Day 2 2026-10-19: ep0 keep-weekly 2 (D18), passphrase measured (R-1159 READY, D19), hub 0.160.0 deployed, controller 0.333.0 floor, gofmt gates; register 167 -> 163 (closed 6, opened R-1165, R-1166)
gates / gates (push) Successful in 7m15s
gates / gates (push) Successful in 7m15s
This commit is contained in:
admin committed
1 parent
73f3899266
commit
224fe41e06
28 files changed
+652
-22
No files matched your search
@@ -0,0 +1,39 @@
|
||||
== DooPlex PBS (read 2026-10-19)
|
||||
[
|
||||
{
|
||||
"comment": "decision 71: keep the last 8 weekly copies per group (all namespaces); runs after the 05:00 pull",
|
||||
"id": "prune-ep0-copy",
|
||||
"keep-weekly": 8,
|
||||
"schedule": "07:30",
|
||||
"store": "ep0-copy"
|
||||
}
|
||||
]
|
||||
[
|
||||
{
|
||||
"comment": "decision 70: nightly copy of ep0 felhom-offsite; never removes what ep0 removed",
|
||||
"id": "ep0-felhom-offsite",
|
||||
"remote": "ep0",
|
||||
"remote-store": "felhom-offsite",
|
||||
"remove-vanished": false,
|
||||
"schedule": "05:00",
|
||||
"store": "ep0-copy"
|
||||
}
|
||||
]
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/Tester-2/ct/9201/2026-10-04T16:31:13Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/demo-felhom/ct/9201/2026-09-22T04:12:20Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/demo-felhom/ct/9201/2026-09-29T04:16:43Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/demo-felhom/ct/9201/2026-10-06T04:21:09Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/demo-felhom/ct/9201/2026-10-13T04:22:51Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/demo-hp/ct/9201/2026-09-24T20:06:25Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/demo-hp/ct/9201/2026-10-01T20:15:29Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/demo-hp/ct/9201/2026-10-08T20:34:27Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/demo-hp/ct/9201/2026-10-15T20:38:47Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/operator/host/dooplex-gitea/2026-10-10T22:22:52Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/operator/host/dooplex-gitea/2026-10-17T22:22:32Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/operator/host/dooplex-gitea/2026-10-18T22:22:01Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/operator/host/dooplex-hub/2026-10-11T00:30:55Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/operator/host/dooplex-hub/2026-10-18T00:31:48Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/operator/host/dooplex-hub/2026-10-19T00:32:07Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/tester-1/ct/9201/2026-10-04T19:57:18Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/tester-1/ct/9201/2026-10-11T20:02:13Z
|
||||
/mnt/5_hdd/backup/ep0-copy/ns/tester-1/ct/9201/2026-10-18T20:04:51Z
|
||||
@@ -0,0 +1,5 @@
|
||||
box | job | snapshots today | keep-last 2 keeps / removes | keep-weekly 2 keeps / removes
|
||||
