Security app updates 2026-10-27: 14 security-fix steps + 2 normal steps live (catalog 06e603e, 7b0071e, 65a6b11); controller v0.346.1 (traefik, file manager, cloudflared) floor set; R-1304 and R-1306 CLOSED, R-1305 NARROWED; R-1313, R-1315–R-1325 filed (big steps left, three observations); 09 decision 255 and B23: the batch use of the lane; evidence
This commit is contained in:
admin committed
1 parent
7c75162a18
commit
7610f69e7c
69 files changed
+7530
-10
No files matched your search
@@ -124,7 +124,7 @@
|
||||
| <a id="b20"></a>[B20](capability-map-detail/B.md#b20) | App crashes → customer notified (one event per transition, no flapping spam) | controller v0.120, hub v0.48 | **IMPLEMENTED** | crash→customer mail never live-confirmed | `audits/CAMPAIGN-3-2026-07-11.md` (2026-07-11) |
|
||||
| <a id="b21"></a>[B21](capability-map-detail/B.md#b21) | Post-deploy optional config (API keys etc.) with restart | controller, catalog `.felhom.yml` | **IMPLEMENTED** | config-save + restart in no campaign | `tests/CAMPAIGN-2-2026-07-07.md` (2026-07-07) |
|
||||
| <a id="b22"></a>[B22](capability-map-detail/B.md#b22) | Backup classification: 13 bind-bearing apps carry mandatory/optional/excluded classes | catalog, controller v0.132–133 | **PROVEN-LIVE** | — | `audits/SPIKE-backup-classification-2026-07-14.md` (2026-07-14); `audits/CAMPAIGN-6D-2026-07-15.md` (2026-07-15) |
|
||||
| <a id="b23"></a>[B23](capability-map-detail/B.md#b23) | An urgent security fix reaches the boxes at night — a `security_fix` ladder step (box walk required, bench optional, a CVE/GHSA notice), taken by the night update (`09` §3 decision 255, D39 = B) | catalog `3898593`, controller v0.341.0 | **PROVEN-LIVE** | scratch 9202 (drill catalog), Plex 1.43.4 → 1.43.5; an app with no box fixture is checked by health, version and a soak only (`seed: none`) | `audits/security-lane-2026-10-23/` (2026-10-23) |
|
||||
| <a id="b23"></a>[B23](capability-map-detail/B.md#b23) | An urgent security fix reaches the boxes at night — a `security_fix` ladder step (box walk required, bench optional, a CVE/GHSA notice), taken by the night update (`09` §3 decision 255, D39 = B) | catalog `3898593`, controller v0.341.0 | **PROVEN-LIVE** | scratch 9202 (drill catalog), Plex 1.43.4 → 1.43.5; an app with no box fixture is checked by health, version and a soak only (`seed: none`) | `audits/security-lane-2026-10-23/` (2026-10-23); batch use: `audits/security-app-updates-2026-10-27/` (2026-10-27, 14 steps live) |
|
||||
|
||||
## C. Protection & recovery (the product promise)
|
||||
|
||||
|
||||
@@ -1098,6 +1098,19 @@ its length, and both fixes cost something the household would notice — operato
|
||||
night leg logged `plex: skipped — not_proven` and a hand press took the step; on 0.341.0-rc.1 the night leg logged
|
||||
`plex: security fix CVE-2026-96652,CVE-2026-96654,CVE-2026-96655,CVE-2026-96656 taken` and ended `done` in 30.1 s
|
||||
after the update's second-drive copy and undo copy. Released as controller 0.341.0, global floor 11:24 UTC.
|
||||
**Batch use, 2026-10-27 (the lane's first live use, `audits/security-app-updates-2026-10-27/`):** the security
|
||||
watch (R-1303) flagged 38 pins; a hand triage put 15 apps in the lane. One negative control first (TO
|
||||
`busybox:1.36.1` → `failed`, undone), then walks on 9202 three at a time, each written to the drill, then **a STOP
|
||||
per batch of about five** before the live catalog: batch 1 `06e603e` (rallly, romm, code-server, outline, vikunja),
|
||||
batch 2 `7b0071e` (n8n, privatebin, docmost, grafana), batch 3 `65a6b11` (homebox, mealie, audiobookshelf,
|
||||
bentopdf, uptime-kuma) — 14 steps, 12 with the seed read back after the update, 2 `seed: none` (code-server: no
|
||||
script route; bentopdf: no data). Two notices with no CVE/GHSA id (wishlist's critical account takeover,
|
||||
bookstack's two leaks) could not use the lane and went as NORMAL steps (bench 9401 + box) in the same batches.
|
||||
**What the batch use taught:** (a) a walk can be `inconclusive` because the FIXTURE is stale, not the step — four
|
||||
were (Rallly 4.15's code-only sign-in, Jellyfin 10.11's wizard, Homebox 0.26's entities API, Mealie's generated
|
||||
admin password); each was fixed and the walk run again; (b) three walks at a time on 9202 (25 GiB) kept every soak
|
||||
clean; (c) a one-step-per-app lane stops below a fix that needs a NEW main version — those stay big steps with a
|
||||
row each (R-1311, R-1313–R-1322).
|
||||
|
||||
### 2026-10-26 (night brief) — D55: demo-hp's one clean-up window gets a cap of 260
|
||||
|
||||
|
||||
@@ -409,4 +409,10 @@ a hand press took the step; on 0.341.0-rc.1 the night leg logged `plex: security
|
||||
**Gap:** an app with no box fixture (Plex today, R-1238) is checked only by health, version and the soak — no data is
|
||||
read back. `files_may_change` is a bench measurement and reads `false` when no bench ran (decision 255 item 7).
|
||||
|
||||
**Batch use (2026-10-27, `audits/security-app-updates-2026-10-27/`):** 14 security-fix steps in three batches, each
|
||||
pushed live after the operator's yes at a batch STOP (catalog `06e603e`, `7b0071e`, `65a6b11`); 12 read the seed back
|
||||
after the update, 2 are `seed: none`. demo-hp's 9201 read `06e603e` at once and holds RomM's step for its night leg
|
||||
(`live-readback-batch1-9201.txt`). Notices with no CVE/GHSA id go as normal steps in the same batches (wishlist,
|
||||
bookstack). Four stale fixtures were found and fixed by the walks' `inconclusive` C1 (`09` decision 255, batch note).
|
||||
|
||||
---
|
||||
@@ -0,0 +1,7 @@
|
||||
# Batch 1 live read-back on demo-hp 9201 (read only; the other session's yes 2026-10-27). 2026-10-27T14:12:27Z
|
||||
catalog cache: 06e603e88d45f94c2b2723db45a240dea69faca6 2026-10-27 15:05:13 +0100
|
||||
romm running: rommapp/romm:5.3.1
|
||||
security_fix entries in the cached romm .felhom.yml: 1
|
||||
cached romm compose image: rommapp/romm:5.4.1
|
||||
app_update.unattended saved anywhere: 0 file(s) — absent means ON (settings.go:210)
|
||||
Expected tonight: the night leg (after the off-site copy) takes romm 5.3.1 -> 5.4.1 and logs '[security fix romm: GHSA-…,… done]' in its 'update leg (…)' line.
|
||||
@@ -0,0 +1,7 @@
|
||||
# 9202 AFTER (0.346.1-rc.1), 2026-10-27T14:58:26Z
|
||||
images: traefik=traefik:v3.7.16 filebrowser=gtstef/filebrowser:1.5.8-stable cloudflared=
|
||||
none
|
||||
filebrowser networks: felhom-filebrowser felhom-files
|
||||
from traefik-public -> filebrowser:80 (by name): wget: bad address 'filebrowser:80' rc=0
|
||||
from traefik-public -> filebrowser by IP 172.21.0.2: wget: download timed out rc=0
|
||||
CONTROL from traefik-public -> traefik:80: HTTP/1.1 301 Moved Permanently rc=0
|
||||
@@ -0,0 +1,7 @@
|
||||
# 9202 BEFORE (controller 0.343.0), 2026-10-27T14:57:46Z
|
||||
images: traefik=traefik:v3.7.13 filebrowser=gtstef/filebrowser:1.5.6-stable cloudflared=
|
||||
none
|
||||
filebrowser networks: felhom-filebrowser traefik-public
|
||||
from traefik-public -> filebrowser:80 (by name): HTTP/1.1 200 OK rc=0
|
||||
from traefik-public -> filebrowser by IP 172.21.0.2: wget: download timed out rc=0
|
||||
CONTROL from traefik-public -> traefik:80: HTTP/1.1 301 Moved Permanently rc=0
|
||||
@@ -0,0 +1,4 @@
|
||||
1. dashboard /__files/open -> HTTP/2 302 | to files host: True
|
||||
2. files host /_felhom/sso -> HTTP/2 302 | files cookie set: True
|
||||
3. a listing through traefik with the files cookie -> 200
|
||||
4. the same without any cookie (control) -> 401
|
||||
@@ -0,0 +1,15 @@
|
||||
filebrowser gtstef/filebrowser:1.5.8-stable Up 2 seconds (health: starting)
|
||||
traefik traefik:v3.7.16 Up 5 seconds
|
||||
felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.346.1-rc.1 Up 14 seconds (healthy)
|
||||
2026/10/27 14:58:06 manager.go:680: [DEBUG] [stacks] ScanStacks: found stack "filebrowser" deployed=false composePath=/opt/docker/stacks/filebrowser/docker-compose.yml
|
||||
2026/10/27 14:58:06 infra.go:147: [INFO] [infra] traefik config changed (docker-compose.yml, tunnel trust true) — rewriting and recreating traefik (routing pauses a few seconds)
|
||||
2026/10/27 14:58:06 dbdump.go:171: [DEBUG] DiscoverDatabases: skipping container filebrowser (image=gtstef/filebrowser:1.5.6-stable, not a database)
|
||||
2026/10/27 14:58:06 manager.go:680: [DEBUG] [stacks] ScanStacks: found stack "filebrowser" deployed=false composePath=/opt/docker/stacks/filebrowser/docker-compose.yml
|
||||
2026/10/27 14:58:06 manager.go:258: [DEBUG] [integrations] ReapplyConfigForTarget: target=filebrowser integrations=0
|
||||
2026/10/27 14:58:15 infra.go:378: [INFO] [infra] connected felhom-controller to traefik-public
|
||||
2026/10/27 14:58:15 infra.go:97: [INFO] [infra] cloudflared skipped — no cf_tunnel_token configured (LAN-only node)
|
||||
2026/10/27 14:58:15 filebrowser_gate.go:70: [INFO] [infra] connected felhom-controller to felhom-filebrowser (the FileBrowser default-login check, R-1126)
|
||||
2026/10/27 14:58:17 filebrowser_gate.go:101: [INFO] [infra] filebrowser: traefik joined felhom-files — the only route to FileBrowser (R-1281)
|
||||
2026/10/27 14:58:17 filebrowser_gate.go:108: [INFO] [infra] filebrowser: default login refused for this run — joined felhom-files, files.<domain> served (R-1126, R-1281)
|
||||
2026/10/27 14:58:17 filebrowser_gate.go:112: [WARN] [infra] filebrowser: could not leave traefik-public — every app can still reach it (R-1281): Error response from daemon: No such container: 503e946085d8f32ed26e1134778f7a9d02d3d75c67cda5ebfb7629da3a173f54: exit status 1
|
||||
2026/10/27 14:58:20 filebrowser_gate.go:108: [INFO] [infra] filebrowser: default login refused for this run — joined felhom-files, files.<domain> served (R-1126, R-1281)
|
||||
@@ -0,0 +1,15 @@
|
||||
2026/10/27 15:41:26 [INFO] [selfupdate] Post-update startup: update successful (0.346.0 → 0.346.1)
|
||||
2026/10/27 15:41:26 [INFO] [scheduler] Registered periodic job: selfupdate-check (every 6h0m0s)
|
||||
2026/10/27 15:41:26 [INFO] [infra] traefik config changed (docker-compose.yml, tunnel trust true) — rewriting and recreating traefik (routing pauses a few seconds)
|
||||
2026/10/27 15:41:33 [INFO] [infra] connected felhom-controller to traefik-public
|
||||
2026/10/27 15:41:33 [INFO] [infra] cloudflared compose changed (tunnel network true) — recreating cloudflared (the tunnel reconnects in seconds)
|
||||
2026/10/27 15:41:36 [INFO] [infra] connected felhom-controller to felhom-filebrowser (the FileBrowser default-login check, R-1126)
|
||||
2026/10/27 15:41:36 [INFO] [infra] filebrowser: traefik joined felhom-files — the only route to FileBrowser (R-1281)
|
||||
2026/10/27 15:41:37 [INFO] [infra] filebrowser: default login refused for this run — joined felhom-files, files.<domain> served (R-1126, R-1281)
|
||||
-- cloudflared (new container) first lines:
|
||||
2026-10-27T15:41:36Z INF Starting tunnel tunnelID=8b4edf48-1846-4484-870e-68b48cf43483
|
||||
2026-10-27T15:41:37Z INF Registered tunnel connection connIndex=0 connection=8eb9754f-ff0d-4134-925b-769d0f95002a event=0 ip=198.41.192.37 location=bud01 protocol=quic
|
||||
2026-10-27T15:41:37Z INF Registered tunnel connection connIndex=1 connection=7d303a85-782a-4edd-9c77-7d1b3003235a event=0 ip=198.41.200.233 location=vie05 protocol=quic
|
||||
2026-10-27T15:41:38Z INF Registered tunnel connection connIndex=2 connection=316aa0f8-4472-40f2-90ff-1d08da5d1be2 event=0 ip=198.41.200.33 location=vie05 protocol=quic
|
||||
2026-10-27T15:41:39Z INF Registered tunnel connection connIndex=3 connection=3ef8334c-383c-4ccc-91bd-578675e88372 event=0 ip=198.41.192.67 location=bud01 protocol=quic
|
||||
-- cloudflared StartedAt: 2026-10-27T15:41:36.543853737Z traefik StartedAt: 2026-10-27T15:41:32.861698806Z
|
||||
@@ -0,0 +1,16 @@
|
||||
2026/10/27 15:41:31 updater.go:855: [INFO] [selfupdate] Post-update startup: update successful (0.346.0 → 0.346.1)
|
||||
2026/10/27 15:41:31 scheduler.go:120: [INFO] [scheduler] Registered periodic job: selfupdate-check (every 6h0m0s)
|
||||
2026/10/27 15:41:31 infra.go:147: [INFO] [infra] traefik config changed (docker-compose.yml, tunnel trust true) — rewriting and recreating traefik (routing pauses a few seconds)
|
||||
2026/10/27 15:41:52 infra.go:378: [INFO] [infra] connected felhom-controller to traefik-public
|
||||
2026/10/27 15:41:52 infra.go:188: [INFO] [infra] cloudflared compose changed (tunnel network true) — recreating cloudflared (the tunnel reconnects in seconds)
|
||||
2026/10/27 15:41:56 filebrowser_gate.go:70: [INFO] [infra] connected felhom-controller to felhom-filebrowser (the FileBrowser default-login check, R-1126)
|
||||
2026/10/27 15:41:58 filebrowser_gate.go:101: [INFO] [infra] filebrowser: traefik joined felhom-files — the only route to FileBrowser (R-1281)
|
||||
2026/10/27 15:41:58 filebrowser_gate.go:108: [INFO] [infra] filebrowser: default login refused for this run — joined felhom-files, files.<domain> served (R-1126, R-1281)
|
||||
2026/10/27 15:42:06 updater.go:196: [INFO] [selfupdate] Current version 0.346.1 is up to date
|
||||
-- cloudflared (new container) first lines:
|
||||
2026-10-27T15:41:55Z INF Starting tunnel tunnelID=d7a3c848-d754-46ce-a1c1-ca6bc7a81775
|
||||
2026-10-27T15:41:56Z INF Registered tunnel connection connIndex=0 connection=678ca6cf-b165-46bb-8385-1ab98028776c event=0 ip=198.41.200.53 location=vie05 protocol=quic
|
||||
2026-10-27T15:41:57Z INF Registered tunnel connection connIndex=1 connection=abfcb8da-5e7f-4176-9451-b9b71389ba07 event=0 ip=198.41.192.7 location=bud01 protocol=quic
|
||||
2026-10-27T15:41:57Z INF Registered tunnel connection connIndex=2 connection=873f8fcf-a8eb-464c-9298-7ab0732b44e3 event=0 ip=198.41.192.167 location=bud01 protocol=quic
|
||||
2026-10-27T15:41:58Z INF Registered tunnel connection connIndex=3 connection=a9d19736-d544-48bc-8583-a086e27fed66 event=0 ip=198.41.200.13 location=vie05 protocol=quic
|
||||
-- cloudflared StartedAt: 2026-10-27T15:41:55.714288153Z traefik StartedAt: 2026-10-27T15:41:51.786522796Z
|
||||
@@ -0,0 +1,12 @@
|
||||
setting is independent of the Day-0 artifact manifest below. Effective floor: v0.346.1 — source: DB (hub_settings) ; env fallback would be v0.120.0 Save global floor…
|
||||
DB override: v0.346.1 … Type the version again to confirm (or CLEAR to remove the DB override): Confi
|
||||
rtifact. Agent — none — 0.167.0 0.166.0 0.165.0 0.164.0 0.163.0 0.162.0 0.161.0 0.158.1 Golden — none — 0.344.0 0.331.0 0.329.0 0.318.0 0.313.0 0.312.0 0.311.0 Min age
|
||||
0.165.0 0.164.0 0.163.0 0.162.0 0.161.0 0.158.1 Golden — none — 0.344.0 0.331.0 0.329.0 0.318.0 0.313.0 0.312.0 0.311.0 Min agent The golden's controller CHANGELOG MinAgent: . The hub HOLDS the floor for any box whose agent is below this — blank = u
|
||||
2026/10/27 16:41:19 [INFO] Customer tester-1 controller-version floor override set to "0.346.1" (declared MinAgent "0.158.1")
|
||||
2026/10/27 16:41:19 [INFO] access token "cc-releases-2": POST /customers/tester-1/floor → 303
|
||||
2026/10/27 16:41:19 [INFO] Customer demo-hp controller-version floor override set to "0.346.1" (declared MinAgent "0.158.1")
|
||||
2026/10/27 16:41:19 [INFO] access token "cc-releases-2": POST /customers/demo-hp/floor → 303
|
||||
2026/10/27 16:41:19 [INFO] Customer demo-felhom controller-version floor override set to "0.346.1" (declared MinAgent "0.158.1")
|
||||
2026/10/27 16:41:19 [INFO] access token "cc-releases-2": POST /customers/demo-felhom/floor → 303
|
||||
2026/10/27 16:50:15 [INFO] Global controller-version floor set to "0.346.1" (declared MinAgent "0.158.1")
|
||||
2026/10/27 16:50:15 [INFO] access token "cc-releases-2": POST /configuration/global-floor → 303
|
||||
@@ -0,0 +1,3 @@
|
||||
== global floor 2026-10-27T15:50:15Z (operator's yes at the STOP)
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /configuration?flash=floor_set
|
||||
@@ -0,0 +1,34 @@
|
||||
control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -)
|
||||
== tester-1 (enkicsifelhom.hu): 6 public name(s)
|
||||
OK control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1
|
||||
== demo-hp (enkisfelhom.hu): 15 public name(s)
|
||||
OK http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://time.enkisfelhom.hu/r1033-check?q=1 -> 301 https://time.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1
|
||||
== demo-felhom (demo-felhom.eu): 8 public name(s)
|
||||
OK http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1
|
||||
== every public name redirects http -> https
|
||||
@@ -0,0 +1,9 @@
|
||||
== tester-1 2026-10-27T15:41:19Z
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /customers/tester-1?flash=floor_set
|
||||
== demo-hp 2026-10-27T15:41:19Z
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /customers/demo-hp?flash=floor_set
|
||||
== demo-felhom 2026-10-27T15:41:19Z
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /customers/demo-felhom?flash=floor_set
|
||||
@@ -0,0 +1,21 @@
|
||||
# tester-1 2026-10-27T15:44:39Z
|
||||
images: traefik=traefik:v3.7.16 filebrowser=gtstef/filebrowser:1.5.8-stable cloudflared=cloudflare/cloudflared:2026.10.4
|
||||
filebrowser networks: felhom-filebrowser felhom-files
|
||||
from traefik-public -> filebrowser:80 (by name): wget: bad address 'filebrowser:80' rc=0
|
||||
from traefik-public -> filebrowser by IP 172.21.0.2: wget: download timed out rc=0
|
||||
CONTROL from traefik-public -> traefik:80: HTTP/1.1 301 Moved Permanently rc=0
|
||||
# demo-hp 9201 2026-10-27T15:44:47Z
|
||||
images: traefik=traefik:v3.7.16 filebrowser=gtstef/filebrowser:1.5.8-stable cloudflared=cloudflare/cloudflared:2026.10.4
|
||||
filebrowser networks: felhom-filebrowser felhom-files
|
||||
from traefik-public -> filebrowser:80 (by name): wget: bad address 'filebrowser:80' rc=0
|
||||
from traefik-public -> filebrowser by IP 172.24.0.2: wget: download timed out rc=0
|
||||
CONTROL from traefik-public -> traefik:80: HTTP/1.1 301 Moved Permanently rc=0
|
||||
# demo-felhom 9201 2026-10-27T15:44:55Z
|
||||
images: traefik=traefik:v3.7.16 filebrowser=gtstef/filebrowser:1.5.8-stable cloudflared=cloudflare/cloudflared:2026.10.4
|
||||
filebrowser networks: felhom-filebrowser felhom-files
|
||||
from traefik-public -> filebrowser:80 (by name): wget: bad address 'filebrowser:80' rc=0
|
||||
from traefik-public -> filebrowser by IP 172.19.0.2: wget: download timed out rc=0
|
||||
CONTROL from traefik-public -> traefik:80: HTTP/1.1 301 Moved Permanently rc=0
|
||||
https://files.enkicsifelhom.hu/ -> 200 <title>"FileBrowser Quantum"
|
||||
https://files.enkisfelhom.hu/ -> 200 <title>"FileBrowser Quantum"
|
||||
https://files.demo-felhom.eu/ -> 200 <title>"FileBrowser Quantum"
|
||||
@@ -0,0 +1,4 @@
|
||||
1. dashboard /__files/open -> HTTP/2 302 | to files host: True
|
||||
2. files host /_felhom/sso -> HTTP/2 302 | files cookie set: True
|
||||
3. a listing through traefik with the files cookie -> 200
|
||||
4. the same without any cookie (control) -> 401
|
||||
@@ -0,0 +1,14 @@
|
||||
2026/10/27 15:41:33 [INFO] [selfupdate] Post-update startup: update successful (0.346.0 → 0.346.1)
|
||||
2026/10/27 15:41:33 [INFO] [scheduler] Registered periodic job: selfupdate-check (every 6h0m0s)
|
||||
2026/10/27 15:41:33 [INFO] [infra] traefik config changed (docker-compose.yml, tunnel trust true) — rewriting and recreating traefik (routing pauses a few seconds)
|
||||
2026/10/27 15:41:47 [INFO] [infra] connected felhom-controller to traefik-public
|
||||
2026/10/27 15:41:47 [INFO] [infra] cloudflared compose changed (tunnel network true) — recreating cloudflared (the tunnel reconnects in seconds)
|
||||
2026/10/27 15:41:52 [INFO] [infra] connected felhom-controller to felhom-filebrowser (the FileBrowser default-login check, R-1126)
|
||||
2026/10/27 15:41:52 [INFO] [infra] filebrowser: traefik joined felhom-files — the only route to FileBrowser (R-1281)
|
||||
2026/10/27 15:41:52 [INFO] [infra] filebrowser: default login refused for this run — joined felhom-files, files.<domain> served (R-1126, R-1281)
|
||||
2026/10/27 15:42:05 [INFO] [selfupdate] Current version 0.346.1 is up to date
|
||||
-- cloudflared:
|
||||
2026-10-27T15:41:52Z INF Starting tunnel tunnelID=52d0c214-b833-477c-86d8-f787d9b550dd
|
||||
2026-10-27T15:41:52Z INF Registered tunnel connection connIndex=0 connection=9620f255-82f6-4233-ae47-8c852baa748a event=0 ip=198.41.200.193 location=vie05 protocol=quic
|
||||
2026-10-27T15:41:52Z INF Registered tunnel connection connIndex=1 connection=d6b75d06-cfa8-4a92-b669-3ed2f9a66816 event=0 ip=198.41.192.67 location=bud01 protocol=quic
|
||||
-- cloudflared StartedAt: 2026-10-27T15:41:51.942094496Z traefik StartedAt: 2026-10-27T15:41:47.240479453Z
