R-1300 CLOSED: controller 0.345.1 (cloudflared 2026.10.3) on every box; R-1301 filed (N100 host clock, chrony fails at boot); 01: cloudflared follows Cloudflare's security notices
gates / gates (push) Successful in 2m27s
gates / gates (push) Successful in 2m27s
This commit is contained in:
admin committed
1 parent
f680720ecd
commit
cc0fb962f3
23 files changed
+4424
-6
No files matched your search
@@ -0,0 +1,76 @@
|
||||
# REPORT — cloudflared 2026.10.3 on every box (R-1300), 2026-10-26 evening, attended
|
||||
|
||||
> A sibling of `REPORT.md`: the night session (`TASK-night-burndown-and-tuesday-2026-10-26.md`) owns `REPORT.md`
|
||||
> tonight.
|
||||
|
||||
## In plain words
|
||||
|
||||
1. **We run 3 cloudflared, one in each box's guest** (Tester 1, demo-hp, demo-felhom). None on DooPlex. Tester4 has no
|
||||
tunnel; Tester 2 has no box.
|
||||
2. **The https-origin trap does not apply.** Each tunnel sends to `https://traefik` with „No TLS Verify" on, and traefik
|
||||
shows its own self-signed certificate — not an eMudhra one.
|
||||
3. **0.345.1 is on every box: 4 of 4 reporting controllers** (the three above + Tester4); none left behind.
|
||||
4. **Longest tunnel gap: about 11 seconds** (demo-hp). Tester 1 about 2 s, demo-felhom about 4 s.
|
||||
|
||||
Decisions: the operator said yes to the build-gate exception (build from a pushed tag) and to the global floor.
|
||||
|
||||
## Versions, digests, CI
|
||||
|
||||
| What | Value |
|
||||
|---|---|
|
||||
| controller tag `v0.345.1` | commit `f3204024` = v0.345.0 `6bfb784` + one commit; CI job 2393 success (attempt 1) |
|
||||
| controller `main` | `a1c65b3d` (same bump + `build.sh` tag path); CI job 2392 success (attempt 1) |
|
||||
| controller image `0.345.1` / `:latest` | `sha256:7cfdf7e1f835628de9c7d536e0a60c06bad5bbe19e8133765cc0a6bb732dbff6` |
|
||||
| cloudflared | `cloudflare/cloudflared:2026.10.3`, index `sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39` |
|
||||
| MinAgent | 0.158.1 (unchanged, declared with the floor) |
|
||||
| global floor | 0.345.1 at 20:08:39Z (`303 floor_set`; read back from the running hub: „Effective floor: v0.345.1 — source: DB") |
|
||||
| per-box floors | set 20:05:08Z (Tester 1), 20:06:04Z (demo-hp, demo-felhom); cleared 20:39:54Z |
|
||||
|
||||
Tests and gates: controller gates `--fast` green on both commits; `go test ./...` green on the tag commit; the new
|
||||
reconcile test and the four build-gate cases red-proved. felhom.eu gates green on push. **Methods:** box state by
|
||||
`docker ps`/`docker logs` in each guest; tunnel state by the hub's Hosts page and by a public name with no app
|
||||
(`cfprobe.<domain>`: 404 = tunnel up, 530 = down), probed every 0.5–1 s from DooPlex.
|
||||
|
||||
## Register
|
||||
|
||||
Rows before **213**, after **214**, opened **2** (R-1300, R-1301), closed **1** (R-1300).
|
||||
|
||||
## Observations
|
||||
|
||||
- The N100 host's clock is 14 s slow; chrony fails at every boot — **FILED: R-1301** (and `lived-in/n100.md`).
|
||||
- I put a test run and a commit in one command on the detached tag clone (standing rule 1). The commit was local; the
|
||||
test result was then read on its own (green) before anything was pushed — **NOT-A-FINDING: my slip, caught before
|
||||
push, recorded here.**
|
||||
- `noTLSVerify` on every tunnel route (R-510) — **NOT-A-FINDING: a leg that never leaves the guest** (cloudflared and
|
||||
traefik alone on the /29 tunnel network); now written in `01` as a recorded exception, with the rule „never turn off
|
||||
a certificate check to make an update work".
|
||||
- cloudflared 2026.10.4 (today, VULN-176088: metrics debug endpoints allowlist) — **NOT-A-FINDING: our metrics bind to
|
||||
the container's own loopback**; not taken because it is under a day old and the notice names 2026.10.3.
|
||||
- 0.345.1 is built with 0.345.0's Go builder; `main` moved to Go 1.27.3 tonight (R-972) — **NOT-A-FINDING: R-972 owns
|
||||
it; the next release from `main` carries it.**
|
||||
- Single-sample `000` answers at 20:13:37 (both Tester 1 probes at once) and 20:17:13 (demo-hp) — **NOT-A-FINDING: a
|
||||
client-side timeout, no 530; the hub and the boxes showed the tunnel up throughout.**
|
||||
- `internal/stacks` tests took 450 s under the night session's load (each R-442 remove test 26 s) — **NOT-A-FINDING: CI
|
||||
green; slow only under load.**
|
||||
- Tester4's agent reads `0.167.0-night1 floor held` on the Hosts page — the night session's agent; not touched.
|
||||
|
||||
## What changed in documents
|
||||
|
||||
- `architecture/01-topology-and-trust.md` „Tunnel placement": the version, the rule, the recorded exception.
|
||||
- `architecture/11-os-updates.md` C8: the new pin.
|
||||
- `STATUS.md`: one line (released; `main` and Sunday's golden carry it). The golden 0.344.0 still has 2026.9.3; a new
|
||||
box moves to the floor in its first minutes. No extra bake (operator did not ask).
|
||||
- System poster: none of the three needed — no fact on the poster changed (cloudflared still runs in the guest).
|
||||
- Controller: `build.sh` may push from the pushed tag `v<VERSION>` (operator's yes). Controller report:
|
||||
`felhom-controller/REPORT-cloudflared-0.345.1.md`.
|
||||
|
||||
## For the operator
|
||||
|
||||
- **Nothing to do.** If you want a second look: Cloudflare dashboard → Networking → Tunnels shows each connector's
|
||||
version (CC holds no Cloudflare token).
|
||||
|
||||
## Teardown
|
||||
|
||||
Machine: the image pulled on scratch guest 9202 for the version check was removed. Host: nothing. Hub: the three
|
||||
per-box floors cleared; the global floor stays at 0.345.1 by design. Clones `felhom-controller-sec`,
|
||||
`felhom-controller-mainsec` and `felhom.eu-cfsec` on DooPlex are my work copies (all pushed); removed at the end.
|
||||
@@ -18,12 +18,12 @@
|
||||
- The hub mails alarms and recoveries and keeps a weekly whole-box copy on ep0; CC uses its own limited token (map F1, F11, G15).
|
||||
|
||||
## What is broken
|
||||
- **P1:** each box's tunnel trusts 8 bad certificates until 0.345.1 reaches it (R-1300, rolling out). Any hacked app on DooPlex can read the hub's nightly backups, and maybe the signing keys (R-1241, homelab session); about 12 homelab logins still use a password that was public, and the public Gitea repo is not decided (R-925, yours).
|
||||
- **P1:** any hacked app on DooPlex can read the hub's nightly backups, and maybe the signing keys (R-1241, homelab session); about 12 homelab logins still use a password that was public, and the public Gitea repo is not decided (R-925, yours).
