Night 2026-10-17: restore keeps the DB password (R-1106, 07 §7.4), restic 0.19.1, hardening; 8 rows closed, 7 filed; evidence
gates / gates (push) Successful in 6m57s
gates / gates (push) Successful in 6m57s
This commit is contained in:
@@ -0,0 +1,108 @@
|
||||
# REPORT — night 2026-10-16 → 17: restore after a reinstall · restic 0.19.1 · small fixes · dashboard hardening
|
||||
|
||||
Written in ASD-STE100 Simplified Technical English. Brief: the night task of 2026-10-16 (operator decisions 1A and 2A,
|
||||
21:57). Design read first: `architecture/07-backup-architecture.md` §7.4 (now carries the rule), §6.8, the restore table;
|
||||
`_recovery-inventory-2026-07-28.md`; `02-controller-module-map.md`. Evidence: `documentation/audits/night-restore-2026-10-17/`.
|
||||
|
||||
## 0. Readings I took without asking
|
||||
|
||||
1. **The rule „the backup's database password wins" applies only when the restore puts back the database's DATA
|
||||
VOLUME.** A backup that holds only a dump goes into the current data folder, which only the current password opens.
|
||||
2. **„Not on the box" means: the current install is not older than the data.** A unit without the password over an
|
||||
install that existed when the backup was taken uses the install's value; over a newer install it is refused.
|
||||
3. **Grimmory's on-box restore after its books were removed refused by design** (R-479: a unit holds settings and
|
||||
database, not the household's files). Its on-box route is „use my kept data", which I proved instead.
|
||||
4. **Part 6: researched, not changed.** Changing five apps' Redis settings on every box needs answers I do not have
|
||||
tonight (the ladder step files, the old volumes left behind, keeping data across the change). R-1096 holds the plan.
|
||||
5. **The prune with 0.19.1 on demo-hp's real store cannot run tonight:** its clean-up window opens after 2026-10-18 14:16
|
||||
UTC and only the operator can grant one sooner. Proven on a scratch store instead.
|
||||
|
||||
## 1. The restore fix (R-1106, R-127 b, R-926)
|
||||
|
||||
| Route | Where the database password came from before | Now |
|
||||
|---|---|---|
|
||||
| On-box restore („Visszaállítás"), update rollback, „use my kept data", off-site at the snapshot's version | the unit (unit wins); O4 GENERATED it when missing | the unit; missing → install older than the data → kept, else **refused before any change**; never generated |
|
||||
| Off-site full restore, same version (the reinstall case) | the current install (**the bug**) | the snapshot's, written before the database starts, when the snapshot replays the DB volume |
|
||||
| `.fab` import | the bundle's app.yaml | unchanged |
|
||||
|
||||
**Drill on demo-hp 9201 (rc.1, the dashboard's own posts), Rallly = Postgres, Grimmory = MariaDB:**
|
||||
|
||||
| Path | Rallly | Grimmory |
|
||||
|---|---|---|
|
||||
| Off-site full restore after remove + reinstall | marker row back, healthy, 0 auth errors, app's DB login works | marker row + books file (sha256) back, healthy, root and app logins work |
|
||||
| On-box restore after remove (backups kept) + reinstall | both marker rows back, healthy, logins work | refused by design (books removed — R-479) |
|
||||
| Refusal: unit without the password over a newer install | refused before any change; the app kept running, data untouched | — |
|
||||
| „Use my kept data" | — | both passwords from the backup; marker row back; kept file unchanged |
|
||||
|
||||
Last night the same off-site steps left Rallly crash-looping and Grimmory held. **R-926's answer:** after a unit restore
|
||||
the page hides a login it had to invent and says to use the old password — correct. On the reinstall path the page
|
||||
would have shown the reinstall's admin login; now it records it as not the app's login. Tests `TestR1106_*` (8),
|
||||
red-proved by six mutations; catalog gate `db-credentials` (17 apps, 20 fields, all `type: secret`).
|
||||
|
||||
## 2. restic 0.19.1 (R-1107)
|
||||
|
||||
- **Notes read** 0.18.1 → 0.19.1. One change touches the table: a missing top-level backup path now exits 3 (was 0).
|
||||
The box removes such paths before the call, so only a race reaches it — now a loud failure instead of a silent partial
|
||||
copy. No repository format change.
|
||||
- **Pinned** like 0.18.1 (official file, signed sums, our two pinned sums). A wrong sum fails the build (proved).
|
||||
- **Fixtures** for 0.14.0, 0.18.1, 0.19.1 from one store; `TestR1105_*` runs each against 0.14.0 — all pass.
|
||||
- **Both directions on demo-hp's REAL store:** copies made by 0.14.0, 0.18.1 and 0.19.1, each restored by all three —
|
||||
byte-identical every time; all three list the same 234 copies. **After a 0.19.1 prune:** scratch store only (reading 5) —
|
||||
0.14.0 lists, checks and restores.
|
||||
- **Scanner** (trivy 0.74.0): critical 3 (2 fixable) → **1 (0)**; high 122 (52) → **93 (23)**. restic's own part 50 → 19.
|
||||
|
||||
## 3. Small fixes (Part 3)
|
||||
|
||||
- **R-1108** done — a share added before the first password is served (test red-proved; live `smbclient` from DooPlex).
|
||||
- **R-1065** done — a Plex claim schedules the wiring (test red-proved; no live claim tonight).
|
||||
- **R-1017** done — the guard exists and found one more bare drive path (the remove dialog's kept-folders list), fixed.
|
||||
|
||||
## 4. Dashboard hardening (Part 4)
|
||||
|
||||
All six R-983 items and both R-976 items done, one red-proved test each. 135 i18n fixtures re-captured (the sign-out
|
||||
control became a form; one minimum-length change), 22 unchanged. **Headless Chrome through demo-hp's public address:**
|
||||
sign in → `/launcher`; `X-Frame-Options: DENY`; sign-out is a POST with CSRF → `/login`; sign in again; the
|
||||
family-gated Grimmory and the setup-gated Rallly open their own pages.
|
||||
|
||||
## 5. Part 6 — Redis (R-1096)
|
||||
|
||||
Seven Redis services: five append-only (romm, docmost, paperless-ngx, immich, nextcloud), two snapshot-only (outline,
|
||||
dawarich). Table and proposed lines: `P6/redis-persistence.md`. Not changed (reading 4). Also: RomM's file WAS repaired on
|
||||
2026-09-24 — the row's history was wrong, corrected.
|
||||
|
||||
## 6. Release
|
||||
|
||||
**0.324.0** built from `b695857` (code identical to rc.1 `f75b3aa`, the README differs), MinAgent 0.158.1 (the hub's
|
||||
declared value — not lowered). Per-box floors at 21:51:39 UTC (`303` → `floor_set`, all three); **Tester 1, demo-hp and
|
||||
demo-felhom on 0.324.0 at 21:52 UTC**, each through the normal update path. Box walk: no container unhealthy, restarting,
|
||||
exited or created (28 / 9 / 17); restic 0.19.1 in each; dashboards 200; https-only 37 names OK (`release/`).
|
||||
|
||||
NIGHT-PLACEHOLDER
|
||||
|
||||
## 7. Rows
|
||||
|
||||
**Before 177. Opened 7** (R-1109 … R-1115). **Closed 8** (R-1106, R-127, R-926, R-1108, R-1065, R-1017, R-983, R-976).
|
||||
FLOOR-ROWS-PLACEHOLDER R-1096 corrected and READY. `unproven.py`: NOT WALKED 35 of 55, unchanged.
|
||||
|
||||
## 8. Observations
|
||||
|
||||
1. A reinstalled database app restored from the off-site copy came back unusable. NOT-A-FINDING: it is R-1106, closed tonight.
|
||||
2. A share renamed at the same path is never applied to a running samba. FILED: R-1109
|
||||
3. Two sibling path helpers are called with drive-named arguments, unguarded. FILED: R-1110
|
||||
4. The share-password and escrow limiters count a try after the password check. FILED: R-1111
|
||||
5. Family sessions are stored raw, not as a fingerprint. FILED: R-1112
|
||||
6. Each `/__family/start` pass with a household session creates a new family session. FILED: R-1113
|
||||
7. `controller_gates.py` cannot pass in a worktree outside `git/`. FILED: R-1114
|
||||
8. A catalog decoy („a credential token rewritten in translation") no longer convicts. FILED: R-1115
|
||||
9. Grimmory's on-box restore after its books were removed refused. NOT-A-FINDING: by design (R-479), its route is „use my kept data", proven.
|
||||
10. The launcher logs 404s for SVG app logos. NOT-A-FINDING: the page asks for the SVG first and falls back to the PNG; the same 263 assets were in 0.322.0.
|
||||
11. Two catalog-wide stacks tests take about 26 s each. NOT-A-FINDING: test duration, no defect.
|
||||
12. R-1096's history said RomM's Redis file was not repaired on 2026-09-24. NOT-A-FINDING: the row text is corrected tonight (the file was repaired; the 2026-10-16 cause is unproven).
|
||||
|
||||
## 9. Teardown (three layers)
|
||||
|
||||
- **Machine (demo-hp 9201):** Rallly and Grimmory removed through the product (no container, volume, unit, copy or hold
|
||||
left); my marker files and the cover file removed; sharing off, the test share and its folders removed. 9201 runs
|
||||
0.324.0. The old Kimai hold is not mine and stays.
|
||||
- **Host:** nothing.
|
||||
- **Hub:** per-box floors set (§6).
|
||||
@@ -2,10 +2,12 @@
|
||||
|
||||
**Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.**
|
||||
|
||||
**Updated 2026-10-16 (evening).** Controller 0.323.0 (Debian 13, its own pinned backup program restic 0.18.1, the new file-sharing image) runs on the three test boxes; **every other box waits for tonight's off-site backups** — `REPORT-debian13-restic-2026-10-16.md`. **Earlier (midday):** Controller 0.319.0 (the app page in panels, the login in one panel) is the floor, MinAgent 0.158.1 — `REPORT-app-page-tuning-2026-10-16.md`. **Earlier (morning):** Storage identity build B shipped: agent 0.158.1 and golden 0.318.0 vouched by you, controller 0.318.0 is the floor (MinAgent 0.158.1), installer 1.33.0 published — new one-disk boxes get their own data area. Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
|
||||
**Updated 2026-10-17 (night).** Controller 0.324.0 runs on the three test boxes: a restore now brings the database password back with the data (your 1A), restic 0.19.1 (your 2A), dashboard hardening — `REPORT-night-2026-10-17.md`. The update for every box: see „What we work on". **Earlier (2026-10-16 evening):** 0.323.0, Debian 13 — `REPORT-debian13-restic-2026-10-16.md`. **Earlier (midday):** Controller 0.319.0 (the app page in panels, the login in one panel) is the floor, MinAgent 0.158.1 — `REPORT-app-page-tuning-2026-10-16.md`. **Earlier (morning):** Storage identity build B shipped: agent 0.158.1 and golden 0.318.0 vouched by you, controller 0.318.0 is the floor (MinAgent 0.158.1), installer 1.33.0 published — new one-disk boxes get their own data area. Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
|
||||
`documentation/backlog/STATUS-HISTORY.md`. Reports: `REPORT-night-2026-10-14.md`, `REPORT-immich-rollout-2026-10-14.md`, `REPORT-seo-felho-tarhely-2026-10-14.md`, `REPORT-immich-repair-2026-10-14.md`, `REPORT-power-cut-fixes-2026-10-14.md`, `REPORT-night-power-2026-10-13.md`, `REPORT-poweroff.md`.
|
||||
|
||||
## What works
|
||||
- **A restore brings the database password back with the data** (controller 0.324.0, your decision 1A): remove an app, install it again, restore it — the app opens its own data (proven on demo-hp with Rallly and Grimmory, off-site and on-box, and through „use my kept data"). A backup without the password is refused before anything changes, with a plain sentence. Backup program restic 0.19.1 (your 2A): old and new copies read both ways; scanner findings in it 50 → 19.
|
||||
- **The dashboard is harder to attack** (0.324.0): no sending the browser to another site after sign-in, no framing, parallel password guesses counted, 12-character minimum, reset-code requests limited, sign-out needs a token (the old sign-out link did nothing), a password change ends every family and gate session.
|
||||
- **The box's backup program is now chosen, not inherited** (controller 0.323.0, 2026-10-16): restic 0.18.1, checked by its signature and fingerprint at every build, on Debian 13. Every way the box reads restic was compared old vs new with real outputs; old copies stay readable by the new program and new copies by the old one (on demo-hp's real store). The file-sharing image has 0 known high holes (was 48), and the same household password still works after the change.
|
||||
- **The hub's key can no longer open anything on a box** (controller 0.322.0, 2026-10-16): the settings route is gone, and every former door answers 401 even with the box's own key. Every box that reports answers only over https (35 names). The controller and the hub (0.156.0, deployed at your yes) are built on a supported Go (1.27.2): known Go weaknesses in each 62 → 1; the hub has 0 high findings.
|
||||
- **RomM game saves are in the backup now** (2026-10-16, catalog): a save survived a backup, a removal and a restore on demo-hp, byte for byte. Eight apps no longer claim „a known, shared password" (your D10 = A). If someone changes the file manager's password in the file manager, the box notices and offers a new one (controller 0.321.0).
|
||||
@@ -36,8 +38,7 @@
|
||||
- Tester 2 has never made an off-site check (R-862). The scratch box cannot read the drill catalog (R-992).
|
||||
|
||||
## What we work on
|
||||
- **Tomorrow (2026-10-17), the next session: finish the 0.323.0 release (R-1105).** For each test box read the off-site result: `ssh <host> "pct exec 9201 -- python3 -c \"import json;o=json.load(open('/var/lib/docker/volumes/felhom-controller-data/_data/data/settings.json'))['offbox'];print(o['last_status'],o['last_success'])\""` with `<host>` = `demo-hp`, `felhom-pve`, `root@192.168.0.154`. All three `ok` with a time after 2026-10-17T00:00Z → raise the global floor (the `felhom-build-deploy` skill, step 5: `min_controller_version=0.323.0`, `min_agent=0.158.1`, expect `303` → `flash=floor_set`), read it back with the WAL, then clear the three per-box floors (`POST /customers/<id>/floor`, both fields empty). Any box not `ok` → no floor; find out why first. After 2026-10-18 14:16 UTC (demo-hp's next clean-up window): check that the old restic (image 0.322.0) still lists and restores demo-hp's store (`audits/debian13-restic-2026-10-16/tools/rx.sh`).
|
||||
- A reinstalled database app restored from the off-site copy comes back with the old database password and does not start (R-1106, with R-127 (b)); needs a design.
|
||||
- **The update for every box (R-1105, R-1107) waits on tonight's off-site backups on 0.324.0.** The night session checks from 02:45 UTC and raises the floor if all three are `ok`. If it could not, the morning check is: `ssh <host> "pct exec 9201 -- python3 -c \"import json;o=json.load(open('/var/lib/docker/volumes/felhom-controller-data/_data/data/settings.json'))['offbox'];print(o['last_status'],o['last_success'])\""` for `demo-hp`, `felhom-pve`, `root@192.168.0.154`; all `ok` after 2026-10-17T00:00Z on 0.324.0 → global floor `min_controller_version=0.324.0`, `min_agent=0.158.1` (`felhom-build-deploy` step 5), read back with the WAL, clear the three per-box floors. After 2026-10-18 14:16 UTC: the old restic still reads demo-hp's store after its first 0.19.1 prune (`audits/night-restore-2026-10-17/tools/rx.sh`).
|
||||
- The power-cut findings still open (R-1004, R-1005, R-1010, R-1012, R-1013).
|
||||
- Media apps on every drive (R-1023): live with the 0.313.0 floor — every drive in every media app, a new drive made ready by the box, a pulled drive loses nothing, a safe removal lets go first and the drive comes back by itself.
|
||||
|
||||
@@ -54,7 +55,6 @@
|
||||
| D7 | R-990, R-989 | Rule yes / no / later on the forum ideas (`audits/forum-research-2026-10-12/FELHOM.md` §5) and the selfh.st ideas (`audits/selfhst-survey-2026-10-12/FELHOM.md` §6) | — | — | nothing changes; the research ages | — |
|
||||
| D8 | R-206 | Install DooPlex's Docker settings from git (restarts Docker), and prune the build cache weekly: yes or no? | **Yes, in a quiet window** | — | a rebuild of DooPlex still has the settings in git | — |
|
||||
| D9 | R-1062 | The N100's USB drive is also its whole-box backup drive. Split it in two anyway? | **No — keep one drive**; the lived-in box keeps its nightly whole-box backup | Split: the box loses its local whole-box backup (or add a second drive first) | it stays one drive; multi-drive tests stay on Tester 1 | — |
|
||||
| D10 | R-1107 | The new backup program restic 0.18.1 (your brief's choice) brings 50 fixable scanner findings, because restic built it with an old Go. Move to restic 0.19.1 (19 findings, 0 critical)? | **Yes, 0.19.1** — one more version step with the same re-proof (about two hours; the tests are ready) | Stay on 0.18.1: no work; the scanner keeps counting 50 that are inside restic | 0.18.1 stays; nothing breaks; the count stays | — |
|
||||
|
||||
## Waiting on you — do
|
||||
- **Nézd meg a demo-hp-n a Calibre-Web „Adatok és mentés" fülét és a Fájlkezelőt** (`felhom.enkisfelhom.hu`, controller 0.321.0, minden dobozon kiadva). A mentés egy részben, egyszerű szavakkal; a Fájlkezelő nem kér frissítést és nem ajánl „Install app"-ot.
|
||||
|
||||
@@ -952,7 +952,7 @@ rather than being folded into a neighbour. Where the warning is SHOWN on the das
|
||||
**[DESIGN] restic is a pinned decision, never „whatever the OS ships".** Until v0.322.0 it came from the runtime's apt
|
||||
list, so a base-image move (Debian 12 → 13) would have swapped restic 0.14.0 for 0.18.0 under the off-site code with
|
||||
nobody choosing it. Since v0.323.0 the controller image carries the **official restic release binary** of one version
|
||||
(`ARG RESTIC_VERSION`, today **0.18.1**), checked at build time against restic's signed `SHA256SUMS` (vendored release
|
||||
(`ARG RESTIC_VERSION`, **0.19.1** since controller v0.324.0 — 0.18.1 in v0.323.0; operator decision 2A, R-1107), checked at build time against restic's signed `SHA256SUMS` (vendored release
|
||||
key, no keyserver) and against a per-architecture sum pinned in the Dockerfile; any mismatch fails the build. The
|
||||
Proxmox hosts run no restic at all (measured on all three test hosts): the agent's escrow path only stores and returns
|
||||
the repository password, and every restic call happens in the guest.
|
||||
@@ -964,7 +964,7 @@ holds REAL outputs of each version the code was checked against (captured on one
|
||||
|
||||
| What the code relies on | 0.18.1 |
|
||||
|---|---|
|
||||
| a missing source path is skipped with a warning, exit 0 (§6.3, SP-3.4); an unreadable file exits 3 | same |
|
||||
| a missing source path is skipped with a warning, exit 0 (§6.3, SP-3.4); an unreadable file exits 3 | 0.18.1 same; **0.19.1 exits 3 for a missing top-level path** (restic #4467) — the capture's stat-filter keeps such paths out of argv, so only a path vanishing in between reaches it, and that race now reads as the app's failure instead of a silent partial copy |
|
||||
| `backup --json` status lines (`percent_done`, totals, `current_files`) | same field names |
|
||||
| `snapshots --json`, `snapshots latest --tag … --json`, `stats <id>` / `--mode raw-data` | same shapes (new fields only) |
|
||||
| the §6.7 classes: wrong password, no repository, refused port / key, unreachable host, dead rclone ssh | same class each |
|
||||
@@ -975,8 +975,10 @@ holds REAL outputs of each version the code was checked against (captured on one
|
||||
| a store written by both: 0.14.0 reads and restores a 0.18.1 snapshot after a 0.18.1 `forget --prune`; 0.18.1 restores a 0.14.0 snapshot | proven on a scratch store; on demo-hp's real store both directions are proven (byte-identical trees); 0.14.0 reading after a 0.18.1 prune there waits for the store's next weekly clean-up window |
|
||||
|
||||
Exit codes changed (10 no repository, 11 locked, 12 wrong password); nothing in the controller reads a restic exit code.
|
||||
**Open:** the 0.18.1 binary is built with Go 1.25.1 and carries 50 fixable scanner findings (R-1107 — the operator's
|
||||
choice of 0.19.x).
|
||||
The 0.19.1 re-proof (2026-10-16 night): its notes read for every row above; fixtures for 0.14.0, 0.18.1 and 0.19.1
|
||||
recaptured from one shared store; `TestR1105_*` runs each version against 0.14.0 — same classes, same JSON, the same
|
||||
forget plan as 0.18.1. The 0.18.1 binary (Go 1.25.1) carried 50 fixable scanner findings; 0.19.1 (Go 1.26.4) is the
|
||||
reason for the move (`audits/night-restore-2026-10-17/P2/`).
|
||||
|
||||
## 7. The recovery chain (D3) — the reason this document exists
|
||||
|
||||
@@ -1153,6 +1155,28 @@ password would have failed. Separately, Grafana's `type: password` admin login w
|
||||
the sentinel value was live in the container and encrypted in the guest, and appeared in **0 files**
|
||||
anywhere under the backup namespace. Full record: `audits/D5-drive-alone-restore-2026-07-30.md`.
|
||||
|
||||
**[DESIGN — operator decision 1A, 2026-10-16 21:57; built in controller v0.324.0 — R-1106, R-127 (b)] A restored
|
||||
database comes back with the password it was saved with.** A database engine reads `POSTGRES_PASSWORD`,
|
||||
`MARIADB_ROOT_PASSWORD` and the like only when it initialises an EMPTY data directory; a restored data directory opens
|
||||
with its own password only. So when a restore puts back an app's database, the database credentials the data was
|
||||
saved with are written into the app's settings before the app starts, and they REPLACE whatever the current install
|
||||
holds. The credentials are the app.yaml variables that feed a database service's `*_PASSWORD` keys in the compose
|
||||
that will run (`appbackup.DBCredentialVars`; 17 catalog apps, 20 fields, every one `type: secret` — the catalog gate
|
||||
`db-credentials` refuses a template where that stops being true). Per route:
|
||||
|
||||
| Route | Where the database password comes from |
|
||||
|---|---|
|
||||
| On-box restore („Visszaállítás", `POST /backup/restore`), the update's rollback, „use my kept data", an off-site restore at the snapshot's version | the unit (unit-wins, `unitRestoreEnv`) |
|
||||
| Off-site full restore that keeps the app's definition (same version — the reinstall case) | the snapshot's unit, written by `stacks.SetStackSecretValues` before the database starts — **only when the snapshot replays the database's data volume**; a dump-only snapshot replays into the current data directory and keeps the current password |
|
||||
| `.fab` import | the bundle's own app.yaml (it carries the whole env) — unchanged |
|
||||
|
||||
**A restore whose unit does not carry the password is REFUSED before anything changes** — unless the current install
|
||||
is OLDER than the data (then the current value is the one the data was written with). The household reads „Ezt a
|
||||
mentést nem lehet visszaállítani: nem tartalmazza az adatbázis jelszavát, és nélküle az alkalmazás nem tudna elindulni.
|
||||
A mostani telepítés érintetlen maradt." **A database password is never generated for restored data** — O4 no longer
|
||||
reaches these names. On the reinstall path the reinstall's `type: password` admin logins are recorded as restored-login
|
||||
fields (R-694's rule — the page says to use the old password; R-926).
|
||||
|
||||
### 7.2 A tier whose prerequisites cannot be met in the failure it exists for
|
||||
|
||||
**[FACT]** Two instances, both current:
|
||||
|
||||
@@ -46,7 +46,7 @@ for V in 0.14.0 0.18.1; do
|
||||
$R -r $W/dmg check --read-data > $O/check-damaged.txt 2>&1; chmod -R u+w $W/dmg; rm -rf $W/dmg
|
||||
done
|
||||
# rewrite every local path to /data/x and the user/host names to neutral ones
|
||||
for f in $W/out/*/*; do sed -i -e "s#$W#/data/x#g" -e "s#<scratch> \"]*#/data/x#g" -e 's/user/root/g' -e 's/dooplex/box/g' "$f"; done
|
||||
for f in $W/out/*/*; do sed -i -e "s#$W#/data/x#g" -e "s#$S#/data/x#g" -e "s/$(id -un)/root/g" -e "s/$(hostname)/box/g" "$f"; done
|
||||
mkdir -p $DEST; cp -r $W/out/* $DEST/
|
||||
for V in 0.14.0 0.18.1; do echo "$V: $(ls $DEST/$V | wc -l) files, $(du -sh $DEST/$V | cut -f1)"; done
|
||||
grep -rl "$S\|claude-1000\|user" $DEST && echo "LEAK" || echo "no local path left"
|
||||
grep -rl "$S\|$(id -un)" $DEST && echo "LEAK" || echo "no local path left"
|
||||
|
||||
@@ -0,0 +1,107 @@
|
||||
##### PATH A — off-site full restore after a reinstall
|
||||
22:49:18 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
22:50:08 [1] deployed, controller state=running, pinned={'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'}
|
||||
22:50:08 install rallly: True
|
||||
22:50:08 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
22:50:08 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
22:51:29 [1] deployed, controller state=running, pinned={'grimmory': 'ghcr.io/grimmory-tools/grimmory:v3.5.0', 'grimmory-db': 'mariadb:11.4'}
|
||||
22:51:29 install grimmory: True
|
||||
22:51:33 seed rallly r1106-A: LINE 1: ...te varchar(80)); insert into r1106_marker values (r1106-A); ...
