From b70f2d0763427a091c6e29c950770ff4d3778393 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sun, 5 Jul 2026 22:35:00 +0200 Subject: [PATCH] =?UTF-8?q?deploy(hub):=20v0.35.0=20=E2=80=94=20OOB=20oper?= =?UTF-8?q?ator=20access=20(TASK=20H1)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6 --- hub/CHANGELOG.md | 17 +++++++++++++++++ manifests/hub.yaml | 2 +- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/hub/CHANGELOG.md b/hub/CHANGELOG.md index bfee25e..c354cad 100644 --- a/hub/CHANGELOG.md +++ b/hub/CHANGELOG.md @@ -1,5 +1,22 @@ # Felhom Hub — Changelog +## v0.35.0 — OOB operator access: operator peer + oob_peer_ip/oob_operator_ssh_key + OOB health alert (TASK H1) (2026-07-05) + +The hub half of the merged E1+H1 operator-SSH-access feature (agent half = felhom-agent v0.72.0). + +- **Operator OOB peer** (`store/wg_operator.go`): the fleet operator peer as an UNBOUND wg_peers row + (host_id '', note operator-oob) at an EXPLICIT /32 (so the endpoint's static forward chain can + hardcode it); validated in-subnet/not-reserved/not-taken; last-write-wins rotation. It rides + ListWGPeers → peersync pushes it to the endpoint. `PUT/GET /admin/wg/operator-peer` (global key); + the PUT also takes an optional `ssh_pubkey` (the operator authorized_keys line, hub_settings) and + bumps EVERY host's generation. +- **Desired-state** (`api/wg.go` mergeWireguard): when an operator peer exists, the served wireguard + block carries `oob_peer_ip` (rendered into the box's AllowedIPs — survives self-heal [OF-1]) and + `oob_operator_ssh_key` (agent writes felhom-sshd's authorized_keys). Absent → byte-identical. +- **OOB health** (`monitor/host_oob.go`): ingests the agent's `oob` heartbeat stanza and raises a + transition-based `oob_degraded`/`oob_recovered` warning (felhom-sshd down while the operator peer + is configured, OR config invalid) — the proactive "can the operator get in right now" signal. + ## v0.34.1 — mgmt_plane_healed alerts on the FIRST auto-heal (TASK G1 fix) (2026-07-05) The mgmt-plane checker seeded a heal marker silently on first observation (copied from HostLeafChecker's diff --git a/manifests/hub.yaml b/manifests/hub.yaml index f24b0cd..e9d71e8 100644 --- a/manifests/hub.yaml +++ b/manifests/hub.yaml @@ -126,7 +126,7 @@ spec: spec: containers: - name: hub - image: gitea.dooplex.hu/admin/felhom-hub:0.34.1 + image: gitea.dooplex.hu/admin/felhom-hub:0.35.0 ports: - containerPort: 8080 name: http