diff --git a/REPORT.md b/REPORT.md index 1ce1824b..54356414 100644 --- a/REPORT.md +++ b/REPORT.md @@ -1,4 +1,4 @@ -# REPORT — test-box check after a week away (2026-11-07, attended) +# REPORT — test-box check after a week away, and the old website copy retired (2026-11-07, attended) **Plain words first.** All three test boxes (N100, HP, Tester 1) run, report to the hub, and all apps are healthy. Two faults were found. demo-hp made no local whole-box copy for 9 days because its system disk was too full; CC freed @@ -21,11 +21,26 @@ it and waits for the operator's vouch and signed jobs (commands in `felhom-agent - demo-hp: whole journal saved off-git (`/mnt/5_hdd/felhom.eu/evidence/demo-hp-space-2026-11-07/`), then `journalctl --vacuum-size=500M` (freed 3.3 GB) and `pvesm free` of the 2026-08-21 archive of guest 9100: `/` 9.5 → 14 GB free; the preflight asks 12.4 GiB. Recorded under R-548. The journal will grow back (journald default cap). -- felhom-agent v0.172.1 released (not vouched) — see that repo's REPORT. +- felhom-agent v0.172.1 released; the operator vouched it and sent both signed jobs; all three boxes run it (bundle + self-check ok, capability probe 77/77). See that repo's REPORT. +- **R-1228 closed (operator yes):** DooPlex's copy of the website retired. The installer pin moved first to + `INSTALLER-TAG` (publish script + `hostinstall_gates.py` 6c, red on five mutants; dry run = the public installer's + sha256). Then a deliberate ArgoCD sync pruned exactly six objects (webpage Deployment, Service, Ingress, two + ConfigMaps, and the orphan `felhom.eu/api` Ingress — a `number: 80---` typo had glued it to the next YAML document); + live objects saved first (`/mnt/5_hdd/felhom.eu/evidence/r1228-retire-2026-11-07/`); the unused `felhom-webpage-tls` + Secret deleted. After: felhom.eu 200, `api.felhom.eu` preflight 204. +- **Security review follow-up:** the old nginx sent `X-Frame-Options: SAMEORIGIN` and `/scripts/` as `text/plain`; + Cloudflare did neither since 2026-10-30. `website/_headers` restores both; uploaded; measured from outside (both + headers present, installer sha256 unchanged `e18cdd17…`, `/_headers` itself 404). - N100 diary entry; STATUS updated (new do-list, the Tester4 item removed). **Not yet observed.** demo-hp's next local-tier try (every ~4 h) has not run since the cleanup. Positive observable: `backup: completed … target=local` in its agent journal. -**Registers.** No row opened or closed (the GRUB fault is fixed in the session, size rule). Evidence: -`documentation/audits/demo-check-2026-11-07/`. System poster: no fact changed. +**Registers.** R-1228 closed (to CLOSED-ITEMS); none opened (the GRUB fault is fixed in the session, size rule). Evidence: +`documentation/audits/demo-check-2026-11-07/`. System poster: the facts file updated (the old copy retired); the drawing refresh was already listed in STATUS. + +**Instruction files edited** (stale facts, no rule loosened): `CLAUDE.md` R-110 fence (where the tag is pinned, what +gate 6 checks), `.claude/rules/manifests.md` (section replaced: no installer in a manifest), `.claude/rules/website.md` +(the way back retired), the `felhom-build-deploy` skill (same). Why: the pin moved from `manifests/webpage.yaml` to +`INSTALLER-TAG`. diff --git a/STATUS.md b/STATUS.md index 21d8f4a9..8b1c56b6 100644 --- a/STATUS.md +++ b/STATUS.md @@ -2,7 +2,7 @@ **Ready for Tester 2? Yes — tell the friend go (`documentation/pilot/TESTER2-handover.md`).** -**Updated 2026-11-07.** CC checked the three test boxes: all run and all apps are healthy. demo-hp had no local whole-box copy for 9 days (its disk was full); CC freed space. The N100 refused its nightly Proxmox updates (a GRUB package in the wrong group); agent 0.172.1 fixes it and waits for your vouch and signed jobs. +**Updated 2026-11-07 (late).