Tester-2 | NO JOB | 1 | 2026-10-04 (w40) / none | 2026-10-04 (w40) / none
|
||||
demo-felhom | prune-demo-felhom | 2 | 2026-10-13 (w42), 2026-10-06 (w41) / none | 2026-10-13 (w42), 2026-10-06 (w41) / none
|
||||
demo-hp | prune-demo-hp | 2 | 2026-10-15 (w42), 2026-10-08 (w41) / none | 2026-10-15 (w42), 2026-10-08 (w41) / none
|
||||
tester-1 | NO JOB | 3 | 2026-10-18 (w42), 2026-10-11 (w41) / 2026-10-04 (w40) | 2026-10-18 (w42), 2026-10-11 (w41) / 2026-10-04 (w40)
|
||||
@@ -0,0 +1,31 @@
|
||||
Mon Oct 19 07:49:11 UTC 2026
|
||||
[
|
||||
{
|
||||
"comment": "R-1162 operator D1=A 2026-10-19: one copy per ISO week, 2 weeks, server-side (box tokens are write-only)",
|
||||
"id": "prune-demo-hp",
|
||||
"keep-weekly": 2,
|
||||
"max-depth": 0,
|
||||
"ns": "demo-hp",
|
||||
"schedule": "03:30",
|
||||
"store": "felhom-offsite"
|
||||
},
|
||||
{
|
||||
"comment": "R-1162 operator D1=A 2026-10-19: one copy per ISO week, 2 weeks, server-side (box tokens are write-only)",
|
||||
"id": "prune-demo-felhom",
|
||||
"keep-weekly": 2,
|
||||
"max-depth": 0,
|
||||
"ns": "demo-felhom",
|
||||
"schedule": "03:30",
|
||||
"store": "felhom-offsite"
|
||||
},
|
||||
{
|
||||
"comment": "R-173 hub DB copies; operator ns only",
|
||||
"id": "prune-operator-hubdb",
|
||||
"keep-daily": 14,
|
||||
"keep-weekly": 8,
|
||||
"max-depth": 0,
|
||||
"ns": "operator",
|
||||
"schedule": "03:45",
|
||||
"store": "felhom-offsite"
|
||||
}
|
||||
]
|
||||
@@ -0,0 +1,40 @@
|
||||
felhom-hetzner
|
||||
proxmox-backup-server 4.2.8-1 running version: 4.2.5
|
||||
==prune-jobs
|
||||
[
|
||||
{
|
||||
"comment": "R-173 hub DB copies; operator ns only",
|
||||
"id": "prune-operator-hubdb",
|
||||
"keep-daily": 14,
|
||||
"keep-weekly": 8,
|
||||
"max-depth": 0,
|
||||
"ns": "operator",
|
||||
"schedule": "03:45",
|
||||
"store": "felhom-offsite"
|
||||
},
|
||||
{
|
||||
"comment": "R-82 retention keep-last=2, server-side (box tokens are write-only)",
|
||||
"id": "prune-demo-hp",
|
||||
"keep-last": 2,
|
||||
"max-depth": 0,
|
||||
"ns": "demo-hp",
|
||||
"schedule": "03:30",
|
||||
"store": "felhom-offsite"
|
||||
},
|
||||
{
|
||||
"comment": "R-82 retention keep-last=2, server-side (box tokens are write-only)",
|
||||
"id": "prune-demo-felhom",
|
||||
"keep-last": 2,
|
||||
"max-depth": 0,
|
||||
"ns": "demo-felhom",
|
||||
"schedule": "03:30",
|
||||
"store": "felhom-offsite"
|
||||
}
|
||||
]
|
||||
==datastore
|
||||
{
|
||||
"gc-schedule": "sun 04:30",
|
||||
"name": "felhom-offsite",
|
||||
"path": "/mnt/pbs-datastore",
|
||||
"verify-new": true
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
ns/Tester-2/ct/9201/2026-10-04T16:31:13Z
|
||||
ns/demo-felhom/ct/9201/2026-10-06T04:21:09Z
|
||||
ns/demo-felhom/ct/9201/2026-10-13T04:22:51Z
|
||||
ns/demo-hp/ct/9201/2026-10-08T20:34:27Z
|
||||
ns/demo-hp/ct/9201/2026-10-15T20:38:47Z
|
||||
ns/tester-1/ct/9201/2026-10-04T19:57:18Z
|
||||
ns/tester-1/ct/9201/2026-10-11T20:02:13Z
