REPORT: website Proxmox-platform refresh (Option 3) — live-verified

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

REPORT.md

@@ -2,65 +2,68 @@
 
 > **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md).
 
-## BUNDLE slice — Day-0 artifact manifest + self-install the agent (2026-06-28)
+## Website refresh — reflect the Proxmox-based platform (2026-06-28)
 
-**Hub v0.15.0 → v0.16.0** @ `39ef64e`/`d5266ca` · **host-install v1.0.0 → v1.1.0** @ `30ecf73`
+**Content/marketing task (not Go — no `go build/vet/test` applies).** Positioning **Option 3** (Proxmox =
+the honest foundation everywhere; Kubernetes/multi-node/rack relabelled "Üzleti / igény szerint").
 
-The host-bootstrap script now **installs the agent itself** (the last manual Day-0 prerequisite is
-gone). It fetches the agent binary + golden from Gitea generic packages and **verifies each artifact's
-sha256 against a hub-vouched manifest** before installing/using it. The hub is the checksum **trust
-root** (a different root than Gitea, which only stores the bytes); the fetch credential is the git
-token already inside the customer's `controller.yaml` (config-retrieve) — **no new credential**.
+- **Baseline:** felhom.eu `main` @ `6c285ba`.
+- **Files edited:** `website/technologiak.html`, `website/index.html`, `website/gyik.html`,
+  `website/biztonsagimentes.html`.
+- **Commit pushed:** `aa3d7c7` (deployed live via git-sync).
+- **No CHANGELOG** entry — the only CHANGELOG in-repo is `hub/CHANGELOG.md` (the Go app); there is no
+  website changelog. No version bump (the website is unversioned).
 
-### Hub (v0.16.0)
-- `store.go`: `ArtifactManifest{agent,golden version+sha256}` in the existing `hub_settings` table;
-  `Get/SetArtifactManifest` + generic `getSetting/setSetting`.
-- `handler.go`: `GET /api/v1/artifacts/{customer_id}` — auth mirrors `handleConfigRetrieve`
-  (`X-Retrieval-Password`, 404-then-401, constant-time). Unset manifest → 200 with empty fields.
-- `configs.go` + `configs.html`: operator UI "Day-0 artifacts" card (`POST /configs/artifacts`,
-  semver + 64-hex validation). `main.go`: env-seed (`ARTIFACT_AGENT_VERSION`/`…_SHA256`/`GOLDEN_…`),
-  empty-fields-only so a UI edit sticks (the operator UI is password-gated — same escape hatch as the
-  Phase-2 floor).
-- Tests (`artifact_test.go`): returned-verbatim / unset-empty / 401 / 404 / store partial round-trip.
+### What changed
+- **technologiak.html:** removed the "A legtöbb otthoni felhasználónak nincs szüksége Proxmoxra" warning;
+  reframed the Proxmox section as **the foundation** ("Az alapréteg: Proxmox", "Az alap, nem opció",
+  "Mit ad neked a Proxmox alap?") with only grounded benefits (snapshot-before-change, whole-system
+  backup + restore to new hardware, isolation, fast/repeatable provisioning); advanced use-cases
+  demoted to a secondary "És ha többre van szükséged…" note. Rebuilt the stack diagram to **5 layers**
+  (Hardver → Proxmox VE → Izolált rendszerkörnyezet → Docker → Felhő Felügyelő + Alkalmazások),
+  dropping the old "OS — Linux (Ubuntu/Debian)" box. Reframed the controller section as **the
+  management layer on every box** ("A kezelőréteg: Felhő Felügyelő"), not a competing option.
+  Relabelled Kubernetes ("Üzleti és haladó igényekre, kérésre" + an Üzleti/igény-szerint callout, k3s
+  card softened) and the Rack/Multi-node hardware cards ("Üzleti / igény szerint"); Mini PC stays the
+  primary home config and "Kezdj kicsiben" stays.
+- **index.html:** Proxmox tile "Virtualizáció haladóknak" → **"Stabil virtualizációs alap"**; Kubernetes
+  tile "Magas rendelkezésre állás" → **"Üzleti szintű rendelkezésre állás"**.
+- **gyik.html:** rewrote "Milyen operációs rendszer fut a szerveren?" (Proxmox VE foundation + Docker in
+  an isolated environment); added a new "**Mi az a Proxmox, és miért használjátok?**" entry under
+  Technikai kérdések; added a snapshot clause to "Hogyan történik a szoftverfrissítés?". JSON-LD FAQ
+  schema updated to match (OS answer + new question + update clause) — validated as valid JSON
+  (41 questions).
+- **biztonsagimentes.html:** added one accurate line that the **whole system** (not just files/DBs) is
+  backup/restorable to a new machine (Proxmox-level, encrypted offsite). 3-2-1 story unchanged.
 