** The three test boxes run agent 0.172.1 (you vouched and signed it): the N100's nightly Proxmox updates are no longer refused, and demo-hp has space for its local whole-box copy again. DooPlex's old copy of the website is retired; the installer's version pin now lives in `INSTALLER-TAG`, and two browser headers are back on the public site. ## What works - **The Plex attack did not reach Felhom's secrets** (R-1241). @@ -25,7 +25,6 @@ ## What we work on - HTTP2Shell waiters: cal.com, Calibre-Web, RomM have no fix; SparkyFitness has one on a new main version (R-785, behind R-784). -- Retire DooPlex's old copy of the website (your yes, 2026-11-07): the installer's version pin moves out of it first (R-1228). ## Waiting on you — decide @@ -49,7 +48,7 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te 5. Ask Google to index `https://felhom.eu/sajat-felho-tarhely` in Search Console (R-1035). (since 10-14) 6. BIOS: on the N100, read „After Power Loss"; on the HP, set „Bypass F1 Prompt on Configuration Changes" to Enable. (since 10-14) 7. Pin the first Facebook post (R-917), and look at the new cover in the Facebook phone app (R-919). (since 10-12) -**2026-11-07.** 1. Vouch agent 0.172.1 (sha `505a0594…`, bundle `3e7acaee…`; `felhom-agent/CHANGELOG.md`). 2. Send each of the three test boxes two signed jobs: `agent_update` 0.172.1, then `agent_config_update` 0.172.1 (commands in `felhom-agent/REPORT.md`). If not: the N100 gets no Proxmox updates and mails `os_update_failed` every morning; all three keep the „Root files behind" warning. **2026-11-03.** To the homelab session: R-1355. +**2026-11-03.** To the homelab session: R-1355. **2026-10-30.** On the hub's Hosts page: Discard the appliance of 10:44:59 (uuid d3529d2d…) and appliance 49 (CC's proof VMs). If not: dead entries alarm. **2026-10-29 (release run).** 1. (since 10-28) Give the homelab session `audits/http2shell-2026-10-27/HOMELAB-LIST.md` (19 images, R-1328). If not: DooPlex keeps the bad runtimes. **2026-10-23 do list.** 1. Print the break-glass sheet (`documentation/runbooks/break-glass-sheet.md`, the part from „The sheet”, one A4), fill it by hand, keep it outside the home (D32; R-923, R-924). If not: after a DooPlex loss no off-site copy opens. diff --git a/documentation/backlog/CLOSED-ITEMS.md b/documentation/backlog/CLOSED-ITEMS.md index 57c31d76..de36ea21 100644 --- a/documentation/backlog/CLOSED-ITEMS.md +++ b/documentation/backlog/CLOSED-ITEMS.md @@ -26,6 +26,12 @@ --- +## 2026-11-07 — R-1228 closed: DooPlex's copy of the website retired (full text of the row: `git show 7e56d166:documentation/backlog/OPEN-ITEMS.md`) + +| Row | What | Closed | Evidence | +|---|---|---|---| +| **R-1228** | **The website, the installer script and the hub were all served from the home line — a DooPlex loss stopped new installs and the public site.** (P3) | CLOSED 2026-11-07 — the site and the installer on Cloudflare Pages since 2026-10-30 (D35); DooPlex's copy, the way back, retired on the operator's yes: the installer pin moved to `INSTALLER-TAG` (publish script + `hostinstall_gates.py` 6c, red on five mutants), then the webpage Deployment, Service, Ingress, two ConfigMaps and the orphan `felhom.eu/api` Ingress pruned by a deliberate ArgoCD sync (`c28ce7ce`), the unused `felhom-webpage-tls` Secret deleted. Two headers the old nginx sent (`X-Frame-Options`, `/scripts/` as `text/plain`) restored on Cloudflare by `website/_headers` and measured from outside; the installer's sha256 unchanged (`e18cdd17…`). **Reasoning kept:** the hub and Gitea stay on the home line by design (D35) — a new install still needs DooPlex for the claim, the config, the agent package and the golden. | live objects before removal: `/mnt/5_hdd/felhom.eu/evidence/r1228-retire-2026-11-07/` (off-git); `audits/release-2026-10-30/p3-cloudflare/` | + ## 2026-11-03 — the security night (full text of the rows: `git show HEAD~1:documentation/backlog/OPEN-ITEMS.md` at the close-out commit) | Row | What | Closed | Evidence | diff --git a/documentation/backlog/OPEN-ITEMS.md b/documentation/backlog/OPEN-ITEMS.md index e80aa283..0ed6bea2 100644 --- a/documentation/backlog/OPEN-ITEMS.md +++ b/documentation/backlog/OPEN-ITEMS.md @@ -210,7 +210,6 @@ stopping line that lies. | **R-1206** | Backup & restore | P3 | **Backups written while the box's clock ran ahead stay „the latest" after the clock is fixed.** The rehearsal's scenario #10 (clock set to 2026-10-28) left off-site snapshots dated 2026-10-28; on 2026-10-21 the rebuilt box's recovery page listed every app's „Legutóbbi mentés: 2026. 