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
#!/bin/bash
|
||||
# r1281probe.sh — run INSIDE a guest (pct exec <vmid> -- bash -s < r1281probe.sh). R-1281: an app container on
|
||||
# traefik-public must NOT reach the file manager; the control (same image, same network, same wget) reaches traefik.
|
||||
# The throwaway client is the box's own traefik image (busybox wget), `--rm`, on traefik-public. Prints codes only.
|
||||
img=$(docker inspect -f '{{.Config.Image}}' traefik)
|
||||
fbip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}} {{end}}' filebrowser | awk '{print $1}')
|
||||
echo "images: traefik=$img filebrowser=$(docker inspect -f '{{.Config.Image}}' filebrowser) cloudflared=$(docker inspect -f '{{.Config.Image}}' cloudflared 2>/dev/null || echo none)"
|
||||
echo "filebrowser networks: $(docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} {{end}}' filebrowser)"
|
||||
t() { docker run --rm --network traefik-public --entrypoint sh "$img" -c "wget -q -T 5 -O /dev/null -S '$1' 2>&1 | head -1 | tr -d '\r' ; echo rc=\$?" 2>&1 | tr '\n' ' '; }
|
||||
echo "from traefik-public -> filebrowser:80 (by name): $(t http://filebrowser:80/)"
|
||||
echo "from traefik-public -> filebrowser by IP $fbip: $(t http://$fbip:80/)"
|
||||
echo "CONTROL from traefik-public -> traefik:80: $(t http://traefik:80/)"
|
||||
+5
@@ -0,0 +1,5 @@
|
||||
#!/bin/bash
|
||||
# tunnelprobe.sh <url> <seconds> — one GET per second through the PUBLIC path (Cloudflare → the box's tunnel); prints
|
||||
# "HH:MM:SS code". The gap is the run of codes that are not the name's normal answer (530/502/000 = tunnel away).
|
||||
u=$1; n=$2
|
||||
for i in $(seq 1 "$n"); do printf '%s %s\n' "$(date -u +%T)" "$(curl -s -o /dev/null -m 3 -w '%{http_code}' "$u")"; sleep 1; done
|
||||
+1500
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,72 @@
|
||||
== 15:51:19
|
||||
Tester-2 DOWN 0.292.0
|
||||
Tester4 DOWN 0.345.1
|
||||
demo-felhom OK 0.346.1
|
||||
demo-hp OK 0.346.1
|
||||
tester-1 OK 0.346.1
|
||||
https://paste.enkicsifelhom.hu/ 200
|
||||
https://paste.enkisfelhom.hu/ 200
|
||||
https://felhom.demo-felhom.eu/ 302
|
||||
https://files.enkicsifelhom.hu/ 200
|
||||
https://files.enkisfelhom.hu/ 200
|
||||
https://files.demo-felhom.eu/ 200
|
||||
== 15:56:20
|
||||
Tester-2 DOWN 0.292.0
|
||||
Tester4 DOWN 0.345.1
|
||||
demo-felhom OK 0.346.1
|
||||
demo-hp OK 0.346.1
|
||||
tester-1 OK 0.346.1
|
||||
https://paste.enkicsifelhom.hu/ 200
|
||||
https://paste.enkisfelhom.hu/ 200
|
||||
https://felhom.demo-felhom.eu/ 302
|
||||
https://files.enkicsifelhom.hu/ 200
|
||||
https://files.enkisfelhom.hu/ 200
|
||||
https://files.demo-felhom.eu/ 200
|
||||
== 16:01:21
|
||||
Tester-2 DOWN 0.292.0
|
||||
Tester4 DOWN 0.345.1
|
||||
demo-felhom OK 0.346.1
|
||||
demo-hp OK 0.346.1
|
||||
tester-1 OK 0.346.1
|
||||
https://paste.enkicsifelhom.hu/ 200
|
||||
https://paste.enkisfelhom.hu/ 200
|
||||
https://felhom.demo-felhom.eu/ 302
|
||||
https://files.enkicsifelhom.hu/ 200
|
||||
https://files.enkisfelhom.hu/ 200
|
||||
https://files.demo-felhom.eu/ 200
|
||||
== 16:06:23
|
||||
Tester-2 DOWN 0.292.0
|
||||
Tester4 DOWN 0.345.1
|
||||
demo-felhom OK 0.346.1
|
||||
demo-hp OK 0.346.1
|
||||
tester-1 OK 0.346.1
|
||||
https://paste.enkicsifelhom.hu/ 200
|
||||
https://paste.enkisfelhom.hu/ 200
|
||||
https://felhom.demo-felhom.eu/ 302
|
||||
https://files.enkicsifelhom.hu/ 200
|
||||
https://files.enkisfelhom.hu/ 200
|
||||
https://files.demo-felhom.eu/ 200
|
||||
== 16:11:24
|
||||
Tester-2 DOWN 0.292.0
|
||||
Tester4 DOWN 0.345.1
|
||||
demo-felhom OK 0.346.1
|
||||
demo-hp OK 0.346.1
|
||||
tester-1 OK 0.346.1
|
||||
https://paste.enkicsifelhom.hu/ 200
|
||||
https://paste.enkisfelhom.hu/ 200
|
||||
https://felhom.demo-felhom.eu/ 302
|
||||
https://files.enkicsifelhom.hu/ 200
|
||||
https://files.enkisfelhom.hu/ 200
|
||||
https://files.demo-felhom.eu/ 200
|
||||
== 16:16:26
|
||||
Tester-2 DOWN 0.292.0
|
||||
Tester4 DOWN 0.345.1
|
||||
demo-felhom OK 0.346.1
|
||||
demo-hp OK 0.346.1
|
||||
tester-1 OK 0.346.1
|
||||
https://paste.enkicsifelhom.hu/ 200
|
||||
https://paste.enkisfelhom.hu/ 200
|
||||
https://felhom.demo-felhom.eu/ 302
|
||||
https://files.enkicsifelhom.hu/ 200
|
||||
https://files.enkisfelhom.hu/ 200
|
||||
https://files.demo-felhom.eu/ 200
|
||||
+46
@@ -0,0 +1,46 @@
|
||||
{
|
||||
"app": "homebox",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "inconclusive",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.26.2"
|
||||
},
|
||||
"to": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.27.1"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.26.2"
|
||||
},
|
||||
"installed_images": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.26.2"
|
||||
},
|
||||
"catalog_images": null,
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/sysadminsmedia/homebox:0.26.2"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"homebox ghcr.io/sysadminsmedia/homebox:0.26.2 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "401",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"why": "C1: the fixture could not seed and read back before the update",
|
||||
"log": [
|
||||
"14:51:49 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"14:52:09 [1] deployed, controller state=running, pinned={'homebox': 'ghcr.io/sysadminsmedia/homebox:0.26.2'}",
|
||||
"14:52:09 gate: homebox is gated — passed as the household (cookie set)",
|
||||
"14:52:12 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}",
|
||||
"14:52:13 homebox: create location -> 404 404 page not found\n"
|
||||
]
|
||||
}
|
||||
+11
@@ -0,0 +1,11 @@
|
||||
14:51:49 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
14:52:09 [1] deployed, controller state=running, pinned={'homebox': 'ghcr.io/sysadminsmedia/homebox:0.26.2'}
|
||||
14:52:09 gate: homebox is gated — passed as the household (cookie set)
|
||||
14:52:12 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}
|
||||
14:52:13 homebox: create location -> 404 404 page not found
|
||||
|
||||
14:52:13 [9] verdict inconclusive -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/homebox/verdict.json
|
||||
14:52:13 RESULT inconclusive — C1: the fixture could not seed and read back before the update
|
||||
14:52:13 [X] stop -> 200 {'ok': True, 'message': 'Stack homebox stop completed'}
|
||||
14:52:45 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'homebox', 'volumes_removed': ['homebox_homebox_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alk
|
||||
14:52:53 [X] after remove: deployed=False leftovers=''
|
||||
+47
@@ -0,0 +1,47 @@
|
||||
{
|
||||
"app": "mealie",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "inconclusive",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.28.0"
|
||||
},
|
||||
"to": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.29.0"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.28.0"
|
||||
},
|
||||
"installed_images": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.28.0"
|
||||
},
|
||||
"catalog_images": null,
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/mealie-recipes/mealie:v3.28.0@sha256:8b02290f4d1806f02acac6f25f6d48a3c965612fda1f8e914d5af533276f8688"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"mealie ghcr.io/mealie-recipes/mealie:v3.28.0@sha256:8b02290f4d1806f02acac6f25f6d48a3c965612fda1f8e914d5af533276f8688 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "200",
|
||||
"redirect": null
|
||||
},
|
||||
"script": {
|
||||
"status": "200",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"why": "C1: the fixture could not seed and read back before the update",
|
||||
"log": [
|
||||
"15:17:18 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['ADMIN_PASSWORD']",
|
||||
"15:17:18 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"15:18:29 [1] deployed, controller state=running, pinned={'mealie': 'ghcr.io/mealie-recipes/mealie:v3.28.0'}",
|
||||
"15:18:29 gate: recipes is gated — passed as the household (cookie set)",
|
||||
"15:18:34 [2] setup gate as installed: {'browser': {'status': '200', 'redirect': None}, 'script': {'status': '200', 'redirect': None}}",
|
||||
"15:18:35 mealie: could not authenticate as the first-run admin :: http=401 {\"detail\":\"Unauthorized\"}"
|
||||
]
|
||||
}
|
||||
+11
@@ -0,0 +1,11 @@
|
||||
15:17:18 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['ADMIN_PASSWORD']
|
||||
15:17:18 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
15:18:29 [1] deployed, controller state=running, pinned={'mealie': 'ghcr.io/mealie-recipes/mealie:v3.28.0'}
|
||||
15:18:29 gate: recipes is gated — passed as the household (cookie set)
|
||||
15:18:34 [2] setup gate as installed: {'browser': {'status': '200', 'redirect': None}, 'script': {'status': '200', 'redirect': None}}
|
||||
15:18:35 mealie: could not authenticate as the first-run admin :: http=401 {"detail":"Unauthorized"}
|
||||
15:18:35 [9] verdict inconclusive -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/mealie/verdict.json
|
||||
15:18:35 RESULT inconclusive — C1: the fixture could not seed and read back before the update
|
||||
15:18:37 [X] stop -> 200 {'ok': True, 'message': 'Stack mealie stop completed'}
|
||||
15:19:09 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'mealie', 'volumes_removed': ['mealie_mealie_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalm
|
||||
15:19:17 [X] after remove: deployed=False leftovers=''
|
||||
+222
@@ -0,0 +1,222 @@
|
||||
{
|
||||
"app": "audiobookshelf",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "proven",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"audiobookshelf": "ghcr.io/advplyr/audiobookshelf:2.37.1"
|
||||
},
|
||||
"to": {
|
||||
"audiobookshelf": "ghcr.io/advplyr/audiobookshelf:2.37.2"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"audiobookshelf": "ghcr.io/advplyr/audiobookshelf:2.37.1"
|
||||
},
|
||||
"installed_images": {
|
||||
"audiobookshelf": "ghcr.io/advplyr/audiobookshelf:2.37.1"
|
||||
},
|
||||
"catalog_images": {
|
||||
"audiobookshelf": "ghcr.io/advplyr/audiobookshelf:2.37.1"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/advplyr/audiobookshelf:2.37.1@sha256:581d68b2a6fc7ebf58d81c878a9f387cbbc0d88ac9d37b298b9cee10168af85b"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"audiobookshelf ghcr.io/advplyr/audiobookshelf:2.37.1@sha256:581d68b2a6fc7ebf58d81c878a9f387cbbc0d88ac9d37b298b9cee10168af85b running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "401",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"seed": "read_back",
|
||||
"drill_commit": "36f907d89474",
|
||||
"sync_waited_s": 4.5,
|
||||
"badge_before": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
|
||||
"text": "Frissítés elérhető — ma"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "A newer version of this app is available. Select the Update button to start it.",
|
||||
"text": "Update available — today"
|
||||
}
|
||||
]
|
||||
},
|
||||
"measured_at": "2026-10-27T14:20:08Z",
|
||||
"update": {
|
||||
"accepted": true,
|
||||
"http": "202",
|
||||
"phases": [
|
||||
{
|
||||
"t": 0.0,
|
||||
"phase": "backing-up",
|
||||
"label": "Biztonsági mentés készül a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 3.1,
|
||||
"phase": "safety-dump",
|
||||
"label": "Adatbázis pillanatkép…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 4.1,
|
||||
"phase": "pulling",
|
||||
"label": "Új verzió letöltése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 16.4,
|
||||
"phase": "copying",
|
||||
"label": "Az adatok másolása a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 21.5,
|
||||
"phase": "verifying",
|
||||
"label": "Működés ellenőrzése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 26.7,
|
||||
"phase": "done",
|
||||
"label": "Frissítve",
|
||||
"updating": false,
|
||||
"error": null,
|
||||
"hold": null
|
||||
}
|
||||
],
|
||||
"duration_s": 26.7,
|
||||
"final_phase": "done",
|
||||
"update_error": null,
|
||||
"hold_reason": null,
|
||||
"state": "running"
|
||||
},
|
||||
"observables_after": {
|
||||
"pinned_images": {
|
||||
"audiobookshelf": "ghcr.io/advplyr/audiobookshelf:2.37.2"
|
||||
},
|
||||
"installed_images": {
|
||||
"audiobookshelf": "ghcr.io/advplyr/audiobookshelf:2.37.2"
|
||||
},
|
||||
"catalog_images": {
|
||||
"audiobookshelf": "ghcr.io/advplyr/audiobookshelf:2.37.2"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/advplyr/audiobookshelf:2.37.2"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"audiobookshelf ghcr.io/advplyr/audiobookshelf:2.37.2 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"badge_after": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.",
|
||||
"text": "Naprakész"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "This app is running the newest version available.",
|
||||
"text": "Up to date"
|
||||
}
|
||||
]
|
||||
},
|
||||
"state_after": "running",
|
||||
"hold_after": null,
|
||||
"to_digests": {
|
||||
"audiobookshelf": "sha256:b897c33f05972fb1bf484f7487bc878fa91ec8691335c1db6e2929c3a7658efa"
|
||||
},
|
||||
"four_observables": {
|
||||
"pinned": {
|
||||
"audiobookshelf": "ghcr.io/advplyr/audiobookshelf:2.37.2"
|
||||
},
|
||||
"installed": {
|
||||
"audiobookshelf": "ghcr.io/advplyr/audiobookshelf:2.37.2"
|
||||
},
|
||||
"catalog": {
|
||||
"audiobookshelf": "ghcr.io/advplyr/audiobookshelf:2.37.2"
|
||||
},
|
||||
"live_compose": [
|
||||
"ghcr.io/advplyr/audiobookshelf:2.37.2"
|
||||
]
|
||||
},
|
||||
"seed_read_after": true,
|
||||
"setup_gate_after": {
|
||||
"browser": {
|
||||
"status": "404",
|
||||
"redirect": null
|
||||
},
|
||||
"script": {
|
||||
"status": "404",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"memory": {
|
||||
"soak_s": 600,
|
||||
"interval_s": 10,
|
||||
"samples": 60,
|
||||
"containers": {
|
||||
"audiobookshelf": {
|
||||
"samples": 60,
|
||||
"anon_peak_bytes": 51740672,
|
||||
"limit_bytes": 536870912,
|
||||
"anon_peak_pct": 9.6,
|
||||
"cgroup_peak_pct": 11.7,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-204ecffd61b9b118d4c783d86b7e00b8a1da656d9463b9bacebaaad58a13dc9a.scope"
|
||||
}
|
||||
},
|
||||
"oom_kills": 0,
|
||||
"restarts": 0,
|
||||
"peak_pct": 9.6
|
||||
},
|
||||
"why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back",
|
||||
"log": [
|
||||
"15:19:19 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']",
|
||||
"15:19:19 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"15:19:49 [1] deployed, controller state=running, pinned={'audiobookshelf': 'ghcr.io/advplyr/audiobookshelf:2.37.1'}",
|
||||
"15:19:49 gate: audiobooks is gated — passed as the household (cookie set)",
|
||||
"15:19:53 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}",
|
||||
"15:19:53 audiobookshelf: /init http=200",
|
||||
"15:19:53 audiobookshelf: login as the seeded root http=200 ok=True",
|
||||
"15:19:55 [5] drill commit 36f907d89474: audiobookshelf ghcr.io/advplyr/audiobookshelf:2.37.1 -> ghcr.io/advplyr/audiobookshelf:2.37.2 (push rc=0)",
|
||||
"15:20:04 [5] the box's drill mirror now at 36f907d89",
|
||||
"15:20:09 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
|
||||
"15:20:09 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None",
|
||||
"15:20:12 + 3.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None",
|
||||
"15:20:13 + 4.1s phase=pulling label=Új verzió letöltése… err=None hold=None",
|
||||
"15:20:25 + 16.4s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None",
|
||||
"15:20:30 + 21.5s phase=verifying label=Működés ellenőrzése… err=None hold=None",
|
||||
"15:20:35 + 26.7s phase=done label=Frissítve err=None hold=None",
|
||||
"15:20:54 audiobookshelf: login as the seeded root http=200 ok=True",
|
||||
"15:20:54 [7] memory soak 600 s …",
|
||||
"15:31:00 [7] soak: peak 9.6% of the limit (anon), kills 0, restarts 0"
|
||||
]
|
||||
}
|
||||
+3
@@ -0,0 +1,3 @@
|
||||
15:31:43 [5] drill commit d8006e9e6de8: audiobookshelf ghcr.io/advplyr/audiobookshelf:2.37.2 -> ghcr.io/advplyr/audiobookshelf:2.37.1 (push rc=0)
|
||||
15:31:51 [5] the box's drill mirror now at d8006e9e6
|
||||
d8006e9e6de8
|
||||
@@ -0,0 +1,24 @@
|
||||
15:19:19 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
15:19:19 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
15:19:49 [1] deployed, controller state=running, pinned={'audiobookshelf': 'ghcr.io/advplyr/audiobookshelf:2.37.1'}
|
||||
15:19:49 gate: audiobooks is gated — passed as the household (cookie set)
|
||||
15:19:53 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}
|
||||
15:19:53 audiobookshelf: /init http=200
|
||||
15:19:53 audiobookshelf: login as the seeded root http=200 ok=True
|
||||
15:19:55 [5] drill commit 36f907d89474: audiobookshelf ghcr.io/advplyr/audiobookshelf:2.37.1 -> ghcr.io/advplyr/audiobookshelf:2.37.2 (push rc=0)
|
||||
15:20:04 [5] the box's drill mirror now at 36f907d89
|
||||
15:20:09 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
|
||||
15:20:09 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None
|
||||
15:20:12 + 3.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None
|
||||
15:20:13 + 4.1s phase=pulling label=Új verzió letöltése… err=None hold=None
|
||||
15:20:25 + 16.4s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None
|
||||
15:20:30 + 21.5s phase=verifying label=Működés ellenőrzése… err=None hold=None
|
||||
15:20:35 + 26.7s phase=done label=Frissítve err=None hold=None
|
||||
15:20:54 audiobookshelf: login as the seeded root http=200 ok=True
|
||||
15:20:54 [7] memory soak 600 s …
|
||||
15:31:00 [7] soak: peak 9.6% of the limit (anon), kills 0, restarts 0
|
||||
15:31:00 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/audiobookshelf/verdict.json
|
||||
15:31:00 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back
|
||||
15:31:00 [X] stop -> 200 {'ok': True, 'message': 'Stack audiobookshelf stop completed'}
|
||||
15:31:33 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'audiobookshelf', 'volumes_removed': ['audiobookshelf_audiobookshelf_config', 'audiobookshelf_audiobookshelf_metadata'], 'hdd_p
|
||||
15:31:41 [X] after remove: deployed=False leftovers=''
|
||||
+3
@@ -0,0 +1,3 @@
|
||||
STEP audiobookshelf: the superseded step {'audiobookshelf': 'ghcr.io/advplyr/audiobookshelf:2.37.1'} keeps its definition at steps/357e2920c1d33ed0.yml
|
||||
STEP audiobookshelf: … and its .felhom.yml at steps/357e2920c1d33ed0.felhom.yml
|
||||
WROTE audiobookshelf: {'audiobookshelf': 'ghcr.io/advplyr/audiobookshelf:2.37.1'} -> {'audiobookshelf': 'ghcr.io/advplyr/audiobookshelf:2.37.2'} peak 9.6% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}
|
||||
+209
@@ -0,0 +1,209 @@
|
||||
{
|
||||
"app": "bentopdf",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "proven",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"bentopdf": "ghcr.io/alam00000/bentopdf:v2.8.6"
|
||||
},
|
||||
"to": {
|
||||
"bentopdf": "ghcr.io/alam00000/bentopdf:v2.8.10"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"bentopdf": "ghcr.io/alam00000/bentopdf:v2.8.6"
|
||||
},
|
||||
"installed_images": {
|
||||
"bentopdf": "ghcr.io/alam00000/bentopdf:v2.8.6"
|
||||
},
|
||||
"catalog_images": {
|
||||
"bentopdf": "ghcr.io/alam00000/bentopdf:v2.8.6"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/alam00000/bentopdf:v2.8.6"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"bentopdf ghcr.io/alam00000/bentopdf:v2.8.6 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "404",
|
||||
"redirect": null
|
||||
},
|
||||
"script": {
|
||||
"status": "404",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"seed": "none",
|
||||
"seed_why": "no box fixture for this app",
|
||||
"drill_commit": "6d42520c7a8c",
|
||||
"sync_waited_s": 4.5,
|
||||
"badge_before": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
|
||||
"text": "Frissítés elérhető — ma"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "A newer version of this app is available. Select the Update button to start it.",
|
||||
"text": "Update available — today"
|
||||
}
|
||||
]
|
||||
},
|
||||
"measured_at": "2026-10-27T14:22:11Z",
|
||||
"update": {
|
||||
"accepted": true,
|
||||
"http": "202",
|
||||
"phases": [
|
||||
{
|
||||
"t": 0.0,
|
||||
"phase": "backing-up",
|
||||
"label": "Biztonsági mentés készül a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 1.1,
|
||||
"phase": "pulling",
|
||||
"label": "Új verzió letöltése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 14.4,
|
||||
"phase": "copying",
|
||||
"label": "Az adatok másolása a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 18.5,
|
||||
"phase": "verifying",
|
||||
"label": "Működés ellenőrzése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 23.6,
|
||||
"phase": "done",
|
||||
"label": "Frissítve",
|
||||
"updating": false,
|
||||
"error": null,
|
||||
"hold": null
|
||||
}
|
||||
],
|
||||
"duration_s": 23.6,
|
||||
"final_phase": "done",
|
||||
"update_error": null,
|
||||
"hold_reason": null,
|
||||
"state": "running"
|
||||
},
|
||||
"observables_after": {
|
||||
"pinned_images": {
|
||||
"bentopdf": "ghcr.io/alam00000/bentopdf:v2.8.10"
|
||||
},
|
||||
"installed_images": {
|
||||
"bentopdf": "ghcr.io/alam00000/bentopdf:v2.8.10"
|
||||
},
|
||||
"catalog_images": {
|
||||
"bentopdf": "ghcr.io/alam00000/bentopdf:v2.8.10"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/alam00000/bentopdf:v2.8.10"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"bentopdf ghcr.io/alam00000/bentopdf:v2.8.10 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"badge_after": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.",
|
||||
"text": "Naprakész"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "This app is running the newest version available.",
|
||||
"text": "Up to date"
|
||||
}
|
||||
]
|
||||
},
|
||||
"state_after": "running",
|
||||
"hold_after": null,
|
||||
"to_digests": {
|
||||
"bentopdf": "sha256:039239902a01e58a5a0f52e29039fafa18ffc2a481bb8acd807599f1c6dde7ef"
|
||||
},
|
||||
"four_observables": {
|
||||
"pinned": {
|
||||
"bentopdf": "ghcr.io/alam00000/bentopdf:v2.8.10"
|
||||
},
|
||||
"installed": {
|
||||
"bentopdf": "ghcr.io/alam00000/bentopdf:v2.8.10"
|
||||
},
|
||||
"catalog": {
|
||||
"bentopdf": "ghcr.io/alam00000/bentopdf:v2.8.10"
