Evening 2026-10-18: fresh install proven (R-1148), OnlyOffice walk (R-1018), one-sign-in spike (R-1100 READY), Redis volumes (R-1117), CI rows, golden 0.331.0 baked; register 168 -> 168 (closed 6, opened R-1149..R-1154)

2026-10-18 23:12:21 +02:00
parent b9b56c47c0
commit e4f022a0d9
90 changed files with 1634 additions and 22 deletions
@@ -0,0 +1,24 @@
+loop=/dev/loop2
+--- lsblk p1 (the bug input)
+{"blockdevices":[{"name":"loop2p1","fstype":null,"pttype":"gpt","mountpoint":null}]}
+--- blkid -p p1 (empty part)
+DEVNAME=/dev/loop2p1
+PART_ENTRY_SCHEME=gpt
+PART_ENTRY_UUID=2b13a20b-f5a4-4906-9e30-985c170a50ad
+PART_ENTRY_TYPE=0fc63daf-8483-4772-8e79-3d69d8477de4
+PART_ENTRY_NUMBER=1
+PART_ENTRY_OFFSET=2048
+PART_ENTRY_SIZE=1048576
+PART_ENTRY_DISK=7:2
+rc=0
+--- blkid -p p2 (ext4)
+TYPE=ext4
+PART_ENTRY_SCHEME=gpt
+PART_ENTRY_NUMBER=2
+rc=0
+Re-reading the partition table failed.: Invalid argument
+--- blkid -p p1 (a dos table inside)
+PTTYPE=dos
+PART_ENTRY_SCHEME=gpt
+rc=0
+ls: cannot access '/root/r1093-scratch.img': No such file or directory
@@ -0,0 +1,4 @@
+## per-customer floors 0.331.0 / MinAgent 0.158.1 — 20:44:00
+tester-1: HTTP/1.1 303 See Other  Location: /customers/tester-1?flash=floor_set  
+demo-hp: HTTP/1.1 303 See Other  Location: /customers/demo-hp?flash=floor_set  
+demo-felhom: HTTP/1.1 303 See Other  Location: /customers/demo-felhom?flash=floor_set  
@@ -0,0 +1,6 @@
+demo-felhom|2026-10-18 20:44:04|0.330.0
+demo-felhom|2026-10-18 20:44:16|0.331.0
+demo-hp|2026-10-18 20:44:04|0.330.0
+demo-hp|2026-10-18 20:44:19|0.331.0
+tester-1|2026-10-18 20:44:03|0.330.0
+tester-1|2026-10-18 20:44:18|0.331.0
@@ -0,0 +1,52 @@
+=== demo-hp (enkisfelhom.hu) 20:45:54
+containers: 24 running; not healthy/running: traefik Up 2 days;
+unhealthy: 0
+2026/10/18 20:44:12 updater.go:855: [INFO] [selfupdate] Post-update startup: update successful (0.330.0 → 0.331.0)
+allow-list refusals since start: 0
+2026/10/18 20:44:13 sync.go:142: [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
+installed apps (stacks with app.yaml): 12
+2026/10/18 20:44:14 handlers.go:3887: [INFO] [web] FileBrowser mounts synced (recreated) — 1 storage path(s), config updated
+2026/10/18 20:44:19 filebrowser_gate.go:94: [INFO] [infra] filebrowser: default login refused for this run — joined traefik-public, files.<domain> s
+public https://felhom.enkisfelhom.hu/login: 000
+public https://files.enkisfelhom.hu/: 200
+=== demo-felhom (demo-felhom.eu) 20:46:13
+containers: 9 running; not healthy/running: traefik Up 2 days;
+unhealthy: 0
+2026/10/18 20:44:02 [INFO] [selfupdate] Post-update startup: update successful (0.330.0 → 0.331.0)
+allow-list refusals since start: 0
+2026/10/18 20:44:02 [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
+installed apps (stacks with app.yaml): 5
+2026/10/18 20:44:03 [INFO] [web] FileBrowser mounts synced (recreated) — 1 storage path(s), config updated
+2026/10/18 20:44:09 [INFO] [infra] filebrowser: default login refused for this run — joined traefik-public, files.<domain> served (R-1126)
+public https://felhom.demo-felhom.eu/login: 200
+public https://files.demo-felhom.eu/: 200
+=== tester-1 (enkicsifelhom.hu) 20:46:16
+containers: 10 running; not healthy/running: traefik Up 2 days;
+unhealthy: 0
+2026/10/18 20:44:11 [INFO] [selfupdate] Post-update startup: update successful (0.330.0 → 0.331.0)
+allow-list refusals since start: 0
+2026/10/18 20:44:12 [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