|
||||
ns/tester-1/ct/9201/2026-10-18T20:04:51Z
|
||||
@@ -0,0 +1,14 @@
|
||||
== ns/demo-felhom
|
||||
ns/demo-felhom/ct/9201/2026-10-06T04:21:09Z
|
||||
ns/demo-felhom/ct/9201/2026-10-13T04:22:51Z
|
||||
== ns/demo-hp
|
||||
ns/demo-hp/ct/9201/2026-10-08T20:34:27Z
|
||||
ns/demo-hp/ct/9201/2026-10-15T20:38:47Z
|
||||
== ns/operator
|
||||
== ns/tester-1
|
||||
ns/tester-1/ct/9201/2026-10-04T19:57:18Z
|
||||
ns/tester-1/ct/9201/2026-10-11T20:02:13Z
|
||||
ns/tester-1/ct/9201/2026-10-18T20:04:51Z
|
||||
== ns/Tester-2
|
||||
ns/Tester-2/ct/9201/2026-10-04T16:31:13Z
|
||||
== root
|
||||
@@ -0,0 +1,24 @@
|
||||
== demo-hp --keep-last 2 (PBS dry-run)
|
||||
2026-10-08T20:34:27Z keep
|
||||
2026-10-15T20:38:47Z keep
|
||||
== demo-hp --keep-weekly 2 (PBS dry-run)
|
||||
2026-10-08T20:34:27Z keep
|
||||
2026-10-15T20:38:47Z keep
|
||||
== demo-felhom --keep-last 2 (PBS dry-run)
|
||||
2026-10-06T04:21:09Z keep
|
||||
2026-10-13T04:22:51Z keep
|
||||
== demo-felhom --keep-weekly 2 (PBS dry-run)
|
||||
2026-10-06T04:21:09Z keep
|
||||
2026-10-13T04:22:51Z keep
|
||||
== tester-1 --keep-last 2 (PBS dry-run)
|
||||
2026-10-04T19:57:18Z REMOVE
|
||||
2026-10-11T20:02:13Z keep
|
||||
2026-10-18T20:04:51Z keep
|
||||
== tester-1 --keep-weekly 2 (PBS dry-run)
|
||||
2026-10-04T19:57:18Z REMOVE
|
||||
2026-10-11T20:02:13Z keep
|
||||
2026-10-18T20:04:51Z keep
|
||||
== Tester-2 --keep-last 2 (PBS dry-run)
|
||||
2026-10-04T16:31:13Z keep
|
||||
== Tester-2 --keep-weekly 2 (PBS dry-run)
|
||||
2026-10-04T16:31:13Z keep
|
||||
@@ -0,0 +1,32 @@
|
||||
# Offline model of PBS's prune selection (pbs-datastore prune.rs compute_prune_info / mark_selections),
|
||||
# run over ep0's snapshot list. Never touches ep0. ep0's clock is UTC (timedatectl), and PBS keys
|
||||
# weekly buckets by local time "%G/%V" (ISO year/week).
|
||||
import sys, datetime
|
||||
snaps = {}
|
||||
for line in open(sys.argv[1]):
|
||||
line=line.strip()
|
||||
if line.startswith('ns/') and '/ct/' in line:
|
||||
ns = line.split('/')[1]; t = line.rsplit('/',1)[1]
|
||||
snaps.setdefault(ns, []).append(t)
|
||||
def sel_last(t): return t
|
||||
def sel_week(t):
|
||||
d = datetime.datetime.strptime(t, '%Y-%m-%dT%H:%M:%SZ'); y,w,_ = d.isocalendar(); return f"{y}/{w:02d}"
|
||||
def compute(lst, opts):
|
||||
lst = sorted(lst, reverse=True); mark = {}
|
||||
for keep, sel in opts:
|
||||
already = {sel(t) for t in lst if mark.get(t)=='keep'}; inc=set()
|
||||
for t in lst:
|
||||
if t in mark: continue
|
||||
s = sel(t)
|
||||
if s in already: continue
|
||||
if s not in inc:
|
||||
if len(inc) >= keep: break
|
||||
inc.add(s); mark[t]='keep'
|
||||
else: mark[t]='remove'
|
||||
return {t: mark.get(t,'remove') for t in lst}
|
||||
jobs = {'demo-hp':'prune-demo-hp','demo-felhom':'prune-demo-felhom'}
|
||||
print("box | job | snapshots today | keep-last 2 keeps / removes | keep-weekly 2 keeps / removes")
