From 808d0e87567ca963210f6cc0f7dac3aff301e5eb Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sun, 28 Jun 2026 10:01:31 +0200 Subject: [PATCH] =?UTF-8?q?REPORT:=20website=20Proxmox-platform=20refresh?= =?UTF-8?q?=20(Option=203)=20=E2=80=94=20live-verified?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) --- REPORT.md | 115 ++++++++++++++++++++++++++++-------------------------- 1 file changed, 59 insertions(+), 56 deletions(-) diff --git a/REPORT.md b/REPORT.md index c477dc1..405edba 100644 --- a/REPORT.md +++ b/REPORT.md @@ -2,65 +2,68 @@ > **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md). -## BUNDLE slice — Day-0 artifact manifest + self-install the agent (2026-06-28) +## Website refresh — reflect the Proxmox-based platform (2026-06-28) -**Hub v0.15.0 → v0.16.0** @ `39ef64e`/`d5266ca` · **host-install v1.0.0 → v1.1.0** @ `30ecf73` +**Content/marketing task (not Go — no `go build/vet/test` applies).** Positioning **Option 3** (Proxmox = +the honest foundation everywhere; Kubernetes/multi-node/rack relabelled "Üzleti / igény szerint"). -The host-bootstrap script now **installs the agent itself** (the last manual Day-0 prerequisite is -gone). It fetches the agent binary + golden from Gitea generic packages and **verifies each artifact's -sha256 against a hub-vouched manifest** before installing/using it. The hub is the checksum **trust -root** (a different root than Gitea, which only stores the bytes); the fetch credential is the git -token already inside the customer's `controller.yaml` (config-retrieve) — **no new credential**. +- **Baseline:** felhom.eu `main` @ `6c285ba`. +- **Files edited:** `website/technologiak.html`, `website/index.html`, `website/gyik.html`, + `website/biztonsagimentes.html`. +- **Commit pushed:** `aa3d7c7` (deployed live via git-sync). +- **No CHANGELOG** entry — the only CHANGELOG in-repo is `hub/CHANGELOG.md` (the Go app); there is no + website changelog. No version bump (the website is unversioned). -### Hub (v0.16.0) -- `store.go`: `ArtifactManifest{agent,golden version+sha256}` in the existing `hub_settings` table; - `Get/SetArtifactManifest` + generic `getSetting/setSetting`. -- `handler.go`: `GET /api/v1/artifacts/{customer_id}` — auth mirrors `handleConfigRetrieve` - (`X-Retrieval-Password`, 404-then-401, constant-time). Unset manifest → 200 with empty fields. -- `configs.go` + `configs.html`: operator UI "Day-0 artifacts" card (`POST /configs/artifacts`, - semver + 64-hex validation). `main.go`: env-seed (`ARTIFACT_AGENT_VERSION`/`…_SHA256`/`GOLDEN_…`), - empty-fields-only so a UI edit sticks (the operator UI is password-gated — same escape hatch as the - Phase-2 floor). -- Tests (`artifact_test.go`): returned-verbatim / unset-empty / 401 / 404 / store partial round-trip. +### What changed +- **technologiak.html:** removed the "A legtöbb otthoni felhasználónak nincs szüksége Proxmoxra" warning; + reframed the Proxmox section as **the foundation** ("Az alapréteg: Proxmox", "Az alap, nem opció", + "Mit ad neked a Proxmox alap?") with only grounded benefits (snapshot-before-change, whole-system + backup + restore to new hardware, isolation, fast/repeatable provisioning); advanced use-cases + demoted to a secondary "És ha többre van szükséged…" note. Rebuilt the stack diagram to **5 layers** + (Hardver → Proxmox VE → Izolált rendszerkörnyezet → Docker → Felhő Felügyelő + Alkalmazások), + dropping the old "OS — Linux (Ubuntu/Debian)" box. Reframed the controller section as **the + management layer on every box** ("A kezelőréteg: Felhő Felügyelő"), not a competing option. + Relabelled Kubernetes ("Üzleti és haladó igényekre, kérésre" + an Üzleti/igény-szerint callout, k3s + card softened) and the Rack/Multi-node hardware cards ("Üzleti / igény szerint"); Mini PC stays the + primary home config and "Kezdj kicsiben" stays. +- **index.html:** Proxmox tile "Virtualizáció haladóknak" → **"Stabil virtualizációs alap"**; Kubernetes + tile "Magas rendelkezésre állás" → **"Üzleti szintű rendelkezésre állás"**. +- **gyik.html:** rewrote "Milyen operációs rendszer fut a szerveren?" (Proxmox VE foundation + Docker in + an isolated environment); added a new "**Mi az a Proxmox, és miért használjátok?**" entry under + Technikai kérdések; added a snapshot clause to "Hogyan történik a szoftverfrissítés?". JSON-LD FAQ + schema updated to match (OS answer + new question + update clause) — validated as valid JSON + (41 questions). +- **biztonsagimentes.html:** added one accurate line that the **whole system** (not just files/DBs) is + backup/restorable to a new machine (Proxmox-level, encrypted offsite). 