|
||||
- Tester 2 off since 10-04: old emergency password, no off-site check, no bootstrap (R-1139, R-1104, R-862). Scratch box: no agent features (R-1083).
|
||||
- DooPlex: something sets the shared checkout to „bare" (R-935).
|
||||
|
||||
## What we work on
|
||||
- Built, not released: a BYO box removes our SSH file in the same update (R-1285; the agent waits for a live BYO proof); held apps reach you (R-1291, controller + hub, proven on a test hub).
|
||||
- Released: 0.345.1 (cloudflared 2026.10.3, security), every box; `main` and Sunday's golden carry it. Built, not released: a BYO box removes our SSH file in the same update (R-1285; the agent waits for a live BYO proof); held apps reach you (R-1291, controller + hub, proven on a test hub).
|
||||
- Dated checks, run by CC. 2026-10-27: the qBittorrent line test on a seeding box, with DooPlex's qBittorrent as the peer (R-1250, your yes). Done 2026-10-26: the weekly clean-up windows removed only old copies and raised no false alarm. 2026-10-30: D35, website and installer to Cloudflare, starts (R-1228, ruled yes).
|
||||
|
||||
## Waiting on you — decide
|
||||
|
||||
@@ -281,6 +281,13 @@ app. Controller down → the gated app answers an error, never the app. Measured
|
||||
tunnel. Since controller v0.286.0 it sits ALONE on the `felhom-tunnel` network at the fixed address `172.16.253.2`
|
||||
(traefik at `.3`), so traefik can believe forwarded headers from it and from nothing else (§5). Geo-restriction WAF
|
||||
is **hub-enforced** (the hub holds the CF API token; the controller only reports geo desired-state).
|
||||
**Version and rule (2026-10-26, R-1300):** the image is `cloudflare/cloudflared:2026.10.3` since controller v0.345.1
|
||||
(`infra.CloudflaredImage`). **cloudflared follows Cloudflare's security notices** — a notice is a patch release of
|
||||
the controller, and a controller update recreates the container on the new image by itself
|
||||
(`TestEnsureCloudflared_ANewImageRecreatesTheTunnel`). **Never turn off a certificate check to make an update
|
||||
work.** The one check that is off today is the route's own: `*.<domain>` → `https://traefik` with `noTLSVerify`
|
||||
(R-510; traefik shows its self-signed default certificate on a leg that never leaves the guest) — a recorded
|
||||
exception, not a pattern to copy.
|
||||
- **[DESIGN] The website's content comes from Gitea IN-CLUSTER** (2026-10-19). The `felhom-webpage` pod pulls
|
||||
`website/` (from `main`) and `scripts/` (from the `installer-v…` tag, R-110) with four git-syncs that read
|
||||
`http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git` — plain HTTP, safe only because it never
|
||||
|
||||
@@ -91,7 +91,7 @@ boxes installed. Nobody keeps a hand-written list.
|
||||
- **The Proxmox MAJOR upgrade** (PVE 9 → 10). It is a later step of its own, drilled first (R-808 item 5).
|
||||
- **`cloudflared` and the other infrastructure images** (traefik, filebrowser). **[FACT] (C8)** They are containers in
|
||||
the guest, pinned in the controller (`internal/infra/infra.go:26`: `cloudflare/cloudflared:2026.6.0`, since
|
||||
2026-06-11 — *`2026.9.3` today, corrected 2026-10-24*) and baked into the golden; upstream was `2026.9.3` on 2026-10-04. They move only by a controller release
|
||||
2026-06-11 — *`2026.9.3` from 2026-10-24; `2026.10.3` since controller v0.345.1, 2026-10-26 — Cloudflare's eMudhra notice, R-1300*) and baked into the golden; upstream was `2026.9.3` on 2026-10-04. They move only by a controller release
|
||||
— the app-image question (`09`), not an OS package. The gap is R-838.
|
||||
|
||||
---
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
System clock synchronized: no
|
||||
NTP service: inactive
|
||||
failed
|
||||
inactive
|
||||
× chrony.service - chrony, an NTP client/server
|
||||
Loaded: loaded (/usr/lib/systemd/system/chrony.service; enabled; preset: enabled)
|
||||
Active: failed (Result: exit-code) since Wed 2026-10-21 05:23:50 CEST; 5 days ago
|
||||
Invocation: 135c8cdc305140c8ac2bf943db811094
|
||||
Docs: man:chronyd(8)
|
||||
man:chronyc(1)
|
||||
Oct 16 05:09:25 demo-felhom systemd[1]: Failed to start chrony.service - chrony, an NTP client/server.
|
||||
-- Boot 56db71938b304a57bdedf30f89860e1f --
|
||||
Oct 21 05:23:50 demo-felhom systemd[1]: Starting chrony.service - chrony, an NTP client/server...
|
||||
Oct 21 05:23:50 demo-felhom chronyd[676]: chronyd version 4.8 starting (+CMDMON +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +NTS +SECHASH +IPV6 -DEBUG)
|
||||
Oct 21 05:23:50 demo-felhom chronyd[676]: Loaded 0 symmetric keys
|
||||
Oct 21 05:23:50 demo-felhom chronyd[676]: Using leap second list /usr/share/zoneinfo/leap-seconds.list
|
||||
Oct 21 05:23:50 demo-felhom chronyd[676]: Frequency -2.666 +/- 0.016 ppm read from /var/lib/chrony/chrony.drift
|
||||
Oct 21 05:23:50 demo-felhom chronyd[676]: Loaded seccomp filter (level 1)
|
||||
Oct 21 05:23:50 demo-felhom chronyd[676]: Fatal error : Could not send notification to $NOTIFY_SOCKET
|
||||
Oct 21 05:23:50 demo-felhom chronyd[676]: Fatal error : Could not send notification to $NOTIFY_SOCKET
|
||||
Oct 21 05:23:50 demo-felhom systemd[1]: chrony.service: Main process exited, code=exited, status=1/FAILURE
|
||||
Oct 21 05:23:50 demo-felhom systemd[1]: chrony.service: Failed with result 'exit-code'.
|
||||
Oct 21 05:23:50 demo-felhom systemd[1]: Failed to start chrony.service - chrony, an NTP client/server.