|
||||
for ns in sorted(snaps):
|
||||
a = compute(snaps[ns], [(2, sel_last)]); b = compute(snaps[ns], [(2, sel_week)])
|
||||
f = lambda m,k: ', '.join(f"{t[:10]} (w{sel_week(t)[5:]})" for t,v in m.items() if v==k) or 'none'
|
||||
print(f"{ns} | {jobs.get(ns,'NO JOB')} | {len(snaps[ns])} | {f(a,'keep')} / {f(a,'remove')} | {f(b,'keep')} / {f(b,'remove')}")
|
||||
@@ -0,0 +1,24 @@
|
||||
=== RUN TestR1159_Measure
|
||||
r1159_measure_test.go:85: GET /config/c1 (passphrase) -> 200; hub fields: [api_key enabled url]; carries the controller key: true
|
||||
r1159_measure_test.go:86: GET /config/c1 (wrong passphrase) -> 401
|
||||
r1159_measure_test.go:90: POST /host-enroll (passphrase) -> 200; returns the EXISTING host's key: true
|
||||
r1159_measure_test.go:105: POST /offsite/register-key/c1 controller key -> 200, wrong key -> 401
|
||||
r1159_measure_test.go:105: POST /offsite/confirm-key/c1 controller key -> 200, wrong key -> 401
|
||||
r1159_measure_test.go:105: POST /offsite/move-aside/c1 controller key -> 200, wrong key -> 401
|
||||
r1159_measure_test.go:105: POST /offsite/window-open/c1 controller key -> 200, wrong key -> 401
|
||||
r1159_measure_test.go:105: POST /offsite/abandon-request/c1 controller key -> 200, wrong key -> 401
|
||||
r1159_measure_test.go:105: POST /offsite/abandon-cancel/c1 controller key -> 200, wrong key -> 401
|
||||
r1159_measure_test.go:105: POST /offsite/abandon-status/c1 controller key -> 200, wrong key -> 401
|
||||
r1159_measure_test.go:121: GET /hosts/h1/escrow host key -> 200, wrong key -> 401
|
||||
r1159_measure_test.go:121: GET /hosts/h1/escrow/retained host key -> 200, wrong key -> 401
|
||||
r1159_measure_test.go:121: PUT /hosts/h1/escrow host key -> 400, wrong key -> 401
|
||||
r1159_measure_test.go:121: POST /hosts/h1/wg host key -> 400, wrong key -> 401
|
||||
r1159_measure_test.go:121: POST /hosts/h1/pbs/consume-token host key -> 404, wrong key -> 401
|
||||
r1159_measure_test.go:121: GET /hosts/h1/desired-state host key -> 200, wrong key -> 401
|
||||
r1159_measure_test.go:121: GET /hosts/h1/jobs host key -> 200, wrong key -> 401
|
||||
r1159_measure_test.go:121: PUT /hosts/h1/recovery-credential host key -> 400, wrong key -> 401
|
||||
r1159_measure_test.go:121: POST /host-report host key -> 200, wrong key -> 401
|
||||
r1159_measure_test.go:123: off-site service calls reached with the passphrase-derived key: RegisterKey, ConfirmKey, MoveAside, OpenWindowFor, RequestAbandon, CancelAbandon, AbandonStatusFor
|
||||
--- PASS: TestR1159_Measure (0.04s)
|
||||
PASS
|
||||
ok gitea.dooplex.hu/admin/felhom-hub/internal/api 0.065s
|
||||
@@ -0,0 +1,124 @@
|
||||
package api
|
||||
|
||||
// R-1159 MEASUREMENT HARNESS (temporary, not committed): what a holder of the household's retrieval passphrase ALONE
|
||||
// can reach through the real hub router. Field names and status codes only.
