hub 0.166.0 source: the clock-ahead tunnel alarm wg_tunnel_stale/ok (R-1204, operator-only, edge-triggered); D21 + D4 proof evidence

2026-10-22 17:02:37 +02:00
parent 0639cf0772
commit e267c5e2cd
12 changed files with 279 additions and 1 deletions
@@ -0,0 +1,15 @@
+db-dumps/:
+total 52464
+drwxr-xr-x 2 root root     4096 Oct 22 00:30 .
+drwxr-xr-x 5 root root     4096 Oct 22 10:32 ..
+-rw-r--r-- 1 root root 53711763 Oct 22 00:30 immich-postgres.sql
+
+volume-dumps/:
+total 1080892
+drwxr-xr-x 2 root root      4096 Oct 22 00:30 .
+drwxr-xr-x 5 root root      4096 Oct 22 10:32 ..
+-rw-r--r-- 1 root root 823764480 Oct 22 00:30 immich_immich_ml_cache.tar
+-rw-r--r-- 1 root root 283049472 Oct 22 00:30 immich_immich_postgres_data.tar
+1160553832	.
+204665903	/mnt/sizing-bench/appdata/immich
+823835298	/v
@@ -0,0 +1,11 @@
+2026/10/22 14:32:59 backup.go:1014: [INFO] [backup] Stopping immich for safe volume dump
+2026/10/22 14:33:00 volume_exclusion.go:31: [INFO] [backup] Volume immich/immich_immich_ml_cache is excluded by the template (a cache the app rebuilds) — not dumped (R-49)
+2026/10/22 14:33:11 backup.go:911: [INFO] [backup] Volume dump: immich/immich_immich_postgres_data → 269.9 MB
+2026/10/22 14:33:11 data_versions.go:131: [DEBUG] [backup] immich: stamped volume-dumps/immich_immich_postgres_data.tar (283049472 B) with pins [ghcr.io/immich-app/immich-server:v3.2.4@sha256:d317916b28090c33eb36b308464e
+2026/10/22 14:33:11 backup.go:936: [DEBUG] [backup] Removed stale volume dump: immich/immich_immich_ml_cache.tar
+2026/10/22 14:33:11 backup.go:1030: [INFO] [backup] Restarting immich after volume dump
+total 276428
+drwxr-xr-x 2 root root      4096 Oct 22 14:33 .
+drwxr-xr-x 5 root root      4096 Oct 22 14:33 ..
+-rw-r--r-- 1 root root 283049472 Oct 22 14:33 immich_immich_postgres_data.tar
+336788031	.
@@ -0,0 +1,9 @@
+# 9202, 2026-10-22 14:35–14:40 UTC — after the backup without the model cache
+- POST /api/stacks/immich/stop → 200; `docker volume rm immich_immich_ml_cache` (as on a rebuilt box: no cache).
+- The local unit restore (POST /backup/restore stack_name=immich snapshot_id=helyi) is REFUSED by design (R-538): Immich's
+  unit holds no photo files, so the database is not put back over files it does not hold — the route for Immich is the
+  second drive's or the off-site whole restore. 9202 has neither target, so the restore leg itself was NOT run here.
+  What changed is only the cache volume's absence from the unit, so the proof is the state ANY such restore leaves:
+- POST /api/stacks/immich/start → 200; all four containers healthy; the cache volume holds 4096 B (empty).
+- Smart search's call, inside immich-machine-learning: POST localhost:3003/predict {clip.textual ViT-B-32__openai}
+  → HTTP 200, embedding length 512, 9.2 s (the model fetched); again → 200, 512, 0.1 s. The cache now 610 978 474 B.
@@ -0,0 +1,12 @@
+== BEFORE: root password over SSH from the LAN: root
+DooPlex public key added
+content check (sshd -t -f the snippet): rc=0
+sshd -t (whole): ok
+reload ssh: ok
+permitrootlogin without-password
+passwordauthentication yes
+active
+== AFTER: root password over SSH from the LAN: Permission denied, please try again.
+== AFTER: root KEY over SSH from the LAN: root
+== AFTER: the web page's password login (PVE /api2/json/access/ticket): HTTP 200
+console (tty1) login as root with the password AFTER the drop-in: shell, `id` → uid=0(root) — 02-console-login-after.png