|
||||
^
|
||||
CREATE TABLE
|
||||
22:51:33 check rallly: deployed=True state=running hold=None
|
||||
22:51:36 marker row: 'ERROR: relation "r1106_marker" does not exist\nLINE 1: select note from r1106_marker\n ^' (want 'r1106-A' present)
|
||||
22:51:39 rallly log auth errors (10 min) / status: 0 | Up | About | a | minute | (healthy)
|
||||
22:51:43 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
22:51:46 front door: 301
|
||||
|
||||
22:51:49 seed grimmory r1106-A: --------------
|
||||
|
||||
ERROR 1054 (42S22) at line 1: Unknown column 'r1106' in 'VALUES'
|
||||
22:51:52 file: 0f4abe3bee6cd83e56b7a0f554cad3f6f7f91a8a0af59c024e67fbf7a01440cd /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A.txt
|
||||
22:51:53 check grimmory: deployed=True state=running hold=None
|
||||
22:51:56 marker row: '' (want 'r1106-A' present)
|
||||
22:51:59 root login (the product's dump user): 1
|
||||
22:52:03 app user login (the app's own DB user): 1
|
||||
22:52:06 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T22:52:05.285639702","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T22:52:05.28566
|
||||
22:52:09 file: 0f4abe3bee6cd83e56b7a0f554cad3f6f7f91a8a0af59c024e67fbf7a01440cd /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A.txt
|
||||
22:52:09 off-site before: status=ok last_run=2026-10-16T18:48:30Z snapshots=202
|
||||
22:52:09 POST /backup/offbox/run {} -> HTTP/2 302 /backups/remote?flash=flash.offbox.run_started
|
||||
22:52:09 + 0.0s ('running', 'dump', '', 0) files 0/0 bytes /
|
||||
22:54:47 + 157.4s ('running', '', 'plex', 0) files 0/0 bytes /
|
||||
22:54:50 + 160.4s ('running', '', 'prowlarr', 0) files 0/0 bytes /
|
||||
22:54:53 + 163.4s ('running', '', 'radarr', 0) files 0/0 bytes /
|
||||
22:54:56 + 166.5s ('running', '', 'romm', 100) files 8/10 bytes 187.9 MB/187.9 MB
|
||||
22:54:59 + 169.5s ('running', '', 'sonarr', 91) files 3/4 bytes 11.1 KB/12.2 KB
|
||||
22:55:02 + 172.5s ('running', '', 'privatebin', 0) files 0/0 bytes /
|
||||
22:55:05 + 175.6s ('running', '', 'rallly', 0) files 0/0 bytes /
|
||||
22:55:08 + 178.6s ('running', '', 'rallly', 100) files 7/7 bytes 50.1 MB/50.1 MB
|
||||
22:55:14 + 184.7s ('running', '', 'grimmory', 0) files 0/0 bytes /
|
||||
22:55:17 + 187.7s ('running', '', 'grimmory', 100) files 8/8 bytes 156.7 MB/156.7 MB
|
||||
22:55:20 + 190.7s ('running', '', 'bookstack', 100) files 11/11 bytes 160.7 MB/160.7 MB
|
||||
22:55:23 + 193.7s ('running', '', 'home-assistant', 0) files 0/0 bytes /
|
||||
22:55:26 + 196.8s ('running', '', 'home-assistant', 100) files 6/6 bytes 12.5 MB/12.5 MB
|
||||
22:55:29 + 199.8s ('running', '', 'paperless-ngx', 0) files 0/0 bytes /
|
||||
22:55:32 + 202.8s ('running', '', 'paperless-ngx', 100) files 74/74 bytes 154.1 MB/154.1 MB
|
||||
22:55:35 + 205.8s ('running', '', 'docmost', 0) files 0/0 bytes /
|
||||
22:55:38 + 208.9s ('running', '', 'kimai', 100) files 10/10 bytes 173.0 MB/173.0 MB
|
||||
22:55:41 + 211.9s ('running', 'retention', '', 0) files 0/0 bytes /
|
||||
22:55:47 + 217.9s ('ok', '', '', 0) files 0/0 bytes /
|
||||
22:55:47 off-site after: status=ok last_run=2026-10-16T20:55:46Z duration=3m31s snapshots=218 size=653.5 MB error=''
|
||||
22:56:30 remove rallly (all: remove_hdd_data=True, remove_backups=True) -> 200 {'ok': True, 'data': {'removed': 'rallly', 'volumes_removed': ['rallly_rallly_postgres_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem tárolt saját adatot kü
|
||||
22:57:04 remove grimmory (all: remove_hdd_data=True, remove_backups=True) -> 200 {'ok': True, 'data': {'removed': 'grimmory', 'volumes_removed': ['grimmory_grimmory_db'], 'hdd_paths_removed': ['/mnt/felhom-drives/hdd_1/appdata/grimmory/data (4.0K)'], 'hdd_paths_preserved': [], 'us
|
||||
22:57:07 household deletes the books-folder files: 1
|
||||
22:57:08 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
22:57:58 [1] deployed, controller state=running, pinned={'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'}
|
||||
22:57:58 install rallly: True
|
||||
22:57:58 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
22:57:58 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
22:59:29 [1] deployed, controller state=running, pinned={'grimmory': 'ghcr.io/grimmory-tools/grimmory:v3.5.0', 'grimmory-db': 'mariadb:11.4'}
|
||||
22:59:29 install grimmory: True
|
||||
## negative control after the reinstall
|
||||
22:59:29 check rallly: deployed=True state=running hold=None
|
||||
22:59:33 marker row: 'ERROR: relation "r1106_marker" does not exist\nLINE 1: select note from r1106_marker\n ^' (want 'r1106-A' present)
|
||||
22:59:36 rallly log auth errors (10 min) / status: 0 | Up | About | a | minute | (healthy)
|
||||
22:59:39 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
22:59:42 front door: 301
|
||||
|
||||
22:59:43 check grimmory: deployed=True state=running hold=None
|
||||
22:59:46 marker row: "--------------\n\nERROR 1146 (42S02) at line 1: Table 'grimmory.r1106_marker' doesn't exist" (want 'r1106-A' present)
|
||||
22:59:49 root login (the product's dump user): 1
|
||||
22:59:53 app user login (the app's own DB user): 1
|
||||
22:59:56 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T22:59:55.464371994","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T22:59:55.46441
|
||||
22:59:59 file: sha256sum: /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A.txt: No such file or directory
|
||||
23:00:03 POST /backup/offbox/restore {'app': 'rallly', 'mode': 'full'} -> HTTP/2 302 /backups/restore/app?name=rallly&full_prep=rallly&full_size=50.1+MB
|
||||
23:00:03 POST /backup/offbox/restore {'app': 'rallly', 'mode': 'full', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=rallly&flash=flash.offbox.restore_started
|
||||
23:00:03 + 0.0s restore-status (True, 'offbox-restore', None, '')
|
||||
23:00:12 + 9.1s restore-status (False, 'offbox-restore', None, '')
|
||||
23:00:12 {"running": false, "op": "offbox-restore", "stack": "rallly", "started_at": "2026-10-16T21:00:03.606006931Z", "last": {"op": "offbox-restore", "stack": "rallly", "ok": true, "message": "A(z) rallly teljes mentése visszaállítva ellenőrző mappába: /mnt/felhom-drives/hdd_1/backups/offsite-restore/rallly — a saját fájljaiddal együtt. A meglévő adatok változatlanok.", "finished_at": "2026-10-16T21:00:11.039016046Z"}, "last_recent": true}
|
||||
23:00:12 POST /backup/offbox/reconstitute {'app': 'rallly', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=rallly&flash=flash.offbox.full_restore_started
|
||||
23:00:12 + 0.0s restore-status (True, 'offbox-reconstitute', None, '')
|
||||
23:00:43 + 30.3s restore-status (False, 'offbox-reconstitute', None, '')
|
||||
23:00:43 {"running": false, "op": "offbox-reconstitute", "stack": "rallly", "started_at": "2026-10-16T21:00:12.737270741Z", "last": {"op": "offbox-reconstitute", "stack": "rallly", "ok": true, "message": "A(z) rallly: 0 fájl és 1 adatkötet és az adatbázis visszaállítva (mentés: 2026. 10. 16. 22:52) — az alkalmazás újraindult.", "finished_at": "2026-10-16T21:00:41.713460862Z"}, "last_recent": true}
|
||||
23:00:46 POST /backup/offbox/restore {'app': 'grimmory', 'mode': 'full'} -> HTTP/2 302 /backups/restore/app?name=grimmory&full_prep=grimmory&full_size=156.7+MB
|
||||
23:00:46 POST /backup/offbox/restore {'app': 'grimmory', 'mode': 'full', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=grimmory&flash=flash.offbox.restore_started
|
||||
23:00:46 + 0.0s restore-status (True, 'offbox-restore', None, '')
|
||||
23:00:55 + 9.1s restore-status (False, 'offbox-restore', None, '')
|
||||
23:00:55 {"running": false, "op": "offbox-restore", "stack": "grimmory", "started_at": "2026-10-16T21:00:46.868233201Z", "last": {"op": "offbox-restore", "stack": "grimmory", "ok": true, "message": "A(z) grimmory teljes mentése visszaállítva ellenőrző mappába: /mnt/felhom-drives/hdd_1/backups/offsite-restore/grimmory — a saját fájljaiddal együtt. A meglévő adatok változatlanok.", "finished_at": "2026-10-16T21:00:55.045276695Z"}, "last_recent": true}
|
||||
23:00:55 POST /backup/offbox/reconstitute {'app': 'grimmory', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=grimmory&flash=flash.offbox.full_restore_started
|
||||
23:00:56 + 0.0s restore-status (True, 'offbox-reconstitute', None, '')
|
||||
23:01:50 + 54.5s restore-status (False, 'offbox-reconstitute', None, '')
|
||||
23:01:50 {"running": false, "op": "offbox-reconstitute", "stack": "grimmory", "started_at": "2026-10-16T21:00:55.98356812Z", "last": {"op": "offbox-reconstitute", "stack": "grimmory", "ok": true, "message": "A(z) grimmory: 1 fájl és 1 adatkötet és az adatbázis visszaállítva (mentés: 2026. 10. 16. 22:52) — az alkalmazás újraindult.", "finished_at": "2026-10-16T21:01:48.947953301Z"}, "last_recent": true}
|
||||
## after the off-site restore
|
||||
23:02:50 check rallly: deployed=True state=running hold=None
|
||||
23:02:54 marker row: 'ERROR: relation "r1106_marker" does not exist\nLINE 1: select note from r1106_marker;\n ^' (want 'r1106-A' present)
|
||||
23:02:57 rallly log auth errors (10 min) / status: 0 | Up | 2 | minutes | (healthy)
|
||||
23:03:00 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:03:03 front door: 301
|
||||
|
||||
23:03:04 check grimmory: deployed=True state=running hold=None
|
||||
23:03:07 marker row: '' (want 'r1106-A' present)
|
||||
23:03:10 root login (the product's dump user): 1
|
||||
23:03:14 app user login (the app's own DB user): 1
|
||||
23:03:17 app health: Up 2 minutes (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:03:16.428599078","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:03:16.42862
|
||||
23:03:20 file: 0f4abe3bee6cd83e56b7a0f554cad3f6f7f91a8a0af59c024e67fbf7a01440cd /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A.txt
|
||||
@@ -0,0 +1,95 @@
|
||||
##### PATH A2 — off-site full restore after a reinstall (seed fixed)
|
||||
23:12:31 seed rallly r1106-A2: CREATE TABLE
|
||||
INSERT 0 1
|
||||
r1106-A2
|
||||
23:12:31 check rallly: deployed=True state=running hold=None
|
||||
23:12:34 marker row: 'r1106-A2' (want 'r1106-A2' present)
|
||||
23:12:37 rallly log auth errors (10 min) / status: 0 | Up | 12 | minutes | (healthy)
|
||||
23:12:41 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:12:44 front door: 301
|
||||
|
||||
23:12:48 seed grimmory r1106-A2: r1106-A2
|
||||
23:12:51 file: 50a1cfbcde9a13e801c30d3bd9f65457e3249704a3c925fe5e8d6baba886ea79 /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A2.txt
|
||||
23:12:51 check grimmory: deployed=True state=running hold=None
|
||||
23:12:54 marker row: 'r1106-A2' (want 'r1106-A2' present)
|
||||
23:12:58 root login (the product's dump user): 1
|
||||
23:13:01 app user login (the app's own DB user): 1
|
||||
23:13:04 app health: Up 11 minutes (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:13:03.583521678","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:13:03.58356
|
||||
23:13:07 file: 50a1cfbcde9a13e801c30d3bd9f65457e3249704a3c925fe5e8d6baba886ea79 /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A2.txt
|
||||
23:13:07 off-site before: status=ok last_run=2026-10-16T20:55:46Z snapshots=218
|
||||
23:13:07 POST /backup/offbox/run {} -> HTTP/2 302 /backups/remote?flash=flash.offbox.run_started
|
||||
23:13:07 + 0.0s ('running', 'dump', '', 0) files 0/0 bytes /
|
||||
23:15:42 + 154.3s ('running', '', 'romm', 0) files 0/0 bytes /
|
||||
23:15:45 + 157.4s ('running', '', 'sonarr', 0) files 0/0 bytes /
|
||||
23:15:48 + 160.4s ('running', '', 'bentopdf', 0) files 0/0 bytes /
|
||||
23:15:51 + 163.4s ('running', '', 'rallly', 0) files 0/0 bytes /
|
||||
23:15:54 + 166.4s ('running', '', 'grimmory', 0) files 0/0 bytes /
|
||||
23:15:57 + 169.5s ('running', '', 'bookstack', 0) files 0/0 bytes /
|
||||
23:16:00 + 172.5s ('running', '', 'calibre-web', 0) files 0/0 bytes /
|
||||
23:16:03 + 175.5s ('running', '', 'home-assistant', 100) files 6/6 bytes 12.6 MB/12.6 MB
|
||||
23:16:06 + 178.5s ('running', '', 'paperless-ngx', 0) files 0/0 bytes /
|
||||
23:16:09 + 181.6s ('running', '', 'docmost', 0) files 0/0 bytes /
|
||||
23:16:12 + 184.6s ('running', '', 'kimai', 0) files 0/0 bytes /
|
||||
23:16:15 + 187.6s ('running', '', 'plex', 0) files 0/0 bytes /
|
||||
23:16:18 + 190.6s ('running', 'retention', '', 0) files 0/0 bytes /
|
||||
23:16:24 + 196.7s ('ok', '', '', 0) files 0/0 bytes /
|
||||
23:16:24 off-site after: status=ok last_run=2026-10-16T21:16:23Z duration=3m12s snapshots=234 size=670.9 MB error=''
|
||||
23:17:07 remove rallly (all: remove_hdd_data=True, remove_backups=True) -> 200 {'ok': True, 'data': {'removed': 'rallly', 'volumes_removed': ['rallly_rallly_postgres_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem tárolt saját adatot kü
|
||||
23:17:41 remove grimmory (all: remove_hdd_data=True, remove_backups=True) -> 200 {'ok': True, 'data': {'removed': 'grimmory', 'volumes_removed': ['grimmory_grimmory_db'], 'hdd_paths_removed': ['/mnt/felhom-drives/hdd_1/appdata/grimmory/data (4.0K)'], 'hdd_paths_preserved': [], 'us
|
||||
23:17:45 household deletes the books-folder files: 2
|
||||
23:17:45 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
23:18:35 [1] deployed, controller state=running, pinned={'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'}
|
||||
23:18:35 install rallly: True
|
||||
23:18:35 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
23:18:36 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
23:19:56 [1] deployed, controller state=running, pinned={'grimmory': 'ghcr.io/grimmory-tools/grimmory:v3.5.0', 'grimmory-db': 'mariadb:11.4'}
|
||||
23:19:56 install grimmory: True
|
||||
## A2 negative control after the reinstall
|
||||
23:19:56 check rallly: deployed=True state=running hold=None
|
||||
23:20:00 marker row: 'ERROR: relation "r1106_marker" does not exist\nLINE 1: select note from r1106_marker;\n ^' (want 'r1106-A2' present)
|
||||
23:20:03 rallly log auth errors (10 min) / status: 0 | Up | About | a | minute | (healthy)
|
||||
23:20:06 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:20:10 front door: 301
|
||||
|
||||
23:20:10 check grimmory: deployed=True state=running hold=None
|
||||
23:20:13 marker row: "--------------\n\nERROR 1146 (42S02) at line 1: Table 'grimmory.r1106_marker' doesn't exist" (want 'r1106-A2' present)
|
||||
23:20:16 root login (the product's dump user): 1
|
||||
23:20:20 app user login (the app's own DB user): 1
|
||||
23:20:23 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:20:22.859735764","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:20:22.85975
|
||||
23:20:26 file: sha256sum: /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A2.txt: No such file or directory
|
||||
23:20:30 POST /backup/offbox/restore {'app': 'rallly', 'mode': 'full'} -> HTTP/2 302 /backups/restore/app?name=rallly&full_prep=rallly&full_size=66.9+MB
|
||||
23:20:30 POST /backup/offbox/restore {'app': 'rallly', 'mode': 'full', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=rallly&flash=flash.offbox.restore_started
|
||||
23:20:30 + 0.0s restore-status (True, 'offbox-restore', None, '')
|
||||
23:20:39 + 9.1s restore-status (False, 'offbox-restore', None, '')
|
||||
23:20:39 {"running": false, "op": "offbox-restore", "stack": "rallly", "started_at": "2026-10-16T21:20:30.883566825Z", "last": {"op": "offbox-restore", "stack": "rallly", "ok": true, "message": "A(z) rallly teljes mentése visszaállítva ellenőrző mappába: /mnt/felhom-drives/hdd_1/backups/offsite-restore/rallly — a saját fájljaiddal együtt. A meglévő adatok változatlanok.", "finished_at": "2026-10-16T21:20:38.696061676Z"}, "last_recent": true}
|
||||
23:20:40 POST /backup/offbox/reconstitute {'app': 'rallly', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=rallly&flash=flash.offbox.full_restore_started
|
||||
23:20:40 + 0.0s restore-status (True, 'offbox-reconstitute', None, '')
|
||||
23:21:10 + 30.3s restore-status (False, 'offbox-reconstitute', None, '')
|
||||
23:21:10 {"running": false, "op": "offbox-reconstitute", "stack": "rallly", "started_at": "2026-10-16T21:20:40.00486394Z", "last": {"op": "offbox-reconstitute", "stack": "rallly", "ok": true, "message": "A(z) rallly: 0 fájl és 1 adatkötet és az adatbázis visszaállítva (mentés: 2026. 10. 16. 23:13) — az alkalmazás újraindult.", "finished_at": "2026-10-16T21:21:09.345344912Z"}, "last_recent": true}
|
||||
23:21:14 POST /backup/offbox/restore {'app': 'grimmory', 'mode': 'full'} -> HTTP/2 302 /backups/restore/app?name=grimmory&full_prep=grimmory&full_size=156.8+MB
|
||||
23:21:14 POST /backup/offbox/restore {'app': 'grimmory', 'mode': 'full', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=grimmory&flash=flash.offbox.restore_started
|
||||
23:21:14 + 0.0s restore-status (True, 'offbox-restore', None, '')
|
||||
23:21:23 + 9.1s restore-status (False, 'offbox-restore', None, '')
|
||||
23:21:23 {"running": false, "op": "offbox-restore", "stack": "grimmory", "started_at": "2026-10-16T21:21:14.156589916Z", "last": {"op": "offbox-restore", "stack": "grimmory", "ok": true, "message": "A(z) grimmory teljes mentése visszaállítva ellenőrző mappába: /mnt/felhom-drives/hdd_1/backups/offsite-restore/grimmory — a saját fájljaiddal együtt. A meglévő adatok változatlanok.", "finished_at": "2026-10-16T21:21:22.333018655Z"}, "last_recent": true}
|
||||
23:21:23 POST /backup/offbox/reconstitute {'app': 'grimmory', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=grimmory&flash=flash.offbox.full_restore_started
|
||||
23:21:23 + 0.0s restore-status (True, 'offbox-reconstitute', None, '')
|
||||
23:22:17 + 54.5s restore-status (False, 'offbox-reconstitute', None, '')
|
||||
23:22:17 {"running": false, "op": "offbox-reconstitute", "stack": "grimmory", "started_at": "2026-10-16T21:21:23.276103566Z", "last": {"op": "offbox-reconstitute", "stack": "grimmory", "ok": true, "message": "A(z) grimmory: 2 fájl és 1 adatkötet és az adatbázis visszaállítva (mentés: 2026. 10. 16. 23:13) — az alkalmazás újraindult.", "finished_at": "2026-10-16T21:22:15.633221727Z"}, "last_recent": true}
|
||||
## A2 after the off-site restore
|
||||
23:23:02 check rallly: deployed=True state=running hold=None
|
||||
23:23:07 marker row: 'r1106-A2' (want 'r1106-A2' present)
|
||||
23:23:10 rallly log auth errors (10 min) / status: 0 | Up | 2 | minutes | (healthy)
|
||||
23:23:14 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:23:18 front door: 301
|
||||
|
||||
23:23:18 check grimmory: deployed=True state=running hold=None
|
||||
23:23:22 marker row: 'r1106-A2' (want 'r1106-A2' present)
|
||||
23:23:26 root login (the product's dump user): 1
|
||||
23:23:30 app user login (the app's own DB user): 1
|
||||
23:23:34 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:23:33.152578787","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:23:33.15260
|
||||
23:23:38 file: 50a1cfbcde9a13e801c30d3bd9f65457e3249704a3c925fe5e8d6baba886ea79 /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A2.txt
|
||||
/mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/night-restore-2026-10-17/tools/run_AB.sh: line 12: syntax error near unexpected token `)'
|
||||
/mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/night-restore-2026-10-17/tools/run_AB.sh: line 12: `echo "##### PATH B — on-box restore („Visszaállítás") after a reinstall"'
|
||||
@@ -0,0 +1,79 @@
|
||||
##### PATH B — on-box restore (Visszaallitas) after a reinstall
|
||||
23:24:08 seed rallly r1106-B: INSERT 0 1
|
||||
r1106-A2
|
||||
r1106-B
|
||||
23:24:13 seed grimmory r1106-B: r1106-A2
|
||||
r1106-B
|
||||
23:24:17 file: c90bc7913f76e3b72bd245b1f4f0b6c3b2be0a6de62bf95374eb47f62b9fb7cf /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-B.txt
|
||||
23:24:17 off-site before: status=ok last_run=2026-10-16T21:16:23Z snapshots=234
|
||||
23:24:17 POST /backup/offbox/run {} -> HTTP/2 302 /backups/remote?flash=flash.offbox.run_started
|
||||
23:24:17 + 0.0s ('running', 'dump', '', 0) files 0/0 bytes /
|
||||
23:27:10 + 172.5s ('running', '', 'opengist', 0) files 0/0 bytes /
|
||||
23:27:13 + 175.6s ('running', '', 'docmost', 0) files 0/0 bytes /
|
||||
23:27:16 + 178.6s ('running', '', 'kimai', 0) files 0/0 bytes /
|
||||
23:27:19 + 181.6s ('running', '', 'plex', 0) files 0/0 bytes /
|
||||
23:27:22 + 184.6s ('running', '', 'prowlarr', 100) files 4/4 bytes 9.1 KB/9.1 KB
|
||||
23:27:25 + 187.7s ('running', '', 'romm', 0) files 0/0 bytes /
|
||||
23:27:28 + 190.7s ('running', '', 'sonarr', 0) files 0/0 bytes /
|
||||
23:27:31 + 193.7s ('running', '', 'bentopdf', 0) files 0/0 bytes /
|
||||
23:27:34 + 196.8s ('running', '', 'rallly', 0) files 0/0 bytes /
|
||||
23:27:37 + 199.8s ('running', '', 'rallly', 100) files 8/8 bytes 67.0 MB/67.0 MB
|
||||
23:27:40 + 202.8s ('running', '', 'grimmory', 0) files 0/0 bytes /
|
||||
23:27:43 + 205.8s ('running', '', 'bookstack', 0) files 0/0 bytes /
|
||||
23:27:46 + 208.9s ('running', '', 'calibre-web', 0) files 0/0 bytes /
|
||||
23:27:49 + 211.9s ('running', '', 'home-assistant', 0) files 0/0 bytes /
|
||||
23:27:52 + 214.9s ('running', 'retention', '', 0) files 0/0 bytes /
|
||||
23:27:58 + 221.0s ('ok', '', '', 0) files 0/0 bytes /
|
||||
23:27:58 off-site after: status=ok last_run=2026-10-16T21:27:57Z duration=3m35s snapshots=250 size=687.5 MB error=''
|
||||
23:28:41 remove rallly (keepbackups: remove_hdd_data=True, remove_backups=False) -> 200 {'ok': True, 'data': {'removed': 'rallly', 'volumes_removed': ['rallly_rallly_postgres_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem tárolt saját adatot kü
|
||||
23:29:15 remove grimmory (keepbackups: remove_hdd_data=True, remove_backups=False) -> 200 {'ok': True, 'data': {'removed': 'grimmory', 'volumes_removed': ['grimmory_grimmory_db'], 'hdd_paths_removed': ['/mnt/felhom-drives/hdd_1/appdata/grimmory/data (4.0K)'], 'hdd_paths_preserved': [], 'us
|
||||
23:29:19 household deletes the books-folder files: 3
|
||||
23:29:20 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
23:30:15 [1] deployed, controller state=running, pinned={'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'}
|
||||
23:30:15 install rallly: True
|
||||
23:30:15 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
23:30:15 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
23:31:36 [1] deployed, controller state=running, pinned={'grimmory': 'ghcr.io/grimmory-tools/grimmory:v3.5.0', 'grimmory-db': 'mariadb:11.4'}
|
||||
23:31:36 install grimmory: True
|
||||
## B negative control after the reinstall
|
||||
23:31:36 check rallly: deployed=True state=running hold=None
|
||||
23:31:40 marker row: 'ERROR: relation "r1106_marker" does not exist\nLINE 1: select note from r1106_marker;\n ^' (want 'r1106-B' present)
|
||||
23:31:43 rallly log auth errors (10 min) / status: 0 | Up | About | a | minute | (healthy)
|
||||
23:31:46 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:31:50 front door: 301
|
||||
|
||||
23:31:50 check grimmory: deployed=True state=running hold=None
|
||||
23:31:53 marker row: "--------------\n\nERROR 1146 (42S02) at line 1: Table 'grimmory.r1106_marker' doesn't exist" (want 'r1106-B' present)
|
||||
23:31:56 root login (the product's dump user): 1
|
||||
23:32:00 app user login (the app's own DB user): 1
|
||||
23:32:03 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:32:02.311256259","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:32:02.31127
|
||||
23:32:06 file: sha256sum: /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-B.txt: No such file or directory
|
||||
23:32:06 [R] restoring rallly from snapshot 'helyi' (of 1 offered)
|
||||
23:32:06 [R] POST /backup/restore -> HTTP/2 302 ['location: /backups/restore?flash=flash.restore.started']
|
||||
23:32:06 + 0.0s restore (True, None, None)
|
||||
23:32:34 + 28.3s restore (False, None, None)
|
||||
23:32:34 [R] after restore: state=running hold=None phase=None
|
||||
23:32:38 onbox restore: {"ok": true, "snapshot_id": "helyi", "http": "HTTP/2 302", "location": ["location: /backups/restore?flash=flash.restore.started"], "seconds": 28.4}
|
||||
23:32:38 restore-status: {"running": false, "op": "restore", "stack": "rallly", "started_at": "2026-10-16T21:32:06.602574836Z", "last": {"op": "restore", "stack": "rallly", "ok": true, "message": "A(z) rallly: 1 adatkötet és az adatbázis visszaállítva — az alkalmazás újraindult.", "finished_at": "2026-10-16T21:32:33.370797695Z"}, "last_recent": true}
|
||||
23:32:38 [R] restoring grimmory from snapshot 'helyi' (of 1 offered)
|
||||
23:33:18 [R] POST /backup/restore -> HTTP/2 302 ['location: /backups/restore?flash_error=Ez+a+ment%C3%A9s+nem+tartalmazza+az+alkalmaz%C3%A1s+f%C3%A1jljait%2C+ez%C3%A9rt+nem+%C3%A1ll%C3%ADtjuk+vissza+az+adatb%C3%A1zist+f%C3%B6l%C3%A9j%C3%BCk+%E2%80%94+a+f%C3%A1jlok+%C3%ADgy+a+hely%C3%BCk%C3%B6n+maradnak.+A+f%C3%A1jlok+a+t%C3%A1voli+m%C3%A1solatb%C3%B3l+%C3%A1ll%C3%ADthat%C3%B3k+vissza%3A+Biztons%C3%A1gi+ment%C3%A9s+%E2%86%92+Vissza%C3%A1ll%C3%ADt%C3%A1s%2C+%E2%80%9ETeljes+vissza%C3%A1ll%C3%ADt%C3%A1s+%28f%C3%A1jlok+%2B+adatb%C3%A1zis%29%E2%80%9D.']
|
||||
23:33:18 + 0.0s restore (False, None, None)
|
||||
23:33:25 [R] after restore: state=running hold=None phase=None
|
||||
23:33:28 onbox restore: {"ok": true, "snapshot_id": "helyi", "http": "HTTP/2 302", "location": ["location: /backups/restore?flash_error=Ez+a+ment%C3%A9s+nem+tartalmazza+az+alkalmaz%C3%A1s+f%C3%A1jljait%2C+ez%C3%A9rt+nem+%C3%A1ll%C3%ADtjuk+vissza+az+adatb%C3%A1zist+f%C3%B6l%C3%A9j%C3%BCk+%E2%80%94+a+f%C3%A1jlok+%C3%ADgy+a+hely%C3%BCk%C3%B6n+maradnak.+A+f%C3%A1jlok+a+t%C3%A1voli+m%C3%A1solatb%C3%B3l+%C3%A1ll%C3%ADthat%C3%B3k+vissza%3A+Biztons%C3%A1gi+ment%C3%A9s+%E2%86%92+Vissza%C3%A1ll%C3%ADt%C3%A1s%2C+%E2%80%9ETeljes+vissza%C3%A1ll%C3%ADt%C3%A1s+%28f%C3%A1jlok+%2B+adatb%C3%A1zis%29%E2%80%9D."], "seconds": 6.1}
|
||||
23:33:28 restore-status: {"running": false, "op": "restore", "stack": "rallly", "started_at": "2026-10-16T21:32:06.602574836Z", "last": {"op": "restore", "stack": "rallly", "ok": true, "message": "A(z) rallly: 1 adatkötet és az adatbázis visszaállítva — az alkalmazás újraindult.", "finished_at": "2026-10-16T21:32:33.370797695Z"}, "last_recent": true}
|
||||
## B after the on-box restore
|
||||
23:34:14 check rallly: deployed=True state=running hold=None
|
||||
23:34:17 marker row: 'r1106-A2\nr1106-B' (want 'r1106-B' present)
|
||||
23:34:21 rallly log auth errors (10 min) / status: 0 | Up | About | a | minute | (healthy)
|
||||
23:34:24 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:34:27 front door: 301
|
||||
|
||||
23:34:27 check grimmory: deployed=True state=running hold=None
|
||||
23:34:31 marker row: "--------------\n\nERROR 1146 (42S02) at line 1: Table 'grimmory.r1106_marker' doesn't exist" (want 'r1106-B' present)
|
||||
23:34:34 root login (the product's dump user): 1
|
||||
23:34:37 app user login (the app's own DB user): 1
|
||||
23:34:41 app health: Up 3 minutes (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:34:39.959127823","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:34:39.95916
|
||||
23:34:44 file: sha256sum: /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-B.txt: No such file or directory
|
||||
##### DONE
|
||||
@@ -0,0 +1,18 @@
|
||||
##### REFUSAL — a unit without the database password, over a newer install (rallly)
|
||||
unit app.yaml now carries DB_PASSWORD: 0
|
||||
deployed_at: "2026-10-16T21:32:19Z"
|
||||
"dumps_at": "2026-10-16T21:24:17Z
|
||||
23:35:13 [R] restoring rallly from snapshot 'helyi' (of 1 offered)
|
||||
23:35:13 [R] POST /backup/restore -> HTTP/2 302 ['location: /backups/restore?flash=flash.restore.started']
|
||||
23:35:13 + 0.0s restore (False, None, None)
|
||||
23:35:19 [R] after restore: state=running hold=None phase=None
|
||||
23:35:22 onbox restore: {"ok": true, "snapshot_id": "helyi", "http": "HTTP/2 302", "location": ["location: /backups/restore?flash=flash.restore.started"], "seconds": 6.1}
|
||||
23:35:22 restore-status: {"running": false, "op": "restore", "stack": "rallly", "started_at": "2026-10-16T21:35:13.244020136Z", "last": {"op": "restore", "stack": "rallly", "ok": false, "message": "Visszaállítás sikertelen: Ezt a mentést nem lehet visszaállítani: nem tartalmazza az adatbázis jelszavát, és nélküle az alkalmazás nem tudna elindulni. A mostani telepítés érintetlen maradt.", "finished_at": "2026-10-16T21:35:13.253731205Z"}, "last_recent": true}
|
||||
23:35:42 check rallly: deployed=True state=running hold=None
|
||||
23:35:46 marker row: 'r1106-A2\nr1106-B' (want 'r1106-B' present)
|
||||
23:35:49 rallly log auth errors (10 min) / status: 0 | Up | 3 | minutes | (healthy)
|
||||
23:35:52 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:35:55 front door: 301
|
||||
|
||||
2026/10/16 21:35:13 restore_dbcreds.go:111: [ERROR] [backup] Restore REFUSED for rallly before any change: restore refused: the backup does not carry the database password: [DB_PASSWORD] (the current install is not older than the data, or no value at all) (R-1
|
||||
unit restored: DB_PASSWORD lines 1
|
||||
@@ -0,0 +1,51 @@
|
||||
##### PATH D — install from backup (use kept data), grimmory
|
||||
23:36:10 seed grimmory r1106-D: r1106-D
|
||||
23:36:13 file: b9a6247e71922dce28dfccaabaebee528e89f125052cb799ea3e8ba2bd579b9e /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-D.txt
|
||||
23:36:13 check grimmory: deployed=True state=running hold=None
|
||||
23:36:16 marker row: 'r1106-D' (want 'r1106-D' present)
|
||||
23:36:19 root login (the product's dump user): 1
|
||||
23:36:23 app user login (the app's own DB user): 1
|
||||
23:36:26 app health: Up 5 minutes (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:36:25.554584861","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:36:25.55460
|
||||
23:36:29 file: b9a6247e71922dce28dfccaabaebee528e89f125052cb799ea3e8ba2bd579b9e /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-D.txt
|
||||
23:36:29 off-site before: status=ok last_run=2026-10-16T21:27:57Z snapshots=250
|
||||
23:36:29 POST /backup/offbox/run {} -> HTTP/2 302 /backups/remote?flash=flash.offbox.run_started
|
||||
23:36:30 + 0.0s ('running', 'dump', '', 0) files 0/0 bytes /
|
||||
23:39:07 + 157.3s ('running', '', 'grimmory', 0) files 0/0 bytes /
|
||||
23:39:10 + 160.4s ('running', '', 'bookstack', 0) files 0/0 bytes /
|
||||
23:39:13 + 163.4s ('running', '', 'calibre-web', 0) files 0/0 bytes /
|
||||
23:39:16 + 166.4s ('running', '', 'home-assistant', 0) files 0/0 bytes /
|
||||
23:39:19 + 169.4s ('running', '', 'home-assistant', 100) files 6/6 bytes 12.7 MB/12.7 MB
|
||||
23:39:22 + 172.5s ('running', '', 'opengist', 0) files 0/0 bytes /
|
||||
23:39:25 + 175.5s ('running', '', 'paperless-ngx', 100) files 74/74 bytes 154.1 MB/154.1 MB
|
||||
23:39:28 + 178.5s ('running', '', 'docmost', 100) files 12/12 bytes 105.1 MB/105.1 MB
|
||||
23:39:31 + 181.5s ('running', '', 'plex', 0) files 0/0 bytes /
|
||||
23:39:34 + 184.6s ('running', '', 'prowlarr', 0) files 0/0 bytes /
|
||||
23:39:37 + 187.6s ('running', '', 'romm', 0) files 0/0 bytes /
|
||||
23:39:40 + 190.6s ('running', '', 'romm', 100) files 10/10 bytes 189.8 MB/189.8 MB
|
||||
23:39:43 + 193.6s ('running', '', 'bentopdf', 0) files 0/0 bytes /
|
||||
23:39:46 + 196.7s ('running', '', 'privatebin', 0) files 0/0 bytes /
|
||||
23:39:49 + 199.7s ('running', '', 'rallly', 100) files 8/8 bytes 67.5 MB/67.5 MB
|
||||
23:39:52 + 202.7s ('running', 'retention', '', 0) files 0/0 bytes /
|
||||
23:39:58 + 208.8s ('ok', '', '', 0) files 0/0 bytes /
|
||||
23:39:58 off-site after: status=ok last_run=2026-10-16T21:39:56Z duration=3m23s snapshots=266 size=704.6 MB error=''
|
||||
23:40:32 remove grimmory (keepdata: remove_hdd_data=False, remove_backups=False) -> 200 {'ok': True, 'data': {'removed': 'grimmory', 'volumes_removed': ['grimmory_grimmory_db'], 'hdd_paths_removed': [], 'hdd_paths_preserved': ['/mnt/felhom-drives/hdd_1/appdata/grimmory/data (4.0K)'], 'us
|
||||
## after remove (data kept)
|
||||
/mnt/felhom-drives/hdd_1/appdata/grimmory/:
|
||||
data
|
||||
|
||||
/mnt/felhom-drives/hdd_1/userdata/media/grimmory/:
|
||||
r1106-D.txt
|
||||
0
|
||||
23:40:33 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
23:40:34 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
23:41:59 [1] deployed, controller state=running, pinned={'grimmory': 'ghcr.io/grimmory-tools/grimmory:v3.5.0', 'grimmory-db': 'mariadb:11.4'}
|
||||
23:41:59 install grimmory with kept_data=use: True
|
||||
## after install with kept data
|
||||
23:42:29 check grimmory: deployed=True state=running hold=None
|
||||
23:42:33 marker row: "--------------\n\nERROR 1146 (42S02) at line 1: Table 'grimmory.r1106_marker' doesn't exist" (want 'r1106-D' present)
|
||||
23:42:36 root login (the product's dump user): 1
|
||||
23:42:39 app user login (the app's own DB user): 1
|
||||
23:42:43 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:42:42.23419292","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:42:42.234213
|
||||
23:42:46 file: b9a6247e71922dce28dfccaabaebee528e89f125052cb799ea3e8ba2bd579b9e /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-D.txt
|
||||
@@ -0,0 +1,43 @@
|
||||
##### PATH D2 — install from backup (use kept data), grimmory, with app data in appdata/grimmory/data
|
||||
dc2f9452f403591fc4a69f587af72cab73fb8d942d14a4e196481caf6703546e /mnt/felhom-drives/hdd_1/appdata/grimmory/data/r1106-cover.bin
|
||||
23:43:14 seed grimmory r1106-D2: r1106-D2
|
||||
23:43:17 file: a584aeaa731c68ace4355bbcffa492f6f578af38c12142ff943aeb2880564ab0 /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-D2.txt
|
||||
23:43:18 off-site before: status=ok last_run=2026-10-16T21:39:56Z snapshots=266
|
||||
23:43:18 POST /backup/offbox/run {} -> HTTP/2 302 /backups/remote?flash=flash.offbox.run_started
|
||||
23:43:18 + 0.0s ('running', 'dump', '', 0) files 0/0 bytes /
|
||||
23:45:52 + 154.3s ('running', '', 'calibre-web', 0) files 0/0 bytes /
|
||||
23:45:55 + 157.3s ('running', '', 'home-assistant', 0) files 0/0 bytes /
|
||||
23:45:58 + 160.4s ('running', '', 'opengist', 0) files 0/0 bytes /
|
||||
23:46:01 + 163.4s ('running', '', 'paperless-ngx', 28) files 70/74 bytes 42.6 MB/154.2 MB
|
||||
23:46:04 + 166.4s ('running', '', 'docmost', 0) files 0/0 bytes /
|
||||
23:46:07 + 169.4s ('running', '', 'plex', 0) files 0/0 bytes /
|
||||
23:46:10 + 172.5s ('running', '', 'prowlarr', 0) files 0/0 bytes /
|
||||
23:46:13 + 175.5s ('running', '', 'radarr', 0) files 0/0 bytes /
|
||||
23:46:16 + 178.5s ('running', '', 'romm', 100) files 10/10 bytes 190.0 MB/190.0 MB
|
||||
23:46:19 + 181.5s ('running', '', 'bentopdf', 0) files 0/0 bytes /
|
||||
23:46:22 + 184.6s ('running', '', 'privatebin', 0) files 0/0 bytes /
|
||||
23:46:25 + 187.6s ('running', '', 'rallly', 100) files 8/8 bytes 67.5 MB/67.5 MB
|
||||
23:46:28 + 190.6s ('running', '', 'grimmory', 100) files 11/11 bytes 156.9 MB/156.9 MB
|
||||
23:46:31 + 193.6s ('running', 'retention', '', 0) files 0/0 bytes /
|
||||
23:46:37 + 199.7s ('ok', '', '', 0) files 0/0 bytes /
|
||||
23:46:37 off-site after: status=ok last_run=2026-10-16T21:46:35Z duration=3m13s snapshots=282 size=719.2 MB error=''
|
||||
23:47:11 remove grimmory (keepdata: remove_hdd_data=False, remove_backups=False) -> 200 {'ok': True, 'data': {'removed': 'grimmory', 'volumes_removed': ['grimmory_grimmory_db'], 'hdd_paths_removed': [], 'hdd_paths_preserved': ['/mnt/felhom-drives/hdd_1/appdata/grimmory/data (8.0K)'], 'us
|
||||
23:47:11 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
23:47:13 [1] deploy -> 202 {'ok': True, 'message': 'A(z) Grimmory megőrzött adatainak betöltése elindult.'}
|
||||
23:47:38 [1] deployed, controller state=unhealthy, pinned={'grimmory': 'ghcr.io/grimmory-tools/grimmory:v3.5.0', 'grimmory-db': 'mariadb:11.4'}
|
||||
23:47:38 [1] NOTE: the controller's own state is 'unhealthy', not 'running' — recorded, not treated as a failure; the fixture's front-door wait is the real gate
|
||||
23:47:38 install grimmory with kept_data=use: True
|
||||
2026/10/16 21:47:12 image_retention.go:238: [INFO] [stacks] image retention (remove of grimmory): pass over 53 image(s) of [ghcr.io/grimmory-tools/grimmory mariadb] — 2 candidate(s), 2 deleted, the rest kept
|
||||
2026/10/16 21:47:13 kept_install.go:97: [INFO] [api] Deploy grimmory: USE MY KEPT DATA — loading from /mnt/felhom-drives/hdd_1/backups/primary/grimmory (tier 1, 2026-10-16T21:43:18Z) under the kept files [/mnt/felhom-drives/hdd_
|
||||
2026/10/16 21:47:13 restore_dbcreds.go:114: [INFO] [backup] Restore grimmory: database password(s) [DB_PASSWORD DB_ROOT_PASSWORD] come from the backup, [] stay as installed (older than the data) — values not logged (R-1106)
|
||||
2026/10/16 21:48:29 restore_unit.go:487: [INFO] [backup] Restore-from-unit completed: grimmory — 1 volume(s) of 1 listed, 1 database(s) of 1 listed
|
||||
2026/10/16 21:48:29 kept_load.go:331: [INFO] [backup] kept load grimmory from /mnt/felhom-drives/hdd_1/backups/primary/grimmory done in 1m16s (volumes 1/1, dbs 1/1)
|
||||
dc2f9452f403591fc4a69f587af72cab73fb8d942d14a4e196481caf6703546e /mnt/felhom-drives/hdd_1/appdata/grimmory/data/r1106-cover.bin
|
||||
## after install with kept data
|
||||
23:48:40 check grimmory: deployed=True state=running hold=None
|
||||
23:48:43 marker row: 'r1106-D2' (want 'r1106-D2' present)
|
||||
23:48:47 root login (the product's dump user): 1
|
||||
23:48:50 app user login (the app's own DB user): 1
|
||||
23:48:53 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:48:52.592861758","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:48:52.59288
|
||||
23:48:56 file: a584aeaa731c68ace4355bbcffa492f6f578af38c12142ff943aeb2880564ab0 /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-D2.txt
|
||||
@@ -0,0 +1,11 @@
|
||||
23:54:12 remove rallly (all: remove_hdd_data=True, remove_backups=True) -> 200 {'ok': True, 'data': {'removed': 'rallly', 'volumes_removed': ['rallly_rallly_postgres_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem tárolt saját adatot kü
|
||||
23:54:46 remove grimmory (all: remove_hdd_data=True, remove_backups=True) -> 200 {'ok': True, 'data': {'removed': 'grimmory', 'volumes_removed': ['grimmory_grimmory_db'], 'hdd_paths_removed': ['/mnt/felhom-drives/hdd_1/appdata/grimmory/data (8.0K)'], 'hdd_paths_preserved': [], 'us
|
||||
23:54:49 household deletes the books-folder files: 2
|
||||
0
|
||||
rmdir: failed to remove '/mnt/felhom-drives/hdd_1/appdata/grimmory/data': No such file or directory
|
||||
0
|
||||
0
|
||||
ls: cannot access '/mnt/sys_drive/felhom-data/backups/primary/rallly': No such file or directory
|
||||
ls: cannot access '/mnt/felhom-drives/hdd_1/backups/primary/grimmory': No such file or directory
|
||||
ls: cannot access '/mnt/felhom-drives/hdd_1/backups/offsite-restore/*': No such file or directory
|
||||
holds: ['kimai']
|
||||
@@ -0,0 +1,360 @@
|
||||
22:49:18 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
22:50:08 [1] deployed, controller state=running, pinned={'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'}
|
||||
22:50:08 install rallly: True
|
||||
22:50:08 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
22:50:08 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
22:51:29 [1] deployed, controller state=running, pinned={'grimmory': 'ghcr.io/grimmory-tools/grimmory:v3.5.0', 'grimmory-db': 'mariadb:11.4'}
|
||||
22:51:29 install grimmory: True
|
||||
22:51:33 seed rallly r1106-A: LINE 1: ...te varchar(80)); insert into r1106_marker values (r1106-A); ...
