aa4: Download complete +bf30769d36e7: Verifying Checksum +bf30769d36e7: Download complete +a8ac7f6c67ab: Pull complete +bf30769d36e7: Pull complete +044b66fbe46c: Pull complete +b5c41a28e83f: Pull complete +b4ded44ea1b4: Pull complete +259199823aa4: Pull complete +Digest: sha256:2645eeef513ea8f4384053f10fb0a89e5022ba71b22595dff575e1261100cae0 +Status: Downloaded newer image for gitea.dooplex.hu/admin/felhom-controller:0.276.0 +gitea.dooplex.hu/admin/felhom-controller:0.276.0 +[golden] asking the controller which infra images it manages … +[golden] baking infra images (4): traefik:v3.6.7 cloudflare/cloudflared:2026.6.0 gtstef/filebrowser:1.3.3-stable gitea.dooplex.hu/admin/felhom-samba:1.1.0 … +v3.6.7: Pulling from library/traefik +589002ba0eae: Pulling fs layer +ef63511ea6cc: Pulling fs layer +0738e5cb835e: Pulling fs layer +3e6813f70c64: Pulling fs layer +3e6813f70c64: Waiting +589002ba0eae: Verifying Checksum +589002ba0eae: Download complete +ef63511ea6cc: Verifying Checksum +ef63511ea6cc: Download complete +3e6813f70c64: Verifying Checksum +3e6813f70c64: Download complete +589002ba0eae: Pull complete +0738e5cb835e: Verifying Checksum +0738e5cb835e: Download complete +ef63511ea6cc: Pull complete +0738e5cb835e: Pull complete +3e6813f70c64: Pull complete +Digest: sha256:a9890c898f379c1905ee5b28342f6b408dc863f08db2dab20e46c267d1ff463a +Status: Downloaded newer image for traefik:v3.6.7 +docker.io/library/traefik:v3.6.7 +2026.6.0: Pulling from cloudflare/cloudflared +47de5dd0b812: Pulling fs layer +c172f21841df: Pulling fs layer +99515e7b4d35: Pulling fs layer +99ba982a9142: Pulling fs layer +d6b1b89eccac: Pulling fs layer +2780920e5dbf: Pulling fs layer +7c12895b777b: Pulling fs layer +3214acf345c0: Pulling fs layer +52630fc75a18: Pulling fs layer +dd64bf2dd177: Pulling fs layer +b839dfae01f6: Pulling fs layer +ebddc55facdc: Pulling fs layer +bdfd7f7e5bf6: Pulling fs layer +2d4d7adf6272: Pulling fs layer +40008157d8d2: Pulling fs layer +bd8962e29291: Pulling fs layer +cac2ae0193cb: Pulling fs layer +74d1dac84ecc: Pulling fs layer +99ba982a9142: Waiting +d6b1b89eccac: Waiting +2780920e5dbf: Waiting +7c12895b777b: Waiting +3214acf345c0: Waiting +52630fc75a18: Waiting +dd64bf2dd177: Waiting +b839dfae01f6: Waiting +ebddc55facdc: Waiting +bdfd7f7e5bf6: Waiting +2d4d7adf6272: Waiting +40008157d8d2: Waiting +bd8962e29291: Waiting +cac2ae0193cb: Waiting +74d1dac84ecc: Waiting +99515e7b4d35: Verifying Checksum +99515e7b4d35: Download complete +c172f21841df: Download complete +47de5dd0b812: Download complete +99ba982a9142: Verifying Checksum +99ba982a9142: Download complete +d6b1b89eccac: Verifying Checksum +d6b1b89eccac: Download complete +2780920e5dbf: Verifying Checksum +2780920e5dbf: Download complete +7c12895b777b: Verifying Checksum +7c12895b777b: Download complete +47de5dd0b812: Pull complete +52630fc75a18: Verifying Checksum +52630fc75a18: Download complete +3214acf345c0: Verifying Checksum +3214acf345c0: Download complete +dd64bf2dd177: Verifying Checksum +dd64bf2dd177: Download complete +ebddc55facdc: Verifying Checksum +ebddc55facdc: Download complete +b839dfae01f6: Verifying Checksum +b839dfae01f6: Download complete +bdfd7f7e5bf6: Download complete +c172f21841df: Pull complete +40008157d8d2: Verifying Checksum +40008157d8d2: Download complete +bd8962e29291: Download complete +2d4d7adf6272: Verifying Checksum +2d4d7adf6272: Download complete +cac2ae0193cb: Verifying Checksum +cac2ae0193cb: Download complete +74d1dac84ecc: Verifying Checksum +74d1dac84ecc: Download complete +99515e7b4d35: Pull complete +99ba982a9142: Pull complete +d6b1b89eccac: Pull complete +2780920e5dbf: Pull complete +7c12895b777b: Pull complete +3214acf345c0: Pull complete +52630fc75a18: Pull complete +dd64bf2dd177: Pull complete +b839dfae01f6: Pull complete +ebddc55facdc: Pull complete +bdfd7f7e5bf6: Pull complete +2d4d7adf6272: Pull complete +40008157d8d2: Pull complete +bd8962e29291: Pull complete +cac2ae0193cb: Pull complete +74d1dac84ecc: Pull complete +Digest: sha256:ba461b8aa9c042156dbd39c38657fe7431bafa063220eab8d5330a523863da9f +Status: Downloaded newer image for cloudflare/cloudflared:2026.6.0 +docker.io/cloudflare/cloudflared:2026.6.0 +1.3.3-stable: Pulling from gtstef/filebrowser +6a0ac1617861: Pulling fs layer +ef8806083e82: Pulling fs layer +b74107c861c7: Pulling fs layer +adc935def003: Pulling fs layer +4f4fb700ef54: Pulling fs layer +18695ccc900a: Pulling fs layer +45d119d5c397: Pulling fs layer +dac52db4fc51: Pulling fs layer +6d598f86b2f2: Pulling fs layer +8aa349c8396c: Pulling fs layer +adc935def003: Waiting +4f4fb700ef54: Waiting +18695ccc900a: Waiting +dac52db4fc51: Waiting +45d119d5c397: Waiting +6d598f86b2f2: Waiting +8aa349c8396c: Waiting +b74107c861c7: Verifying Checksum +b74107c861c7: Download complete +adc935def003: Verifying Checksum +adc935def003: Download complete +4f4fb700ef54: Verifying Checksum +4f4fb700ef54: Download complete +18695ccc900a: Verifying Checksum +18695ccc900a: Download complete +45d119d5c397: Download complete +dac52db4fc51: Verifying Checksum +dac52db4fc51: Download complete +6d598f86b2f2: Verifying Checksum +6d598f86b2f2: Download complete +8aa349c8396c: Verifying Checksum +8aa349c8396c: Download complete +6a0ac1617861: Verifying Checksum +6a0ac1617861: Download complete +6a0ac1617861: Pull complete +ef8806083e82: Download complete +ef8806083e82: Pull complete +b74107c861c7: Pull complete +adc935def003: Pull complete +4f4fb700ef54: Pull complete +18695ccc900a: Pull complete +45d119d5c397: Pull complete +dac52db4fc51: Pull complete +6d598f86b2f2: Pull complete +8aa349c8396c: Pull complete +Digest: sha256:eb3733681db8757412632c61a99ad656f0d94ed6781bb2ea114b4d70babab78c +Status: Downloaded newer image for gtstef/filebrowser:1.3.3-stable +docker.io/gtstef/filebrowser:1.3.3-stable +1.1.0: Pulling from admin/felhom-samba +897d797d2723: Pulling fs layer +3051591aa250: Pulling fs layer +ce57a3f93416: Pulling fs layer +fb94eeec2fe1: Pulling fs layer +fb94eeec2fe1: Waiting +ce57a3f93416: Verifying Checksum +ce57a3f93416: Download complete +fb94eeec2fe1: Verifying Checksum +fb94eeec2fe1: Download complete +897d797d2723: Verifying Checksum +897d797d2723: Download complete +3051591aa250: Download complete +897d797d2723: Pull complete +3051591aa250: Pull complete +ce57a3f93416: Pull complete +fb94eeec2fe1: Pull complete +Digest: sha256:1c17c09422bec0366d7cf0e0fcfc1486ba6c90334a0a5d5c851073a9342f8f10 +Status: Downloaded newer image for gitea.dooplex.hu/admin/felhom-samba:1.1.0 +gitea.dooplex.hu/admin/felhom-samba:1.1.0 +[golden] baking the controller-bootstrap unit (deploys the BAKED controller from the config mount) … +Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-controller-bootstrap.service' → '/etc/systemd/system/felhom-controller-bootstrap.service'. +[golden] baking the controller-bootstrap PATH unit (starts the service on bootstrap-mount hot-plug — B1) … +Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-controller-bootstrap.path' → '/etc/systemd/system/felhom-controller-bootstrap.path'. +[golden] baking the first-boot SSH host-key regeneration unit (F3) … +Created symlink '/etc/systemd/system/multi-user.target.wants/felhom-regen-hostkeys.service' → '/etc/systemd/system/felhom-regen-hostkeys.service'. +[golden] identity-clean + minimize … +[golden] stop + archive … +INFO: including mount point rootfs ('/') in backup +INFO: including mount point mp0 ('/var/lib/felhom') in backup +INFO: archive file size: 624MB +INFO: Finished Backup of VM 9100 (00:00:31) +[golden] DONE. golden archive volid: local:backup/vzdump-lxc-9100-2026_09_28-09_33_21.tar.zst (rootfs 32G + ONE data volume 24G @ /var/lib/felhom, all in the archive) +[golden] publishing golden (654383234 bytes, sha256 d8e273930953f400…) → https://gitea.dooplex.hu/api/packages/admin/generic/felhom-golden/0.276.0/golden.tar.zst +[golden] pre-delete existing: HTTP 404 (404/204 expected) +[golden] upload OK (HTTP 201) +GOLDEN_VERSION=0.276.0 +GOLDEN_SHA256=d8e273930953f400afa62b356753d4a99fd9a330cf174436c7096a2307cc4a23 +[golden] Record in the hub operator UI (Configs → Day-0 artifacts): golden 0.276.0 / d8e273930953f400afa62b356753d4a99fd9a330cf174436c7096a2307cc4a23 +[golden] (the build guest 9100 is stopped; destroy it with: pct destroy 9100 --purge) diff --git a/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-day0-install.txt b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-day0-install.txt new file mode 100644 index 00000000..218e2444 --- /dev/null +++ b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-day0-install.txt @@ -0,0 +1,98 @@ +## 2026-09-28T07:37:31Z A4 — scratch customer for the Day-0 test install (hub's own form; no e-mail, DR tier OFF, off-site OFF → no external provisioning) +HTTP/1.1 303 See Other +Location: /customers/drill-g0276?flash=created +2026/09/28 09:37:31 [INFO] Customer config created: drill-g0276 +2026/09/28 09:37:31 [WARN] self-bind link NOT auto-minted for drill-g0276 on customer creation: no registered email address (F1) — set one, then send from the Setup tab +## 2026-09-28T07:38:00Z drill VM: revert to virgin + cold boot (§4.0) + reverted to virgin + cold boot started +perl: warning: Setting locale failed. +perl: warning: Please check that your locale settings: + LANGUAGE = (unset), + LC_ALL = (unset), + LC_CTYPE = "UTF-8", + LC_NUMERIC = (unset), + LC_COLLATE = (unset), + LC_TIME = (unset), + LC_MESSAGES = (unset), + LC_MONETARY = (unset), + LC_ADDRESS = (unset), + LC_IDENTIFICATION = (unset), + LC_MEASUREMENT = (unset), + LC_PAPER = (unset), + LC_TELEPHONE = (unset), + LC_NAME = (unset), + LANG = "en_US.UTF-8" + are supported and installed on your system. +perl: warning: Falling back to a fallback locale ("en_US.UTF-8"). + ssh up: pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve) +SCRIPT_VERSION="1.28.0" # the SINGLE version source (F-1): -h and the run banners follow it. +hub from VM: 302 + 75.93g 0.00 +perl: warning: Setting locale failed. +perl: warning: Please check that your locale settings: + LANGUAGE = (unset), + LC_ALL = (unset), + LC_CTYPE = "UTF-8", + LC_NUMERIC = (unset), + LC_COLLATE = (unset), + LC_TIME = (unset), + LC_MESSAGES = (unset), + LC_MONETARY = (unset), + LC_ADDRESS = (unset), + LC_IDENTIFICATION = (unset), + LC_MEASUREMENT = (unset), + LC_PAPER = (unset), + LC_TELEPHONE = (unset), + LC_NAME = (unset), + LANG = "en_US.UTF-8" + are supported and installed on your system. +perl: warning: Falling back to a fallback locale ("en_US.UTF-8"). +0 + passphrase file landed (file→file, 0600) +## 2026-09-28T07:43:07Z installer log copied off FIRST (119 lines) +[WARN] no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged) +[INFO] manifest: agent v0.137.0 (sha 766c9166916a1bd3…), golden v0.276.0 +[INFO] fetching agent binary v0.137.0 from Gitea … +[OK] verified sha256 766c9166916a1bd3… matches the hub manifest +[WARN] no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged) +[INFO] fetching golden v0.276.0 from Gitea → /var/lib/vz/dump/vzdump-lxc-9100-2026_09_28-09_40_19.tar.zst +[OK] verified sha256 d8e273930953f400… matches the hub manifest +[OK] Day-0 provision SUCCESS — vmid=120 host_id=drill-g0276-b861fc customer=drill-g0276 golden=local:backup/vzdump-lxc-9100-2026_09_28-09_40_19.tar.zst +## the box, read from the box: +felhom-agent 0.137.0 +gitea.dooplex.hu/admin/felhom-controller:0.276.0 +filebrowser gtstef/filebrowser:1.3.3-stable Up 48 seconds (healthy) +felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.276.0 Up 52 seconds (healthy) +traefik traefik:v3.6.7 Up 51 seconds +controller ip 172.17.0.2 +{"ok":true,"message":"felhom-controller is healthy"} + +{"ok":false,"error":"dashboard not yet claimed"} +claim page: 200 +## hub side, 2026-09-28T07:43:26Z: +2026/09/28 09:37:31 [INFO] Customer config created: drill-g0276 +2026/09/28 09:37:31 [WARN] self-bind link NOT auto-minted for drill-g0276 on customer creation: no registered email address (F1) — set one, then send from the Setup tab +2026/09/28 09:38:58 [ERROR] [claim] claim code generated (gen 1) but customer drill-g0276 has NO registered email — deliver via resend after setting one +2026/09/28 09:38:58 [WARN] claim issue for drill-g0276 on config retrieve: claim: customer drill-g0276 has no registered email +2026/09/28 09:38:58 [INFO] Config downloaded for customer drill-g0276 +2026/09/28 09:39:32 [INFO] host enrolled: drill-g0276-b861fc (customer drill-g0276) +2026/09/28 09:39:33 [INFO] vaulted break-glass recovery credential for host drill-g0276-b861fc (user=root@pam, secret 32 chars) +2026/09/28 09:39:35 [INFO] Artifact manifest served for customer drill-g0276 (agent=0.137.0 golden=0.276.0) +2026/09/28 09:39:35 [INFO] Config downloaded for customer drill-g0276 +2026/09/28 09:40:18 [INFO] Config downloaded for customer drill-g0276 +2026/09/28 09:40:18 [INFO] wg registered: host=drill-g0276-b861fc pubkey=Ly0yjK/BwcPQqDdwIhcd2W96UwdPhQsIQ8fY5GcevVQ= ip=10.77.0.5/32 changed=true gen=1 sync=ok +2026/09/28 09:40:18 [INFO] host-report from drill-g0276-b861fc (0 guests, 2 storage targets, 0 backups, 0 restore-tests, 0 pbs-snapshots, 10198 bytes) +2026/09/28 09:40:18 [INFO] DR-recipe host-half stored for customer drill-g0276 (host drill-g0276-b861fc, v1) +2026/09/28 09:41:13 [INFO] restore-test staleness: drill-g0276 local tier: not restore-proven yet, but only watching for 0s (grace 168h0m0s since first contact 2026-09-28T07:40:18Z) — newborn, not a fault +2026/09/28 09:41:58 [INFO] Config downloaded for customer drill-g0276 +2026/09/28 09:42:22 [INFO] Event from drill-g0276: controller_started (info) — Controller elindult (0.276.0) +2026/09/28 09:42:23 [INFO] DR-recipe app-half stored for customer drill-g0276 (v1) +2026/09/28 09:42:23 [INFO] Received report from drill-g0276 (3158 bytes) +2026/09/28 09:42:23 [INFO] managed floor