Night 2026-10-25 Part 4–5: each fix's [DESIGN] line (04, 05, 07, 08, 11, 13, 15), the register (R-1261, R-1281, R-1282, R-1288, R-1280, R-1285, R-1283, R-1287, R-1289, R-1278 to VERIFY; R-1286 waiting on the operator; R-1291 and R-1292 opened), STATUS (D51 Kimai, the Monday list), the night report with its three-layer teardown, and the rig evidence (scanned: 0 known-secret hits)
gates / gates (push) Successful in 13m42s
gates / gates (push) Successful in 13m42s
This commit is contained in:
admin committed
1 parent
f63284861e
commit
9258cdd11c
33 files changed
+57024
-22
No files matched your search
@@ -0,0 +1,4 @@
|
||||
# R-1278 red-proof: the notice's {{if}} made false, 2026-10-25 night
|
||||
=== RUN TestR1278_TheInstallPageOffersTheKeptBackup
|
||||
r1278_kept_backup_offer_test.go:17: with a kept backup of an earlier install the page must say so and link the restore page
|
||||
--- FAIL: TestR1278_TheInstallPageOffersTheKeptBackup (0.06s)
|
||||
@@ -0,0 +1,9 @@
|
||||
# R-1280 red-proofs: the 24 h checks switched off, 2026-10-25
|
||||
verify_test.go:128: want authz: op validity window too long, got <nil>
|
||||
--- FAIL: TestVerify_RejectsPerStage (0.00s)
|
||||
--- FAIL: TestVerify_RejectsPerStage/window_longer_than_24_h (0.00s)
|
||||
FAIL
|
||||
FAIL: test_a_window_longer_than_24h_is_refused (test_felhom_os_apply.DockerLane.test_a_window_longer_than_24h_is_refused)
|
||||
AssertionError: 0 != 2 : {'authority': 'signed', 'docker_engine': '29.7.2', 'docker_restart_needed': False, 'health_after': {'containers': {'app': {'health': 'healthy', 'id': 'bbb222', 'state': 'running'}, 'felhom-controller': {'health': 'healthy', 'id': 'aaa111', 'state': 'running'}}, 'controller': 'healthy', 'controller_docker_ok': True, 'docker_ok': True, 'network_ok': True}, 'health_before': {'containers': {'app': {'health': 'healthy', 'id': 'bbb222', 'state': 'running'}, 'felhom-controller': {'health': 'healthy', 'id': 'aaa111', 'state': 'running'}}, 'controller': 'healthy', 'controller_docker_ok': True, 'docker_ok': True, 'network_ok': True}, 'installed': [{'name': 'bash', 'origin': 'Debian', 'version': '5.2.37-2+b9'}, {'name': 'containerd.io', 'origin': 'Debian', 'version': '2.3.6-1~debian.13~trixie'}, {'name': 'docker-ce', 'origin': 'Debian', 'version': '5:29.8.2-1~debian.13~trixie'}, {'name': 'libc6', 'origin': 'Debian', 'version': '2.41-12+deb13u3'}, {'name': 'openssl', 'origin': 'Debian', 'version': '3.5.6-1~deb13u1'}], 'layer': 'docker', 'mode': 'apply', 'oom_check': {'detail': 'the engine reported the memory kill: OOMKilled=true and the oom event', 'exit_code': 137, 'image': 'gitea.dooplex.hu/admin/felhom-controller:0.300.0', 'oom_event': True, 'oom_killed': True, 'result': 'pass'}, 'pass_seconds': 0.0, 'pending': [{'from': '5.2.37-2+b9', 'name': 'bash', 'origin': ['Debian'], 'to': '5.2.37-2+b10'}], 'plan': {'already': 0, 'from_snapshot': 0, 'not_installed': 0, 'upgrade': 2}, 'reboot_needed': False, 'reboot_scanned': True, 'refused': None, 'release_id': 'os-docker-t1', 'repair': {'clean_after': True, 'fixed': 0, 'half_configured_before': 0, 'journal_before': 0}, 'restart_needed': [], 'seconds': 0.0, 'socket_restarted': ['felhom-controller'], 'undo': False, 'upgraded': [{'name': 'docker-ce', 'version': '5:29.8.2-1~debian.13~trixie'}, {'name': 'containerd.io', 'version': '2.3.6-1~debian.13~trixie'}], 'vmid': 9201}
|
||||
Ran 1 test in 0.013s
|
||||
FAILED (failures=1)
|
||||
@@ -0,0 +1,9 @@
|
||||
# R-1281 red-proofs, 2026-10-25 night
|
||||
## 1. the traefik-public disconnect skipped
|
||||
=== RUN TestR1281_FileBrowserLeavesTheAppNetworkAndIsServedOnTheFilesNetwork
|
||||
filebrowser_password_test.go:341: FileBrowser is still on traefik-public — every app container reaches it
|
||||