|
||||
},
|
||||
"live_compose": [
|
||||
"ghcr.io/alam00000/bentopdf:v2.8.10"
|
||||
]
|
||||
},
|
||||
"setup_gate_after": {
|
||||
"browser": {
|
||||
"status": "404",
|
||||
"redirect": null
|
||||
},
|
||||
"script": {
|
||||
"status": "404",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"memory": {
|
||||
"soak_s": 600,
|
||||
"interval_s": 10,
|
||||
"samples": 60,
|
||||
"containers": {
|
||||
"bentopdf": {
|
||||
"samples": 60,
|
||||
"anon_peak_bytes": 2605056,
|
||||
"limit_bytes": 402653184,
|
||||
"anon_peak_pct": 0.6,
|
||||
"cgroup_peak_pct": 2.5,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-d58f1be38bb12778ce92b3b932ad4c67cfec769459dbdc1941ea47b41cf5c3e9.scope"
|
||||
}
|
||||
},
|
||||
"oom_kills": 0,
|
||||
"restarts": 0,
|
||||
"peak_pct": 0.6
|
||||
},
|
||||
"why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak",
|
||||
"log": [
|
||||
"15:21:19 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"15:21:54 [1] deployed, controller state=running, pinned={'bentopdf': 'ghcr.io/alam00000/bentopdf:v2.8.6'}",
|
||||
"15:21:57 [2] setup gate as installed: {'browser': {'status': '404', 'redirect': None}, 'script': {'status': '404', 'redirect': None}}",
|
||||
"15:21:57 [3] seed: none — no box fixture for this app",
|
||||
"15:21:58 [5] drill commit 6d42520c7a8c: bentopdf ghcr.io/alam00000/bentopdf:v2.8.6 -> ghcr.io/alam00000/bentopdf:v2.8.10 (push rc=0)",
|
||||
"15:22:07 [5] the box's drill mirror now at 6d42520c7",
|
||||
"15:22:12 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
|
||||
"15:22:12 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None",
|
||||
"15:22:13 + 1.1s phase=pulling label=Új verzió letöltése… err=None hold=None",
|
||||
"15:22:26 + 14.4s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None",
|
||||
"15:22:30 + 18.5s phase=verifying label=Működés ellenőrzése… err=None hold=None",
|
||||
"15:22:35 + 23.6s phase=done label=Frissítve err=None hold=None",
|
||||
"15:22:53 [7] memory soak 600 s …",
|
||||
"15:32:59 [7] soak: peak 0.6% of the limit (anon), kills 0, restarts 0"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
15:33:42 [5] drill commit 0e02cd781bcf: bentopdf ghcr.io/alam00000/bentopdf:v2.8.10 -> ghcr.io/alam00000/bentopdf:v2.8.6 (push rc=0)
|
||||
15:33:50 [5] the box's drill mirror now at 0e02cd781
|
||||
0e02cd781bcf
|
||||
@@ -0,0 +1,19 @@
|
||||
15:21:19 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
15:21:54 [1] deployed, controller state=running, pinned={'bentopdf': 'ghcr.io/alam00000/bentopdf:v2.8.6'}
|
||||
15:21:57 [2] setup gate as installed: {'browser': {'status': '404', 'redirect': None}, 'script': {'status': '404', 'redirect': None}}
|
||||
15:21:57 [3] seed: none — no box fixture for this app
|
||||
15:21:58 [5] drill commit 6d42520c7a8c: bentopdf ghcr.io/alam00000/bentopdf:v2.8.6 -> ghcr.io/alam00000/bentopdf:v2.8.10 (push rc=0)
|
||||
15:22:07 [5] the box's drill mirror now at 6d42520c7
|
||||
15:22:12 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
|
||||
15:22:12 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None
|
||||
15:22:13 + 1.1s phase=pulling label=Új verzió letöltése… err=None hold=None
|
||||
15:22:26 + 14.4s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None
|
||||
15:22:30 + 18.5s phase=verifying label=Működés ellenőrzése… err=None hold=None
|
||||
15:22:35 + 23.6s phase=done label=Frissítve err=None hold=None
|
||||
15:22:53 [7] memory soak 600 s …
|
||||
15:32:59 [7] soak: peak 0.6% of the limit (anon), kills 0, restarts 0
|
||||
15:32:59 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/bentopdf/verdict.json
|
||||
15:32:59 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak
|
||||
15:33:00 [X] stop -> 200 {'ok': True, 'message': 'Stack bentopdf stop completed'}
|
||||
15:33:31 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'bentopdf', 'volumes_removed': [], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem tárolt sa
|
||||
15:33:40 [X] after remove: deployed=False leftovers=''
|
||||
@@ -0,0 +1 @@
|
||||
WROTE bentopdf: {'bentopdf': 'ghcr.io/alam00000/bentopdf:v2.8.6'} -> {'bentopdf': 'ghcr.io/alam00000/bentopdf:v2.8.10'} peak 0.6% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}
|
||||
+294
@@ -0,0 +1,294 @@
|
||||
{
|
||||
"app": "docmost",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "proven",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"docmost": "docmost/docmost:0.96.0",
|
||||
"docmost-postgres": "postgres:18-alpine",
|
||||
"docmost-redis": "redis:7-alpine"
|
||||
},
|
||||
"to": {
|
||||
"docmost": "docmost/docmost:0.97.0",
|
||||
"docmost-postgres": "postgres:18-alpine",
|
||||
"docmost-redis": "redis:7-alpine"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"docmost": "docmost/docmost:0.96.0",
|
||||
"docmost-postgres": "postgres:18-alpine",
|
||||
"docmost-redis": "redis:7-alpine"
|
||||
},
|
||||
"installed_images": {
|
||||
"docmost": "docmost/docmost:0.96.0",
|
||||
"docmost-postgres": "postgres:18-alpine",
|
||||
"docmost-redis": "redis:7-alpine"
|
||||
},
|
||||
"catalog_images": null,
|
||||
"live_compose_image_lines": [
|
||||
"image: docmost/docmost:0.96.0@sha256:b56947fcfd08aab8fae12a377e1792784786adbf8b96e4281f14ef4fc072685a",
|
||||
"image: postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873",
|
||||
"image: redis:7-alpine@sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"docmost docmost/docmost:0.96.0@sha256:b56947fcfd08aab8fae12a377e1792784786adbf8b96e4281f14ef4fc072685a running=true restarts=0",
|
||||
"docmost-postgres postgres:18-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873 running=true restarts=0",
|
||||
"docmost-redis redis:7-alpine@sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "401",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"seed": "read_back",
|
||||
"drill_commit": "1105b2da8b4c",
|
||||
"sync_waited_s": 26.9,
|
||||
"badge_before": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
|
||||
"text": "Frissítés elérhető — ma"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "A newer version of this app is available. Select the Update button to start it.",
|
||||
"text": "Update available — today"
|
||||
}
|
||||
]
|
||||
},
|
||||
"measured_at": "2026-10-27T14:00:23Z",
|
||||
"update": {
|
||||
"accepted": true,
|
||||
"http": "202",
|
||||
"phases": [
|
||||
{
|
||||
"t": 0.0,
|
||||
"phase": "checking",
|
||||
"label": "Ellenőrzés…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 1.0,
|
||||
"phase": "backing-up",
|
||||
"label": "Biztonsági mentés készül a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 24.6,
|
||||
"phase": "safety-dump",
|
||||
"label": "Adatbázis pillanatkép…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 26.6,
|
||||
"phase": "pulling",
|
||||
"label": "Új verzió letöltése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 127.1,
|
||||
"phase": "copying",
|
||||
"label": "Az adatok másolása a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 131.2,
|
||||
"phase": "starting",
|
||||
"label": "Indítás az új verzióval…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 142.5,
|
||||
"phase": "verifying",
|
||||
"label": "Működés ellenőrzése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 163.0,
|
||||
"phase": "done",
|
||||
"label": "Frissítve",
|
||||
"updating": false,
|
||||
"error": null,
|
||||
"hold": null
|
||||
}
|
||||
],
|
||||
"duration_s": 163.0,
|
||||
"final_phase": "done",
|
||||
"update_error": null,
|
||||
"hold_reason": null,
|
||||
"state": "running"
|
||||
},
|
||||
"observables_after": {
|
||||
"pinned_images": {
|
||||
"docmost": "docmost/docmost:0.97.0",
|
||||
"docmost-postgres": "postgres:18-alpine",
|
||||
"docmost-redis": "redis:7-alpine"
|
||||
},
|
||||
"installed_images": {
|
||||
"docmost": "docmost/docmost:0.97.0",
|
||||
"docmost-postgres": "postgres:18-alpine",
|
||||
"docmost-redis": "redis:7-alpine"
|
||||
},
|
||||
"catalog_images": {
|
||||
"docmost": "docmost/docmost:0.97.0",
|
||||
"docmost-postgres": "postgres:18-alpine",
|
||||
"docmost-redis": "redis:7-alpine"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: docmost/docmost:0.97.0",
|
||||
"image: postgres:18-alpine",
|
||||
"image: redis:7-alpine"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"docmost docmost/docmost:0.97.0 running=true restarts=0",
|
||||
"docmost-redis redis:7-alpine running=true restarts=0",
|
||||
"docmost-postgres postgres:18-alpine running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"badge_after": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.",
|
||||
"text": "Naprakész"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "This app is running the newest version available.",
|
||||
"text": "Up to date"
|
||||
}
|
||||
]
|
||||
},
|
||||
"state_after": "running",
|
||||
"hold_after": null,
|
||||
"to_digests": {
|
||||
"docmost": "sha256:40c454d74ffdd9ecb15833e4d96f3a630d59aad862a1869381ae6ee086454419",
|
||||
"docmost-postgres": "sha256:10a5c69a83035ab5239f5620d708520e8b28f5aa1f2b20143e6024532edadfb5",
|
||||
"docmost-redis": "sha256:6ba19c50b56777f5c11c58eff8ddb69d0d5f27ba131cffb63f180ccfd43c66af"
|
||||
},
|
||||
"four_observables": {
|
||||
"pinned": {
|
||||
"docmost": "docmost/docmost:0.97.0",
|
||||
"docmost-postgres": "postgres:18-alpine",
|
||||
"docmost-redis": "redis:7-alpine"
|
||||
},
|
||||
"installed": {
|
||||
"docmost": "docmost/docmost:0.97.0",
|
||||
"docmost-postgres": "postgres:18-alpine",
|
||||
"docmost-redis": "redis:7-alpine"
|
||||
},
|
||||
"catalog": {
|
||||
"docmost": "docmost/docmost:0.97.0",
|
||||
"docmost-postgres": "postgres:18-alpine",
|
||||
"docmost-redis": "redis:7-alpine"
|
||||
},
|
||||
"live_compose": [
|
||||
"docmost/docmost:0.97.0",
|
||||
"postgres:18-alpine",
|
||||
"redis:7-alpine"
|
||||
]
|
||||
},
|
||||
"seed_read_after": true,
|
||||
"setup_gate_after": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "401",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"memory": {
|
||||
"soak_s": 600,
|
||||
"interval_s": 10,
|
||||
"samples": 174,
|
||||
"containers": {
|
||||
"docmost": {
|
||||
"samples": 58,
|
||||
"anon_peak_bytes": 435372032,
|
||||
"limit_bytes": 805306368,
|
||||
"anon_peak_pct": 54.1,
|
||||
"cgroup_peak_pct": 100.0,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-31babd6a486c29cf55bcc4c17816b835a91ad9a1c6d261d594e4c15a1a38680b.scope"
|
||||
},
|
||||
"docmost-redis": {
|
||||
"samples": 58,
|
||||
"anon_peak_bytes": 4182016,
|
||||
"limit_bytes": 134217728,
|
||||
"anon_peak_pct": 3.1,
|
||||
"cgroup_peak_pct": 16.9,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-08f976fb643fe7db20e4a4c91934e68946492af8a0d141fa61468ccb7eb14652.scope"
|
||||
},
|
||||
"docmost-postgres": {
|
||||
"samples": 58,
|
||||
"anon_peak_bytes": 12107776,
|
||||
"limit_bytes": 268435456,
|
||||
"anon_peak_pct": 4.5,
|
||||
"cgroup_peak_pct": 23.5,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-23db659fc0d91e0a1dbbd8f356cb0fa649c382eaf518b54172dcbb1385379a5e.scope"
|
||||
}
|
||||
},
|
||||
"oom_kills": 0,
|
||||
"restarts": 0,
|
||||
"peak_pct": 54.1
|
||||
},
|
||||
"why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back",
|
||||
"log": [
|
||||
"14:57:50 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"14:59:41 [1] deployed, controller state=running, pinned={'docmost': 'docmost/docmost:0.96.0', 'docmost-postgres': 'postgres:18-alpine', 'docmost-redis': 'redis:7-alpine'}",
|
||||
"14:59:41 gate: docs is gated — passed as the household (cookie set)",
|
||||
"14:59:44 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}",
|
||||
"14:59:45 docmost: /api/auth/setup http=200 rc=0",
|
||||
"14:59:45 docmost: login as the seeded user http=200 ok=True",
|
||||
"14:59:46 [5] drill commit 1105b2da8b4c: docmost docmost/docmost:0.96.0 -> docmost/docmost:0.97.0 (push rc=0)",
|
||||
"14:59:56 [5] the box's drill mirror now at 1105b2da8",
|
||||
"15:00:23 [sync] the badge needed 26.9s and 3 sync+rescan rounds to catch up to docmost/docmost:0.97.0 — R-607's window, measured",
|
||||
"15:00:23 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
|
||||
"15:00:23 + 0.0s phase=checking label=Ellenőrzés… err=None hold=None",
|
||||
"15:00:24 + 1.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None",
|
||||
"15:00:47 + 24.6s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None",
|
||||
"15:00:50 + 26.6s phase=pulling label=Új verzió letöltése… err=None hold=None",
|
||||
"15:02:30 + 127.1s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None",
|
||||
"15:02:34 + 131.2s phase=starting label=Indítás az új verzióval… err=None hold=None",
|
||||
"15:02:45 + 142.5s phase=verifying label=Működés ellenőrzése… err=None hold=None",
|
||||
"15:03:06 + 163.0s phase=done label=Frissítve err=None hold=None",
|
||||
"15:03:25 docmost: login as the seeded user http=200 ok=True",
|
||||
"15:03:25 [7] memory soak 600 s …",
|
||||
"15:13:34 [7] soak: peak 54.1% of the limit (anon), kills 0, restarts 0"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
15:14:22 [5] drill commit fe89552ebf0b: docmost docmost/docmost:0.97.0 -> docmost/docmost:0.96.0 (push rc=0)
|
||||
15:14:30 [5] the box's drill mirror now at fe89552eb
|
||||
fe89552ebf0b
|
||||
@@ -0,0 +1,26 @@
|
||||
14:57:50 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
14:59:41 [1] deployed, controller state=running, pinned={'docmost': 'docmost/docmost:0.96.0', 'docmost-postgres': 'postgres:18-alpine', 'docmost-redis': 'redis:7-alpine'}
|
||||
14:59:41 gate: docs is gated — passed as the household (cookie set)
|
||||
14:59:44 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}
|
||||
14:59:45 docmost: /api/auth/setup http=200 rc=0
|
||||
14:59:45 docmost: login as the seeded user http=200 ok=True
|
||||
14:59:46 [5] drill commit 1105b2da8b4c: docmost docmost/docmost:0.96.0 -> docmost/docmost:0.97.0 (push rc=0)
|
||||
14:59:56 [5] the box's drill mirror now at 1105b2da8
|
||||
15:00:23 [sync] the badge needed 26.9s and 3 sync+rescan rounds to catch up to docmost/docmost:0.97.0 — R-607's window, measured
|
||||
15:00:23 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
|
||||
15:00:23 + 0.0s phase=checking label=Ellenőrzés… err=None hold=None
|
||||
15:00:24 + 1.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None
|
||||
15:00:47 + 24.6s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None
|
||||
15:00:50 + 26.6s phase=pulling label=Új verzió letöltése… err=None hold=None
|
||||
15:02:30 + 127.1s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None
|
||||
15:02:34 + 131.2s phase=starting label=Indítás az új verzióval… err=None hold=None
|
||||
15:02:45 + 142.5s phase=verifying label=Működés ellenőrzése… err=None hold=None
|
||||
15:03:06 + 163.0s phase=done label=Frissítve err=None hold=None
|
||||
15:03:25 docmost: login as the seeded user http=200 ok=True
|
||||
15:03:25 [7] memory soak 600 s …
|
||||
15:13:34 [7] soak: peak 54.1% of the limit (anon), kills 0, restarts 0
|
||||
15:13:34 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/docmost/verdict.json
|
||||
15:13:34 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back
|
||||
15:13:36 [X] stop -> 200 {'ok': True, 'message': 'Stack docmost stop completed'}
|
||||
15:14:08 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'docmost', 'volumes_removed': ['docmost_docmost_postgres_data', 'docmost_docmost_redis_data', 'docmost_docmost_storage'], 'hdd_
|
||||
15:14:16 [X] after remove: deployed=False leftovers=''
|
||||
@@ -0,0 +1,3 @@
|
||||
STEP docmost: the superseded step {'docmost': 'docmost/docmost:0.96.0', 'docmost-postgres': 'postgres:18-alpine', 'docmost-redis': 'redis:7-alpine'} keeps its definition at steps/01ae17194c827ab5.yml
|
||||
STEP docmost: … and its .felhom.yml at steps/01ae17194c827ab5.felhom.yml
|
||||
WROTE docmost: {'docmost': 'docmost/docmost:0.96.0', 'docmost-postgres': 'postgres:18-alpine', 'docmost-redis': 'redis:7-alpine'} -> {'docmost': 'docmost/docmost:0.97.0', 'docmost-postgres': 'postgres:18-alpine', 'docmost-redis': 'redis:7-alpine'} peak 54.1% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}
|
||||
+237
@@ -0,0 +1,237 @@
|
||||
{
|
||||
"app": "grafana",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "proven",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"grafana": "grafana/grafana:13.2.3"
|
||||
},
|
||||
"to": {
|
||||
"grafana": "grafana/grafana:13.2.4"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"grafana": "grafana/grafana:13.2.3"
|
||||
},
|
||||
"installed_images": {
|
||||
"grafana": "grafana/grafana:13.2.3"
|
||||
},
|
||||
"catalog_images": null,
|
||||
"live_compose_image_lines": [
|
||||
"image: grafana/grafana:13.2.3@sha256:b28bae15e219c998fb0e0424ed724930cc61b1f61fb404d47c862f9a23f9e572"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"grafana grafana/grafana:13.2.3@sha256:b28bae15e219c998fb0e0424ed724930cc61b1f61fb404d47c862f9a23f9e572 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "/login?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "302",
|
||||
"redirect": "/login?…"
|
||||
}
|
||||
},
|
||||
"seed": "read_back",
|
||||
"drill_commit": "b8137ea1370d",
|
||||
"sync_waited_s": 4.5,
|
||||
"badge_before": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
|
||||
"text": "Frissítés elérhető — ma"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "A newer version of this app is available. Select the Update button to start it.",
|
||||
"text": "Update available — today"
|
||||
}
|
||||
]
|
||||
},
|
||||
"measured_at": "2026-10-27T14:01:18Z",
|
||||
"update": {
|
||||
"accepted": true,
|
||||
"http": "202",
|
||||
"phases": [
|
||||
{
|
||||
"t": 0.0,
|
||||
"phase": "checking",
|
||||
"label": "Ellenőrzés…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 2.1,
|
||||
"phase": "backing-up",
|
||||
"label": "Biztonsági mentés készül a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 26.7,
|
||||
"phase": "safety-dump",
|
||||
"label": "Adatbázis pillanatkép…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 30.8,
|
||||
"phase": "pulling",
|
||||
"label": "Új verzió letöltése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 55.3,
|
||||
"phase": "copying",
|
||||
"label": "Az adatok másolása a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 71.7,
|
||||
"phase": "starting",
|
||||
"label": "Indítás az új verzióval…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 72.8,
|
||||
"phase": "verifying",
|
||||
"label": "Működés ellenőrzése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 77.9,
|
||||
"phase": "done",
|
||||
"label": "Frissítve",
|
||||
"updating": false,
|
||||
"error": null,
|
||||
"hold": null
|
||||
}
|
||||
],
|
||||
"duration_s": 77.9,
|
||||
"final_phase": "done",
|
||||
"update_error": null,
|
||||
"hold_reason": null,
|
||||
"state": "running"
|
||||
},
|
||||
"observables_after": {
|
||||
"pinned_images": {
|
||||
"grafana": "grafana/grafana:13.2.4"
|
||||
},
|
||||
"installed_images": {
|
||||
"grafana": "grafana/grafana:13.2.4"
|
||||
},
|
||||
"catalog_images": {
|
||||
"grafana": "grafana/grafana:13.2.4"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: grafana/grafana:13.2.4"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"grafana grafana/grafana:13.2.4 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"badge_after": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.",
|
||||
"text": "Naprakész"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "This app is running the newest version available.",
|
||||
"text": "Up to date"
|
||||
}
|
||||
]
|
||||
},
|
||||
"state_after": "running",
|
||||
"hold_after": null,
|
||||
"to_digests": {
|
||||
"grafana": "sha256:dbbc38ea21103cefb50396340cd88afec779c7e070b0a7bf5a75b4ce46651d3f"
|
||||
},
|
||||
"four_observables": {
|
||||
"pinned": {
|
||||
"grafana": "grafana/grafana:13.2.4"
|
||||
},
|
||||
"installed": {
|
||||
"grafana": "grafana/grafana:13.2.4"
|
||||
},
|
||||
"catalog": {
|
||||
"grafana": "grafana/grafana:13.2.4"
|
||||
},
|
||||
"live_compose": [
|
||||
"grafana/grafana:13.2.4"
|
||||
]
|
||||
},
|
||||
"seed_read_after": true,
|
||||
"setup_gate_after": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "/login?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "302",
|
||||
"redirect": "/login?…"
|
||||
}
|
||||
},
|
||||
"memory": {
|
||||
"soak_s": 600,
|
||||
"interval_s": 10,
|
||||
"samples": 60,
|
||||
"containers": {
|
||||
"grafana": {
|
||||
"samples": 60,
|
||||
"anon_peak_bytes": 243650560,
|
||||
"limit_bytes": 805306368,
|
||||
"anon_peak_pct": 30.3,
|
||||
"cgroup_peak_pct": 97.5,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-743819121be0a9189ca1c75cdc1c7ebb5d01df10cf1713ae19cab11edc7cfc4b.scope"
|
||||
}
|
||||
},
|
||||
"oom_kills": 0,
|
||||
"restarts": 0,
|
||||
"peak_pct": 30.3
|
||||
},
|
||||
"why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back",
|
||||
"log": [
|
||||
"14:59:48 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['GF_SECURITY_ADMIN_PASSWORD']",
|
||||
"14:59:49 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"15:00:59 [1] deployed, controller state=running, pinned={'grafana': 'grafana/grafana:13.2.3'}",
|
||||
"15:01:03 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': '/login?…'}, 'script': {'status': '302', 'redirect': '/login?…'}}",
|
||||
"15:01:03 grafana: create folder http=200",
|
||||
"15:01:03 grafana: readback of the seeded folder http=200 ok=True",
|
||||
"15:01:04 [5] drill commit b8137ea1370d: grafana grafana/grafana:13.2.3 -> grafana/grafana:13.2.4 (push rc=0)",
|
||||
"15:01:14 [5] the box's drill mirror now at b8137ea13",
|
||||
"15:01:19 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
|
||||
"15:01:19 + 0.0s phase=checking label=Ellenőrzés… err=None hold=None",
|
||||
"15:01:21 + 2.1s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None",
|
||||
"15:01:45 + 26.7s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None",
|
||||
"15:01:49 + 30.8s phase=pulling label=Új verzió letöltése… err=None hold=None",
|
||||
"15:02:14 + 55.3s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None",
|
||||
"15:02:30 + 71.7s phase=starting label=Indítás az új verzióval… err=None hold=None",
|
||||