|
||||
^
|
||||
CREATE TABLE
|
||||
22:51:33 check rallly: deployed=True state=running hold=None
|
||||
22:51:36 marker row: 'ERROR: relation "r1106_marker" does not exist\nLINE 1: select note from r1106_marker\n ^' (want 'r1106-A' present)
|
||||
22:51:39 rallly log auth errors (10 min) / status: 0 | Up | About | a | minute | (healthy)
|
||||
22:51:43 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
22:51:46 front door: 301
|
||||
|
||||
22:51:49 seed grimmory r1106-A: --------------
|
||||
|
||||
ERROR 1054 (42S22) at line 1: Unknown column 'r1106' in 'VALUES'
|
||||
22:51:52 file: 0f4abe3bee6cd83e56b7a0f554cad3f6f7f91a8a0af59c024e67fbf7a01440cd /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A.txt
|
||||
22:51:53 check grimmory: deployed=True state=running hold=None
|
||||
22:51:56 marker row: '' (want 'r1106-A' present)
|
||||
22:51:59 root login (the product's dump user): 1
|
||||
22:52:03 app user login (the app's own DB user): 1
|
||||
22:52:06 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T22:52:05.285639702","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T22:52:05.28566
|
||||
22:52:09 file: 0f4abe3bee6cd83e56b7a0f554cad3f6f7f91a8a0af59c024e67fbf7a01440cd /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A.txt
|
||||
22:52:09 off-site before: status=ok last_run=2026-10-16T18:48:30Z snapshots=202
|
||||
22:52:09 POST /backup/offbox/run {} -> HTTP/2 302 /backups/remote?flash=flash.offbox.run_started
|
||||
22:52:09 + 0.0s ('running', 'dump', '', 0) files 0/0 bytes /
|
||||
22:54:47 + 157.4s ('running', '', 'plex', 0) files 0/0 bytes /
|
||||
22:54:50 + 160.4s ('running', '', 'prowlarr', 0) files 0/0 bytes /
|
||||
22:54:53 + 163.4s ('running', '', 'radarr', 0) files 0/0 bytes /
|
||||
22:54:56 + 166.5s ('running', '', 'romm', 100) files 8/10 bytes 187.9 MB/187.9 MB
|
||||
22:54:59 + 169.5s ('running', '', 'sonarr', 91) files 3/4 bytes 11.1 KB/12.2 KB
|
||||
22:55:02 + 172.5s ('running', '', 'privatebin', 0) files 0/0 bytes /
|
||||
22:55:05 + 175.6s ('running', '', 'rallly', 0) files 0/0 bytes /
|
||||
22:55:08 + 178.6s ('running', '', 'rallly', 100) files 7/7 bytes 50.1 MB/50.1 MB
|
||||
22:55:14 + 184.7s ('running', '', 'grimmory', 0) files 0/0 bytes /
|
||||
22:55:17 + 187.7s ('running', '', 'grimmory', 100) files 8/8 bytes 156.7 MB/156.7 MB
|
||||
22:55:20 + 190.7s ('running', '', 'bookstack', 100) files 11/11 bytes 160.7 MB/160.7 MB
|
||||
22:55:23 + 193.7s ('running', '', 'home-assistant', 0) files 0/0 bytes /
|
||||
22:55:26 + 196.8s ('running', '', 'home-assistant', 100) files 6/6 bytes 12.5 MB/12.5 MB
|
||||
22:55:29 + 199.8s ('running', '', 'paperless-ngx', 0) files 0/0 bytes /
|
||||
22:55:32 + 202.8s ('running', '', 'paperless-ngx', 100) files 74/74 bytes 154.1 MB/154.1 MB
|
||||
22:55:35 + 205.8s ('running', '', 'docmost', 0) files 0/0 bytes /
|
||||
22:55:38 + 208.9s ('running', '', 'kimai', 100) files 10/10 bytes 173.0 MB/173.0 MB
|
||||
22:55:41 + 211.9s ('running', 'retention', '', 0) files 0/0 bytes /
|
||||
22:55:47 + 217.9s ('ok', '', '', 0) files 0/0 bytes /
|
||||
22:55:47 off-site after: status=ok last_run=2026-10-16T20:55:46Z duration=3m31s snapshots=218 size=653.5 MB error=''
|
||||
22:56:30 remove rallly (all: remove_hdd_data=True, remove_backups=True) -> 200 {'ok': True, 'data': {'removed': 'rallly', 'volumes_removed': ['rallly_rallly_postgres_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem tárolt saját adatot kü
|
||||
22:57:04 remove grimmory (all: remove_hdd_data=True, remove_backups=True) -> 200 {'ok': True, 'data': {'removed': 'grimmory', 'volumes_removed': ['grimmory_grimmory_db'], 'hdd_paths_removed': ['/mnt/felhom-drives/hdd_1/appdata/grimmory/data (4.0K)'], 'hdd_paths_preserved': [], 'us
|
||||
22:57:07 household deletes the books-folder files: 1
|
||||
22:57:08 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
22:57:58 [1] deployed, controller state=running, pinned={'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'}
|
||||
22:57:58 install rallly: True
|
||||
22:57:58 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
22:57:58 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
22:59:29 [1] deployed, controller state=running, pinned={'grimmory': 'ghcr.io/grimmory-tools/grimmory:v3.5.0', 'grimmory-db': 'mariadb:11.4'}
|
||||
22:59:29 install grimmory: True
|
||||
22:59:29 check rallly: deployed=True state=running hold=None
|
||||
22:59:33 marker row: 'ERROR: relation "r1106_marker" does not exist\nLINE 1: select note from r1106_marker\n ^' (want 'r1106-A' present)
|
||||
22:59:36 rallly log auth errors (10 min) / status: 0 | Up | About | a | minute | (healthy)
|
||||
22:59:39 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
22:59:42 front door: 301
|
||||
|
||||
22:59:43 check grimmory: deployed=True state=running hold=None
|
||||
22:59:46 marker row: "--------------\n\nERROR 1146 (42S02) at line 1: Table 'grimmory.r1106_marker' doesn't exist" (want 'r1106-A' present)
|
||||
22:59:49 root login (the product's dump user): 1
|
||||
22:59:53 app user login (the app's own DB user): 1
|
||||
22:59:56 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T22:59:55.464371994","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T22:59:55.46441
|
||||
22:59:59 file: sha256sum: /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A.txt: No such file or directory
|
||||
23:00:03 POST /backup/offbox/restore {'app': 'rallly', 'mode': 'full'} -> HTTP/2 302 /backups/restore/app?name=rallly&full_prep=rallly&full_size=50.1+MB
|
||||
23:00:03 POST /backup/offbox/restore {'app': 'rallly', 'mode': 'full', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=rallly&flash=flash.offbox.restore_started
|
||||
23:00:03 + 0.0s restore-status (True, 'offbox-restore', None, '')
|
||||
23:00:12 + 9.1s restore-status (False, 'offbox-restore', None, '')
|
||||
23:00:12 {"running": false, "op": "offbox-restore", "stack": "rallly", "started_at": "2026-10-16T21:00:03.606006931Z", "last": {"op": "offbox-restore", "stack": "rallly", "ok": true, "message": "A(z) rallly teljes mentése visszaállítva ellenőrző mappába: /mnt/felhom-drives/hdd_1/backups/offsite-restore/rallly — a saját fájljaiddal együtt. A meglévő adatok változatlanok.", "finished_at": "2026-10-16T21:00:11.039016046Z"}, "last_recent": true}
|
||||
23:00:12 POST /backup/offbox/reconstitute {'app': 'rallly', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=rallly&flash=flash.offbox.full_restore_started
|
||||
23:00:12 + 0.0s restore-status (True, 'offbox-reconstitute', None, '')
|
||||
23:00:43 + 30.3s restore-status (False, 'offbox-reconstitute', None, '')
|
||||
23:00:43 {"running": false, "op": "offbox-reconstitute", "stack": "rallly", "started_at": "2026-10-16T21:00:12.737270741Z", "last": {"op": "offbox-reconstitute", "stack": "rallly", "ok": true, "message": "A(z) rallly: 0 fájl és 1 adatkötet és az adatbázis visszaállítva (mentés: 2026. 10. 16. 22:52) — az alkalmazás újraindult.", "finished_at": "2026-10-16T21:00:41.713460862Z"}, "last_recent": true}
|
||||
23:00:46 POST /backup/offbox/restore {'app': 'grimmory', 'mode': 'full'} -> HTTP/2 302 /backups/restore/app?name=grimmory&full_prep=grimmory&full_size=156.7+MB
|
||||
23:00:46 POST /backup/offbox/restore {'app': 'grimmory', 'mode': 'full', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=grimmory&flash=flash.offbox.restore_started
|
||||
23:00:46 + 0.0s restore-status (True, 'offbox-restore', None, '')
|
||||
23:00:55 + 9.1s restore-status (False, 'offbox-restore', None, '')
|
||||
23:00:55 {"running": false, "op": "offbox-restore", "stack": "grimmory", "started_at": "2026-10-16T21:00:46.868233201Z", "last": {"op": "offbox-restore", "stack": "grimmory", "ok": true, "message": "A(z) grimmory teljes mentése visszaállítva ellenőrző mappába: /mnt/felhom-drives/hdd_1/backups/offsite-restore/grimmory — a saját fájljaiddal együtt. A meglévő adatok változatlanok.", "finished_at": "2026-10-16T21:00:55.045276695Z"}, "last_recent": true}
|
||||
23:00:55 POST /backup/offbox/reconstitute {'app': 'grimmory', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=grimmory&flash=flash.offbox.full_restore_started
|
||||
23:00:56 + 0.0s restore-status (True, 'offbox-reconstitute', None, '')
|
||||
23:01:50 + 54.5s restore-status (False, 'offbox-reconstitute', None, '')
|
||||
23:01:50 {"running": false, "op": "offbox-reconstitute", "stack": "grimmory", "started_at": "2026-10-16T21:00:55.98356812Z", "last": {"op": "offbox-reconstitute", "stack": "grimmory", "ok": true, "message": "A(z) grimmory: 1 fájl és 1 adatkötet és az adatbázis visszaállítva (mentés: 2026. 10. 16. 22:52) — az alkalmazás újraindult.", "finished_at": "2026-10-16T21:01:48.947953301Z"}, "last_recent": true}
|
||||
23:02:50 check rallly: deployed=True state=running hold=None
|
||||
23:02:54 marker row: 'ERROR: relation "r1106_marker" does not exist\nLINE 1: select note from r1106_marker;\n ^' (want 'r1106-A' present)
|
||||
23:02:57 rallly log auth errors (10 min) / status: 0 | Up | 2 | minutes | (healthy)
|
||||
23:03:00 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:03:03 front door: 301
|
||||
|
||||
23:03:04 check grimmory: deployed=True state=running hold=None
|
||||
23:03:07 marker row: '' (want 'r1106-A' present)
|
||||
23:03:10 root login (the product's dump user): 1
|
||||
23:03:14 app user login (the app's own DB user): 1
|
||||
23:03:17 app health: Up 2 minutes (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:03:16.428599078","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:03:16.42862
|
||||
23:03:20 file: 0f4abe3bee6cd83e56b7a0f554cad3f6f7f91a8a0af59c024e67fbf7a01440cd /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A.txt
|
||||
23:12:31 seed rallly r1106-A2: CREATE TABLE
|
||||
INSERT 0 1
|
||||
r1106-A2
|
||||
23:12:31 check rallly: deployed=True state=running hold=None
|
||||
23:12:34 marker row: 'r1106-A2' (want 'r1106-A2' present)
|
||||
23:12:37 rallly log auth errors (10 min) / status: 0 | Up | 12 | minutes | (healthy)
|
||||
23:12:41 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:12:44 front door: 301
|
||||
|
||||
23:12:48 seed grimmory r1106-A2: r1106-A2
|
||||
23:12:51 file: 50a1cfbcde9a13e801c30d3bd9f65457e3249704a3c925fe5e8d6baba886ea79 /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A2.txt
|
||||
23:12:51 check grimmory: deployed=True state=running hold=None
|
||||
23:12:54 marker row: 'r1106-A2' (want 'r1106-A2' present)
|
||||
23:12:58 root login (the product's dump user): 1
|
||||
23:13:01 app user login (the app's own DB user): 1
|
||||
23:13:04 app health: Up 11 minutes (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:13:03.583521678","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:13:03.58356
|
||||
23:13:07 file: 50a1cfbcde9a13e801c30d3bd9f65457e3249704a3c925fe5e8d6baba886ea79 /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A2.txt
|
||||
23:13:07 off-site before: status=ok last_run=2026-10-16T20:55:46Z snapshots=218
|
||||
23:13:07 POST /backup/offbox/run {} -> HTTP/2 302 /backups/remote?flash=flash.offbox.run_started
|
||||
23:13:07 + 0.0s ('running', 'dump', '', 0) files 0/0 bytes /
|
||||
23:15:42 + 154.3s ('running', '', 'romm', 0) files 0/0 bytes /
|
||||
23:15:45 + 157.4s ('running', '', 'sonarr', 0) files 0/0 bytes /
|
||||
23:15:48 + 160.4s ('running', '', 'bentopdf', 0) files 0/0 bytes /
|
||||
23:15:51 + 163.4s ('running', '', 'rallly', 0) files 0/0 bytes /
|
||||
23:15:54 + 166.4s ('running', '', 'grimmory', 0) files 0/0 bytes /
|
||||
23:15:57 + 169.5s ('running', '', 'bookstack', 0) files 0/0 bytes /
|
||||
23:16:00 + 172.5s ('running', '', 'calibre-web', 0) files 0/0 bytes /
|
||||
23:16:03 + 175.5s ('running', '', 'home-assistant', 100) files 6/6 bytes 12.6 MB/12.6 MB
|
||||
23:16:06 + 178.5s ('running', '', 'paperless-ngx', 0) files 0/0 bytes /
|
||||
23:16:09 + 181.6s ('running', '', 'docmost', 0) files 0/0 bytes /
|
||||
23:16:12 + 184.6s ('running', '', 'kimai', 0) files 0/0 bytes /
|
||||
23:16:15 + 187.6s ('running', '', 'plex', 0) files 0/0 bytes /
|
||||
23:16:18 + 190.6s ('running', 'retention', '', 0) files 0/0 bytes /
|
||||
23:16:24 + 196.7s ('ok', '', '', 0) files 0/0 bytes /
|
||||
23:16:24 off-site after: status=ok last_run=2026-10-16T21:16:23Z duration=3m12s snapshots=234 size=670.9 MB error=''
|
||||
23:17:07 remove rallly (all: remove_hdd_data=True, remove_backups=True) -> 200 {'ok': True, 'data': {'removed': 'rallly', 'volumes_removed': ['rallly_rallly_postgres_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem tárolt saját adatot kü
|
||||
23:17:41 remove grimmory (all: remove_hdd_data=True, remove_backups=True) -> 200 {'ok': True, 'data': {'removed': 'grimmory', 'volumes_removed': ['grimmory_grimmory_db'], 'hdd_paths_removed': ['/mnt/felhom-drives/hdd_1/appdata/grimmory/data (4.0K)'], 'hdd_paths_preserved': [], 'us
|
||||
23:17:45 household deletes the books-folder files: 2
|
||||
23:17:45 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
23:18:35 [1] deployed, controller state=running, pinned={'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'}
|
||||
23:18:35 install rallly: True
|
||||
23:18:35 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
23:18:36 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
23:19:56 [1] deployed, controller state=running, pinned={'grimmory': 'ghcr.io/grimmory-tools/grimmory:v3.5.0', 'grimmory-db': 'mariadb:11.4'}
|
||||
23:19:56 install grimmory: True
|
||||
23:19:56 check rallly: deployed=True state=running hold=None
|
||||
23:20:00 marker row: 'ERROR: relation "r1106_marker" does not exist\nLINE 1: select note from r1106_marker;\n ^' (want 'r1106-A2' present)
|
||||
23:20:03 rallly log auth errors (10 min) / status: 0 | Up | About | a | minute | (healthy)
|
||||
23:20:06 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:20:10 front door: 301
|
||||
|
||||
23:20:10 check grimmory: deployed=True state=running hold=None
|
||||
23:20:13 marker row: "--------------\n\nERROR 1146 (42S02) at line 1: Table 'grimmory.r1106_marker' doesn't exist" (want 'r1106-A2' present)
|
||||
23:20:16 root login (the product's dump user): 1
|
||||
23:20:20 app user login (the app's own DB user): 1
|
||||
23:20:23 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:20:22.859735764","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:20:22.85975
|
||||
23:20:26 file: sha256sum: /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A2.txt: No such file or directory
|
||||
23:20:30 POST /backup/offbox/restore {'app': 'rallly', 'mode': 'full'} -> HTTP/2 302 /backups/restore/app?name=rallly&full_prep=rallly&full_size=66.9+MB
|
||||
23:20:30 POST /backup/offbox/restore {'app': 'rallly', 'mode': 'full', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=rallly&flash=flash.offbox.restore_started
|
||||
23:20:30 + 0.0s restore-status (True, 'offbox-restore', None, '')
|
||||
23:20:39 + 9.1s restore-status (False, 'offbox-restore', None, '')
|
||||
23:20:39 {"running": false, "op": "offbox-restore", "stack": "rallly", "started_at": "2026-10-16T21:20:30.883566825Z", "last": {"op": "offbox-restore", "stack": "rallly", "ok": true, "message": "A(z) rallly teljes mentése visszaállítva ellenőrző mappába: /mnt/felhom-drives/hdd_1/backups/offsite-restore/rallly — a saját fájljaiddal együtt. A meglévő adatok változatlanok.", "finished_at": "2026-10-16T21:20:38.696061676Z"}, "last_recent": true}
|
||||
23:20:40 POST /backup/offbox/reconstitute {'app': 'rallly', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=rallly&flash=flash.offbox.full_restore_started
|
||||
23:20:40 + 0.0s restore-status (True, 'offbox-reconstitute', None, '')
|
||||
23:21:10 + 30.3s restore-status (False, 'offbox-reconstitute', None, '')
|
||||
23:21:10 {"running": false, "op": "offbox-reconstitute", "stack": "rallly", "started_at": "2026-10-16T21:20:40.00486394Z", "last": {"op": "offbox-reconstitute", "stack": "rallly", "ok": true, "message": "A(z) rallly: 0 fájl és 1 adatkötet és az adatbázis visszaállítva (mentés: 2026. 10. 16. 23:13) — az alkalmazás újraindult.", "finished_at": "2026-10-16T21:21:09.345344912Z"}, "last_recent": true}
|
||||
23:21:14 POST /backup/offbox/restore {'app': 'grimmory', 'mode': 'full'} -> HTTP/2 302 /backups/restore/app?name=grimmory&full_prep=grimmory&full_size=156.8+MB
|
||||
23:21:14 POST /backup/offbox/restore {'app': 'grimmory', 'mode': 'full', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=grimmory&flash=flash.offbox.restore_started
|
||||
23:21:14 + 0.0s restore-status (True, 'offbox-restore', None, '')
|
||||
23:21:23 + 9.1s restore-status (False, 'offbox-restore', None, '')
|
||||
23:21:23 {"running": false, "op": "offbox-restore", "stack": "grimmory", "started_at": "2026-10-16T21:21:14.156589916Z", "last": {"op": "offbox-restore", "stack": "grimmory", "ok": true, "message": "A(z) grimmory teljes mentése visszaállítva ellenőrző mappába: /mnt/felhom-drives/hdd_1/backups/offsite-restore/grimmory — a saját fájljaiddal együtt. A meglévő adatok változatlanok.", "finished_at": "2026-10-16T21:21:22.333018655Z"}, "last_recent": true}
|
||||
23:21:23 POST /backup/offbox/reconstitute {'app': 'grimmory', 'confirm': '1'} -> HTTP/2 302 /backups/restore/app?name=grimmory&flash=flash.offbox.full_restore_started
|
||||
23:21:23 + 0.0s restore-status (True, 'offbox-reconstitute', None, '')
|
||||
23:22:17 + 54.5s restore-status (False, 'offbox-reconstitute', None, '')
|
||||
23:22:17 {"running": false, "op": "offbox-reconstitute", "stack": "grimmory", "started_at": "2026-10-16T21:21:23.276103566Z", "last": {"op": "offbox-reconstitute", "stack": "grimmory", "ok": true, "message": "A(z) grimmory: 2 fájl és 1 adatkötet és az adatbázis visszaállítva (mentés: 2026. 10. 16. 23:13) — az alkalmazás újraindult.", "finished_at": "2026-10-16T21:22:15.633221727Z"}, "last_recent": true}
|
||||
23:23:02 check rallly: deployed=True state=running hold=None
|
||||
23:23:07 marker row: 'r1106-A2' (want 'r1106-A2' present)
|
||||
23:23:10 rallly log auth errors (10 min) / status: 0 | Up | 2 | minutes | (healthy)
|
||||
23:23:14 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:23:18 front door: 301
|
||||
|
||||
23:23:18 check grimmory: deployed=True state=running hold=None
|
||||
23:23:22 marker row: 'r1106-A2' (want 'r1106-A2' present)
|
||||
23:23:26 root login (the product's dump user): 1
|
||||
23:23:30 app user login (the app's own DB user): 1
|
||||
23:23:34 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:23:33.152578787","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:23:33.15260
|
||||
23:23:38 file: 50a1cfbcde9a13e801c30d3bd9f65457e3249704a3c925fe5e8d6baba886ea79 /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-A2.txt
|
||||
23:24:08 seed rallly r1106-B: INSERT 0 1
|
||||
r1106-A2
|
||||
r1106-B
|
||||
23:24:13 seed grimmory r1106-B: r1106-A2
|
||||
r1106-B
|
||||
23:24:17 file: c90bc7913f76e3b72bd245b1f4f0b6c3b2be0a6de62bf95374eb47f62b9fb7cf /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-B.txt
|
||||
23:24:17 off-site before: status=ok last_run=2026-10-16T21:16:23Z snapshots=234
|
||||
23:24:17 POST /backup/offbox/run {} -> HTTP/2 302 /backups/remote?flash=flash.offbox.run_started
|
||||
23:24:17 + 0.0s ('running', 'dump', '', 0) files 0/0 bytes /
|
||||
23:27:10 + 172.5s ('running', '', 'opengist', 0) files 0/0 bytes /
|
||||
23:27:13 + 175.6s ('running', '', 'docmost', 0) files 0/0 bytes /
|
||||
23:27:16 + 178.6s ('running', '', 'kimai', 0) files 0/0 bytes /
|
||||
23:27:19 + 181.6s ('running', '', 'plex', 0) files 0/0 bytes /
|
||||
23:27:22 + 184.6s ('running', '', 'prowlarr', 100) files 4/4 bytes 9.1 KB/9.1 KB
|
||||
23:27:25 + 187.7s ('running', '', 'romm', 0) files 0/0 bytes /
|
||||
23:27:28 + 190.7s ('running', '', 'sonarr', 0) files 0/0 bytes /
|
||||
23:27:31 + 193.7s ('running', '', 'bentopdf', 0) files 0/0 bytes /
|
||||
23:27:34 + 196.8s ('running', '', 'rallly', 0) files 0/0 bytes /
|
||||
23:27:37 + 199.8s ('running', '', 'rallly', 100) files 8/8 bytes 67.0 MB/67.0 MB
|
||||
23:27:40 + 202.8s ('running', '', 'grimmory', 0) files 0/0 bytes /
|
||||
23:27:43 + 205.8s ('running', '', 'bookstack', 0) files 0/0 bytes /
|
||||
23:27:46 + 208.9s ('running', '', 'calibre-web', 0) files 0/0 bytes /
|
||||
23:27:49 + 211.9s ('running', '', 'home-assistant', 0) files 0/0 bytes /
|
||||
23:27:52 + 214.9s ('running', 'retention', '', 0) files 0/0 bytes /
|
||||
23:27:58 + 221.0s ('ok', '', '', 0) files 0/0 bytes /
|
||||
23:27:58 off-site after: status=ok last_run=2026-10-16T21:27:57Z duration=3m35s snapshots=250 size=687.5 MB error=''
|
||||
23:28:41 remove rallly (keepbackups: remove_hdd_data=True, remove_backups=False) -> 200 {'ok': True, 'data': {'removed': 'rallly', 'volumes_removed': ['rallly_rallly_postgres_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem tárolt saját adatot kü
|
||||
23:29:15 remove grimmory (keepbackups: remove_hdd_data=True, remove_backups=False) -> 200 {'ok': True, 'data': {'removed': 'grimmory', 'volumes_removed': ['grimmory_grimmory_db'], 'hdd_paths_removed': ['/mnt/felhom-drives/hdd_1/appdata/grimmory/data (4.0K)'], 'hdd_paths_preserved': [], 'us
|
||||
23:29:19 household deletes the books-folder files: 3
|
||||
23:29:20 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
23:30:15 [1] deployed, controller state=running, pinned={'rallly': 'lukevella/rallly:4.15.3', 'rallly-postgres': 'postgres:18-alpine'}
|
||||
23:30:15 install rallly: True
|
||||
23:30:15 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
23:30:15 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
23:31:36 [1] deployed, controller state=running, pinned={'grimmory': 'ghcr.io/grimmory-tools/grimmory:v3.5.0', 'grimmory-db': 'mariadb:11.4'}
|
||||
23:31:36 install grimmory: True
|
||||
23:31:36 check rallly: deployed=True state=running hold=None
|
||||
23:31:40 marker row: 'ERROR: relation "r1106_marker" does not exist\nLINE 1: select note from r1106_marker;\n ^' (want 'r1106-B' present)
|
||||
23:31:43 rallly log auth errors (10 min) / status: 0 | Up | About | a | minute | (healthy)
|
||||
23:31:46 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:31:50 front door: 301
|
||||
|
||||
23:31:50 check grimmory: deployed=True state=running hold=None
|
||||
23:31:53 marker row: "--------------\n\nERROR 1146 (42S02) at line 1: Table 'grimmory.r1106_marker' doesn't exist" (want 'r1106-B' present)
|
||||
23:31:56 root login (the product's dump user): 1
|
||||
23:32:00 app user login (the app's own DB user): 1
|
||||
23:32:03 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:32:02.311256259","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:32:02.31127
|
||||
23:32:06 file: sha256sum: /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-B.txt: No such file or directory
|
||||
23:32:06 [R] restoring rallly from snapshot 'helyi' (of 1 offered)
|
||||
23:32:06 [R] POST /backup/restore -> HTTP/2 302 ['location: /backups/restore?flash=flash.restore.started']
|
||||
23:32:06 + 0.0s restore (True, None, None)
|
||||
23:32:34 + 28.3s restore (False, None, None)
|
||||
23:32:34 [R] after restore: state=running hold=None phase=None
|
||||
23:32:38 onbox restore: {"ok": true, "snapshot_id": "helyi", "http": "HTTP/2 302", "location": ["location: /backups/restore?flash=flash.restore.started"], "seconds": 28.4}
|
||||
23:32:38 restore-status: {"running": false, "op": "restore", "stack": "rallly", "started_at": "2026-10-16T21:32:06.602574836Z", "last": {"op": "restore", "stack": "rallly", "ok": true, "message": "A(z) rallly: 1 adatkötet és az adatbázis visszaállítva — az alkalmazás újraindult.", "finished_at": "2026-10-16T21:32:33.370797695Z"}, "last_recent": true}
|
||||
23:32:38 [R] restoring grimmory from snapshot 'helyi' (of 1 offered)
|
||||
23:33:18 [R] POST /backup/restore -> HTTP/2 302 ['location: /backups/restore?flash_error=Ez+a+ment%C3%A9s+nem+tartalmazza+az+alkalmaz%C3%A1s+f%C3%A1jljait%2C+ez%C3%A9rt+nem+%C3%A1ll%C3%ADtjuk+vissza+az+adatb%C3%A1zist+f%C3%B6l%C3%A9j%C3%BCk+%E2%80%94+a+f%C3%A1jlok+%C3%ADgy+a+hely%C3%BCk%C3%B6n+maradnak.+A+f%C3%A1jlok+a+t%C3%A1voli+m%C3%A1solatb%C3%B3l+%C3%A1ll%C3%ADthat%C3%B3k+vissza%3A+Biztons%C3%A1gi+ment%C3%A9s+%E2%86%92+Vissza%C3%A1ll%C3%ADt%C3%A1s%2C+%E2%80%9ETeljes+vissza%C3%A1ll%C3%ADt%C3%A1s+%28f%C3%A1jlok+%2B+adatb%C3%A1zis%29%E2%80%9D.']