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"sort"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"gitea.dooplex.hu/admin/felhom-hub/internal/offsitekeys"
|
||||
"gitea.dooplex.hu/admin/felhom-hub/internal/store"
|
||||
"gopkg.in/yaml.v3"
|
||||
)
|
||||
|
||||
type r1159Tpl struct{}
|
||||
|
||||
func (r1159Tpl) Template() string { return "hub: {}\n" }
|
||||
|
||||
type r1159Keys struct{ calls []string }
|
||||
|
||||
func (f *r1159Keys) RegisterKey(_ context.Context, c, _ string) (offsitekeys.InstallResult, error) {
|
||||
f.calls = append(f.calls, "RegisterKey")
|
||||
return offsitekeys.InstallResult{Fingerprint: "SHA256:x"}, nil
|
||||
}
|
||||
func (f *r1159Keys) ConfirmKey(_ context.Context, c, _ string) (int, error) {
|
||||
f.calls = append(f.calls, "ConfirmKey")
|
||||
return 1, nil
|
||||
}
|
||||
func (f *r1159Keys) MoveAside(_ context.Context, c string) (string, error) {
|
||||
f.calls = append(f.calls, "MoveAside")
|
||||
return "repo.orphaned-x", nil
|
||||
}
|
||||
func (f *r1159Keys) OpenWindowFor(_ context.Context, c string, _ int) (offsitekeys.WindowGrant, error) {
|
||||
f.calls = append(f.calls, "OpenWindowFor")
|
||||
return offsitekeys.WindowGrant{}, nil
|
||||
}
|
||||
func (f *r1159Keys) CloseWindowFor(_ context.Context, c string, _ offsitekeys.WindowResult) error {
|
||||
f.calls = append(f.calls, "CloseWindowFor")
|
||||
return nil
|
||||
}
|
||||
func (f *r1159Keys) RequestAbandon(_ context.Context, c, _ string) (offsitekeys.AbandonStatus, error) {
|
||||
f.calls = append(f.calls, "RequestAbandon")
|
||||
return offsitekeys.AbandonStatus{State: "pending"}, nil
|
||||
}
|
||||
func (f *r1159Keys) CancelAbandon(c, _ string) (int, error) {
|
||||
f.calls = append(f.calls, "CancelAbandon")
|
||||
return 1, nil
|
||||
}
|
||||
func (f *r1159Keys) AbandonStatusFor(c string) (offsitekeys.AbandonStatus, error) {
|
||||
f.calls = append(f.calls, "AbandonStatusFor")
|
||||
return offsitekeys.AbandonStatus{State: "none"}, nil
|
||||
}
|
||||
|
||||
func TestR1159_Measure(t *testing.T) {
|
||||
h, st, _ := newTestHandler(t)
|
||||
h.templateProvider = r1159Tpl{}
|
||||
fk := &r1159Keys{}
|
||||
h.SetOffsiteKeyService(fk)
|
||||
if err := st.SaveCustomerConfig(&store.CustomerConfig{CustomerID: "c1", APIKey: "ckey-1159", RetrievalPassword: "owner-pass"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := st.UpsertHost(&store.Host{HostID: "h1", CustomerID: "c1", APIKey: "HKEY-1159"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
// Step 1: the passphrase alone.
|
||||
rr := r879Get(h, "/config/c1", "owner-pass")
|
||||
var y map[string]any
|
||||
_ = yaml.Unmarshal(rr.Body.Bytes(), &y)
|
||||
var hubFields []string
|
||||
if hm, ok := y["hub"].(map[string]any); ok {
|
||||
for k := range hm {
|
||||
hubFields = append(hubFields, k)
|
||||
}
|
||||
}
|
||||
sort.Strings(hubFields)
|
||||
key := ""
|
||||
if hm, ok := y["hub"].(map[string]any); ok {
|
||||
key, _ = hm["api_key"].(string)
|
||||
}
|
||||
t.Logf("GET /config/c1 (passphrase) -> %d; hub fields: %v; carries the controller key: %v", rr.Code, hubFields, key == "ckey-1159")
|
||||
t.Logf("GET /config/c1 (wrong passphrase) -> %d", r879Get(h, "/config/c1", "nope").Code)
|
||||
er := doEnroll(h, "c1", "owner-pass")
|
||||
var e enrollResp
|
||||
_ = json.Unmarshal(er.Body.Bytes(), &e)
|
||||
t.Logf("POST /host-enroll (passphrase) -> %d; returns the EXISTING host's key: %v", er.Code, e.APIKey == "HKEY-1159")
|
||||
|
||||
// Step 2: the controller key taken from the config.