"15:02:31 + 72.8s phase=verifying label=Működés ellenőrzése… err=None hold=None",
|
||||
"15:02:36 + 77.9s phase=done label=Frissítve err=None hold=None",
|
||||
"15:02:55 grafana: readback of the seeded folder http=200 ok=True",
|
||||
"15:02:55 [7] memory soak 600 s …",
|
||||
"15:13:01 [7] soak: peak 30.3% of the limit (anon), kills 0, restarts 0"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
15:13:45 [5] drill commit fd2dff6dc40e: grafana grafana/grafana:13.2.4 -> grafana/grafana:13.2.3 (push rc=0)
|
||||
15:13:54 [5] the box's drill mirror now at fd2dff6dc
|
||||
fd2dff6dc40e
|
||||
@@ -0,0 +1,25 @@
|
||||
14:59:48 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['GF_SECURITY_ADMIN_PASSWORD']
|
||||
14:59:49 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
15:00:59 [1] deployed, controller state=running, pinned={'grafana': 'grafana/grafana:13.2.3'}
|
||||
15:01:03 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': '/login?…'}, 'script': {'status': '302', 'redirect': '/login?…'}}
|
||||
15:01:03 grafana: create folder http=200
|
||||
15:01:03 grafana: readback of the seeded folder http=200 ok=True
|
||||
15:01:04 [5] drill commit b8137ea1370d: grafana grafana/grafana:13.2.3 -> grafana/grafana:13.2.4 (push rc=0)
|
||||
15:01:14 [5] the box's drill mirror now at b8137ea13
|
||||
15:01:19 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
|
||||
15:01:19 + 0.0s phase=checking label=Ellenőrzés… err=None hold=None
|
||||
15:01:21 + 2.1s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None
|
||||
15:01:45 + 26.7s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None
|
||||
15:01:49 + 30.8s phase=pulling label=Új verzió letöltése… err=None hold=None
|
||||
15:02:14 + 55.3s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None
|
||||
15:02:30 + 71.7s phase=starting label=Indítás az új verzióval… err=None hold=None
|
||||
15:02:31 + 72.8s phase=verifying label=Működés ellenőrzése… err=None hold=None
|
||||
15:02:36 + 77.9s phase=done label=Frissítve err=None hold=None
|
||||
15:02:55 grafana: readback of the seeded folder http=200 ok=True
|
||||
15:02:55 [7] memory soak 600 s …
|
||||
15:13:01 [7] soak: peak 30.3% of the limit (anon), kills 0, restarts 0
|
||||
15:13:01 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/grafana/verdict.json
|
||||
15:13:01 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back
|
||||
15:13:02 [X] stop -> 200 {'ok': True, 'message': 'Stack grafana stop completed'}
|
||||
15:13:34 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'grafana', 'volumes_removed': ['grafana_grafana_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alk
|
||||
15:13:42 [X] after remove: deployed=False leftovers=''
|
||||
@@ -0,0 +1,3 @@
|
||||
STEP grafana: the superseded step {'grafana': 'grafana/grafana:13.2.3'} keeps its definition at steps/63fab8627e9b70ed.yml
|
||||
STEP grafana: … and its .felhom.yml at steps/63fab8627e9b70ed.felhom.yml
|
||||
WROTE grafana: {'grafana': 'grafana/grafana:13.2.3'} -> {'grafana': 'grafana/grafana:13.2.4'} peak 30.3% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}
|
||||
+221
@@ -0,0 +1,221 @@
|
||||
{
|
||||
"app": "homebox",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "proven",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.26.2"
|
||||
},
|
||||
"to": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.27.1"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.26.2"
|
||||
},
|
||||
"installed_images": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.26.2"
|
||||
},
|
||||
"catalog_images": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.26.2"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/sysadminsmedia/homebox:0.26.2"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"homebox ghcr.io/sysadminsmedia/homebox:0.26.2 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "401",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"seed": "read_back",
|
||||
"drill_commit": "47435b2461e9",
|
||||
"sync_waited_s": 4.5,
|
||||
"badge_before": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
|
||||
"text": "Frissítés elérhető — ma"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "A newer version of this app is available. Select the Update button to start it.",
|
||||
"text": "Update available — today"
|
||||
}
|
||||
]
|
||||
},
|
||||
"measured_at": "2026-10-27T14:45:55Z",
|
||||
"update": {
|
||||
"accepted": true,
|
||||
"http": "202",
|
||||
"phases": [
|
||||
{
|
||||
"t": 0.0,
|
||||
"phase": "backing-up",
|
||||
"label": "Biztonsági mentés készül a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 2.1,
|
||||
"phase": "safety-dump",
|
||||
"label": "Adatbázis pillanatkép…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 3.1,
|
||||
"phase": "pulling",
|
||||
"label": "Új verzió letöltése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 12.3,
|
||||
"phase": "copying",
|
||||
"label": "Az adatok másolása a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 13.3,
|
||||
"phase": "verifying",
|
||||
"label": "Működés ellenőrzése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 18.4,
|
||||
"phase": "done",
|
||||
"label": "Frissítve",
|
||||
"updating": false,
|
||||
"error": null,
|
||||
"hold": null
|
||||
}
|
||||
],
|
||||
"duration_s": 18.5,
|
||||
"final_phase": "done",
|
||||
"update_error": null,
|
||||
"hold_reason": null,
|
||||
"state": "running"
|
||||
},
|
||||
"observables_after": {
|
||||
"pinned_images": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.27.1"
|
||||
},
|
||||
"installed_images": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.27.1"
|
||||
},
|
||||
"catalog_images": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.27.1"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/sysadminsmedia/homebox:0.27.1"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"homebox ghcr.io/sysadminsmedia/homebox:0.27.1 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"badge_after": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.",
|
||||
"text": "Naprakész"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "This app is running the newest version available.",
|
||||
"text": "Up to date"
|
||||
}
|
||||
]
|
||||
},
|
||||
"state_after": "running",
|
||||
"hold_after": null,
|
||||
"to_digests": {
|
||||
"homebox": "sha256:9d0b64776c694f018c0ca06faf52105a33ca376024f46bb58e6ab0e2b728bb61"
|
||||
},
|
||||
"four_observables": {
|
||||
"pinned": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.27.1"
|
||||
},
|
||||
"installed": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.27.1"
|
||||
},
|
||||
"catalog": {
|
||||
"homebox": "ghcr.io/sysadminsmedia/homebox:0.27.1"
|
||||
},
|
||||
"live_compose": [
|
||||
"ghcr.io/sysadminsmedia/homebox:0.27.1"
|
||||
]
|
||||
},
|
||||
"seed_read_after": true,
|
||||
"setup_gate_after": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "401",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"memory": {
|
||||
"soak_s": 600,
|
||||
"interval_s": 10,
|
||||
"samples": 60,
|
||||
"containers": {
|
||||
"homebox": {
|
||||
"samples": 60,
|
||||
"anon_peak_bytes": 85250048,
|
||||
"limit_bytes": 268435456,
|
||||
"anon_peak_pct": 31.8,
|
||||
"cgroup_peak_pct": 34.8,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-fd6a3af6858e947718d8cee156dd49a48db3dcafa3b57130b6daa8e969edd96f.scope"
|
||||
}
|
||||
},
|
||||
"oom_kills": 0,
|
||||
"restarts": 0,
|
||||
"peak_pct": 31.8
|
||||
},
|
||||
"why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back",
|
||||
"log": [
|
||||
"15:45:21 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"15:45:36 [1] deployed, controller state=running, pinned={'homebox': 'ghcr.io/sysadminsmedia/homebox:0.26.2'}",
|
||||
"15:45:36 gate: homebox is gated — passed as the household (cookie set)",
|
||||
"15:45:40 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}",
|
||||
"15:45:40 homebox: seeded location drillloc79c848d6 through /api/v1/entities",
|
||||
"15:45:41 homebox: readback found=True (http 200, control passed)",
|
||||
"15:45:42 [5] drill commit 47435b2461e9: homebox ghcr.io/sysadminsmedia/homebox:0.26.2 -> ghcr.io/sysadminsmedia/homebox:0.27.1 (push rc=0)",
|
||||
"15:45:50 [5] the box's drill mirror now at 47435b246",
|
||||
"15:45:55 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
|
||||
"15:45:55 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None",
|
||||
"15:45:57 + 2.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None",
|
||||
"15:45:58 + 3.1s phase=pulling label=Új verzió letöltése… err=None hold=None",
|
||||
"15:46:07 + 12.3s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None",
|
||||
"15:46:08 + 13.3s phase=verifying label=Működés ellenőrzése… err=None hold=None",
|
||||
"15:46:13 + 18.4s phase=done label=Frissítve err=None hold=None",
|
||||
"15:46:32 homebox: readback found=True (http 200, control passed)",
|
||||
"15:46:32 [7] memory soak 600 s …",
|
||||
"15:56:38 [7] soak: peak 31.8% of the limit (anon), kills 0, restarts 0"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
15:57:21 [5] drill commit 9837e99b3b3f: homebox ghcr.io/sysadminsmedia/homebox:0.27.1 -> ghcr.io/sysadminsmedia/homebox:0.26.2 (push rc=0)
|
||||
15:57:29 [5] the box's drill mirror now at 9837e99b3b
|
||||
9837e99b3b3f
|
||||
@@ -0,0 +1,23 @@
|
||||
15:45:21 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
15:45:36 [1] deployed, controller state=running, pinned={'homebox': 'ghcr.io/sysadminsmedia/homebox:0.26.2'}
|
||||
15:45:36 gate: homebox is gated — passed as the household (cookie set)
|
||||
15:45:40 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}
|
||||
15:45:40 homebox: seeded location drillloc79c848d6 through /api/v1/entities
|
||||
15:45:41 homebox: readback found=True (http 200, control passed)
|
||||
15:45:42 [5] drill commit 47435b2461e9: homebox ghcr.io/sysadminsmedia/homebox:0.26.2 -> ghcr.io/sysadminsmedia/homebox:0.27.1 (push rc=0)
|
||||
15:45:50 [5] the box's drill mirror now at 47435b246
|
||||
15:45:55 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
|
||||
15:45:55 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None
|
||||
15:45:57 + 2.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None
|
||||
15:45:58 + 3.1s phase=pulling label=Új verzió letöltése… err=None hold=None
|
||||
15:46:07 + 12.3s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None
|
||||
15:46:08 + 13.3s phase=verifying label=Működés ellenőrzése… err=None hold=None
|
||||
15:46:13 + 18.4s phase=done label=Frissítve err=None hold=None
|
||||
15:46:32 homebox: readback found=True (http 200, control passed)
|
||||
15:46:32 [7] memory soak 600 s …
|
||||
15:56:38 [7] soak: peak 31.8% of the limit (anon), kills 0, restarts 0
|
||||
15:56:38 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/homebox/verdict.json
|
||||
15:56:38 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back
|
||||
15:56:38 [X] stop -> 200 {'ok': True, 'message': 'Stack homebox stop completed'}
|
||||
15:57:11 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'homebox', 'volumes_removed': ['homebox_homebox_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alk
|
||||
15:57:19 [X] after remove: deployed=False leftovers=''
|
||||
@@ -0,0 +1 @@
|
||||
WROTE homebox: {'homebox': 'ghcr.io/sysadminsmedia/homebox:0.26.2'} -> {'homebox': 'ghcr.io/sysadminsmedia/homebox:0.27.1'} peak 31.8% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}
|
||||
+229
@@ -0,0 +1,229 @@
|
||||
{
|
||||
"app": "jellyfin",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "proven",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"jellyfin": "jellyfin/jellyfin:10.11.11"
|
||||
},
|
||||
"to": {
|
||||
"jellyfin": "jellyfin/jellyfin:12.4"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"jellyfin": "jellyfin/jellyfin:10.11.11"
|
||||
},
|
||||
"installed_images": {
|
||||
"jellyfin": "jellyfin/jellyfin:10.11.11"
|
||||
},
|
||||
"catalog_images": null,
|
||||
"live_compose_image_lines": [
|
||||
"image: jellyfin/jellyfin:10.11.11"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"jellyfin jellyfin/jellyfin:10.11.11 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "401",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"seed": "read_back",
|
||||
"drill_commit": "a6f8052b643e",
|
||||
"sync_waited_s": 4.5,
|
||||
"badge_before": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
|
||||
"text": "Frissítés elérhető — ma"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "A newer version of this app is available. Select the Update button to start it.",
|
||||
"text": "Update available — today"
|
||||
}
|
||||
]
|
||||
},
|
||||
"measured_at": "2026-10-27T15:53:07Z",
|
||||
"update": {
|
||||
"accepted": true,
|
||||
"http": "202",
|
||||
"phases": [
|
||||
{
|
||||
"t": 0.0,
|
||||
"phase": "backing-up",
|
||||
"label": "Biztonsági mentés készül a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 3.1,
|
||||
"phase": "safety-dump",
|
||||
"label": "Adatbázis pillanatkép…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 4.1,
|
||||
"phase": "pulling",
|
||||
"label": "Új verzió letöltése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 31.8,
|
||||
"phase": "copying",
|
||||
"label": "Az adatok másolása a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 42.0,
|
||||
"phase": "starting",
|
||||
"label": "Indítás az új verzióval…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 43.0,
|
||||
"phase": "verifying",
|
||||
"label": "Működés ellenőrzése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 53.3,
|
||||
"phase": "done",
|
||||
"label": "Frissítve",
|
||||
"updating": false,
|
||||
"error": null,
|
||||
"hold": null
|
||||
}
|
||||
],
|
||||
"duration_s": 53.3,
|
||||
"final_phase": "done",
|
||||
"update_error": null,
|
||||
"hold_reason": null,
|
||||
"state": "running"
|
||||
},
|
||||
"observables_after": {
|
||||
"pinned_images": {
|
||||
"jellyfin": "jellyfin/jellyfin:12.4"
|
||||
},
|
||||
"installed_images": {
|
||||
"jellyfin": "jellyfin/jellyfin:12.4"
|
||||
},
|
||||
"catalog_images": {
|
||||
"jellyfin": "jellyfin/jellyfin:12.4"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: jellyfin/jellyfin:12.4"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"jellyfin jellyfin/jellyfin:12.4 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"badge_after": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.",
|
||||
"text": "Naprakész"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "This app is running the newest version available.",
|
||||
"text": "Up to date"
|
||||
}
|
||||
]
|
||||
},
|
||||
"state_after": "running",
|
||||
"hold_after": null,
|
||||
"to_digests": {
|
||||
"jellyfin": "sha256:fea863d0cd9ec445985d9c75fc6ed64e38a1d2766cf0c250a33d553f4fc1b771"
|
||||
},
|
||||
"four_observables": {
|
||||
"pinned": {
|
||||
"jellyfin": "jellyfin/jellyfin:12.4"
|
||||
},
|
||||
"installed": {
|
||||
"jellyfin": "jellyfin/jellyfin:12.4"
|
||||
},
|
||||
"catalog": {
|
||||
"jellyfin": "jellyfin/jellyfin:12.4"
|
||||
},
|
||||
"live_compose": [
|
||||
"jellyfin/jellyfin:12.4"
|
||||
]
|
||||
},
|
||||
"seed_read_after": true,
|
||||
"setup_gate_after": {
|
||||
"browser": {
|
||||
"status": "404",
|
||||
"redirect": null
|
||||
},
|
||||
"script": {
|
||||
"status": "404",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"memory": {
|
||||
"soak_s": 600,
|
||||
"interval_s": 10,
|
||||
"samples": 60,
|
||||
"containers": {
|
||||
"jellyfin": {
|
||||
"samples": 60,
|
||||
"anon_peak_bytes": 105771008,
|
||||
"limit_bytes": 2147483648,
|
||||
"anon_peak_pct": 4.9,
|
||||
"cgroup_peak_pct": 9.2,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-09b28f937d293c056afe38225eb9e0ee044f727e37f1da145ee588a471c4ec61.scope"
|
||||
}
|
||||
},
|
||||
"oom_kills": 0,
|
||||
"restarts": 0,
|
||||
"peak_pct": 4.9
|
||||
},
|
||||
"why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back",
|
||||
"log": [
|
||||
"16:51:46 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']",
|
||||
"16:51:46 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"16:52:47 [1] deployed, controller state=running, pinned={'jellyfin': 'jellyfin/jellyfin:10.11.11'}",
|
||||
"16:52:47 gate: jellyfin is gated — passed as the household (cookie set)",
|
||||
"16:52:50 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}",
|
||||
"16:52:51 jellyfin: seeded first user drill32e938f7",
|
||||
"16:52:53 jellyfin: sign-in as the seeded user http=200 token=True (wrong password refused: http 401)",
|
||||
"16:52:54 [5] drill commit a6f8052b643e: jellyfin jellyfin/jellyfin:10.11.11 -> jellyfin/jellyfin:12.4 (push rc=0)",
|
||||
"16:53:02 [5] the box's drill mirror now at a6f8052",
|
||||
"16:53:07 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
|
||||
"16:53:07 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None",
|
||||
"16:53:10 + 3.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None",
|
||||
"16:53:11 + 4.1s phase=pulling label=Új verzió letöltése… err=None hold=None",
|
||||
"16:53:39 + 31.8s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None",
|
||||
"16:53:49 + 42.0s phase=starting label=Indítás az új verzióval… err=None hold=None",
|
||||
"16:53:50 + 43.0s phase=verifying label=Működés ellenőrzése… err=None hold=None",
|
||||
"16:54:00 + 53.3s phase=done label=Frissítve err=None hold=None",
|
||||
"16:54:20 jellyfin: sign-in as the seeded user http=200 token=True (wrong password refused: http 401)",
|
||||
"16:54:20 [7] memory soak 600 s …",
|
||||
"17:04:26 [7] soak: peak 4.9% of the limit (anon), kills 0, restarts 0"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
17:05:09 [5] drill commit ea22847fcb97: jellyfin jellyfin/jellyfin:12.4 -> jellyfin/jellyfin:10.11.11 (push rc=0)
|
||||
17:05:17 [5] the box's drill mirror now at ea22847
|
||||
ea22847fcb97
|
||||
@@ -0,0 +1,25 @@
|
||||
16:51:46 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
16:51:46 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
16:52:47 [1] deployed, controller state=running, pinned={'jellyfin': 'jellyfin/jellyfin:10.11.11'}
|
||||
16:52:47 gate: jellyfin is gated — passed as the household (cookie set)
|
||||
16:52:50 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}
|
||||
16:52:51 jellyfin: seeded first user drill32e938f7
|
||||
16:52:53 jellyfin: sign-in as the seeded user http=200 token=True (wrong password refused: http 401)
|
||||
16:52:54 [5] drill commit a6f8052b643e: jellyfin jellyfin/jellyfin:10.11.11 -> jellyfin/jellyfin:12.4 (push rc=0)
|
||||
16:53:02 [5] the box's drill mirror now at a6f8052
|
||||
16:53:07 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
|
||||
16:53:07 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None
|
||||
16:53:10 + 3.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None
|
||||
16:53:11 + 4.1s phase=pulling label=Új verzió letöltése… err=None hold=None
|
||||
16:53:39 + 31.8s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None
|
||||
16:53:49 + 42.0s phase=starting label=Indítás az új verzióval… err=None hold=None
|
||||
16:53:50 + 43.0s phase=verifying label=Működés ellenőrzése… err=None hold=None
|
||||
16:54:00 + 53.3s phase=done label=Frissítve err=None hold=None
|
||||
16:54:20 jellyfin: sign-in as the seeded user http=200 token=True (wrong password refused: http 401)
|
||||
16:54:20 [7] memory soak 600 s …
|
||||
17:04:26 [7] soak: peak 4.9% of the limit (anon), kills 0, restarts 0
|
||||
17:04:26 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/jellyfin/verdict.json
|
||||
17:04:26 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back
|
||||
17:04:26 [X] stop -> 200 {'ok': True, 'message': 'Stack jellyfin stop completed'}
|
||||
17:04:58 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'jellyfin', 'volumes_removed': ['jellyfin_jellyfin_cache', 'jellyfin_jellyfin_config'], 'hdd_paths_removed': [], 'hdd_paths_pre
|
||||
17:05:07 [X] after remove: deployed=False leftovers=''
|
||||
@@ -0,0 +1 @@
|
||||
WROTE jellyfin: {'jellyfin': 'jellyfin/jellyfin:10.11.11'} -> {'jellyfin': 'jellyfin/jellyfin:12.4'} peak 5.0% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}
|
||||
+229
@@ -0,0 +1,229 @@
|
||||
{
|
||||
"app": "mealie",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "proven",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.28.0"
|
||||
},
|
||||
"to": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.29.0"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.28.0"
|
||||
},
|
||||
"installed_images": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.28.0"
|
||||
},
|
||||
"catalog_images": null,
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/mealie-recipes/mealie:v3.28.0@sha256:8b02290f4d1806f02acac6f25f6d48a3c965612fda1f8e914d5af533276f8688"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"mealie ghcr.io/mealie-recipes/mealie:v3.28.0@sha256:8b02290f4d1806f02acac6f25f6d48a3c965612fda1f8e914d5af533276f8688 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "401",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"seed": "read_back",
|
||||
"drill_commit": "33ac1b301150",
|
||||
"sync_waited_s": 4.5,
|
||||
"badge_before": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
|
||||
"text": "Frissítés elérhető — ma"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "A newer version of this app is available. Select the Update button to start it.",
|
||||
"text": "Update available — today"
|
||||
}
|
||||
]
|
||||
},
|
||||
"measured_at": "2026-10-27T14:44:30Z",
|
||||
"update": {
|
||||
"accepted": true,
|
||||
"http": "202",
|
||||
"phases": [
|
||||
{
|
||||
"t": 0.0,
|
||||
"phase": "backing-up",
|
||||
"label": "Biztonsági mentés készül a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 4.1,
|
||||
"phase": "safety-dump",
|
||||
"label": "Adatbázis pillanatkép…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 5.1,
|
||||
"phase": "pulling",
|
||||
"label": "Új verzió letöltése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 43.5,
|
||||
"phase": "copying",
|
||||
"label": "Az adatok másolása a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 49.6,
|
||||
"phase": "starting",
|
||||
"label": "Indítás az új verzióval…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 50.7,