+installed apps (stacks with app.yaml): 3
+2026/10/18 20:44:13 [INFO] [web] FileBrowser mounts synced (recreated) — 5 storage path(s), config updated
+2026/10/18 20:44:18 [INFO] [infra] filebrowser: default login refused for this run — joined traefik-public, files.<domain> served (R-1126)
+public https://felhom.enkicsifelhom.hu/login: 200
+public https://files.enkicsifelhom.hu/: 000
+## retries 20:47:49
+20:47:49 https://felhom.enkisfelhom.hu/login: 200 0.156759s
+20:47:49 https://files.enkisfelhom.hu/: 200 0.151312s
+20:47:49 https://felhom.enkicsifelhom.hu/login: 200 0.154273s
+20:47:49 https://files.enkicsifelhom.hu/: 200 0.186791s
+20:47:50 https://felhom.demo-felhom.eu/login: 200 0.129644s
+20:47:50 https://files.demo-felhom.eu/: 200 0.148989s
+20:48:00 https://felhom.enkisfelhom.hu/login: 200 0.138598s
+20:48:00 https://files.enkisfelhom.hu/: 200 0.137951s
+20:48:00 https://felhom.enkicsifelhom.hu/login: 200 0.168040s
+20:48:00 https://files.enkicsifelhom.hu/: 200 0.160295s
+20:48:01 https://felhom.demo-felhom.eu/login: 200 0.172388s
+20:48:01 https://files.demo-felhom.eu/: 200 0.177437s
+20:48:11 https://felhom.enkisfelhom.hu/login: 200 0.151194s
+20:48:11 https://files.enkisfelhom.hu/: 200 0.166961s
+20:48:11 https://felhom.enkicsifelhom.hu/login: 200 0.130657s
+20:48:11 https://files.enkicsifelhom.hu/: 200 0.139520s
+20:48:12 https://felhom.demo-felhom.eu/login: 200 0.166568s
+20:48:12 https://files.demo-felhom.eu/: 200 0.148200s
@@ -0,0 +1,33 @@
+control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -)
+== tester-1 (enkicsifelhom.hu): 6 public name(s)
+   OK   control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1
+   OK   http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1
+== demo-hp (enkisfelhom.hu): 14 public name(s)
+   OK   http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1
+   OK   http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1
+   OK   http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1
+   OK   http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1
+   OK   http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1
+   OK   http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1
+   OK   http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1
+   OK   http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1
+   OK   http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1
+   OK   http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1
+   OK   http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1
+   OK   http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1
+   OK   http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1
+   OK   http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1
+== demo-felhom (demo-felhom.eu): 8 public name(s)
+   OK   http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1
+   OK   http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1
+   OK   http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1
+   OK   http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1
+   OK   http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1
+   OK   http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1
+   OK   http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1
+   OK   http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1
+== every public name redirects http -> https
@@ -0,0 +1,15 @@
+## global floor 20:48:56
+HTTP/1.1 303 See Other  Location: /configuration?flash=floor_set  