|
||||
2026-10-21 05:23:45
|
||||
[Unit]
|
||||
Description=chrony, an NTP client/server
|
||||
Documentation=man:chronyd(8) man:chronyc(1) man:chrony.conf(5)
|
||||
Conflicts=openntpd.service ntp.service ntpsec.service
|
||||
ConditionVirtualization=|!container
|
||||
ConditionVirtualization=|wsl
|
||||
ConditionCapability=CAP_SYS_TIME
|
||||
[Service]
|
||||
Type=notify
|
||||
PIDFile=/run/chrony/chronyd.pid
|
||||
EnvironmentFile=-/etc/default/chrony
|
||||
User=_chrony
|
||||
ExecStart=!/usr/sbin/chronyd -n $DAEMON_OPTS
|
||||
CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
|
||||
CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE
|
||||
CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_MKNOD CAP_SYS_ADMIN
|
||||
CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_PACCT
|
||||
CapabilityBoundingSet=~CAP_SYS_PTRACE CAP_SYS_RAWIO CAP_SYS_TTY_CONFIG CAP_WAKE_ALARM
|
||||
DeviceAllow=char-pps rw
|
||||
DeviceAllow=char-ptp rw
|
||||
DeviceAllow=char-rtc rw
|
||||
DevicePolicy=closed
|
||||
LockPersonality=yes
|
||||
MemoryDenyWriteExecute=yes
|
||||
NoNewPrivileges=yes
|
||||
PrivateTmp=yes
|
||||
ProcSubset=pid
|
||||
ProtectControlGroups=yes
|
||||
ProtectHome=yes
|
||||
ProtectHostname=yes
|
||||
|
||||
DAEMON_OPTS="-F 1"
|
||||
ii chrony 4.8-4~bpo13+2 amd64 Versatile implementation of the Network Time Protocol
|
||||
@@ -0,0 +1,181 @@
|
||||
|
||||
[INFO] ╔══════════════════════════════════════╗
|
||||
[INFO] ║ felhom-controller image builder ║
|
||||
[INFO] ╚══════════════════════════════════════╝
|
||||
[INFO] Version: 0.345.1
|
||||
[INFO] Commit: f3204024
|
||||
[INFO] Repo: /mnt/5_hdd/felhom.eu/git/felhom-controller-sec
|
||||
[INFO] Source: /mnt/5_hdd/felhom.eu/git/felhom-controller-sec/controller
|
||||
[INFO] Build dir: /mnt/5_hdd/felhom.eu/git/felhom-controller-mainsec/controller/workspace
|
||||
[INFO] Image: gitea.dooplex.hu/admin/felhom-controller:0.345.1
|
||||
|
||||
[STEP] 0/4 — Checking the registry: is 0.345.1 already published?
|
||||
[INFO] 0.345.1 is not present in the registry — proceeding.
|
||||
[INFO] Source tree is clean and at the pushed tag v0.345.1 (not origin/main).
|
||||
[STEP] 1/4 — Preparing build workspace...
|
||||
[INFO] Source copied: 1079 Go files
|
||||
[STEP] 2/4 — Syncing app assets...
|
||||
[INFO] Synced 263 assets (52 SVG + 16 PNG logos, 195 screenshots)
|
||||
[STEP] 3/4 — Preparing Go modules...
|
||||
[INFO] Running go mod tidy...
|
||||
[STEP] 4/4 — Building Docker image...
|
||||
[INFO] Building for current platform + pushing...
|
||||
#0 building with "default" instance using docker driver
|
||||
|
||||
#1 [internal] load build definition from Dockerfile
|
||||
#1 transferring dockerfile: 6.94kB done
|
||||
#1 DONE 0.0s
|
||||
|
||||
#2 [internal] load metadata for docker.io/library/golang:1.27.2-trixie@sha256:47667934874913a449b96faa7ef4777fa285d9ec29126ee80ed61c45b7cccf0e
|
||||
#2 ...
|
||||
|
||||
#3 [auth] library/golang:pull token for registry-1.docker.io
|
||||
#3 DONE 0.0s
|
||||
|
||||
#4 [auth] library/debian:pull token for registry-1.docker.io
|
||||
#4 DONE 0.0s
|
||||
|
||||
#5 [internal] load metadata for docker.io/library/debian:13.7-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
|
||||
#5 ...
|
||||
|
||||
#2 [internal] load metadata for docker.io/library/golang:1.27.2-trixie@sha256:47667934874913a449b96faa7ef4777fa285d9ec29126ee80ed61c45b7cccf0e
|
||||
#2 DONE 1.0s
|
||||
|
||||
#5 [internal] load metadata for docker.io/library/debian:13.7-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
|
||||
#5 DONE 1.1s
|
||||
|
||||
#6 [internal] load .dockerignore
|
||||
#6 transferring context: 2B done
|
||||
#6 DONE 0.0s
|
||||
|
||||
#7 [restic 1/3] FROM docker.io/library/debian:13.7-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
|
||||
#7 resolve docker.io/library/debian:13.7-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f 0.0s done
|
||||
#7 DONE 0.0s
|
||||
|
||||
#8 [builder 1/7] FROM docker.io/library/golang:1.27.2-trixie@sha256:47667934874913a449b96faa7ef4777fa285d9ec29126ee80ed61c45b7cccf0e
|
||||
#8 resolve docker.io/library/golang:1.27.2-trixie@sha256:47667934874913a449b96faa7ef4777fa285d9ec29126ee80ed61c45b7cccf0e 0.0s done
|
||||
#8 DONE 0.0s
|
||||
|
||||
#9 [internal] load build context
|
||||
#9 transferring context: 36.99MB 0.4s done
|
||||
#9 DONE 0.4s
|
||||
|
||||
#10 [builder 3/7] COPY go.mod ./
|
||||
#10 CACHED
|
||||
|
||||
#11 [builder 2/7] WORKDIR /build
|
||||
#11 CACHED
|
||||
|
||||
#12 [builder 4/7] RUN go mod download || true
|
||||
#12 CACHED
|
||||
|
||||
#13 [builder 5/7] COPY . .
|
||||
#13 DONE 0.6s
|
||||
|
||||
#14 [builder 6/7] RUN go mod tidy
|
||||
#14 0.532 go: downloading gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405
|
||||
#14 0.619 go: downloading github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e
|
||||
#14 0.619 go: downloading modernc.org/fileutil v1.3.40
|
||||
#14 0.698 go: downloading golang.org/x/term v0.47.0
|
||||
#14 1.291 go: downloading modernc.org/goabi0 v0.2.0
|
||||
#14 1.291 go: downloading modernc.org/ccgo/v4 v4.30.1
|
||||
#14 1.291 go: downloading modernc.org/cc/v4 v4.27.1
|
||||
#14 1.291 go: downloading golang.org/x/tools v0.38.0
|
||||
#14 1.422 go: downloading modernc.org/opt v0.1.4
|
||||
#14 1.422 go: downloading modernc.org/token v1.1.0
|
||||
#14 1.422 go: downloading modernc.org/sortutil v1.2.1
|
||||
#14 1.422 go: downloading modernc.org/strutil v1.2.1
|
||||
#14 1.598 go: downloading modernc.org/gc/v2 v2.6.5
|
||||
#14 1.598 go: downloading golang.org/x/mod v0.29.0
|
||||
#14 1.598 go: downloading modernc.org/gc/v3 v3.1.1
|
||||
#14 1.820 go: downloading github.com/hashicorp/golang-lru/v2 v2.0.7
|
||||
#14 2.038 go: downloading golang.org/x/sync v0.17.0
|
||||
#14 DONE 2.4s
|
||||
|
||||
#15 [builder 7/7] RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X main.Version=0.345.1 -X main.BuildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ) -X main.GitCommit=f3204024" -o /build/felhom-controller ./cmd/controller/
|
||||
#15 DONE 22.3s
|
||||
|
||||
#16 [stage-2 3/7] COPY --from=restic /usr/local/bin/restic /usr/local/bin/restic
|
||||
#16 CACHED
|
||||
|
||||
#17 [stage-2 4/7] RUN curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker.gpg && . /etc/os-release && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.gpg] https://download.docker.com/linux/debian ${VERSION_CODENAME} stable" > /etc/apt/sources.list.d/docker.list && apt-get update && apt-get install -y --no-install-recommends docker-ce-cli docker-compose-plugin && rm -rf /var/lib/apt/lists/*