|
||||
"phase": "verifying",
|
||||
"label": "Működés ellenőrzése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 66.0,
|
||||
"phase": "done",
|
||||
"label": "Frissítve",
|
||||
"updating": false,
|
||||
"error": null,
|
||||
"hold": null
|
||||
}
|
||||
],
|
||||
"duration_s": 66.0,
|
||||
"final_phase": "done",
|
||||
"update_error": null,
|
||||
"hold_reason": null,
|
||||
"state": "running"
|
||||
},
|
||||
"observables_after": {
|
||||
"pinned_images": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.29.0"
|
||||
},
|
||||
"installed_images": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.29.0"
|
||||
},
|
||||
"catalog_images": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.29.0"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/mealie-recipes/mealie:v3.29.0"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"mealie ghcr.io/mealie-recipes/mealie:v3.29.0 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"badge_after": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.",
|
||||
"text": "Naprakész"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "This app is running the newest version available.",
|
||||
"text": "Up to date"
|
||||
}
|
||||
]
|
||||
},
|
||||
"state_after": "running",
|
||||
"hold_after": null,
|
||||
"to_digests": {
|
||||
"mealie": "sha256:78eb28b8776d0bad40c5e605c72b3f4f5976793e491558c7dcbdfc04c835d4bc"
|
||||
},
|
||||
"four_observables": {
|
||||
"pinned": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.29.0"
|
||||
},
|
||||
"installed": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.29.0"
|
||||
},
|
||||
"catalog": {
|
||||
"mealie": "ghcr.io/mealie-recipes/mealie:v3.29.0"
|
||||
},
|
||||
"live_compose": [
|
||||
"ghcr.io/mealie-recipes/mealie:v3.29.0"
|
||||
]
|
||||
},
|
||||
"seed_read_after": true,
|
||||
"setup_gate_after": {
|
||||
"browser": {
|
||||
"status": "200",
|
||||
"redirect": null
|
||||
},
|
||||
"script": {
|
||||
"status": "200",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"memory": {
|
||||
"soak_s": 600,
|
||||
"interval_s": 10,
|
||||
"samples": 60,
|
||||
"containers": {
|
||||
"mealie": {
|
||||
"samples": 60,
|
||||
"anon_peak_bytes": 242831360,
|
||||
"limit_bytes": 1048576000,
|
||||
"anon_peak_pct": 23.2,
|
||||
"cgroup_peak_pct": 26.4,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-c58a42735c9a9828f82f0ff5c66b35c509fd4db6b161f5f2f6fe70b38e56cfbf.scope"
|
||||
}
|
||||
},
|
||||
"oom_kills": 0,
|
||||
"restarts": 0,
|
||||
"peak_pct": 23.2
|
||||
},
|
||||
"why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back",
|
||||
"log": [
|
||||
"15:43:04 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['ADMIN_PASSWORD']",
|
||||
"15:43:05 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"15:44:10 [1] deployed, controller state=running, pinned={'mealie': 'ghcr.io/mealie-recipes/mealie:v3.28.0'}",
|
||||
"15:44:10 gate: recipes is gated — passed as the household (cookie set)",
|
||||
"15:44:14 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}",
|
||||
"15:44:15 mealie: create recipe http=201",
|
||||
"15:44:16 mealie: readback of the seeded recipe http=200 ok=True",
|
||||
"15:44:17 [5] drill commit 33ac1b301150: mealie ghcr.io/mealie-recipes/mealie:v3.28.0 -> ghcr.io/mealie-recipes/mealie:v3.29.0 (push rc=0)",
|
||||
"15:44:25 [5] the box's drill mirror now at 33ac1b301",
|
||||
"15:44:30 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
|
||||
"15:44:30 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None",
|
||||
"15:44:35 + 4.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None",
|
||||
"15:44:36 + 5.1s phase=pulling label=Új verzió letöltése… err=None hold=None",
|
||||
"15:45:14 + 43.5s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None",
|
||||
"15:45:20 + 49.6s phase=starting label=Indítás az új verzióval… err=None hold=None",
|
||||
"15:45:21 + 50.7s phase=verifying label=Működés ellenőrzése… err=None hold=None",
|
||||
"15:45:36 + 66.0s phase=done label=Frissítve err=None hold=None",
|
||||
"15:45:56 mealie: readback of the seeded recipe http=200 ok=True",
|
||||
"15:45:57 [7] memory soak 600 s …",
|
||||
"15:56:02 [7] soak: peak 23.2% of the limit (anon), kills 0, restarts 0"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
15:56:47 [5] drill commit e08f6fd1d448: mealie ghcr.io/mealie-recipes/mealie:v3.29.0 -> ghcr.io/mealie-recipes/mealie:v3.28.0 (push rc=0)
|
||||
15:56:55 [5] the box's drill mirror now at e08f6fd1d
|
||||
e08f6fd1d448
|
||||
@@ -0,0 +1,25 @@
|
||||
15:43:04 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['ADMIN_PASSWORD']
|
||||
15:43:05 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
15:44:10 [1] deployed, controller state=running, pinned={'mealie': 'ghcr.io/mealie-recipes/mealie:v3.28.0'}
|
||||
15:44:10 gate: recipes is gated — passed as the household (cookie set)
|
||||
15:44:14 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}
|
||||
15:44:15 mealie: create recipe http=201
|
||||
15:44:16 mealie: readback of the seeded recipe http=200 ok=True
|
||||
15:44:17 [5] drill commit 33ac1b301150: mealie ghcr.io/mealie-recipes/mealie:v3.28.0 -> ghcr.io/mealie-recipes/mealie:v3.29.0 (push rc=0)
|
||||
15:44:25 [5] the box's drill mirror now at 33ac1b301
|
||||
15:44:30 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
|
||||
15:44:30 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None
|
||||
15:44:35 + 4.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None
|
||||
15:44:36 + 5.1s phase=pulling label=Új verzió letöltése… err=None hold=None
|
||||
15:45:14 + 43.5s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None
|
||||
15:45:20 + 49.6s phase=starting label=Indítás az új verzióval… err=None hold=None
|
||||
15:45:21 + 50.7s phase=verifying label=Működés ellenőrzése… err=None hold=None
|
||||
15:45:36 + 66.0s phase=done label=Frissítve err=None hold=None
|
||||
15:45:56 mealie: readback of the seeded recipe http=200 ok=True
|
||||
15:45:57 [7] memory soak 600 s …
|
||||
15:56:02 [7] soak: peak 23.2% of the limit (anon), kills 0, restarts 0
|
||||
15:56:02 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/mealie/verdict.json
|
||||
15:56:02 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back
|
||||
15:56:04 [X] stop -> 200 {'ok': True, 'message': 'Stack mealie stop completed'}
|
||||
15:56:36 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'mealie', 'volumes_removed': ['mealie_mealie_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalm
|
||||
15:56:44 [X] after remove: deployed=False leftovers=''
|
||||
@@ -0,0 +1,3 @@
|
||||
STEP mealie: the superseded step {'mealie': 'ghcr.io/mealie-recipes/mealie:v3.28.0'} keeps its definition at steps/a54b0fc61c1df5e3.yml
|
||||
STEP mealie: … and its .felhom.yml at steps/a54b0fc61c1df5e3.felhom.yml
|
||||
WROTE mealie: {'mealie': 'ghcr.io/mealie-recipes/mealie:v3.28.0'} -> {'mealie': 'ghcr.io/mealie-recipes/mealie:v3.29.0'} peak 23.2% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}
|
||||
@@ -0,0 +1,221 @@
|
||||
{
|
||||
"app": "n8n",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "proven",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"n8n": "n8nio/n8n:2.42.1"
|
||||
},
|
||||
"to": {
|
||||
"n8n": "n8nio/n8n:2.44.7"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"n8n": "n8nio/n8n:2.42.1"
|
||||
},
|
||||
"installed_images": {
|
||||
"n8n": "n8nio/n8n:2.42.1"
|
||||
},
|
||||
"catalog_images": {
|
||||
"n8n": "n8nio/n8n:2.42.1"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: n8nio/n8n:2.42.1@sha256:e7634e62f766044dc770460db8defdcd84034eb6d767dd6a1101d49fe98f814f"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"n8n n8nio/n8n:2.42.1@sha256:e7634e62f766044dc770460db8defdcd84034eb6d767dd6a1101d49fe98f814f running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "401",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"seed": "read_back",
|
||||
"drill_commit": "fabba433307c",
|
||||
"sync_waited_s": 4.5,
|
||||
"badge_before": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
|
||||
"text": "Frissítés elérhető — ma"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "A newer version of this app is available. Select the Update button to start it.",
|
||||
"text": "Update available — today"
|
||||
}
|
||||
]
|
||||
},
|
||||
"measured_at": "2026-10-27T13:56:23Z",
|
||||
"update": {
|
||||
"accepted": true,
|
||||
"http": "202",
|
||||
"phases": [
|
||||
{
|
||||
"t": 0.0,
|
||||
"phase": "backing-up",
|
||||
"label": "Biztonsági mentés készül a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 3.1,
|
||||
"phase": "safety-dump",
|
||||
"label": "Adatbázis pillanatkép…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 4.1,
|
||||
"phase": "pulling",
|
||||
"label": "Új verzió letöltése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 140.0,
|
||||
"phase": "copying",
|
||||
"label": "Az adatok másolása a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 147.2,
|
||||
"phase": "verifying",
|
||||
"label": "Működés ellenőrzése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 158.6,
|
||||
"phase": "done",
|
||||
"label": "Frissítve",
|
||||
"updating": false,
|
||||
"error": null,
|
||||
"hold": null
|
||||
}
|
||||
],
|
||||
"duration_s": 158.6,
|
||||
"final_phase": "done",
|
||||
"update_error": null,
|
||||
"hold_reason": null,
|
||||
"state": "running"
|
||||
},
|
||||
"observables_after": {
|
||||
"pinned_images": {
|
||||
"n8n": "n8nio/n8n:2.44.7"
|
||||
},
|
||||
"installed_images": {
|
||||
"n8n": "n8nio/n8n:2.44.7"
|
||||
},
|
||||
"catalog_images": {
|
||||
"n8n": "n8nio/n8n:2.44.7"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: n8nio/n8n:2.44.7"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"n8n n8nio/n8n:2.44.7 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"badge_after": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.",
|
||||
"text": "Naprakész"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "This app is running the newest version available.",
|
||||
"text": "Up to date"
|
||||
}
|
||||
]
|
||||
},
|
||||
"state_after": "running",
|
||||
"hold_after": null,
|
||||
"to_digests": {
|
||||
"n8n": "sha256:942bc274709f27f99f7c6024a785d8e8f75ac06838cabcba448abb8d9127ec7b"
|
||||
},
|
||||
"four_observables": {
|
||||
"pinned": {
|
||||
"n8n": "n8nio/n8n:2.44.7"
|
||||
},
|
||||
"installed": {
|
||||
"n8n": "n8nio/n8n:2.44.7"
|
||||
},
|
||||
"catalog": {
|
||||
"n8n": "n8nio/n8n:2.44.7"
|
||||
},
|
||||
"live_compose": [
|
||||
"n8nio/n8n:2.44.7"
|
||||
]
|
||||
},
|
||||
"seed_read_after": true,
|
||||
"setup_gate_after": {
|
||||
"browser": {
|
||||
"status": "200",
|
||||
"redirect": null
|
||||
},
|
||||
"script": {
|
||||
"status": "200",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"memory": {
|
||||
"soak_s": 600,
|
||||
"interval_s": 10,
|
||||
"samples": 60,
|
||||
"containers": {
|
||||
"n8n": {
|
||||
"samples": 60,
|
||||
"anon_peak_bytes": 520908800,
|
||||
"limit_bytes": 1610612736,
|
||||
"anon_peak_pct": 32.3,
|
||||
"cgroup_peak_pct": 62.1,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-9eb5c2a40aa12e1d720b9adf273fa557c16f82690382d018dbab6aae47553ef3.scope"
|
||||
}
|
||||
},
|
||||
"oom_kills": 0,
|
||||
"restarts": 0,
|
||||
"peak_pct": 32.3
|
||||
},
|
||||
"why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back",
|
||||
"log": [
|
||||
"14:53:49 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"14:55:59 [1] deployed, controller state=running, pinned={'n8n': 'n8nio/n8n:2.42.1'}",
|
||||
"14:55:59 gate: auto is gated — passed as the household (cookie set)",
|
||||
"14:56:08 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}",
|
||||
"14:56:09 n8n: /rest/owner/setup http=200",
|
||||
"14:56:09 n8n: login as the seeded owner http=200 ok=True",
|
||||
"14:56:10 [5] drill commit fabba433307c: n8n n8nio/n8n:2.42.1 -> n8nio/n8n:2.44.7 (push rc=0)",
|
||||
"14:56:19 [5] the box's drill mirror now at fabba4333",
|
||||
"14:56:23 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
|
||||
"14:56:23 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None",
|
||||
"14:56:27 + 3.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None",
|
||||
"14:56:28 + 4.1s phase=pulling label=Új verzió letöltése… err=None hold=None",
|
||||
"14:58:43 + 140.0s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None",
|
||||
"14:58:51 + 147.2s phase=verifying label=Működés ellenőrzése… err=None hold=None",
|
||||
"14:59:02 + 158.6s phase=done label=Frissítve err=None hold=None",
|
||||
"14:59:21 n8n: login as the seeded owner http=200 ok=True",
|
||||
"14:59:21 [7] memory soak 600 s …",
|
||||
"15:09:27 [7] soak: peak 32.3% of the limit (anon), kills 0, restarts 0"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
15:10:11 [5] drill commit d175052a7428: n8n n8nio/n8n:2.44.7 -> n8nio/n8n:2.42.1 (push rc=0)
|
||||
15:10:20 [5] the box's drill mirror now at d175052a7
|
||||
d175052a7428
|
||||
@@ -0,0 +1,23 @@
|
||||
14:53:49 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
14:55:59 [1] deployed, controller state=running, pinned={'n8n': 'n8nio/n8n:2.42.1'}
|
||||
14:55:59 gate: auto is gated — passed as the household (cookie set)
|
||||
14:56:08 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}
|
||||
14:56:09 n8n: /rest/owner/setup http=200
|
||||
14:56:09 n8n: login as the seeded owner http=200 ok=True
|
||||
14:56:10 [5] drill commit fabba433307c: n8n n8nio/n8n:2.42.1 -> n8nio/n8n:2.44.7 (push rc=0)
|
||||
14:56:19 [5] the box's drill mirror now at fabba4333
|
||||
14:56:23 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
|
||||
14:56:23 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None
|
||||
14:56:27 + 3.1s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None
|
||||
14:56:28 + 4.1s phase=pulling label=Új verzió letöltése… err=None hold=None
|
||||
14:58:43 + 140.0s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None
|
||||
14:58:51 + 147.2s phase=verifying label=Működés ellenőrzése… err=None hold=None
|
||||
14:59:02 + 158.6s phase=done label=Frissítve err=None hold=None
|
||||
14:59:21 n8n: login as the seeded owner http=200 ok=True
|
||||
14:59:21 [7] memory soak 600 s …
|
||||
15:09:27 [7] soak: peak 32.3% of the limit (anon), kills 0, restarts 0
|
||||
15:09:27 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/n8n/verdict.json
|
||||
15:09:27 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back
|
||||
15:09:28 [X] stop -> 200 {'ok': True, 'message': 'Stack n8n stop completed'}
|
||||
15:10:00 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'n8n', 'volumes_removed': ['n8n_n8n_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazás nem
|
||||
15:10:09 [X] after remove: deployed=False leftovers=''
|
||||
@@ -0,0 +1,3 @@
|
||||
STEP n8n: the superseded step {'n8n': 'n8nio/n8n:2.42.1'} keeps its definition at steps/9083c23d189f5b92.yml
|
||||
STEP n8n: … and its .felhom.yml at steps/9083c23d189f5b92.felhom.yml
|
||||
WROTE n8n: {'n8n': 'n8nio/n8n:2.42.1'} -> {'n8n': 'n8nio/n8n:2.44.7'} peak 32.3% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}
|
||||
+228
@@ -0,0 +1,228 @@
|
||||
{
|
||||
"app": "privatebin",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "proven",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"privatebin": "privatebin/pdo:2.0.6"
|
||||
},
|
||||
"to": {
|
||||
"privatebin": "privatebin/pdo:2.1.0"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"privatebin": "privatebin/pdo:2.0.6"
|
||||
},
|
||||
"installed_images": {
|
||||
"privatebin": "privatebin/pdo:2.0.6"
|
||||
},
|
||||
"catalog_images": null,
|
||||
"live_compose_image_lines": [
|
||||
"image: privatebin/pdo:2.0.6@sha256:4c141b2326f8b353598ce9ce7507a9cfecf2dad5c60a39fea903d430e296d8f5"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"privatebin privatebin/pdo:2.0.6@sha256:4c141b2326f8b353598ce9ce7507a9cfecf2dad5c60a39fea903d430e296d8f5 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "200",
|
||||
"redirect": null
|
||||
},
|
||||
"script": {
|
||||
"status": "200",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"seed": "read_back",
|
||||
"drill_commit": "837de7ffa496",
|
||||
"sync_waited_s": 27.0,
|
||||
"badge_before": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
|
||||
"text": "Frissítés elérhető — ma"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "A newer version of this app is available. Select the Update button to start it.",
|
||||
"text": "Update available — today"
|
||||
}
|
||||
]
|
||||
},
|
||||
"measured_at": "2026-10-27T13:56:56Z",
|
||||
"update": {
|
||||
"accepted": true,
|
||||
"http": "202",
|
||||
"phases": [
|
||||
{
|
||||
"t": 0.0,
|
||||
"phase": "checking",
|
||||
"label": "Ellenőrzés…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 1.0,
|
||||
"phase": "backing-up",
|
||||
"label": "Biztonsági mentés készül a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 6.2,
|
||||
"phase": "safety-dump",
|
||||
"label": "Adatbázis pillanatkép…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 7.2,
|
||||
"phase": "pulling",
|
||||
"label": "Új verzió letöltése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 11.3,
|
||||
"phase": "copying",
|
||||
"label": "Az adatok másolása a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 14.3,
|
||||
"phase": "verifying",
|
||||
"label": "Működés ellenőrzése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 19.5,
|
||||
"phase": "done",
|
||||
"label": "Frissítve",
|
||||
"updating": false,
|
||||
"error": null,
|
||||
"hold": null
|
||||
}
|
||||
],
|
||||
"duration_s": 19.5,
|
||||
"final_phase": "done",
|
||||
"update_error": null,
|
||||
"hold_reason": null,
|
||||
"state": "running"
|
||||
},
|
||||
"observables_after": {
|
||||
"pinned_images": {
|
||||
"privatebin": "privatebin/pdo:2.1.0"
|
||||
},
|
||||
"installed_images": {
|
||||
"privatebin": "privatebin/pdo:2.1.0"
|
||||
},
|
||||
"catalog_images": {
|
||||
"privatebin": "privatebin/pdo:2.1.0"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: privatebin/pdo:2.1.0"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"privatebin privatebin/pdo:2.1.0 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"badge_after": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.",
|
||||
"text": "Naprakész"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "This app is running the newest version available.",
|
||||
"text": "Up to date"
|
||||
}
|
||||
]
|
||||
},
|
||||
"state_after": "running",
|
||||
"hold_after": null,
|
||||
"to_digests": {
|
||||
"privatebin": "sha256:3400b0a4714d62161727a710c82a3e319cfea364ac6e591aed653f5bb6bb8055"
|
||||
},
|
||||
"four_observables": {
|
||||
"pinned": {
|
||||
"privatebin": "privatebin/pdo:2.1.0"
|
||||
},
|
||||
"installed": {
|
||||
"privatebin": "privatebin/pdo:2.1.0"
|
||||
},
|
||||
"catalog": {
|
||||
"privatebin": "privatebin/pdo:2.1.0"
|
||||
},
|
||||
"live_compose": [
|
||||
"privatebin/pdo:2.1.0"
|
||||
]
|
||||
},
|
||||
"seed_read_after": true,
|
||||
"setup_gate_after": {
|
||||
"browser": {
|
||||
"status": "200",
|
||||
"redirect": null
|
||||
},
|
||||
"script": {
|
||||
"status": "200",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"memory": {
|
||||
"soak_s": 600,
|
||||
"interval_s": 10,
|
||||
"samples": 60,
|
||||
"containers": {
|
||||
"privatebin": {
|
||||
"samples": 60,
|
||||
"anon_peak_bytes": 34672640,
|
||||
"limit_bytes": 134217728,
|
||||
"anon_peak_pct": 25.8,
|
||||
"cgroup_peak_pct": 34.6,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-043362473ac067e166e3136df6acfeee1812461d3f6fd926546e0fd35feec6d6.scope"
|
||||
}
|
||||
},
|
||||
"oom_kills": 0,
|
||||
"restarts": 0,
|
||||
"peak_pct": 25.8
|
||||
},
|
||||
"why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back",
|
||||
"log": [
|
||||
"14:55:51 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"14:56:11 [1] deployed, controller state=running, pinned={'privatebin': 'privatebin/pdo:2.0.6'}",
|
||||
"14:56:15 [2] setup gate as installed: {'browser': {'status': '200', 'redirect': None}, 'script': {'status': '200', 'redirect': None}}",
|
||||
"14:56:15 privatebin: seeded paste id=add805a9d79e114c",
|
||||
"14:56:15 privatebin: readback http=200 marker_present=True",
|
||||
"14:56:20 [5] drill commit 837de7ffa496: privatebin privatebin/pdo:2.0.6 -> privatebin/pdo:2.1.0 (push rc=0)",
|
||||
"14:56:28 [5] the box's drill mirror now at 837de7ffa",
|
||||
"14:56:55 [sync] the badge needed 27.0s and 3 sync+rescan rounds to catch up to privatebin/pdo:2.1.0 — R-607's window, measured",
|
||||
"14:56:56 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
|
||||
"14:56:56 + 0.0s phase=checking label=Ellenőrzés… err=None hold=None",
|
||||
"14:56:57 + 1.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None",
|
||||
"14:57:02 + 6.2s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None",
|
||||
"14:57:03 + 7.2s phase=pulling label=Új verzió letöltése… err=None hold=None",
|
||||
"14:57:07 + 11.3s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None",
|
||||
"14:57:10 + 14.3s phase=verifying label=Működés ellenőrzése… err=None hold=None",
|
||||
"14:57:15 + 19.5s phase=done label=Frissítve err=None hold=None",
|
||||
"14:57:35 privatebin: readback http=200 marker_present=True",
|
||||
"14:57:35 [7] memory soak 600 s …",
|
||||
"15:07:41 [7] soak: peak 25.8% of the limit (anon), kills 0, restarts 0"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
15:08:24 [5] drill commit d0f6b22831d1: privatebin privatebin/pdo:2.1.0 -> privatebin/pdo:2.0.6 (push rc=0)
|
||||
15:08:33 [5] the box's drill mirror now at d0f6b2283
|
||||
d0f6b22831d1
|
||||
@@ -0,0 +1,24 @@
|
||||
14:55:51 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
14:56:11 [1] deployed, controller state=running, pinned={'privatebin': 'privatebin/pdo:2.0.6'}
|
||||
14:56:15 [2] setup gate as installed: {'browser': {'status': '200', 'redirect': None}, 'script': {'status': '200', 'redirect': None}}
|
||||
14:56:15 privatebin: seeded paste id=add805a9d79e114c
|
||||
14:56:15 privatebin: readback http=200 marker_present=True
|
||||
14:56:20 [5] drill commit 837de7ffa496: privatebin privatebin/pdo:2.0.6 -> privatebin/pdo:2.1.0 (push rc=0)
|
||||