|
||||
23:33:18 + 0.0s restore (False, None, None)
|
||||
23:33:25 [R] after restore: state=running hold=None phase=None
|
||||
23:33:28 onbox restore: {"ok": true, "snapshot_id": "helyi", "http": "HTTP/2 302", "location": ["location: /backups/restore?flash_error=Ez+a+ment%C3%A9s+nem+tartalmazza+az+alkalmaz%C3%A1s+f%C3%A1jljait%2C+ez%C3%A9rt+nem+%C3%A1ll%C3%ADtjuk+vissza+az+adatb%C3%A1zist+f%C3%B6l%C3%A9j%C3%BCk+%E2%80%94+a+f%C3%A1jlok+%C3%ADgy+a+hely%C3%BCk%C3%B6n+maradnak.+A+f%C3%A1jlok+a+t%C3%A1voli+m%C3%A1solatb%C3%B3l+%C3%A1ll%C3%ADthat%C3%B3k+vissza%3A+Biztons%C3%A1gi+ment%C3%A9s+%E2%86%92+Vissza%C3%A1ll%C3%ADt%C3%A1s%2C+%E2%80%9ETeljes+vissza%C3%A1ll%C3%ADt%C3%A1s+%28f%C3%A1jlok+%2B+adatb%C3%A1zis%29%E2%80%9D."], "seconds": 6.1}
|
||||
23:33:28 restore-status: {"running": false, "op": "restore", "stack": "rallly", "started_at": "2026-10-16T21:32:06.602574836Z", "last": {"op": "restore", "stack": "rallly", "ok": true, "message": "A(z) rallly: 1 adatkötet és az adatbázis visszaállítva — az alkalmazás újraindult.", "finished_at": "2026-10-16T21:32:33.370797695Z"}, "last_recent": true}
|
||||
23:34:14 check rallly: deployed=True state=running hold=None
|
||||
23:34:17 marker row: 'r1106-A2\nr1106-B' (want 'r1106-B' present)
|
||||
23:34:21 rallly log auth errors (10 min) / status: 0 | Up | About | a | minute | (healthy)
|
||||
23:34:24 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:34:27 front door: 301
|
||||
|
||||
23:34:27 check grimmory: deployed=True state=running hold=None
|
||||
23:34:31 marker row: "--------------\n\nERROR 1146 (42S02) at line 1: Table 'grimmory.r1106_marker' doesn't exist" (want 'r1106-B' present)
|
||||
23:34:34 root login (the product's dump user): 1
|
||||
23:34:37 app user login (the app's own DB user): 1
|
||||
23:34:40 app health: Up 3 minutes (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:34:39.959127823","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:34:39.95916
|
||||
23:34:44 file: sha256sum: /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-B.txt: No such file or directory
|
||||
23:35:13 [R] restoring rallly from snapshot 'helyi' (of 1 offered)
|
||||
23:35:13 [R] POST /backup/restore -> HTTP/2 302 ['location: /backups/restore?flash=flash.restore.started']
|
||||
23:35:13 + 0.0s restore (False, None, None)
|
||||
23:35:19 [R] after restore: state=running hold=None phase=None
|
||||
23:35:22 onbox restore: {"ok": true, "snapshot_id": "helyi", "http": "HTTP/2 302", "location": ["location: /backups/restore?flash=flash.restore.started"], "seconds": 6.1}
|
||||
23:35:22 restore-status: {"running": false, "op": "restore", "stack": "rallly", "started_at": "2026-10-16T21:35:13.244020136Z", "last": {"op": "restore", "stack": "rallly", "ok": false, "message": "Visszaállítás sikertelen: Ezt a mentést nem lehet visszaállítani: nem tartalmazza az adatbázis jelszavát, és nélküle az alkalmazás nem tudna elindulni. A mostani telepítés érintetlen maradt.", "finished_at": "2026-10-16T21:35:13.253731205Z"}, "last_recent": true}
|
||||
23:35:42 check rallly: deployed=True state=running hold=None
|
||||
23:35:46 marker row: 'r1106-A2\nr1106-B' (want 'r1106-B' present)
|
||||
23:35:49 rallly log auth errors (10 min) / status: 0 | Up | 3 | minutes | (healthy)
|
||||
23:35:52 app login to its DB (the app's own DATABASE_URL user): 1
|
||||
23:35:55 front door: 301
|
||||
|
||||
23:36:10 seed grimmory r1106-D: r1106-D
|
||||
23:36:13 file: b9a6247e71922dce28dfccaabaebee528e89f125052cb799ea3e8ba2bd579b9e /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-D.txt
|
||||
23:36:13 check grimmory: deployed=True state=running hold=None
|
||||
23:36:16 marker row: 'r1106-D' (want 'r1106-D' present)
|
||||
23:36:19 root login (the product's dump user): 1
|
||||
23:36:23 app user login (the app's own DB user): 1
|
||||
23:36:26 app health: Up 5 minutes (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:36:25.554584861","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:36:25.55460
|
||||
23:36:29 file: b9a6247e71922dce28dfccaabaebee528e89f125052cb799ea3e8ba2bd579b9e /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-D.txt
|
||||
23:36:29 off-site before: status=ok last_run=2026-10-16T21:27:57Z snapshots=250
|
||||
23:36:29 POST /backup/offbox/run {} -> HTTP/2 302 /backups/remote?flash=flash.offbox.run_started
|
||||
23:36:30 + 0.0s ('running', 'dump', '', 0) files 0/0 bytes /
|
||||
23:39:07 + 157.3s ('running', '', 'grimmory', 0) files 0/0 bytes /
|
||||
23:39:10 + 160.4s ('running', '', 'bookstack', 0) files 0/0 bytes /
|
||||
23:39:13 + 163.4s ('running', '', 'calibre-web', 0) files 0/0 bytes /
|
||||
23:39:16 + 166.4s ('running', '', 'home-assistant', 0) files 0/0 bytes /
|
||||
23:39:19 + 169.4s ('running', '', 'home-assistant', 100) files 6/6 bytes 12.7 MB/12.7 MB
|
||||
23:39:22 + 172.5s ('running', '', 'opengist', 0) files 0/0 bytes /
|
||||
23:39:25 + 175.5s ('running', '', 'paperless-ngx', 100) files 74/74 bytes 154.1 MB/154.1 MB
|
||||
23:39:28 + 178.5s ('running', '', 'docmost', 100) files 12/12 bytes 105.1 MB/105.1 MB
|
||||
23:39:31 + 181.5s ('running', '', 'plex', 0) files 0/0 bytes /
|
||||
23:39:34 + 184.6s ('running', '', 'prowlarr', 0) files 0/0 bytes /
|
||||
23:39:37 + 187.6s ('running', '', 'romm', 0) files 0/0 bytes /
|
||||
23:39:40 + 190.6s ('running', '', 'romm', 100) files 10/10 bytes 189.8 MB/189.8 MB
|
||||
23:39:43 + 193.6s ('running', '', 'bentopdf', 0) files 0/0 bytes /
|
||||
23:39:46 + 196.7s ('running', '', 'privatebin', 0) files 0/0 bytes /
|
||||
23:39:49 + 199.7s ('running', '', 'rallly', 100) files 8/8 bytes 67.5 MB/67.5 MB
|
||||
23:39:52 + 202.7s ('running', 'retention', '', 0) files 0/0 bytes /
|
||||
23:39:58 + 208.8s ('ok', '', '', 0) files 0/0 bytes /
|
||||
23:39:58 off-site after: status=ok last_run=2026-10-16T21:39:56Z duration=3m23s snapshots=266 size=704.6 MB error=''
|
||||
23:40:32 remove grimmory (keepdata: remove_hdd_data=False, remove_backups=False) -> 200 {'ok': True, 'data': {'removed': 'grimmory', 'volumes_removed': ['grimmory_grimmory_db'], 'hdd_paths_removed': [], 'hdd_paths_preserved': ['/mnt/felhom-drives/hdd_1/appdata/grimmory/data (4.0K)'], 'us
|
||||
23:40:33 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
23:40:34 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
23:41:59 [1] deployed, controller state=running, pinned={'grimmory': 'ghcr.io/grimmory-tools/grimmory:v3.5.0', 'grimmory-db': 'mariadb:11.4'}
|
||||
23:41:59 install grimmory with kept_data=use: True
|
||||
23:42:29 check grimmory: deployed=True state=running hold=None
|
||||
23:42:33 marker row: "--------------\n\nERROR 1146 (42S02) at line 1: Table 'grimmory.r1106_marker' doesn't exist" (want 'r1106-D' present)
|
||||
23:42:36 root login (the product's dump user): 1
|
||||
23:42:39 app user login (the app's own DB user): 1
|
||||
23:42:43 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:42:42.23419292","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:42:42.234213
|
||||
23:42:46 file: b9a6247e71922dce28dfccaabaebee528e89f125052cb799ea3e8ba2bd579b9e /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-D.txt
|
||||
23:43:14 seed grimmory r1106-D2: r1106-D2
|
||||
23:43:17 file: a584aeaa731c68ace4355bbcffa492f6f578af38c12142ff943aeb2880564ab0 /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-D2.txt
|
||||
23:43:18 off-site before: status=ok last_run=2026-10-16T21:39:56Z snapshots=266
|
||||
23:43:18 POST /backup/offbox/run {} -> HTTP/2 302 /backups/remote?flash=flash.offbox.run_started
|
||||
23:43:18 + 0.0s ('running', 'dump', '', 0) files 0/0 bytes /
|
||||
23:45:52 + 154.3s ('running', '', 'calibre-web', 0) files 0/0 bytes /
|
||||
23:45:55 + 157.3s ('running', '', 'home-assistant', 0) files 0/0 bytes /
|
||||
23:45:58 + 160.4s ('running', '', 'opengist', 0) files 0/0 bytes /
|
||||
23:46:01 + 163.4s ('running', '', 'paperless-ngx', 28) files 70/74 bytes 42.6 MB/154.2 MB
|
||||
23:46:04 + 166.4s ('running', '', 'docmost', 0) files 0/0 bytes /
|
||||
23:46:07 + 169.4s ('running', '', 'plex', 0) files 0/0 bytes /
|
||||
23:46:10 + 172.5s ('running', '', 'prowlarr', 0) files 0/0 bytes /
|
||||
23:46:13 + 175.5s ('running', '', 'radarr', 0) files 0/0 bytes /
|
||||
23:46:16 + 178.5s ('running', '', 'romm', 100) files 10/10 bytes 190.0 MB/190.0 MB
|
||||
23:46:19 + 181.5s ('running', '', 'bentopdf', 0) files 0/0 bytes /
|
||||
23:46:22 + 184.6s ('running', '', 'privatebin', 0) files 0/0 bytes /
|
||||
23:46:25 + 187.6s ('running', '', 'rallly', 100) files 8/8 bytes 67.5 MB/67.5 MB
|
||||
23:46:28 + 190.6s ('running', '', 'grimmory', 100) files 11/11 bytes 156.9 MB/156.9 MB
|
||||
23:46:31 + 193.6s ('running', 'retention', '', 0) files 0/0 bytes /
|
||||
23:46:37 + 199.7s ('ok', '', '', 0) files 0/0 bytes /
|
||||
23:46:37 off-site after: status=ok last_run=2026-10-16T21:46:35Z duration=3m13s snapshots=282 size=719.2 MB error=''
|
||||
23:47:11 remove grimmory (keepdata: remove_hdd_data=False, remove_backups=False) -> 200 {'ok': True, 'data': {'removed': 'grimmory', 'volumes_removed': ['grimmory_grimmory_db'], 'hdd_paths_removed': [], 'hdd_paths_preserved': ['/mnt/felhom-drives/hdd_1/appdata/grimmory/data (8.0K)'], 'us
|
||||
23:47:11 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
23:47:13 [1] deploy -> 202 {'ok': True, 'message': 'A(z) Grimmory megőrzött adatainak betöltése elindult.'}
|
||||
23:47:38 [1] deployed, controller state=unhealthy, pinned={'grimmory': 'ghcr.io/grimmory-tools/grimmory:v3.5.0', 'grimmory-db': 'mariadb:11.4'}
|
||||
23:47:38 [1] NOTE: the controller's own state is 'unhealthy', not 'running' — recorded, not treated as a failure; the fixture's front-door wait is the real gate
|
||||
23:47:38 install grimmory with kept_data=use: True
|
||||
23:48:40 check grimmory: deployed=True state=running hold=None
|
||||
23:48:43 marker row: 'r1106-D2' (want 'r1106-D2' present)
|
||||
23:48:47 root login (the product's dump user): 1
|
||||
23:48:50 app user login (the app's own DB user): 1
|
||||
23:48:53 app health: Up About a minute (healthy)
|
||||
{"data":{"status":"UP","message":"Application is running smoothly.","timestamp":"2026-10-16T23:48:52.592861758","version":"v3.5.0"},"message":"Pong","status":200,"timestamp":"2026-10-16T23:48:52.59288
|
||||
23:48:56 file: a584aeaa731c68ace4355bbcffa492f6f578af38c12142ff943aeb2880564ab0 /mnt/felhom-drives/hdd_1/userdata/media/grimmory/r1106-D2.txt
|
||||
23:54:12 remove rallly (all: remove_hdd_data=True, remove_backups=True) -> 200 {'ok': True, 'data': {'removed': 'rallly', 'volumes_removed': ['rallly_rallly_postgres_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem tárolt saját adatot kü
|
||||
23:54:46 remove grimmory (all: remove_hdd_data=True, remove_backups=True) -> 200 {'ok': True, 'data': {'removed': 'grimmory', 'volumes_removed': ['grimmory_grimmory_db'], 'hdd_paths_removed': ['/mnt/felhom-drives/hdd_1/appdata/grimmory/data (8.0K)'], 'hdd_paths_preserved': [], 'us
|
||||
23:54:49 household deletes the books-folder files: 2
|
||||
@@ -0,0 +1,5 @@
|
||||
snapshots: 0.14.0-made f3f16e0e (bookstack), 0.18.1-made 6d9dd607 (rallly), 0.19.1-made fd048a06 (bookstack, newest)
|
||||
f3f16e0e: restic 0.14.0 → 0929043ef22edf09 (11 files) restic 0.18.1 → 0929043ef22edf09 (11 files) restic 0.19.1 → 0929043ef22edf09 (11 files)
|
||||
6d9dd607: restic 0.14.0 → 8008e687404bd9a7 (7 files) restic 0.18.1 → 8008e687404bd9a7 (7 files) restic 0.19.1 → 8008e687404bd9a7 (7 files)
|
||||
fd048a06: restic 0.14.0 → 1567422ecd060fbb (11 files) restic 0.18.1 → 1567422ecd060fbb (11 files) restic 0.19.1 → 1567422ecd060fbb (11 files)
|
||||
store listed by each: 0.14.0=234 0.18.1=234 0.19.1=234
|
||||
@@ -0,0 +1 @@
|
||||
rc=0
|
||||
+561
@@ -0,0 +1,561 @@
|
||||
Applying Policy: keep 7 daily, 4 weekly, 6 monthly snapshots
|
||||
keep 14 snapshots:
|
||||
ID Time Host Tags Reasons Paths
|
||||
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
8f70dd2d 2026-05-31 02:30:00 box a,felhom-offbox monthly snapshot <W>/src/a
|
||||
e5685e89 2026-06-30 14:10:00 box a,felhom-offbox monthly snapshot <W>/src/a
|
||||
48fcf709 2026-07-31 02:30:00 box a,felhom-offbox monthly snapshot <W>/src/a
|
||||
9cec0dfb 2026-08-31 02:30:00 box a,felhom-offbox monthly snapshot <W>/src/a
|
||||
8d8b6744 2026-09-27 02:30:00 box a,felhom-offbox weekly snapshot <W>/src/a
|
||||
60e75e0a 2026-09-30 02:30:00 box a,felhom-offbox monthly snapshot <W>/src/a
|
||||
8f26ea70 2026-10-04 02:30:00 box a,felhom-offbox weekly snapshot <W>/src/a
|
||||
3f469a9f 2026-10-10 02:30:00 box a,felhom-offbox daily snapshot <W>/src/a
|
||||
64ab4ec2 2026-10-11 02:30:00 box a,felhom-offbox daily snapshot <W>/src/a
|
||||
weekly snapshot
|
||||
60a96942 2026-10-12 02:30:00 box a,felhom-offbox daily snapshot <W>/src/a
|
||||
a15f14a3 2026-10-13 02:30:00 box a,felhom-offbox daily snapshot <W>/src/a
|
||||
d5a6f655 2026-10-14 02:30:00 box a,felhom-offbox daily snapshot <W>/src/a
|
||||
666514eb 2026-10-15 02:30:00 box a,felhom-offbox daily snapshot <W>/src/a
|
||||
09367c72 2026-10-16 14:10:00 box a,felhom-offbox daily snapshot <W>/src/a
|
||||
weekly snapshot
|
||||
monthly snapshot
|
||||
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
Timestamps shown in UTC
|
||||
14 snapshots
|
||||
|
||||
remove 243 snapshots:
|
||||
ID Time Host Tags Paths
|
||||
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
771de67e 2026-02-28 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
6dd387ac 2026-03-01 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
1e07d089 2026-03-02 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
ff409d60 2026-03-03 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
e40a98b5 2026-03-04 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
1c44dfba 2026-03-05 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
72974001 2026-03-05 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
d4419552 2026-03-06 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
0f19842b 2026-03-07 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
489ee511 2026-03-08 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
87a1ebb8 2026-03-09 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
a405062a 2026-03-10 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
7547886f 2026-03-11 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
255407da 2026-03-12 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
96c9161e 2026-03-13 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
993bcf63 2026-03-14 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
43e3394d 2026-03-14 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
a8985a5f 2026-03-15 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
85f15ec0 2026-03-16 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
7057b877 2026-03-17 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
e9fac77a 2026-03-18 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
131c441a 2026-03-19 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
8324988f 2026-03-20 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
d1e609c0 2026-03-21 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
442ebff9 2026-03-22 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
0e2fa801 2026-03-23 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
767ab4e3 2026-03-23 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
33137cc5 2026-03-24 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
3e8a2c5a 2026-03-25 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
053d36f8 2026-03-26 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
f47d2804 2026-03-27 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
7685b131 2026-03-28 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
962b5504 2026-03-29 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
7890ed38 2026-03-30 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
3b108715 2026-03-31 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
3a958277 2026-04-01 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
cd7aba44 2026-04-01 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
681b0d03 2026-04-02 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
d4d72cf7 2026-04-03 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
2b02c165 2026-04-04 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
4ca97426 2026-04-05 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
b9e29684 2026-04-06 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
d571e1bb 2026-04-07 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
ae53fc44 2026-04-08 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
5deeec58 2026-04-09 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
97ee4d90 2026-04-10 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
608267b5 2026-04-10 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
711776df 2026-04-11 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
21f7f406 2026-04-12 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
21418f80 2026-04-13 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
f39bbb32 2026-04-14 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
a484fc5e 2026-04-15 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
c917f1da 2026-04-16 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
38b2529a 2026-04-17 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
15bd7c6f 2026-04-18 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
bc987be4 2026-04-19 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
907a9646 2026-04-19 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
f36759fb 2026-04-20 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
86e604e7 2026-04-21 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
208bf342 2026-04-22 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
9e65ba46 2026-04-23 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
38c1f3e4 2026-04-24 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
4ad7e0ad 2026-04-25 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
2835c7d4 2026-04-26 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
b34dc0c9 2026-04-27 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
2e47ed5d 2026-04-28 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
37863bf3 2026-04-28 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
0dfcdf46 2026-04-29 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
256e43e6 2026-04-30 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
6cf6cb2c 2026-05-01 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
125d79cb 2026-05-02 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
43a78ef7 2026-05-03 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
fc826c25 2026-05-04 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
4aec4215 2026-05-05 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
75bdd2d8 2026-05-06 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
2b90ac52 2026-05-07 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
d5b8c85b 2026-05-07 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
efff3a99 2026-05-08 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
ca6478bb 2026-05-09 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
b99c0056 2026-05-10 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
47f0537b 2026-05-11 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
36f9ebf9 2026-05-12 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
1a1c6121 2026-05-13 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
eed37ee7 2026-05-14 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
9e50d9dd 2026-05-15 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
123f3b9a 2026-05-16 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
2ff01eae 2026-05-16 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
acbb7fe6 2026-05-17 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
f20f3fc4 2026-05-18 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
497de3c8 2026-05-19 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
c36d44cf 2026-05-20 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
05171c35 2026-05-21 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
ed9ab1fe 2026-05-22 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
2e4e8278 2026-05-23 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
7570e58e 2026-05-24 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
d1761e38 2026-05-25 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
d54f9281 2026-05-25 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
c1b802c4 2026-05-26 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
d6502728 2026-05-27 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
9ea083d0 2026-05-28 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
a2d178ee 2026-05-29 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
8885d6ac 2026-05-30 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
7088f0cc 2026-06-01 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
db51dbc5 2026-06-02 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
c42cb86a 2026-06-03 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
1f7fad88 2026-06-03 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
fcd28986 2026-06-04 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
588b64a8 2026-06-05 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
caee2672 2026-06-06 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
48908f97 2026-06-07 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
7c5b5505 2026-06-08 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
4f849183 2026-06-09 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
28307a76 2026-06-10 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
c9182c36 2026-06-11 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
48d17034 2026-06-12 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
a0c476e1 2026-06-12 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
37940620 2026-06-13 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
b0240087 2026-06-14 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
573fbae8 2026-06-15 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
5e759a21 2026-06-16 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
cf724e77 2026-06-17 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
4b118972 2026-06-18 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
f8793dc2 2026-06-19 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
0f16b002 2026-06-20 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
11be0ee3 2026-06-21 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
df2cd6a0 2026-06-21 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
45b73f82 2026-06-22 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
1deb37d6 2026-06-23 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
a28a97b2 2026-06-24 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
fd399042 2026-06-25 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
902bbc6e 2026-06-26 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
6b994fb0 2026-06-27 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
4841074f 2026-06-28 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
0757e64a 2026-06-29 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
37fadb18 2026-06-30 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
7aae1393 2026-07-01 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
dcc3ec41 2026-07-02 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
c8f6eb05 2026-07-03 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
e2bf3420 2026-07-04 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
ab10a3bb 2026-07-05 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
77072eae 2026-07-06 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
6a6b4e52 2026-07-07 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
e7232f1d 2026-07-08 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
57f98a04 2026-07-09 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
454fe67a 2026-07-09 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
6bf3bb2f 2026-07-10 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
22a6f643 2026-07-11 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
4c584c3c 2026-07-12 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
6b212603 2026-07-13 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
bea3a812 2026-07-14 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
e6bace4c 2026-07-15 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
77d4182e 2026-07-16 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
63bcd85b 2026-07-17 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
3b1a43dc 2026-07-18 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
0bc845a4 2026-07-18 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
18a865dc 2026-07-19 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
ba7ff236 2026-07-20 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
3acec8c9 2026-07-21 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
fd032617 2026-07-22 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
fa6d63e1 2026-07-23 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
69f6bb28 2026-07-24 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
69dba03f 2026-07-25 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
85128e1a 2026-07-26 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
64bb4c3f 2026-07-27 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
2ec9bd3e 2026-07-27 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
d0dad73a 2026-07-28 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
5a9303b6 2026-07-29 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
055989d8 2026-07-30 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
fead4fb4 2026-08-01 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
4a1fd03b 2026-08-02 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
b76bbe6b 2026-08-03 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
3fc058ca 2026-08-04 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
809fbefd 2026-08-05 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
034515e1 2026-08-05 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
dfbe7317 2026-08-06 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
871d237a 2026-08-07 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
ee702f60 2026-08-08 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
efbae105 2026-08-09 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
f2dccbdc 2026-08-10 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
034f04d0 2026-08-11 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
cfcc9376 2026-08-12 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
2c8fbc96 2026-08-13 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
16e7c50a 2026-08-14 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
5b178039 2026-08-14 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
8b5e7881 2026-08-15 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
48129420 2026-08-16 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
cbace118 2026-08-17 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
5041239e 2026-08-18 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
f0001b70 2026-08-19 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
35511892 2026-08-20 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
a25ddedb 2026-08-21 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
83b7a7bb 2026-08-22 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
d3606ba9 2026-08-23 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
a8caee32 2026-08-23 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
31d6b8f7 2026-08-24 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
cac533c3 2026-08-25 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
f50266af 2026-08-26 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
3ff86b96 2026-08-27 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
533e5a7d 2026-08-28 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
ed6d22d5 2026-08-29 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
37b9d011 2026-08-30 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
b5a1a0ac 2026-09-01 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
b4b57fc7 2026-09-01 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
d04c4116 2026-09-02 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
02b2f992 2026-09-03 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
6dab8693 2026-09-04 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
36acac77 2026-09-05 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
06eb52f2 2026-09-06 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
8cdd6ceb 2026-09-07 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
cd407456 2026-09-08 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
ea01bb40 2026-09-09 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
95c7e048 2026-09-10 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
0afaee19 2026-09-10 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
265703f3 2026-09-11 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
d7010979 2026-09-12 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
36341c94 2026-09-13 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
2fe66096 2026-09-14 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
eff9c539 2026-09-15 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
5037d619 2026-09-16 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
13362fe8 2026-09-17 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
7bc717c3 2026-09-18 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
3a0162bd 2026-09-19 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
0629599b 2026-09-19 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
338bb83f 2026-09-20 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
6ef1247b 2026-09-21 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
0e9f2fd3 2026-09-22 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
e391dae4 2026-09-23 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
67f9dbb1 2026-09-24 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
3a93ae89 2026-09-25 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
60dabff3 2026-09-26 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
504c5bd6 2026-09-28 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
357c7267 2026-09-28 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
4391b722 2026-09-29 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
488452f5 2026-10-01 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
52995377 2026-10-02 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
d92eafc1 2026-10-03 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
d4947064 2026-10-05 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
c9460062 2026-10-06 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
a3363dc9 2026-10-07 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
268dc8f4 2026-10-07 14:10:00 box a,felhom-offbox <W>/src/a
|
||||
fea94d1c 2026-10-08 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
4fbbc2b9 2026-10-09 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
6479bd91 2026-10-16 02:30:00 box a,felhom-offbox <W>/src/a
|
||||
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
Timestamps shown in UTC
|
||||
243 snapshots
|
||||
|
||||
keep 14 snapshots:
|
||||
ID Time Host Tags Reasons Paths
|
||||
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
36accea8 2026-05-31 02:30:00 box b,felhom-offbox monthly snapshot <W>/src/b
|
||||
e82153e3 2026-06-30 02:30:00 box b,felhom-offbox monthly snapshot <W>/src/b
|
||||
7db7628f 2026-07-31 02:30:00 box b,felhom-offbox monthly snapshot <W>/src/b
|
||||
96548538 2026-08-31 02:30:00 box b,felhom-offbox monthly snapshot <W>/src/b
|
||||
3c827e18 2026-09-27 02:30:00 box b,felhom-offbox weekly snapshot <W>/src/b
|
||||
b7a6d53e 2026-09-30 02:30:00 box b,felhom-offbox monthly snapshot <W>/src/b
|
||||
f8ab7abd 2026-10-04 02:30:00 box b,felhom-offbox weekly snapshot <W>/src/b
|
||||
dd10b8c4 2026-10-10 02:30:00 box b,felhom-offbox daily snapshot <W>/src/b
|
||||
b7b3a5e5 2026-10-11 02:30:00 box b,felhom-offbox daily snapshot <W>/src/b
|
||||
weekly snapshot
|
||||
9727e882 2026-10-12 02:30:00 box b,felhom-offbox daily snapshot <W>/src/b
|
||||
d79e9f8f 2026-10-13 02:30:00 box b,felhom-offbox daily snapshot <W>/src/b
|
||||
9f0146b2 2026-10-14 02:30:00 box b,felhom-offbox daily snapshot <W>/src/b
|
||||
304b8e9e 2026-10-15 02:30:00 box b,felhom-offbox daily snapshot <W>/src/b
|
||||
d76b401f 2026-10-16 02:30:00 box b,felhom-offbox daily snapshot <W>/src/b
|
||||
weekly snapshot
|
||||
monthly snapshot
|
||||
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
Timestamps shown in UTC
|
||||
14 snapshots
|
||||
|
||||
remove 231 snapshots:
|
||||
ID Time Host Tags Paths
|
||||
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
6a402dc0 2026-02-28 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
beb44caf 2026-03-01 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
66ac8d3c 2026-03-02 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d4722099 2026-03-03 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
dc4433db 2026-03-04 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
917dca0d 2026-03-05 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
4a98db6a 2026-03-06 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d46839d3 2026-03-07 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d22b6a34 2026-03-08 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
b8f477ee 2026-03-08 23:40:00 box b,felhom-offbox <W>/src/b
|
||||
db8f3f50 2026-03-09 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
bff6bc4a 2026-03-10 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d9427e12 2026-03-11 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
9d487b80 2026-03-12 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
95eaac16 2026-03-13 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d003ea92 2026-03-14 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
c08f7015 2026-03-15 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
0239cfc4 2026-03-16 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
6496efdd 2026-03-17 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
5369ad4a 2026-03-18 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
ecce625b 2026-03-19 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
a9891d86 2026-03-20 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
4d4a77f1 2026-03-21 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
c7c9eaa7 2026-03-22 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
24143eb5 2026-03-23 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
55613027 2026-03-24 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
c1d613e6 2026-03-25 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
c3e44c0b 2026-03-25 23:40:00 box b,felhom-offbox <W>/src/b
|
||||
b11a66ef 2026-03-26 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
8fbe9d3b 2026-03-27 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
6c9df060 2026-03-28 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d9084464 2026-03-29 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
e41f49b6 2026-03-30 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
2c2da14e 2026-03-31 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
ed46e7f4 2026-04-01 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
c7c247ee 2026-04-02 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
c639f637 2026-04-03 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
b54b9eeb 2026-04-04 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
4a91df7b 2026-04-05 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
da8ace42 2026-04-06 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
3661cf00 2026-04-07 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
12506e4b 2026-04-08 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
ca81d3bf 2026-04-09 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
cb4ac262 2026-04-10 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
6b191a1b 2026-04-11 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
7c5da2c1 2026-04-11 22:40:00 box b,felhom-offbox <W>/src/b
|
||||
50829770 2026-04-12 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
9d4de4d0 2026-04-13 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
9940ffa2 2026-04-14 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
fc26f5c2 2026-04-15 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
7e86073f 2026-04-16 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
f33c694b 2026-04-17 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
055bd980 2026-04-18 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
a5b7c6ee 2026-04-19 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
12acc17d 2026-04-20 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
e2412763 2026-04-21 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
cbe3e534 2026-04-22 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
04fec27c 2026-04-23 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
f2c51703 2026-04-24 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
a2fc8669 2026-04-25 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
efac66aa 2026-04-26 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
24be8a0a 2026-04-27 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
7d9e6ac5 2026-04-28 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
6d1bfcbf 2026-04-28 22:40:00 box b,felhom-offbox <W>/src/b
|
||||
b7570692 2026-04-29 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
7859f130 2026-04-30 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
5501314e 2026-05-01 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
852384d0 2026-05-02 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
1a806311 2026-05-03 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
22050be5 2026-05-04 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d2bf9a42 2026-05-05 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
ca8c2f85 2026-05-06 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
26b220be 2026-05-07 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
506491f2 2026-05-08 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
688189a0 2026-05-09 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
ecaac318 2026-05-10 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
e0b9a354 2026-05-11 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
e2a52b54 2026-05-12 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
3ec096df 2026-05-13 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
e9738d4d 2026-05-14 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
052e0896 2026-05-15 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
84b7a47d 2026-05-15 22:40:00 box b,felhom-offbox <W>/src/b
|
||||
7583f66d 2026-05-16 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
058d5813 2026-05-17 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
cbbe7dd1 2026-05-18 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
b1cb0174 2026-05-19 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
54cf284e 2026-05-20 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
b3e53f97 2026-05-21 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
76846bd0 2026-05-22 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
3c3c3196 2026-05-23 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
7a099ec5 2026-05-24 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
3f2d9830 2026-05-25 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
4f18917e 2026-05-26 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
04df6307 2026-05-27 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
10afba47 2026-05-28 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
f50ed158 2026-05-29 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
0ba92ebe 2026-05-30 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
2facd99e 2026-06-01 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
1084e6fd 2026-06-01 22:40:00 box b,felhom-offbox <W>/src/b
|
||||
8f4863ec 2026-06-02 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
20c5e566 2026-06-03 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
aa1fe73c 2026-06-04 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
b259befd 2026-06-05 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
b361cc39 2026-06-06 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
a9fe08a7 2026-06-07 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
03a3a73c 2026-06-08 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
236e0f4c 2026-06-09 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
a4dc8756 2026-06-10 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
468c771f 2026-06-11 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
c14384d3 2026-06-12 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
31486f77 2026-06-13 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
ae3b14ac 2026-06-14 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
a24c3aa1 2026-06-15 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
bc3c78db 2026-06-16 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
2ad5af51 2026-06-17 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
2680ffc7 2026-06-18 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
2c424261 2026-06-18 22:40:00 box b,felhom-offbox <W>/src/b
|
||||
bd97943b 2026-06-19 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
b825d642 2026-06-20 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d417005e 2026-06-21 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
9940af16 2026-06-22 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
5f309e2c 2026-06-23 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
f71f4a3b 2026-06-24 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
8308f20d 2026-06-25 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
394d9ceb 2026-06-26 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
eec81a2c 2026-06-27 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
1d2ea3fe 2026-06-28 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
3c5d64c0 2026-06-29 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
42068a48 2026-07-01 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
0e911cf9 2026-07-02 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
c0e5084c 2026-07-03 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
93940831 2026-07-04 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
4e6adc60 2026-07-05 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
03ee4458 2026-07-05 22:40:00 box b,felhom-offbox <W>/src/b
|
||||
230bd9ae 2026-07-06 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
8b257ab2 2026-07-07 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
703c6fd9 2026-07-08 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
c9a36d5c 2026-07-09 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
14f21efd 2026-07-10 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
c970ed6f 2026-07-11 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
57f5c22e 2026-07-12 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
43b23661 2026-07-13 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
13c2ac05 2026-07-14 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
a9b8e21c 2026-07-15 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
b7830a8a 2026-07-16 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
b2bda3c4 2026-07-17 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
54ec14ca 2026-07-18 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
688c5e87 2026-07-19 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
fe60b55b 2026-07-20 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
8410e869 2026-07-21 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
4e33c281 2026-07-22 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
7f924a70 2026-07-22 22:40:00 box b,felhom-offbox <W>/src/b
|
||||
11020603 2026-07-23 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
82d8cc6d 2026-07-24 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
30645b80 2026-07-25 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
00ba72b7 2026-07-26 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d0f27361 2026-07-27 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
817beade 2026-07-28 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
be12d398 2026-07-29 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
88543a7f 2026-07-30 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
7e766bfd 2026-08-01 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
104fda2d 2026-08-02 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d4a3ead0 2026-08-03 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
79d589c5 2026-08-04 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
7a23ddd0 2026-08-05 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
694583af 2026-08-06 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
07905789 2026-08-07 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
66eb1cea 2026-08-08 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
da6fecd2 2026-08-08 22:40:00 box b,felhom-offbox <W>/src/b
|
||||
876812a8 2026-08-09 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
3d88252f 2026-08-10 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
475b1897 2026-08-11 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
4bc78500 2026-08-12 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
0c015408 2026-08-13 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
62346cc4 2026-08-14 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
a8695b01 2026-08-15 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
c081b4c3 2026-08-16 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
05191842 2026-08-17 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
fc548112 2026-08-18 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
bd460956 2026-08-19 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
e9f8dccc 2026-08-20 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
84eb1974 2026-08-21 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
c1f9df12 2026-08-22 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
f1a8340a 2026-08-23 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
ba65914b 2026-08-24 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
9dfa74cb 2026-08-25 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
9da83081 2026-08-25 22:40:00 box b,felhom-offbox <W>/src/b
|
||||
1a74877e 2026-08-26 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d46ac7a8 2026-08-27 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d28f0225 2026-08-28 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
b20ddf0c 2026-08-29 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
566e708b 2026-08-30 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
5e77a4b4 2026-09-01 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
e57521de 2026-09-02 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d4c9a9be 2026-09-03 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
5aa997a3 2026-09-04 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
eb221b8b 2026-09-05 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
6de4d01b 2026-09-06 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
7a54ac59 2026-09-07 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
8a9f46fc 2026-09-08 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
e381761e 2026-09-09 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
9ea9a862 2026-09-10 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
e37779c4 2026-09-11 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
5a50be81 2026-09-11 22:40:00 box b,felhom-offbox <W>/src/b
|
||||
8619c49a 2026-09-12 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
fafb42b7 2026-09-13 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
dce8f22f 2026-09-14 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
1c324ca6 2026-09-15 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
9c7d21c8 2026-09-16 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
beb3becb 2026-09-17 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
1c2538d2 2026-09-18 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
797667df 2026-09-19 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
b036fb39 2026-09-20 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
52617b0f 2026-09-21 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
0fb2da28 2026-09-22 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
4cfb09bd 2026-09-23 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
a39ced85 2026-09-24 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
015979f0 2026-09-25 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
3abe3ef9 2026-09-26 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
7033fff6 2026-09-28 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
d85ee2c6 2026-09-28 22:40:00 box b,felhom-offbox <W>/src/b
|
||||
5629a380 2026-09-29 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
544613c7 2026-10-01 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
54b5463c 2026-10-02 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
3fa9ba77 2026-10-03 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
5d0405f0 2026-10-05 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
4c51d9f0 2026-10-06 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
0f19d9b7 2026-10-07 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
338aeaae 2026-10-08 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
840009d1 2026-10-09 02:30:00 box b,felhom-offbox <W>/src/b
|
||||
67143204 2026-10-15 22:40:00 box b,felhom-offbox <W>/src/b
|
||||
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
Timestamps shown in UTC
|
||||
231 snapshots
|
||||
|
||||
[0:00] 100.00% 474 / 474 files deleted
|
||||
474 snapshots have been removed, running prune
|
||||
loading all snapshots...
