admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

burndown 2: controller 0.322.0 released; R-1033, R-970, R-1103 closed; R-972 narrowed; R-1104, R-1105 filed
gates / gates (push) Successful in 6m51s
Details

Browse Source
This commit is contained in:
authentik Default Admin
2026-10-16 19:10:08 +02:00
parent 9d6f3b4637
commit 7e1c6df3a0
32 changed files with 554 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/audits/burndown2-2026-10-16/P1/calibre-web-data.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 168 KiB

documentation/audits/burndown2-2026-10-16/P1/report.json
+17
View File
@@ -0,0 +1,17 @@
after login url: /launcher
{
"path": "/apps/calibre-web/data",
"keyField": {
"name": "fab_encryption_key",
"autocomplete": "new-password",
"type": "password",
"valueLength": 0
},
"oldIdPresent": false,
"statusRows": 0,
"targetLabels": 1,
"form": true,
"warnCallout": true,
"scrollWidth": 1270,
"console": []
}
documentation/audits/burndown2-2026-10-16/P2/boxes-and-versions.txt
+5
View File
@@ -0,0 +1,5 @@
every box's newest controller report (hub DB + WAL, one tar, read 2026-10-16T16:41:33Z):
demo-hp 0.322.0-rc.1 https://felhom.enkisfelhom.hu 2026-10-16 16:40:15
tester-1 0.321.0 https://felhom.enkicsifelhom.hu 2026-10-16 16:36:41
demo-felhom 0.321.0 https://felhom.demo-felhom.eu 2026-10-16 16:36:35
Tester-2 0.292.0 https://felhom.sajatfelhom.hu 2026-10-04 18:06:24
documentation/audits/burndown2-2026-10-16/P2/https-only.txt
+40
View File
@@ -0,0 +1,40 @@
control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -)
== tester-1 (enkicsifelhom.hu): 13 public name(s)
OK control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1
OK http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1
OK http://media.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://media.enkicsifelhom.hu/r1033-check?q=1
OK http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1
OK http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1
OK http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1
OK http://plex.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://plex.enkicsifelhom.hu/r1033-check?q=1
OK http://prowlarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://prowlarr.enkicsifelhom.hu/r1033-check?q=1
OK http://radarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://radarr.enkicsifelhom.hu/r1033-check?q=1
OK http://sonarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://sonarr.enkicsifelhom.hu/r1033-check?q=1
OK http://torrent.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://torrent.enkicsifelhom.hu/r1033-check?q=1
OK http://transmission.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://transmission.enkicsifelhom.hu/r1033-check?q=1
OK http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1
== demo-hp (enkisfelhom.hu): 14 public name(s)
OK http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1
OK http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1
OK http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1
OK http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1
OK http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1
OK http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1
OK http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1
OK http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1
OK http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1
OK http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1
OK http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1
OK http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1
OK http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1
OK http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1
== demo-felhom (demo-felhom.eu): 8 public name(s)
OK http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1
OK http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1