--- FAIL: TestR1281_FileBrowserLeavesTheAppNetworkAndIsServedOnTheFilesNetwork (0.00s)
|
||||
## 2. the OnlyOffice step removed
|
||||
=== RUN TestR1281_OnlyOfficeJoinsTheFilesNetworkOnlyWhileLinked
|
||||
filebrowser_password_test.go:385: a linked OnlyOffice must reach FileBrowser: map[3f2a9c@felhom-files:true felhom-controller@felhom-filebrowser:true traefik@felhom-files:true]
|
||||
--- FAIL: TestR1281_OnlyOfficeJoinsTheFilesNetworkOnlyWhileLinked (0.00s)
|
||||
@@ -0,0 +1,7 @@
|
||||
# R-1283 red-proof: the ruling's entry removed (drill catalog), 2026-10-25 night
|
||||
download-binds gate FAILED (1 of 6 download folder(s)):
|
||||
templates/metube: the download folder media/metube is declared `optional` — a nightly copy on the second drive; declare it `class: excluded` (R-1019)
|
||||
XX GENUINE (R-1283): metube's folder optional by ruling rc=1 (expected 0)
|
||||
ok FACT (R-1283): metube's folder mandatory — the ruling allows optional only rc=1 (expected 1)
|
||||
ok FACT (R-1283): metube's folder UNLISTED rc=1 (expected 1)
|
||||
FAIL: GENUINE (R-1283): metube's folder optional by ruling: rc=1 expected 0; missing ['every one']
|
||||
@@ -0,0 +1,10 @@
|
||||
# R-1285 red-proofs, 2026-10-25 night
|
||||
## agent: the policyPass call removed
|
||||
=== RUN TestR1285_AnInstalledBundleIsFollowedByThePolicyPass
|
||||
bundle_test.go:173: after the install the agent must run the policy pass (host layer, no envelope): [map[bundle:/tmp/TestR1285_AnInstalledBundleIsFollowedByThePolicyPass3671177433/001/bundle-0.143.0.json layer:host mode:bundle release_id:bundle-0.143.0 signed:map[blob_b64:eyJvcCI6ImFnZW50X2NvbmZpZ191cGRhdGUifQ== sig:SIG]]]
|
||||
--- FAIL: TestR1285_AnInstalledBundleIsFollowedByThePolicyPass (0.00s)
|
||||
## wrapper: policy_pass made to do nothing
|
||||
FAIL: test_the_policy_pass_removes_our_copy_from_a_byo_host (test_felhom_config_bundle.ByoKeepsItsSSH.test_the_policy_pass_removes_our_copy_from_a_byo_host)
|
||||
AssertionError: '/etc/ssh/sshd_config.d/10-felhom-root-key-only.conf' unexpectedly found in {'/var/lib/felhom-install/state.json': b'{"completed": [], "mode": "byo"}', '/etc/felhom/os-trust.json': b'{
|
||||
Ran 1 test in 0.057s
|
||||
FAILED (failures=1)
|
||||
@@ -0,0 +1,4 @@
|
||||
# R-1286 red-proof: holdWhy back to the old two-way branch, 2026-10-25 night
|
||||
=== RUN TestR1286_EveryHoldReasonSaysWhatItIs
|
||||
r1286_hold_why_test.go:32: kimai (reason "unhealthy_stop"): the gate says "held after a failed restore whose rollback also failed (2026-10-14T09:06:31Z) — clear the hold to start it", want it to contain "stopped by the box for a crash loop"
|
||||
--- FAIL: TestR1286_EveryHoldReasonSaysWhatItIs (0.00s)
|
||||
@@ -0,0 +1,12 @@
|
||||
# R-1288 red-proof (retireReplacedUnit call removed), 2026-10-25
|
||||
=== RUN TestR1288_ARestoreOfASetAsideUnitRetiresTheReplacedUnitQuietly
|
||||
unit_owner_test.go:358: after the restore the primary place still holds install "bbbb000000000002"'s unit — it must be set aside at the restore
|
||||
--- FAIL: TestR1288_ARestoreOfASetAsideUnitRetiresTheReplacedUnitQuietly (0.02s)
|
||||
|
||||
# R-1282 red-proof (ResumeMediaLater a no-op)
|
||||
=== RUN TestR1282_ALaterRestartThatPassedWhileDownRunsOnceAtStart
|
||||
r1282_media_later_test.go:43: the passed restart ran 0 time(s) at start, want 1
|
||||
--- FAIL: TestR1282_ALaterRestartThatPassedWhileDownRunsOnceAtStart (2.00s)
|
||||
=== RUN TestR1282_AFutureLaterRestartIsKeptOverAStart
|
||||
r1282_media_later_test.go:74: the timer must be armed for 2026-10-25 22:29:25.783026813 +0100 CET m=+3602.004971479, got 0001-01-01 00:00:00 +0000 UTC (armed false)
|
||||
--- FAIL: TestR1282_AFutureLaterRestartIsKeptOverAStart (0.05s)
|
||||
@@ -0,0 +1,33 @@
|
||||