SERVED for drill-g0276: floor 0.276.0, agent requirement "0.131.0" from manifest (golden 0.276.0) + hosts row: drill-g0276-b861fc Golden 0.276.0 drill 0.137.0 ONLINE 0/0 0% 19% 9% inactive 9% local +## 2026-09-28T07:43:39Z teardown layer 1+2 (machine + host): shred passphrase, poweroff, revert to virgin +1 + qemu processes: 0 + disk reverted to virgin + DooPlex copy of the passphrase shredded diff --git a/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-day0-installer.log b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-day0-installer.log new file mode 100644 index 00000000..754a3699 --- /dev/null +++ b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-day0-installer.log @@ -0,0 +1,119 @@ + +[INFO] felhom-host-install v1.28.0 — mode=appliance customer=drill-g0276 vmid=120 + +[STEP] 1/8 pre-flight +[INFO] pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve) +[INFO] node: drill-pve (auto) +[INFO] agent config: /etc/felhom-agent/agent.json +[INFO] agent: not installed yet — will be fetched + installed in step 5/8 +[INFO] local-lvm free: ~75 GiB +[WARN] local-lvm free ~75 GiB < hard min 120 GiB +[INFO] free RAM: ~6255 MiB +[INFO] existing guests on this host: 0 (pct+qm) +[INFO] archive storage 'local' present +[INFO] acl storage 'felhom-pbs' not present yet — expected: the PBS-DR tier creates it; the grant is pre-positioned deliberately +[INFO] dnsmasq: not present before Felhom — recorded; uninstall will remove it again if we install it +[INFO] hub reachable (https://hub.felhom.eu) +[OK] customer 'drill-g0276' exists + passphrase valid +[INFO] golden: none local — will fetch + verify from Gitea in step 7/8 +[OK] pre-flight passed +[STEP] 2/8 Proxmox API token +[OK] token minted (secret captured, not logged) +[OK] scoped ACL applied (Base@/, Guest@/pool/felhom + /vms/990000..990009, Store@[local local-lvm felhom-pbs]) +[SKIP] old broad role FelhomAgent already absent +[STEP] 3/8 compute volume grows +[INFO] auto-computed from ~75 GiB free (ONE volume since R-165) +[INFO] grows: rootfs +0G (->32G), data +46G (->70G, ONE volume) +[STEP] 4/8 host enrollment (POST /host-enroll) +[OK] host MINTED (first enroll) +[INFO] host_id: drill-g0276-b861fc (api_key captured, not logged) +[STEP] 4b/8 break-glass credential (root@pam console password → hub vault) +[OK] root@pam password set + vaulted to the hub (retrieve via the operator /admin path; never logged here) +[WARN] NOTE: the root@pam password just CHANGED — the old one now fails at the PVE web GUI (:8006). +[WARN] Retrieve the new one at hub → host page (vaulted recovery credential). +[STEP] 5/8 agent install (fetch + verify + install) +[INFO] disabled pve-enterprise.sources (Enabled: no) +[INFO] disabled ceph.sources (Enabled: no) +[INFO] added pve-no-subscription.sources (suite=trixie) +[OK] apt repos aligned to no-subscription (changed; apt-get update OK) +[WARN] no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged) +[INFO] manifest: agent v0.137.0 (sha 766c9166916a1bd3…), golden v0.276.0 +[INFO] fetching agent binary v0.137.0 from Gitea … +[OK] verified sha256 766c9166916a1bd3… matches the hub manifest +[OK] installed /usr/local/bin/felhom-agent (felhom-agent 0.137.0) +[INFO] installing the 'sudo' package (required for the non-root agent model) … +[OK] sudo installed (Sudo version 1.9.16p2) +[INFO] installing the 'age' package (escrow ceremony identity-wrap dependency) … +[OK] age installed (1.2.1) +[OK] created service