OK http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1
OK http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1
OK http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1
OK http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1
OK http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1
OK http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1
== every public name redirects http -> https
documentation/audits/burndown2-2026-10-16/P2/tester2.txt
+3
View File
@@ -0,0 +1,3 @@
Tester 2 (sajatfelhom.hu), read only, 2026-10-16T16:42:09Z:
http://felhom.sajatfelhom.hu/login -> 530 server=cloudflare
https://felhom.sajatfelhom.hu/login -> 530 server=cloudflare
documentation/audits/burndown2-2026-10-16/P3/live-door-check.txt
+14
View File
@@ -0,0 +1,14 @@
key length read: 64
GET /api/config with the hub key -> 401
POST /api/config with the hub key -> 401
GET /api/config/ with the hub key -> 401
POST /api/config/ with the hub key -> 401
GET /api/config/apply with the hub key -> 401
POST /api/config/apply with the hub key -> 401
GET /api/config/hash with the hub key -> 401
POST /api/config/hash with the hub key -> 401
GET /api/selfupdate/check with the hub key -> 401
POST /api/selfupdate/check with the hub key -> 401
GET /api/geo/settings with the hub key -> 401
POST /api/geo/settings with the hub key -> 401
control: GET /api/health (no auth) -> 200
documentation/audits/burndown2-2026-10-16/P4/govulncheck-after.txt
+4
View File
@@ -0,0 +1,4 @@
ctl-0.322.0-rc.2.bin: go1.27.2
ctl-0.322.0-rc.2: 1 vulnerabilities reported
hub-0.156.0.bin: go1.27.2
hub-0.156.0: 1 vulnerabilities reported
documentation/audits/burndown2-2026-10-16/P4/govulncheck-before.txt
+4
View File
@@ -0,0 +1,4 @@
ctl-0.321.0.bin: go1.24.13
ctl-0.321.0: 62 vulnerabilities reported
hub-0.155.0.bin: go1.24.13
hub-0.155.0: 62 vulnerabilities reported
documentation/audits/burndown2-2026-10-16/P4/restic-0.14-after-0.18-nightchain.txt
+40
View File
@@ -0,0 +1,40 @@
2026/10/16 16:50:06 offsiteapply.go:148: [INFO] [offsite-apply] settle-gate: GO — at/above floor 0.321.0 (we are 0.322.0-rc.2), no managed update running
2026/10/16 16:50:43 night_chain.go:108: [INFO] [night-chain] manual run started from 172.18.0.4:57016: [db-dump tier2 offsite update-leg]
2026/10/16 16:50:43 night_chain.go:84: [INFO] [night-chain] manual run of tonight's chain: dump → second drive → off-site → update leg
2026/10/16 16:50:43 night_chain.go:77: [INFO] [night-chain] db-dump: started
2026/10/16 16:52:40 night_chain.go:82: [INFO] [night-chain] db-dump: done in 1m57s
2026/10/16 16:52:40 night_chain.go:77: [INFO] [night-chain] tier2: started
2026/10/16 16:53:03 night_chain.go:82: [INFO] [night-chain] tier2: done in 22s
2026/10/16 16:53:03 night_chain.go:77: [INFO] [night-chain] offsite: started
2026/10/16 16:53:03 offbox.go:1021: [INFO] [offbox] backup run started (15 app(s) toggled)
2026/10/16 16:54:56 scheduler.go:450: [INFO] [scheduler] Running job: offsite-credential-retry
2026/10/16 16:54:56 scheduler.go:467: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
2026/10/16 16:55:05 offbox.go:1068: [INFO] [offbox] pre-push dump leg completed in 2m2.212s — snapshot pair is coherent
2026/10/16 16:55:08 offbox_capture.go:45: [WARN] [offbox] prowlarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:55:08 offbox_capture.go:45: [WARN] [offbox] qbittorrent: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:55:08 offbox_capture.go:45: [WARN] [offbox] radarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:55:08 offbox_capture.go:45: [WARN] [offbox] sonarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:55:12 offbox.go:1504: [INFO] [offbox] backed up bookstack (/mnt/sys_drive/felhom-data/backups/primary/bookstack, 0 mandatory path(s))
2026/10/16 16:55:15 offbox.go:1504: [INFO] [offbox] backed up docmost (/mnt/sys_drive/felhom-data/backups/primary/docmost, 0 mandatory path(s))
