Operator's three steps verified: hub password changed (DB vs 02:00 snapshot), HUB_PW gone from CC's credentials, demo-hp floor cleared; STATUS + total-loss runbook S16

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
2026-10-15 14:05:58 +02:00
parent 6d82f96d58
commit bd478afe14
3 changed files with 3 additions and 3 deletions
@@ -15,3 +15,4 @@ hub 0.153.0 live check with CC's token (customer id that does not exist: zz-prob
 2026/10/15 13:39:51 [WARN] access token "cc-releases" refused: session only — never by a token — POST /customers/zz-probe-none/create-config → 403
 2026/10/15 13:39:54 [INFO] access token "cc-releases": GET /configuration → 200
 Boxes reporting after the restart (hub DB + WAL from the running pod, last_report_at > 11:39:40 UTC): demo-felhom-8363b5=11:49:40 demo-hp-bb76ea=11:41:03 tester-1-d70be4=11:41:30 (Tester-2 off since 2026-10-04, known)
+operator done 2026-10-15 ~13:50-14:05: password changed (hub_settings override differs from the 02:00 snapshot, compared by hash, not printed); HUB_PW line gone from ~/.config/credentials (HUB_TOKEN present); demo-hp own floor empty (snapshot 0.311.0), hub log 13:39:59 'managed floor SERVED for demo-hp: floor 0.313.0'
@@ -47,7 +47,7 @@ local restic repos; Prometheus history; DooPlex's other homelab apps (not Felhom
 | S13 | Domain registrar(s) for `felhom.eu`, `dooplex.hu`; No-IP (`dooplex.hopto.org`, the home address CNAME) | moving DNS / the home address | the operator; Vaultwarden | — |
 | S14 | Resend account / API key | all mail | Secrets export (S1+S5); Vaultwarden; the Resend dashboard (re-mint) | no — re-mint at Resend |
 | S15 | Gitea admin password; registry credentials (`gitea-creds`) | Gitea UI; image push/pull | the restored Gitea DB (password hash) + Vaultwarden; the Secrets export | no, after S1 (+S3) |
-| S16 | The hub operator password (`HUB_PW`) | the hub UI | the restored hub DB (hash); `~/.config/credentials` on DooPlex; Vaultwarden | no, after S2 (+S3) |
+| S16 | The hub operator password | the hub UI | the restored hub DB (hash); Vaultwarden — NOT `~/.config/credentials` any more (operator-only since 2026-10-15, `09` §3 decision 251; CC holds the scoped token `HUB_TOKEN` there instead, which a restored hub DB keeps as its hash) | no, after S2 (+S3) |
 | S17 | Authentik admin | SSO for Vaultwarden and DooPlex apps | Authentik's DB (Longhorn on DooPlex, local PostgreSQL dumps only) | **yes** — not in any copy; Vaultwarden does not need it (password login) |
 | S18 | Households' recovery codes, PBS keys, restic passwords | households' restores | the households / escrow / the boxes | not the operator's |