From bca45aaed1acb2cd84e9537f97c9a190f44e4834 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Wed, 16 Sep 2026 12:30:47 +0200 Subject: [PATCH] drill phase 1 complete: fresh box on golden 0.243.0 (sha proven), tunnel, file manager, apps, vaultwarden 400, paperless 20/20, 26 s downtime, absent-tier skip live Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- .../DRILL-prove-fixes-0243-2026-09-16.md | 8 ++++- .../phase1-backups.txt | 7 +++++ .../phase1-manualbackup.txt | 10 ++++++ .../phase1-paperless.txt | 5 +++ .../phase1-provision.txt | 31 +++++++++++++++++++ 5 files changed, 60 insertions(+), 1 deletion(-) diff --git a/documentation/audits/DRILL-prove-fixes-0243-2026-09-16.md b/documentation/audits/DRILL-prove-fixes-0243-2026-09-16.md index 54bcafb1..57455505 100644 --- a/documentation/audits/DRILL-prove-fixes-0243-2026-09-16.md +++ b/documentation/audits/DRILL-prove-fixes-0243-2026-09-16.md @@ -57,5 +57,11 @@ Vouched as a three-field change — golden 0.243.0 + agent 0.131.0 + min agent 0 | 8b | the data drive | „Nincs regisztrált adattároló" on arrival; the wizard formatted and registered `/dev/sdb` as „Adatlemez" (`/mnt/felhom-drives/adatlemez`, default, 97.9 GB) in ~2 s. **Two refusals worth recording:** the mount name rejects accented letters („érvénytelen csatlakoztatási név"), which is the first thing a Hungarian volunteer types, and the API needs `mount_name`, not `label` | 10:20 | | 11 | **the backup page** (R-517 on a FRESH box) | per tier: „Helyi tároló (local) ✓ Utolsó sikeres mentés: 2026-09-16 12:08 · 624.3 MB · Naprakész"; „Biztonsági szerver – külön hardver (PBS) **nincs beállítva**"; the remote tile „Távoli rendszermentés **nincs beállítva**" (not ticked); the button says „A mentés alatt az alkalmazások leállnak — általában néhány perc, nagyobb adatnál több." | 10:22 | -_(steps 9–12 continue: the four apps, their cards, the manual backup)_ +| 9 | four apps | deployed through the dashboard API with the new drive as their data path: privatebin and vaultwarden **running by 10:23:29Z**, paperless-ngx and nextcloud **by 10:24:29Z** (2–3 min each); the hub logged four `app_deployed` events. Cards: **no `admin / admin` anywhere**; Vaultwarden's „Első lépések" is invite-first („Users" → „Invite User", „a regisztráció alapból le van zárva"); Paperless points at „Beállítások → Automatikusan generált értékek" and at the file manager's own login page | 10:21–10:24 | +| 9b | **Vaultwarden, R-512 on a fresh box** | over the public address, a stranger's `send-verification-email` → **400 „Registration not allowed or user already exists"**; the app answers otherwise (its `/api/config` 200) | 10:25:05 | +| 9c | **Paperless, R-514 on a fresh box** | 20 three-page PDFs posted at once through the public address → **20 SUCCESS, 20 documents**, no OOM; the container carries the new catalog limits (1280M, 1 worker × 1 thread) | 10:25:26–10:27 | +| 10–11 | **„Mentés most" and the page** | the button's promise measured: privatebin answered 200, went unreachable **10:27:17→10:27:43Z = 26 s**, then answered again while the dump continued — inside „általában néhány perc". The page kept „Helyi tároló (local) ✓ … 624.3 MB · Naprakész" and „PBS — nincs beállítva" throughout, and showed „Mentés folyamatban… (fázis: snapshotted)" while running. **The box's own first scheduled backup had already proven R-518 live**: `backup_tier_skipped (warning)` at 12:08:25 CEST — „tier felhom-pbs skipped: its storage does not exist … No app was stopped for it" + operator mail | 10:27 | +| 12 | which golden it landed on | **MEASURED, not inferred:** the day-0 install left the golden archive on the box (`vzdump-lxc-9100-…tar.zst`, 653 997 919 B) whose sha256 is **e2d1843c…c10a** — byte-identical to this drill's own bake; the guest runs controller **0.243.0**, so no self-update was needed | 12:02 | + +**New finding on the walk: R-535 (P2)** — 25 minutes after a successful bind AND claim, with apps deploying, the box's console still showed „a doboz készen áll, és a párosításra