|
||||
routes := []struct{ path, body string }{
|
||||
{"/offsite/register-key/c1", `{"public_key":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl x"}`},
|
||||
{"/offsite/confirm-key/c1", `{"fingerprint":"SHA256:x"}`},
|
||||
{"/offsite/move-aside/c1", `{}`},
|
||||
{"/offsite/window-open/c1", `{"count_before":10}`},
|
||||
{"/offsite/abandon-request/c1", `{"path":"repo.orphaned-x"}`},
|
||||
{"/offsite/abandon-cancel/c1", `{}`},
|
||||
{"/offsite/abandon-status/c1", `{}`},
|
||||
}
|
||||
for _, r := range routes {
|
||||
ok := do(h, http.MethodPost, r.path, key, r.body)
|
||||
bad := do(h, http.MethodPost, r.path, "ckey-wrong", r.body)
|
||||
t.Logf("POST %-30s controller key -> %d, wrong key -> %d", r.path, ok.Code, bad.Code)
|
||||
}
|
||||
hk := e.APIKey
|
||||
for _, r := range []struct{ m, path, body string }{
|
||||
{"GET", "/hosts/h1/escrow", ""},
|
||||
{"GET", "/hosts/h1/escrow/retained", ""},
|
||||
{"PUT", "/hosts/h1/escrow", `{}`},
|
||||
{"POST", "/hosts/h1/wg", `{}`},
|
||||
{"POST", "/hosts/h1/pbs/consume-token", `{}`},
|
||||
{"GET", "/hosts/h1/desired-state", ""},
|
||||
{"GET", "/hosts/h1/jobs", ""},
|
||||
{"PUT", "/hosts/h1/recovery-credential", `{}`},
|
||||
{"POST", "/host-report", validReportBody("h1")},
|
||||
} {
|
||||
ok := do(h, r.m, r.path, hk, r.body)
|
||||
bad := do(h, r.m, r.path, "HKEY-wrong", r.body)
|
||||
t.Logf("%-4s %-32s host key -> %d, wrong key -> %d", r.m, r.path, ok.Code, bad.Code)
|
||||
}
|
||||
t.Logf("off-site service calls reached with the passphrase-derived key: %s", strings.Join(fk.calls, ", "))
|
||||
}
|
||||
@@ -0,0 +1,12 @@
|
||||
ARP watch for 192.168.0.104 (demo-hp vmbr0 7c:d3:0a:77:d9:76), from 09:58:07 UTC
|
||||
09:58:07 mac=7c:d3:0a:77:d9:76 ssh=open
|
||||
10:02:18 mac=b8:06:0d:60:45:58 ssh=shut
|
||||
10:02:58 mac=7c:d3:0a:77:d9:76 ssh=open
|
||||
10:03:38 mac=b8:06:0d:60:45:58 ssh=shut
|
||||
10:08:59 mac=7c:d3:0a:77:d9:76 ssh=open
|
||||
10:10:19 mac=b8:06:0d:60:45:58 ssh=shut
|
||||
10:12:50 mac=7c:d3:0a:77:d9:76 ssh=open
|
||||
10:17:10 mac=b8:06:0d:60:45:58 ssh=shut
|
||||
10:17:50 mac=7c:d3:0a:77:d9:76 ssh=open
|
||||
10:19:21 mac=b8:06:0d:60:45:58 ssh=shut
|
||||
stopped by CC at 10:20:37 UTC (enough to show the flips)
|
||||
@@ -0,0 +1,4 @@
|
||||
FileBrowser 1.5.6-stable on demo-hp 9201, 2026-10-19
|
||||
index.html links: <link rel="manifest" href="/public/static/site.webmanifest" crossorigin="use-credentials">
|
||||
manifest: 200 application/manifest+json, display=standalone
|
||||
PWA config keys in the binary: disablePWAInstall only (strings | grep -i pwa/manifest)
|
||||
@@ -0,0 +1,10 @@
|
||||
jwt alg: HS256 | claim names: ['Permissions', 'belongsTo', 'exp', 'iat', 'iss']
|
||||
nested Permissions -> ['admin', 'api', 'create', 'delete', 'download', 'modify', 'realtime', 'share']
|
||||
exp-iat/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/649cb06d-b4ca-49f2-9e2c-16c8bc36531f/scrat seconds: 7200
