From 66b955d05473c05ae5a284795425e55e6a8e4b6d Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 6 Jul 2026 19:28:15 +0200 Subject: [PATCH] =?UTF-8?q?docs(audit):=20P1-P3=20re-run=20=E2=80=94=20acc?= =?UTF-8?q?urate=20end-state=20+=20healthcheck-robustness=20observation?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Correct the end-state: uptime-kuma redeployed healthy, notifications restored; vaultwarden serves (127.0.0.1 /alive 200) but reads docker-unhealthy due to a localhost->IPv6 healthcheck probe quirk (reproduced on fresh redeploy); bookstack unhealthy at app level (HTTP 500, pre-existing). Recommend catalog healthchecks use 127.0.0.1 not localhost. Neither is a P1-P3 defect. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6 --- documentation/audits/RERUN-p1p3-2026-07-06.md | 20 +++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/documentation/audits/RERUN-p1p3-2026-07-06.md b/documentation/audits/RERUN-p1p3-2026-07-06.md index 1709490..ecd2f6e 100644 --- a/documentation/audits/RERUN-p1p3-2026-07-06.md +++ b/documentation/audits/RERUN-p1p3-2026-07-06.md @@ -105,10 +105,22 @@ bit-identical. Off-box restic-SFTP is validated end-to-end (grant #2). ## End state -Demo node left healthy: notifications restored (11 events), uptime-kuma redeployed (its volume was -destroyed by the remove-test cascade), vaultwarden + bookstack hard-restarted to clear a healthcheck -`localhost`→IPv6 binding quirk (both serving; `/alive` 200). R0′/R0.5 snapshots retained in PBS. -Auth left disabled (grant #1). No production code, versions, or config changed. +Notifications restored (11 events, verified). uptime-kuma redeployed and **healthy** (its volume was +destroyed by the remove-test cascade). 12 apps healthy. Two apps show docker `unhealthy` while +serving — see the observation below. R0′/R0.5 snapshots retained in PBS. Auth left disabled +(grant #1). No production code, versions, or config changed. + +## Observation (out of P1–P3 scope; documented, not acted on) + +**Catalog healthcheck robustness — `localhost` vs `127.0.0.1`.** Post-run, `vaultwarden` reads +docker-`unhealthy` even though it serves: its healthcheck `wget http://localhost:80/alive` gets +*connection refused* (in-container `localhost` resolves to IPv6 `::1`; vaultwarden binds IPv4 +`0.0.0.0:80`), while `http://127.0.0.1:80/alive` returns 200. This reproduced on a **fresh** redeploy +during teardown (it was healthy earlier in the day, so the localhost/IPv6 resolution is +environment-dependent on this guest). Recommend catalog healthchecks target `127.0.0.1`, not +`localhost`, for IPv4-only apps. Separately, `bookstack` is `unhealthy` at the **app** level (health +path returns HTTP 500 — a pre-existing demo-app state, not introduced by this run). Neither is a +backup/restore (P1–P3) defect. ## Still open (not this run)