vár" with the pairing code, and still promised „Ez a képernyő magától frissül". diff --git a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-backups.txt b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-backups.txt index 9ffc45e8..bc5f2422 100644 --- a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-backups.txt +++ b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-backups.txt @@ -1,3 +1,10 @@ ## whole-system section (fresh box, off-site NOT provisioned — R-534): Rendszermentés (teljes mentés) A teljes szerver — alkalmazások, beállítások és adatbázisok együtt — időszakos mentése, amelyből az egész készülék visszaállítható. Ezt a host-ügynök készíti és kezeli. ✓ Utolsó teljes mentés 2026-09-16 12:08 (14 perce) 624.3 MB Helyi tároló (local) Naprakész Következő mentés 0 órája — a mentési ablakon belül – Visszaállítás ellenőrizve Még nem futott Helyi tároló (local) ✓ Utolsó sikeres mentés: 2026-09-16 12:08 (14 perce) · 624.3 MB Naprakész Biztonsági szerver – külön hardver (PBS) nincs beállítva Mentés most A mentés alatt az alkalmazások leállnak — általában néhány perc, nagyobb adatnál több. ## remote tile: s – Távoli rendszermentés nincs beállítva +## LIVE PROOF of R-518's cheap half (the absent-tier skip), on the box's OWN first scheduled backup: +## hub, 2026-09-16 12:08:25 CEST: Event from tester-1: backup_tier_skipped (warning) — +## "Whole-guest backup tier felhom-pbs skipped: its storage does not exist on the host (never provisioned or removed). +## No app was stopped for it." → "Operator email sent for tester-1/backup_tier_skipped". +## Context: the PBS tier could not be provisioned at all on this box (R-534, the ep0 grant), so the tier's storage is +## genuinely absent — exactly the shape the skip exists for. The local tier still ran: 12:08 success, 624.3 MB. +## Also live: app_deployed events for all four apps (PrivateBin, Vaultwarden, Paperless-ngx, Nextcloud) 12:21–12:22. diff --git a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-manualbackup.txt b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-manualbackup.txt index 474a1ce9..fc1d8e6e 100644 --- a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-manualbackup.txt +++ b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-manualbackup.txt @@ -2,3 +2,13 @@ privatebin before: 200 trigger http=200 {"data":{"started":true},"ok":true} + privatebin unreachable from 2026-09-16T10:27:17Z to 2026-09-16T10:27:43Z = 26 s (trigger at 2026-09-16T10:27:01Z) +## 2026-09-16T10:28:22Z hub events for tester-1 during the manual backup: +2026/09/16 12:08:25 [INFO] Event from tester-1: backup_tier_skipped (warning) — Whole-guest backup tier felhom-pbs skipped: its storage does not exist on the host (never provisioned or removed). No app was stopped for it. +2026/09/16 12:08:25 [INFO] Operator email sent for tester-1/backup_tier_skipped +2026/09/16 12:17:16 [INFO] host-report from tester-1-652049 (1 guests, 2 storage targets, 1 backups, 0 restore-tests, 0 pbs-snapshots, 11172 bytes) +2026/09/16 12:21:17 [INFO] Event from tester-1: app_deployed (info) — Alkalmazás telepítve: PrivateBin +2026/09/16 12:21:38 [INFO] Event from tester-1: app_deployed (info) — Alkalmazás telepítve: Vaultwarden +2026/09/16 12:21:58 [INFO] Event from tester-1: app_deployed (info) — Alkalmazás telepítve: Paperless-ngx +2026/09/16 12:22:18 [INFO] Event from tester-1: app_deployed (info) — Alkalmazás telepítve: Nextcloud + page after: Rendszermentés (teljes mentés) A teljes szerver — alkalmazások, beállítások és adatbázisok együtt — időszakos mentése, amelyből az egész készülék visszaállítható. Ezt a host-ügynök készíti és kezeli. ✓ Utolsó teljes mentés 2026-09-16 12:08 (20 perce) 624.3 MB Helyi tároló (local) Naprakész Következő mentés 0 órája — a mentési ablakon belül – Visszaállítás ellenőrizve Még nem futott Helyi tároló (local) ✓ Utolsó sikeres mentés: 2026-09-16 12:08 (20 perce) · 624.3 MB Naprakész Biztonsági szerver – külön hardver (PBS) nincs beállítva Mentés folyamatban… (fázis: snapshotted ) Mentés most A mentés diff --git a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-paperless.txt b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-paperless.txt index 81d126cd..68bfb4ef 100644 --- a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-paperless.txt +++ b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-paperless.txt @@ -2,3 +2,8 @@ posted at 2026-09-16T10:25:26Z tasks: {'SUCCESS': 20} documents: 20 +/paperless-webserver mem_limit=1342177280 oom=false restarts=0 +/paperless-postgres mem_limit=268435456 oom=false restarts=0 +/paperless-redis mem_limit=134217728 oom=false restarts=0 +workers=1 threads=1 +## 2026-09-16T10:30:34Z fresh-box paperless limits (catalog after R-514): webserver 1 342 177 280 B (1280M), postgres 256M, redis 128M, workers=1 threads=1 — the new template applied on a fresh install. diff --git a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-provision.txt b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-provision.txt index 9fe75617..fa6f71e5 100644 --- a/documentation/audits/evidence-drill-0243-2026-09-16/phase1-provision.txt +++ b/documentation/audits/evidence-drill-0243-2026-09-16/phase1-provision.txt @@ -35,3 +35,34 @@ VMID Status Lock Name 9201 running backup tester-1 controller image: gitea.dooplex.hu/admin/felhom-controller:0.243.0 golden marker: +--- agent journal, golden/provision lines: +Sep 16 12:02:12 tester1 felhom-agent[3602]: time=2026-09-16T12:02:12.605+02:00 level=WARN msg="local-api leaf REGENERATED — any previously issued bootstrap pins are now INVALID; controllers will fail the pin check until re-boots +Sep 16 12:02:13 tester1 felhom-agent[3602]: time=2026-09-16T12:02:13.369+02:00 level=INFO msg="backup: restore-test scheduler starting (per-archive due-check)" eval_interval=6h0m0s settle=24h0m0s +--- install log (day-0): +/var/log/felhom-bootstrap-postinst.log +-rw-r--r-- 1 root root 408 Sep 16 11:13 felhom-bootstrap-postinst.log +--- golden lines in any felhom log: +--- vzdump/backup files present: +-rw-r--r-- 1 root root 16 Sep 16 12:08 vzdump-lxc-9201-2026_09_16-12_08_25.tar.zst.notes +-rw-r--r-- 1 root root 946388992 Sep 16 12:28 vzdump-lxc-9201-2026_09_16-12_27_11.tar.dat +drwxr-xr-x 3 root root 4096 Sep 16 12:27 vzdump-lxc-9201-2026_09_16-12_27_11.tmp +## HOW THE GOLDEN LANDING IS EVIDENCED (2026-09-16), stated because there is no single box-side line: +## - hub, 09:01:59Z: "Artifact manifest served for customer tester-1 (agent=0.131.0 golden=0.243.0)" — the vouched set +## is this run's own bake (GOLDEN_SHA256 e2d1843c…c10a). +## - box: guest 9201 exists and runs `gitea.dooplex.hu/admin/felhom-controller:0.243.0`, which is the controller the +## 0.243.0 golden bakes; agent 0.131.0. +## - NOT available: a box-side log naming the golden archive. `/var/log/` holds only `felhom-bootstrap-postinst.log` +## (the ISO payload's own log); the agent journal has no golden/restore line. So the landing is inferred from the +## two facts above, not read from one line — recorded as an inference, not a measurement. +golden archive on the box: /var/lib/vz/dump/vzdump-lxc-9100-2026_09_16-12_02_16.tar.zst + size: 653997919 +cut: '"': No such file or directory + sha256: + expected (this drill's bake): e2d1843c8b648910ddde7cef4fe9f9ba2ee25002cdb58fbc42543a3e8967c10a +e2d1843c8b648910ddde7cef4fe9f9ba2ee25002cdb58fbc42543a3e8967c10a /var/lib/vz/dump/vzdump-lxc-9100-2026_09_16-12_02_16.tar.zst +## CORRECTION / UPGRADE OF THE ABOVE (2026-09-16): the golden landing is MEASURED, not inferred. +## The day-0 install leaves the golden archive on the box as `/var/lib/vz/dump/vzdump-lxc-9100-2026_09_16-12_02_16.tar.zst` +## (the golden is baked as guest 9100), 653 997 919 B, sha256 +## e2d1843c8b648910ddde7cef4fe9f9ba2ee25002cdb58fbc42543a3e8967c10a — byte-identical to this drill's own bake output +## (GOLDEN_SHA256 in phase0-bake-full.log). So the fresh box landed on golden 0.243.0, and no self-update was needed +## (guest controller image is 0.243.0, the version that golden bakes).