+## read back (hub.db + -wal + -shm in one tar)
+min_controller_version|0.331.0
+min_controller_version_declared_min_agent|0.331.0=0.158.1
+## clear the per-customer floors 20:49:09
+tester-1: HTTP/1.1 303 See Other  Location: /customers/tester-1?flash=floor_set  
+demo-hp: HTTP/1.1 303 See Other  Location: /customers/demo-hp?flash=floor_set  
+demo-felhom: HTTP/1.1 303 See Other  Location: /customers/demo-felhom?flash=floor_set  
+		, status TEXT NOT NULL DEFAULT 'active', min_controller_version TEXT NOT NULL DEFAULT '', config_version INTEGER NOT NULL DEFAULT 1, dr_tier INTEGER NOT NULL DEFAULT 0, min_controller_declared_min_agent TEXT NOT NULL DEFAULT '', language TEXT NOT NULL DEFAULT 'hu', min_controller_set_at TEXT NOT NULL DEFAULT '', api_key_hash TEXT NOT NULL DEFAULT '');
+demo-felhom|[]|[]
+demo-hp|[]|[]
+tester-1|[]|[]
+Tester-2|[]|[]
+Tester4|[]|[]
@@ -0,0 +1,2 @@
+0.322.0: 310 snapshots restic=restic 0.14.0
+0.331.0: 310 snapshots restic=restic 0.19.1
@@ -0,0 +1,12 @@
+iso=/var/lib/vz/template/iso/felhom-installer-1.29.0-pve9.2-1.iso sha256=dceacae5da247d76
+Formatting '/mnt/hdd_1/images/9302/vm-9302-disk-0.raw', fmt=raw size=128849018880 preallocation=off
+scsi0: successfully created disk 'nvme-scratch:9302/vm-9302-disk-0.raw,size=120G'
+update VM 9302: -boot order=scsi0;ide2
+boot: order=scsi0;ide2
+cores: 4
+ide2: local:iso/felhom-installer-1.29.0-pve9.2-1.iso,media=cdrom,size=1665356K
+memory: 8192
+name: newbox-r1148
+net0: virtio=BC:24:11:0F:7C:57,bridge=vmbr0
+scsi0: nvme-scratch:9302/vm-9302-disk-0.raw,size=120G
+19:43:15
@@ -0,0 +1,22 @@
+install pressed 19:50:19 CEST
+bind posted 20:02:58 CEST
+--- read from the hub DB (copied with its WAL), the box's journal, and the box's own /api/selfupdate/status (all UTC) ---
+17:42:21 hub: customer Tester4 created by the operator; the bind mail sent at once (Gmail catch-all)
+17:43:15 VM 9302 created on demo-hp (8 GB / 4 cores / 120 GB on nvme-scratch at /mnt/hdd_1 root); ISO 1.29.0 (sha256 dceacae5… = published)
+17:50:19 Install pressed (graphical installer, Hungarian layout kept, driven by qm sendkey; screens/)
+~18:02    console: pairing code shown (screens/13-now.png)
+18:02:58 bind through the mailed link + pairing code + owner phrase: „Sikeres összekötés" (03-bind.txt)
+18:03:13 setup-code mail
+18:03:42 hub: host Tester4-31fa0e created
+18:03:43 step 4b/8: „recovery password vaulted at the hub (stored) — now setting it on root@pam"; chpasswd; „[OK] root@pam password vaulted, set, and the PVE login takes it"
+18:03:43 hub: host_recovery.set_at for Tester4-31fa0e (the same second)
+18:03:44 step 5/8: manifest agent v0.159.2 (sha 4d98868e…), golden v0.329.0; agent sha256 verified = hub manifest; bundle 477704ea… verified
+18:04:02 first host report: agent 0.159.2
+18:05:37 first controller report: 0.329.0 (the vouched golden)
+18:05:38 the box's own record: update 0.329.0 -> 0.330.0 initiated_by „auto-floor"; completed 18:05:45
+18:05:51 controller report: 0.330.0
+18:05:54 „Day-0 provision SUCCESS — vmid=9201 host_id=Tester4-31fa0e customer=Tester4"
+18:17:14 CC's own PVE login from DooPlex: vaulted value 200; the installer's typed value 401 (04-pve-login-check.txt)
+18:18:32 dashboard claimed with the mailed setup code (302 /)
+18:19:25 BentoPDF deploy 202; 18:20:05 running, container healthy (07-first-app.txt)
+=> Install pressed to the floor: 15 min 26 s. Bind to the floor: 2 min 47 s. Nobody pressed an update.