3-2-1 story unchanged. -### host-install (v1.1.0) -- New **step 5/8 agent-install**: resolve manifest + git token → fetch binary → **verify sha256 vs hub - manifest** (abort on mismatch) → install the non-root `felhom-agent` user + binary + sudoers - (`visudo -cf`-validated) + canonical unit. Installs the `sudo` package (the non-root model needs it). -- New **step 7/8 golden**: local fallback else fetch+verify+import from Gitea (`--force-gitea-golden`). -- Agent now runs **non-root** (`privileged.mode: "sudo"`); config chowned to the service user. -- `--skip-provision` (agent-only install/verify), pre-flight relaxed (binary no longer required), - README prerequisites trimmed to: install PVE + create the customer. +### Scenario results (A–E) — all PASS, verified live in-browser (claude-in-chrome) +- **A — Proxmox is the foundation, not optional:** PASS. Live `technologiak.html` shows no "don't need + Proxmox" copy; Proxmox is "Az alapréteg … Erre a stabil alapra építünk minden Felhom gépet" with the + grounded benefit list. `index.html` tile reads "Stabil virtualizációs alap". +- **B — stack diagram shows the real layers:** PASS. Live diagram renders 5 bands + Felhő Felügyelő + Alkalmazások / Docker / Izolált rendszerkörnyezet / Proxmox VE / Hardver. Old + 4-box OS-Linux diagram gone. +- **C — FAQ OS answer correct:** PASS. Live `gyik.html` OS answer is the Proxmox VE one; the new + "Mi az a Proxmox" entry renders and expands with the three grounded benefits. +- **D — Kubernetes/multi-node demoted:** PASS. Live: Kubernetes section + k3s card + Rack + Multi-node + cards + the index tile all read business/on-request; Mini PC + "Kezdj kicsiben" intact; nothing + deleted. +- **E — nothing else breaks:** PASS. UTF-8 BOM preserved on all 4 files (`head -c3` = `ef bb bf`; `git + diff` first hunks start at lines 249/633/676/884 — line 1 untouched). `
` open/close balanced per + file; JSON-LD valid; nav/ToC/footer render; Hungarian correct, adult tone, no English/placeholder + leakage, no layout break. -### Green gate -Hub: `go build/vet/test ./...` green. Scripts: `bash -n` + `shellcheck -S warning` clean. +### Verification method +Live browser (claude-in-chrome) against the deployed site: loaded `felhom.eu/technologiak.html`, +`/gyik.html`, `/index.html` after the git-sync deploy and read the rendered text. Source-level checks +(BOM bytes, git-diff hunk offsets, div balance, JSON-LD parse, no-leftover-old-framing grep) run locally. -### Deployed + live-proven (felhom-pve, demo-felhom) -- Hub **0.16.0** rolled out to k3s (`felhom-system/hub`); artifact manifest seeded via env. Endpoint - live: correct passphrase returns the manifest; **wrong/missing → 401, unknown customer → 404**. -- Published **agent 0.43.0** (sha `8b989917…`) + **golden 0.85.1** (sha `f87031cc…`) to Gitea generic. -- **From-scratch agent install** (live agent moved fully aside): fetch → **verify sha256** → install - (non-root user + binary + sudoers + unit + config) → service **active as `felhom-agent`** → - `--selftest=hub` host-report landed → **9201 still managed**. The git token (from `controller.yaml`) - reads Gitea generic packages (confirmed PUT/GET/DELETE). -- **sha256 negative:** a corrupted published binary made the install **abort** ("Refusing to install — - verify-before-use", exit 1); the good binary was then restored (sha re-verified). -- **Golden fetch+verify+import** from Gitea proven; the test-imported copy was cleaned up. - -### Two real bugs found + fixed live -1. The `sudo` package wasn't installed (the host ran the agent root+`direct`) — step 5 now installs it. -2. `felhom-agent.sudoers` had **unescaped commas** in the `lvs`/`lsblk -o` lists → `visudo -cf` - rejected it (never validated live before). Fixed in felhom-agent (escaped commas). - -### Observations -- **Throwaway full provision SKIPPED** to protect the live demo: a guest provisioned with - demo-felhom's config would fight the live 9201 for the Cloudflare tunnel/domain. The new code (agent - install + golden fetch/verify/import) is fully proven; the golden→guest restore is unchanged from - prior slices. Use a dedicated throwaway customer for an end-to-end provision proof. -- **Non-root + PBS:** the agent can't read `/etc/pve/priv` as `felhom-agent` (PBS datastores skipped - with a WARN; cadence disabled on the demo). Needs a pmxcfs group/ACL or sudoers grant for PBS in - production — follow-up. -- **Per-customer artifact pinning** is a future hook (the endpoint already takes the customer id; - v0.16.0 returns the global current set). -- felhom-pve left with a **healthy non-root agent 0.43.0** + 9201 managed; rollback bundle kept at - `/root/agent-backup-bundle-test`. +### Observations (NOT acted on — out of scope) +- **"45+ alkalmazás" claim:** the live `alkalmazasok.html` has ~48 app cards (`app-title-area` count), + so "45+" / "több mint 45" is accurate (conservative). No change needed. +- **Tailscale VPN** still named in the `technologiak.html` Hálózat section, while the roadmap is + self-hosted Headscale/WireGuard — left as-is per the task's AUTHOR NOTES (align when the Headscale + spike lands). +- **gyik.html "Hardver & Telepítés" step 3** still says "Feltelepítjük az operációs rendszert, a + konténerkezelőt…" — generic and accurate, no Proxmox-optional implication; left unchanged (minimal-edit + rule).