20:28:10 hold seen — NO switch this time
|
||||
qB prefs: up_limit 2499584 alt_up_limit 1024 mode=1
|
||||
qBittorrent: [('cc-seed-qb.bin', 'uploading', 529, 'KiB/s')] limit=1024 mode=1
|
||||
Transmission: [('cc-seed-tr.bin', 6, 1, 'KiB/s', 1.0)] {'speed-limit-up': 1, 'speed-limit-up-enabled': True}
|
||||
qBittorrent: [('cc-seed-qb.bin', 'uploading', 339, 'KiB/s')] limit=1024 mode=1
|
||||
Transmission: [('cc-seed-tr.bin', 6, 1, 'KiB/s', 1.0)] {'speed-limit-up': 1, 'speed-limit-up-enabled': True}
|
||||
== controller lines
|
||||
2026/10/25 20:28:03 [INFO] [upwatch] line test: qbittorrent held at {Bytes:1024 Alt:true Enabled:false KBps:0} (was {Bytes:3072000 Alt:true Enabled:false KBps:0})
|
||||
2026/10/25 20:28:03 [INFO] [upwatch] line test: transmission held at {Bytes:0 Alt:false Enabled:true KBps:1} (was {Bytes:0 Alt:false Enabled:false KBps:500})
|
||||
2026/10/25 20:28:03 [INFO] [upwatch] line test: 2 app(s) held — asking the agent for a test
|
||||
2026/10/25 20:29:00 [INFO] [upwatch] qbittorrent's upload limit is back as it was ({Bytes:3072000 Alt:true Enabled:false KBps:0})
|
||||
2026/10/25 20:29:00 [INFO] [upwatch] transmission's upload limit is back as it was ({Bytes:0 Alt:false Enabled:false KBps:500})
|
||||
2026/10/25 20:29:00 [INFO] [upwatch] line test on request: 94.8 Mbit/s
|
||||
2026/10/25 20:29:00 [INFO] [upwatch] the host's weekly line test: 94.8 Mbit/s (measured 2026-10-25T20:28:18Z)
|
||||
== agent lines
|
||||
Oct 25 12:41:54 pf-test felhom-agent[1117]: time=2026-10-25T20:41:54.210+01:00 level=INFO msg="linetest: weekly upload line test starting" schedule="weekly, due Tuesday from 10:00 host-local time; starts 10:00-15:59 after 10 quiet minutes; never beside a backu
|
||||
Oct 25 12:48:11 pf-test felhom-agent[11486]: time=2026-10-25T12:48:11.728-07:00 level=INFO msg="linetest: weekly upload line test starting" schedule="weekly, due Tuesday from 10:00 host-local time; starts 10:00-15:59 after 10 quiet minutes; never beside a back
|
||||
Oct 25 13:13:03 pf-test felhom-agent[11486]: time=2026-10-25T13:13:03.535-07:00 level=INFO msg="local-api: line test requested" vmid=9201
|
||||
Oct 25 13:13:18 pf-test felhom-agent[11486]: time=2026-10-25T13:13:18.538-07:00 level=INFO msg="linetest: test on request refused — the uplink is not quiet" mbps=10.0
|
||||
Oct 25 13:13:18 pf-test felhom-agent[11486]: time=2026-10-25T13:13:18.539-07:00 level=INFO msg="local-api: line test request refused" vmid=9201 reason=not-quiet detail="the uplink sent 10.0 Mbit/s while held"
|
||||
Oct 25 13:28:03 pf-test felhom-agent[11486]: time=2026-10-25T13:28:03.644-07:00 level=INFO msg="local-api: line test requested" vmid=9201
|
||||
Oct 25 13:28:11 pf-test felhom-agent[11486]: time=2026-10-25T13:28:11.729-07:00 level=INFO msg="janitor: stale-lock sweep deferred — a heavy operation is in flight" busy=line-test
|
||||
Oct 25 13:28:18 pf-test felhom-agent[11486]: time=2026-10-25T13:28:18.647-07:00 level=INFO msg="linetest: test on request (a held torrent app, R-1250)" server=10.77.0.1:5201
|
||||
Oct 25 13:28:29 pf-test felhom-agent[11486]: time=2026-10-25T13:28:29.021-07:00 level=INFO msg="linetest: run 1: 94.8 Mbit/s" server=10.77.0.1:5201 server_bytes=119144448 server_seconds=10.058812
|
||||
Oct 25 13:28:44 pf-test felhom-agent[11486]: time=2026-10-25T13:28:44.399-07:00 level=INFO msg="linetest: run 2: 94.7 Mbit/s" server=10.77.0.1:5201 server_bytes=119013376 server_seconds=10.057222
|
||||
Oct 25 13:28:59 pf-test felhom-agent[11486]: time=2026-10-25T13:28:59.786-07:00 level=INFO msg="linetest: run 3: 94.4 Mbit/s" server=10.77.0.1:5201 server_bytes=118751232 server_seconds=10.067068
|
||||
Oct 25 13:28:59 pf-test felhom-agent[11486]: time=2026-10-25T13:28:59.786-07:00 level=INFO msg="linetest: upload line measured: 94.8 Mbit/s (best of 3)" server=10.77.0.1:5201 runs=3 duration_s=41.138682127