-### host-install (v1.1.0)
-- New **step 5/8 agent-install**: resolve manifest + git token → fetch binary → **verify sha256 vs hub
-  manifest** (abort on mismatch) → install the non-root `felhom-agent` user + binary + sudoers
-  (`visudo -cf`-validated) + canonical unit. Installs the `sudo` package (the non-root model needs it).
-- New **step 7/8 golden**: local fallback else fetch+verify+import from Gitea (`--force-gitea-golden`).
-- Agent now runs **non-root** (`privileged.mode: "sudo"`); config chowned to the service user.
-- `--skip-provision` (agent-only install/verify), pre-flight relaxed (binary no longer required),
-  README prerequisites trimmed to: install PVE + create the customer.
+### Scenario results (A–E) — all PASS, verified live in-browser (claude-in-chrome)
+- **A — Proxmox is the foundation, not optional:** PASS. Live `technologiak.html` shows no "don't need
+  Proxmox" copy; Proxmox is "Az alapréteg … Erre a stabil alapra építünk minden Felhom gépet" with the
+  grounded benefit list. `index.html` tile reads "Stabil virtualizációs alap".
+- **B — stack diagram shows the real layers:** PASS. Live diagram renders 5 bands
+  Felhő Felügyelő + Alkalmazások / Docker / Izolált rendszerkörnyezet / Proxmox VE / Hardver. Old
+  4-box OS-Linux diagram gone.
+- **C — FAQ OS answer correct:** PASS. Live `gyik.html` OS answer is the Proxmox VE one; the new
+  "Mi az a Proxmox" entry renders and expands with the three grounded benefits.
+- **D — Kubernetes/multi-node demoted:** PASS. Live: Kubernetes section + k3s card + Rack + Multi-node
+  cards + the index tile all read business/on-request; Mini PC + "Kezdj kicsiben" intact; nothing
+  deleted.
+- **E — nothing else breaks:** PASS. UTF-8 BOM preserved on all 4 files (`head -c3` = `ef bb bf`; `git
+  diff` first hunks start at lines 249/633/676/884 — line 1 untouched). `<div>` open/close balanced per
+  file; JSON-LD valid; nav/ToC/footer render; Hungarian correct, adult tone, no English/placeholder
+  leakage, no layout break.
 
-### Green gate
-Hub: `go build/vet/test ./...` green. Scripts: `bash -n` + `shellcheck -S warning` clean.
+### Verification method
+Live browser (claude-in-chrome) against the deployed site: loaded `felhom.eu/technologiak.html`,
+`/gyik.html`, `/index.html` after the git-sync deploy and read the rendered text. Source-level checks
+(BOM bytes, git-diff hunk offsets, div balance, JSON-LD parse, no-leftover-old-framing grep) run locally.
 
-### Deployed + live-proven (felhom-pve, demo-felhom)
-- Hub **0.16.0** rolled out to k3s (`felhom-system/hub`); artifact manifest seeded via env. Endpoint
-  live: correct passphrase returns the manifest; **wrong/missing → 401, unknown customer → 404**.
-- Published **agent 0.43.0** (sha `8b989917…`) + **golden 0.85.1** (sha `f87031cc…`) to Gitea generic.
-- **From-scratch agent install** (live agent moved fully aside): fetch → **verify sha256** → install
-  (non-root user + binary + sudoers + unit + config) → service **active as `felhom-agent`** →
-  `--selftest=hub` host-report landed → **9201 still managed**. The git token (from `controller.yaml`)
-  reads Gitea generic packages (confirmed PUT/GET/DELETE).
-- **sha256 negative:** a corrupted published binary made the install **abort** ("Refusing to install —
-  verify-before-use", exit 1); the good binary was then restored (sha re-verified).
-- **Golden fetch+verify+import** from Gitea proven; the test-imported copy was cleaned up.
-
-### Two real bugs found + fixed live
-1. The `sudo` package wasn't installed (the host ran the agent root+`direct`) — step 5 now installs it.
-2. `felhom-agent.sudoers` had **unescaped commas** in the `lvs`/`lsblk -o` lists → `visudo -cf`
-   rejected it (never validated live before). Fixed in felhom-agent (escaped commas).
-
-### Observations
-- **Throwaway full provision SKIPPED** to protect the live demo: a guest provisioned with
-  demo-felhom's config would fight the live 9201 for the Cloudflare tunnel/domain. The new code (agent
-  install + golden fetch/verify/import) is fully proven; the golden→guest restore is unchanged from
-  prior slices. Use a dedicated throwaway customer for an end-to-end provision proof.
-- **Non-root + PBS:** the agent can't read `/etc/pve/priv` as `felhom-agent` (PBS datastores skipped
-  with a WARN; cadence disabled on the demo). Needs a pmxcfs group/ACL or sudoers grant for PBS in
-  production — follow-up.
-- **Per-customer artifact pinning** is a future hook (the endpoint already takes the customer id;
-  v0.16.0 returns the global current set).
-- felhom-pve left with a **healthy non-root agent 0.43.0** + 9201 managed; rollback bundle kept at
-  `/root/agent-backup-bundle-test`.
+### Observations (NOT acted on — out of scope)
+- **"45+ alkalmazás" claim:** the live `alkalmazasok.html` has ~48 app cards (`app-title-area` count),
+  so "45+" / "több mint 45" is accurate (conservative). No change needed.
+- **Tailscale VPN** still named in the `technologiak.html` Hálózat section, while the roadmap is
+  self-hosted Headscale/WireGuard — left as-is per the task's AUTHOR NOTES (align when the Headscale
+  spike lands).
+- **gyik.html "Hardver & Telepítés" step 3** still says "Feltelepítjük az operációs rendszert, a
+  konténerkezelőt…" — generic and accurate, no Proxmox-optional implication; left unchanged (minimal-edit
+  rule).