|
||||
finding data that is still in use for 28 snapshots
|
||||
[0:00] 100.00% 28 / 28 snapshots
|
||||
searching used packs...
|
||||
collecting packs for deletion and repacking
|
||||
[0:00] 100.00% 964 / 964 packs processed
|
||||
|
||||
to repack: 310 blobs / 86.833 KiB
|
||||
this removes: 2 blobs / 486 B
|
||||
to delete: 4938 blobs / 1.129 MiB
|
||||
total prune: 4940 blobs / 1.129 MiB
|
||||
remaining: 308 blobs / 71.907 KiB
|
||||
unused size after prune: 0 B (0.00% of remaining size)
|
||||
|
||||
repacking packs
|
||||
[0:00] 100.00% 58 / 58 packs repacked
|
||||
rebuilding index
|
||||
[0:00] 100.00% 503 / 503 indexes processed
|
||||
[0:00] 100.00% 503 / 503 old indexes deleted
|
||||
removing 964 old packs
|
||||
[0:00] 100.00% 964 / 964 files deleted
|
||||
done
|
||||
+1
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
+1
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -0,0 +1,11 @@
|
||||
snapshots made by 0.14.0: 502
|
||||
plan-0.14.0-Europe_Budapest.json: remove 474 keep 28 — identical to 0.14.0/UTC: True
|
||||
plan-0.14.0-UTC.json: remove 474 keep 28 — identical to 0.14.0/UTC: True
|
||||
plan-0.19.1-Europe_Budapest.json: remove 474 keep 28 — identical to 0.14.0/UTC: True
|
||||
plan-0.19.1-UTC.json: remove 474 keep 28 — identical to 0.14.0/UTC: True
|
||||
after 0.19.1 forget --prune + a 0.19.1 backup:
|
||||
0.14.0 lists: 29
|
||||
0.19.1 lists: 29
|
||||
0.14.0 check --read-data rc=0 (no errors were found)
|
||||
0.14.0 restores the 0.19.1 snapshot: rc=0 content=f-new
|
||||
0.19.1 restores a 0.14.0 snapshot (09367c72): rc=0 content=2026-10-16 a
|
||||
@@ -0,0 +1,6 @@
|
||||
trivy 0.74.0, felhom-controller:0.324.0-rc.1 (critical/high, fixable in brackets)
|
||||
gitea.dooplex.hu/admin/felhom-controller:0.324.0-rc.1 (debia crit 1 (0) high 70 (0)
|
||||
usr/libexec/docker/cli-plugins/docker-compose crit 0 (0) high 4 (4) ['golang.org/x/net@v0.58.0', 'stdlib@v1.26.8']
|
||||
usr/local/bin/restic crit 0 (0) high 19 (19) ['golang.org/x/crypto@v0.52.0', 'golang.org/x/net@v0.55.0', 'golang.org/x/text@v0.37.0', 'google.golang.org/grpc@v1.81.1', 'stdlib@v1.26.4']
|
||||
TOTAL crit 1 (0) high 93 (23)
|
||||
before (0.323.0 = restic 0.18.1): crit 3 (2) high 122 (52), of which restic 2 (2) / 48 (48)
|
||||
@@ -0,0 +1,5 @@
|
||||
23:24:26 POST /sharing/enable {'enabled': 'on', 'server_name': 'FELHOMHP'} -> HTTP/2 303 /sharing?flash=flash.sharing.saved_preparing
|
||||
23:24:26 POST /sharing/shares {'name': 'r1108', 'mode': 'new', 'storage_root': '/mnt/felhom-drives/hdd_1'} -> HTTP/2 303 /sharing?flash=flash.sharing.created
|
||||
23:24:27 POST /sharing/password (value not shown) -> location: /sharing?flash=flash.sharing.pw_set_preparing
|
||||
23:25:07 POST /sharing/shares/delete {'name': 'r1108'} -> HTTP/2 303 /sharing?flash=flash.sharing.deleted
|
||||
23:25:07 POST /sharing/enable {'enabled': 'off', 'server_name': 'FELHOMHP'} -> HTTP/2 303 /sharing?flash=flash.sharing.disabled
|
||||
@@ -0,0 +1,17 @@
|
||||
== r1108-live — 2026-10-16T21:24:47Z
|
||||
-- 1. smbclient with the household password: write, list, read back, delete
|
||||
putting file /tmp/probe.txt as \probe-r1108-live.txt (2.8 kB/s) (average 2.8 kB/s)
|
||||
probe-r1108-live.txt A 17 Fri Oct 16 21:24:47 2026
|
||||
getting file \probe-r1108-live.txt of size 17 as /tmp/back.txt (16.6 KiloBytes/sec) (average 16.6 KiloBytes/sec)
|
||||
read back: r1105-r1108-live
|
||||
-- 2. negative control: a wrong password
|
||||
session setup failed: NT_STATUS_LOGON_FAILURE
|
||||
-- 3. nmbd: NetBIOS name query from DooPlex
|
||||
192.168.0.155 FELHOMHP<00>
|
||||
-- 4. avahi: mDNS A query for FELHOMHP.local
|
||||
answer from 192.168.0.155: 192.168.0.155 for felhomhp.local
|
||||
-- 5. wsdd: WS-Discovery Probe
|
||||
ProbeMatches from: ['192.168.0.110', '192.168.0.155'] — the box (192.168.0.155) answered
|
||||
rmdir: removing directory, '/mnt/felhom-drives/hdd_1/shares/r1108'
|
||||
rmdir: removing directory, '/mnt/felhom-drives/hdd_1/shares'
|
||||
0
|
||||
@@ -0,0 +1,80 @@
|
||||
rm: cannot remove '/mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/night-restore-2026-10-17/P4/browser/.profile/Default': Directory not empty
|
||||
{
|
||||
"1_sign_in_lands_on": "/launcher",
|
||||
"2_headers": {
|
||||
"status": 200,
|
||||
"xfo": "DENY",
|
||||
"csp": "frame-ancestors 'none'"
|
||||
},
|
||||
"3_signout_control": {
|
||||
"method": "post",
|
||||
"hasCsrf": true
|
||||
},
|
||||
"4_after_signout": "/login",
|
||||
"5_launcher_after_signout": "/login",
|
||||
"6_sign_in_again": "/launcher",
|
||||
"7_app grimmory-r1106.enkisfelhom.hu": {
|
||||
"host": "grimmory-r1106.enkisfelhom.hu",
|
||||
"path": "/setup",
|
||||
"title": "Grimmory",
|
||||
"gatePage": false
|
||||
},
|
||||
"7_app rallly-r1106.enkisfelhom.hu": {
|
||||
"host": "rallly-r1106.enkisfelhom.hu",
|
||||
"path": "/login",
|
||||
"title": "Login",
|
||||
"gatePage": false
|
||||
},
|
||||
"console": [
|
||||
[
|
||||
"log-error",
|
||||
"Failed to load resource: the server responded with a status of 404 ()",
|
||||
"https://felhom.enkisfelhom.hu/static/assets/adventurelog-logo.svg"
|
||||
],
|
||||
[
|
||||
"log-error",
|
||||
"Failed to load resource: the server responded with a status of 404 ()",
|
||||
"https://felhom.enkisfelhom.hu/static/assets/kimai-logo.svg"
|
||||
],
|
||||
[
|
||||
"log-error",
|
||||
"Failed to load resource: the server responded with a status of 404 ()",
|
||||
"https://felhom.enkisfelhom.hu/static/assets/privatebin-logo.svg"
|
||||
],
|
||||
[
|
||||
"log-error",
|
||||
"Failed to load resource: the server responded with a status of 404 ()",
|
||||
"https://felhom.enkisfelhom.hu/static/assets/opengist-logo.svg"
|
||||
],
|
||||
[
|
||||
"log-error",
|
||||
"Failed to load resource: the server responded with a status of 404 ()",
|
||||
"https://felhom.enkisfelhom.hu/static/assets/docmost-logo.svg"
|
||||
],
|
||||
[
|
||||
"log-error",
|
||||
"Failed to load resource: the server responded with a status of 404 ()",
|
||||
"https://felhom.enkisfelhom.hu/static/assets/docmost-logo.svg"
|
||||
],
|
||||
[
|
||||
"log-error",
|
||||
"Failed to load resource: the server responded with a status of 404 ()",
|
||||
"https://felhom.enkisfelhom.hu/static/assets/kimai-logo.svg"
|
||||
],
|
||||
[
|
||||
"log-error",
|
||||
"Failed to load resource: the server responded with a status of 404 ()",
|
||||
"https://felhom.enkisfelhom.hu/static/assets/opengist-logo.svg"
|
||||
],
|
||||
[
|
||||
"log-error",
|
||||
"Failed to load resource: the server responded with a status of 404 ()",
|
||||
"https://felhom.enkisfelhom.hu/static/assets/privatebin-logo.svg"
|
||||
],
|
||||
[
|
||||
"log-error",
|
||||
"Failed to load resource: the server responded with a status of 404 ()",
|
||||
"https://felhom.enkisfelhom.hu/static/assets/adventurelog-logo.svg"
|
||||
]
|
||||
]
|
||||
}
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 19 KiB |
@@ -0,0 +1,29 @@
|
||||
# R-1096 — Redis persistence in the catalog (research, 2026-10-16 night; catalog HEAD af75dc0; nothing changed)
|
||||
|
||||
Read-only research (catalog compose files + upstream docs/source). No valkey image in the catalog. No `.felhom.yml`
|
||||
classifies a Redis volume; every named volume (Redis included) rides the nightly volume dump, taken with the stack
|
||||
stopped, so Redis saves cleanly first.
|
||||
|
||||
Facts that hold for all: `redis:7-alpine` / `7.4-alpine` without a config saves RDB snapshots to `/data` (3600/1,
|
||||
300/100, 60/10000). An RDB file is written to a temp file and renamed only when complete — a full disk leaves the old
|
||||
file intact (and `stop-writes-on-bgsave-error` refuses writes until a save succeeds, then recovers by itself). An
|
||||
APPEND-ONLY file damaged in the middle (2026-09-24: zero bytes near the end, „Expected \r\n, got: 0000") makes Redis
|
||||
abort until `redis-check-aof --fix`; `aof-load-truncated yes` only covers a cut-off tail.
|
||||
|
||||
| app | service | persistence today | volume | what the app keeps in Redis | verdict | recommendation | source |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| romm 5.3.1 | romm-redis (redis:7-alpine) | AOF + RDB | romm_redis_data | sessions; RQ job queues; caches reloaded at start; Switch TitleDB / LaunchBox stores (refilled by the next metadata task) | sessions + queue | AOF → RDB (`--appendonly no`) | docs.romm.app/4.9.2/install/redis-or-valkey/ ; github.com/rommapp/romm 5.3.1 backend/handler/redis_handler.py, backend/startup.py |
|
||||
| docmost 0.96.0 | docmost-redis | AOF + RDB | docmost_redis_data | BullMQ queues (email, notifications, page history, search index, import/export) | queue | AOF → RDB | github.com/docmost/docmost docker-compose.yml, queue.constants.ts |
|
||||
| paperless-ngx 2.20.15 | paperless-redis | AOF + RDB | paperless_redis_data | Celery queue (consumption, mail fetch, classifier) | queue | AOF → RDB (upstream's own broker uses the default RDB) | paperless-ngx docs/configuration.md, docker-compose.postgres.yml |
|
||||
| immich v3.2.4 | immich-redis | AOF + RDB | immich_redis_data | BullMQ job queues + websocket pub/sub; every job can be re-queued from Administration → Jobs | throwaway queue | OFF (`--save "" --appendonly no`, tmpfs /data) — upstream runs it with no volume | immich docker/docker-compose.yml |
|
||||
| nextcloud 34.0.4 | nextcloud-redis | AOF + RDB | nextcloud_redis_data | file-locking cache, shared cache, PHP sessions | cache + sessions | OFF (same shape) — upstream examples have no volume | nextcloud/docker README (REDIS_HOST), .examples |
|
||||
| outline 1.10.1 | outline-redis | RDB (image default) | outline_redis_data | Bull queues, pub/sub, collaboration | queue | keep (RDB is full-disk-safe) | outline server/queues/index.ts, server/storage/redis.ts |
|
||||
| dawarich 1.15.3 | dawarich-redis (7.4) | RDB only (`--save 900 1 --save 300 10 --appendonly no`) | dawarich_redis | Sidekiq queue + Rails cache | queue | keep (= upstream) | Freika/dawarich docker/docker-compose.yml |
|
||||
|
||||
Open before any template edit (why it was NOT edited tonight): the same Redis lines sit in ladder step files
|
||||
(romm 2, docmost 1, nextcloud 2, immich 2) and the step rule for a compose-only change was not checked; removing a
|
||||
volume from compose leaves the old volume on installed boxes (orphan — nightly dump and old-backup restore behaviour
|
||||
unchecked); the AOF → RDB switch keeping existing data is likely (Redis 7 writes `dump.rdb` at a clean shutdown) but
|
||||
unproven. Also: R-1096's own history is wrong — `audits/r672-2026-09-24/B7-redis-aof-fix.txt` shows RomM's AOF WAS
|
||||
repaired on 2026-09-24 (cut by 6 631 B, fix_rc=0, romm-redis then running); the 2026-10-16 crash loop has no proven
|
||||
cause (its Redis log was never read).
|
||||
@@ -0,0 +1,15 @@
|
||||
=== demo-hp
|
||||
containers: 28 not healthy/running: none
|
||||
restic 0.19.1 compiled with go1.26.4 on linux/amd64
|
||||
2026/10/16 21:51:51 updater.go:855: [INFO] [selfupdate] Post-update startup: update successful (0.324.0-rc.1 → 0.324.0)
|
||||
=== felhom-pve
|
||||
containers: 9 not healthy/running: none
|
||||
restic 0.19.1 compiled with go1.26.4 on linux/amd64
|
||||
2026/10/16 21:51:43 [INFO] [selfupdate] Post-update startup: update successful (0.323.0 → 0.324.0)
|
||||
=== root@192.168.0.154
|
||||
containers: 17 not healthy/running: none
|
||||
restic 0.19.1 compiled with go1.26.4 on linux/amd64
|
||||
2026/10/16 21:51:54 [INFO] [selfupdate] Post-update startup: update successful (0.323.0 → 0.324.0)
|
||||
felhom.enkisfelhom.hu /login: 200
|
||||
felhom.demo-felhom.eu /login: 200
|
||||
felhom.enkicsifelhom.hu /login: 200
|
||||
@@ -0,0 +1,42 @@
|
||||
control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -)
|
||||
== tester-1 (enkicsifelhom.hu): 13 public name(s)
|
||||
OK control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://media.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://media.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://plex.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://plex.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://prowlarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://prowlarr.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://radarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://radarr.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://sonarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://sonarr.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://torrent.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://torrent.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://transmission.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://transmission.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1
|
||||
== demo-hp (enkisfelhom.hu): 16 public name(s)
|
||||
OK http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://grimmory-r1106.enkisfelhom.hu/r1033-check?q=1 -> 301 https://grimmory-r1106.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://rallly-r1106.enkisfelhom.hu/r1033-check?q=1 -> 301 https://rallly-r1106.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1
|
||||
== demo-felhom (demo-felhom.eu): 8 public name(s)
|
||||
OK http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1
|
||||
== every public name redirects http -> https
|
||||
@@ -0,0 +1,121 @@
|
||||
#!/usr/bin/env python3
|
||||
"""v0.324.0 night (R-983, R-976): the household's normal flow in headless Chrome through the PUBLIC addresses — sign in, sign out (now a POST form),
|
||||
sign in again, a family-gated app (Grimmory), a setup-gated app (Rallly). Minimal CDP client: log in to the controller through its PUBLIC address in headless Chrome, open each
|
||||
app-page tab, assert computed styles, collect console errors, save screenshots. The password is read
|
||||
from a 0600 file and only ever sent inside a CDP message; it is never printed."""
|
||||
import base64, json, os, socket, struct, subprocess, sys, time, urllib.request
|
||||
|
||||
CHROME = os.path.expanduser('~/.cache/ms-playwright/chromium_headless_shell-1243/chrome-headless-shell-linux64/chrome-headless-shell')
|
||||
BASE = sys.argv[1] # https://felhom.enkisfelhom.hu
|
||||
PWFILE = sys.argv[2] # the controller password (0600 file)
|
||||
APPS = sys.argv[3].split(',') # family-gated,setup-gated app hostnames
|
||||
OUT = sys.argv[4]
|
||||
PORT = 9333
|
||||
os.makedirs(OUT, exist_ok=True)
|
||||
prof = os.path.join(OUT, '.profile')
|
||||
proc = subprocess.Popen([CHROME, f'--remote-debugging-port={PORT}', '--no-sandbox', f'--user-data-dir={prof}',
|
||||
'--window-size=1280,900', 'about:blank'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
|
||||
try:
|
||||
for _ in range(50):
|
||||
try:
|
||||
tabs = json.load(urllib.request.urlopen(f'http://127.0.0.1:{PORT}/json'))
|
||||
break
|
||||
except Exception:
|
||||
time.sleep(0.2)
|
||||
ws_url = [t for t in tabs if t['type'] == 'page'][0]['webSocketDebuggerUrl']
|
||||
host, path = ws_url[len('ws://'):].split('/', 1)
|
||||
h, p = host.split(':')
|
||||
sock = socket.create_connection((h, int(p)))
|
||||
key = base64.b64encode(os.urandom(16)).decode()
|
||||
sock.send(f'GET /{path} HTTP/1.1\r\nHost: {host}\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: {key}\r\nSec-WebSocket-Version: 13\r\n\r\n'.encode())
|
||||
buf = b''
|
||||
while b'\r\n\r\n' not in buf:
|
||||
buf += sock.recv(4096)
|
||||
st = {'pending': buf.split(b'\r\n\r\n', 1)[1]}
|
||||
|
||||
def send(obj):
|
||||
data = json.dumps(obj).encode()
|
||||
hdr = bytearray([0x81])
|
||||
n = len(data)
|
||||
if n < 126: hdr.append(0x80 | n)
|
||||
elif n < 65536: hdr.append(0x80 | 126); hdr += struct.pack('>H', n)
|
||||
else: hdr.append(0x80 | 127); hdr += struct.pack('>Q', n)
|
||||
mask = os.urandom(4); hdr += mask
|
||||
sock.sendall(bytes(hdr) + bytes(b ^ mask[i % 4] for i, b in enumerate(data)))
|
||||
|
||||
def recv_exact(n):
|
||||
while len(st['pending']) < n:
|
||||
st['pending'] += sock.recv(1 << 20)
|
||||
out, st['pending'] = st['pending'][:n], st['pending'][n:]
|
||||
return out
|
||||
|
||||
def recv():
|
||||
msg = b''
|
||||
while True:
|
||||
b0, b1 = recv_exact(2)
|
||||
n = b1 & 0x7f
|
||||
if n == 126: n = struct.unpack('>H', recv_exact(2))[0]
|
||||
elif n == 127: n = struct.unpack('>Q', recv_exact(8))[0]
|
||||
msg += recv_exact(n)
|
||||
if b0 & 0x80: return json.loads(msg)
|
||||
|
||||
console = []
|
||||
mid = [0]
|
||||
def call(method, **params):
|
||||
mid[0] += 1; i = mid[0]
|
||||
send({'id': i, 'method': method, 'params': params})
|
||||
while True:
|
||||
m = recv()
|
||||
if m.get('method') == 'Runtime.exceptionThrown':
|
||||
console.append(('exception', m['params']['exceptionDetails'].get('text', ''), m['params']['exceptionDetails'].get('exception', {}).get('description', '')[:200]))
|
||||
elif m.get('method') == 'Runtime.consoleAPICalled' and m['params']['type'] in ('error', 'warning'):
|
||||
console.append((m['params']['type'], ' '.join(str(a.get('value', a.get('description', ''))) for a in m['params']['args'])[:200]))
|
||||
elif m.get('method') == 'Log.entryAdded' and m['params']['entry']['level'] in ('error', 'warning'):
|
||||
e = m['params']['entry']; console.append(('log-' + e['level'], e.get('text', '')[:200], e.get('url', '')))
|
||||
if m.get('id') == i:
|
||||
if 'error' in m: raise RuntimeError(f'{method}: {m["error"]}')
|
||||
return m.get('result', {})
|
||||
|
||||
def ev(expr):
|
||||
r = call('Runtime.evaluate', expression=expr, returnByValue=True, awaitPromise=True)
|
||||
return r.get('result', {}).get('value')
|
||||
|
||||
def goto(url):
|
||||
call('Page.navigate', url=url)
|
||||
for _ in range(100):
|
||||
time.sleep(0.2)
|
||||
if ev('document.readyState') == 'complete':
|
||||
break
|
||||
time.sleep(1.5) # images' onerror, layout
|
||||
|
||||
for d in ('Page', 'Runtime', 'Log', 'Network'):
|
||||
call(d + '.enable')
|
||||
res = {}
|
||||
def login():
|
||||
pw = open(PWFILE).read().strip()
|
||||
goto(BASE + '/login')
|
||||
ev("(function(){var f=document.querySelector('input[type=password]'); f.value=%s; f.form.submit(); return 1})()" % json.dumps(pw))
|
||||
time.sleep(3)
|
||||
return ev('location.pathname')
|
||||
res['1_sign_in_lands_on'] = login()
|
||||
res['2_headers'] = ev("fetch('/launcher',{credentials:'include'}).then(r=>({status:r.status, xfo:r.headers.get('x-frame-options'), csp:r.headers.get('content-security-policy')}))")
|
||||
res['3_signout_control'] = ev("(function(){var f=[...document.querySelectorAll('form')].find(f=>/logout/.test(f.action)); return f?{method:f.method, hasCsrf:!!f.querySelector('input[name=_csrf]')}:null})()")
|
||||
ev("(function(){var f=[...document.querySelectorAll('form')].find(f=>/logout/.test(f.action)); if(f){f.submit()} return !!f})()")
|
||||
time.sleep(3)
|
||||
res['4_after_signout'] = ev('location.pathname')
|
||||
goto(BASE + '/launcher')
|
||||
res['5_launcher_after_signout'] = ev('location.pathname')
|
||||
res['6_sign_in_again'] = login()
|
||||
for host in APPS:
|
||||
goto('https://' + host + '/')
|
||||
time.sleep(4)
|
||||
res['7_app ' + host] = ev("({host: location.host, path: location.pathname, title: document.title, gatePage: !!document.querySelector('form[action*=\"__family\"],form[action*=\"__felhom_gate\"],[data-gate]') })")
|
||||
def shot(name):
|
||||
s = call('Page.captureScreenshot', format='png')
|
||||
open(os.path.join(OUT, name + '.png'), 'wb').write(base64.b64decode(s['data']))
|
||||
shot('last-app')
|
||||
res['console'] = console[:20]
|
||||
print(json.dumps(res, indent=1, ensure_ascii=False))
|
||||
finally:
|
||||
proc.terminate()
|
||||
subprocess.run(['rm', '-rf', prof])
|
||||
@@ -0,0 +1,116 @@
|
||||
#!/usr/bin/env python3
|
||||
"""drill.py — R-1105 Part 2 on demo-hp guest 9201, THROUGH THE PRODUCT (the endpoints the dashboard's buttons post).
|
||||
|
||||
Runs on DooPlex. Env: SC (0600 dir with .ctlpw), EV (evidence dir), TARGET=9201. Steps (one per invocation):
|
||||
restore-old the product's off-site restore („Visszaállítás a távoli tárolóból", unit only) BEFORE any 0.18 backup:
|
||||
restic 0.18.1 restores the newest snapshot, which restic 0.14.0 made
|
||||
offsite-run „Távoli mentés most" (POST /backup/offbox/run: dumps + units + push), polled to its end
|
||||
restore APP the household's full off-site restore: prepare (size), confirm → download, then „Teljes
|
||||
visszaállítás" (POST /backup/offbox/reconstitute), each polled to its end
|
||||
delcopy APP remove the verification copy (POST /backup/offbox/verify-copy/delete)
|
||||
Nothing here writes to an app's data except what those buttons write.
|
||||
"""
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
import sys
|
||||
import time
|
||||
|
||||
sys.path.insert(0, "/mnt/5_hdd/felhom.eu/git/app-catalog-felhom.eu/scripts")
|
||||
import box_walk as w # noqa: E402
|
||||
|
||||
EV = os.environ["EV"]
|
||||
LOG = open(os.path.join(EV, "drill-console.txt"), "a", buffering=1)
|
||||
_say = w.say
|
||||
|
||||
|
||||
def say(*a):
|
||||
_say(*a)
|
||||
LOG.write(time.strftime("%H:%M:%S ") + " ".join(str(x) for x in a) + "\n")
|
||||
|
||||
|
||||
w.say = say
|
||||
|
||||
|
||||
def form(path, fields):
|
||||
"""A dashboard FORM post with the session's CSRF — exactly what the button sends."""
|
||||
sess = open(f"{w.SC}/sess{os.getpid()}.txt").read().strip()
|
||||
csrf = open(f"{w.SC}/csrf{os.getpid()}.txt").read().strip()
|
||||
args = ["curl", "-sk", "-D", "-", "-o", "/dev/null", "-H", w.HOSTHDR, "-H", f"Cookie: {sess}", "-X", "POST",
|
||||
"--data-urlencode", f"_csrf={csrf}"]
|
||||
for k, v in fields.items():
|
||||
args += ["--data-urlencode", f"{k}={v}"]
|
||||
r = w.sh(args + [f"{w.BASE}{path}"], timeout=180)
|
||||
head = (r.stdout or "").split("\n")[0].strip()
|
||||
loc = next((l.split(":", 1)[1].strip() for l in (r.stdout or "").split("\n") if l.lower().startswith("location:")), "")
|
||||
say(f"POST {path} {fields} -> {head} {loc}")
|
||||
return head, loc
|
||||
|
||||
|
||||
def wait_restore(cap=3600):
|
||||
t0, last = time.time(), None
|
||||
while time.time() - t0 < cap:
|
||||
code, d = w.ctl("GET", "/api/backup/restore-status")
|
||||
dd = (d or {}).get("data") or d or {}
|
||||
cur = (dd.get("running"), dd.get("op"), dd.get("ok"), (dd.get("message") or "")[:300])
|
||||
if cur != last:
|
||||
say(f" +{time.time()-t0:7.1f}s restore-status {cur}")
|
||||
last = cur
|
||||
if not dd.get("running") and time.time() - t0 > 4:
|
||||
return dd
|
||||
time.sleep(3)
|
||||
say(" restore did not end within the cap")
|
||||
return {}
|
||||
|
||||
|
||||
def offsite_status():
|
||||
return w.ctl("GET", "/backup/offbox/status")[1]
|
||||
|
||||
|
||||
def offsite_run(cap=3600):
|
||||
before = offsite_status()
|
||||
say(f"off-site before: status={before.get('status')} last_run={before.get('last_run')} snapshots={before.get('snapshots')}")
|
||||
form("/backup/offbox/run", {})
|
||||
t0, last = time.time(), None
|
||||
while time.time() - t0 < cap:
|
||||
s = offsite_status()
|
||||
p = s.get("progress") or {}
|
||||
cur = (s.get("status"), p.get("phase"), p.get("current_app"), round(p.get("percent") or 0))
|
||||
if cur != last:
|
||||
say(f" +{time.time()-t0:7.1f}s {cur} files {p.get('files_done')}/{p.get('total_files')} bytes {p.get('done_human')}/{p.get('total_human')}")
|
||||
last = cur
|
||||
if s.get("last_run") != before.get("last_run") and not p.get("active") and s.get("status") != "running":
|
||||
say(f"off-site after: status={s.get('status')} last_run={s.get('last_run')} duration={s.get('last_duration')} "
|
||||
f"snapshots={s.get('snapshots')} size={s.get('repo_size_human')} error={s.get('last_error')!r}")
|
||||
return s
|
||||
time.sleep(3)
|
||||
say("off-site run did not end within the cap")
|
||||
return {}
|
||||
|
||||
|
||||
def main():
|
||||
step = sys.argv[1]
|
||||
w.login()
|
||||
if step == "restore-old":
|
||||
app = sys.argv[2]
|
||||
form("/backup/offbox/restore", {"app": app})
|
||||
say(json.dumps(wait_restore()))
|
||||
elif step == "offsite-run":
|
||||
offsite_run()
|
||||
elif step == "restore":
|
||||
app = sys.argv[2]
|
||||
head, loc = form("/backup/offbox/restore", {"app": app, "mode": "full"})
|
||||
m = re.search(r"full_size=([^&]+)", loc)
|
||||
say(f" prepared: size {m.group(1) if m else '?'}")
|
||||
form("/backup/offbox/restore", {"app": app, "mode": "full", "confirm": "1"})
|
||||
say(json.dumps(wait_restore()))
|
||||
form("/backup/offbox/reconstitute", {"app": app, "confirm": "1"})
|
||||
say(json.dumps(wait_restore()))
|
||||
elif step == "delcopy":
|
||||
form("/backup/offbox/verify-copy/delete", {"stack": sys.argv[2], "confirm": "1"})
|
||||
else:
|
||||
sys.exit(f"unknown step {step}")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -0,0 +1,118 @@
|
||||
#!/usr/bin/env python3
|
||||
"""drill2.py — R-1106 proof on demo-hp 9201 (controller 0.324.0-rc.N), THROUGH THE PRODUCT.
|
||||
|
||||
Runs on DooPlex. Env: SC (0600 dir with .ctlpw), EV (evidence dir), TARGET=9201. One step per call:
|
||||
install APP deploy fresh (new generated passwords)
|
||||
seed APP TAG a marker row in the app's database (+ a file in Grimmory's books folder); TAG names it
|
||||
check APP TAG the app's state, the marker, auth errors in the app log, the DB logins with the app's env
|
||||
offsite-run „Távoli mentés most" (dumps + units + push)
|
||||
remove APP MODE MODE all = drive data + backups; keepbackups = drive data gone, backups kept;
|
||||
keepdata = drive data kept, backups kept
|
||||
restore-offsite APP full off-site restore (prepare, confirm, „Teljes visszaállítás")
|
||||
restore-onbox APP the backups page's „Visszaállítás" from the app's own unit (POST /backup/restore)
|
||||
install-kept APP install choosing „A megőrzött adataimat használom" (kept_data=use)
|
||||
Database probes run INSIDE the app's own containers with the container's own env (`docker exec … sh -c '…$VAR…'`):
|
||||
no password leaves the box or reaches this log.