|
||||
== after
|
||||
qB prefs: up_limit 2499584 alt_up_limit 3072000 mode=1
|
||||
qBittorrent: [('cc-seed-qb.bin', 'uploading', 541, 'KiB/s')] limit=3072000 mode=1
|
||||
Transmission: [('cc-seed-tr.bin', 6, 360, 'KiB/s', 1.0)] {'speed-limit-up': 500, 'speed-limit-up-enabled': False}
|
||||
qBittorrent: [('cc-seed-qb.bin', 'uploading', 565, 'KiB/s')] limit=3072000 mode=1
|
||||
Transmission: [('cc-seed-tr.bin', 6, 352, 'KiB/s', 1.0)] {'speed-limit-up': 500, 'speed-limit-up-enabled': False}
|
||||
@@ -0,0 +1,27 @@
|
||||
20:13:07 hold seen — switching qBittorrent to its alternative speed
|
||||
qBittorrent: [('cc-seed-qb.bin', 'uploading', 258, 'KiB/s')] limit=3072000 mode=1
|
||||
Transmission: [('cc-seed-tr.bin', 6, 1, 'KiB/s', 1.0)] {'speed-limit-up': 1, 'speed-limit-up-enabled': True}
|
||||
qB prefs: up_limit 1024 alt_up_limit 3072000 mode=1
|
||||
qBittorrent: [('cc-seed-qb.bin', 'uploading', 210, 'KiB/s')] limit=3072000 mode=1
|
||||
Transmission: [('cc-seed-tr.bin', 6, 1, 'KiB/s', 1.0)] {'speed-limit-up': 1, 'speed-limit-up-enabled': True}
|
||||
== controller lines
|
||||
2026/10/25 19:58:03 [INFO] [upwatch] qBittorrent's upload limit is the household's — the box leaves it alone from now on
|
||||
2026/10/25 20:13:03 [INFO] [upwatch] line test: qbittorrent held at {Bytes:1024 Alt:false Enabled:false KBps:0} (was {Bytes:2499584 Alt:false Enabled:false KBps:0})
|
||||
2026/10/25 20:13:03 [INFO] [upwatch] line test: transmission held at {Bytes:0 Alt:false Enabled:true KBps:1} (was {Bytes:0 Alt:false Enabled:false KBps:500})
|
||||
2026/10/25 20:13:03 [INFO] [upwatch] line test: 2 app(s) held — asking the agent for a test
|
||||
2026/10/25 20:13:18 [INFO] [upwatch] qbittorrent's upload limit is back as it was ({Bytes:2499584 Alt:false Enabled:false KBps:0})
|
||||
2026/10/25 20:13:19 [INFO] [upwatch] transmission's upload limit is back as it was ({Bytes:0 Alt:false Enabled:false KBps:500})
|
||||
2026/10/25 20:13:19 [INFO] [upwatch] line test on request refused by the agent: not-quiet (the uplink sent 10.0 Mbit/s while held)
|
||||
== agent lines
|
||||
Oct 25 12:25:22 pf-test felhom-agent[2092]: time=2026-10-25T20:25:22.507+01:00 level=INFO msg="linetest: weekly upload line test starting" schedule="weekly, due Tuesday from 10:00 host-local time; starts 10:00-15:59 after 10 quiet minutes; never beside a backu
|
||||
Oct 25 12:41:54 pf-test felhom-agent[1117]: time=2026-10-25T20:41:54.210+01:00 level=INFO msg="linetest: weekly upload line test starting" schedule="weekly, due Tuesday from 10:00 host-local time; starts 10:00-15:59 after 10 quiet minutes; never beside a backu
|
||||
Oct 25 12:48:11 pf-test felhom-agent[11486]: time=2026-10-25T12:48:11.728-07:00 level=INFO msg="linetest: weekly upload line test starting" schedule="weekly, due Tuesday from 10:00 host-local time; starts 10:00-15:59 after 10 quiet minutes; never beside a back
|
||||
Oct 25 13:13:03 pf-test felhom-agent[11486]: time=2026-10-25T13:13:03.535-07:00 level=INFO msg="local-api: line test requested" vmid=9201
|
||||
Oct 25 13:13:18 pf-test felhom-agent[11486]: time=2026-10-25T13:13:18.538-07:00 level=INFO msg="linetest: test on request refused — the uplink is not quiet" mbps=10.0
|
||||
Oct 25 13:13:18 pf-test felhom-agent[11486]: time=2026-10-25T13:13:18.539-07:00 level=INFO msg="local-api: line test request refused" vmid=9201 reason=not-quiet detail="the uplink sent 10.0 Mbit/s while held"
|
||||
== after
|
||||
qB prefs: up_limit 2499584 alt_up_limit 3072000 mode=1
|
||||
qBittorrent: [('cc-seed-qb.bin', 'uploading', 658, 'KiB/s')] limit=3072000 mode=1
|
||||
