Media all drives: nCore synced to Sonarr/Radarr via Prowlarr (read back); R-1033 filed (public names answer plain http, *arr login redirect is http)
gates / gates (push) Successful in 6m28s
gates / gates (push) Successful in 6m28s
This commit is contained in:
@@ -62,3 +62,13 @@ Rows before 133 → after 146 (another session added R-1020, R-1021 and closed R
|
||||
- Rows filed: R-1028 (Plex claim runs out), R-1029 (identical „media” folders in Plex), R-1030 (first admin defaults to
|
||||
„Enabled”), R-1031 (no drive question for media apps), R-1032 (delete safety list names the old layout).
|
||||
- Register: 146 → 151 (opened 5, closed 0).
|
||||
|
||||
## Follow-up (operator, 18:40): nCore, the login pages
|
||||
|
||||
- The operator's indexer (nCore, private) reached Sonarr and Radarr through Prowlarr's „Full Sync": both now hold
|
||||
„nCore (Prowlarr)" (Torznab, RSS and automatic search on, priority 25). Read back by API.
|
||||
- Sonarr, Radarr and Prowlarr are past the setup gate: their public `/` goes to their own `/login`.
|
||||
- **New: the boxes answer plain `http://`, login pages included; the *arr sign-in redirect is `http://`** — R-1033.
|
||||
- Prowlarr download clients: not added. They serve only searches started inside Prowlarr (its own page says so);
|
||||
Sonarr and Radarr use their own entries.
|
||||
- Register: 151 → 152 (opened 1).
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
sonarr indexers: [('nCore (Prowlarr)', 'Torznab', True, True, 25)]
|
||||
radarr indexers: [('nCore (Prowlarr)', 'Torznab', True, True, 25)]
|
||||
prowlarr indexers: [('nCore', 'Cardigann', None, None, 25)]
|
||||
|
||||
sonarr public / -> 302 -> http://sonarr.enkicsifelhom.hu/login?returnUrl=%2F
|
||||
radarr public / -> 302 -> http://radarr.enkicsifelhom.hu/login?returnUrl=%2F
|
||||
prowlarr public / -> 302 -> http://prowlarr.enkicsifelhom.hu/login?returnUrl=%2F
|
||||
http://sonarr.enkicsifelhom.hu/ -> 302 http://sonarr.enkicsifelhom.hu/login?returnUrl=%2F
|
||||
http://radarr.enkicsifelhom.hu/ -> 302 http://radarr.enkicsifelhom.hu/login?returnUrl=%2F
|
||||
http://prowlarr.enkicsifelhom.hu/ -> 302 http://prowlarr.enkicsifelhom.hu/login?returnUrl=%2F
|
||||
http://bookstack.enkicsifelhom.hu/ -> 404
|
||||
http://torrent.enkicsifelhom.hu/ -> 200
|
||||
http://felhom.enkicsifelhom.hu/ -> 302 http://felhom.enkicsifelhom.hu/login
|
||||
http://felhom.enkisfelhom.hu/ -> 302 http://felhom.enkisfelhom.hu/login
|
||||
http://felhom.enkisfelhom.hu/login -> 200
|
||||
@@ -203,10 +203,11 @@ stopping line that lies.