|
||||
identity claims: {'belongsTo': 3}
|
||||
signed in: cookie-token alone -> HTTP chpad/jwt_probe3.sh: line 23: T3: unbound variable
|
||||
/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/649cb06d-b4ca-49f2-9e2c-16c8bc36531f/scrat401; bearer alone -> HTTP
|
||||
dashboard sign-out: 302
|
||||
after sign-out: coochpad/jwt_probe3.sh: line 23: T3: unbound variable
|
||||
/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/649cb06d-b4ca-49f2-9e2c-16c8bc36531f/scratkie-token alone -> HTTP 401; bearer alone -> HTTP
|
||||
chpad/jwt_probe3.sh: line 28: T3: unbound variable
|
||||
@@ -0,0 +1,5 @@
|
||||
with the files cookie (the household's normal path): HTTP 200
|
||||
token alone, still signed in: cookie 401 · bearer 401 · basic 401 · ?auth= 401
|
||||
dashboard sign-out: 302
|
||||
token alone, after sign-out: cookie 401 · bearer 401 · basic 401 · ?auth= 401
|
||||
FileBrowser's own sign-in page, no token: HTTP 200
|
||||
@@ -0,0 +1,27 @@
|
||||
=== demo-hp (enkisfelhom.hu) 10:15:18
|
||||
containers: 24 running; not healthy/running: traefik Up 3 days;
|
||||
unhealthy: 0
|
||||
2026/10/19 10:13:21 updater.go:855: [INFO] [selfupdate] Post-update startup: update successful (0.333.0-rc.2 → 0.333.0)
|
||||
allow-list refusals since start: 0
|
||||
2026/10/19 10:13:21 sync.go:142: [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
|
||||
installed apps (stacks with app.yaml): 12
|
||||
public https://felhom.enkisfelhom.hu/: 302
|
||||
public https://files.enkisfelhom.hu/: 200
|
||||
=== demo-felhom (demo-felhom.eu) 10:15:20
|
||||
containers: 9 running; not healthy/running: traefik Up 3 days;
|
||||
unhealthy: 0
|
||||
2026/10/19 09:59:39 [INFO] [selfupdate] Post-update startup: update successful (0.332.0 → 0.333.0)
|
||||
allow-list refusals since start: 0
|
||||
2026/10/19 09:59:40 [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
|
||||
installed apps (stacks with app.yaml): 5
|
||||
public https://felhom.demo-felhom.eu/: 302
|
||||
public https://files.demo-felhom.eu/: 200
|
||||
=== tester-1 (enkicsifelhom.hu) 10:15:22
|
||||
containers: 10 running; not healthy/running: traefik Up 3 days;
|
||||
unhealthy: 0
|
||||
2026/10/19 09:59:48 [INFO] [selfupdate] Post-update startup: update successful (0.332.0 → 0.333.0)
|
||||
allow-list refusals since start: 0
|
||||
2026/10/19 09:59:49 [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
|
||||
installed apps (stacks with app.yaml): 3
|
||||
public https://felhom.enkicsifelhom.hu/: 302
|
||||
public https://files.enkicsifelhom.hu/: 200
|
||||
@@ -0,0 +1,33 @@
|
||||
control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -)
|
||||
== tester-1 (enkicsifelhom.hu): 6 public name(s)
|
||||
OK control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1
|
||||
== demo-hp (enkisfelhom.hu): 14 public name(s)
|
||||
OK http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1
|
||||