2026/10/16 16:55:17 offbox.go:1504: [INFO] [offbox] backed up opengist (/mnt/sys_drive/felhom-data/backups/primary/opengist, 0 mandatory path(s))
2026/10/16 16:55:20 offbox.go:1504: [INFO] [offbox] backed up paperless-ngx (/mnt/felhom-drives/hdd_1/backups/primary/paperless-ngx, 1 mandatory path(s))
2026/10/16 16:55:22 offbox.go:1504: [INFO] [offbox] backed up privatebin (/mnt/sys_drive/felhom-data/backups/primary/privatebin, 0 mandatory path(s))
2026/10/16 16:55:22 offbox_capture.go:45: [WARN] [offbox] prowlarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:55:24 offbox.go:1501: [WARN] [offbox] backed up prowlarr (/mnt/sys_drive/felhom-data/backups/primary/prowlarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it
2026/10/16 16:55:26 offbox.go:1501: [WARN] [offbox] backed up bentopdf (/mnt/sys_drive/felhom-data/backups/primary/bentopdf, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it
2026/10/16 16:55:28 offbox.go:1504: [INFO] [offbox] backed up kimai (/mnt/sys_drive/felhom-data/backups/primary/kimai, 0 mandatory path(s))
2026/10/16 16:55:30 offbox.go:1504: [INFO] [offbox] backed up plex (/mnt/felhom-drives/hdd_1/backups/primary/plex, 0 mandatory path(s))
2026/10/16 16:55:30 offbox.go:1420: [WARN] [offbox] qbittorrent: no recovery unit found on any connected drive — skipping
2026/10/16 16:55:30 offbox_capture.go:45: [WARN] [offbox] radarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:55:33 offbox.go:1501: [WARN] [offbox] backed up radarr (/mnt/felhom-drives/hdd_1/backups/primary/radarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it
2026/10/16 16:55:36 offbox.go:1504: [INFO] [offbox] backed up romm (/mnt/felhom-drives/hdd_1/backups/primary/romm, 0 mandatory path(s))
2026/10/16 16:55:38 offbox.go:1504: [INFO] [offbox] backed up calibre-web (/mnt/felhom-drives/hdd_1/backups/primary/calibre-web, 1 mandatory path(s))
2026/10/16 16:55:42 offbox.go:1504: [INFO] [offbox] backed up home-assistant (/mnt/sys_drive/felhom-data/backups/primary/home-assistant, 0 mandatory path(s))
2026/10/16 16:55:42 offbox_capture.go:45: [WARN] [offbox] sonarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:55:44 offbox.go:1501: [WARN] [offbox] backed up sonarr (/mnt/felhom-drives/hdd_1/backups/primary/sonarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it
2026/10/16 16:55:46 offbox_window.go:231: [INFO] [offbox] retention skipped (after-run): no clean-up window now (not due (last window 2026-10-12T02:16:53Z)) — nothing deleted (decision 68)
2026/10/16 16:55:52 offbox.go:1266: [INFO] [offbox] backup OK: 14 app(s) backed up, 1 skipped (no unit), 186 snapshot(s), 2m43s
2026/10/16 16:55:52 night_chain.go:82: [INFO] [night-chain] offsite: done in 2m49s
2026/10/16 16:55:52 night_chain.go:77: [INFO] [night-chain] update-leg: started
2026/10/16 16:55:52 night_chain.go:82: [INFO] [night-chain] update-leg: done in 0s
2026/10/16 16:55:52 night_chain.go:93: [INFO] [night-chain] finished in 5m9s
documentation/audits/burndown2-2026-10-16/P4/restic-0.18-nightchain-start.txt
+2
View File
@@ -0,0 +1,2 @@
{"data":{"legs":["db-dump","tier2","offsite","update-leg"]},"message":"started","ok":true}
202
documentation/audits/burndown2-2026-10-16/P4/restic-0.18-nightchain.txt
+40
View File
@@ -0,0 +1,40 @@
2026/10/16 16:40:18 offsiteapply.go:148: [INFO] [offsite-apply] settle-gate: GO — at/above floor 0.321.0 (we are 0.322.0-rc.1), no managed update running
2026/10/16 16:41:03 night_chain.go:108: [INFO] [night-chain] manual run started from 172.18.0.4:42566: [db-dump tier2 offsite update-leg]
2026/10/16 16:41:03 night_chain.go:84: [INFO] [night-chain] manual run of tonight's chain: dump → second drive → off-site → update leg
2026/10/16 16:41:03 night_chain.go:77: [INFO] [night-chain] db-dump: started
2026/10/16 16:42:59 night_chain.go:82: [INFO] [night-chain] db-dump: done in 1m56s
2026/10/16 16:42:59 night_chain.go:77: [INFO] [night-chain] tier2: started