|
||||
| **R-332** | Storage & devices | P3 | **The new Hiba-from-counters path has never fired on real hardware.** v0.215.0's whole point is a verdict the product could not previously reach, and it is proven only against the committed fixture's values in unit tests (12 scenario groups, 11 of 12 red-proofs failing as required). The live validation on demo-hp proved the **negative** — three healthy disks still read Rendben across the deploy, no false alert — and the **severity wire** end to end, but no live disk has actually reached Hiba. **This is the honest gap and it must not be closed by pointing at the fixture tests**: the drive that produced the fixture is in DooPlex, which is Tier 2 and never a drill target, and the demo boxes are all-flash and healthy | **WATCHING — NEW 2026-08-14, NARROWED same day.** One item originally in this gap is now PROVEN LIVE: the **persisted state surviving a controller restart**. The v0.215.0→v0.216.0 redeploy destroyed and rebuilt the container, and the new one read back a `changed_at` written by the PREVIOUS version (`2026-08-14T07:23:14.640216851Z`, still intact at 09:31:35Z) instead of re-baselining — Scenario L on real hardware, not just the production-path unit test. **What remains unproven is the verdict itself, plus the stronger restart half: an already-ALERTED disk not re-alerting** | a real degrading disk, or an injection harness | **Closing condition:** a live disk reaching Hiba from counters, OR a deliberate injection through the REAL pipeline (agent `/disks` → controller check → hub event), not a hand-set verdict | CC |
|
||||
| **R-331** | Storage & devices | P4 | **Disk health Phase 3 — growth-rate detection, and retiring the static 64.** The v0.215.0 count backstop (64 unreadable sectors → Hiba) is **a judgement from ONE drive**: the observed benign excursion peaked at 16 and cleared inside an hour, and the terminal run passed 64 at 13 Aug 11:28 and never came back. It is deliberately a backstop BEHIND the sustain rule, not the primary signal, but it is still a magic number tuned on a single sample and it will be wrong for some drive. With Phase 2's history the box can ask the question that actually matters — *is this count climbing, and how fast* — which distinguishes a drive with eight stable aging sectors from one adding forty a day, something no static threshold can do. Revisit 64 when that exists | **READY (M) — NEW 2026-08-14** | R-330 | Growth-rate rule over persisted samples; re-derive or delete the static 64 | CC |
|
||||
|
||||
## Security & access — 16 rows (P1 1, P2 3, P3 8, P4 4)
|
||||
## Security & access — 17 rows (P1 1, P2 4, P3 8, P4 4)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| **R-1033** | Security & access | P2 | **Every box answers its public names over plain `http://` — login pages included.** MEASURED 2026-10-14 from DooPlex over the public path (Cloudflare `Server: cloudflare`, `CF-RAY`): `http://felhom.enkicsifelhom.hu/login` → 200, `http://felhom.enkisfelhom.hu/login` (demo-hp) → 200, `http://torrent.enkicsifelhom.hu/` → 200; no redirect to https and no `Strict-Transport-Security`. Sonarr, Radarr and Prowlarr make it worse: their sign-in redirect is ABSOLUTE `http://<name>/login`, so a household that opened the https address lands on the plain page and sends its password unencrypted between the browser and Cloudflare (`audits/media-all-drives-2026-10-14/H-indexer-sync-ncore.txt`). On an untrusted network (café Wi-Fi) that password can be read. The operator may raise this to P1. | **READY** — filed 2026-10-14 | — | Redirect http → https for every public name (Cloudflare „Always Use HTTPS” on each customer zone, or traefik redirecting when the tunnel's `X-Forwarded-Proto` is `http`), then HSTS; a check in the box walk that every name answers 301/308 on http | CC |
|
||||
| **R-985** | Security & access | P3 | **Our zero-knowledge wording is stronger than the product: on a live box the operator can reach the off-site backup key (through the vaulted root credential and the operator tunnel) without the customer's recovery code.** Design-shaped; decision for the operator in `STATUS.md`. Fix options: change the wording, or remove operator root reach to the key. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | WAITING-ON-OPERATOR — design-proposal | operator decision | Decide the wording or the change | operator |
|
||||
| **R-983** | Security & access | P3 | **Seven small dashboard weaknesses: after sign-in the browser can be sent to another site; the server-reboot route acts on a GET, so a link can reboot the guest (**FIXED 2026-10-13 in controller v0.310.0, R-998 session: POST only, `TestServerReboot_PostOnly` — six remain**); no anti-framing headers; parallel sign-in attempts get past the limiter; the settings page allows 8-character passwords; reset-code requests have no limit on the box; logout can be triggered from another site.** Fix each with a test, in one controller release. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | One hardening release | CC |
|
||||
| **R-977** | Security & access | P3 | **FileBrowser's default password can come back if its data volume is ever re-created, because the box checks it only once; and the tunnel can start before the box is claimed.** Static; needs a live check on 9202. Fix: check at every start, and do not start the tunnel before the claim. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Measure on 9202; then fix | CC |
|
||||
|
||||
Reference in New Issue
Block a user