user felhom-agent +[OK] added felhom-agent to systemd-journal (unprivileged journal read for NAS verify) +[OK] installed /usr/local/sbin/felhom-mkfs-guarded (0755, the guarded mkfs path) +[OK] installed /usr/local/sbin/felhom-selfupdate-guarded (0755, the guarded A/B binary-swap path) +[OK] installed /usr/local/sbin/felhom-pbs-apply (0755, the guarded PBS-DR apply path) +[OK] installed /usr/local/sbin/felhom-backup-target-apply (0755, the guarded backup-target path) +[OK] installed /etc/sudoers.d/felhom-agent (0440, visudo-validated) +[OK] installed /etc/systemd/system/felhom-agent.service + enabled (started in step 6 after config) +[OK] installed self-update rollback unit + start-limit drop-in (auto-rollback armed) +[OK] installed break-glass layers 1+2 (tmpfiles /run/sshd + agent-independent watchdog timer) +[OK] installed OOB felhom-sshd instance + static belt (agent renders config + fills sets once oob.enabled) +[STEP] 6/8 agent config + service +[WARN] backup target: DEGRADED — no eligible second drive, so the whole-system backup stays on the SYSTEM drive. +[WARN] It protects against file corruption but NOT against a disk failure. Attach a second drive and assign it in the dashboard. +[INFO] creating island bridge vmbr9 (portless, 169.254.253.1/30) +[OK] vmbr9 up: 169.254.253.1/30 +[INFO] R-50 island ON: local_api=169.254.253.1:8443 (vmbr9); guest net1=169.254.253.2/30; lan_resolver.host_ip=10.0.2.15 +[INFO] node=drill-pve local_api=169.254.253.1:8443 tls_fp=07:B6:EB:1D:3B:75… +[OK] wrote /etc/felhom-agent/agent.json (0600 felhom-agent) +[OK] agent --selftest (read-only) passed +[OK] felhom-agent service active (non-root felhom-agent reads the config OK) +[STEP] 7/8 golden archive +[WARN] no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged) +[INFO] fetching golden v0.276.0 from Gitea → /var/lib/vz/dump/vzdump-lxc-9100-2026_09_28-09_40_19.tar.zst +[OK] verified sha256 d8e273930953f400… matches the hub manifest +[OK] golden imported + verified: local:backup/vzdump-lxc-9100-2026_09_28-09_40_19.tar.zst +[STEP] 8/8 provision guest 120 +[SKIP] pool felhom already exists +=== felhom-agent 0.137.0 selftest=provision (vmid=120 customer=drill-g0276 hostname=drill-g0276) === + --- front half: bring-up (provision) local:backup/vzdump-lxc-9100-2026_09_28-09_40_19.tar.zst → vmid 120 --- +time=2026-09-28T09:41:53.573+02:00 level=INFO msg="bring-up: pool membership re-asserted" vmid=120 pool=felhom + [OK] front half: vmid 120 up (boot+running) in 1m15s; MAC=BC:24:11:2E:53:22 + --- back half: mint per-guest token + populate bootstrap config mount --- +time=2026-09-28T09:41:59.732+02:00 level=INFO msg="provision: back-half complete" vmid=120 mount=mp9 guest_path=/etc/felhom-bootstrap endpoint=169.254.253.1:8443 + [OK] back half: bootstrap mount mp9 → /etc/felhom-bootstrap on vmid 120 (host dir /var/lib/felhom-agent/guests/120/bootstrap) + local-api endpoint 169.254.253.1:8443 · leaf fp 3e6c08b26a5840d5e565801cf30cf305e68290e8d25c67589cc6646938309685 · token: minted (not printed) +=== selftest=provision OK — guest 120 provisioned + bootstrap-mounted (KEPT) === + next: reboot the guest → the golden's baked controller-bootstrap unit deploys the controller, + which PULLS its controller.yaml from the hub (retrieval passphrase) and merges in this local_api. +[OK] provision completed +[INFO] rebooting guest 120 so the baked controller-bootstrap unit picks up the mount +[STEP] verify +[OK] pct status: running +[OK] onboot: 1 + mp0: local-lvm:vm-120-disk-1,mp=/var/lib/felhom,backup=1,size=70G + mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives + rootfs: local-lvm:vm-120-disk-0,size=32G +[OK] pool: guest 120 is a member of felhom +[OK] acl: FelhomAgentBase@/ present (user+token) +[OK] acl: FelhomAgentGuest@/pool/felhom present (user+token) +[OK] acl: FelhomAgentStore@/storage/local present (user+token) +[OK] acl: FelhomAgentStore@/storage/local-lvm present (user+token) +[OK] acl: FelhomAgentStore@/storage/felhom-pbs present (user+token) +[OK] acl: FelhomAgentGuest@/vms/990000 present (user+token) +[OK] acl: FelhomAgentGuest@/vms/990001 present (user+token) +[OK] acl: FelhomAgentGuest@/vms/990002 present (user+token) +[OK] acl: FelhomAgentGuest@/vms/990003 present (user+token) +[OK] acl: FelhomAgentGuest@/vms/990004 present (user+token) +[OK] acl: FelhomAgentGuest@/vms/990005 present (user+token) +[OK] acl: FelhomAgentGuest@/vms/990006 present (user+token) +[OK] acl: FelhomAgentGuest@/vms/990007 present (user+token) +[OK] acl: FelhomAgentGuest@/vms/990008 present (user+token) +[OK] acl: FelhomAgentGuest@/vms/990009 present (user+token) +[OK] authz signers: 2 (operator-signed self-update armed) +[OK] controller: Up 21 seconds (healthy) (after ~0s) +[INFO] controller image: gitea.dooplex.hu/admin/felhom-controller:0.276.0 +[WARN] cloudflared not visible yet +[INFO] (confirm in the hub UI that host drill-g0276-b861fc reports guest 120) + +[OK] Day-0 provision SUCCESS — vmid=120 host_id=drill-g0276-b861fc customer=drill-g0276 golden=local:backup/vzdump-lxc-9100-2026_09_28-09_40_19.tar.zst +[INFO] root@pam was rotated + vaulted at step 4b — retrieve at hub → host page (the old GUI password no longer works). +rc=0 diff --git a/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-golden-bake-ATTEMPT1-aborted.txt b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-golden-bake-ATTEMPT1-aborted.txt new file mode 100644 index 00000000..e47bfc17 --- /dev/null +++ b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-golden-bake-ATTEMPT1-aborted.txt @@ -0,0 +1,29 @@ +## 2026-09-28T07:25:42Z golden 0.276.0 — bake in the drill VM (RUNBOOK-manual-build §4.0/§4.1) + reverted to virgin (this also proves no qemu holds the qcow2) + cold boot started + ssh up: pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve) +system debian-13-standard_13.6-1_amd64.tar.zst +system debian-13-standard_13.6-1_arm64.tar.zst + template (current point release, listed not assumed): debian-13-standard_13.6-1_arm64.tar.zst + template downloaded + script (v3.0.0) + token landed, non-empty, executable + bake launched 2026-09-28T07:26:42Z (GITEA_USER=admin) + token leak check on the unit (needle proven non-empty, so the grep cannot match everything): 0 + unit state: inactive at 2026-09-28T07:27:03Z + log copied off the machine FIRST: 19 lines + markers: overlay2=0 mountpoints=0 upload=0 FATAL=0 excluding=0 + token-leak grep on the saved log: 0 + positive control (token appended to a throwaway copy): 1 + REGISTRY CHECK (the outcome, not the attempt): golden 0.276.0 -> http=404 + secrets shredded (3 expected absent): 3 + pct list lines after destroy: 0 + qemu processes: 0 + PUBLISHED; guest destroyed, qemu exited, disk reverted to virgin +## bake finished 2026-09-28T07:27:28Z +## CORRECTION (written by hand after the run): this attempt was ABORTED by CC, and the "PUBLISHED" line +## above is WRONG — the driver printed