2026/10/16 16:43:21 night_chain.go:82: [INFO] [night-chain] tier2: done in 23s
2026/10/16 16:43:21 night_chain.go:77: [INFO] [night-chain] offsite: started
2026/10/16 16:43:21 offbox.go:1021: [INFO] [offbox] backup run started (15 app(s) toggled)
2026/10/16 16:45:08 scheduler.go:450: [INFO] [scheduler] Running job: offsite-credential-retry
2026/10/16 16:45:08 scheduler.go:467: [INFO] [scheduler] Job offsite-credential-retry completed (took 0s)
2026/10/16 16:45:22 offbox.go:1068: [INFO] [offbox] pre-push dump leg completed in 2m0.527s — snapshot pair is coherent
2026/10/16 16:45:25 offbox_capture.go:45: [WARN] [offbox] sonarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:45:25 offbox_capture.go:45: [WARN] [offbox] qbittorrent: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:45:25 offbox_capture.go:45: [WARN] [offbox] prowlarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:45:25 offbox_capture.go:45: [WARN] [offbox] radarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:45:29 offbox.go:1504: [INFO] [offbox] backed up paperless-ngx (/mnt/felhom-drives/hdd_1/backups/primary/paperless-ngx, 1 mandatory path(s))
2026/10/16 16:45:31 offbox.go:1504: [INFO] [offbox] backed up privatebin (/mnt/sys_drive/felhom-data/backups/primary/privatebin, 0 mandatory path(s))
2026/10/16 16:45:31 offbox_capture.go:45: [WARN] [offbox] sonarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:45:33 offbox.go:1501: [WARN] [offbox] backed up sonarr (/mnt/felhom-drives/hdd_1/backups/primary/sonarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it
2026/10/16 16:45:36 offbox.go:1504: [INFO] [offbox] backed up calibre-web (/mnt/felhom-drives/hdd_1/backups/primary/calibre-web, 1 mandatory path(s))
2026/10/16 16:45:36 offbox.go:1420: [WARN] [offbox] qbittorrent: no recovery unit found on any connected drive — skipping
2026/10/16 16:45:38 offbox.go:1504: [INFO] [offbox] backed up romm (/mnt/felhom-drives/hdd_1/backups/primary/romm, 0 mandatory path(s))
2026/10/16 16:45:38 offbox_capture.go:45: [WARN] [offbox] prowlarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:45:40 offbox.go:1501: [WARN] [offbox] backed up prowlarr (/mnt/sys_drive/felhom-data/backups/primary/prowlarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it
2026/10/16 16:45:40 offbox_capture.go:45: [WARN] [offbox] radarr: not deployed — offsite push is unit-only (mandatory userdata not resolvable)
2026/10/16 16:45:42 offbox.go:1501: [WARN] [offbox] backed up radarr (/mnt/felhom-drives/hdd_1/backups/primary/radarr, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it
2026/10/16 16:45:44 offbox.go:1504: [INFO] [offbox] backed up opengist (/mnt/sys_drive/felhom-data/backups/primary/opengist, 0 mandatory path(s))
2026/10/16 16:45:47 offbox.go:1504: [INFO] [offbox] backed up plex (/mnt/felhom-drives/hdd_1/backups/primary/plex, 0 mandatory path(s))
2026/10/16 16:45:49 offbox.go:1501: [WARN] [offbox] backed up bentopdf (/mnt/sys_drive/felhom-data/backups/primary/bentopdf, 0 mandatory path(s)) — but the recovery unit carried NO database dump and NO volume tar, so this snapshot holds none of the app's data; the next run with a dump leg will replace it
2026/10/16 16:45:52 offbox.go:1504: [INFO] [offbox] backed up bookstack (/mnt/sys_drive/felhom-data/backups/primary/bookstack, 0 mandatory path(s))
2026/10/16 16:45:54 offbox.go:1504: [INFO] [offbox] backed up docmost (/mnt/sys_drive/felhom-data/backups/primary/docmost, 0 mandatory path(s))
2026/10/16 16:45:57 offbox.go:1504: [INFO] [offbox] backed up home-assistant (/mnt/sys_drive/felhom-data/backups/primary/home-assistant, 0 mandatory path(s))
2026/10/16 16:45:59 offbox.go:1504: [INFO] [offbox] backed up kimai (/mnt/sys_drive/felhom-data/backups/primary/kimai, 0 mandatory path(s))
2026/10/16 16:46:01 offbox_window.go:231: [INFO] [offbox] retention skipped (after-run): no clean-up window now (not due (last window 2026-10-12T02:16:53Z)) — nothing deleted (decision 68)