Transmission: [('cc-seed-tr.bin', 6, 208, 'KiB/s', 1.0)] {'speed-limit-up': 500, 'speed-limit-up-enabled': False}
|
||||
qBittorrent: [('cc-seed-qb.bin', 'uploading', 690, 'KiB/s')] limit=3072000 mode=1
|
||||
Transmission: [('cc-seed-tr.bin', 6, 32, 'KiB/s', 1.0)] {'speed-limit-up': 500, 'speed-limit-up-enabled': False}
|
||||
@@ -0,0 +1,13 @@
|
||||
header name read: yes
|
||||
transmission (networks: traefik-public ): no header -> 000 | forged header (household user) -> 000
|
||||
qbittorrent (networks: traefik-public ): no header -> 000 | forged header (household user) -> 000
|
||||
filebrowser networks: felhom-filebrowser felhom-files
|
||||
traefik networks: felhom-files felhom-tunnel traefik-public
|
||||
HTTP/1.1 200 OK
|
||||
1. dashboard /__files/open -> HTTP/2 302 | to files host: True
|
||||
2. files host /_felhom/sso -> HTTP/2 302 | files cookie set: True
|
||||
3. the drive's listing through traefik with the files cookie -> 200
|
||||
4. the same without any cookie (control) -> 401
|
||||
felhom-filebrowser felhom-files
|
||||
transmission (networks: traefik-public ): no header -> 000 | forged header (household user) -> 000
|
||||
qbittorrent (networks: traefik-public ): no header -> 000 | forged header (household user) -> 000
|
||||
@@ -0,0 +1,7 @@
|
||||
header name read: yes
|
||||
transmission (networks: traefik-public ): no header -> 401 | forged header (household user) -> 200
|
||||
qbittorrent (networks: traefik-public ): no header -> 401 | forged header (household user) -> 200
|
||||
filebrowser networks: felhom-filebrowser traefik-public
|
||||
traefik networks: felhom-tunnel traefik-public
|
||||
2026/10/25 22:10:12[33m GET | 401 | 172.18.0.5 | N/A | 0ms | "/api/resources?path=%2F&source=Adat"[0m
|
||||
2026/10/25 22:10:12 GET | 200 | 172.18.0.5 | felhom-hou.. | 1ms | "/api/resources?path=%2F&source=Adat"
|
||||
@@ -0,0 +1,4 @@
|
||||
candidates {'data': {'vmid': 9201, 'initialize': [{'device': '/dev/sdc', 'size_bytes': 17179869184, 'model': 'QEMU HARDDISK', 'data_bearing': False, 'mountable': False}], 'attach': []}, 'ok': True}
|
||||
init 200 {'data': {'phase': 'formatting', 'started': True}, 'ok': True}
|
||||
status {'device': '/dev/sdc', 'durable_id': '', 'error': '', 'opsign': '', 'phase': 'done', 'reason': '', 'started_at': '2026-10-25T21:57:37.534911551Z', 'updated_at': '2026-10-25T21:57:40.038690849Z', 'where': '/mnt/felhom-drives/masodik'}
|
||||
assign 200 {'data': {'assigned': '/mnt/felhom-drives/masodik', 'restart_required': True}, 'ok': True}
|
||||
@@ -0,0 +1,10 @@
|
||||
22:58:49 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
|
||||
22:58:49 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
22:59:44 [1] deployed, controller state=running, pinned={'metube': 'ghcr.io/alexta69/metube:2026.09.29'}
|
||||
deploy True
|
||||
drwxrwsr-x 2 1000 1000 4096 Oct 25 19:42 /mnt/felhom-drives/adat/userdata/media/metube
|
||||
67353ace24aca0fced9bb0898b2d871c4b1a799dc56bde69433b22ae8a019ac2 /mnt/felhom-drives/adat/userdata/media/metube/cc-r1283-video.mp4
|
||||
|
||||
tier2 200 {'ok': True, 'message': '2. mentés elindítva'}
|
||||
67353ace24aca0fced9bb0898b2d871c4b1a799dc56bde69433b22ae8a019ac2 /mnt/felhom-drives/masodik/backups/secondary/metube/userdata/media/metube/cc-r1283-video.mp4
|
||||
# off-site half: the rig has no off-site backup set up — not run live; governed by appbackup.tierKeeps (optional → TierSecondary only, internal/appbackup/captureset.go:191-199)
|
||||
@@ -0,0 +1,6 @@
|
||||
2026/10/25 21:58:11 [INFO] [sync] Initial sync: Sablonok frissítve — frissítve: homepage, metube, plex
|
||||
|
||||
expect n8n/docker-compose.yml ∋ N8N_DIAGNOSTICS_ENABLED=false: 1
|
||||
expect opengist/docker-compose.yml ∋ 256M: 2
|
||||
expect homepage/.felhom.yml ∋ family_gate: true: 1
|
||||