14:56:28 [5] the box's drill mirror now at 837de7ffa
|
||||
14:56:55 [sync] the badge needed 27.0s and 3 sync+rescan rounds to catch up to privatebin/pdo:2.1.0 — R-607's window, measured
|
||||
14:56:56 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
|
||||
14:56:56 + 0.0s phase=checking label=Ellenőrzés… err=None hold=None
|
||||
14:56:57 + 1.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None
|
||||
14:57:02 + 6.2s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None
|
||||
14:57:03 + 7.2s phase=pulling label=Új verzió letöltése… err=None hold=None
|
||||
14:57:07 + 11.3s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None
|
||||
14:57:10 + 14.3s phase=verifying label=Működés ellenőrzése… err=None hold=None
|
||||
14:57:15 + 19.5s phase=done label=Frissítve err=None hold=None
|
||||
14:57:35 privatebin: readback http=200 marker_present=True
|
||||
14:57:35 [7] memory soak 600 s …
|
||||
15:07:41 [7] soak: peak 25.8% of the limit (anon), kills 0, restarts 0
|
||||
15:07:41 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/privatebin/verdict.json
|
||||
15:07:41 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back
|
||||
15:07:42 [X] stop -> 200 {'ok': True, 'message': 'Stack privatebin stop completed'}
|
||||
15:08:14 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'privatebin', 'volumes_removed': ['privatebin_privatebin_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note'
|
||||
15:08:22 [X] after remove: deployed=False leftovers=''
|
||||
@@ -0,0 +1,3 @@
|
||||
STEP privatebin: the superseded step {'privatebin': 'privatebin/pdo:2.0.6'} keeps its definition at steps/92922b000a9b6091.yml
|
||||
STEP privatebin: … and its .felhom.yml at steps/92922b000a9b6091.felhom.yml
|
||||
WROTE privatebin: {'privatebin': 'privatebin/pdo:2.0.6'} -> {'privatebin': 'privatebin/pdo:2.1.0'} peak 25.8% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}
|
||||
+229
@@ -0,0 +1,229 @@
|
||||
{
|
||||
"app": "uptime-kuma",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "proven",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"uptime-kuma": "louislam/uptime-kuma:2.5.5"
|
||||
},
|
||||
"to": {
|
||||
"uptime-kuma": "louislam/uptime-kuma:2.5.7"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"uptime-kuma": "louislam/uptime-kuma:2.5.5"
|
||||
},
|
||||
"installed_images": {
|
||||
"uptime-kuma": "louislam/uptime-kuma:2.5.5"
|
||||
},
|
||||
"catalog_images": null,
|
||||
"live_compose_image_lines": [
|
||||
"image: louislam/uptime-kuma:2.5.5@sha256:c74379ac4509ce2d2c2633f509e67003ee2e45b6e995c5e43fc101f45a0e1fbe"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"uptime-kuma louislam/uptime-kuma:2.5.5@sha256:c74379ac4509ce2d2c2633f509e67003ee2e45b6e995c5e43fc101f45a0e1fbe running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "401",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"seed": "read_back",
|
||||
"drill_commit": "716392401e82",
|
||||
"sync_waited_s": 4.5,
|
||||
"badge_before": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
|
||||
"text": "Frissítés elérhető — ma"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "A newer version of this app is available. Select the Update button to start it.",
|
||||
"text": "Update available — today"
|
||||
}
|
||||
]
|
||||
},
|
||||
"measured_at": "2026-10-27T14:24:47Z",
|
||||
"update": {
|
||||
"accepted": true,
|
||||
"http": "202",
|
||||
"phases": [
|
||||
{
|
||||
"t": 0.0,
|
||||
"phase": "backing-up",
|
||||
"label": "Biztonsági mentés készül a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 6.2,
|
||||
"phase": "safety-dump",
|
||||
"label": "Adatbázis pillanatkép…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 7.2,
|
||||
"phase": "pulling",
|
||||
"label": "Új verzió letöltése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 50.2,
|
||||
"phase": "copying",
|
||||
"label": "Az adatok másolása a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 60.4,
|
||||
"phase": "starting",
|
||||
"label": "Indítás az új verzióval…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 61.5,
|
||||
"phase": "verifying",
|
||||
"label": "Működés ellenőrzése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 66.6,
|
||||
"phase": "done",
|
||||
"label": "Frissítve",
|
||||
"updating": false,
|
||||
"error": null,
|
||||
"hold": null
|
||||
}
|
||||
],
|
||||
"duration_s": 66.6,
|
||||
"final_phase": "done",
|
||||
"update_error": null,
|
||||
"hold_reason": null,
|
||||
"state": "running"
|
||||
},
|
||||
"observables_after": {
|
||||
"pinned_images": {
|
||||
"uptime-kuma": "louislam/uptime-kuma:2.5.7"
|
||||
},
|
||||
"installed_images": {
|
||||
"uptime-kuma": "louislam/uptime-kuma:2.5.7"
|
||||
},
|
||||
"catalog_images": {
|
||||
"uptime-kuma": "louislam/uptime-kuma:2.5.7"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: louislam/uptime-kuma:2.5.7"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"uptime-kuma louislam/uptime-kuma:2.5.7 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"badge_after": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.",
|
||||
"text": "Naprakész"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "This app is running the newest version available.",
|
||||
"text": "Up to date"
|
||||
}
|
||||
]
|
||||
},
|
||||
"state_after": "running",
|
||||
"hold_after": null,
|
||||
"to_digests": {
|
||||
"uptime-kuma": "sha256:4b95dbe7ac5343b768f8e04e3035ccd59997872b1a35ab9b0f082d2cc279070e"
|
||||
},
|
||||
"four_observables": {
|
||||
"pinned": {
|
||||
"uptime-kuma": "louislam/uptime-kuma:2.5.7"
|
||||
},
|
||||
"installed": {
|
||||
"uptime-kuma": "louislam/uptime-kuma:2.5.7"
|
||||
},
|
||||
"catalog": {
|
||||
"uptime-kuma": "louislam/uptime-kuma:2.5.7"
|
||||
},
|
||||
"live_compose": [
|
||||
"louislam/uptime-kuma:2.5.7"
|
||||
]
|
||||
},
|
||||
"seed_read_after": true,
|
||||
"setup_gate_after": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "401",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"memory": {
|
||||
"soak_s": 600,
|
||||
"interval_s": 10,
|
||||
"samples": 60,
|
||||
"containers": {
|
||||
"uptime-kuma": {
|
||||
"samples": 60,
|
||||
"anon_peak_bytes": 105992192,
|
||||
"limit_bytes": 402653184,
|
||||
"anon_peak_pct": 26.3,
|
||||
"cgroup_peak_pct": 31.2,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-39b8383161e3949dc61f20e0cbc56c766fcf3c77596d375bdcbc5e60414d6f60.scope"
|
||||
}
|
||||
},
|
||||
"oom_kills": 0,
|
||||
"restarts": 0,
|
||||
"peak_pct": 26.3
|
||||
},
|
||||
"why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back",
|
||||
"log": [
|
||||
"15:23:19 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"15:24:29 [1] deployed, controller state=running, pinned={'uptime-kuma': 'louislam/uptime-kuma:2.5.5'}",
|
||||
"15:24:29 gate: status is gated — passed as the household (cookie set)",
|
||||
"15:24:33 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}",
|
||||
"15:24:33 uptime-kuma: setup ok=True successAdded",
|
||||
"15:24:33 uptime-kuma: addStatusPage ok=True successAdded",
|
||||
"15:24:33 uptime-kuma: readback of the seeded status page http=200 found=True",
|
||||
"15:24:34 [5] drill commit 716392401e82: uptime-kuma louislam/uptime-kuma:2.5.5 -> louislam/uptime-kuma:2.5.7 (push rc=0)",
|
||||
"15:24:43 [5] the box's drill mirror now at 716392401",
|
||||
"15:24:48 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
|
||||
"15:24:48 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None",
|
||||
"15:24:54 + 6.2s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None",
|
||||
"15:24:55 + 7.2s phase=pulling label=Új verzió letöltése… err=None hold=None",
|
||||
"15:25:38 + 50.2s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None",
|
||||
"15:25:48 + 60.4s phase=starting label=Indítás az új verzióval… err=None hold=None",
|
||||
"15:25:49 + 61.5s phase=verifying label=Működés ellenőrzése… err=None hold=None",
|
||||
"15:25:54 + 66.6s phase=done label=Frissítve err=None hold=None",
|
||||
"15:26:13 uptime-kuma: readback of the seeded status page http=200 found=True",
|
||||
"15:26:13 [7] memory soak 600 s …",
|
||||
"15:36:18 [7] soak: peak 26.3% of the limit (anon), kills 0, restarts 0"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,3 @@
|
||||
15:37:06 [5] drill commit 0b611a6cbe91: uptime-kuma louislam/uptime-kuma:2.5.7 -> louislam/uptime-kuma:2.5.5 (push rc=0)
|
||||
15:37:14 [5] the box's drill mirror now at 0b611a6cb
|
||||
0b611a6cbe91
|
||||
@@ -0,0 +1,25 @@
|
||||
15:23:19 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
15:24:29 [1] deployed, controller state=running, pinned={'uptime-kuma': 'louislam/uptime-kuma:2.5.5'}
|
||||
15:24:29 gate: status is gated — passed as the household (cookie set)
|
||||
15:24:33 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}
|
||||
15:24:33 uptime-kuma: setup ok=True successAdded
|
||||
15:24:33 uptime-kuma: addStatusPage ok=True successAdded
|
||||
15:24:33 uptime-kuma: readback of the seeded status page http=200 found=True
|
||||
15:24:34 [5] drill commit 716392401e82: uptime-kuma louislam/uptime-kuma:2.5.5 -> louislam/uptime-kuma:2.5.7 (push rc=0)
|
||||
15:24:43 [5] the box's drill mirror now at 716392401
|
||||
15:24:48 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
|
||||
15:24:48 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None
|
||||
15:24:54 + 6.2s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None
|
||||
15:24:55 + 7.2s phase=pulling label=Új verzió letöltése… err=None hold=None
|
||||
15:25:38 + 50.2s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None
|
||||
15:25:48 + 60.4s phase=starting label=Indítás az új verzióval… err=None hold=None
|
||||
15:25:49 + 61.5s phase=verifying label=Működés ellenőrzése… err=None hold=None
|
||||
15:25:54 + 66.6s phase=done label=Frissítve err=None hold=None
|
||||
15:26:13 uptime-kuma: readback of the seeded status page http=200 found=True
|
||||
15:26:13 [7] memory soak 600 s …
|
||||
15:36:18 [7] soak: peak 26.3% of the limit (anon), kills 0, restarts 0
|
||||
15:36:18 [9] verdict proven -> /mnt/5_hdd/felhom.eu/git/felhom.eu/documentation/audits/security-app-updates-2026-10-27/walks/uptime-kuma/verdict.json
|
||||
15:36:18 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back
|
||||
15:36:23 [X] stop -> 200 {'ok': True, 'message': 'Stack uptime-kuma stop completed'}
|
||||
15:36:55 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'uptime-kuma', 'volumes_removed': ['uptime-kuma_uptime_kuma_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_no
|
||||
15:37:03 [X] after remove: deployed=False leftovers=''
|
||||
+3
@@ -0,0 +1,3 @@
|
||||
STEP uptime-kuma: the superseded step {'uptime-kuma': 'louislam/uptime-kuma:2.5.5'} keeps its definition at steps/023d7514039fca24.yml
|
||||
STEP uptime-kuma: … and its .felhom.yml at steps/023d7514039fca24.felhom.yml
|
||||
WROTE uptime-kuma: {'uptime-kuma': 'louislam/uptime-kuma:2.5.5'} -> {'uptime-kuma': 'louislam/uptime-kuma:2.5.7'} peak 26.3% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}
|
||||
@@ -26,6 +26,13 @@
|
||||
|
||||
---
|
||||
|
||||
## 2026-10-27 (day, attended) — security app updates: two rows closed (full text of the rows: `git show 708a3451:documentation/backlog/OPEN-ITEMS.md`)
|
||||
|
||||
| Row | What | Closed | Evidence |
|
||||
|---|---|---|---|
|
||||
| **R-1304** | **traefik v3.7.13 (our pin) is inside 12 advisories of October 2026, fixed in v3.7.14–v3.7.16** (GHSA-fh26-gfpp-7xxx snicheck, GHSA-hrpp-p4fc-wwf8 ForwardAuth pool, GHSA-53qr-784g-cj35 FastProxy, and nine on the Kubernetes ingress-nginx provider or NTLM/Negotiate backends). Triage from our config: docker + file providers only, no FastProxy, no per-router TLS options, no NTLM backend; ForwardAuth goes to the controller — none seem to apply. Found by the security-watch spike (R-1303). `audits/security-watch-2026-10-26/raw/repoadv-traefik_traefik.txt` (P3) | CLOSED 2026-10-27 — RELEASED: controller v0.346.1 (= v0.346.0 `b1b9be3` + one commit `5ba1b86`, tag `v0.346.1`) pins `traefik:v3.7.16`; test `TestEnsureTraefik_ANewImageRecreatesTraefik` (red first); global floor 15:50:15Z (MinAgent 0.158.1) on the operator's yes; live on Tester 1, demo-hp, demo-felhom (per-box floors, 15:41Z) and 9202: all 29 public names redirect to https; the Traefik restart 7–20 s, the tunnel gap 4–5 s per box. | `audits/security-app-updates-2026-10-27/part5/` |
|
||||
| **R-1306** | **The first security-watch run: 27 catalog pins carry published notices that affect the version we pin** (89 notices; the list with our version and the fixed versions: `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md`). Several fix only in a NEW major (Jellyfin 10.11.11 → 12.0; Gokapi 1.9.6 → 2.x; Seerr 2.7.3 → 3.x); some name no fix yet (SparkyFitness); some are release notes naming a CVE (Grafana, BookStack, PrivateBin …). The seed mailed none of them (R-1303). (P2) | CLOSED 2026-10-27 — WORKED THROUGH: 14 security-fix steps (rallly, romm, code-server, outline, vikunja; n8n, privatebin, docmost, grafana; homebox, mealie, audiobookshelf, bentopdf, uptime-kuma) + two normal steps (wishlist, bookstack) LIVE in catalog `06e603e`, `7b0071e`, `65a6b11`, each on the operator's yes at a batch STOP; 5 NOT-A-FINDING; what is left has its own row: R-1313 wanderer, R-1314 jellyfin, R-1315 gitea, R-1316 gokapi, R-1317 seerr, R-1318 karakeep, R-1319 paperless-ngx, R-1320 homepage, R-1321 tandoor, R-1322 immich, R-1311 termix, R-785 sparkyfitness. | `audits/security-app-updates-2026-10-27/TRIAGE.md` |
|
||||
|
||||
## 2026-10-27 (attended release block) — ten rows released and closed (full text of the rows: `git show 708a3451:documentation/backlog/OPEN-ITEMS.md`)
|
||||
|
||||
| Row | What | Closed | Evidence |
|
||||
|
||||
@@ -124,11 +124,11 @@ stopping line that lies.
|
||||
| **R-494** | Install & onboarding | P4 | **NARROWED 2026-09-14 by operator ruling → [P3-LOW] the hub COULD create the tunnel at customer creation, for a domain already on Cloudflare. Not blocking: every customer has their own domain and the operator creates the tunnel per day-0 A.1 (`architecture/01-topology-and-trust.md`).** *Original finding, kept:* **[P1-HIGH] A new customer's dashboard has NO reachable address unless the operator hand-makes a Cloudflare tunnel — the link in the setup-code mail is dead.** MEASURED 2026-09-14 on a fresh install from the public ISO (drill intervention **I1**): the claim mail points at `https://felhom.drill0242.felhom.eu`; that name has **no A and no AAAA** record (`dig @1.1.1.1`, control `felhom.enkisfelhom.hu` resolves); the hub has **no tunnel- or DNS-creation code** (`hub/internal/cloudflare/` holds only geo-rule removal; `cf_tunnel_token` is a pasted, optional form field, `configs.go:1478`) — day-0 runbook A.1 makes it a manual Cloudflare-dashboard step that nothing on the customer-create page asks for; the box's own split-horizon resolver on the appliance LAN IP answered `google.com` but not the dashboard name at 13:27:39Z; the agent applied the record at **13:27:44Z** (`lanresolver: applied split-horizon record … ip=192.168.0.158`, 3 m 46 s after the controller started), so the box CAN answer the name — **but only to a device that uses the box as its DNS server, and no document, screen or mail tells a household to do that**; the router and the installer-offered DNS answer nothing. The page was reachable only at the guest's LAN address with the name forced (`curl --resolve …:443:192.168.0.158`). **A volunteer could not have done that.** **What it needs:** an operator ruling — the hub creates the tunnel and DNS at customer creation, or the product gives a household a LAN address that works with no DNS change. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: operator-side automation; the operator creates the tunnel by hand per the day-0 runbook.** | — | — | CC |
|
||||
| **R-504** | Install & onboarding | P4 | **[P3-LOW] `iso.felhom.eu` cannot show an index page on its own — its root returns 404, and the download page lives on the website instead.** MEASURED 2026-09-14: `https://iso.felhom.eu/` and `/index.html` → 404; only named objects answer. The host is an R2 bucket behind a custom domain; whether R2 would serve an uploaded `index.html` at `/` was **not measured** (uploading anything to the public bucket is a publication). The ISO v1.27.0 task puts the Hungarian download page at `felhom.eu/letoltes` (published with the ISO, after the operator's yes). **Remaining:** a redirect from `iso.felhom.eu/` to that page needs a Cloudflare rule the session has no credential for. | **WAITING-ON-OPERATOR — rank P3-LOW; owner: operator (Cloudflare rule)** **Re-ranked 2026-10-03: P3→P4: households are sent to the website's download page; the bare address is cosmetic.** | — | — | operator |
|
||||
|
||||
## Apps & catalog — 19 rows (P2 1, P3 8, P4 10)
|
||||
## Apps & catalog — 19 rows (P3 8, P4 11)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| **R-1306** | Apps & catalog | P2 | **The first security-watch run: 27 catalog pins carry published notices that affect the version we pin** (89 notices; the list with our version and the fixed versions: `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md`). Several fix only in a NEW major (Jellyfin 10.11.11 → 12.0; Gokapi 1.9.6 → 2.x; Seerr 2.7.3 → 3.x); some name no fix yet (SparkyFitness); some are release notes naming a CVE (Grafana, BookStack, PrivateBin …). The seed mailed none of them (R-1303). | OPEN — filed 2026-10-26; **TRIAGED 2026-10-27** (with the key: 35 app pins in 32 apps): 15 apps go by the lane, Wishlist + BookStack as normal steps (no notice id), 11 need a big step, 5 are NOT-A-FINDING — `audits/security-app-updates-2026-10-27/TRIAGE.md` | the operator's order of triage | worst first through the security-fix lane (B23): read each notice against how the app is deployed, then a ladder step or a re-pin | CC |
|
||||
| **R-1325** | Apps & catalog | P4 | **Cal.com's image (`calcom/cal.com` v6.2.0, our pin) has had no new release for about 8 months, and upstream renamed the project (`calcom/cal.diy`, seen 2026-10-26).** An abandoned image gets no security fixes. `audits/security-app-updates-2026-10-27/triage-notes/calcom.md` | OPEN — filed 2026-10-27 | — | read the upstream repo and registry: renamed image or abandoned; then a new pin or `lifecycle: abandoned` (operator word for the latter) | CC |
|
||||
| **R-1091** | Apps & catalog | P3 | **Catalog copy that is wrong or stale at the pinned tag, found writing the guides — each needs an operator word or a live check, so none was changed tonight.** From source at each app's tag (evidence per app in `audits/app-guides-2026-10-15/B/`): (1) and (2) **DONE 2026-10-16** (operator decision D12: reword): calcom's use case now names Apple Calendar or a CalDAV calendar instead of Google/Outlook, and bentopdf's tagline and use case say the browser does the work and the file stays on the device (catalog CHANGELOG 2026-10-16); (3) **sabnzbd**, **nzbget** use_cases say Radarr/Sonarr/Jellyseerr hand them jobs — the box wires only qBittorrent and Transmission (`mediawire.go`), and a hand link needs a path mapping; (4) **onlyoffice** first_steps 3–4 tell the household to wire Nextcloud by hand — the integration toggle does it (`internal/integrations/onlyoffice_nextcloud.go`); (5) **glance**, **homepage** first_steps send the household into config files in a Docker volume no household tool reaches; (6) **lubelogger** starts with only the „Dashboard" tab and in miles (shipped `appsettings.json`), so first step 3 cannot be done as written; (7) **home-assistant** first_steps promise auto-discovered devices — the app runs on a Docker bridge, where mDNS/SSDP were measured deaf (spike R-6); (8) **homebox** and **gitea** `add_people` name menus that moved or read differently at the tag; **bookstack** `default_creds` still says `admin@admin.com / password`, which after_install replaces; **dawarich** names the API key's page „Settings" (source suggests the account page); **code-server** says „install your tools" with no sudo; **komga** names the discontinued Tachiyomi; **seerr** `docs_url` points at Overseerr; **wanderer**'s comment still says it cannot close sign-up (R-714 is fixed in the same file); (9) **nzbget** and **grafana** deploy-field descriptions say the password can be changed later — nzbget re-applies its env password at every start and grafana ignores the field after first start (R-1086 is the qBittorrent/Transmission side). | OPEN — filed 2026-10-15 | — | Live-check (5)–(7) and (9) on 9202; fix (3), (4), (8) as copy with the freeze re-admitted; re-run the guide label check for any app whose copy moves | CC |
|
||||
| **R-1308** | Apps & catalog | P3 | **14 catalog pins use a floating tag** (`redis:7-alpine`, `postgres:16-…`, `mariadb:12.3`, `nginx:…`): there is no exact version to match a notice's range against, so the security watch (R-1303) lists them FLOATING and matches nothing. `audits/security-watch-2026-10-26/ci-seed.log` (FLOATING) | OPEN — filed 2026-10-26 | — | pin the sidecars to exact versions where the engine allows (the image-pins gate today accepts a major tag) | CC |
|
||||
| **R-1092** | Apps & catalog | P4 | **Three apps show no guide: plant-it and home-assistant carry one HIDDEN (`checked_version: ""`), emby has none.** plant-it: `lifecycle: abandoned`, and its pinned image does not exist upstream, so there is no screen to check labels against. home-assistant: its frontend follows the browser language and the Hungarian strings are fetched at build time, not kept in git, so the Hungarian labels cannot be checked against source (the draft is written; the shipped frontend in the image could check them). emby: its server's web UI is in no public source at 4.11.0.4. Evidence: `audits/app-guides-2026-10-15/B/`. The other 62 templates show a checked guide (controller ≥ 0.315.0). | OPEN — filed 2026-10-15 | — | home-assistant: check the Hungarian labels against the frontend files in the pinned image (read-only, on a box running it), then set checked_version; emby: label-check against the image's own web files the same way; plant-it: nothing while abandoned | CC |
|
||||
@@ -149,15 +149,25 @@ stopping line that lies.