2026/10/16 16:46:06 offbox.go:1266: [INFO] [offbox] backup OK: 14 app(s) backed up, 1 skipped (no unit), 172 snapshot(s), 2m40s
2026/10/16 16:46:06 night_chain.go:82: [INFO] [night-chain] offsite: done in 2m44s
2026/10/16 16:46:06 night_chain.go:77: [INFO] [night-chain] update-leg: started
2026/10/16 16:46:06 night_chain.go:82: [INFO] [night-chain] update-leg: done in 0s
2026/10/16 16:46:06 night_chain.go:93: [INFO] [night-chain] finished in 5m3s
documentation/audits/burndown2-2026-10-16/P4/trivy-after-controller-rc3.txt
+5
View File
@@ -0,0 +1,5 @@
== gitea.dooplex.hu/admin/felhom-controller:0.322.0-rc.3
gitea.dooplex.hu/admin/felhom-controller:0.322.0-rc.3 (debia debian crit 4 (fixable 0) high 136 (fixable 0)
usr/libexec/docker/cli-plugins/docker-compose gobinary crit 0 (fixable 0) high 4 (fixable 4)
usr/local/bin/felhom-controller gobinary crit 0 (fixable 0) high 0 (fixable 0)
TOTAL crit 4 (fixable 0) high 140 (fixable 4)
documentation/audits/burndown2-2026-10-16/P4/trivy-after.txt
+9
View File
@@ -0,0 +1,9 @@
== gitea.dooplex.hu/admin/felhom-controller:0.322.0-rc.2
gitea.dooplex.hu/admin/felhom-controller:0.322.0-rc.2 (debia debian crit 6 (fixable 2) high 144 (fixable 8)
usr/libexec/docker/cli-plugins/docker-compose gobinary crit 0 (fixable 0) high 4 (fixable 4)
usr/local/bin/felhom-controller gobinary crit 0 (fixable 0) high 0 (fixable 0)
TOTAL crit 6 (fixable 2) high 148 (fixable 12)
== gitea.dooplex.hu/admin/felhom-hub:0.156.0
gitea.dooplex.hu/admin/felhom-hub:0.156.0 (alpine 3.24.2) alpine crit 0 (fixable 0) high 0 (fixable 0)
usr/local/bin/felhom-hub gobinary crit 0 (fixable 0) high 0 (fixable 0)
TOTAL crit 0 (fixable 0) high 0 (fixable 0)
documentation/audits/burndown2-2026-10-16/P4/trivy-before.txt
+10
View File
@@ -0,0 +1,10 @@
== gitea.dooplex.hu/admin/felhom-controller:0.321.0
gitea.dooplex.hu/admin/felhom-controller:0.321.0 (debian 12. debian crit 16 (fixable 12) high 159 (fixable 23)
usr/bin/docker gobinary crit 0 (fixable 0) high 3 (fixable 3)
usr/libexec/docker/cli-plugins/docker-compose gobinary crit 0 (fixable 0) high 4 (fixable 4)
usr/local/bin/felhom-controller gobinary crit 0 (fixable 0) high 34 (fixable 34)
TOTAL crit 16 (fixable 12) high 200 (fixable 64)
== gitea.dooplex.hu/admin/felhom-hub:0.155.0
gitea.dooplex.hu/admin/felhom-hub:0.155.0 (alpine 3.21.8) alpine crit 0 (fixable 0) high 2 (fixable 2)
usr/local/bin/felhom-hub gobinary crit 0 (fixable 0) high 34 (fixable 34)
TOTAL crit 0 (fixable 0) high 36 (fixable 36)
documentation/audits/burndown2-2026-10-16/redproof/redproof-datatab.txt
+8
View File
@@ -0,0 +1,8 @@
## no autocomplete=new-password on the export key
logins_folders_test.go:423: hu: the export password field lacks autocomplete="new-password" or still has a login-like name
logins_folders_test.go:423: en: the export password field lacks autocomplete="new-password" or still has a login-like name
--- FAIL: TestAppData_OneBackupSection (0.09s)
## a status row back above the form
logins_folders_test.go:416: hu: the 2nd copy's status rows repeat the form
logins_folders_test.go:419: hu: the target drive is labelled 2 times, want once (the form)
logins_folders_test.go:416: en: the 2nd copy's status rows repeat the form
documentation/audits/burndown2-2026-10-16/redproof/redproof-r1103.txt
+3
View File
@@ -0,0 +1,3 @@
## R-694 on the settings tab: the Restored branch removed
r694_restored_login_test.go:35: the restored login is offered for reveal
--- FAIL: TestR694_TheSettingsTabDoesNotOfferAGeneratedLogin (0.07s)
documentation/audits/burndown2-2026-10-16/redproof/redproof-r970.txt
+10
View File
@@ -0,0 +1,10 @@
## an /api/geo/ route without the session check (a door)
r970_no_hub_key_door_test.go:74: GET /api/geo/countries with the hub key answered 200 — the key opens a door
--- FAIL: TestR970_HubKeyOpensNoDoor (0.08s)
