Media all drives: nCore synced to Sonarr/Radarr via Prowlarr (read back); R-1033 filed (public names answer plain http, *arr login redirect is http)

documentation/audits/media-all-drives-2026-10-14/H-indexer-sync-ncore.txt

@@ -0,0 +1,15 @@
+sonarr indexers: [('nCore (Prowlarr)', 'Torznab', True, True, 25)]
+radarr indexers: [('nCore (Prowlarr)', 'Torznab', True, True, 25)]
+prowlarr indexers: [('nCore', 'Cardigann', None, None, 25)]
+
+sonarr public / -> 302 -> http://sonarr.enkicsifelhom.hu/login?returnUrl=%2F
+radarr public / -> 302 -> http://radarr.enkicsifelhom.hu/login?returnUrl=%2F
+prowlarr public / -> 302 -> http://prowlarr.enkicsifelhom.hu/login?returnUrl=%2F
+http://sonarr.enkicsifelhom.hu/ -> 302 http://sonarr.enkicsifelhom.hu/login?returnUrl=%2F
+http://radarr.enkicsifelhom.hu/ -> 302 http://radarr.enkicsifelhom.hu/login?returnUrl=%2F
+http://prowlarr.enkicsifelhom.hu/ -> 302 http://prowlarr.enkicsifelhom.hu/login?returnUrl=%2F
+http://bookstack.enkicsifelhom.hu/ -> 404 
+http://torrent.enkicsifelhom.hu/ -> 200 
+http://felhom.enkicsifelhom.hu/ -> 302 http://felhom.enkicsifelhom.hu/login
+http://felhom.enkisfelhom.hu/ -> 302 http://felhom.enkisfelhom.hu/login
+http://felhom.enkisfelhom.hu/login -> 200 

documentation/backlog/OPEN-ITEMS.md

@@ -203,10 +203,11 @@ stopping line that lies.
 | **R-332** | Storage & devices | P3 | **The new Hiba-from-counters path has never fired on real hardware.** v0.215.0's whole point is a verdict the product could not previously reach, and it is proven only against the committed fixture's values in unit tests (12 scenario groups, 11 of 12 red-proofs failing as required). The live validation on demo-hp proved the **negative** — three healthy disks still read Rendben across the deploy, no false alert — and the **severity wire** end to end, but no live disk has actually reached Hiba. **This is the honest gap and it must not be closed by pointing at the fixture tests**: the drive that produced the fixture is in DooPlex, which is Tier 2 and never a drill target, and the demo boxes are all-flash and healthy | **WATCHING — NEW 2026-08-14, NARROWED same day.** One item originally in this gap is now PROVEN LIVE: the **persisted state surviving a controller restart**. The v0.215.0→v0.216.0 redeploy destroyed and rebuilt the container, and the new one read back a `changed_at` written by the PREVIOUS version (`2026-08-14T07:23:14.640216851Z`, still intact at 09:31:35Z) instead of re-baselining — Scenario L on real hardware, not just the production-path unit test. **What remains unproven is the verdict itself, plus the stronger restart half: an already-ALERTED disk not re-alerting** | a real degrading disk, or an injection harness | **Closing condition:** a live disk reaching Hiba from counters, OR a deliberate injection through the REAL pipeline (agent `/disks` → controller check → hub event), not a hand-set verdict | CC |
 | **R-331** | Storage & devices | P4 | **Disk health Phase 3 — growth-rate detection, and retiring the static 64.** The v0.215.0 count backstop (64 unreadable sectors → Hiba) is **a judgement from ONE drive**: the observed benign excursion peaked at 16 and cleared inside an hour, and the terminal run passed 64 at 13 Aug 11:28 and never came back. It is deliberately a backstop BEHIND the sustain rule, not the primary signal, but it is still a magic number tuned on a single sample and it will be wrong for some drive. With Phase 2's history the box can ask the question that actually matters — *is this count climbing, and how fast* — which distinguishes a drive with eight stable aging sectors from one adding forty a day, something no static threshold can do. Revisit 64 when that exists | **READY (M) — NEW 2026-08-14** | R-330 | Growth-rate rule over persisted samples; re-derive or delete the static 64 | CC |
 
-## Security & access — 16 rows (P1 1, P2 3, P3 8, P4 4)
+## Security & access — 17 rows (P1 1, P2 4, P3 8, P4 4)
 
 | ID | Category | Sev | What | State | Blocked on | Next action | Owner |
 |---|---|---|---|---|---|---|---|
+| **R-1033** | Security & access | P2 | **Every box answers its public names over plain `http://` — login pages included.** MEASURED 2026-10-14 from DooPlex over the public path (Cloudflare `Server: cloudflare`, `CF-RAY`): `http://felhom.enkicsifelhom.hu/login` → 200, `http://felhom.enkisfelhom.hu/login` (demo-hp) → 200, `http://torrent.enkicsifelhom.hu/` → 200; no redirect to https and no `Strict-Transport-Security`. Sonarr, Radarr and Prowlarr make it worse: their sign-in redirect is ABSOLUTE `http://<name>/login`, so a household that opened the https address lands on the plain page and sends its password unencrypted between the browser and Cloudflare (`audits/media-all-drives-2026-10-14/H-indexer-sync-ncore.txt`). On an untrusted network (café Wi-Fi) that password can be read. The operator may raise this to P1. | **READY** — filed 2026-10-14 | — | Redirect http → https for every public name (Cloudflare „Always Use HTTPS” on each customer zone, or traefik redirecting when the tunnel's `X-Forwarded-Proto` is `http`), then HSTS; a check in the box walk that every name answers 301/308 on http | CC |
 | **R-985** | Security & access | P3 | **Our zero-knowledge wording is stronger than the product: on a live box the operator can reach the off-site backup key (through the vaulted root credential and the operator tunnel) without the customer's recovery code.** Design-shaped; decision for the operator in `STATUS.md`. Fix options: change the wording, or remove operator root reach to the key. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | WAITING-ON-OPERATOR — design-proposal | operator decision | Decide the wording or the change | operator |
 | **R-983** | Security & access | P3 | **Seven small dashboard weaknesses: after sign-in the browser can be sent to another site; the server-reboot route acts on a GET, so a link can reboot the guest (**FIXED 2026-10-13 in controller v0.310.0, R-998 session: POST only, `TestServerReboot_PostOnly` — six remain**); no anti-framing headers; parallel sign-in attempts get past the limiter; the settings page allows 8-character passwords; reset-code requests have no limit on the box; logout can be triggered from another site.** Fix each with a test, in one controller release. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | One hardening release | CC |
 | **R-977** | Security & access | P3 | **FileBrowser's default password can come back if its data volume is ever re-created, because the box checks it only once; and the tunnel can start before the box is claimed.** Static; needs a live check on 9202. Fix: check at every start, and do not start the tunnel before the claim. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Measure on 9202; then fix | CC |