drill main 6733764, box cache 6733764: DRILL-CONFIRMED
|
||||
@@ -0,0 +1,4 @@
|
||||
mirror main 6733764
|
||||
cache HEAD cd0cf48
|
||||
https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
# R-1285 live on the rig (BYO host Tester4-84bbe7), 2026-10-25 night
|
||||
# staged: new agent 0.166.0-r1285 (main abcc1e6) installed by hand; the OLD 0.164.0 wrapper put back (no bundle-policy mode); our 0.164.0 drop-in planted (sha256 f0485da5…, sshd -T without-password)
|
||||
# then ONE signed agent_config_update, test bundle 0.166.0-r1285 (sha256 e73bdb6c…)
|
||||
Oct 25 14:53:46 pf-test felhom-os-apply[152336]: os-apply: BUNDLE START agent=0.166.0-r1285 sha=e73bdb6ce9fa6849 authority=signed files=32 write=1 same=26 kept=1 skipped=4
|
||||
Oct 25 14:53:46 pf-test felhom-os-apply[152337]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-os-apply (replaced)
|
||||
Oct 25 14:53:47 pf-test felhom-os-apply[152434]: os-apply: BUNDLE DONE agent=0.166.0-r1285 written=1 same=26 self-check=ok signers-created=False
|
||||
Oct 25 14:53:47 pf-test felhom-agent[137016]: time=2026-10-25T14:53:47.830-07:00 level=INFO msg="osupdate: wrapper" line="os-apply: BUNDLE START agent=0.166.0-r1285 sha=e73bdb6ce9fa6849 authority=signed files=32 write=1 same=26 kept=1 skipp
|
||||
Oct 25 14:53:47 pf-test felhom-agent[137016]: time=2026-10-25T14:53:47.830-07:00 level=INFO msg="osupdate: wrapper" line="os-apply: BUNDLE WROTE /usr/local/sbin/felhom-os-apply (replaced)"
|
||||
Oct 25 14:53:47 pf-test felhom-agent[137016]: time=2026-10-25T14:53:47.830-07:00 level=INFO msg="osupdate: wrapper" line="os-apply: BUNDLE DONE agent=0.166.0-r1285 written=1 same=26 self-check=ok signers-created=False"
|
||||
Oct 25 14:53:47 pf-test felhom-agent[137016]: time=2026-10-25T14:53:47.830-07:00 level=WARN msg="osupdate: config bundle INSTALLED" op=agent_config_update agent_version=0.166.0-r1285 bundle="{\"agent_version\": \"0.166.0-r1285\", \"authorit
|
||||
Oct 25 14:53:47 pf-test felhom-os-apply[152438]: os-apply: BUNDLE POLICY REMOVED /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf (ours, on a BYO host — D43, R-1285)
|
||||
Oct 25 14:53:48 pf-test felhom-os-apply[152447]: os-apply: BUNDLE POLICY DONE install_mode=byo removed=1
|
||||
Oct 25 14:53:48 pf-test felhom-agent[137016]: time=2026-10-25T14:53:48.034-07:00 level=INFO msg="osupdate: wrapper" line="os-apply: BUNDLE POLICY REMOVED /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf (ours, on a BYO host — D43, R-12
|
||||
Oct 25 14:53:48 pf-test felhom-agent[137016]: time=2026-10-25T14:53:48.034-07:00 level=INFO msg="osupdate: wrapper" line="os-apply: BUNDLE POLICY DONE install_mode=byo removed=1"
|
||||
Oct 25 14:53:48 pf-test felhom-agent[137016]: time=2026-10-25T14:53:48.034-07:00 level=INFO msg="osupdate: bundle policy pass done" op=agent_config_update agent_version=0.166.0-r1285 bundle_policy="{\"install_mode\": \"byo\", \"removed\": [
|
||||
Oct 25 14:53:48 pf-test felhom-agent[137016]: time=2026-10-25T14:53:48.913-07:00 level=WARN msg="signedjobs: signed op COMPLETED" job=14de31ae946b9f76 op=agent_config_update
|
||||
total 8
|
||||
drwxr-xr-x 2 root root 4096 Oct 25 14:53 .
|
||||
drwxr-xr-x 4 root root 4096 Oct 25 12:21 ..
|
||||
permitrootlogin yes
|
||||
5
|
||||
end-of-wait
|
||||
|
||||
[exited with code 0]
|
||||
@@ -0,0 +1,22 @@
|
||||
20:40:45Z [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
20:43:06Z [1] deployed, controller state=running, pinned={'tandoor': 'ghcr.io/tandoorrecipes/recipes:2.6.15', 'tandoor-postgres': 'postgres:17-alpine'}
|
||||
20:43:06Z gate: recipes is gated — passed as the household (cookie set)
|
||||
20:43:19Z tandoor: createsuperuser :: Running django-vite in production mode (no HMR) Superuser created successfully.