10. 28. 07:39", and the full restore said „mentés: 2026. 10. 28. 07:37" — a date in the future (`audits/fixes-2026-10-21/P1-live/07-unlock-right.txt`, `11-nextcloud-full-restore.txt`). restic orders snapshots by their own time, so the future ones are „newest" to every retention rule for a week. NOT measured: whether the box's keep-daily prune then drops a real snapshot. Related R-1202, R-1204 (clock). | NARROWED — the NAS tier only. **2026-10-22 night (read, `backup/offbox_window.go:22-24, 130-137`):** on the Felhom off-site tier no real snapshot is lost — the guard refuses a prune while any snapshot is future-dated (R-822, by design). The NAS tier prunes without that guard: open. **2026-10-25:** the kept-data choice no longer takes such a future-dated copy as the newest (R-1271, controller `bd9f4f7`); retention is unchanged — this row. | — | A pure unit test with the policy simulator on the NAS tier and one future-dated snapshot; if a real one is dropped, give the NAS tier the same guard | CC | | **R-1212** | Backup & restore | P4 | **Two household texts on the backup path do not follow the box's language:** the share-restore summary (`SharesRestoreResult.FlashMessage`, `controller/internal/backup/shares_restore.go`) is built from Hungarian Go literals, and the off-site `LastError` for an interrupted run is the Hungarian literal „megszakadt futás (a vezérlő újraindult futás közben)" (`controller/internal/backup/backup.go`). An English household reads Hungarian there. Found by the night helper 2026-10-21. | OPEN | — | Bundle keys for both (rendered in the box language when written, R-557), with parity fixtures | CC | | **R-1221** | Backup & restore | P4 | **The nightly whole-box backup starts ~1.5–5 min later each night, until one night is skipped (after ~70–80 nights with no press between).** REAL, low harm (night 2026-10-22; split from R-1189 (b)): agent `localapi/server.go:1184` is `age >= Cadence` with the age counted from the archive START; the controller polls every 5 min (`quiesce.go:150`) and the archive starts after the apps stop. Measured on demo-hp: 04:31:07 → 04:33:18 → 04:36:47 → 04:38:14, and 04:33:37 → 04:38:44 → 04:42:40. At W+6h one night is skipped (44 h is below the 48 h valve, `quiesce.go:807-818`); the hub's 26 h line (`deadline.go:29`) mails the operator. Any manual or off-cycle run resets the drift. Evidence `audits/night-2026-10-22/P3-candidates/demohp-whole-box-completions.txt`. | OPEN | — | Fix: inside the night window a tier is due at `age >= cadence - 4h`; the agent answers due-ness, so it is agent code (a unit test with an injected clock) and rides an agent release | CC | -| **R-1228** | Backup & restore | P3 | **The website, the installer script and the hub are all served from the home line — a DooPlex loss stops new installs and the public site.** DooPlex survey 2026-10-23 night (`audits/dooplex-survival-2026-10-22/PLAN.md`, G8): `felhom.eu`, `hub.felhom.eu` and `gitea.dooplex.hu` resolve to the home address; the installer fetches `felhom.eu/scripts/felhom-host-install.sh`; only the ISO (Cloudflare R2) survives. | OPEN — **2026-10-23 — D35 ruled YES, after the release week (operator):** serve the website and the installer from Cloudflare like the ISO. Dated: start on or after 2026-10-30 (DUE-CHECKS). **2026-10-30: SWITCHED** (operator yes, 10:02:35 UTC): `felhom.eu` and `www` are Cloudflare Pages (`felhom-site`, uploaded by `scripts/publish-site-cloudflare.sh`); 30 of 30 pages and the installer byte-identical to `installer-v1.36.1` from outside; a fresh install from the public ISO 1.30.0 (throwaway VM 3461 on demo-hp) fetched the installer from the test address and from `felhom.eu` and passed the preflight both times; the contact form posts to `api.felhom.eu` (DooPlex mailer, a test mail arrived). `audits/release-2026-10-30/p3-cloudflare/`. **What is left:** a new install still needs DooPlex for the hub (claim, config, first report) and Gitea (the agent package, the golden) — by design (D35); DooPlex's webpage copy runs until 2026-11-06 as the way back (DUE-CHECKS), then the operator decides to retire it. NARROWED **2026-11-07: asked, and the operator said RETIRE IT (in chat, 23:0x CET).