admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: SLICE 4 — hub README, REPORT, CONTEXT (offsite arc build-complete)

Browse Source 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-10 00:25:57 +02:00
parent 04826c922e
commit 09bd7191e0
3 changed files with 49 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
REPORT.md
+28 -25
View File
@@ -2,33 +2,36 @@
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
## TASK — offsite SLICE 3: hub-verified escrow auto-confirm — 2026-07-09 — DEPLOYED
## TASK — offsite SLICE 4: soft-quota + health monitoring + freeze lever — 2026-07-10 — DEPLOYED
**Shipped (felhom.eu):** hub **v0.40.0** `49d1233` + bump `c24d4af` — LIVE (Synced/Healthy). Chain pairs:
agent **v0.79.0** (felhom-pve, 56/56) + controller **v0.108.0** (9201, healthy) — all live. Operator-free
task (Viktor ran nothing).
**Shipped (felhom.eu):** hub **v0.41.0** `fad5573` + bump `04826c9` — LIVE (Synced/Healthy, "Offsite
checker initialized"). Pairs with controller **v0.109.1** (9201, healthy). The offsite arc's last build
item; operator-free (Viktor ran nothing).
**The verification chain:** the ceremony hashes the staged repo password it seals (agent) → the hub stores
`restic_pw_sha256` alongside the escrow blob (additive migration; NULL on legacy rows) and serves
`escrow:{identity_blob_present, restic_pw_sha256, created_at}` in the **report ACK** → the controller flips
offbox `EscrowState` pending→escrowed ONLY on `sha256(local repo_password)` match. **Blob-presence alone
never confirms** — a stale blob (re-provision/inject/history) would be a false custody claim re-opening the
fork-4 gap; this is the red-proofed core (blob-present-only check → stale-blob test flips → FAIL).
Mismatch → pending + loud warn naming the ceremony (deduped per hash); never un-confirms. On flip the
agent-staged secret is wiped (v0.107.0 path). The two hashers are pinned by the SAME cross-repo test vector
(trimmed-string sha256). Manual confirm-escrow → documented deprecated fallback for legacy hash-less blobs.
**Hub changes:**
- **`monitor.OffsiteChecker`** — sibling of StorageFillChecker over the controller report's new `offsite`
object: fill warn/crit at 90/95% of `quota_gb` (quota 0 = dedicated, silent) + `offsite_stale` (warning)
for enabled+**escrowed** targets with no run >48h/never — the silently-stuck detector (recently-FAILING
runs are `backup_failed`'s signal; pending/disabled never alert — **red-proofed**: dropping the
escrowed-only filter made the pending customer alert → FAIL). Nil-safe on pre-v0.109 reports;
same-second latest-report ties processed once per sweep.
- **Freeze lever:** `Provisioner.SetOffsiteFrozen` — flips ONLY `readonly` on the exactly-1 labelled
sub-account (SSH preserved — tested; ambiguity refuses); confirm-gated **Freeze/Unfreeze** buttons next
to Re-issue (shared only). **MANUAL only, never automatic** — freezing also blocks prune, the customer's
only way down from over-quota.
**Hub specifics:** `host_escrow.restic_pw_sha256` migration; `SaveHostEscrow`/`HostEscrow`/`GetHostEscrow`
NULL-safe; `GetEscrowStatusForCustomer` (hosts⋈host_escrow, latest-updated wins); ACK object omitted when
no escrow row (fresh customers stay silently pending); `TestEscrowUploadContract` mirrors agent v0.79.0.
**Live verification (free checks, real pipeline):** the controller deploy's re-apply exercised
**key-auth-first live** (re-pinned, zero password consumed) and surfaced a real bug — the re-apply demoted
the escrowed demo to pending + wiped runtime status → **fixed as controller v0.109.1** (re-apply preserves
custody + status; red-proofed), demo repaired (manual confirm — truthful, same escrowed password — + a
run). The next report carried the full offsite object (`escrowed`, 45 MB / 50 GB, fresh run); the
**checker held it healthy (0 offsite_* events)**; the `/backups` usage bar renders
"Tárhelykeret: 43.2 MB / 50 GB (0%)".
**Live state check (no operator action):** migration applied on the production DB — all 3 legacy rows
(demo included) read hash-NULL; the demo's `escrowed` target produced **zero** `escrow-confirm` controller
log lines after reports through the new hub (Scenario E — never-revisit — proven live for free); no hub
errors.
**NOT live-exercised (per the STOP):** the freeze (would write-lock the demo's working offsite) and the
100% refusal (demo is at 0.08%) — unit red-proofs cover both.
**NOT yet live-exercised:** the full happy chain (fresh enable → ceremony records the hash → ACK →
auto-flip) — the first real offsite enable (Peti onboarding) proves it; unit red-proofs carry the logic.
**NEXT:** SLICE 4 (soft-quota on `quota_gb`), Peti onboarding runbook (live-exercises auto-confirm + F4
re-issue), NEW-box restore round-trip → retire the old-box archive.
**The offsite arc is now build-complete:** provisioning (S1/S2) → hardening (F1–F5, key-auth-first, wipe)
→ auto-confirm (S3) → quota + health (S4). **NEXT:** the Peti onboarding runbook (live-exercises
auto-confirm + F4 + fresh-provision quota end-to-end), NEW-box restore round-trip → retire the old-box
archive.