|
||||
"""
|
||||
import json
|
||||
import os
|
||||
import sys
|
||||
import time
|
||||
|
||||
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
|
||||
import drill # noqa: E402
|
||||
|
||||
w = drill.w
|
||||
say = drill.say
|
||||
SUB = {"rallly": "rallly-r1106", "grimmory": "grimmory-r1106"}
|
||||
VALUES = {"grimmory": {"HDD_PATH": "/mnt/felhom-drives/hdd_1"}}
|
||||
BOOKS = "/mnt/felhom-drives/hdd_1/userdata/media/grimmory"
|
||||
|
||||
SQL = {
|
||||
"rallly": ("rallly-postgres", "psql -U rallly -d rallly -v ON_ERROR_STOP=1 -Atc"),
|
||||
"grimmory": ("grimmory-db", 'mariadb -uroot -p"$MARIADB_ROOT_PASSWORD" grimmory -N -e'),
|
||||
}
|
||||
|
||||
|
||||
def sql(app, q):
|
||||
"""The SQL goes in on STDIN (a heredoc), so no quote inside it can break the shell around it. (The first version
|
||||
passed it with `-c "…"` inside `sh -c '…'`, and the marker's own single quotes broke it — run A1, recorded.)"""
|
||||
c, cmd = SQL[app]
|
||||
cmd = cmd.replace(" -Atc", " -At").replace(" -N -e", " -N")
|
||||
return w.guest(f"docker exec -i {c} sh -c '{cmd}' 2>&1 <<'R1106SQL' | tail -3\n{q};\nR1106SQL\n").strip()
|
||||
|
||||
|
||||
def seed(app, tag):
|
||||
say(f"seed {app} {tag}: " + sql(app, f"create table if not exists r1106_marker(note varchar(80)); insert into r1106_marker values ('{tag}'); select note from r1106_marker"))
|
||||
if app == "grimmory":
|
||||
say(" file: " + w.guest(f"printf '%s\\n' '{tag}' > {BOOKS}/{tag}.txt && chown 1000:1000 {BOOKS}/{tag}.txt && sha256sum {BOOKS}/{tag}.txt").strip())
|
||||
|
||||
|
||||
def check(app, tag):
|
||||
st = w.stack(app)
|
||||
say(f"check {app}: deployed={st.get('deployed')} state={st.get('state')} hold={st.get('hold_reason')!r}")
|
||||
say(f" marker row: {sql(app, 'select note from r1106_marker')!r} (want {tag!r} present)")
|
||||
if app == "rallly":
|
||||
logs = w.guest("docker logs --since 10m rallly 2>&1 | grep -c -E 'P1000|Authentication failed' ; docker ps --filter name=^rallly$ --format '{{.Status}}'")
|
||||
say(f" rallly log auth errors (10 min) / status: {' | '.join(logs.split())}")
|
||||
say(" app login to its DB (the app's own DATABASE_URL user): " + w.guest(
|
||||
"docker exec rallly-postgres sh -c 'PGPASSWORD=\"$POSTGRES_PASSWORD\" psql -h 127.0.0.1 -U rallly -d rallly -Atc \"select 1\"' 2>&1 | tail -1").strip())
|
||||
say(" front door: " + w.guest("curl -s -o /dev/null -w '%{http_code}' --max-time 15 -H 'Host: rallly-r1106.enkisfelhom.hu' http://127.0.0.1/ 2>/dev/null; echo"))
|
||||
else:
|
||||
say(" root login (the product's dump user): " + w.guest(
|
||||
"docker exec grimmory-db sh -c 'mariadb -uroot -p\"$MARIADB_ROOT_PASSWORD\" -N -e \"select 1\"' 2>&1 | tail -1").strip())
|
||||
say(" app user login (the app's own DB user): " + w.guest(
|
||||
"docker exec grimmory-db sh -c 'mariadb -ugrimmory -p\"$MARIADB_PASSWORD\" grimmory -N -e \"select 1\"' 2>&1 | tail -1").strip())
|
||||
say(" app health: " + w.guest("docker ps --filter name=^grimmory$ --format '{{.Status}}'; docker exec grimmory wget -q -O- http://127.0.0.1:6060/api/v1/healthcheck 2>&1 | head -c 200; echo").strip())
|
||||
say(" file: " + w.guest(f"sha256sum {BOOKS}/{tag}.txt 2>&1").strip())
|
||||
|
||||
|
||||
def remove(app, mode):
|
||||
hdd = mode == "all" or mode == "keepbackups"
|
||||
bk = mode == "all"
|
||||
c1, _ = w.ctl("POST", f"/api/stacks/{app}/stop")
|
||||
for _ in range(24):
|
||||
time.sleep(5)
|
||||
if w.stack(app).get("state") != "running":
|
||||
break
|
||||
code, d = w.ctl("POST", f"/api/stacks/{app}/remove", {"remove_hdd_data": hdd, "remove_backups": bk})
|
||||
say(f"remove {app} ({mode}: remove_hdd_data={hdd}, remove_backups={bk}) -> {code} {str(d)[:200]}")
|
||||
if app == "grimmory" and hdd:
|
||||
# the household's books folder is never removed by the product (decision 67); the household deletes its file
|
||||
say(" household deletes the books-folder files: " + w.guest(f"rm -fv {BOOKS}/r1106-*.txt | wc -l").strip())
|
||||
|
||||
|
||||
def main():
|
||||
step, args = sys.argv[1], sys.argv[2:]
|
||||
w.login()
|
||||
if step == "install":
|
||||
say(f"install {args[0]}: {w.deploy(args[0], SUB[args[0]], VALUES.get(args[0]))}")
|
||||
elif step == "install-kept":
|
||||
os.environ["KEPT"] = "use"
|
||||
say(f"install {args[0]} with kept_data=use: {w.deploy(args[0], SUB[args[0]], VALUES.get(args[0]))}")
|
||||
elif step == "seed":
|
||||
seed(args[0], args[1])
|
||||
elif step == "check":
|
||||
check(args[0], args[1])
|
||||
elif step == "offsite-run":
|
||||
drill.offsite_run()
|
||||
elif step == "remove":
|
||||
remove(args[0], args[1])
|
||||
elif step == "restore-offsite":
|
||||
app = args[0]
|
||||
head, loc = drill.form("/backup/offbox/restore", {"app": app, "mode": "full"})
|
||||
drill.form("/backup/offbox/restore", {"app": app, "mode": "full", "confirm": "1"})
|
||||
say(json.dumps(drill.wait_restore(), ensure_ascii=False)[:700])
|
||||
drill.form("/backup/offbox/reconstitute", {"app": app, "confirm": "1"})
|
||||
say(json.dumps(drill.wait_restore(), ensure_ascii=False)[:900])
|
||||
elif step == "restore-onbox":
|
||||
r = w.restore(args[0])
|
||||
say("onbox restore: " + json.dumps({k: r.get(k) for k in ("ok", "snapshot_id", "http", "location", "seconds")}, ensure_ascii=False))
|
||||
c, d = w.ctl("GET", "/api/backup/restore-status")
|
||||
say(" restore-status: " + json.dumps((d or {}).get("data"), ensure_ascii=False)[:900])
|
||||
else:
|
||||
sys.exit("unknown step " + step)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -0,0 +1,20 @@
|
||||
#!/bin/bash
|
||||
# R-1106 drill, paths A (rerun with the fixed seed) and B, on demo-hp 9201. Env SC, EV, TARGET from the caller.
|
||||
E=$(cd "$(dirname "$0")/.." && pwd); D="python3 $E/tools/drill2.py"
|
||||
echo "##### PATH A2 — off-site full restore after a reinstall (seed fixed)"
|
||||
for a in rallly grimmory; do $D seed $a r1106-A2; $D check $a r1106-A2; done
|
||||
$D offsite-run
|
||||
for a in rallly grimmory; do $D remove $a all; done
|
||||
for a in rallly grimmory; do $D install $a; done
|
||||
echo "## A2 negative control after the reinstall"; for a in rallly grimmory; do $D check $a r1106-A2; done
|
||||
for a in rallly grimmory; do $D restore-offsite $a; done
|
||||
sleep 45; echo "## A2 after the off-site restore"; for a in rallly grimmory; do $D check $a r1106-A2; done
|
||||
echo "##### PATH B — on-box restore (Visszaallitas) after a reinstall"
|
||||
for a in rallly grimmory; do $D seed $a r1106-B; done
|
||||
$D offsite-run
|
||||
for a in rallly grimmory; do $D remove $a keepbackups; done
|
||||
for a in rallly grimmory; do $D install $a; done
|
||||
echo "## B negative control after the reinstall"; for a in rallly grimmory; do $D check $a r1106-B; done
|
||||
for a in rallly grimmory; do $D restore-onbox $a; done
|
||||
sleep 45; echo "## B after the on-box restore"; for a in rallly grimmory; do $D check $a r1106-B; done
|
||||
echo "##### DONE"
|
||||
@@ -0,0 +1,11 @@
|
||||
#!/bin/bash
|
||||
E=$(cd "$(dirname "$0")/.." && pwd); D="python3 $E/tools/drill2.py"
|
||||
echo "##### PATH B — on-box restore (Visszaallitas) after a reinstall"
|
||||
for a in rallly grimmory; do $D seed $a r1106-B; done
|
||||
$D offsite-run
|
||||
for a in rallly grimmory; do $D remove $a keepbackups; done
|
||||
for a in rallly grimmory; do $D install $a; done
|
||||
echo "## B negative control after the reinstall"; for a in rallly grimmory; do $D check $a r1106-B; done
|
||||
for a in rallly grimmory; do $D restore-onbox $a; done
|
||||
sleep 45; echo "## B after the on-box restore"; for a in rallly grimmory; do $D check $a r1106-B; done
|
||||
echo "##### DONE"
|
||||
@@ -0,0 +1,27 @@
|
||||
#!/bin/bash
|
||||
# R-1105 — run ONE read-only restic command against THIS box's off-site store, with the restic of a chosen controller
|
||||
# image (0.322.0 = restic 0.14.0, 0.323.0-rc.N = 0.18.1). Runs INSIDE the guest (pushed by pct). It builds the same
|
||||
# `rclone:` repo + `rclone.program` the controller builds (offboxBaseArgs, pinned transport) from settings.json, mounts
|
||||
# the controller's own volumes READ-ONLY (--volumes-from …:ro) and shares its network. It prints no host, user, path,
|
||||
# key or password. ALLOWED verbs: snapshots, restore, ls, cat config — each with --no-lock, so nothing is written to the
|
||||
# store. Usage: rx.sh <image> <restic args…>
|
||||
set -euo pipefail
|
||||
IMG="$1"; shift
|
||||
case "$1" in snapshots|restore|ls|cat) ;; *) echo "rx.sh: refusing verb '$1' (read-only verbs only)" >&2; exit 2 ;; esac
|
||||
S=/var/lib/docker/volumes/felhom-controller-data/_data/data/settings.json
|
||||
eval "$(python3 - "$S" <<'EOF'
|
||||
import json, shlex, sys
|
||||
o = json.load(open(sys.argv[1]))["offbox"]
|
||||
assert o.get("transport") == "rclone-pinned", "rx.sh handles the pinned transport only"
|
||||
d = "/opt/docker/felhom-controller/data/offbox"
|
||||
prog = (f"ssh -p {o.get('port') or 23} -oBatchMode=yes -oConnectTimeout=10 -oStrictHostKeyChecking=yes "
|
||||
f"-oUserKnownHostsFile={d}/known_hosts -oIdentitiesOnly=yes -i {d}/ssh_key {o['user']}@{o['host']} rclone")
|
||||
print("REPO=" + shlex.quote("rclone:" + o["repo_path"]))
|
||||
print("PROG=" + shlex.quote("rclone.program=" + prog))
|
||||
EOF
|
||||
)"
|
||||
mkdir -p /tmp/r1105
|
||||
exec docker run --rm --network container:felhom-controller --volumes-from felhom-controller:ro \
|
||||
-v /tmp/r1105:/tmp/r1105 -e RESTIC_PASSWORD_FILE=/opt/docker/felhom-controller/data/offbox/repo_password \
|
||||
-e RESTIC_CACHE_DIR=/tmp/r1105/cache-$(echo "$IMG" | tr -c 'a-z0-9.\n' '_') \
|
||||
--entrypoint restic "$IMG" -r "$REPO" -o "$PROG" --no-lock "$@"
|
||||
@@ -0,0 +1,54 @@
|
||||
#!/bin/bash
|
||||
# R-972 Part 4 — the LAN sharing checks, run ON DOOPLEX against demo-hp 9201's felhom-samba. Usage: sambacheck.sh <label>
|
||||
# The household SMB password is read from $SC/.smbpw (0600) into a 0600 smbclient auth file; it is never printed.
|
||||
# smbclient runs from our own felhom-samba image as a throwaway client container (--rm, host network, nothing
|
||||
# installed on DooPlex); nmblookup is DooPlex's own; the mDNS and WS-Discovery probes are plain python sockets.
|
||||
set -u
|
||||
LABEL=${1:?label}; IP=192.168.0.155; NAME=FELHOMHP; SHARE=r1105; USERNAME=felhom
|
||||
IMG=gitea.dooplex.hu/admin/felhom-samba:1.2.0
|
||||
A=$(mktemp -p "$SC"); chmod 600 "$A"; printf 'username=%s\npassword=%s\n' "$USERNAME" "$(cat "$SC/.smbpw")" > "$A"
|
||||
B=$(mktemp -p "$SC"); chmod 600 "$B"; printf 'username=%s\npassword=%s\n' "$USERNAME" "not-the-password" > "$B"
|
||||
echo "== $LABEL — $(date -u +%FT%TZ)"
|
||||
echo "-- 1. smbclient with the household password: write, list, read back, delete"
|
||||
docker run --rm --network host -v "$A":/auth:ro --entrypoint sh "$IMG" -c \
|
||||
"echo r1105-$LABEL > /tmp/probe.txt && smbclient //$IP/$SHARE -A /auth -m SMB3 -c 'put /tmp/probe.txt probe-$LABEL.txt; ls probe-*; get probe-$LABEL.txt /tmp/back.txt; rm probe-$LABEL.txt' 2>&1 | grep -vE '^\s*$|blocks of size'; echo \"read back: \$(cat /tmp/back.txt 2>/dev/null || echo NOTHING)\""
|
||||
echo "-- 2. negative control: a wrong password"
|
||||
docker run --rm --network host -v "$B":/auth:ro --entrypoint smbclient "$IMG" //$IP/$SHARE -A /auth -m SMB3 -c 'ls' 2>&1 | tail -1
|
||||
rm -f "$A" "$B"
|
||||
echo "-- 3. nmbd: NetBIOS name query from DooPlex"
|
||||
nmblookup -U $IP "$NAME" 2>&1 | tail -1
|
||||
echo "-- 4. avahi: mDNS A query for $NAME.local"
|
||||
python3 - "$NAME" <<'EOF'
|
||||
import socket, struct, sys, time
|
||||
name = sys.argv[1].lower() + ".local"
|
||||
q = struct.pack(">HHHHHH", 0, 0, 1, 0, 0, 0) + b"".join(bytes([len(p)]) + p.encode() for p in name.split(".")) + b"\0" + struct.pack(">HH", 1, 0x8001)
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(3)
|
||||
s.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_TTL, 1)
|
||||
s.sendto(q, ("224.0.0.251", 5353))
|
||||
try:
|
||||
while True:
|
||||
d, a = s.recvfrom(4096)
|
||||
if d[-4:] and len(d) > 12 and struct.unpack(">H", d[6:8])[0] > 0:
|
||||
print(f"answer from {a[0]}: {socket.inet_ntoa(d[-4:])} for {name}"); break
|
||||
except socket.timeout:
|
||||
print(f"NO mDNS answer for {name}")
|
||||
EOF
|
||||
echo "-- 5. wsdd: WS-Discovery Probe"
|
||||
python3 - <<'EOF'
|
||||
import socket, uuid
|
||||
probe = f'''<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsd="http://schemas.xmlsoap.org/ws/2005/04/discovery" xmlns:wsdp="http://schemas.xmlsoap.org/ws/2006/02/devprof"><soap:Header><wsa:To>urn:schemas-xmlsoap-org:ws:2005:04:discovery</wsa:To><wsa:Action>http://schemas.xmlsoap.org/ws/2005/04/discovery/Probe</wsa:Action><wsa:MessageID>urn:uuid:{uuid.uuid4()}</wsa:MessageID></soap:Header><soap:Body><wsd:Probe><wsd:Types>wsdp:Device</wsd:Types></wsd:Probe></soap:Body></soap:Envelope>'''
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(3)
|
||||
s.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_TTL, 1)
|
||||
s.sendto(probe.encode(), ("239.255.255.250", 3702))
|
||||
seen = []
|
||||
try:
|
||||
while True:
|
||||
d, a = s.recvfrom(65535)
|
||||
if b"ProbeMatches" in d:
|
||||
seen.append(a[0])
|
||||
except socket.timeout:
|
||||
pass
|
||||
print("ProbeMatches from:", sorted(set(seen)) or "NOBODY", "— the box (192.168.0.155) answered" if "192.168.0.155" in seen else "— the box did NOT answer")
|
||||
EOF
|
||||
echo "-- 6. processes in the samba container, and its image"
|
||||
ssh -o BatchMode=yes demo-hp "LC_ALL=C pct exec 9201 -- sh -c 'docker inspect felhom-samba --format \"{{.Config.Image}} created {{.Created}}\"; docker exec felhom-samba ps -o pid,comm,args | grep -E \"smbd|nmbd|wsdd|avahi|dbus|tini\" | grep -v grep | cut -c1-90; docker volume ls -q | grep -i samba'" 2>/dev/null
|
||||
@@ -0,0 +1,54 @@
|
||||
#!/bin/bash
|
||||
# R-972 Part 4 — the LAN sharing checks, run ON DOOPLEX against demo-hp 9201's felhom-samba. Usage: sambacheck.sh <label>
|
||||
# The household SMB password is read from $SC/.smbpw (0600) into a 0600 smbclient auth file; it is never printed.
|
||||
# smbclient runs from our own felhom-samba image as a throwaway client container (--rm, host network, nothing
|
||||
# installed on DooPlex); nmblookup is DooPlex's own; the mDNS and WS-Discovery probes are plain python sockets.
|
||||
set -u
|
||||
LABEL=${1:?label}; IP=192.168.0.155; NAME=FELHOMHP; SHARE=r1108; USERNAME=felhom
|
||||
IMG=gitea.dooplex.hu/admin/felhom-samba:1.2.0
|
||||
A=$(mktemp -p "$SC"); chmod 600 "$A"; printf 'username=%s\npassword=%s\n' "$USERNAME" "$(cat "$SC/.smbpw")" > "$A"
|
||||
B=$(mktemp -p "$SC"); chmod 600 "$B"; printf 'username=%s\npassword=%s\n' "$USERNAME" "not-the-password" > "$B"
|
||||
echo "== $LABEL — $(date -u +%FT%TZ)"
|
||||
echo "-- 1. smbclient with the household password: write, list, read back, delete"
|
||||
docker run --rm --network host -v "$A":/auth:ro --entrypoint sh "$IMG" -c \
|
||||
"echo r1105-$LABEL > /tmp/probe.txt && smbclient //$IP/$SHARE -A /auth -m SMB3 -c 'put /tmp/probe.txt probe-$LABEL.txt; ls probe-*; get probe-$LABEL.txt /tmp/back.txt; rm probe-$LABEL.txt' 2>&1 | grep -vE '^\s*$|blocks of size'; echo \"read back: \$(cat /tmp/back.txt 2>/dev/null || echo NOTHING)\""
|
||||
echo "-- 2. negative control: a wrong password"
|
||||
docker run --rm --network host -v "$B":/auth:ro --entrypoint smbclient "$IMG" //$IP/$SHARE -A /auth -m SMB3 -c 'ls' 2>&1 | tail -1
|
||||
rm -f "$A" "$B"
|
||||
echo "-- 3. nmbd: NetBIOS name query from DooPlex"
|
||||
nmblookup -U $IP "$NAME" 2>&1 | tail -1
|
||||
echo "-- 4. avahi: mDNS A query for $NAME.local"
|
||||
python3 - "$NAME" <<'EOF'
|
||||
import socket, struct, sys, time
|
||||
name = sys.argv[1].lower() + ".local"
|
||||
q = struct.pack(">HHHHHH", 0, 0, 1, 0, 0, 0) + b"".join(bytes([len(p)]) + p.encode() for p in name.split(".")) + b"\0" + struct.pack(">HH", 1, 0x8001)
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(3)
|
||||
s.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_TTL, 1)
|
||||
s.sendto(q, ("224.0.0.251", 5353))
|
||||
try:
|
||||
while True:
|
||||
d, a = s.recvfrom(4096)
|
||||
if d[-4:] and len(d) > 12 and struct.unpack(">H", d[6:8])[0] > 0:
|
||||
print(f"answer from {a[0]}: {socket.inet_ntoa(d[-4:])} for {name}"); break
|
||||
except socket.timeout:
|
||||
print(f"NO mDNS answer for {name}")
|
||||
EOF
|
||||
echo "-- 5. wsdd: WS-Discovery Probe"
|
||||
python3 - <<'EOF'
|
||||
import socket, uuid
|
||||
probe = f'''<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsd="http://schemas.xmlsoap.org/ws/2005/04/discovery" xmlns:wsdp="http://schemas.xmlsoap.org/ws/2006/02/devprof"><soap:Header><wsa:To>urn:schemas-xmlsoap-org:ws:2005:04:discovery</wsa:To><wsa:Action>http://schemas.xmlsoap.org/ws/2005/04/discovery/Probe</wsa:Action><wsa:MessageID>urn:uuid:{uuid.uuid4()}</wsa:MessageID></soap:Header><soap:Body><wsd:Probe><wsd:Types>wsdp:Device</wsd:Types></wsd:Probe></soap:Body></soap:Envelope>'''
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM); s.settimeout(3)
|
||||
s.setsockopt(socket.IPPROTO_IP, socket.IP_MULTICAST_TTL, 1)
|
||||
s.sendto(probe.encode(), ("239.255.255.250", 3702))
|
||||
seen = []
|
||||
try:
|
||||
while True:
|
||||
d, a = s.recvfrom(65535)
|
||||
if b"ProbeMatches" in d:
|
||||
seen.append(a[0])
|
||||
except socket.timeout:
|
||||
pass
|
||||
print("ProbeMatches from:", sorted(set(seen)) or "NOBODY", "— the box (192.168.0.155) answered" if "192.168.0.155" in seen else "— the box did NOT answer")
|
||||
EOF
|
||||
echo "-- 6. processes in the samba container, and its image"
|
||||
ssh -o BatchMode=yes demo-hp "LC_ALL=C pct exec 9201 -- sh -c 'docker inspect felhom-samba --format \"{{.Config.Image}} created {{.Created}}\"; docker exec felhom-samba ps -o pid,comm,args | grep -E \"smbd|nmbd|wsdd|avahi|dbus|tini\" | grep -v grep | cut -c1-90; docker volume ls -q | grep -i samba'" 2>/dev/null
|
||||
@@ -0,0 +1,22 @@
|
||||
#!/bin/bash
|
||||
# R-1107 — restic 0.19.1 vs 0.18.1 vs 0.14.0 on demo-hp's REAL store, read-only (rx.sh: --no-lock, read verbs only).
|
||||
# Runs in the guest. Each snapshot is restored by every version; the tree hashes must agree.
|
||||
set -u
|
||||
I=gitea.dooplex.hu/admin/felhom-controller
|
||||
declare -A IMG=([0.14.0]=$I:0.322.0 [0.18.1]=$I:0.323.0 [0.19.1]=$I:0.324.0-rc.1)
|
||||
for v in 0.14.0 0.18.1 0.19.1; do docker image inspect ${IMG[$v]} >/dev/null 2>&1 || docker pull -q ${IMG[$v]} >/dev/null; done
|
||||
NEW19=$(/root/rx.sh ${IMG[0.19.1]} snapshots --tag bookstack --json 2>/dev/null | python3 -c 'import json,sys; s=[x for x in json.load(sys.stdin) if x.get("program_version","").startswith("restic 0.19")]; print(s[-1]["short_id"] if s else "")')
|
||||
echo "snapshots: 0.14.0-made f3f16e0e (bookstack), 0.18.1-made 6d9dd607 (rallly), 0.19.1-made $NEW19 (bookstack, newest)"
|
||||
for snap in f3f16e0e 6d9dd607 $NEW19; do
|
||||
line="$snap:"
|
||||
for v in 0.14.0 0.18.1 0.19.1; do
|
||||
d=/tmp/r1105/x-$snap-$v; rm -rf $d
|
||||
if /root/rx.sh ${IMG[$v]} restore $snap --target $d >/dev/null 2>&1; then
|
||||
h=$(cd $d && find . -type f -exec sha256sum {} + | sort -k2 | sha256sum | cut -c1-16); n=$(find $d -type f | wc -l)
|
||||
line="$line restic $v → $h ($n files)"
|
||||
else line="$line restic $v → FAILED"; fi
|
||||
rm -rf $d
|
||||
done
|
||||
echo "$line"
|
||||
done
|
||||
echo "store listed by each: $(for v in 0.14.0 0.18.1 0.19.1; do printf '%s=%s ' $v $(/root/rx.sh ${IMG[$v]} snapshots --json 2>/dev/null | python3 -c 'import json,sys;print(len(json.load(sys.stdin)))'); done)"
|
||||
@@ -26,6 +26,19 @@
|
||||
|
||||
---
|
||||
|
||||
## 2026-10-17 — night: restore after a reinstall, restic 0.19.1, hardening (controller v0.324.0, catalog `af75dc0`)
|
||||
|
||||
| Row | What | Closed | Evidence |
|
||||
|---|---|---|---|
|
||||
| **R-1065** | **After the Plex claim the box does not set Plex's libraries until the next wiring run.** (P3) | CLOSED 2026-10-17 — **controller v0.324.0**: a successful Plex claim schedules the media wiring (`RunMediaWiringSoon`, both claim routes). `TestPlexClaim_TriggersMediaWiring` (claimed / refused / never claimed), red-proved. Not seen live: no claim code tonight; the N100's next claim is the live observation. | `audits/night-restore-2026-10-17/` |
|
||||
| **R-926** | **After a household removes an `after_install` app keeping its backups and then restores it, nobody has checked whether the app page still shows a password that works.** (P3) | CLOSED 2026-10-17 — answered from the code and fixed where it was wrong. After a unit restore that had to GENERATE a `type: password` login, the page never shows it and says to use the old password (R-694's `RestoredLogins`) — the household's own password works (measured for grocy 2026-10-10). The path that was wrong: an off-site restore over a reinstall kept the reinstall's admin login as „the login”; since **controller v0.324.0** `SetStackSecretValues` records those as restored-login fields too (`TestR1106_SetStackSecretValues`, red-proved). | `audits/night-restore-2026-10-17/` |
|
||||
| **R-1106** | **An app with a database that is removed, reinstalled and then fully restored from the off-site copy comes back unusable: the restore puts back the OLD database volume, which carries the old install's database password, while the reinstall generated a new one.** (P2) | CLOSED 2026-10-17 — **controller v0.324.0** (operator decision 1A): the database password comes back with the data. The off-site full restore over a reinstall writes the snapshot's password before the database starts (only when the snapshot replays the DB volume); the shared unit-restore env refuses, before any change, when neither the unit nor an install OLDER than the data holds it; O4 never generates a DB password. **Live on demo-hp 9201** (rc.1, the dashboard's posts): Rallly (Postgres) and Grimmory (MariaDB) seeded, removed, reinstalled, restored — off-site path: marker row + books file back, both apps healthy, the app's and the dump user's DB logins work (last night: crash loop and held); on-box path (Rallly) the same; the refusal (Rallly unit without its password) refused with the app untouched; „use my kept data” (Grimmory) the same. Tests `TestR1106_*` red-proved; catalog gate `db-credentials`. `07` §7.4. | `audits/night-restore-2026-10-17/` |
|
||||
| **R-127** | **The catalog's `data_key: true` flag is UNRELIABLE — at least four data-encrypting keys the catalog itself labels as encryption keys are unflagged; and the O4 restore path can regenerate a DB password that then does not match the restored data directory** (P3) | CLOSED 2026-10-17 — leg (a) was pushed 2026-10-06 (catalog `c265b37`); leg (b) is decided (operator decision 1A) and built in **controller v0.324.0** with R-1106: a database password is never regenerated for restored data, the unit's value wins, a restore without it is refused before any change. 20 DB credential fields in 17 apps (the 18 counted here plus apps added since), all `type: secret`, gated by `db-credentials`. | `audits/night-restore-2026-10-17/` |
|
||||
| **R-1108** | **A share added while sharing is on but the household password is not yet set is not exported once the password is set, if the samba container was already running: `SetSMBPassword` rewrites `smb.conf` and the compose file but starts the stack only when it is NOT running, and the next reconcile sees „unchanged + running" and does nothing.** (P4) | CLOSED 2026-10-17 — **controller v0.324.0**: `SetSMBPassword` applies changed files when the stack is already running. `TestSambaPassword_ShareAddedBeforePasswordIsApplied` + companion, red-proved. Live on demo-hp: a share added before the password was set, reached with `smbclient` from DooPlex (the exact „first password failed” order needs a box that never had a password — that order rests on the test). | `audits/night-restore-2026-10-17/` |
|
||||
| **R-983** | **Seven small dashboard weaknesses: after sign-in the browser can be sent to another site; the server-reboot route acts on a GET, so a link can reboot the guest (** (P3) | CLOSED 2026-10-17 — the six remaining items in **controller v0.324.0**, one red-proved test each (`TestR983_*`): sign-in `next` stays on the box; `X-Frame-Options: DENY` + `frame-ancestors 'none'`; a try is counted before the password check (dashboard and family gate); settings password minimum = the claim's 12; reset-code requests limited (1 per visitor per minute, 3 per box per 15 min); logout is POST + CSRF (dashboard, family gate — the dashboard's sign-out link had done nothing since 2026-02-25). Headless Chrome on demo-hp's public address: sign in, headers, POST sign-out, sign in again. Remaining limiters → R-1111. | `audits/night-restore-2026-10-17/` |
|
||||
| **R-976** | **A family member's session can be copied out of a family-gated app, and a dashboard password reset does not end family or gate sessions; so a stolen session keeps working for up to 30 days.** (P3) | CLOSED 2026-10-17 — **controller v0.324.0**: a password change or reset ends every dashboard, family and setup-gate session (the gate key rotated and saved); a family app cookie carries a per-app HMAC token, never the session. `TestR976_*` red-proved (a restart check included). Headless Chrome on demo-hp: the family-gated Grimmory and the setup-gated Rallly open for the household. Raw storage → R-1112; growth → R-1113. | `audits/night-restore-2026-10-17/` |
|
||||
| **R-1017** | **A comment names a guard test that does not exist.** (P3) | CLOSED 2026-10-17 — the guard exists: `TestNoBareDrivePathToUserdataDir` (parses every non-test Go file; one listed exception), red-proved four ways. It found a real one: the remove dialog's „kept folders” list was empty on the system-drive fallback (`delete.go` `userdataKept`) — fixed in **controller v0.324.0**, `TestRemoveStack_R800_UserdataKeptOnSystemDrive`. Sibling helpers → R-1110. | `audits/night-restore-2026-10-17/` |
|
||||
|
||||
## 2026-10-16 — burndown 2 (controller v0.322.0)
|
||||
|
||||
| Row | What | Closed | Evidence |
|
||||
|
||||
@@ -124,7 +124,7 @@ stopping line that lies.
|
||||
| **R-494** | Install & onboarding | P4 | **NARROWED 2026-09-14 by operator ruling → [P3-LOW] the hub COULD create the tunnel at customer creation, for a domain already on Cloudflare. Not blocking: every customer has their own domain and the operator creates the tunnel per day-0 A.1 (`architecture/01-topology-and-trust.md`).** *Original finding, kept:* **[P1-HIGH] A new customer's dashboard has NO reachable address unless the operator hand-makes a Cloudflare tunnel — the link in the setup-code mail is dead.** MEASURED 2026-09-14 on a fresh install from the public ISO (drill intervention **I1**): the claim mail points at `https://felhom.drill0242.felhom.eu`; that name has **no A and no AAAA** record (`dig @1.1.1.1`, control `felhom.enkisfelhom.hu` resolves); the hub has **no tunnel- or DNS-creation code** (`hub/internal/cloudflare/` holds only geo-rule removal; `cf_tunnel_token` is a pasted, optional form field, `configs.go:1478`) — day-0 runbook A.1 makes it a manual Cloudflare-dashboard step that nothing on the customer-create page asks for; the box's own split-horizon resolver on the appliance LAN IP answered `google.com` but not the dashboard name at 13:27:39Z; the agent applied the record at **13:27:44Z** (`lanresolver: applied split-horizon record … ip=192.168.0.158`, 3 m 46 s after the controller started), so the box CAN answer the name — **but only to a device that uses the box as its DNS server, and no document, screen or mail tells a household to do that**; the router and the installer-offered DNS answer nothing. The page was reachable only at the guest's LAN address with the name forced (`curl --resolve …:443:192.168.0.158`). **A volunteer could not have done that.** **What it needs:** an operator ruling — the hub creates the tunnel and DNS at customer creation, or the product gives a household a LAN address that works with no DNS change. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: operator-side automation; the operator creates the tunnel by hand per the day-0 runbook.** | — | — | CC |
|
||||
| **R-504** | Install & onboarding | P4 | **[P3-LOW] `iso.felhom.eu` cannot show an index page on its own — its root returns 404, and the download page lives on the website instead.** MEASURED 2026-09-14: `https://iso.felhom.eu/` and `/index.html` → 404; only named objects answer. The host is an R2 bucket behind a custom domain; whether R2 would serve an uploaded `index.html` at `/` was **not measured** (uploading anything to the public bucket is a publication). The ISO v1.27.0 task puts the Hungarian download page at `felhom.eu/letoltes` (published with the ISO, after the operator's yes). **Remaining:** a redirect from `iso.felhom.eu/` to that page needs a Cloudflare rule the session has no credential for. | **WAITING-ON-OPERATOR — rank P3-LOW; owner: operator (Cloudflare rule)** **Re-ranked 2026-10-03: P3→P4: households are sent to the website's download page; the bare address is cosmetic.** | — | — | operator |
|
||||
|
||||
## Apps & catalog — 22 rows (P2 1, P3 12, P4 9)
|
||||
## Apps & catalog — 20 rows (P2 1, P3 11, P4 8)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
@@ -138,7 +138,6 @@ stopping line that lies.