== demo-felhom (demo-felhom.eu): 8 public name(s)
|
||||
OK http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1
|
||||
== every public name redirects http -> https
|
||||
@@ -0,0 +1,26 @@
|
||||
== demo-hp
|
||||
sec: cannot run /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/649cb06d-b4ca-49f2-9e2c-16c8bc36531f/scratchpad/sso_check.sh: Permission denied
|
||||
== tester-1
|
||||
sec: cannot run /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/649cb06d-b4ca-49f2-9e2c-16c8bc36531f/scratchpad/sso_check.sh: Permission denied
|
||||
== tester-1 R-1155
|
||||
with the files cookie (the household's normal path): HTTP 200
|
||||
token alone, still signed in: cookie 401 · bearer 401 · basic 401 · ?auth= 401
|
||||
dashboard sign-out: 302
|
||||
token alone, after sign-out: cookie 401 · bearer 401 · basic 401 · ?auth= 401
|
||||
FileBrowser's own sign-in page, no token: HTTP 200
|
||||
== demo-hp
|
||||
dashboard sign-in: 302
|
||||
the Fajlok button goes to: https://files.enkisfelhom.hu/_felhom/sso
|
||||
the pass answer goes to: https://files.enkisfelhom.hu/files/; files cookie set: 1
|
||||
FileBrowser with the files cookie: felhom-household admin: False modify: True
|
||||
FileBrowser without it, a fresh browser: HTTP 401
|
||||
dashboard sign-out: 302
|
||||
after the sign-out, the files cookie sends the browser to: https://felhom.enkisfelhom.hu/__files/open?to=%2Ffiles%2F
|
||||
== tester-1
|
||||
dashboard sign-in: 302
|
||||
the Fajlok button goes to: https://files.enkicsifelhom.hu/_felhom/sso
|
||||
the pass answer goes to: https://files.enkicsifelhom.hu/files/; files cookie set: 1
|
||||
FileBrowser with the files cookie: felhom-household admin: False modify: True
|
||||
FileBrowser without it, a fresh browser: HTTP 401
|
||||
dashboard sign-out: 302
|
||||
after the sign-out, the files cookie sends the browser to: https://felhom.enkicsifelhom.hu/__files/open?to=%2Ffiles%2F
|
||||
@@ -0,0 +1,5 @@
|
||||
page bytes: 53890
|
||||
new text, shown by default (id=live-after-check, ASCII fragment 'lent a k'): 1
|
||||
old text, hidden until the claim says no confirm (id=live-now display:none): 1
|
||||
the switch in the page script: 1
|
||||
negative control (a sentence that is not on the page): 0
|
||||
@@ -0,0 +1,13 @@
|
||||
## global floor 0.333.0 / MinAgent 0.158.1 — 10:16:22 UTC
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /configuration?flash=floor_set
|
||||
## clear per-box floors
|
||||
tester-1: HTTP/1.1 303 See Other Location: /customers/tester-1?flash=floor_set
|
||||
demo-hp: HTTP/1.1 303 See Other Location: /customers/demo-hp?flash=floor_set
|
||||
demo-felhom: HTTP/1.1 303 See Other Location: /customers/demo-felhom?flash=floor_set
|
||||
## read back (hub.db + WAL)
|
||||
min_controller_version|0.333.0
|
||||
min_controller_version_declared_min_agent|0.333.0=0.158.1
|
||||
demo-felhom|
|
||||
demo-hp|
|
||||
tester-1|
|
||||
Reference in new issue
Block a user