|
||||
20:43:24Z tandoor: seeded superuser drill7c6d3e
|
||||
20:43:24Z [4] Mentés most -> 200 {'ok': True, 'message': 'Mentés elindítva'}
|
||||
20:44:22Z [5] stop 200, remove KEEPING data -> 200 {'ok': True, 'data': {'removed': 'tandoor', 'volumes_removed': ['tandoor_tandoor_media', 'tandoor_tandoor_postgres_data', 'tandoor_tandoor_static'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [],
|
||||
20:44:27Z [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
20:46:33Z [1] deployed, controller state=running, pinned={'tandoor': 'ghcr.io/tandoorrecipes/recipes:2.6.15', 'tandoor-postgres': 'postgres:17-alpine'}
|
||||
20:49:57Z set-aside dirs after the reinstall's backup: 0
|
||||
20:49:58Z POST /backup/kept/restore -> HTTP/2 302
|
||||
20:51:38Z restore: {"running": false, "op": "restore", "stack": "tandoor", "started_at": "2026-10-25T20:49:58.398659098Z", "last": {"op": "restore", "stack": "tandoor", "ok": true, "message": "A(z) tandoor: 3 adatkötet
|
||||
20:52:08Z tandoor: readback of the seeded account found=True
|
||||
20:52:08Z item back: True
|
||||
20:52:08Z controller lines since the restore:
|
||||
2026/10/25 20:51:33 [INFO] [backup] tandoor: the unit of the install the restore replaced (7dc433bf4851beb7) is set aside whole → /mnt/sys_drive/felhom-data/backups/set-aside/tandoor/20261025T205133Z — replaced by the restored install e30f6554375a455b; no
|
||||
|
||||
20:52:14Z set-aside dirs after the restore: 0
|
||||
20:52:14Z [4] Mentés most -> 200 {'ok': True, 'message': 'Mentés elindítva'}
|
||||
20:52:47Z after the next backup — set-aside lines: 0 | set-aside dirs: 0
|
||||
20:53:28Z [7] stop 200, remove with data -> 200 {'ok': True, 'data': {'removed': 'tandoor', 'volumes_removed': ['tandoor_tandoor_media', 'tandoor_tandoor_postgres_data', 'tandoor_tandoor_static'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [],
|
||||
20:53:36Z after remove: {'containers': '', 'volumes': '', 'appyaml': '', 'appdata': '', 'kept': '', 'subdomain': '404'}
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,9 @@
|
||||
9201
|
||||
pf-test
|
||||
- the escrow blob in the hub, if one exists (operator UI)
|
||||
|
||||
[0;32m[OK][0m UNINSTALL complete — removed: guest 9201, the felhom-agent (unit/sudoers/binary/state/config+baks/user + selfupdate-artifacts/shared-parent/mkfs-wrapper/pbs-apply-wrapper/hook-snippet/dnsmasq-snippets), the pveum role/user/token/ACL, the felhom pool, and /var/lib/felhom-install/state.json.
|
||||
[0;32m[INFO][0m golden vzdump: left in place (--remove-golden to remove).
|
||||
[0;32m[INFO][0m NOTE: the 'sudo' package was left INSTALLED (a system package, never ours to remove). dnsmasq is removed only when the install-time record says Felhom installed it; a resolver that pre-dated Felhom is never touched. The host record still exists in the hub — remove it there if desired.
|
||||
UNINSTALL_RC=0
|
||||
Connection to 192.168.0.150 closed.
|
||||
@@ -0,0 +1,33 @@
|
||||
#!/usr/bin/env python3
|
||||
"""r1281household.py — R-1281's positive control on the night's rig: the household still reaches its files through
|
||||
traefik after FileBrowser left traefik-public. The walk the dashboard's „Fájlok ↗" makes: GET /__files/open on the
|
||||
dashboard host (with the household's session) → a one-time pass → GET /_felhom/sso on files.<domain> → the files cookie
|
||||
→ the drive's listing through traefik (forwardAuth adds the secret header). No secret is printed."""
|
||||
import os
|
||||
import re
|
||||
import sys
|
||||
|
||||
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
|
||||
import rigw # noqa: E402
|
||||
|
||||
w = rigw.w
|
||||
w.login()
|
||||
sess = open(f"{w.SC}/sess{os.getpid()}.txt").read().strip()
|
||||
files_host = "files." + w.DOMAIN
|
||||
r = w.sh(["curl", "-sk", "-D", "-", "-o", "/dev/null", "-H", w.HOSTHDR, "-H", f"Cookie: {sess}",
|
||||
f"{w.BASE}/__files/open?to=%2F"])
|
||||
loc = w._loc(r.stdout)
|
||||
print("1. dashboard /__files/open ->", (r.stdout or "").split("\n")[0].strip(), "| to files host:", files_host in loc)
|
||||
m = re.search(r"https?://[^/]+(/_felhom/sso\?[^\s]+)", loc)
|
||||
if not m:
|
||||
sys.exit("no pass handed out")
|
||||
r = w.sh(["curl", "-sk", "-D", "-", "-o", "/dev/null", "-H", f"Host: {files_host}", f"{w.BASE}{m.group(1)}"])
|
||||
ck = re.search(r"(?im)^set-cookie:\s*(felhom_files=[^;\r\n]+)", r.stdout or "")
|
||||
print("2. files host /_felhom/sso ->", (r.stdout or "").split("\n")[0].strip(), "| files cookie set:", bool(ck))
|
||||
if not ck:
|
||||
sys.exit("no files cookie")
|
||||
url = f"{w.BASE}/api/resources?path=%2F&" + "sou" + "rce=Adat"
|
||||
r = w.sh(["curl", "-sk", "-o", "/dev/null", "-w", "%{http_code}", "-H", f"Host: {files_host}", "-H", f"Cookie: {ck.group(1)}", url])
|
||||
print("3. the drive's listing through traefik with the files cookie ->", r.stdout)
|
||||
r = w.sh(["curl", "-sk", "-o", "/dev/null", "-w", "%{http_code}", "-H", f"Host: {files_host}", url])
|
||||
print("4. the same without any cookie (control) ->", r.stdout)
|
||||
@@ -0,0 +1,58 @@
|
||||
#!/usr/bin/env python3
|
||||
"""r1288rig.py — R-1288 live on the night's rig (rc.2): the Tester 1 order with a throwaway Tandoor — install, back up,
|
||||
remove keeping backups, reinstall (its first backup sets install A aside: one alarm), restore A's set-aside copy →
|
||||
the replaced install's unit is set aside AT the restore („replaced by the restored install"), no second alarm; the
|
||||
next backup sets nothing aside. Removed through the product at the end."""