|
||||
| **R-1028** | Apps & catalog | P3 | **Plex's claim code can run out during the install, and the box cannot recover it.** plex.tv's code lives 4 minutes from the moment the household copies it; the clock covers the wizard, the image pull (`plexinc/pms-docker` is 351 MB, measured) and the first start. Plex reads `PLEX_CLAIM` only on its first run, and the field is `locked_after_deploy` — so a late code leaves an unclaimed server and the only way back is remove + install again. Reported by the operator during the 2026-10-14 test; on Tester 1's line the pull+start took 8.5 s and the claim worked (`audits/media-all-drives-2026-10-14/``G-auth/G3-plex-claim.txt`), so it bites on a slow line or a slow hand. **K6, 2026-10-14 night (`audits/media-drive-events-2026-10-14/``K6-1-unclaimed-plex.txt`):** an unclaimed Plex starts with no code at all, and `POST /myplex/claim?token=` on the RUNNING server reaches plex.tv (a wrong code → 500 after plex.tv's 401). So the box can pull + start first and ask for the code after: no race. A real claim needs the household's code — the morning step on the throwaway `plex-k6` on Tester 1. Narrowed 2026-10-14 night. **PROVEN 2026-10-15 morning (`K6-2-claim-after-start.txt`):** the operator's real code, given to the RUNNING unclaimed `plex-k6` → 200, `claimed` 0→1, `PlexOnlineToken` written, and the open door closed (no token → 401). `ADVERTISE_IP` was unset and the claim did not need it; whether clients find the server without it was not measurable (the throwaway had no published port). **BUILT 2026-10-15 (v0.313.0):** `after_start` field — not asked at install; the Plex page asks for the code once Plex runs and claims the running server; the gate opens only when Plex says claimed. Proven up to the code on 9201 (G5). | **NARROWED** — the dashboard claim with a real code is the last step | a household Plex code | Claim through the Plex page with a real code (G5c); then close | CC |
|
||||
| **R-1029** | Apps & catalog | P3 | **Plex's folder picker shows the drives as identical „media” folders.** With one bind per drive at the same path (`/mnt/felhom-drives/<drive>/userdata/media`), the leaf of every library folder is `media`; the drive's name sits two levels up, so in Plex's picker the household sees several folders all called „media” (reported by the operator during the 2026-10-14 test on Tester 1). It conflicts with `15` §2 reason 2 (the same path everywhere). | **READY** — filed 2026-10-14 | the layout decision (STATUS D9) | Decide in `15` §2: the players (`:ro`, never linked) may get a readable path per drive (e.g. `/media/<drive label>`) without breaking the hardlink rule, which binds only the download/library apps | CC |
|
||||
| **R-1036** | Apps & catalog | P3 | **The apps page lags the catalog by two apps.** `app-catalog-felhom.eu/templates/` holds **64** apps; `/alkalmazasok` and `/en/apps` render **63** cards, one of which (`filebrowser`) is built in and not a catalog template — so **62 catalog apps are listed**. Missing: **`plant-it`** and **`wger`**, both in the catalog since 2026-10-06/08. Their website assets are ALREADY present (`plant-it-logo.svg` + 3 screenshots, `wger-logo.png` + 3 screenshots, renamed to the catalog slug by `a3507761`, 2026-10-08) — only the cards were never written, so this is not a new-asset job. Found 2026-10-14 while reconciling the app count for the „felhő tárhely” page, where four places said **60** and the rest said **62**. **Done in that session:** every stated count on the site set to **62** (`index.html`, `szolgaltatasok.html`, `en/services.html` were 60), which is what the apps page actually shows — so no visitor can count the cards and find the number wrong. **62 is still not the catalog's number.** **To close:** write the two cards on both apps pages (gate 15 keeps the two pages' app sets equal, so they move together), then raise every stated count 62 → 64 in the same commit. **The operator chose this split at the 2026-10-14 STOP** over doing it inside the SEO change. **2026-10-15 (R-1048):** Prowlarr's card added on both pages and every stated count 62 → 63 (the media group 19 → 20), so the site still states what it shows; the two owed cards would make it 65. **Note before writing them:** `wger` is `lifecycle: hidden` and `plant-it` `lifecycle: abandoned` — neither is offered for a new install, so a card would advertise an app the wizard refuses. | **OPEN** | — | write the `plant-it` + `wger` cards on both apps pages, then 62 → 64 everywhere, one commit | CC |
|
||||
| **R-1065** | Apps & catalog | P3 | **After the Plex claim the box does not set Plex's libraries until the next wiring run.** The claim handler (`felhom-controller` `internal/web/media_events.go` `appPlexClaimHandler`) opens the gate when Plex says claimed and returns; the wiring runs only when a `media_library` app comes up, on a drive event, or on „Bekötés most". Plex's own install ran it while Plex was unclaimed (`plex=household(0)`), so a freshly claimed Plex has no libraries until one of those happens — the shape of R-1058. Read from code 2026-10-15; to be measured on the N100 when the operator claims Plex (the sheet asks for „Bekötés most" only if no library appears). | **OPEN** — filed 2026-10-15 | — | Run the wiring (RunMediaWiringSoon) after a successful claim; a test; measure on the N100's claim | CC |
|
||||
| **R-1071** | Apps & catalog | P3 | **Jellyfin cannot use films that sit on a NAS share (the pilot's OMV), and the pilot's wish is exactly that.** MEASURED 2026-10-15: an OMV SMB share added as „Hálózati tárhely” mounts and verifies (`/mnt/felhom-drives/omv-filmek`) — but only with a user name AND a WRITABLE share (read-only → refused „az alkalmazások nem tudnak rá írni”) — and the household's „Újraindítás most” binds only local drives into Jellyfin (`per-drive binds 1 [/mnt/felhom-drives/filmlemez/userdata/media]`). By design: R-108 (a NAS is browse-only, never an app's namespace); `media_library.go` skips `Kind == "network"`. A design decision, not a defect (R-370). Evidence: `audits/omv-vm-2026-10-15/B6-omv-share.txt`. | WAITING-ON-OPERATOR | Operator: should a media app read a NAS share read-only (a new bind kind), or is the answer „put the films on a drive the box owns”? | Operator rules; if yes, a design note in `15-media-library.md` first. | Operator |
|
||||
| **R-76** | Apps & catalog | P4 | **FileBrowser-created folders break the setgid chain, and a drop-zone's mode is not stable** **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-26, size S, roadmap state `idea (surfaced by the R-75 spike, 2026-07-26)`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** **2026-10-06 night: not a catalog fix** — the setgid chain is set by the controller's FileBrowser setup; a controller row. | — | Two related findings from `audits/SPIKE-catalog-data-paths-2026-07-26.md` P3/P5, both **pre-existing** and deliberately left alone by that spike. **(a)** FileBrowser Quantum 1.3.3 creates files `0644` and folders `0755` and does **not** propagate the setgid bit — even though the entrypoint wrapper's `umask 002` really is in effect (`/proc/1/status` `Umask: 0002`). Group inheritance itself works (a file uploaded into a 2775 group-100 dir landed group 100, not the process gid 1000), so the convention's *group* half holds and only its *mode* half is lost. The consequence is proven with a control: inside a UI-created `0755` folder a gid-1000 process's file landed group **1000**, while the identical write into the 2775 parent landed group **100**. So **any folder a customer creates through FileBrowser breaks the shared-group chain one level down.** Latent today — every userdata-touching catalog app that declares an identity declares uid/gid **1000**, the same uid FileBrowser runs as, so owner permissions mask it; it bites the day a content app runs as a different non-root uid with gid 1000. The comment at `infra/infra.go:156` is right that the image ignores `-e UMASK` but does not say t | CC |
|
||||
| **R-707** | Apps & catalog | P4 | **[P2] 37 apps still start with a login a stranger can take (`09` §3 decision 45).** Audit of all 53 apps: `app-catalog-felhom.eu/FIRST-ADMIN.md` (class, fix route, status, measured or read). Open: **3 hard-coded defaults** — calibre-web (`admin / admin123`, measured working on demo-hp and 9202; its own `cps.py -s` route needs a generated password WITH a special character — our generator is letters+digits, a controller change), mealie (`changeme@example.com / MyPassword`), wger (`admin / adminadmin`); **34 open first-run screens** (the first visitor creates the admin: actualbudget, adventurelog, audiobookshelf, calcom, docmost, emby, ghost, gitea, gramps-web, home-assistant, homebox, immich, jellyfin, komga, n8n, navidrome, opengist, outline, papra, plant-it, radarr, rallly, recipe-importer, romm, seerr, sonarr, sparkyfitness, tandoor, termix, uptime-kuma, vikunja, wanderer, wishlist, zipline). **Stale notes:** romm's `default_creds` `admin / admin` answers 401 on demo-hp (like a wrong password) — the page now warns with a login that does not exist; zipline's looks stale too. **Measured on demo-hp 2026-09-28 (read-only):** bookstack's default still logs in on the INSTALLED app (the fix is for new installs; the page now warns). Each fix: route (a) env or (b) the app's own CLI/API via `after_install:`, proven on 9202 with the default failing and the generated password working; route (c) a page sentence. Several sessions (operator, 2026-09-28). **2026-09-29 (controller v0.280.0, catalog `d0e7e2e`):** every class-3 app fixed — mealie, wger, calibre-web by `after_install` (calibre-web with the new `password:24:special`), proven on 9202 fresh installs (`audits/login-gate-2026-09-29/D/`); the setup gate (decision 46, spike PASSED) built and live on immich, n8n, audiobookshelf (probes measured) and uptime-kuma (button) (`…/C/`); romm's and zipline's stale notes removed. **Left: 30 class-4 apps** — gate each (probe measured on 9202 where one exists — 11 upstream candidates listed in `…/B/B-VERDICT.md` §3; the button otherwise). **2026-09-29 afternoon (controller v0.281.0, catalog `6faf432`):** 28 more class-4 apps gated — 32 of 34 — each proven on 9202 (`audits/gate-rollout-2026-09-29/`B): stranger → gate page / 401, household reached the first-setup screen, the gate opened (9 by a measured probe, the rest by the press), the app answered after. seerr, outline, rallly: gated, their opening needs a media server / e-mail (not proven). **Left:** wanderer (R-714); plant-it is not installable. | **NARROWED** (2026-10-03 triage: the row's verdict was finished, but it names open work no other row carries — seerr, outline and rallly are gated, but the gate OPENING is not proven (needs a media server / e-mail)) — **CLOSED — 2026-09-29 (the rest → R-714)** | — | — | CC |
|
||||
@@ -146,7 +145,7 @@ stopping line that lies.
|
||||
| **R-995** | Apps & catalog | P4 | **Removing an app through the product can leave unnamed Docker volumes and an empty import folder behind.** MEASURED 2026-10-13 on demo-felhom after 61 removals (`documentation/audits/sizing-2026-10-13/METHOD.md` „Teardown”, `evidence/leftover-volumes-after-bench.txt`): 8 unnamed volumes (4–72 KB; immich 1, romm 2, privatebin 3, onlyoffice 2 — volumes the images declare themselves) and `userdata/import/{paperless,calibre,grimmory}` (empty, created by the deploy). The removal answered 200 and its own leftover check was clean, because it looks only at labelled volumes. No data risk; disk and tidiness only. Removed by name on the bench. | **READY** — filed 2026-10-13 | — | Make the removal account for the containers' unnamed volumes (and an empty import folder it created), with a test that deploys an image that declares a VOLUME | CC |
|
||||
| **R-1067** | Apps & catalog | P4 | **The catalog still carries `pi_compatible:` on every template, and nothing reads it any more.** controller v0.315.0 removed the „Pi kompatibilis" badge and the „csak x86" tag from every page (Raspberry Pi is no longer supported, so one was noise and the other was a warning on almost every app). The `ResourceHints.PiCompatible` struct field and the catalog key were deliberately LEFT: a box still on 0.314.0 reads the key, and removing it would make that box show „csak x86" on every app. **Gated on the floor:** once the fleet floor is at or above 0.315.0, drop `pi_compatible:` from the templates and the field from `stacks.ResourceHints` in the same pair of commits. Harmless until then — an unread key costs nothing. | **BLOCKED** — filed 2026-10-15. Checked 2026-10-16 (apps burndown): the floor is 0.321.0 and demo-hp, Tester 1 and the N100 run 0.321.0, but **Tester-2 still reports 0.292.0** (its newest report 2026-10-04; hub DB with WAL) — so nothing removed. | every box on ≥ 0.315.0 — today Tester-2 | Drop the catalog key and the struct field; grep the hub and the website for Pi wording at the same time (none found 2026-10-15) | CC |
|
||||
| **R-1043** | Apps & catalog | P4 | **Sonarr, Radarr and Prowlarr build their login redirect as an absolute `http://` URL.** They trust forwarded headers only from their „Trusted networks” (the household set `192.168.0.0/24`; traefik is `172.18.x`), so they ignore `X-Forwarded-Proto: https` and answer `Location: http://<name>/login` to an https visitor. Since controller v0.312.0 that hop is sent back to https by traefik (a GET, no password), so it is cosmetic; a template could seed traefik's network as trusted. (`audits/https-only-2026-10-14/``1A-3-4.txt`) | **OPEN** — filed 2026-10-14 | — | Seed the docker network as a trusted proxy in the *arr templates (with the R-1030 seed), measure the redirect | CC |
|
||||
| **R-1096** | Apps & catalog | P3 | **After a disk-full, an app's damaged Redis file keeps the app down for good, and nothing says what to do.** FOUND 2026-10-16 on demo-hp 9201: the standing RomM (installed 2026-08-21) was stopped; the dashboard's Start re-created it, `romm-redis` crash-looped (unhealthy), the box stopped it again (`crash_loop`, `09` §3 decision 28) and mailed `app_start_failed`. Its Redis volume dates from the 2026-09-24 thin-pool fill (R-672): Docmost's damaged append-only file was repaired by hand that day with `redis-check-aof --fix` (`audits/r672-2026-09-24/B7-redis-aof-fix.txt`); RomM's was not (the copy `romm_romm_redis_data.pre-aof-fix-20260924T135937Z` is still on the box). The Redis log was not read: the box removed the containers first. That RomM was then removed by operator ruling (`audits/romm-ghost-2026-10-16/A1/`). | OPEN — filed 2026-10-16 | — | List the catalog apps whose Redis runs with `--appendonly yes` (romm does); for each, decide whether its Redis needs persistence at all; reproduce on 9202 by damaging an append-only file, and make the box repair a copy or say what to do | CC |
|
||||
| **R-1096** | Apps & catalog | P3 | **After a disk-full, an app's damaged Redis file keeps the app down for good, and nothing says what to do.** FOUND 2026-10-16 on demo-hp 9201: the standing RomM (installed 2026-08-21) was stopped; the dashboard's Start re-created it, `romm-redis` crash-looped (unhealthy), the box stopped it again (`crash_loop`, `09` §3 decision 28) and mailed `app_start_failed`. Its Redis volume dates from the 2026-09-24 thin-pool fill (R-672): Docmost's damaged append-only file was repaired by hand that day with `redis-check-aof --fix` (`audits/r672-2026-09-24/B7-redis-aof-fix.txt`); RomM's was not (the copy `romm_romm_redis_data.pre-aof-fix-20260924T135937Z` is still on the box). The Redis log was not read: the box removed the containers first. That RomM was then removed by operator ruling (`audits/romm-ghost-2026-10-16/A1/`). | **READY** — 2026-10-17 night: researched, NOT changed (`audits/night-restore-2026-10-17/P6/redis-persistence.md`). Seven Redis services: romm, docmost, paperless-ngx, immich, nextcloud run append-only (AOF) — a file damaged in the middle stops Redis until `redis-check-aof --fix`; outline and dawarich run RDB snapshots, which a full disk cannot damage. Proposed: AOF → RDB for romm/docmost/paperless (queues + sessions), OFF (tmpfs) for immich/nextcloud (upstream runs them without a volume). Not edited unattended: the same lines sit in 7 ladder step files, a removed volume orphans on installed boxes, and keeping data across AOF → RDB is unproven. **Correction:** RomM's AOF WAS repaired on 2026-09-24 (`audits/r672-2026-09-24/B7-redis-aof-fix.txt`); the 2026-10-16 crash loop has no proven cause (its Redis log was never read). | — | Prove AOF → RDB keeps data on 9202 (and reproduce a damaged AOF there); decide the step-file rule; then the template change | CC |
|
||||
| **R-1100** | Apps & catalog | P3 | **One sign-in for the dashboard and FileBrowser (proxy auth) — spike first.** Since controller 0.320.0 every app with a folder has „Fájlok ↗", and the box can show FileBrowser's password — but FileBrowser still asks for its OWN login the first time, so the household signs in twice. FileBrowser Quantum has a proxy-auth method (`auth.methods.proxyAuth`, header-trusted) that could take the dashboard session through traefik; nobody has measured it. Design: `architecture/02-controller-module-map.md` „Logins and folders". | OPEN — filed 2026-10-16 (task logins-folders). | — | Spike on demo-hp: proxy auth at the pinned tag (source + measured), a forwardAuth in traefik that answers only for a dashboard session, what a stranger reaching `files.<domain>` with a forged header gets, and what happens to FileBrowser's shares. | CC |
|
||||
| **R-1099** | Apps & catalog | P4 | **The N100 may hold RomM games in the old upload place, now shown under a fake „roms” platform.** Until 2026-10-16 RomM's own upload wrote to the drive's `roms/roms/<platform>/`; after the mapping fix (catalog `fb18471`, R-1089) those files are at RomM's `library/roms/roms/…`. Measured on 9201: such a game showed as missing in its platform and again under a platform „roms” (`audits/romm-ghost-2026-10-16/B/b-after.txt`). Files put in with the file manager are not affected — they are now found. The N100 runs RomM (hub `/apps/romm`); CC does not log in to the lived-in box. | OPEN — filed 2026-10-16 | Operator: look at `roms/roms/` on the N100's drive in the file manager | If it holds platform folders: move them up one level into `roms/`, then run „Scan” in RomM; if it is empty, close | Operator |
|
||||
|
||||
@@ -160,21 +159,18 @@ stopping line that lies.
|
||||
| **R-683** | App updates | P3 | **[P3-LOW] Watch: after a power cut during an update's health check, the hold named an HOUR-OLD second-drive copy, not the one the update's own backup should have just made.** 2026-09-24 chaos round 3 (nextcloud, `backup_max_age: 1m`): no `backing-up` phase was seen and the hold named Tier 2 at 13:04 for an update pressed at 14:04; the pre-cut controller log was lost with the container (the runner now saves it at arm time — R-320). Round 11, the same action without a power cut, named a fresh 14:34 copy and logged the Tier-2 copy. The sentence was TRUE (it named the copy it offered); the question is why the update did not back up first. Not reproduced; watch the next power-cut drill. `audits/night-2026-09-24/E/round-03*.json`, `E/round-11-controller-pre.log` | **OPEN — P3; owner: CC (watch)** | — | — | CC |
|
||||
| **R-785** | App updates | P3 | **[P3-LOW] SparkyFitness is pinned 11 releases and a major behind upstream (v0.17.3; upstream v1.7.3, v1.6.0 dated 2026-07-24).** READ 2026-10-01 (`audits/visitors-2026-10-01/C/bench/C1-previous-tag.txt`). **Needs:** an update walk 0.17 → 1.x through the ladder (bench + box), after R-784 is decided. | **OPEN — rank P3-LOW; owner: CC (after R-784)** | — | — | CC |
|
||||
|
||||
## Backup & restore — 32 rows (P2 4, P3 17, P4 11)
|
||||
## Backup & restore — 29 rows (P2 3, P3 15, P4 11)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| **R-1012** | Backup & restore | P3 | **A full host root can leave an orphan thin snapshot in the LVM pool that LVM no longer knows; from then on every whole-guest backup of that guest fails at the snapshot step („Creation of new snapshot 4 of device 2 failed"), and nothing in the product finds or names the cause.** Made on demo-hp 2026-10-14 by this session's C4 test (the root filled while vzdump snapshotted; LVM could not write its metadata): `thin_ls --metadata-snap` shows device 4 (19 GiB, a snapshot of 9201's data disk), LVM only 1 and 2 (`audits/power-cut-fixes-2026-10-14/E/thin-ls.txt`). R-1006's cleanup keeps the root from filling; this row is the repair and the detection. | **OPEN** — filed 2026-10-14; **repaired on demo-hp 2026-10-14 12:02 UTC** (operator „B2 - A"): `dmsetup message pve-data-tpool 0 "delete 4"`, then thin_ls and LVM agree on devices 1 and 2, and the next backup (12:10, after a real power cut) made its snapshot and finished (`audits/power-cut-fixes-2026-10-14/E/repair.txt`, `E/next-backup.txt`). What is left is the detection. 2026-10-14: P2 → P3 — the cause (a full host root) is what agent v0.156.1's leftover cleanup now prevents | — | CC: a check that compares the pool's thin ids with LVM's and names an orphan in the backup failure | CC |
|
||||
| **R-978** | Backup & restore | P3 | **Starting the escrow ceremony again can make the customer's written-down recovery code useless: the new package replaces the old one before the new code is confirmed.** It can happen to an ordinary customer who starts and walks away. Fix: keep the previous package until the new code is confirmed. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Fix in the agent with a test | CC |
|
||||
| **R-973** | Backup & restore | P3 | **A compromised controller can make the whole-guest backup run again and again, and each run prunes older restore points: the local tier directly, and the off-site tier through the store's own nightly keep-last-2.** So `07` §8 row 10 (ransomware) is weaker than it reads. The second reader confirmed the local half; the off-site half is inferred. Fix: a cadence or daily cap on the local-API backup route, and off-site snapshots that a nightly prune cannot remove. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Add the cap with a test; decide the off-site retention shape | CC |
|
||||
| **R-926** | Backup & restore | P3 | **After a household removes an `after_install` app keeping its backups and then restores it, nobody has checked whether the app page still shows a password that works.** A `type: password` deploy field is NOT in `stacks.PortableSecretEnvVars` (that list is `type: secret` only, `deploy.go:1199`), so it does not travel in the backup unit — the same shape as R-765, where Radicale's restored login was replaced by a value no page showed and every phone lost its calendar. MEASURED on 9202 2026-10-10 for grocy: remove keeping the backups, restore, and **the household's own password still signs in and the seeded data reads back** — so the DATABASE half is right. What was NOT settled is the PAGE half: `app.yaml` holds the value encrypted at rest, so reading it proves nothing (a 76-character string that of course did not sign in), and `POST /apps/grocy/initial-credentials/reveal` answered 404 for this app. Seven apps are in the same class: bookstack, calibre-web, claper, dawarich, grocy, mealie, wger. | **OPEN — the question is unanswered, not the answer bad** | — | Ask the controller what the app page renders for a generated `type: password` after a restore (one endpoint read, one app), and if it differs from the one that works, decide: carry the value in the unit, or re-run `after_install` after a restore | CC |
|
||||
| **R-232** | Backup & restore | P2 | **DooPlex's backup makes every copy inside the same box — and nothing tells anyone when it fails.** Surveyed read-only 2026-08-06 (`audits/RECON-dooplex-backup-2026-08-06.md`). **What works:** five sets, 14/14 successful runs in 14 days; a file was restored from the `data` repo and matched the live original **byte for byte**; every set except two is cross-disk; k3s is integrity-checked on every run. **What the matrix exposes, ranked:** (a) **`notify_failure` is a no-op** — `NOTIFY_ON_FAILURE=true` but `NOTIFY_WEBHOOK_URL` is commented out, so a failed backup notifies **nobody**; the project already has a working Resend path that CI uses. Cheapest item, and it makes every other failure visible. (b) **Nothing leaves the box** — no rclone, no remote repo, no off-site target anywhere; Longhorn's target is `nfs://192.168.0.180:` pointing at DooPlex itself, and the only outbound-looking cron pulls *inbound* from Hetzner for a different project. The machine that runs the hub managing the customers' off-site chain has no off-site copy of its own. (c) **The backup tree is a single writable path** and the restic repos are not append-only — one bad script or ransomware destroys every copy at once. (d) **Two same-disk sets**: `.claude-memory` and the PostgreSQL dumps, whose source directory sits *inside* the backup tree. (e) **Longhorn `retain=1`** — one generation per volume, so a corruption noticed a day late has no earlier copy. (f) **`/opt/backup/docs/BACKUP-RESTORE.md` does not exist** though the systemd unit advertises it. (g) **`secrets/restic-repo` has never held a snapshot** — `backup-secrets.sh` contains no `restic` call; the secrets are GPG files on `sda1` only. (h) **No restore has ever been run** beyond today's single-file probe — the matrix's "ever demonstrated?" column is otherwise entirely empty. **Not a finding:** the restic passphrase. The on-box copy is on `sdb1`, a different disk from the backups, and the **operator holds an offline copy out of band** — so a disk loss is recoverable. The narrow residual is that it is operator-held rather than system-held, unlike the customer case's hub-vaulted escrow, so it should be confirmed current and findable by someone else. **Nothing was changed by the recon.** | **NARROWED 2026-10-08 — owner Viktor.** (a) DONE with the operator's yes in chat: `notify_failure` now mails admin@felhom.eu through Resend; proven by one test mail that reached the inbox (`audits/day-2026-10-08/r232/`; no backup was started). (b) partly: the hub database leaves DooPlex nightly to ep0 (R-173); everything else stays on the box. (c)–(h) unchanged. **2026-10-09 (operator yes in chat): (b) and (h) DONE for Gitea and the secrets.** Nightly 00:20 `felhom-dooplex-offsite` pushes Gitea (614 MB of repositories, the `gitea` database dump taken first, `app.ini`) and the nightly GPG secrets export, encrypted with a NEW key, to ep0 `operator` (`host/dooplex-gitea`) on the hub-DB write-only token — no change on ep0; first push 57 s; restore test weekly (manifest, `git fsck` every repo, `pg_restore --list`), run once: 27 805 files, 10 repos OK; `DooplexGiteaOffsiteStale`/`DooplexGiteaRestoreTestStale` in force (`absent()` included, promtool + 2 red-proofs); every backup unit now mails on failure (`OnFailure=`, dry run reached the inbox). **First real Gitea restore:** into a throwaway on the bench, 10/10 repos, product `main` = live, a file byte for byte, a login (`runbooks/gitea-restore.md`). The hub came back too (R-173, closed). **The registry is left out on purpose:** its images rebuild from the code. **Correction to the recon §7:** the API mirror holds ONE repo (`homelab-manifests`), not all — Gitea had a single copy, on DooPlex. `audits/dooplex-survival-2026-10-09/` **LEFT:** (c) append-only for the on-box tree, (d)–(g) as written; the paper copy of the new key (operator). **READY** for the rest | — | — | operator |
|
||||
| **R-893** | Backup & restore | P3 | **After a failed OFF-SITE replay, the rollback pours the NEWER pre-restore copy over the OLDER volume just put back.** Read in source 2026-10-06 (R-638 option A, not measured): `internal/backup/offbox_reconstitute.go` writes the undo copy from the live (newer) database, replaces the volumes with the snapshot's older tars, then — when the replay fails — `rollbackSafetyDump` loads that newer dump over the older database volume. The loader only drops what the dump knows, so tables the newer migration removed stay; and when the snapshot's older definition was written, the rollback branch does not put the newer definition back, so the older app starts on rolled-back data; non-database volumes stay at the snapshot's state. An order change cannot fix it (the only undo is a logical dump, and its volume was replaced). Known limit in `07` §6.3. **-- 2026-10-08 design:** `audits/day-2026-10-08/design-R-893.md` — re-verified; and the screen's „your data is back as it was" (`err.backup.db_restore_failed_rolled_back`) is false for files, other volumes and the app version. Question D8 on STATUS's decision sheet. **-- 2026-10-08 14:16 operator ruling D8 (`09` §3 decision 192):** yes, both, in that order — first the app stays stopped for support (option C), next „put back exactly as it was" (option A). | **NARROWED — 2026-10-09: the first half DELIVERED in controller 0.304.0. Slice 0 (the live measurement) NOT run: 9202 has no off-site, and a dump cannot be cut by hand inside an encrypted off-site copy on Tester 1; it needs a scratch off-site repo — a plan, not a finding.** **NARROWED 2026-10-08 — the first half (D8 option C, the app held stopped) is built on controller main and ships tomorrow; what stays open is the second half, „put back exactly as it was” (option A: a pre-restore copy of the app's volumes and placed files, a fit check, disk for one copy; the slice-0 measurement on 9202 first).** **OPEN — filed 2026-10-06** **2026-10-06 night: verified in source, no code** — `offbox_reconstitute.go:758` (undo dump from the live DB), `:778-860` (files and volumes from the snapshot), `:804` (the snapshot's definition is written when its version differs), `:898` (the rollback loads the newer dump over the older volume; nothing writes the live definition back). Not a reorder fix: it needs R-638 option B (a rebuilding loader) or a pre-restore volume copy (disk cost; R-685's class). Which state a household gets after a failed off-site replay is the operator's call. Next: the 9202 measurement, then the design. | a design: R-638 option B (a loader that rebuilds instead of overlays) or a pre-restore volume copy | Measure it once on 9202 (a forced replay failure after an off-site restore over a migrated app); then a design for the operator | CC |
|
||||
| **R-895** | Backup & restore | P2 | **The hub's clean-up-window check trusts the snapshot counts the box sends, so a broken-into box (or past-dated fakes added through the add-only key) can shrink the real off-site history without an alarm.** READ 2026-10-06 night in source (R-822's design): the before/after comparison uses counts the box itself reports (`hub/internal/offsitekeys/service.go:284`, `:343`); new fakes keep the count level. Decision 68 already accepts a box-trusted count. | **OPEN — filed 2026-10-06 night** **2026-10-07 07:58: kept open for later (`09` §3 decision 166).** | a design + one read-only measurement (does the Storage Box shell on port 23 show snapshot file upload times?) | Option B of `audits/night-burndown-2026-10-06/design-R-822.md`: the hub lists the repo's `snapshots/` files over its own login before and after a window and alarms on snapshots no box run explains | CC |
|
||||
| **R-923** | Backup & restore | P2 | **The password manager (Vaultwarden) runs on DooPlex and holds the keys that open DooPlex's own off-site copies — a loss of DooPlex loses the keys with the copies.** Operator finding, 2026-10-09 11:19: "the password manager also runs on DooPlex (Vaultwarden), so I probably need to back up its DB somewhere too." Measured: `vaultwarden-system/vaultwarden` (1.37.3), PVC `vaultwarden-data` 7.4 MB (`db.sqlite3` + WAL, `rsa_key.pem`, no attachments); its only backups were Longhorn on DooPlex. **A key in a password manager that runs on DooPlex is not off DooPlex** — R-173's "both keys are off DooPlex" (2026-10-05) and the hub-DB runbook Step 0 were wrong in that sense. Also seen: Vaultwarden warns its `ADMIN_TOKEN` is plain text (an Argon2 hash is its guidance). | **NARROWED 2026-10-09 (operator yes in chat):** Vaultwarden's own `backup` copy + `rsa_key.pem` ride the nightly encrypted DooPlex→ep0 job (`scripts/dooplex-offsite/`), checked on every push and every Sunday (integrity, users, items — rows only). That copy opens only with the DooPlex off-site key, and the vault only with the master password — so the circle is broken only once both are on paper outside DooPlex: `runbooks/break-glass-sheet.md`, `runbooks/total-loss-of-dooplex.md`. **LEFT:** the operator prints the sheet and stores it away from home; the `ADMIN_TOKEN` hash (a DooPlex change, operator's word). | operator: print the sheet | Operator: print + store the sheet; then close | operator |
|
||||
| **R-1106** | Backup & restore | P2 | **An app with a database that is removed, reinstalled and then fully restored from the off-site copy comes back unusable: the restore puts back the OLD database volume, which carries the old install's database password, while the reinstall generated a new one.** MEASURED 2026-10-16 on demo-hp 9201 (controller 0.323.0-rc.1, the dashboard's own posts): Rallly (Postgres) — the restore reported success („… és az adatbázis visszaállítva"), the marker row was in the database, and the app crash-looped `P1000: Authentication failed` (the dump replay passes through the container's local trust socket — R-127 (b)'s shape). Grimmory (MariaDB) — the dump replay AND the rollback both failed `ERROR 1045 Access denied for user 'root'`, and the app was held stopped (`restore_holds`); the books-folder file did come back byte-identical. Not restic: both off-site copies downloaded complete. The same class as R-127 (b), on a path R-127 does not name: here no secret is MISSING — the reinstall made a valid new one. The hold then outlives the remove and a fresh install (by design, R-379 — the operator clears it). | OPEN — filed 2026-10-16 | a design: R-127 (b) already says the fix changes restore behaviour on customer data (carry the DB password with the unit, or `ALTER USER` to the live value after the volume replay) | Decide with R-127 (b); then a drill of reinstall → off-site full restore for one Postgres and one MariaDB app. Evidence `audits/debian13-restic-2026-10-16/part2/` (B–G) | CC |
|
||||