|
||||
#17 CACHED
|
||||
|
||||
#18 [stage-2 2/7] RUN apt-get update && apt-get upgrade -y --no-install-recommends && apt-get install -y --no-install-recommends ca-certificates curl gnupg git util-linux rsync openssh-client && rm -rf /var/lib/apt/lists/*
|
||||
#18 CACHED
|
||||
|
||||
#19 [restic 2/3] COPY third_party/restic/restic-release-key.asc /tmp/restic-release-key.asc
|
||||
#19 CACHED
|
||||
|
||||
#20 [restic 3/3] RUN set -eu; apt-get update && apt-get install -y --no-install-recommends ca-certificates curl gnupg gpgv bzip2; case "amd64" in amd64) want="f415415624dcc452f2a02b8c33641791a8c6d6d3b65bbb3543fcf9a25151585c" ;; arm64) want="a5f64aaab53d51e311fa3829124c5b703f2d14cf187d8640b6be3b2b49376465" ;; *) echo "no pinned restic checksum for architecture 'amd64'" >&2; exit 1 ;; esac; f="restic_0.19.1_linux_amd64.bz2"; url="https://github.com/restic/restic/releases/download/v0.19.1"; cd /tmp; curl -fsSL -o "$f" "$url/$f"; curl -fsSL -o SHA256SUMS "$url/SHA256SUMS"; curl -fsSL -o SHA256SUMS.asc "$url/SHA256SUMS.asc"; gpg --dearmor < /tmp/restic-release-key.asc > /tmp/restic-release-key.gpg; gpgv --keyring /tmp/restic-release-key.gpg SHA256SUMS.asc SHA256SUMS; grep " ${f}\$" SHA256SUMS | sha256sum -c -; echo "${want} ${f}" | sha256sum -c -; bunzip2 -c "$f" > /usr/local/bin/restic; chmod 0755 /usr/local/bin/restic; /usr/local/bin/restic version | grep -q "^restic 0.19.1 "
|
||||
#20 CACHED
|
||||
|
||||
#21 [stage-2 5/7] RUN mkdir -p /opt/docker/felhom-controller/data
|
||||
#21 CACHED
|
||||
|
||||
#22 [stage-2 6/7] COPY --from=builder /build/felhom-controller /usr/local/bin/felhom-controller
|
||||
#22 DONE 0.1s
|
||||
|
||||
#23 [stage-2 7/7] COPY assets/ /usr/share/felhom/assets/
|
||||
#23 DONE 0.1s
|
||||
|
||||
#24 exporting to image
|
||||
#24 exporting layers
|
||||
#24 exporting layers 2.6s done
|
||||
#24 exporting manifest sha256:c64bc088431b2398ec209fe5b2971bfd33ead8bb1ba219dedf601f6b556ebb63
|
||||
#24 exporting manifest sha256:c64bc088431b2398ec209fe5b2971bfd33ead8bb1ba219dedf601f6b556ebb63 0.3s done
|
||||
#24 exporting config sha256:94b98adfce1d5f7610e683f3f8a6855a7fb2a4bd5c668d19cf1415d6ba0327fa
|
||||
#24 exporting config sha256:94b98adfce1d5f7610e683f3f8a6855a7fb2a4bd5c668d19cf1415d6ba0327fa 0.2s done
|
||||
#24 exporting attestation manifest sha256:7368ba4d08db112ea8eb69a8e35f247298306710e6f9220005ce3220638bb891
|
||||
#24 exporting attestation manifest sha256:7368ba4d08db112ea8eb69a8e35f247298306710e6f9220005ce3220638bb891 0.3s done
|
||||
#24 exporting manifest list sha256:7cfdf7e1f835628de9c7d536e0a60c06bad5bbe19e8133765cc0a6bb732dbff6
|
||||
#24 exporting manifest list sha256:7cfdf7e1f835628de9c7d536e0a60c06bad5bbe19e8133765cc0a6bb732dbff6 0.2s done
|
||||
#24 naming to gitea.dooplex.hu/admin/felhom-controller:0.345.1
|
||||
#24 naming to gitea.dooplex.hu/admin/felhom-controller:0.345.1 0.0s done
|
||||
#24 unpacking to gitea.dooplex.hu/admin/felhom-controller:0.345.1
|
||||
#24 unpacking to gitea.dooplex.hu/admin/felhom-controller:0.345.1 0.6s done
|
||||
#24 naming to gitea.dooplex.hu/admin/felhom-controller:latest 0.0s done
|
||||
#24 unpacking to gitea.dooplex.hu/admin/felhom-controller:latest 0.1s done
|
||||
#24 DONE 4.5s
|
||||
[INFO] Pushing...
|
||||
The push refers to repository [gitea.dooplex.hu/admin/felhom-controller]
|
||||
c3f83389ce1b: Waiting
|
||||
44136fa355b3: Waiting
|
||||
b2b4e3e31fd1: Waiting
|
||||
ecc510c1e359: Waiting
|
||||
c3f83389ce1b: Layer already exists
|
||||
44136fa355b3: Already exists
|
||||
b2b4e3e31fd1: Waiting
|
||||
ecc510c1e359: Layer already exists
|
||||
e81c1fce9826: Layer already exists
|
||||
63a1406b1961: Waiting
|
||||
d747c9b6922d: Waiting
|
||||
8c5bc1ea4981: Waiting
|
||||
63a1406b1961: Layer already exists
|
||||
d747c9b6922d: Layer already exists
|
||||
b2b4e3e31fd1: Pushed
|
||||
8c5bc1ea4981: Pushed
|
||||
bd4abb283803: Pushed
|
||||
0.345.1: digest: sha256:7cfdf7e1f835628de9c7d536e0a60c06bad5bbe19e8133765cc0a6bb732dbff6 size: 856
|
||||
The push refers to repository [gitea.dooplex.hu/admin/felhom-controller]
|
||||
b2b4e3e31fd1: Waiting
|
||||
44136fa355b3: Waiting
|
||||
c3f83389ce1b: Waiting
|
||||
ecc510c1e359: Waiting
|
||||
bd4abb283803: Layer already exists
|
||||
44136fa355b3: Already exists
|
||||
ecc510c1e359: Layer already exists
|
||||
b2b4e3e31fd1: Already exists
|
||||
d747c9b6922d: Layer already exists
|
||||
c3f83389ce1b: Layer already exists
|
||||
e81c1fce9826: Layer already exists
|
||||
63a1406b1961: Layer already exists
|
||||
8c5bc1ea4981: Layer already exists
|
||||
latest: digest: sha256:7cfdf7e1f835628de9c7d536e0a60c06bad5bbe19e8133765cc0a6bb732dbff6 size: 856
|
||||
|
||||
[INFO] ╔══════════════════════════════════════╗
|
||||
[INFO] ║ Build complete ✓ ║
|
||||
[INFO] ╚══════════════════════════════════════╝
|
||||
[INFO] Image: gitea.dooplex.hu/admin/felhom-controller:0.345.1
|
||||
[INFO] Size: 486M
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
== demo-hp
|
||||
cloudflared cloudflare/cloudflared:2026.10.3 Up 11 seconds (healthy)
|
||||
felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.345.1 Up 27 seconds (healthy)
|
||||
started=2026-10-26T20:06:31.171324386Z
|
||||
2026-10-26T20:06:31Z INF Version 2026.10.3 (Checksum 919cd4640a5984b57ed420f1dd61e4155ee60abb52ac5fe2adb5f8dc71d0c2e5)
|
||||
2026-10-26T20:06:31Z INF GOOS: linux, GOVersion: go1.27.3, GoArch: amd64
|
||||
2026-10-26T20:06:31Z INF Registered tunnel connection connIndex=0 connection=843ee444-05e8-4aec-9b3e-339cd75a0243 event=0 ip=198.41.200.113 location=vie06 protocol=quic
|
||||
2026-10-26T20:06:31Z INF Updated to new configuration config="{\"ingress\":[{\"hostname\":\"*.enkisfelhom.hu\", \"originRequest\":{\"noTLSVerify\":true}, \"service\":\"https://traefik\"}, {\"service\":\"http_status:404\"}], \"warp-routing\":{\"enabled\":false}}" version=1
|
||||
2026-10-26T20:06:32Z INF Registered tunnel connection connIndex=1 connection=f4340b8a-6bb4-47b2-a781-d649bf2f8f58 event=0 ip=198.41.192.47 location=bud01 protocol=quic
|
||||
2026-10-26T20:06:33Z INF Registered tunnel connection connIndex=2 connection=fc7d8940-2277-4687-8942-c9a84142d9c9 event=0 ip=198.41.192.77 location=bud01 protocol=quic
|
||||