## the /config GET case back
r970_config_routes_test.go:31: GET /api/config answered 200, want the router's 404
r970_config_routes_test.go:31: GET /api/config/ answered 200, want the router's 404
--- FAIL: TestR970_ConfigRoutesAreGone (0.00s)
## the Bearer CSRF exemption back
r970_csrf_test.go:40: a POST carrying the hub key passed CSRF (code 200)
--- FAIL: TestR970_HubKeyIsNoCSRFExemption (0.00s)
documentation/audits/burndown2-2026-10-16/release/containers.txt
+12
View File
@@ -0,0 +1,12 @@
== tester-1
unhealthy=0 restarting=0 exited=0 created=0
controller gitea.dooplex.hu/admin/felhom-controller:0.322.0 Up About a minute (healthy)
restic 0.14.0
== demo-hp
unhealthy=0 restarting=0 exited=0 created=0
controller gitea.dooplex.hu/admin/felhom-controller:0.322.0 Up About a minute (healthy)
restic 0.14.0
== demo-felhom
unhealthy=0 restarting=0 exited=0 created=0
controller gitea.dooplex.hu/admin/felhom-controller:0.322.0 Up About a minute (healthy)
restic 0.14.0
documentation/audits/burndown2-2026-10-16/release/customer-floors-cleared.txt
+3
View File
@@ -0,0 +1,3 @@
tester-1 Location: /customers/tester-1?flash=floor_set
demo-hp Location: /customers/demo-hp?flash=floor_set
demo-felhom Location: /customers/demo-felhom?flash=floor_set
documentation/audits/burndown2-2026-10-16/release/customer-floors.txt
+3
View File
@@ -0,0 +1,3 @@
demo-hp Location: /customers/demo-hp?flash=floor_set
tester-1 Location: /customers/tester-1?flash=floor_set
demo-felhom Location: /customers/demo-felhom?flash=floor_set
documentation/audits/burndown2-2026-10-16/release/dashboards.txt
+3
View File
@@ -0,0 +1,3 @@
felhom.enkisfelhom.hu 200
felhom.enkicsifelhom.hu 200
felhom.demo-felhom.eu 200
documentation/audits/burndown2-2026-10-16/release/global-floor-readback.txt
+9
View File
@@ -0,0 +1,9 @@
integrity ok
newest report 2026-10-16 16:54:54 now 2026-10-16 17:06:26
min_controller_version ('0.322.0',)
min_controller_version_declared_min_agent ('0.322.0=0.158.1',)
customer floor columns []
customer_configs ['min_controller_version', 'min_controller_declared_min_agent', 'min_controller_set_at']
('demo-felhom', '', '', '')
('demo-hp', '', '', '')
('tester-1', '', '', '')
documentation/audits/burndown2-2026-10-16/release/global-floor.txt
+3
View File
@@ -0,0 +1,3 @@
19:04:50
HTTP/1.1 303 See Other
Location: /configuration?flash=floor_set
documentation/audits/burndown2-2026-10-16/release/https-only.txt
+40
View File
@@ -0,0 +1,40 @@
control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -)
== tester-1 (enkicsifelhom.hu): 13 public name(s)
OK control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1
OK http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1
OK http://media.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://media.enkicsifelhom.hu/r1033-check?q=1
OK http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1
OK http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1
OK http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1
OK http://plex.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://plex.enkicsifelhom.hu/r1033-check?q=1
OK http://prowlarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://prowlarr.enkicsifelhom.hu/r1033-check?q=1
OK http://radarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://radarr.enkicsifelhom.hu/r1033-check?q=1
OK http://sonarr.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://sonarr.enkicsifelhom.hu/r1033-check?q=1
OK http://torrent.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://torrent.enkicsifelhom.hu/r1033-check?q=1
OK http://transmission.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://transmission.enkicsifelhom.hu/r1033-check?q=1
OK http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1
== demo-hp (enkisfelhom.hu): 14 public name(s)
OK http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1
OK http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1