| **R-49** | Backup & restore | P3 | **[P2] The offsite capture set is ~90% cache and duplication — 1.1 GB of a 1.2 GB immich "photo backup".** Measured 2026-07-19: `immich_ml_cache.tar` **823 660 032 B (~60%)** — re-downloadable ML model weights; `immich_postgres_data.tar` **308 251 136 B (~23%)** — a raw tar of the postgres data dir that DUPLICATES the logical `.sql` dump captured beside it; `upload/backups/` **18 MB** — immich's own nightly dump, a backup inside the backup, growing daily; plus the stranded pre-v3 `dccc13fe…` tree (~36 MB) no DB has ever referenced. Actual irreplaceable content: **72 MB of originals**. **MIGRATED FROM `ROADMAP.md` 2026-08-22 (R-369) — originally filed 2026-07-19, size S–M, roadmap state `idea`.** Moved verbatim; nothing added or reinterpreted. The roadmap keeps its copy as history, marked moved. | **OPEN — migrated from ROADMAP 2026-08-22, rank unchanged** **Re-ranked 2026-10-03: P2→P3: wasted space and transfer, no data risk; needs a capture-set ruling, not a sale blocker.** | — | **Evidence: `audits/DIAG-immich-restore-round2-2026-07-19.md` §4 (full byte breakdown).** This is the customer's offsite quota and transfer cost, and it lands on the Hetzner sub-account they are billed for. **Recorded, deliberately not changed** — a capture-set exclusion is a data-loss-shaped decision and gets its own ruling, not a drive-by edit. Candidates in priority order: (a) `immich_ml_cache` — pure cache, strongest case; (b) the `postgres_data` volume tar where a logical dump of the same DB is already captured (the dump is what the restore path actually replays); (c) `upload/backups/`. Likely generalises past immich into a template-classification rule about cache volumes and self-backup directories, so it should be specified against the catalog, not one app | CC |
|
||||
| **R-127** | Backup & restore | P3 | **The catalog's `data_key: true` flag is UNRELIABLE — at least four data-encrypting keys the catalog itself labels as encryption keys are unflagged; and the O4 restore path can regenerate a DB password that then does not match the restored data directory** | **READY (S/M)** **2026-10-06: leg (a) PUSHED** to the live catalog (`c265b37`). **2026-10-06 (burn-down night, later): leg (b) NEEDS A DESIGN.** `07` §7.4 sets no direction; refusing the restore without the DB password, or `ALTER USER` after it, each change restore behaviour on customer data. | — | **Found by D5's Part 0, and it is why D5's boundary is `type: secret` rather than `data_key`.** Two separable legs. **(a) The misclassification.** Only 5 fields across 4 apps set `data_key: true` (`adventurelog/SECRET_KEY`, `homebox/HBOX_AUTH_API_KEY_PEPPER`, `papra/AUTH_SECRET`, `sparkyfitness/{API_ENCRYPTION_KEY,BETTER_AUTH_SECRET}`), yet `n8n/N8N_ENCRYPTION_KEY` („Titkosítási kulcs"), `wanderer/POCKETBASE_ENCRYPTION_KEY` („Adatbázis titkosítási kulcs"), `calcom/CALENDSO_ENCRYPTION_KEY` and `bookstack/APP_KEY` are unflagged — the catalog's own Hungarian labels contradict the flag. **D5 makes this non-urgent but not harmless:** everything `type: secret` now travels, so the keys DO reach the drive; what stays wrong is the **fail-closed gate**, which only refuses for `data_key` names — so if one of these is missing from both sources the restore proceeds onto data it cannot decrypt instead of refusing. Fix = flag them (`app-catalog-felhom.eu`, a catalog-only change) + a gate/test that the flag set and the label set agree. **(b) The regenerated-DB-password trap.** `internal/backup/restore_unit.go` O4 generates a replacement for any missing non-data-key secret. Proven on `postgres:16-alpine`: with PGDATA restored from the volume tar, `POSTGRES_PASSWORD` is ignored (initdb skipped), so the app fails over the compose network while the dump replay still succeeds through the container's local **trust** socket — success reported, data unreachable. v0.188.0 corrected the WARN's false claim that *"stored data is unaffected"* and scoped it, but did **not** add a guard: D5 shrinks this to the rare case (the secret was empty at capture AND absent from the guest). Real fix = either treat a DB password as fail-closed like a data key, or `ALTER USER` to the regenerated value after the volume restore. 18 DB/root-password fields are in scope; MariaDB fails loudly instead (Access denied), which is the safer half | CC |
|
||||
| **R-231** | Backup & restore | P3 | **`/opt/backup/scripts/` on DooPlex is unversioned host state** — found 2026-08-06 while adding the auto-memory store to the backup set. No repository tracks the scripts that protect the recovery chain, so the edit made that day (`CLAUDE_MEMORY_DIR` in `backup-config.sh`, multi-path restic call in `backup-data.sh`) exists only on the box. This is the same class the part-2 session was closing, found inside the fix for it; the change is transcribed in `felhom.eu/workspace/README.md` so it is at least *recorded*. **Two related facts, both understating current safety:** the backup destination (`/mnt/5_hdd/backup`) is on the **same physical disk** as the workspace it protects, and the DooPlex backup set has **no off-site leg** (`sync-hetzner-backups.sh` is jarrs.eu and pulls *from* Hetzner *to* DooPlex). Bringing a root-owned production backup script under version control, and deciding what installs it, is its own scoped change. | **VERIFY** — **MEASURED 2026-10-13 — the due check is GREEN** (read by the sizing session, two channels): `systemctl show dooplex-backup.service` → `Result=success`, `ExecMainStatus=0`, ran 03:27:39–03:33:29 CEST; its journal ends „All backup components completed successfully!”, and the manifests leg (the header-token change) logged „Successfully backed up homelab-manifests” with the plain URL `https://gitea.dooplex.hu/admin/homelab-manifests` (no token in it). Left open, not closed: the row also carries the same-disk and no-off-site facts, which closing would drop — the owner decides. **VERIFY** — **2026-10-12 evening: the token left the clone URL** (operator yes in chat; homelab-manifests `1943a70`, installed by the role): `backup-manifests.sh` sends it as an `http.extraHeader` through `GIT_CONFIG_*` env; read-only proof: `git ls-remote` of the private repo with the header → HEAD, without → refused. The 2026-10-13 03:10 run is the test of both changes. **VERIFY** — **2026-10-12: in git and installed from it** (operator yes in chat, operator in the session): homelab-manifests `fdd324b`, `homelab-ansible/roles/dooplex_backup/` (11 scripts + the timer units, byte-identical to the live ones; no secret in any file; `install.sh` dry run / `--apply`). The install changed only the units' mode (744 → 644). Baseline: last night's run `Result=success`, exit 0 (`audits/answers-2026-10-12/s20-backup-scripts.txt`). **Seen by the commit's security review, NOT changed (a DooPlex behaviour change needs the operator's word):** `backup-manifests.sh` puts the Gitea token into the clone URL for the mirror run (visible in the process list for those seconds) and strips it from the stored remote afterwards; no token VALUE is in any file, and the repo is private (anonymous API read = 404). A header-based fetch (`git -c http.extraHeader=…` from the token file) would remove it — one line in the decision list. **READY** — operator ruling 2026-10-12 (S20, `09` §3 decision 215): yes — the scripts into a repo + an install script; the operator present for the install. **READY** — owner Viktor | — | Owner: close the row (the install from git is proven) and file the same-disk / no-off-site facts as their own row if they still hold | CC |
|
||||
| **R-314** | Backup & restore | P3 | **`StopAbandon` has no web route — a customer who telephones is served by a command line.** `--abandon-stop` exists on the controller binary (`cmd/controller/main.go:86`) and refuses rather than silently no-opping, which is right. But there is no handler: the only in-product way to cancel a countdown is the customer finding their recovery code (Scenario G cancels it at the moment the code proves they still have it). **An operator who is telephoned instead has to reach a shell on the customer's machine.** Used this session on the operator's ruling, container stopped first so the running controller could not overwrite `settings.json` from memory — a sequencing subtlety that is itself an argument for a route **-- 2026-10-08 design:** `audits/day-2026-10-08/design-R-314-279-177.md` — the box's own 14-day countdown has no operator door (the hub's 7-day phase does, decision 74); one door for R-314 + R-279: a fixed list of operator actions carried in the report reply. Question D1 on STATUS's decision sheet. **-- 2026-10-08 14:16 operator ruling D1 (`09` §3 decision 185):** yes — option A, a fixed list of operator actions carried in the box's report reply. | **VERIFY — 2026-10-09: DELIVERED (hub 0.144.0 + controller 0.304.0); `run_job fill-watch` proven live on the Tester 1 box (hub row „done — ran to its end"; control: the box log „checked 3 filesystem(s)"; an unknown action is refused 400). `abandon_stop` / `abandon_extend` NOT yet proven — no box has a deletion countdown; prove them on the first one.** **VERIFY — built on main 2026-10-08 (D1, decision 185), ships with tomorrow's controller + hub releases; closes after the live proof on 9202** (`abandon_stop` / `abandon_extend` through the hub's buttons). **READY (S) — NEW 2026-08-12, RANK 3** **2026-10-05 (burn-down night): NEEDS A DESIGN.** There is no operator door into a RUNNING controller (its HTTP surface is the household's session; the CLI runs in a separate process and cannot safely trigger a job in the running one). Same design as R-177 and R-279. | R-241, R-307 | An operator-authenticated POST that calls the same `StopAbandon`, so the telephone path and the code path converge | CC |
|
||||
| **R-401** | Backup & restore | P3 | **Revisit the off-site integrity depth when a real store is LARGE — the default rests on ONE measurement, on ONE 134 MB store.** Controller v0.228.0 (R-399) made `--read-data-subset=100%` the default for every box. The whole justification is a single data point: `demo-hp`, 2026-08-30, 140 829 678 B / 2 651 blobs / 67 snapshots, structure 35.0 s vs 100% **39.2 s** — four seconds. Re-proven live 2026-08-31 at 38.7 s. **It does not extrapolate, and the reason is structural: the structure check's cost tracks the INDEX, a read-data run's tracks the DATA.** A 50 GB store is ~370x the data and this curve says nothing about it. **Nothing was invented from that one point** — no rotation schedule, no size threshold, no bandwidth budget — because four production designs in this project were specced against unvalidated mechanisms and all four were wrong. **`readDataSubsetRe` already accepts `n/m`**, so a rotating schedule (`1/7` on a different seventh each week) needs no parser work when the time comes; the missing input is a measurement on a large store, not code. **THE TRIGGER IS AN EVENT, NOT A DATE:** the slow-check WARN from v0.228.0 firing on any box (`integritySlowNoticeThreshold`, 5 min) — that line names the duration, the depth and this row. **WHAT HAPPENS IF NOBODY ACTS:** every box re-reads its entire store every week, however large it grows, and the first person to notice is a customer whose upload is saturated. **Whoever acts must also revisit `integrityCheckTimeout` (30 min)**, which is now the number a large store meets first. | **OPEN — WATCHING** | — | When the WARN fires: measure the curve on that store, then choose between a rotation (`n/m`), a size-conditional default, or leaving it. Do NOT choose from this row's numbers — they are the small-store case. | CC |
|
||||
@@ -213,16 +209,17 @@ stopping line that lies.
|
||||
| **R-1076** | Storage & devices | P4 | **A cheap SSD reports a vendor-less WWN, so a WWN-first disk key may not be unique.** MEASURED 2026-10-15 on the N100's system SSD (AirDisk 512 GB): `ID_WWN=0x5000000123456f1f` — NAA-5 with OUI `000000`, a pattern that looks like a placeholder; its serial `QDF922W009654S30EX` looks real. The agent's wipe binding prefers `wwn-` links (A/internal/storage/durable_device.go:32). Not known whether two units share the WWN. Evidence: `audits/storage-identity-2026-10-15/B-n100.txt`. | OPEN | — | Check a second unit of the same model (or vendor data); if shared, make the agent skip OUI-000000 WWNs (the design already keys on model+serial, `architecture/16-storage-physical-identity.md` §3). | CC |
|
||||
| **R-1077** | Storage & devices | P4 | **No USB enclosure that hides or fakes a disk's serial has been measured.** The storage-identity spike (2026-10-15) had none at hand and found none in earlier evidence; the design's `usb_bridge` unknown rule (`architecture/16-storage-physical-identity.md` §3) is therefore an assumption. Cheap single- and dual-bay bridges are known to report one bridge serial for any disk. Evidence: `audits/storage-identity-2026-10-15/README.md` case 4b. | OPEN | — | Buy or borrow one cheap USB enclosure (single and dual bay), run `tools/physdisk_probe.py` against it, and set the rule from what it reports. | Operator (a device) then CC |
|
||||
| **R-1094** | Storage & devices | P4 | **The whole-disk format refusal tells the household to format the free part — which is refused while the other part is in use.** SEEN 2026-10-16 (controller 0.318.0): 409 „Ezen a lemezen egy használatban lévő meghajtó van, ezért a teljes lemez nem formázható. Csak a szabad részét formázhatod." — since agent 0.158.1 a part next to a mounted part can only be USED (the root wrapper trusts no „Felhom's own" claim). Evidence: `audits/storage-identity-buildB-2026-10-15/live/14-samedisk-refusal-offer.txt`. | READY | — | Reword `err.web.meghajto_hasznalatban_formazas` (hu + en): „… nem formázható. A szabad részét használatba veheted." Next controller release; the copy gates run. | CC |
|
||||
| **R-1108** | Storage & devices | P4 | **A share added while sharing is on but the household password is not yet set is not exported once the password is set, if the samba container was already running: `SetSMBPassword` rewrites `smb.conf` and the compose file but starts the stack only when it is NOT running, and the next reconcile sees „unchanged + running" and does nothing.** Measured 2026-10-16 on demo-hp 9201 (0.322.0): a first password attempt failed (the test's own trailing newline — `smbpasswd: Mismatch`), which left the container up; the share created next was in `settings.json` and never in the container's `smb.conf` (`NT_STATUS_BAD_NETWORK_NAME`) until another share mutation recreated it. The dashboard is supposed to ask for the password first, so the household path is narrow. Not fixed in v0.323.0: that release's live checks were done on its rc.1, and an untested change does not ride a base-OS move. | OPEN — filed 2026-10-16 | — | In `SetSMBPassword`: when `writeSambaFiles` reports a change and the stack is running, apply it (`sambaUp`); a test that adds a share before the first password and asserts the export | CC |
|
||||
| **R-1109** | Storage & devices | P4 | **A change that alters only `smb.conf` (not the compose file — e.g. a share renamed at the same path) is never applied to a running samba container.** `smb.conf` is a bind-mounted FILE written by atomic rename, so a running container keeps the old inode; `reconcileSambaAt` runs `compose up -d`, which recreates only when the COMPOSE changed. Read from code 2026-10-16 night while fixing R-1108 (the helper session that wrote that fix). | OPEN — filed 2026-10-17 | — | Recreate when `smb.conf` changed (`--force-recreate`, or a config hash label in the compose); a test with a same-path rename | CC |
|
||||
|
||||
## Security & access — 20 rows (P1 1, P2 2, P3 11, P4 6)
|
||||
## Security & access — 21 rows (P1 1, P2 2, P3 11, P4 7)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| **R-985** | Security & access | P3 | **Our zero-knowledge wording is stronger than the product: on a live box the operator can reach the off-site backup key (through the vaulted root credential and the operator tunnel) without the customer's recovery code.** Design-shaped; decision for the operator in `STATUS.md`. Fix options: change the wording, or remove operator root reach to the key. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | WAITING-ON-OPERATOR — design-proposal | operator decision | Decide the wording or the change | operator |
|
||||
| **R-983** | Security & access | P3 | **Seven small dashboard weaknesses: after sign-in the browser can be sent to another site; the server-reboot route acts on a GET, so a link can reboot the guest (**FIXED 2026-10-13 in controller v0.310.0, R-998 session: POST only, `TestServerReboot_PostOnly` — six remain**); no anti-framing headers; parallel sign-in attempts get past the limiter; the settings page allows 8-character passwords; reset-code requests have no limit on the box; logout can be triggered from another site.** Fix each with a test, in one controller release. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | One hardening release | CC |
|
||||
| **R-977** | Security & access | P3 | **FileBrowser's default password can come back if its data volume is ever re-created, because the box checks it only once; and the tunnel can start before the box is claimed.** Static; needs a live check on 9202. Fix: check at every start, and do not start the tunnel before the claim. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Measure on 9202; then fix | CC |
|
||||
| **R-976** | Security & access | P3 | **A family member's session can be copied out of a family-gated app, and a dashboard password reset does not end family or gate sessions; so a stolen session keeps working for up to 30 days.** Fix: give each app its own derived token instead of the session itself, and end every family and gate session on a reset. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Fix with tests in a controller release | CC |
|
||||
| **R-1113** | Security & access | P4 | **`/__family/start` with a household dashboard session creates a NEW 30-day household family session on every pass, so `family.json` keeps growing.** Found by the R-976 helper session 2026-10-16 night (read from code). | OPEN — filed 2026-10-17 | — | Reuse the household's live family session (or bound the list); a test that N passes leave one session | CC |
|
||||
| **R-1112** | Security & access | P3 | **Family sessions are stored in `family.json` as the raw session value, not as a fingerprint the way dashboard sessions are (R-35)** — anyone who reads the controller's data folder can lift a family session. Found by the R-976 helper session 2026-10-16 night. | OPEN — filed 2026-10-17 | — | Store a fingerprint (the R-35 pattern); a test that the file holds no usable value | CC |
|
||||
| **R-1111** | Security & access | P3 | **The share-password limiter (`/s/<token>`, `shareRateLimited`) and the escrow re-auth limiter (`escrowRateLimited`) still count a try only AFTER the slow password check, so parallel tries get past them** — the shape v0.324.0 fixed for the dashboard and family sign-in (R-983, „reserve before compare"). Found by the R-983 helper session 2026-10-16 night. | OPEN — filed 2026-10-17 | — | The same reserve-before-compare pattern (REUSE.md) on both, with a parallel test each | CC |
|
||||
| **R-954** | Security & access | P2 | **We cannot tell whether anyone used the old hub operator key (R-950) or the open hub read routes (R-951) before 2026-10-12; if someone did, they could have read every box's break-glass root credential and every customer's box report.** The exposure began in February 2026; the logs that could show it cover only 2026-10-12 from about 09:54 and one day in June, so about 238 days are not visible. Fix (operator decision): change the break-glass root password of every box (tester-1 holds a real person's data), or accept the risk; either way, keep ingress access logs long enough to answer this next time. | WAITING-ON-OPERATOR — filed 2026-10-12 by the security review; the log search was not completed in-session | operator decision | Decide: rotate every box's break-glass root password now, or accept | operator |
|
||||
| **R-1042** | Security & access | P3 | **The boxes' Cloudflare keys cannot change zone settings, so Cloudflare's own „Always Use HTTPS” cannot be switched on.** Measured 2026-10-14 on all three zones (`audits/https-only-2026-10-14/``1A-1-zones-and-keys.txt`): each `cf_api_token` is valid and sees only its own zone, but GET/PATCH `settings/always_use_https`, `ssl`, `security_header` answer 403; the redirect and transform rule phases too. The https-only fix therefore lives on the box (decision 246). A second layer at Cloudflare needs „Zone Settings: Edit” (and, for headers, „Transform Rules”) added to each customer's key — the hub's zone-reach check stays. | **WAITING-ON-OPERATOR** — filed 2026-10-14 | a key permission only the operator can grant | Optional: widen each customer key, then switch „Always Use HTTPS” on per zone | operator |
|
||||
| **R-1104** | Security & access | P3 | **Check https-only on Tester 2 when it reports again.** R-1033 (plain http on every public name) is closed on the three boxes that report (35 names → 301, 2026-10-16). Tester 2 (`sajatfelhom.hu`) has been off since 2026-10-04 on controller 0.292.0; its addresses answer Cloudflare 530 (tunnel down), so nothing is served in plain http while it is off. When it comes back it takes the floor (≥ 0.312.0 carries the redirect). | OPEN — filed 2026-10-16 | Tester 2 reporting again | Run `scripts/https_only_check.py` with Tester 2 in it; close | CC |
|
||||
@@ -314,14 +311,16 @@ stopping line that lies.
|
||||
| **R-990** | Business & legal | P4 | **Operator: read `documentation/audits/forum-research-2026-10-12/FELHOM.md` §5 and rule on each recommendation.** READ-ONLY research 2026-10-12: three years (#7943–#11092, 2,908 posts, 195 people, 82 beginner threads) of the public PROHARDVER! topic „Home server / házi szerver építése”, tagged and counted by person (`FINDINGS.md`, method and spot-check in `METHOD.md`; no username or post text in git). Ten ranked recommendations, none acted on; the top three: a „which machine works” page (8 of 33 beginners who name their hardware own only a Synology, a router disk or a Raspberry Pi — the installer cannot run there; the same gap is R-989's first recommendation from a different source, and the shipped-page half is R-991), „you do not choose an operating system — we do” (the biggest beginner question, 20 of 82 threads), and „bring your old office PC” as the cheap entry. Catalog gap (≥ 3 people): a DLNA server (7), an ad/DNS blocker (5), a camera recorder (5). | **WAITING-ON-OPERATOR** — filed 2026-10-12 | the operator's reading | Operator: rule on each of the ten (yes / no / later). If nothing is done: nothing changes; the research ages | operator |
|
||||
| **R-1035** | Business & legal | P4 | **Did the „felhő tárhely” page earn anything? Two dated checks.** **Baseline (reported by the operator from Search Console, 2026-10-14, last 3 months):** 1 click, 48 impressions, CTR 2.1 %, average position **73.6**; „felhő tárhely” 19 impressions, „felhőtárhely” 5, „felhő alapú tárhely” 3. CC measured separately that the phrase „felhő tárhely” appeared **0 times** on the home, FAQ and backup pages — Google was showing the home page for those queries by accident. `/sajat-felho-tarhely` + `/en/own-cloud-storage` published **2026-10-14**; full baseline, price sources and the power provenance in `audits/seo-2026-10-14/BASELINE.md`. **What to measure, both times:** impressions and average position for „felhő tárhely” and „saját felhő tárhely”, plus the new page's own impressions, clicks and position. **A null result at +4 weeks means nothing on its own** — a new page on a site at position 73.6 takes weeks to months to move, and „felhő tárhely” alone is held by Microsoft, Google and the big list sites; the page aims at the two longer phrases. That is why there are two checks and not one, and why neither should be read as a verdict on the copy. **There is no Search Console connector in this project, so CC cannot read these numbers** — the operator reads them, CC records and compares. **Blocked until the operator asks for indexing** (Search Console → URL-ellenőrzés → the URL → „Indexelés kérése”): until that happens, or Google finds the page itself, both checks read zero for a reason that is not the page. **This is a slow channel and does not replace talking to people.** | **WATCHING** | operator: request indexing, then supply the Search Console read | 2026-11-11: first read (+4 weeks); 2026-12-09: second (+8 weeks), compared with the first | operator + CC |
|
||||
|
||||
## Process & tooling — 29 rows (P3 11, P4 18)
|
||||
## Process & tooling — 31 rows (P3 11, P4 20)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| **R-1083** | Process & tooling | P3 | **The scratch box 9202 cannot use any feature that needs the agent: its `bootstrap.json` has no `local_api` block, so its controller never gets an agent client.** MEASURED 2026-10-15 (storage-identity build A): 9202 put on controller 0.317.0 by hand to show that a NAS share no longer hides the one-copy notice (R-1075); its `bootstrap.json` (read on the box) holds no `local_api`, so the controller has no agent to ask and keeps the old `st_dev` rule — the check could not tell old from new — 9202 was put back on 0.314.0. Every agent-coupled feature (drives, same-disk, format, network storage) is untestable on the scratch box today, and the NAS leg of build A is proven by a red-proofed unit test only. Evidence: `audits/storage-identity-buildA-2026-10-15/9202-upgrade.txt`. | OPEN | — | Give 9202 a local-API token the normal way (the agent mints it for its guest), or record in `runbooks/target-selection.md` that 9202 is controller-only; then show the NAS notice live. | CC |
|
||||
| **R-1081** | Process & tooling | P4 | **Two published controller tags hold content that is not what their number says: `0.315.0` and `0.316.3`.** Both were caused by CC on 2026-10-15, and both by the same shape — a guard that was not on the path the work takes. **`0.316.3`:** the build directory's `build.sh` is a symlink into the SHARED clone's working copy, which predated the `FELHOM_REPO_DIR` override, so the override was silently ignored and the build copied that tree — which held 31 uncommitted files of another session's physical-disk storage work. The banner printed `Commit: 0225255` with no `Repo:` line. **Nobody deployed it; that was luck, not a control.** Fixed at the root in controller v0.316.4: `build.sh` now refuses `--push` from a tree that is dirty, not at `origin/main`, or not a git checkout, with four test cases red-proved. **Neither tag is re-pushed or deleted** — a version number is pushed once, and that applies to numbers CC spoiled. **No box runs either:** demo-hp 9201 is on 0.317.0, the floor is 0.314.0, and the button offers the highest tag. **`0.315.0`:** Caused by CC on 2026-10-15 while proving R-1080's own fix: the guard was added to `controller/build.sh` in the repo, but the documented release command runs `$FELHOM_ROOT/build/felhom-controller/build.sh`, which was a **separate copy taken 2026-07-18** and had no guard. Running the refusal against a real existing tag therefore rebuilt and re-pushed 0.315.0 — a fourth time — with v0.316.0's code under it (digest `8887343011d6` → `b809201841f7`). **Fixed at the root in the same session:** the build directory's script is now a symlink to the repo's, the old copy kept beside it as `build.sh.stale-copy-2026-07-18`, and the refusal was then proven to fire from the documented path. **No box is affected:** nothing runs 0.315.0 (demo-hp 9201 is on 0.316.2), the floor is 0.314.0, and the household button offers the highest tag. What remains is two tags that must never be deployed and are no longer reproducible from the registry. | **OPEN** — filed 2026-10-15; nothing to do unless someone needs one of those two images, and then the answer is the current release | — | Leave them. If an audit ever needs the real 0.315.0 or 0.316.3, build it from the matching commit under a NEW number and say so | CC |
|
||||
| **R-992** | Process & tooling | P3 | **The drill-catalog route that `09` §6.5 documents cannot be followed: `admin/app-catalog-drill` is PRIVATE and no box has catalog credentials.** Measured 2026-10-12 while publishing the Usenet pair: the box's clone fails with `fatal: could not read Username for 'https://gitea.dooplex.hu'` (exit 128), the Gitea API reports the drill repo `private=true` and the live catalog `private=false`, and NEITHER the current controller.yaml on 9202 NOR any of its 30 saved copies has ever carried `git.username` or `git.token` (the controller supports both — `internal/config/config.go` GitConfig). The route worked for the campaigns of 2026-10-10 and the torrent pair earlier the same day, so the repository's visibility changed between then and now. **Worked around, not fixed:** that campaign staged its two templates in the box's own catalog cache (`audits/usenet-2026-10-12/tools/stage_in_cache.py`), which is where the sync copies a catalog change anyway, with the sync interval raised to 12h for the duration and rescan used in place of sync. The real fix is an operator decision: either a read-only catalog credential on the scratch box (a secret on a Tier-0 guest) or making the drill repository readable. Until then every new-app campaign hits this. | WAITING-ON-OPERATOR | the operator's choice between a box credential and a readable drill repo | Decide; then either set `git.username`/`git.token` on 9202 from the credentials store, or flip the drill repo, and correct `09` §6.5 either way | operator |
|
||||
| **R-1017** | Process & tooling | P3 | **A comment names a guard test that does not exist.** `felhom-controller/controller/internal/appbackup/paths.go:58` says „`TestNoBareDrivePathToUserdataDir` is the guard that keeps the count from growing”; no test of that name (or `NoBareDrive*`) exists in the repo (grep 2026-10-14; positive control: `TestRemoveStack_R800_UserdataKeptIsNamed` is found). A comment asserting an invariant with no test pinning it — the class in the `felhom-testing` skill. | **READY** — filed 2026-10-14 | — | Write the guard (a test that fails when a bare drive path reaches `UserdataDir`), red-proof it, or correct the comment | CC |
|
||||
| **R-1110** | Process & tooling | P4 | **The R-1017 guard covers `UserdataDir` only; two sibling path helpers are still called with drive-named arguments whose comments claim a namespace root:** `stacks/delete.go` `RecoveryUnitPath(drivePath, name)` and `web/handlers.go` `backup.AppDataDir(storagePath, name)`. The guard `TestNoBareDrivePathToUserdataDir` found one real defect of this shape tonight (`userdataKept`, fixed in v0.324.0). | OPEN — filed 2026-10-17 | — | Extend the guard to `RecoveryUnitPath`/`AppDataDir`/`PrimaryBackupPath`, fix what it finds | CC |
|
||||
| **R-1114** | Process & tooling | P4 | **`controller_gates.py` cannot pass inside a worktree outside `git/` (e.g. `/mnt/5_hdd/felhom.eu/wt/<name>`): the reuse-refs, instructions and observations gates look for felhom.eu only at `../felhom.eu`, report MISSING, and the runner fails.** Measured 2026-10-16 night by both helper sessions (each ran the four gates by hand from felhom.eu). | OPEN — filed 2026-10-17 | — | Resolve the sibling from `FELHOM_SHARED_SCRIPTS` or the main clone (`git worktree list`), as retrieval-promise already does | CC |
|
||||
| **R-1115** | Process & tooling | P3 | **The catalog decoy suite fails one case: „FACT: a credential token rewritten in translation" — `check-copy-i18n.py` answers rc 0 where the decoy expects 1, so the gate may no longer convict a reworded credential token.** Measured 2026-10-16 night (`python3 scripts/test_gate_decoys.py`, with and without the new `db-credentials` cases — the same failure both ways). `catalog_gates.py --fast` is green because the decoy suite is not one of its gates. | OPEN — filed 2026-10-17 | — | Find whether the gate or the decoy moved; red-prove the gate on the case again | CC |
|
||||
| **R-1022** | Process & tooling | P3 | **Tester 1 follows the drill catalog and carries two test drives — teardown owed (operator ruling (e), 2026-10-14).** Steps, only on the operator's word: (1) remove the test apps (Sonarr, Radarr, qBittorrent, Transmission, Plex, Jellyfin) through the dashboard WITHOUT „delete data” (R-1027); (2) decommission Media A and Media B through Tester 1's dashboard; (3) `repoint.py restore` — `controller.yaml` from `controller.yaml.pre-media-2026-10-14`, read back byte-identical, `repo_url` the live catalog; remove `drill-catalog.git` from the controller volume; (4) on demo-hp: `qm set 341 --delete scsi2,scsi3`, then delete the two volumes BY NAME (`nvme-scratch:341/vm-341-disk-3.raw`, `-disk-4.raw`) — never `qm destroy`; (5) VM memory unchanged (8192, not raised); (6) drill repo reset to live `main`. Tools: `audits/media-all-drives-2026-10-14/``tools/`. **Added 2026-10-14 night:** (4b) Media C — `qm set 341 --delete scsi4`, then the volume `nvme-scratch:341/vm-341-disk-5.raw` by name (decommission it on the dashboard first; it holds 4 test files); (7) DONE 2026-10-15: `plex-k6` and its volume removed after the claim (0 left) — the operator removes its server entry „plex-k6” from plex.tv (Settings → Authorized Devices); (8) drill commit `925f3fd` (media_c binds) goes with step 6; Prowlarr and the test drive tag „driva-a” go with step 1. Tools also in `audits/media-drive-events-2026-10-14/tools/`. **Added 2026-10-15 (media build):** (4c) Media D — decommission it on the dashboard, then `qm set 341 --delete scsi5` and the volume `nvme-scratch:341/vm-341-disk-6.raw` by name (20 GB; 2 own-bytes torrents on it); (9) Tester 1 runs controller `0.313.0-rc.3/rc.4` by hand — put the vouched release back (`/etc/felhom-controller-image`); (10) the rig's Sonarr/Radarr hold two sets of drive tags and clients (the night script's `drive-a…` and the product's `media-a…`) — they go with step 1. | **WAITING-ON-OPERATOR** — filed 2026-10-14 | the operator's teardown word | Run the six steps; quote each read-back | CC |
|
||||
| **R-1034** | Process & tooling | P3 | **Gate 17 checks the FAQ JSON-LD on two pages only, by a hard-coded list — a FAQPage anywhere else is unchecked.** `scripts/site_gates.py` gate 17 loops `for p in ("gyik.html", os.path.join("en", "faq.html"))`, so its „JSON-LD equals the visible questions and answers” guarantee stops at those two files. **Since 2026-10-14 two more pages carry a FAQPage block the gate never reads:** `/sajat-felho-tarhely` and `/en/own-cloud-storage`. Their JSON-LD was *derived* from the visible headings and paragraphs by a script and then verified verbatim against the rendered text, so it is correct today — but nothing stops the next copy edit moving the visible text and leaving the structured data behind, which is exactly the failure gate 17 exists to catch, and the one Google penalises. **Why it is not a one-line fix:** gate 17's extractor is written for the FAQ pages' accordion markup (`<button class="faq-question">` … `<div class="faq-answer-inner">`); the new pages use plain `<h2>` + `<h3>`/`<p>` sections, so widening the scope needs a second extractor beside the first. **Scope is a fact** (repo `CLAUDE.md`: prefer a walk over a hand-maintained list) — the gate should scan **every page containing a FAQPage block**, not a named pair, or the next page to carry one is unguarded in the same way. A decoy is owed for the widened gate (R-421). | **OPEN** | — | widen gate 17 to every page carrying a FAQPage block, second extractor + decoy | CC |
|
||||
| **R-987** | Process & tooling | P4 | **The 53 catalog app images have never been scanned for known vulnerabilities.** Fix: a monthly trivy pass over the images the catalog pins, reported, not gating. | OPEN | — | Add to the monthly re-test | CC |
|
||||
|
||||
Reference in New Issue
Block a user