cloudflared version 2026.10.3 (built 2026-10-21-13:24 UTC)
|
||||
2026/10/26 20:06:16 updater.go:855: [INFO] [selfupdate] Post-update startup: update successful (0.345.0 → 0.345.1)
|
||||
2026/10/26 20:06:17 infra.go:188: [INFO] [infra] cloudflared compose changed (tunnel network true) — recreating cloudflared (the tunnel reconnects in seconds)
|
||||
== felhom-pve
|
||||
cloudflared cloudflare/cloudflared:2026.10.3 Up 25 seconds (healthy)
|
||||
felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.345.1 Up 30 seconds (healthy)
|
||||
started=2026-10-26T20:06:04.399090267Z
|
||||
2026-10-26T20:06:04Z INF Version 2026.10.3 (Checksum 919cd4640a5984b57ed420f1dd61e4155ee60abb52ac5fe2adb5f8dc71d0c2e5)
|
||||
2026-10-26T20:06:04Z INF GOOS: linux, GOVersion: go1.27.3, GoArch: amd64
|
||||
2026-10-26T20:06:05Z INF Registered tunnel connection connIndex=0 connection=592e0ea3-9acc-4ed6-a5e6-cb68d2855353 event=0 ip=198.41.192.167 location=bud01 protocol=quic
|
||||
2026-10-26T20:06:05Z INF Updated to new configuration config="{\"ingress\":[{\"hostname\":\"*.demo-felhom.eu\", \"originRequest\":{\"noTLSVerify\":true}, \"service\":\"https://traefik\"}, {\"service\":\"http_status:404\"}], \"warp-routing\":{\"enabled\":false}}" version=1
|
||||
2026-10-26T20:06:05Z INF Registered tunnel connection connIndex=1 connection=da046196-a6fa-492c-8f47-65e607f005f8 event=0 ip=198.41.200.73 location=vie06 protocol=quic
|
||||
2026-10-26T20:06:06Z INF Registered tunnel connection connIndex=2 connection=d183c0b2-19c3-4bd4-8779-e769170cf504 event=0 ip=198.41.200.23 location=vie05 protocol=quic
|
||||
cloudflared version 2026.10.3 (built 2026-10-21-13:24 UTC)
|
||||
2026/10/26 20:06:00 [INFO] [selfupdate] Post-update startup: update successful (0.345.0 → 0.345.1)
|
||||
2026/10/26 20:06:00 [INFO] [infra] cloudflared compose changed (tunnel network true) — recreating cloudflared (the tunnel reconnects in seconds)
|
||||
@@ -0,0 +1,8 @@
|
||||
2026-10-26T20:06:04Z
|
||||
customer demo-hp
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /customers/demo-hp?flash=floor_set
|
||||
2026-10-26T20:06:04Z
|
||||
customer demo-felhom
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /customers/demo-felhom?flash=floor_set
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,34 @@
|
||||
control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -)
|
||||
== tester-1 (enkicsifelhom.hu): 6 public name(s)
|
||||
OK control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1
|
||||
== demo-hp (enkisfelhom.hu): 15 public name(s)
|
||||
OK http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://time.enkisfelhom.hu/r1033-check?q=1 -> 301 https://time.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1
|
||||
== demo-felhom (demo-felhom.eu): 8 public name(s)
|
||||
OK http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1
|
||||
== every public name redirects http -> https
|
||||
@@ -0,0 +1,5 @@
|
||||
Host | Status | Cloudflared
|
||||
Tester4-b5dbbd | ONLINE | unknown (no running customer guest)
|
||||
demo-felhom-8363b5 | ONLINE | running (connected)
|
||||
demo-hp-bb76ea | ONLINE | running (connected)
|
||||
tester-1-d70be4 | ONLINE | running (connected)
|
||||
@@ -0,0 +1,14 @@
|
||||
2026-10-26T20:05:25Z INF Version 2026.10.3 (Checksum 919cd4640a5984b57ed420f1dd61e4155ee60abb52ac5fe2adb5f8dc71d0c2e5)
|
||||
2026-10-26T20:05:25Z INF GOOS: linux, GOVersion: go1.27.3, GoArch: amd64
|
||||
2026-10-26T20:05:25Z INF Registered tunnel connection connIndex=0 connection=3cc5adb1-aea4-4d4f-8f8e-d63fefd414b2 event=0 ip=198.41.192.37 location=bud01 protocol=quic
|
||||
2026-10-26T20:05:25Z INF Updated to new configuration config="{\"ingress\":[{\"hostname\":\"*.enkicsifelhom.hu\", \"originRequest\":{\"noTLSVerify\":true}, \"service\":\"https://traefik\"}, {\"service\":\"http_status:404\"}], \"warp-routing\":{\"enabled\":false}}" version=2
|
||||
2026-10-26T20:05:25Z INF Registered tunnel connection connIndex=1 connection=27f1251e-375d-4774-a0b9-54d8bfd1641a event=0 ip=198.41.200.33 location=vie05 protocol=quic
|
||||
2026-10-26T20:05:27Z INF Registered tunnel connection connIndex=2 connection=be88ef22-3c33-4da0-ab61-cb14ec33e5ef event=0 ip=198.41.192.227 location=bud01 protocol=quic
|
||||
2026-10-26T20:05:28Z INF Registered tunnel connection connIndex=3 connection=4e5fa7a2-4c94-4c0e-93d0-395fb2b0957d event=0 ip=198.41.200.63 location=vie06 protocol=quic
|
||||
cloudflared version 2026.10.3 (built 2026-10-21-13:24 UTC)
|
||||
2026/10/26 20:05:19 [INFO] [selfupdate] Post-update startup: update successful (0.345.0 → 0.345.1)
|
||||
2026/10/26 20:05:19 [INFO] Self-update enabled (check every 6h, auto-update: false, auto-update time: 04:30)
|
||||
2026/10/26 20:05:19 [INFO] [scheduler] Registered periodic job: selfupdate-check (every 6h0m0s)
|
||||
2026/10/26 20:05:19 [INFO] [offsite-apply] settle-gate: awaiting floor knowledge (first report ACK) before offsite apply
|
||||
2026/10/26 20:05:20 [INFO] [infra] cloudflared compose changed (tunnel network true) — recreating cloudflared (the tunnel reconnects in seconds)
|
||||
2026/10/26 20:05:29 [INFO] [offsite-apply] settle-gate: GO — at/above floor 0.345.1 (we are 0.345.1), no managed update running
|
||||
@@ -0,0 +1,3 @@
|
||||
2026-10-26T20:05:08Z
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /customers/tester-1?flash=floor_set
|
||||
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,6 @@
|
||||
20:39:54 clear tester-1
|
||||
Location: /customers/tester-1?flash=floor_set
|
||||
20:39:54 clear demo-hp
|
||||
Location: /customers/demo-hp?flash=floor_set
|
||||
20:39:54 clear demo-felhom
|
||||
Location: /customers/demo-felhom?flash=floor_set
|
||||
@@ -0,0 +1,7 @@
|
||||
er action. Blank = no global floor. This setting is independent of the Day-0 artifact manifest below. Effective floor: v0.345.1 — source: DB (hub_settings) ; env fallback would be v0.120.0 Save global floor… DB override: v0.345.1 … Type the versio
|
||||
(no manual copy). Choose — none — to clear an artifact. Agent — none — 0.166.0 0.165.0 0.164.0 0.163.0 0.162.0 0.161.0 0.158.1 Golden — none — 0.344.0 0.331.0 0.329.0 0.318.0 0.313.0 0.312.0 0.311.0 Min agent The golden's controller CHANGELOG Min
|
||||
2026/10/26 21:05:08 [INFO] Customer tester-1 controller-version floor override set to "0.345.1" (declared MinAgent "0.158.1")
|
||||
2026/10/26 21:05:08 [INFO] access token "cc-releases-2": POST /customers/tester-1/floor → 303