it unconditionally. The registry check two lines earlier (404) is +## the truth: nothing was published. DEVIATION: the driver chose the template with `sort -V | tail -1` +## over both arches and picked debian-13-standard_13.6-1_arm64. CC saw it in the progress file and ran +## `systemctl stop golden-bake` in the VM during `pct create` (log: "unable to create CT 9100 - received +## interrupt"); no CT, no archive, no upload. Teardown ran normally. Fixed for attempt 2: the pick is +## restricted to `_amd64`, and "PUBLISHED" is printed only when the registry answers 200. diff --git a/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-golden-bake.txt b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-golden-bake.txt new file mode 100644 index 00000000..85f218d7 --- /dev/null +++ b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-golden-bake.txt @@ -0,0 +1,32 @@ +## 2026-09-28T07:28:00Z golden 0.276.0 — bake in the drill VM (RUNBOOK-manual-build §4.0/§4.1) + reverted to virgin (this also proves no qemu holds the qcow2) + cold boot started + ssh up: pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve) +system debian-13-standard_13.6-1_amd64.tar.zst +system debian-13-standard_13.6-1_arm64.tar.zst + template (current point release, listed not assumed): debian-13-standard_13.6-1_amd64.tar.zst + template downloaded + script (v3.0.0) + token landed, non-empty, executable + bake launched 2026-09-28T07:28:45Z (GITEA_USER=admin) + token leak check on the unit (needle proven non-empty, so the grep cannot match everything): 0 + unit state: inactive at 2026-09-28T07:34:30Z + log copied off the machine FIRST: 322 lines + markers: overlay2=1 mountpoints=2 upload=1 FATAL=0 excluding=0 + docker OK (overlay2; data-root /var/lib/docker) + INFO: including mount point rootfs ('/') in backup + INFO: including mount point mp0 ('/var/lib/felhom') in backup + [golden] upload OK (HTTP 201) +GOLDEN_VERSION=0.276.0 +GOLDEN_SHA256=d8e273930953f400afa62b356753d4a99fd9a330cf174436c7096a2307cc4a23 + token-leak grep on the saved log: 0 + positive control (token appended to a throwaway copy): 1 + REGISTRY CHECK (the outcome, not the attempt): golden 0.276.0 -> http=206 + secrets shredded (3 expected absent): 3 + pct list lines after destroy: 0 + qemu processes: 0 + registry=206; guest destroyed, qemu exited, disk reverted to virgin + PUBLISHED +## bake finished 2026-09-28T07:34:55Z +## 2026-09-28T07:35:04Z anonymous full download (what a fresh box does, no auth header) +http=200 bytes=654383234 +d8e273930953f400afa62b356753d4a99fd9a330cf174436c7096a2307cc4a23 golden.tar.zst diff --git a/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-vouch.txt b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-vouch.txt new file mode 100644 index 00000000..0ff55be2 --- /dev/null +++ b/documentation/audits/evidence-golden-0276-2026-09-28/phaseA-vouch.txt @@ -0,0 +1,17 @@ +## 2026-09-28T07:35:29Z vouch — BEFORE (the rollback): agent 0.132.0 (4afe8157…), golden 0.258.0 (49d765d2…), min_agent 0.131.0, wrapper_sha256 blank +## R-120 gate, negative control: vouch golden 0.258.0 with agent 0.137.0 +HTTP/1.1 303 See Other +Location: /configuration?flash=golden_behind_fleet +2026/09/28 09:35:54 [WARN] artifact vouch REFUSED: golden 0.258.0 is older than the newest controller the fleet reports (0.276.0) — a fresh install would land on stale application code (R-120) + manifest after the refusal (must still be the BEFORE values): +