|
||||
| **R-1268** | Backup & restore | P3 | **Remove with „remove backups” leaves a restore's undo copy on the drive (`backups/restore-undo/<app>/`).** Seen 2026-10-24 night on Tester 1 (restore-holes Part 1, run 1): MeTube was held for support after a failed crash put-back, then removed with `remove_backups=true` — the 1.5 GB copy stayed (the removal deletes `backups/primary` and the second-drive mirror, not `restore-undo`), and nothing lists it (`audits/restore-holes-2026-10-24/P1-tester1/14-run1-teardown.txt`; removed by hand, CC's own test data). The copy is kept on purpose while a hold exists; after the app is gone it is orphaned. | OPEN | — | Remove with `remove_backups` also deletes the app's `restore-undo` folder (under the same path guard), or lists it as a kept copy | CC |
|
||||
|
||||
|
||||
## App updates — 5 rows (P2 1, P3 4)
|
||||
## App updates — 15 rows (P2 3, P3 12)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| **R-1313** | App updates | P2 | **Wanderer (v0.20.0): a critical notice with no login — any remote ActivityPub server can overwrite its records (GHSA-fprh-3pp9-68m9), and federation has no off switch; the fix is v0.21.2, a big step.** v0.21 adds a REQUIRED `POCKETBASE_PROXY_SECRET` on both services, its migration shortens rich text with no way back, and upstream wants PocketBase closed while our template publishes it on `SUBDOMAIN_DB`. No box runs Wanderer (hub 2026-10-27). `audits/security-app-updates-2026-10-27/TRIAGE.md`, `PICKS.md` pick 4 | OPEN — filed 2026-10-27 (security app updates, Part 3: not done today) | the operator's pick 4 (hide it from new installs, or leave it offered) | the big step v0.21.2 with a new fixture field and a closed PocketBase: bench + 9202 + the undo proven, then a STOP | CC |
|
||||
| **R-1315** | App updates | P2 | **Gitea 1.27.3: two critical notices for any signed-in user (7cq7, 6pv5) and two with no login (c3cr, hf55); the fix is 28.2.0 (1.28 was renamed 28.0.0 — no 1.27.4 exists).** 28.0 routes git traffic through a new proxy with egress settings. GHSA-rqhx (SSRF through migration) has no fix at all (`PICKS.md` pick 2). No box runs Gitea. `audits/security-app-updates-2026-10-27/TRIAGE.md` | OPEN — filed 2026-10-27 (security app updates, Part 3: not done today) | — | the big step 28.2.0: read the 28.0 proxy settings against our template; bench + 9202 + undo; a STOP | CC |
|
||||
| **R-1316** | App updates | P3 | **Gokapi v1.9.6: GHSA-3c22 (high, self-XSS for the only account); the fix is v2.x, a big step** — a user system with no downgrade, and our first-boot config seed must be captured again. No box runs Gokapi. `audits/security-app-updates-2026-10-27/TRIAGE.md` | OPEN — filed 2026-10-27 (security app updates, Part 3: not done today) | — | the big step v2.2.4 with a new first-boot seed; bench + 9202 + undo; a STOP | CC |
|
||||
| **R-1317** | App updates | P3 | **Seerr (jellyseerr 2.7.3): GHSA-rc4w (a stranger registers, Plex setups only) and GHSA-mc6w (path traversal to code execution, needs a hostile media server); the fix is `ghcr.io/seerr-team/seerr:v3.5.1`, a big step** — a new image name, runs as UID 1000 (`/app/config` must be chowned), a config migration. No box runs it. `audits/security-app-updates-2026-10-27/TRIAGE.md` | OPEN — filed 2026-10-27 (security app updates, Part 3: not done today) | — | the big step to seerr v3.5.1: the ownership step, the image rename; bench + 9202 + undo; a STOP | CC |
|
||||
| **R-1318** | App updates | P3 | **Karakeep 0.33.2 + chrome 151: two CISA-KEV V8 bugs in the crawler's Chromium (runs `--no-sandbox`), reached by content the household saves; the fix is 0.34.1 + chrome 154.0.8037.57-r1** — an auth library swap (everyone signed out, e-mails lowercased) and a chrome rebuilt on full Chrome (memory limit and healthcheck to measure again). No box runs it. `audits/security-app-updates-2026-10-27/TRIAGE.md` | OPEN — filed 2026-10-27 (security app updates, Part 3: not done today) | — | the big step: measure chrome 154's memory; bench + 9202 + undo; a STOP | CC |
|
||||
| **R-1319** | App updates | P3 | **Paperless-ngx 2.20.15: GHSA-2jhj (low; needs a setting we do not set — not reachable); the fix is 3.3.4, a big step** (encryption and API v1 removed, the search index rebuilt). It runs on all four test boxes. Not urgent. `audits/security-app-updates-2026-10-27/TRIAGE.md` | OPEN — filed 2026-10-27 (security app updates, Part 3: not done today) | — | the big step 3.3.4 when the catalog takes Paperless 3 for other reasons; read our API v1 use first | CC |
|
||||
| **R-1320** | App updates | P3 | **Homepage v1.13.2: a medium notice that needs a hand-written credentialed widget (family_gate in front); the fix is v2.7.0, a big step** (the auth rework). No box runs it. `audits/security-app-updates-2026-10-27/TRIAGE.md` | OPEN — filed 2026-10-27 (security app updates, Part 3: not done today) | — | the big step v2.7.0; bench + 9202 + undo; a STOP | CC |
|
||||
| **R-1321** | App updates | P3 | **Tandoor 2.6.15: GHSA-5f74 (high, an XXE file read) and GHSA-69q3 (any user); the fix is 2.7.2** — 2.7.0 removes settings and an endpoint and rewrites the login pages (our probe path — not sure), and 2.7.0/2.7.1 break invite links with sign-up off, so straight to 2.7.2. No box runs it. `audits/security-app-updates-2026-10-27/TRIAGE.md` | OPEN — filed 2026-10-27 (security app updates, Part 3: not done today) | — | a normal step to 2.7.2 with the probe path checked; bench + 9202 (+ undo if a migration); a STOP | CC |
|
||||
| **R-1322** | App updates | P3 | **Immich v3.2.4 (server + ML): only the Node.js October 2026 runtime notice (CVE-2026-111497) and a CA bundle; the lane step to v3.3.5 was not walked today** (the lowest item of the lane). No household runs Immich; 9202 has a leftover install. `audits/security-app-updates-2026-10-27/TRIAGE.md` | OPEN — filed 2026-10-27 (security app updates, Part 3: not done today) | — | the security-fix lane: `box_walk.py --security immich` on 9202 (remove the leftover first), the writer, a batch STOP | CC |
|
||||
| **R-1324** | App updates | P3 | **RomM 5.4's first start can run a 15–20 minute migration on a big library (upstream notes) — longer than the update's check window, so a household's night step could be undone for slowness, not for a fault.** Today's walk (9202, a small seed) took the step in seconds; demo-hp's RomM takes it tonight (security-fix step, catalog `06e603e`). `audits/security-app-updates-2026-10-27/triage-notes/romm.md` | OPEN — filed 2026-10-27; WATCH demo-hp's night leg line | — | read demo-hp's night leg line for romm (done / undone, the time); if undone for time: give the step a longer check or the `needs_person` mark | CC |
|
||||
| **R-1238** | App updates | P2 | **Plex has no test record and no upgrade fixture, so the night leg never updates Plex on a household box.** Filed 2026-10-23. Catalog `6cc317d` moved Plex 1.41.4.9463 → 1.43.5.11029-6bf8af3f0 (the Plex2Shell fix) on the operator's ruling, with NO `update_ladder` entry (the move gate refused; pushed `--no-verify`, the one time). With no ladder, a person's Update press pins the current compose (`stacks/ladder.go` `nextLadderStep`), but the night leg skips the app (`unattended.go` → `LegSkipNoTestRecord`), so every future Plex fix reaches a household only by a hand press. `scripts/upgrade_fixtures.py` has no Plex fixture. A likely seed route is NOT measured: an UNCLAIMED Plex answers a private-address request with no token (`architecture/13-threat-model.md`, the R-1045 row), so the bench may create and read back a library section through Plex's own API without a plex.tv account. **Needs a spike:** prove that route on the bench (seed a section, swap the image, read it back), add the fixture, then `upgrade-test.py --write-ladder` for the current pin — the box walk on 9202 needs the same route behind the setup gate. Evidence: `audits/plex-demo-boxes-2026-10-23/`. **2026-10-23 (later): the NEXT Plex fix need not wait for this** — the security-fix lane (`09` §3 decision 255, D39 = B, controller 0.341.0) takes a box-only step with `seed: "none"` at night (proven on 9202 with Plex 1.43.4 → 1.43.5, `audits/security-lane-2026-10-23/`). The bench fixture stays the aim: it is the only check that reads Plex's data back after a step. | **OPEN** | a claimed-Plex seed route on the bench | the spike above | CC |
|
||||
| **R-440** | App updates | P3 | **[P2-MEDIUM] 23 catalog image pins float, so an update is not reproducible.** `compose pull` on a moving tag fetches whatever upstream published that day. **MEASURED 2026-09-01 over `app-catalog-felhom.eu` @ `29edad9c5bf4`: 79 `image:` lines across 53 apps, 66 distinct; 23 of those lines carry a tag with no patch version.** `postgres:16-alpine` (8 apps), `redis:7-alpine` (6), `mariadb:11.6` (2), plus one each of `postgres:15-alpine`, `postgis/postgis:16-3.5-alpine`, `mariadb:11.4`, `mariadb:12.3`, `ghcr.io/claperco/claper:2.5`, `ghcr.io/thomiceli/opengist:1.13`, `wger/server:2.6`. **A 24th is arguable and is recorded rather than rounded away:** `ghcr.io/immich-app/postgres:16-vectorchord0.4.3-pgvectors0.2.0` pins both extensions exactly but leaves the PostgreSQL patch floating. A customer pressing Frissites can therefore swap their DATABASE ENGINE build with no catalog change and no record; two boxes updated on two days end up different. **Severity MEDIUM on its own; it becomes BLOCKING the moment a pre-update copy exists**, because "what did we upgrade from and to" must be recordable and today it is not — which is also why R-440 must be read next to the digest discipline in Rule 10 of the spike. **MEASURED LIVE 2026-09-01 — the floating pins have ALREADY moved, with a passing control.** Running digests on demo-hp compared against what the registry serves for the same tag today: **`mariadb:11.4` MOVED** (`sha256:4f1d8d20...` -> `sha256:611a2fcc...`) and **`mariadb:12.3` MOVED** (`sha256:a02fe89c...` -> `sha256:dd9b303a...`), while `postgres:16-alpine`, `redis:7-alpine`, `mariadb:11.6` and `opengist:1.13` were SAME — **and both fully-pinned CONTROLS (`rommapp/romm:5.0.0`, `privatebin/pdo:2.0.5`) were SAME.** So on a box with ZERO visible drift by tag, pressing Frissites today silently swaps the DATABASE ENGINE build under `romm` and `bookstack`, with no catalog change and no record. **Compounding fact found while reading:** the recovery unit records `ImagePins` but the manifest comment says *"image NOT stored - re-pulled on restore"*, so a RESTORE of a floating-pinned app also re-pulls whatever is current — the same non-reproducibility on the recovery path. **HALF OF THE ANSWER SHIPPED 2026-09-02 (controller v0.233.0, slice 1): `app.yaml.installed_images` now records, per compose SERVICE, the reference AND the repo digest each container was actually created from — so "what did we upgrade FROM" is answerable on any box that has taken one lifecycle action since the upgrade.** What is still missing is the other half: comparing that digest against what the registry serves for the same tag TODAY, which needs a network call the render path deliberately does not make (see R-446). **The row therefore stays OPEN and its rank is unchanged** — recording a digest does not make a floating pin reproducible; it makes the drift measurable after the fact. `audits/SPIKE-app-update-2026-09-01.md` **— NIGHT 2026-09-23:** every image moved tonight (and the 21 backfilled moves) carries its resolved digest in the catalog's test record; the floating pins themselves still float until the box pulls by digest (`09` §6.4 part 6). **-- MEASURED 2026-09-30 on demo-hp 9201: a fresh install or a guarded Update renders `name:tag@sha256` from the ladder (`digest.go` `RenderWithLadderDigests`) — 9 of 20 services there run such a definition (adventurelog, docmost, paperless-ngx). The other 11 run TAG-ONLY definitions: bookstack, kimai, opengist, privatebin, romm were installed before v0.269.0 and not updated since, and `CarryDigests` (`digest.go:141`) keeps only a digest the running definition already has; bentopdf and calibre-web have no ladder at all. So a re-pull of those (a restore) takes whatever the tag serves that day. `audits/pg-last-six-2026-09-30/E/E2-digests-demo-hp.txt`.** **-- 2026-09-30 (evening):** calibre-web now has a ladder entry (`53a4a1d`), so a new install or a guarded Update renders its tested digest; bentopdf still has none. `audits/more-night-apps-2026-09-30/` **Merged 2026-10-05 from R-446 (duplicate):** the household-visible consequence — for these apps the „Naprakész" badge can never turn „behind" (`felhom-controller controller/internal/stacks/updateorder.go:96` returns false with no catalog digests / no test date); R-740 (same-tag re-test) is closed, so floating-tag drift for laddered apps is handled. | **NARROWED 2026-09-30 — floating only for (1) apps with no ladder entry and (2) apps installed before v0.269.0 until their next guarded Update; owner: CC.** **Re-ranked 2026-10-03: P2→P3: narrowed to apps with no ladder entry and pre-v0.269 installs; each guarded update fixes the latter.** | — | — | CC |
|
||||
| **R-462** | App updates | P3 | **[P2-MEDIUM] Widen the upgrade harness beyond three apps — and the cost is dominated by FIXTURES, not by machine time.** The R-449 harness works and is proven by a red negative control (`audits/SPIKE-upgrade-test-2026-09-06.md` §1). **Costed with this run's REAL numbers rather than an estimate:** a successful edge takes **6.4 s – 305.1 s, median 71.8 s**; a FAILING edge takes **556 s**, roughly **8×**, because a negative is only honest if it waits out the full settle window; 3 apps / 11 images cost **5.07 GB**, so 53 apps naively extrapolate to **~90 GB** and, at the median, about an hour of harness time for one edge each. **THAT EXTRAPOLATION UNDERSTATES THE REAL COST BY AN ORDER OF MAGNITUDE, and that is the point of this row.** Two of the three apps needed a bespoke non-browser seed route; one needed two attempts and a discarded approach; one (bookstack) can only ever be half-proven (R-460). **Fixture time scales with apps and does not amortise.** **The decision this row is really asking for is scope, not schedule:** all 53, or only the apps a customer would lose data from, or only apps whose catalog transition is a MAJOR. **Recommended shape, NOT a design — the operator picks:** start with the apps that carry a database, because §3 measured that the abort question only ever bites there. Owner: **VIKTOR rules on scope, CC implements.** `audits/SPIKE-upgrade-test-2026-09-06.md` §5 **ROW CORRECTED 2026-09-21: the scope is NOT open and this row said it was.** It read *"VIKTOR rules on scope"*; the operator ruled on 2026-09-13 (`09` §3 decision 6) that the upgrade test goes to **ALL** apps through the nightly rotation, explicitly *not* "database apps first". What is open is the WORK, not the scope. An ORDER inside that ruling — the 15 database services first, because that is where a wrong answer costs data rather than uptime — is costed as a drill brief in `09` §6.4: legs A–E ≈ **21–34 CC-hours** plus ~25–30 GB on a scratch host, with legs C (a PostgreSQL `pg_upgrade` rehearsal) and E (one automatic night on a throwaway) the two that unblock a decision. **-- UPDATE NIGHT 2026-09-21:** **The count moved from 3 apps to 21 EDGES ACROSS 19 APPS.** The update night walked real within-a-major upstream edges on scratch guest 9202 through the product's own guarded Update, each app seeded and read back through its OWN front door with a negative control on every readback: **14 proven, 3 failed, 4 inconclusive**. Proven: actualbudget, audiobookshelf, bookstack, docmost, grafana, home-assistant, mealie, n8n, navidrome, papra, privatebin, romm, vikunja, and nextcloud's MariaDB engine major. **Ten of the fourteen printed a verbatim migration line**, so the database really was rewritten and the data still read back. Box-side fixtures for 20 apps now exist at `audits/update-night-2026-09-21/fixtures.py`, and four (actualbudget, navidrome, audiobookshelf, vikunja) are ported into `app-catalog-felhom.eu/scripts/upgrade_fixtures.py` with seven new EDGES (U1-U7) so the same edges can be run on the harness venue **with their ABORT step**, which the box deliberately does not offer. **OWED, stated so it is not mistaken for done:** the U1-U7 harness RUNS (the code is in, the runs are not), and fixtures for the four inconclusive apps, of which two (vaultwarden, zipline) cannot be seeded at all while the catalog rightly closes their sign-up (see R-624). **-- 2026-09-23, the RomM lesson is IN THE HARNESS:** `upgrade-test.py` v2 runs every edge that read back under light load for `--soak` seconds (default 600) and reads the kernel's `oom_kill` counter host-side; a kill or restart turns `proven` into `failed`, a peak over 80 % of the limit adds `memory_tight`. **Red-proof:** romm 5.0.0 → 5.3.0 on the template AS PROMOTED (512M, four workers) — seeded, migrated, read back, and then **OOM-killed at +76 s** under four light callers, verdict `failed` (Docker's own OOMKilled read true here; restarts stayed 0, which is why the walk never saw it). Ten minutes is ample for this failure; demo-hp's first kill came at two hours only because nothing was loading it. Evidence `audits/update-rulings-2026-09-23/harness/`. **— NIGHT 2026-09-23:** the bench and the box now share ONE fixture set — the box walk's fixtures run on the bench through `upgrade_boxport.py` (ported verbatim into the catalog), plus a new wishlist fixture and fixes for opengist 1.15, komga (`/api/v2/users/me`) and nextcloud (wait for `occ status`). 14 apps / 15 edges tried; 12 proven on both venues and published with their test records (`audits/DRILL-night-2026-09-23.md` Part C). **-- 2026-09-30 (day brief): three new front-door fixtures (sparkyfitness, rallly, outline; catalog `e6f3ec2`) and five apps moved on both venues — the three PostgreSQL conversions (R-463) plus bookstack 26.05.5 → 26.09.1 and kimai apache-2.57.0 → 2.67.0 (upstream dropped the `apache-` prefix; the plain tag's digest equals `apache`'s,Line truncated
|
||||
| **R-683** | App updates | P3 | **[P3-LOW] Watch: after a power cut during an update's health check, the hold named an HOUR-OLD second-drive copy, not the one the update's own backup should have just made.** 2026-09-24 chaos round 3 (nextcloud, `backup_max_age: 1m`): no `backing-up` phase was seen and the hold named Tier 2 at 13:04 for an update pressed at 14:04; the pre-cut controller log was lost with the container (the runner now saves it at arm time — R-320). Round 11, the same action without a power cut, named a fresh 14:34 copy and logged the Tier-2 copy. The sentence was TRUE (it named the copy it offered); the question is why the update did not back up first. Not reproduced; watch the next power-cut drill. `audits/night-2026-09-24/E/round-03*.json`, `E/round-11-controller-pre.log` | **OPEN — P3; owner: CC (watch)** | — | — | CC |
|
||||
| **R-785** | App updates | P3 | **[P3-LOW] SparkyFitness is pinned 11 releases and a major behind upstream (v0.17.3; upstream v1.7.3, v1.6.0 dated 2026-07-24).** READ 2026-10-01 (`audits/visitors-2026-10-01/C/bench/C1-previous-tag.txt`). **Needs:** an update walk 0.17 → 1.x through the ladder (bench + box), after R-784 is decided. | **OPEN — rank P3-LOW; owner: CC (after R-784)** | — | — | CC |
|
||||
| **R-785** | App updates | P3 | **[P3-LOW] SparkyFitness is pinned 11 releases and a major behind upstream (v0.17.3; upstream v1.7.3, v1.6.0 dated 2026-07-24).** READ 2026-10-01 (`audits/visitors-2026-10-01/C/bench/C1-previous-tag.txt`). **Needs:** an update walk 0.17 → 1.x through the ladder (bench + box), after R-784 is decided. **2026-10-27 (security triage):** two notices with NO fix released (GHSA-p8cf-g8rv-gvrq: a user overwrites another user's Withings link; GHSA-cmmf-53wf-r5gv: owner-only photos readable by URL) — both need a household account or a leaked URL; pick in `audits/security-app-updates-2026-10-27/PICKS.md` (CC's pick: leave it offered, take the fix with this big step). | **OPEN — rank P3-LOW; owner: CC (after R-784)** | — | — | CC |
|
||||
|
||||
## Backup & restore — 46 rows (P2 4, P3 24, P4 18)
|
||||
|
||||
@@ -228,22 +238,21 @@ stopping line that lies.