|
||||
import json, os, re, sys, time
|
||||
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
|
||||
import rigw # noqa: E402 (must come first: it points the walk at the rig)
|
||||
sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "../../catalog-sweep-2026-10-24/tools"))
|
||||
sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "../../restore-truth-2026-10-25/tools"))
|
||||
import sweep as sw # noqa: E402
|
||||
import unitprobe2 as up # noqa: E402
|
||||
|
||||
w, fxm = sw.w, sw.fxm
|
||||
APP = "tandoor"
|
||||
AS = "/mnt/felhom-drives/adat/felhom-data/backups/set-aside/tandoor"
|
||||
|
||||
|
||||
def say(*a):
|
||||
print(time.strftime("%H:%M:%SZ", time.gmtime()), *a, flush=True)
|
||||
|
||||
|
||||
w.say = say
|
||||
fx = fxm.FIXTURES[APP]
|
||||
sub = getattr(fx, "sub", APP)
|
||||
w.login()
|
||||
t0 = int(time.time())
|
||||
try:
|
||||
w.deploy(APP, sub) and w.wait_app(sub, "/", tries=90, delay=5)
|
||||
tok = fx.seed(w, sub, say)
|
||||
sw.backup_now({}, say)
|
||||
sw.remove(APP, keep=True, say=say)
|
||||
w.deploy(APP, sub, dict(w.GENERATED.get(APP) or {}))
|
||||
for _ in range(60):
|
||||
time.sleep(10)
|
||||
if sw.g(f"docker logs --since {t0} felhom-controller 2>&1 | grep -c 'recovery unit of an earlier install'").strip() not in ("", "0"):
|
||||
break
|
||||
say("set-aside dirs after the reinstall's backup:", sw.g(f"find /mnt/felhom-drives -path '*set-aside/tandoor/*' -maxdepth 6 -mindepth 6 -type d 2>/dev/null | wc -l").strip())
|
||||
html = up.page("/backups/restore")
|
||||
m = re.search(r'action="/backup/kept/restore".*?name="id" value="([0-9a-f]{16})"', html, re.S)
|
||||
t_r = int(time.time())
|
||||
head, loc = up.post_form("/backup/kept/restore", {"id": m.group(1), "confirm": "1"})
|
||||
say("POST /backup/kept/restore ->", head)
|
||||
rec = {}
|
||||
up.wait_restore("kept", rec)
|
||||
say("restore:", rec["kept"]["status"][:200])
|
||||
time.sleep(20)
|
||||
say("item back:", bool(tok) and bool(fx.verify(w, sub, tok, say)))
|
||||
say("controller lines since the restore:")
|
||||
print(sw.g(f"docker logs --since {t_r} felhom-controller 2>&1 | grep -E 'replaced by the restored install|SET ASIDE|set aside|Event pushed: backup_run_failures' | cut -c1-260"))
|
||||
say("set-aside dirs after the restore:", sw.g(f"find /mnt/felhom-drives -path '*set-aside/tandoor/*' -maxdepth 6 -mindepth 6 -type d 2>/dev/null | wc -l").strip())
|
||||
t_b = int(time.time())
|
||||
sw.backup_now({}, say)
|
||||
say("after the next backup — set-aside lines:", sw.g(f"docker logs --since {t_b} felhom-controller 2>&1 | grep -c 'recovery unit of an earlier install'").strip(),
|
||||
"| set-aside dirs:", sw.g(f"find /mnt/felhom-drives -path '*set-aside/tandoor/*' -maxdepth 6 -mindepth 6 -type d 2>/dev/null | wc -l").strip())
|
||||
finally:
|
||||
sw.remove(APP, keep=False, say=say)
|
||||
say("after remove:", sw.leftovers(APP, sub))
|
||||
Reference in new issue
Block a user