|
||||
2026/10/26 21:05:11 [INFO] managed floor SERVED for tester-1: floor 0.345.1, agent requirement "0.158.1" from declared (golden 0.344.0)
|
||||
2026/10/26 21:06:04 [INFO] Customer demo-hp controller-version floor override set to "0.345.1" (declared MinAgent "0.158.1")
|
||||
2026/10/26 21:06:04 [INFO] access token "cc-releases-2": POST /customers/demo-hp/floor → 303
|
||||
@@ -0,0 +1,3 @@
|
||||
2026-10-26T20:08:39Z
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /configuration?flash=floor_set
|
||||
@@ -0,0 +1,11 @@
|
||||
Customer ID | Name | Domain | Status | Version | Floor | Config
|
||||
Tester-2 | Tester 2 | sajatfelhom.hu | DOWN | 0.292.0 | v0.345.1 ● | MANAGED
|
||||
Tester4 | Tester4 | tester4.test | OK | 0.345.1 | v0.345.1 | MANAGED
|
||||
demo-felhom | Demo Ügyfél | demo-felhom.eu | OK | 0.345.1 | v0.345.1 | MANAGED
|
||||
demo-hp | Demo HP | enkisfelhom.hu | OK | 0.345.1 | v0.345.1 | MANAGED
|
||||
tester-1 | Tester 1 | enkicsifelhom.hu | OK | 0.345.1 | v0.345.1 | MANAGED
|
||||
Host | Customer | Agent | Proxmox / kernel | Status | Guests | CPU | Mem | Disk | Cloudflared | Worst Storage
|
||||
Tester4-b5dbbd | Tester4 | 0.167.0-night1 floor held | 9.2.2 7.0.2-6-pve | ONLINE | 1/1 | 8% | 27% | 18% | absent (no cloudflared container in the guest (no tunnel set up on this box)) | 18% local
|
||||
demo-felhom-8363b5 | Demo Ügyfél | 0.166.0 floor: declared MinAgent | 9.2.21 7.0.14-25-pve | ONLINE | 1/2 | 5% | 20% | 35% | running (connected) | 35% local
|
||||
demo-hp-bb76ea | Demo HP | 0.166.0 floor: declared MinAgent | 9.2.21 7.0.14-25-pve | ONLINE | 1/2 | 19% | 66% | 65% | running (connected) | 65% local
|
||||
tester-1-d70be4 | Tester 1 | 0.166.0 floor: declared MinAgent | 9.2.2 7.0.14-22-pve | ONLINE | 1/2 | 0% | 34% | 27% | running (connected) | 27% local
|
||||
@@ -0,0 +1,28 @@
|
||||
== 20:09:04
|
||||
felhom-pve: cloudflared=cloudflare/cloudflared:2026.10.3(Up 2 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 2 minutes (healthy))
|
||||
demo-hp: cloudflared=cloudflare/cloudflared:2026.10.3(Up 2 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 2 minutes (healthy))
|
||||
root@192.168.0.154: cloudflared=cloudflare/cloudflared:2026.10.3(Up 3 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 3 minutes (healthy))
|
||||
== 20:14:08
|
||||
felhom-pve: cloudflared=cloudflare/cloudflared:2026.10.3(Up 7 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 7 minutes (healthy))
|
||||
demo-hp: cloudflared=cloudflare/cloudflared:2026.10.3(Up 7 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 7 minutes (healthy))
|
||||
root@192.168.0.154: cloudflared=cloudflare/cloudflared:2026.10.3(Up 8 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 8 minutes (healthy))
|
||||
== 20:19:14
|
||||
felhom-pve: cloudflared=cloudflare/cloudflared:2026.10.3(Up 12 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 13 minutes (healthy))
|
||||
demo-hp: cloudflared=cloudflare/cloudflared:2026.10.3(Up 12 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 13 minutes (healthy))
|
||||
root@192.168.0.154: cloudflared=cloudflare/cloudflared:2026.10.3(Up 13 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 14 minutes (healthy))
|
||||
== 20:24:19
|
||||
felhom-pve: cloudflared=cloudflare/cloudflared:2026.10.3(Up 18 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 18 minutes (healthy))
|
||||
demo-hp: cloudflared=cloudflare/cloudflared:2026.10.3(Up 17 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 18 minutes (healthy))
|
||||
root@192.168.0.154: cloudflared=cloudflare/cloudflared:2026.10.3(Up 18 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 19 minutes (healthy))
|
||||
== 20:29:23
|
||||
felhom-pve: cloudflared=cloudflare/cloudflared:2026.10.3(Up 23 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 23 minutes (healthy))
|
||||
demo-hp: cloudflared=cloudflare/cloudflared:2026.10.3(Up 22 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 23 minutes (healthy))
|
||||
root@192.168.0.154: cloudflared=cloudflare/cloudflared:2026.10.3(Up 24 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 24 minutes (healthy))
|
||||
== 20:34:27
|
||||
felhom-pve: cloudflared=cloudflare/cloudflared:2026.10.3(Up 28 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 28 minutes (healthy))
|
||||
demo-hp: cloudflared=cloudflare/cloudflared:2026.10.3(Up 27 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 28 minutes (healthy))
|
||||
root@192.168.0.154: cloudflared=cloudflare/cloudflared:2026.10.3(Up 29 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 29 minutes (healthy))
|
||||
== 20:39:31
|
||||
felhom-pve: cloudflared=cloudflare/cloudflared:2026.10.3(Up 33 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 33 minutes (healthy))
|
||||
demo-hp: cloudflared=cloudflare/cloudflared:2026.10.3(Up 33 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 33 minutes (healthy))
|
||||
root@192.168.0.154: cloudflared=cloudflare/cloudflared:2026.10.3(Up 34 minutes (healthy)) felhom-controller=gitea.dooplex.hu/admin/felhom-controller:0.345.1(Up 34 minutes (healthy))
|
||||
@@ -26,6 +26,12 @@
|
||||
|
||||
---
|
||||
|
||||
## 2026-10-26 (evening, attended) — R-1300 released: controller 0.345.1, cloudflared 2026.10.3 (full text of the row: `git show ffb91d89:documentation/backlog/OPEN-ITEMS.md`)
|
||||
|
||||
| Row | What | Closed | Evidence |
|
||||
|---|---|---|---|
|
||||
| **R-1300** | **cloudflared on every box trusted eight eMudhra (emSign) intermediates with weak keys (Cloudflare's notice 2026-10-20; fixed in 2026.10.2).** (P1) | CLOSED 2026-10-26 evening — controller v0.345.1 (tag `f3204024` = v0.345.0 `6bfb784` + one commit; image `sha256:7cfdf7e1…`; CI job 2393 green; `main` `a1c65b3d`, job 2392 green) pins `cloudflare/cloudflared:2026.10.3` (index `sha256:faa8e0a1…`). Per-box floor on Tester 1, then demo-hp and demo-felhom; global floor 0.345.1 (MinAgent 0.158.1 declared) at 20:08:39Z on the operator's yes; per-box floors cleared 20:39:54Z. Every box with a tunnel (Tester 1, demo-hp, demo-felhom) reports controller 0.345.1 and runs cloudflared 2026.10.3, healthy, through a 30-minute watch (21 of 21 samples); the hub: „running (connected)" on all three; 29 of 29 public names redirect http→https. Tester4 moved to 0.345.1 (no tunnel: „absent"); Tester 2 has no box. Tunnel gaps 2 s / 4 s / 11 s. Origin trap NOT-A-FINDING (route `https://traefik` with `noTLSVerify`, traefik's self-signed default certificate). **Rule (01 „Tunnel placement"): cloudflared follows Cloudflare's security notices; never turn off a certificate check to make an update work.** | `audits/cloudflared-2026.10.3-2026-10-26/` |