|
||||
| **R-1275** | Storage & devices | P4 | **An English household sees the drive names in Hungarian** on the install page (and wherever a storage label shows): „Belső tárhely — 52.0 GB free (default)”, „Külső tárhely (hdd_1)” (catalog sweep 2026-10-24, `audits/catalog-sweep-2026-10-24/navidrome/page-install-en.txt`). The label is stored once, in Hungarian, when the drive is found (`felhom-controller/controller/internal/settings/settings.go` `InferStorageLabel`); a household may rename it. | OPEN | — | Render a label that still equals the inferred default in the reader's language; a test per language | CC |
|
||||
| **R-1276** | Storage & devices | P4 | **„Remove with data” leaves the app's empty parent folder** (`<drive>/appdata/<app>`) when the template binds a subfolder: Grimmory, RomM, Paperless-ngx (catalog sweep 2026-10-24; 4 KB each; the bound folders were removed). Harmless (empty, not counted as old data), untidy for a household that browses the drive. | OPEN | — | Remove the parent when it is empty after the bound folders go; a test | CC |
|
||||
|
||||
## Security & access — 31 rows (P1 2, P2 5, P3 17, P4 7)
|
||||
## Security & access — 30 rows (P1 2, P2 5, P3 16, P4 7)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| **R-1241** | Security & access | P1 | **2026-10-24: the Felhom half is DONE** — hub 0.168.0 deployed (the tokens sealed; every copy leaving the volume is clean, the live file's old bytes accepted by the operator, R-975 closed), the hub volume out of the Longhorn backup (D40, R-1243 VERIFY), the two old plain copies deleted by the operator. **What stays here is the homelab half:** the open NFS export and Longhorn's login (the homelab session). **A hacked app pod on DooPlex can read the hub's nightly database copies — with every customer's unsealed Cloudflare, tunnel and git token (R-975) — through the Longhorn NFS export, and by a published file-handle escape the operator signing keys on the same disk: whoever breaks one homelab app can take over the boxes' tunnels and sign agent updates.** MEASURED 2026-10-23 (Plex2Shell impact audit, `audits/plex2shell-felhom-impact-2026-10-23/`): export `/mnt/5_hdd/backup/longhorn-pvc` rw, `no_root_squash`, `no_subtree_check`, a sub-directory of sda1, which also holds `/mnt/5_hdd/felhom.eu/felhom-op-*` (no passphrase, R-924); `secure` is void in pods (containerd sets `ip_unprivileged_port_start=0`; a uid-1000 probe with no capabilities bound port 700); the four `felhom-system` volumes have `encrypted=false`; Longhorn's API on :9500 answers any pod with no login (backups, targets, volumes). In the Plex2Shell window neither door was used — verdict NOT REACHED (nfsd accepted 0 new connections 10-10 → 10-23, positive control; no off-schedule Longhorn backup or volume). 2026-10-23 ~15:18Z, operator yes: the export was narrowed from `*` to `10.42.0.0/16` — the home network and the tailnet are closed, pods are not (Longhorn connects from its pod address). Not exercised: the escape itself (Tier-2 machine). | OPEN | the homelab session (DooPlex host + cluster); the operator (R-924) | Homelab: a NetworkPolicy so only `longhorn-system` reaches :2049/:111 and :9500, or the backup store on its own filesystem. Felhom: R-975 sealed in hub 0.168.0 (deploy pending); the hub's plain Longhorn copies → R-1243; a passphrase on the signing keys (R-924) | operator |
|
||||
| **R-1303** | Security & access | P2 | **Nobody watched the security notices of what we ship** — now a nightly CI watch (`scripts/security_watch.py`, 03:40 UTC; 108 pins: 11 box/build, 97 app): ADVISORY mails that night, BEHIND weekly, a source down two nights mails. BUILT and live-proven 2026-10-26: the test mail reached the mailbox (CI job 2407); the seed run (job 2408) recorded 142 open notices on 30 pins without mailing and committed its memory itself. Spike: `audits/security-watch-2026-10-26/SPIKE.md`; gaps: R-1307, R-1308, R-1309 | OPEN — built; closes after a week of nightly runs with the key (watch the Monday summary and one real ADVISORY mail) | none — the GitHub key is in place since 2026-10-27 (`GH_ADVISORY_TOKEN`, store and CI; its own token, not Renovate's): a dry CI run with it (job 2415) read every repo's advisories in one night (68 GitHub requests, 38 ADVISORY, 1 NOT CHECKED = one Docker Hub timeout). The first real night (job 2413, no key yet) mailed nothing: 159 silent first reads of notices the seed could not read, memory committed by the job. Logs: `audits/security-watch-2026-10-26/ci-night1-2026-10-27.log`, `ci-dry-with-key.log` | read the nightly logs to 2026-11-03; close on the Monday summary and one real ADVISORY mail | CC |
|
||||
| **R-1139** | Security & access | P2 | **Tester 2's break-glass root password was not rotated with the others (R-954, operator decision D1 = A, 2026-10-17): the box has been offline since 2026-10-04.** demo-hp, Tester 1 and demo-felhom were rotated and proven on 2026-10-17 (`audits/agent-allowlist-rotation-2026-10-17/P3/`). | OPEN — filed 2026-10-17 **2026-10-22: closes when Tester 2 is reinstalled (operator ruling 2026-10-22 14:11 — a fresh install sets and vaults a new console password).** | Tester 2 reporting again | When it reports: the installer's step 4b alone (`P3/rotate-step4b.sh` shape), then the vaulted value logs in (PVE API 200) and the old one is refused | CC |
|
||||
| **R-1305** | Security & access | P2 | **The file manager on every box (FileBrowser Quantum 1.5.6-stable) is inside 36 published notices; 2 are fixed in our own channel (1.5.7-stable)** — GHSA-qx86-4v5r-26g5 (high: with the victim's password, an anonymous request re-enrolls TOTP and skips the second factor; our households have no second factor there, so low for us) and GHSA-3846-gh75-gp3m (medium: a public upload share replaces files). Most others name fixes only on the 2.x line. `files.<domain>` is public through the tunnel (behind the controller's forwardAuth, password sign-in on). Found by the first security-watch run (R-1303). `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md` | OPEN — filed 2026-10-26 | a controller release | raise `FileBrowserImage` to 1.5.7-stable in the next controller release; triage the 34 others against 1.5.x (which apply to the stable line) | CC |
|
||||
| **R-1304** | Security & access | P3 | **traefik v3.7.13 (our pin) is inside 12 advisories of October 2026, fixed in v3.7.14–v3.7.16** (GHSA-fh26-gfpp-7xxx snicheck, GHSA-hrpp-p4fc-wwf8 ForwardAuth pool, GHSA-53qr-784g-cj35 FastProxy, and nine on the Kubernetes ingress-nginx provider or NTLM/Negotiate backends). Triage from our config: docker + file providers only, no FastProxy, no per-router TLS options, no NTLM backend; ForwardAuth goes to the controller — none seem to apply. Found by the security-watch spike (R-1303). `audits/security-watch-2026-10-26/raw/repoadv-traefik_traefik.txt` | OPEN — filed 2026-10-26 | a controller release | raise `TraefikImage` to ≥ v3.7.16 in the next controller release from `main`, with the release notes read for breaking changes | CC |
|
||||
| **R-1305** | Security & access | P2 | **The file manager on every box (FileBrowser Quantum 1.5.6-stable) is inside 36 published notices; 2 are fixed in our own channel (1.5.7-stable)** — GHSA-qx86-4v5r-26g5 (high: with the victim's password, an anonymous request re-enrolls TOTP and skips the second factor; our households have no second factor there, so low for us) and GHSA-3846-gh75-gp3m (medium: a public upload share replaces files). Most others name fixes only on the 2.x line. `files.<domain>` is public through the tunnel (behind the controller's forwardAuth, password sign-in on). Found by the first security-watch run (R-1303). `audits/security-watch-2026-10-26/ADVISORIES-2026-10-26.md` | **NARROWED 2026-10-27 — the two notices fixed in our channel are RELEASED: controller v0.346.1 pins `gtstef/filebrowser:1.5.8-stable` (1.5.7-stable skipped: it broke existing TOTP sign-ins), global floor 15:50:15Z; live on Tester 1, demo-hp, demo-felhom and 9202 (sign-in walk: listing 200, 401 without a cookie; R-1281 probe: an app container cannot reach it) — `audits/security-app-updates-2026-10-27/part5/`. LEFT: triage the 34 other notices against the 1.5.x line.** Earlier: OPEN — filed 2026-10-26 | a controller release | raise `FileBrowserImage` to 1.5.7-stable in the next controller release; triage the 34 others against 1.5.x (which apply to the stable line) | CC |
|
||||
| **R-1042** | Security & access | P3 | **The boxes' Cloudflare keys cannot change zone settings, so Cloudflare's own „Always Use HTTPS” cannot be switched on.** Measured 2026-10-14 on all three zones (`audits/https-only-2026-10-14/``1A-1-zones-and-keys.txt`): each `cf_api_token` is valid and sees only its own zone, but GET/PATCH `settings/always_use_https`, `ssl`, `security_header` answer 403; the redirect and transform rule phases too. The https-only fix therefore lives on the box (decision 246). A second layer at Cloudflare needs „Zone Settings: Edit” (and, for headers, „Transform Rules”) added to each customer's key — the hub's zone-reach check stays. | **WAITING-ON-OPERATOR** — filed 2026-10-14 | a key permission only the operator can grant | Optional: widen each customer key, then switch „Always Use HTTPS” on per zone | operator |
|
||||
| **R-1242** | Security & access | P3 | **The demo NAS export `/mnt/5_hdd/felhom-data` → 192.168.0.162 (demo-felhom) is a sub-directory of DooPlex's sda1 with `no_subtree_check`, so a compromised demo-felhom host could walk the whole disk as uid 101000 and read every world-readable file there (the GPG secrets exports are 0644, every repo, the public keys).** Measured 2026-10-23 (`audits/plex2shell-felhom-impact-2026-10-23/` Part 1; `exportfs -v`: `all_squash,anonuid=101000`). 0600 files (the signing keys) stay out of reach. Not exercised. | OPEN | a DooPlex host change (fence) | Give the demo share its own filesystem, or `subtree_check`; or remove other-read from `/mnt/5_hdd/backup/secrets/exports` | operator |
|
||||
| **R-1104** | Security & access | P3 | **Check https-only on Tester 2 when it reports again.** R-1033 (plain http on every public name) is closed on the three boxes that report (35 names → 301, 2026-10-16). Tester 2 (`sajatfelhom.hu`) has been off since 2026-10-04 on controller 0.292.0; its addresses answer Cloudflare 530 (tunnel down), so nothing is served in plain http while it is off. When it comes back it takes the floor (≥ 0.312.0 carries the redirect). | OPEN — filed 2026-10-16 | Tester 2 reporting again | Run `scripts/https_only_check.py` with Tester 2 in it; close | CC |
|
||||
| **R-1141** | Security & access | P3 | **`felhom-host-install --rotate-recovery` exists only as part of a full installer re-run, which also reinstalls the vouched agent and the root files.** On a box running a newer agent than the vouched one (demo-hp on the candidate, 2026-10-17) it would move the agent back; on a household box it is a much larger act than a password change. The 2026-10-17 rotation therefore ran the installer's own `step_break_glass` ALONE (`audits/agent-allowlist-rotation-2026-10-17/P3/`). | **NARROWED 2026-10-18 — built on `main`, not published.** `felhom-host-install.sh --rotate-recovery-only` runs step 4b alone (felhom.eu `7d64038f`): reads the hub, host id and host key from the agent config, refuses byo and every other mode flag, asks the hub's `/healthz` before the password changes, never touches the agent or root files. The default install path is unchanged in behaviour (harness verdicts and 9 transcripts identical old vs new; demo-hp `--preflight-only` identical; `--rotate-recovery-only --dry-run` on demo-hp changed nothing). `step_break_glass` moved, byte-identical, ahead of the argument parse. `break-glass.md` §5 points at it. Publishes only with the next `installer-v…` tag. | the next installer tag | Cut the next `installer-v…` tag (with the other untagged installer changes); close | CC |
|
||||
| **R-1258** | Security & access | P3 | **ep0's iperf3 line-test server takes any tunnel peer's test: one box (root on its host) can keep it busy for the fleet or ask a long reverse test that fills ep0's uplink.** Found 2026-10-24 (SEC-2 X2): `felhom.eu/scripts/ep0-iperf3/felhom-iperf3.service:17` — no authorized users, no server-side duration or rate cap; one client at a time (`felhom-agent/internal/linetest/iperf.go:263-264` → `busy`; 6 tries a day). Static (no ep0 change in this run). | OPEN | — | per-box iperf3 users or server-side caps, tried on a scratch VM first | CC |
|
||||
| **R-1307** | Security & access | P3 | **Packages inside our own images are not watched** — the Debian packages of the controller image, the Alpine packages of the hub and Samba images (Samba's version is whatever Alpine 3.24 ships). The security watch (R-1303) reads only the base image's point release (BEHIND); Debian's DSAs and Alpine's secdb are not read. `audits/security-watch-2026-10-26/SPIKE.md` „cannot see" | OPEN — filed 2026-10-26 | — | add Alpine secdb (machine-readable JSON per release) and Debian's tracker for the packages the images install, or a scanner run on the built images in CI | CC |
|
||||
| **R-1311** | Security & access | P3 | **Termix (catalog 2.8.0): a stranger can get round the login rate limit by writing their own X-Forwarded-For (GHSA-7j7m-85p4-2cpm), and our template keeps that header** (docmost and paperless strip it, R-753). The upstream fix needs Termix's big step (2.8 → 2.9.2 → 26.10.5). No box runs Termix (hub 2026-10-27). `audits/security-app-updates-2026-10-27/TRIAGE.md` | OPEN — filed 2026-10-27 | the operator: a template change (strip the header like R-753, so every visitor shares the tunnel's one address and the limit can lock the household out — the Grimmory shape, R-775) or wait for the big step | the pick in `PICKS.md`; or the big step | CC |
|
||||
| **R-1311** | Security & access | P3 | **Termix (catalog 2.8.0): a stranger can get round the login rate limit by writing their own X-Forwarded-For (GHSA-7j7m-85p4-2cpm), and our template keeps that header** (docmost and paperless strip it, R-753). The upstream fix needs Termix's big step (2.8 → 2.9.2 → 26.10.5). No box runs Termix (hub 2026-10-27). `audits/security-app-updates-2026-10-27/TRIAGE.md` **2026-10-27: Termix's big step (2.8.0 → 2.9.2 → 26.10.5, two hops — 2.9 must start once; calendar versions; guacd dropped) was not done today; this row carries it.** | OPEN — filed 2026-10-27 | the operator: a template change (strip the header like R-753, so every visitor shares the tunnel's one address and the limit can lock the household out — the Grimmory shape, R-775) or wait for the big step | the pick in `PICKS.md`; or the big step | CC |
|
||||
| **R-955** | Security & access | P4 | **The cross-box check of the hub API is done in source and tests but not fully proven: if a later check masks a missing id check, a box's key could read or change another box's hub record without any test noticing.** Read 2026-10-12: every box-facing `/api/v1` route takes the box from its own key or refuses a different id; 14 routes already had a refusal test, 5 got one (`crossbox_refusal_test.go`). Left: red-prove the 4 new tests that were not red-proved (as the restore-directive one was), and the live read-only check with one demo box's key against the other demo box's id. | OPEN — filed 2026-10-12 by the security review | — | Red-prove the 4 tests; run the live GET check on the two demo boxes | CC |
|
||||
| **R-924** | Security & access | P2 | **The operator signing keys exist only on DooPlex, with no passphrase and in no backup — a loss of DooPlex means no box ever accepts a signed agent update, config bundle or OS step again without an on-site re-enrollment.** MEASURED 2026-10-09: `/mnt/5_hdd/felhom.eu/felhom-op-operational`, `felhom-rec-recovery`, `felhom_op_ed25519` (0600 `kisfenyo`); `ssh-keygen -y -P ''` opens all three (no passphrase); `/mnt/5_hdd/felhom.eu` is in no backup set, the off-site job does not carry them. `04` §1 says the operational key is "passphrase-protected" and the recovery key "kept offline" — today neither holds (custody ruling 1 of 2026-09-16 put both on DooPlex for this phase; `04` §3.1). Both keys share one fate, so the cold key cannot do its one job (re-pin after losing the operational key). `runbooks/total-loss-of-dooplex.md` S6. | NARROWED — **2026-10-23 (D32):** S6a/S6b are on the current sheet. LEFT: the operator prints it. **NARROWED 2026-10-09 — operator ruling: option A** (print both AND copy them). The three key files and their public halves ride the nightly encrypted DooPlex→ep0 copy (`scripts/dooplex-offsite/`, a missing key refuses the push); the Sunday restore test proves each private key still derives its own public half (never printed). **LEFT:** the operator prints S6a/S6b (`runbooks/break-glass-sheet.md`); the keys still have no passphrase (custody ruling 1 of 2026-09-16 stands until the first sale). **2026-10-23 night — survey (`audits/dooplex-survival-2026-10-22/PLAN.md`, G2):** the three key files are on `sda1`, the same disk as DooPlex's local backup tree; their only off-box copy is the S1-encrypted nightly one. Passphrase: unchanged by the custody ruling. | operator: print | Operator: print the two keys; then close | operator |
|
||||
| **R-132** | Security & access | P3 | **`curl -w '%{redirect_url}'` reconstructs the request URL WITH its basic-auth credential** — so a `-u ":$HUB_PW"` call that never put the password in a URL still printed it **Merged 2026-10-05 from R-350 (duplicate):** (1) 2026-08-20 occurrence: POST /configuration/artifacts answers 303; leak lives only in the CC transcript under ~/.claude/projects/ on DooPlex, not in git/evidence (checked then). (2) `-v` and `--libcurl` also re-render the credential, not only %{redirect_url}; confirm redirects with %{http_code} + follow-up GET. (3) Rotation path: hub /configuration form (current_password/new_password/confirm_password); DB override wins over ConfigMap (break-glass); CC can rotate file-to-file without printing (operator-present-one-time-secrets) if asked. | **NARROWED 2026-10-20 — the rotation is DONE:** the operator changed the hub password on 2026-10-15 and the `HUB_PW` line is gone (`audits/hub-tokens-2026-10-15/C153-live.txt:18`; CC uses its own token since hub 0.152.0). **Left, the operator's:** should the break-glass `password_hash` in `manifests/hub.yaml` (a public repository) be emptied or replaced? The DB override wins at login, so the old hash no longer opens the hub. **WAITING-ON-OPERATOR** — **ACTION: rotate `HUB_PW`** **Folded R-580 2026-10-03** (the same `curl -w %{redirect_url}` credential echo, seen again 2026-09-18). **Note 2026-10-12 (security review):** `manifests/hub.yaml` also carries the hub login's bcrypt hash in this public repository (the break-glass field); when `HUB_PW` is rotated, decide whether that field should stay empty. | the operator's word on the `manifests/hub.yaml` hash field | Happened on 2026-07-31 while red-proofing the R-120 gate: the hub operator password was written to the session transcript by the write-out format, not by the request. `-u` is safe; the *reporting* was not. Rule: read the redirect from `-D -` and grep `^Location:`, never `%{redirect_url}`, on any authenticated call. Rotate the hub password (`/configuration` → Login password; ConfigMap `auth.password_hash` is the reset path) and update `~/.config/credentials` | Viktor |
|
||||
@@ -264,10 +273,11 @@ stopping line that lies.
|
||||
| **R-1309** | Security & access | P4 | **What no automated source shows: a fix announced only by mail, forum or a blog we do not read; a security fix nobody calls one (cloudflared 2026.10.2's „bump distroless image"); closed-source apps (Plex, Emby).** The watch (R-1303) shows these only as BEHIND (weekly). The vendor mails the operator receives stay a source. `audits/security-watch-2026-10-26/SPIKE.md` | OPEN — filed 2026-10-26 (a stated limit) | — | none until a vendor offers a feed; add a vendor's feed to `security_watch.FEEDS` when one exists | CC |
|
||||
| **R-1312** | Backup & restore | P3 | **The hub customer page's off-site switch did not reach the box: on Tester 1 (2026-10-27, operator-attended, ~14:00–14:12 UTC) the box's saved off-site target stayed `enabled` and its `controller.yaml` `offsite.enabled: true` (unchanged since 2026-10-04) while the hub showed off-site OFF.** So what the switch stops on the box side is not known: the controller reads `cfg.Offsite.Enabled` only at start (`cmd/controller/main.go:890`), and nothing rewrote the file. Either the switch is hub-side only by design (then the page must say so), or a box keeps pushing off-site while the operator believes it is off. Found by the R-1218 live attempt (R-1218 closed 2026-10-27 with its live proof waived by the operator). | OPEN | — | Read the hub handler behind the switch and what it changes (config, tenancy, storage access); then one attended run: switch off, watch the box's next off-site push (does it run, does it fail at the storage) | CC |
|
||||
|
||||
## Box system & updates — 13 rows (P3 8, P4 5)
|
||||
## Box system & updates — 14 rows (P3 9, P4 5)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| **R-1323** | Box system & updates | P3 | **When the file manager's image moves at start, the R-1281 step logs a false alarm: „could not leave traefik-public — every app can still reach it (R-1281): … No such container” — the container it tried to move was the OLD one, already replaced.** Seen on 9202 (0.343.0 → 0.346.1-rc.1, 2026-10-27 14:58:17Z); the probe a few seconds later showed the new container on `felhom-filebrowser` + `felhom-files` only (an app container: „bad address”; the control reached traefik). The text claims an exposure that is not there, which teaches the reader to ignore the real one. `audits/security-app-updates-2026-10-27/part5/9202-rc1-switch.txt` | OPEN — filed 2026-10-27 | — | in `filebrowser_gate.go`: on „No such container” read the CURRENT container's networks and log the truth (or retry once); a test with a replaced container ID; next controller release | CC |
|
||||
| **R-1301** | Box system & updates | P3 | **The N100's Proxmox host keeps no time: `chrony` fails at every boot** („Fatal error : Could not send notification to $NOTIFY_SOCKET", seen 2026-10-16 and 2026-10-21 boots); measured 2026-10-26 20:06 UTC: the host clock 14 s behind DooPlex and demo-hp, `System clock synchronized: no`. demo-hp has the same package (4.8-4~bpo13+2) and `DAEMON_OPTS="-F 1"` and runs it. A drifting host clock feeds backup times (R-1206's class) and TLS. Found while timing the cloudflared update (R-1300). `audits/cloudflared-2026.10.3-2026-10-26/obs-n100-clock.txt` | OPEN — filed 2026-10-26 | — | find why the notify socket fails on this host only (compare the unit and `systemd-analyze` with demo-hp), fix it, and check whether a fresh install could hit it too | CC |
|
||||
| **R-1260** | Box system & updates | P3 | **Spring 2027 (2027-03-28): two clock-change effects in the controller's night (review round 2, HUNT-4 H2/H3).** The update leg's deadline is W + 5 h of REAL time while the full-system backup's gate counts wall-clock minutes, so a step can start after the gate stopped waiting (`felhom-controller/controller/internal/stacks/unattended.go:225`; `internal/quiesce/quiesce.go:922-933`); with W in 02:00–02:59 the DB dump and the second-drive copy start at the same instant (`internal/scheduler/scheduler.go:509`; VERIFIED: Go maps 2027-03-28 02:30 Europe/Budapest to 03:30 CEST). | OPEN | — | before 2027-03-28: one wall-clock basis for both, and a test at the spring date | CC |
|
||||
| **R-984** | Box system & updates | P4 | **Host and agent hardening, low risk each: the backup-target route has no role check; the unsigned guest spec has no size bounds; signed ops have no maximum validity; the guarded mkfs does not refuse LVs, zvols or RAID devices; the local API is reachable from the LAN by a static route; a sudoers inspect pattern is wider than needed; install passes secrets on the command line; guest settings files are world-readable; the host offers rpcbind and DNS on the LAN.** Fix each in its own small change. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Batch into hardening work | CC |
|
||||
|
||||
Reference in new issue
Block a user