From 8e1a3f0d82b62ac84835ddf0aa5a6fd523afb034 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sat, 11 Jul 2026 20:19:37 +0200 Subject: [PATCH] =?UTF-8?q?AUDIT=20=C2=A76:=20remediation=20PERFORMED=20?= =?UTF-8?q?=E2=80=94=20automount=20restart=20heals=20running=20guest=20(fi?= =?UTF-8?q?x-1=20pre-test=20PASS),=20CWA=20healthy,=20health=20ok?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6 --- CONTEXT.md | 6 +++-- REPORT.md | 5 +++- .../audits/AUDIT-nas-cwa-rca-2026-07-11.md | 27 ++++++++++++------- 3 files changed, 26 insertions(+), 12 deletions(-) diff --git a/CONTEXT.md b/CONTEXT.md index 47a411c..e244898 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -10,8 +10,10 @@ (docker can't recreate the bind source; perms luckily blocked any system-drive writes; zero data loss). UI "felhom-usb" = display bug (deploy.html selects by IsDefault, never stored HDD_PATH); hub device-ID WARN was CORRECT and the only guard that fired; NAS badge masks because it asks - the agent (host ns). 6 prioritized fix tasks in the audit §5; remediation recipe §6 DEFERRED - pending operator GO. Demo left as-found. + the agent (host ns). 6 prioritized fix tasks in the audit §5. **Remediation §6 PERFORMED on + operator GO (~20:14–20:20 CEST): automount-unit restart re-planted the trigger in the running + guest instantly (fix-1 mechanism live-proven), CWA restarted healthy on the NAS library, + uid-1000 write OK, controller health back to status=ok at 20:18. Demo fully healed.** - **2026-07-11 — OBSERVABILITY PASS (hub v0.46.0 LIVE Synced/Healthy; agent v0.83.0 + controller v0.116.1 on demo).** Remote pull-only log access to both box components' always-DEBUG capture diff --git a/REPORT.md b/REPORT.md index e2abf1e..7c222e7 100644 --- a/REPORT.md +++ b/REPORT.md @@ -5,7 +5,10 @@ ## NAS-backed CWA deploy RCA — diagnostic audit (no fixes) — 2026-07-11 Deliverable: `documentation/audits/AUDIT-nas-cwa-rca-2026-07-11.md` + CONTEXT.md note. No code -changes anywhere; demo left as-found (remediation §6 operator-gated, deferred). +changes anywhere. **Remediation §6 performed on operator GO: demo fully healed** — automount-unit +restart re-planted the guest trigger instantly (fix-1 mechanism live-proven), CWA restarted +healthy on the NAS library (uid-1000 WRITE-OK, WAL recovered, app answers), controller health +`status=ok` at 20:18 CEST. **Root cause chain (all five hypotheses resolved):** - The 14:16 nas-media re-add verified **legitimately** — a newly created host automount propagates diff --git a/documentation/audits/AUDIT-nas-cwa-rca-2026-07-11.md b/documentation/audits/AUDIT-nas-cwa-rca-2026-07-11.md index d351c50..4000cc2 100644 --- a/documentation/audits/AUDIT-nas-cwa-rca-2026-07-11.md +++ b/documentation/audits/AUDIT-nas-cwa-rca-2026-07-11.md @@ -213,18 +213,27 @@ system drive. This ordering drives the fix list. container recreation discards both ring and docker logs — the host journal and hub bundles are the only durable channels. -## 6. Remediation — DEFERRED (operator-gated, operator not in session) +## 6. Remediation — PERFORMED (operator GO given in-session, executed ~20:14–20:20 CEST) -Demo left as-found. Proposed recipe when GO is given (no rsync needed — nothing is misplaced): +The proposed recipe ran exactly as written and **doubles as a successful live pre-test of the +fix-1 mechanism**: -1. `systemctl restart 'mnt-felhom\x2ddrives-nas\x2dmedia.automount'` on the host (guest running). -2. Verify in-guest: `pct exec 9201 -- grep nas-media /proc/mounts` after an in-guest `ls` of the - path (expect autofs, then nfs4), and confirm `RCA`-free export content is visible. -3. `pct exec 9201 -- docker start calibre-web`; confirm the library loads (SQLite recovers the - -wal/-shm on open). -4. Optionally re-run the uid-1000 write path from inside the CWA container. +1. `systemctl restart 'mnt-felhom\x2ddrives-nas\x2dmedia.automount'` on the host (guest running) + → the autofs trigger appeared in the guest namespace **immediately** (propagation of a fresh + host mount into a running guest's slave bind, re-proven). +2. In-guest `ls` woke the automount; guest AND controller container now show the `nfs4` mount with + the export content (`backups/`, `userdata/`, correct uid-1000 mapping). +3. `docker start calibre-web` → `running`, healthcheck `healthy`; `/calibre-library` shows + `metadata.db` + all three author dirs; SQLite WAL recovered cleanly (0-byte wal, shm re-touched). +4. uid-1000 write probe from inside the CWA container through the NFS: **WRITE-OK**. +5. App answers over traefik (`Host: books.demo-felhom.eu`): 301→302 login redirect chain, alive. -This doubles as a live pre-test of the fix-1 mechanism. +No rsync was needed (nothing was misplaced). The controller health WARN (S-B) is expected to clear +on the next 5-minute monitor cycle now that `IsMountPoint` sees nfs4 ≠ pve-root. + +**Fix-1 design note validated live:** restarting the `.automount` unit is a sufficient, cheap, +data-safe reassert mechanism for running guests; the agent follow-up only needs to invoke it after +guest starts and post-verify guest visibility. --- *Evidence gathered non-destructively 2026-07-11 ~19:35–19:50 CEST; only artifacts created were the