|
||||
|
||||
## 2026-10-26 (evening) — R-435 read and closed (full text of the row: `git show 49557444:documentation/backlog/OPEN-ITEMS.md`)
|
||||
|
||||
| Row | What | Closed | Evidence |
|
||||
|
||||
@@ -231,11 +231,10 @@ stopping line that lies.
|
||||
| **R-1275** | Storage & devices | P4 | **An English household sees the drive names in Hungarian** on the install page (and wherever a storage label shows): „Belső tárhely — 52.0 GB free (default)”, „Külső tárhely (hdd_1)” (catalog sweep 2026-10-24, `audits/catalog-sweep-2026-10-24/navidrome/page-install-en.txt`). The label is stored once, in Hungarian, when the drive is found (`felhom-controller/controller/internal/settings/settings.go` `InferStorageLabel`); a household may rename it. | OPEN | — | Render a label that still equals the inferred default in the reader's language; a test per language | CC |
|
||||
| **R-1276** | Storage & devices | P4 | **„Remove with data” leaves the app's empty parent folder** (`<drive>/appdata/<app>`) when the template binds a subfolder: Grimmory, RomM, Paperless-ngx (catalog sweep 2026-10-24; 4 KB each; the bound folders were removed). Harmless (empty, not counted as old data), untidy for a household that browses the drive. | OPEN | — | Remove the parent when it is empty after the bound folders go; a test | CC |
|
||||
|
||||
## Security & access — 25 rows (P1 3, P2 3, P3 13, P4 6)
|
||||
## Security & access — 24 rows (P1 2, P2 3, P3 13, P4 6)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| **R-1300** | Security & access | P1 | **cloudflared on every box trusts eight eMudhra (emSign) intermediates with weak keys** (Cloudflare's notice 2026-10-20; fixed in 2026.10.2): someone with those keys could pose as any website to the tunnel. List 2026-10-26: three boxes report (demo-felhom, demo-hp, Tester 1), each guest 9201 on `cloudflare/cloudflared:2026.9.3`; none on DooPlex; Tester 2 has no box. Origin trap NOT-A-FINDING: every route is `https://traefik` with `noTLSVerify` (R-510) and traefik shows its self-signed default certificate. Fix: controller **v0.345.1** = v0.345.0 + `CloudflaredImage` `2026.10.3` (index `sha256:faa8e0a1…`); `main` carries it too. `audits/cloudflared-2026.10.3-2026-10-26/` | OPEN — filed 2026-10-26 (attended); closes when every box reports cloudflared 2026.10.3 | the global floor (operator yes) | build + per-box floor on the test boxes, then ask for the global floor | CC |
|
||||
| **R-1241** | Security & access | P1 | **2026-10-24: the Felhom half is DONE** — hub 0.168.0 deployed (the tokens sealed; every copy leaving the volume is clean, the live file's old bytes accepted by the operator, R-975 closed), the hub volume out of the Longhorn backup (D40, R-1243 VERIFY), the two old plain copies deleted by the operator. **What stays here is the homelab half:** the open NFS export and Longhorn's login (the homelab session). **A hacked app pod on DooPlex can read the hub's nightly database copies — with every customer's unsealed Cloudflare, tunnel and git token (R-975) — through the Longhorn NFS export, and by a published file-handle escape the operator signing keys on the same disk: whoever breaks one homelab app can take over the boxes' tunnels and sign agent updates.** MEASURED 2026-10-23 (Plex2Shell impact audit, `audits/plex2shell-felhom-impact-2026-10-23/`): export `/mnt/5_hdd/backup/longhorn-pvc` rw, `no_root_squash`, `no_subtree_check`, a sub-directory of sda1, which also holds `/mnt/5_hdd/felhom.eu/felhom-op-*` (no passphrase, R-924); `secure` is void in pods (containerd sets `ip_unprivileged_port_start=0`; a uid-1000 probe with no capabilities bound port 700); the four `felhom-system` volumes have `encrypted=false`; Longhorn's API on :9500 answers any pod with no login (backups, targets, volumes). In the Plex2Shell window neither door was used — verdict NOT REACHED (nfsd accepted 0 new connections 10-10 → 10-23, positive control; no off-schedule Longhorn backup or volume). 2026-10-23 ~15:18Z, operator yes: the export was narrowed from `*` to `10.42.0.0/16` — the home network and the tailnet are closed, pods are not (Longhorn connects from its pod address). Not exercised: the escape itself (Tier-2 machine). | OPEN | the homelab session (DooPlex host + cluster); the operator (R-924) | Homelab: a NetworkPolicy so only `longhorn-system` reaches :2049/:111 and :9500, or the backup store on its own filesystem. Felhom: R-975 sealed in hub 0.168.0 (deploy pending); the hub's plain Longhorn copies → R-1243; a passphrase on the signing keys (R-924) | operator |
|
||||
| **R-1139** | Security & access | P2 | **Tester 2's break-glass root password was not rotated with the others (R-954, operator decision D1 = A, 2026-10-17): the box has been offline since 2026-10-04.** demo-hp, Tester 1 and demo-felhom were rotated and proven on 2026-10-17 (`audits/agent-allowlist-rotation-2026-10-17/P3/`). | OPEN — filed 2026-10-17 **2026-10-22: closes when Tester 2 is reinstalled (operator ruling 2026-10-22 14:11 — a fresh install sets and vaults a new console password).** | Tester 2 reporting again | When it reports: the installer's step 4b alone (`P3/rotate-step4b.sh` shape), then the vaulted value logs in (PVE API 200) and the old one is refused | CC |
|
||||
| **R-1042** | Security & access | P3 | **The boxes' Cloudflare keys cannot change zone settings, so Cloudflare's own „Always Use HTTPS” cannot be switched on.** Measured 2026-10-14 on all three zones (`audits/https-only-2026-10-14/``1A-1-zones-and-keys.txt`): each `cf_api_token` is valid and sees only its own zone, but GET/PATCH `settings/always_use_https`, `ssl`, `security_header` answer 403; the redirect and transform rule phases too. The https-only fix therefore lives on the box (decision 246). A second layer at Cloudflare needs „Zone Settings: Edit” (and, for headers, „Transform Rules”) added to each customer's key — the hub's zone-reach check stays. | **WAITING-ON-OPERATOR** — filed 2026-10-14 | a key permission only the operator can grant | Optional: widen each customer key, then switch „Always Use HTTPS” on per zone | operator |
|
||||
@@ -261,10 +260,11 @@ stopping line that lies.
