Website git-sync in-cluster: R-1163 closed with evidence, R-1164 opened (P4); report

documentation/backlog/CLOSED-ITEMS.md

@@ -26,6 +26,12 @@
 
 ---
 
+## 2026-10-19 — the website keeps syncing during an internet outage (`fd75003e`)
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-1163** | **The website's git-syncs reached Gitea over the internet and stopped on their first error.** All four read `https://gitea.dooplex.hu/…` (out and back in, although both run on DooPlex); git-sync v4.4.0's `--max-failures` defaults to 0, so on 2026-10-19 09:24 one failed fetch exited the sidecar (`too many failures, aborting … failCount:1`) and it restarted. A pod starting during an outage could not seed its pages at all. (P3) | CLOSED 2026-10-19 — the four git-syncs read `http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git` (anonymous in-cluster fetch proven first: `main` and `installer-v1.34.0` resolve to the public hashes); the two sidecars carry `--max-failures=-1`; `hostinstall_gates.py` gate 6 keeps the four `--repo` values identical (red-proved). Deployed by a Deployment-only ArgoCD sync: new pod 0/0/0 restarts, both sidecars `updated successfully`, site and script 200, served `SCRIPT_VERSION` 1.34.0 = the tag. Proof of the mechanism on a dead address: with the flag `error syncing repo, will retry`, 0 restarts; without it `too many failures, aborting`, 1 restart. Ties the website to the DooPlex cluster → R-1164. | `audits/website-gitsync-incluster-2026-10-19/` |
+
 ## 2026-10-19 (day) — agent 0.160.0, one sign-in for the file manager (controller 0.332.0), hub 0.159.0 (full text of each row: `git show e4f022a0:documentation/backlog/OPEN-ITEMS.md`)
 
 | Row | What | Closed | Evidence |

documentation/backlog/OPEN-ITEMS.md

@@ -264,7 +264,7 @@ stopping line that lies.
 | **R-1157** | Monitoring & notifications | P4 | **While the cadence-cap flag stays degraded (the agent's 24 h hold), further refused backups raise no new alarm:** a guest refused every day reads as one long episode, one mail. The same before hub 0.159.0. Found by the hub helper 2026-10-19. | OPEN — filed 2026-10-19 | — | Decide whether a refusal count in the event detail or a daily repeat is wanted | CC |
 
 
-## Hub & operator — 12 rows (P3 6, P4 6)
+## Hub & operator — 13 rows (P3 6, P4 7)
 
 | ID | Category | Sev | What | State | Blocked on | Next action | Owner |
 |---|---|---|---|---|---|---|---|
@@ -280,6 +280,7 @@ stopping line that lies.
 | **R-1002** | Hub & operator | P4 | **A box the household switched off reads ONLINE on the hub's hosts page for its first 45 minutes** (seen live 2026-10-13, R-998 proof, `audits/poweroff-2026-10-13/B-hub-watch.log`: the „Power: Kikapcsolva…" line at 18:53, the KIKAPCSOLVA badge only at 19:38, when the host report turned stale). The customer page read „warn" in part of that gap (seen, not captured). No alarm and no mail fired; the operator page is only slow to say it. | **READY** — filed 2026-10-13 | — | CC: let `hostDisplayStatus` read `deliberate_off_at` before staleness, with a render test per state; next hub release | CC |
 | **R-1011** | Hub & operator | P3 | **The Day-0 „Agent" list offers step-bundle packages (`0.156.1-step1`, `0.152.0-step1` …) as agent versions; one has no agent binary, so the hub shows the bundle JSON's sha (`FileSHA256` falls back to the first file) and a vouch would point fresh installs at a package with no binary.** Seen 2026-10-14 (`/configuration`: two „0.156.1" entries, `ac83ea41…` is the step bundle). | **READY** — filed 2026-10-14 | — | CC: list only versions whose package holds the `felhom-agent` file (refuse a missing preferred file instead of falling back), with a test; next hub release | CC |
 | **R-1056** | Hub & operator | P4 | **Five operator routes fit no token group, so they are session only until the operator places them:** apps reset-telemetry and dismiss-issues, the Configuration asset re-seed, the off-site WireGuard endpoint save, the off-site abandon-cancel (`05` §17.3). Nothing needs them by token today. | WAITING-ON-OPERATOR — filed 2026-10-15 by the token build | operator decision | Place each in a group, or leave session only | operator |
+| **R-1164** | Hub & operator | P4 | **Move the website to Hetzner (maybe the JARRs.eu prod server) — an operator idea, no decision asked yet.** If it is done, the website's git-syncs must read the public `https://gitea.dooplex.hu/admin/felhom.eu.git` again: since 2026-10-19 (R-1163) all four read Gitea in-cluster, which works only inside the DooPlex cluster (`01-topology-and-trust.md` §7, `manifests/webpage.yaml`). | OPEN | the operator's idea becoming a decision | When decided: switch the four `--repo` values together (gate 6 keeps them identical); keep `--max-failures=-1` | operator |
 
 
 ## Business & legal — 14 rows (P2 4, P3 2, P4 8)