** The copy has no visitors (`felhom.eu` resolves to Cloudflare, also from DooPlex). It is not just a Deployment to delete: `manifests/webpage.yaml` is also where the installer TAG is pinned — `publish-site-cloudflare.sh` reads it and `hostinstall_gates.py` gate 6 checks it, and the R-110 fence in `CLAUDE.md` + `.claude/rules/manifests.md` describes it. So the retirement moves the tag pin to its own home first (script + gate 6 + its decoys + the fence text), then removes the webpage Deployment, Service, Ingress, its two ConfigMaps and TLS Secret by a deliberate ArgoCD sync (FileBrowser in the same file stays). Not started at night during an agent rollout. | the operator's yes | Operator decides (STATUS): A) accept — Gitea and the hub first, the site after; B) the static site + the installer tag on Cloudflare like the ISO — CC's pick, after the release week | CC (ruled yes 2026-10-23, D35) | | **R-1229** | Backup & restore | P4 | **ArgoCD's per-app auto-sync settings live only on the cluster, not in git.** DooPlex survey 2026-10-23 night (`audits/dooplex-survival-2026-10-22/PLAN.md`, G9): the Applications differ (`enabled` true/false, prune, selfHeal); a rebuilt cluster from `homelab-manifests` would not have them. | OPEN | — | Write each Application's sync policy into `homelab-manifests` (a homelab change, the operator's yes for the commit that changes live behaviour) | operator | | **R-1231** | Backup & restore | P4 | **The recovery page says the box's host service is „older” when the controller only cannot tell.** Test night 2026-10-23 (`P4-testnight/07a-unlock-refused-fixture-version.txt`): with the agent's capability `unknown` (a version string it could not compare), the page read „…a hozzá tartozó házon belüli szolgáltatás régebbi… A gép magától frissül”. The same page is reached by a merely-down agent, for which „older” and „updates itself” are not true. | OPEN | — | A separate sentence for `unknown` („a gép most nem éri el a házon belüli szolgáltatást — próbáld újra pár perc múlva”); a render test per state; rides a controller release | CC | | **R-1235** | Backup & restore | P3 | **The release copy on ep0 (D33) is proven to load, not yet to restore a registry — and it follows the newest versions, not the ones the fleet needs.** Built 2026-10-23 (`scripts/release-copy/`, `audits/day-2026-10-23/08-release-copy-D33.txt`). (a) `total-loss-of-dooplex.md` „Restore the release copy” steps 2 (skopeo push back, same digest) and 3 (agent packages back) were never walked into a real new registry — only a `docker load` on 9202. (b) The copy keeps the newest 3 image tags and 5 agent versions; it does not ask the hub for the floor and the vouched agent and always include them — a vouch more than 5 releases behind would fall out. (c) The golden (`felhom-golden`, 637 MB for 0.331.0) is not copied: a new install after a DooPlex loss needs it (the brief named images + agent packages only; one golden fits under the 3 GB cap). | OPEN | — | (a) a throwaway registry on demo-hp, push one tag back, compare digests; (b) read `/configuration`'s floor + vouched agent; (c) the operator says whether the golden goes in | CC | diff --git a/documentation/backlog/STATUS-HISTORY.md b/documentation/backlog/STATUS-HISTORY.md index e6d7603d..67836561 100644 --- a/documentation/backlog/STATUS-HISTORY.md +++ b/documentation/backlog/STATUS-HISTORY.md @@ -7,6 +7,8 @@ Moved here byte for byte on 2026-10-14 (night session), newest first, so that `S ## Moved from STATUS on 2026-11-07 +**Updated 2026-11-07.** CC checked the three test boxes: all run and all apps are healthy. demo-hp had no local whole-box copy for 9 days (its disk was full); CC freed space. The N100 refused its nightly Proxmox updates (a GRUB package in the wrong group); agent 0.172.1 fixes it and waits for your vouch and signed jobs. + **Updated 2026-11-03.** Every box runs controller 0.350.0 with Traefik v3.7.17; the hole is closed, proven on the scratch box. Golden 0.350.0 and agent 0.172.0 are vouched (10:18 CET), hub 0.179.0 is live, and Paperless 3, n8n 3, Mealie and Termix are offered. ## Moved from STATUS on 2026-11-03