|
||||
| **R-1237** | Security & access | P3 | **The nightly CC-secrets sweep found stored one-time codes in a session record dated 2026-10-23: 14 names in one file (bind tokens and setup codes of test boxes — NIGHT_2026_10_23_*, FIXES_2026_10_21_*, NIGHT_2026_10_21_*, REHEARSAL_2026_10_20_* — and R_DEMO_FELHOM in a file of 2026-10-20).** Mail „[DooPlex CC secrets] 2 secret name(s) found in old session records", 2026-10-23 01:57 UTC, read in the day session (names only). One file holding all of them suggests one command printed many stored values at once (a listing or a dump) in the night session. All but R_DEMO_FELHOM are one-time install codes of test boxes; NIGHT_2026_10_23_* die when Tester4-16fdef is deleted (the operator's do list). | OPEN | — | CC: find the file and the command by the sweep's own report (names only), add a hook shape for that command if it is not one; R_DEMO_FELHOM (demo-felhom's recovery code) — the operator decides whether to rotate it | CC |
|
||||
| **R-1248** | Security & access | P3 | **An app's own numbers can lie: an attacker with code inside an app's container can answer the app's API with whatever matches its flood, and the upload watch (R-1244) would then call it explained.** Measured remedy, not built: a per-container upload ceiling with `tc` from a helper container in the app's network namespace — on scratch 9202 (unprivileged) a flood was held at 19.9–20.1 Mbit/s and the app kept answering (`audits/SPIKE-upload-watch-2026-10-23.md` §5). Costs: a helper image with `tc` (a new external image, or `tc` in the controller image), `NET_ADMIN` for that helper, re-applied after each app restart. | OPEN | an operator decision (the new image / capability) | Decide; if yes, CC builds the ceiling for the download and media apps first | operator |
|
||||
|
||||
## Box system & updates — 13 rows (P2 1, P3 7, P4 5)
|
||||
## Box system & updates — 14 rows (P2 1, P3 8, P4 5)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| **R-1301** | Box system & updates | P3 | **The N100's Proxmox host keeps no time: `chrony` fails at every boot** („Fatal error : Could not send notification to $NOTIFY_SOCKET", seen 2026-10-16 and 2026-10-21 boots); measured 2026-10-26 20:06 UTC: the host clock 14 s behind DooPlex and demo-hp, `System clock synchronized: no`. demo-hp has the same package (4.8-4~bpo13+2) and `DAEMON_OPTS="-F 1"` and runs it. A drifting host clock feeds backup times (R-1206's class) and TLS. Found while timing the cloudflared update (R-1300). `audits/cloudflared-2026.10.3-2026-10-26/obs-n100-clock.txt` | OPEN — filed 2026-10-26 | — | find why the notify socket fails on this host only (compare the unit and `systemd-analyze` with demo-hp), fix it, and check whether a fresh install could hit it too | CC |
|
||||
| **R-1260** | Box system & updates | P3 | **Spring 2027 (2027-03-28): two clock-change effects in the controller's night (review round 2, HUNT-4 H2/H3).** The update leg's deadline is W + 5 h of REAL time while the full-system backup's gate counts wall-clock minutes, so a step can start after the gate stopped waiting (`felhom-controller/controller/internal/stacks/unattended.go:225`; `internal/quiesce/quiesce.go:922-933`); with W in 02:00–02:59 the DB dump and the second-drive copy start at the same instant (`internal/scheduler/scheduler.go:509`; VERIFIED: Go maps 2027-03-28 02:30 Europe/Budapest to 03:30 CEST). | OPEN | — | before 2027-03-28: one wall-clock basis for both, and a test at the spring date | CC |
|
||||
| **R-984** | Box system & updates | P4 | **Host and agent hardening, low risk each: the backup-target route has no role check; the unsigned guest spec has no size bounds; signed ops have no maximum validity; the guarded mkfs does not refuse LVs, zvols or RAID devices; the local API is reachable from the LAN by a static route; a sudoers inspect pattern is wider than needed; install passes secrets on the command line; guest settings files are world-readable; the host offers rpcbind and DNS on the LAN.** Fix each in its own small change. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN | — | Batch into hardening work | CC |
|
||||
| **R-979** | Box system & updates | P3 | **Controller updates are trusted by registry tag alone (no digest, no signature), and the Update button offers any newer tag, even an unvouched one; the built-in traefik, cloudflared and FileBrowser images are also pinned by tag only.** Whoever can push to the registry decides what runs. Fix: pin by digest from the hub's vouched list; offer only vouched versions. Security review 2026-10-12 (`audits/security-review-2026-10-12/`); detail held off-git for the operator (`/mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/`). | OPEN — design-proposal | — | Design note, then build | CC |
|
||||
|
||||
@@ -46,3 +46,9 @@ what happened, who noticed, and the register row it became. Prose here is not a
|
||||
route by name) reached the N100 by the normal update path at 12:04:45; `files.demo-felhom.eu` 200, the default login
|
||||
refused (401). No data touched. Register: fixed within the release, recorded in R-1126's close. Evidence:
|
||||
`audits/filebrowser-memory-ci-2026-10-17/release/box-walk.txt`. (CC)
|
||||
- **2026-10-26 — cloudflared 2026.10.3 (Cloudflare's eMudhra notice), and the host clock found 14 s slow.** Controller
|
||||
0.345.1 arrived by the normal update path (per-box floor 20:06:04 UTC); the controller recreated cloudflared on
|
||||
2026.10.3 by itself, the tunnel was down for about 4 s (a no-app name answered 530, then 404 again). While measuring
|
||||
the gap the Proxmox host's clock read 14 s behind DooPlex and demo-hp: `chrony` has failed at every boot since at least
|
||||
2026-10-16 („Could not send notification to $NOTIFY_SOCKET"); demo-hp, same package and options, runs it. Register:
|
||||
R-1300 (the release), R-1301 (the clock). Evidence: `audits/cloudflared-2026.10.3-2026-10-26/` (`obs-n100-clock.txt`). (CC)
|
||||
Reference in new issue
Block a user