admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AUDIT §6: remediation PERFORMED — automount restart heals running guest (fix-1 pre-test PASS), CWA healthy, health ok

Browse Source 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-11 20:19:37 +02:00
parent 0f37e647e3
commit 8e1a3f0d82
3 changed files with 26 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/audits/AUDIT-nas-cwa-rca-2026-07-11.md
+18 -9
View File
@@ -213,18 +213,27 @@ system drive. This ordering drives the fix list.
container recreation discards both ring and docker logs — the host journal and hub bundles are
the only durable channels.
## 6. Remediation — DEFERRED (operator-gated, operator not in session)
## 6. Remediation — PERFORMED (operator GO given in-session, executed ~20:14–20:20 CEST)
Demo left as-found. Proposed recipe when GO is given (no rsync needed — nothing is misplaced):
The proposed recipe ran exactly as written and **doubles as a successful live pre-test of the
fix-1 mechanism**:
1. `systemctl restart 'mnt-felhom\x2ddrives-nas\x2dmedia.automount'` on the host (guest running).
2. Verify in-guest: `pct exec 9201 -- grep nas-media /proc/mounts` after an in-guest `ls` of the
path (expect autofs, then nfs4), and confirm `RCA`-free export content is visible.
3. `pct exec 9201 -- docker start calibre-web`; confirm the library loads (SQLite recovers the
-wal/-shm on open).
4. Optionally re-run the uid-1000 write path from inside the CWA container.
1. `systemctl restart 'mnt-felhom\x2ddrives-nas\x2dmedia.automount'` on the host (guest running)
→ the autofs trigger appeared in the guest namespace **immediately** (propagation of a fresh
host mount into a running guest's slave bind, re-proven).
2. In-guest `ls` woke the automount; guest AND controller container now show the `nfs4` mount with
the export content (`backups/`, `userdata/`, correct uid-1000 mapping).
3. `docker start calibre-web` → `running`, healthcheck `healthy`; `/calibre-library` shows
`metadata.db` + all three author dirs; SQLite WAL recovered cleanly (0-byte wal, shm re-touched).
4. uid-1000 write probe from inside the CWA container through the NFS: **WRITE-OK**.
5. App answers over traefik (`Host: books.demo-felhom.eu`): 301→302 login redirect chain, alive.
This doubles as a live pre-test of the fix-1 mechanism.
No rsync was needed (nothing was misplaced). The controller health WARN (S-B) is expected to clear
on the next 5-minute monitor cycle now that `IsMountPoint` sees nfs4 ≠ pve-root.
**Fix-1 design note validated live:** restarting the `.automount` unit is a sufficient, cheap,
data-safe reassert mechanism for running guests; the agent follow-up only needs to invoke it after
guest starts and post-verify guest visibility.
---
*Evidence gathered non-destructively 2026-07-11 ~19:35–19:50 CEST; only artifacts created were the