OK http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1
OK http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1
OK http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1
OK http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1
OK http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1
OK http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1
OK http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1
OK http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1
OK http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1
OK http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1
OK http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1
OK http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1
== demo-felhom (demo-felhom.eu): 8 public name(s)
OK http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1
OK http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1
OK http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1
OK http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1
OK http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1
OK http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1
OK http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1
OK http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1
== every public name redirects http -> https
documentation/audits/burndown2-2026-10-16/release/hub-page-floor.txt
+1
View File
@@ -0,0 +1 @@
hub page /configuration shows 0.322.0: 3 times
documentation/audits/burndown2-2026-10-16/tools/cdp_datatab.py
+118
View File
@@ -0,0 +1,118 @@
#!/usr/bin/env python3
"""v0.322.0 burndown-2 browser check: the Data tab's export key field and the 2nd-copy part. Minimal CDP client: log in to the controller through its PUBLIC address in headless Chrome, open each
app-page tab, assert computed styles, collect console errors, save screenshots. The password is read
from a 0600 file and only ever sent inside a CDP message; it is never printed."""
import base64, json, os, socket, struct, subprocess, sys, time, urllib.request
CHROME = os.path.expanduser('~/.cache/ms-playwright/chromium_headless_shell-1243/chrome-headless-shell-linux64/chrome-headless-shell')
BASE = sys.argv[1] # https://felhom.enkisfelhom.hu
PWFILE = sys.argv[2] # the controller password (0600 file)
FBPWFILE = sys.argv[3] # FileBrowser's admin password (0600 file) — for the cold „Fajlok" click
OUT = sys.argv[4]
PORT = 9333
os.makedirs(OUT, exist_ok=True)
prof = os.path.join(OUT, '.profile')
proc = subprocess.Popen([CHROME, f'--remote-debugging-port={PORT}', '--no-sandbox', f'--user-data-dir={prof}',
'--window-size=1280,900', 'about:blank'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
try:
for _ in range(50):
try:
tabs = json.load(urllib.request.urlopen(f'http://127.0.0.1:{PORT}/json'))
break
except Exception:
time.sleep(0.2)
ws_url = [t for t in tabs if t['type'] == 'page'][0]['webSocketDebuggerUrl']
host, path = ws_url[len('ws://'):].split('/', 1)
h, p = host.split(':')
sock = socket.create_connection((h, int(p)))
key = base64.b64encode(os.urandom(16)).decode()
sock.send(f'GET /{path} HTTP/1.1\r\nHost: {host}\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: {key}\r\nSec-WebSocket-Version: 13\r\n\r\n'.encode())
buf = b''
while b'\r\n\r\n' not in buf:
buf += sock.recv(4096)
st = {'pending': buf.split(b'\r\n\r\n', 1)[1]}
def send(obj):
data = json.dumps(obj).encode()
hdr = bytearray([0x81])
n = len(data)
if n < 126: hdr.append(0x80 | n)
elif n < 65536: hdr.append(0x80 | 126); hdr += struct.pack('>H', n)
else: hdr.append(0x80 | 127); hdr += struct.pack('>Q', n)
mask = os.urandom(4); hdr += mask
sock.sendall(bytes(hdr) + bytes(b ^ mask[i % 4] for i, b in enumerate(data)))
def recv_exact(n):
while len(st['pending']) < n:
st['pending'] += sock.recv(1 << 20)
out, st['pending'] = st['pending'][:n], st['pending'][n:]
return out
def recv():
msg = b''
while True:
b0, b1 = recv_exact(2)
n = b1 & 0x7f
if n == 126: n = struct.unpack('>H', recv_exact(2))[0]
elif n == 127: n = struct.unpack('>Q', recv_exact(8))[0]
msg += recv_exact(n)
if b0 & 0x80: return json.loads(msg)
console = []
mid = [0]
def call(method, **params):
mid[0] += 1; i = mid[0]
send({'id': i, 'method': method, 'params': params})
while True:
m = recv()
if m.get('method') == 'Runtime.exceptionThrown':
console.append(('exception', m['params']['exceptionDetails'].get('text', ''), m['params']['exceptionDetails'].get('exception', {}).get('description', '')[:200]))
elif m.get('method') == 'Runtime.consoleAPICalled' and m['params']['type'] in ('error', 'warning'):
console.append((m['params']['type'], ' '.join(str(a.get('value', a.get('description', ''))) for a in m['params']['args'])[:200]))
elif m.get('method') == 'Log.entryAdded' and m['params']['entry']['level'] in ('error', 'warning'):
e = m['params']['entry']; console.append(('log-' + e['level'], e.get('text', '')[:200], e.get('url', '')))
if m.get('id') == i:
if 'error' in m: raise RuntimeError(f'{method}: {m["error"]}')
return m.get('result', {})
def ev(expr):
r = call('Runtime.evaluate', expression=expr, returnByValue=True, awaitPromise=True)
return r.get('result', {}).get('value')
def goto(url):
call('Page.navigate', url=url)
for _ in range(100):
time.sleep(0.2)
if ev('document.readyState') == 'complete':
break
time.sleep(1.5) # images' onerror, layout
for d in ('Page', 'Runtime', 'Log', 'Network'):
call(d + '.enable')
pw = open(PWFILE).read().strip()
goto(BASE + '/login')
ev("(function(){var f=document.querySelector('input[type=password]'); f.value=%s; f.form.submit(); return 1})()" % json.dumps(pw))
del pw
time.sleep(3)
print('after login url:', ev('location.pathname'))
console.clear() # the login page is not under test
def shot(name):
s = call('Page.captureScreenshot', format='png', captureBeyondViewport=True)
open(os.path.join(OUT, name + '.png'), 'wb').write(base64.b64decode(s['data']))
goto(BASE + '/apps/calibre-web/data')
time.sleep(2) # give any autofill its moment
r = ev("""(function(){ var k=document.getElementById('fabEncryptionKey');
return {path: location.pathname, keyField: k ? {name: k.name, autocomplete: k.getAttribute('autocomplete'), type: k.type, valueLength: k.value.length} : null,
oldIdPresent: !!document.getElementById('exportPassword'),
statusRows: document.querySelectorAll('[data-backup-row="second"],[data-backup-row="target"]').length,
targetLabels: document.querySelectorAll('label[for="target"]').length,
form: !!document.querySelector('[data-second-backup-form]'),
warnCallout: !!document.querySelector('#app-backup-section .app-callout-warn'),
scrollWidth: document.documentElement.scrollWidth}; })()""")
r['console'] = console[:]
shot('calibre-web-data')
print(json.dumps(r, indent=1, ensure_ascii=False))
finally:
proc.terminate()
subprocess.run(['rm', '-rf', prof])
documentation/audits/burndown2-2026-10-16/tools/trivy_counts.py
+22
View File
@@ -0,0 +1,22 @@
#!/usr/bin/env python3
"""trivy_counts.py <trivy.json>... — per image and per target: CRITICAL/HIGH counts, all and fixable (a fixed version
exists). The burndown-2 before/after table (R-972)."""
import json, sys
from collections import Counter
for p in sys.argv[1:]:
d = json.load(open(p))
print("== %s" % d.get("ArtifactName"))
tot_all, tot_fix = Counter(), Counter()
for r in d.get("Results", []) or []:
a, f = Counter(), Counter()
for v in r.get("Vulnerabilities") or []:
sev = v.get("Severity")
a[sev] += 1
if v.get("FixedVersion"):
f[sev] += 1
tot_all += a; tot_fix += f
if a:
print(" %-60s %-9s crit %3d (fixable %3d) high %3d (fixable %3d)" % (r.get("Target", "")[:60], r.get("Type", ""),
a["CRITICAL"], f["CRITICAL"], a["HIGH"], f["HIGH"]))
print(" %-60s %-9s crit %3d (fixable %3d) high %3d (fixable %3d)" % ("TOTAL", "", tot_all["CRITICAL"], tot_fix["CRITICAL"],
tot_all["HIGH"], tot_fix["HIGH"]))