@@ -0,0 +1 @@
+Felhom — Doboz összekötése Felhom doboz összekötése Sikeres összekötés. A doboz kb. egy percen belül folytatja a telepítést. Ezt az oldalt bezárhatod — a beállítás a háttérben befejeződik, és a vezérlőpultod hamarosan elérhető lesz. Felhom.eu
@@ -0,0 +1,2 @@
+18:17:14 PVE login with the VAULTED value: HTTP 200
+18:17:17 PVE login with the INSTALLER value (typed at install): HTTP 401
@@ -0,0 +1,7 @@
+GET /claim 200
+csrf_len 64
+HTTP/1.1 302 Found
+Location: /
+18:18:32
+{"ok":true,"data":{"running":false,"last_check":{"current_version":"0.330.0","latest_version":"0.330.0","update_available":false,"checked_at":"2026-10-18T18:06:16Z"},"last_state":{"status":"success","previous_version":"0.329.0","previous_image":"gitea.dooplex.hu/admin/felhom-controller:0.329.0","target_version":"0.330.0","target_image":"gitea.dooplex.hu/admin/felhom-controller:0.330.0","initiated_at":"2026-10-18T18:05:38Z","initiated_by":"auto-floor","completed_at":"2026-10-18T18:05:45Z"}}}
+
@@ -0,0 +1 @@
+{"ok":false,"error":"dashboard not yet claimed"}
@@ -0,0 +1,8 @@
+login 302
+csrf_len 64
+{"ok":true,"data":{"app_config":null,"domain":"tester4.test","logo_url":"/static/assets/bentopdf-logo.svg","metadata":{"display_name":"BentoPDF","description":"Adatvédelmi fókuszú PDF eszköztár","category":"tools","subdomain":"pdf","slug":"bentopdf","catalog_since":"2026-07-12","resources":{"me
+{"ok":true,"message":"Telepítés elindítva – az állapot a kártyán követhető"}
+ deploy 202
+18:19:25
+18:20:05 "state":"running" "deployed":true "state":"running" "deployed":true 
+bentopdf ghcr.io/alam00000/bentopdf:v2.8.6 Up 20 seconds (healthy)
@@ -0,0 +1,255 @@
+2026-10-18T19:53:32+02:00 tester4 systemd[1]: Starting felhom-bootstrap.service - Felhom host bootstrap (fetch + run felhom-host-install.sh unattended, retry until success)...
+2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: console: pvebanner.service masked (it would rewrite /etc/issue with the Proxmox admin URL on every boot)
+2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: console: /etc/issue is the Felhom text (no admin URL)
+2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: PAIRING mode (generic ISO, no baked customer/passphrase) — hub=https://hub.felhom.eu
+2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: registering unclaimed appliance at the hub
+2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: registered — appliance token stored (0600); waiting for the operator or a customer self-bind
+2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: console font -> Lat2-Terminus16 (Latin-2, ő/ű capable)
+2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: not bound yet — polling every 30s until the operator or a customer self-bind lands (this is the normal waiting state, not an error)
+2026-10-18T20:03:04+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: bind DELIVERED — writing credentials to the env and switching to direct install
+2026-10-18T20:03:04+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: fetching host-install: https://felhom.eu/scripts/felhom-host-install.sh
+2026-10-18T20:03:05+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: running host-install (customer=Tester4 mode=appliance hub=https://hub.felhom.eu)
+2026-10-18T20:03:05+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   auto-sized guest RAM: 4096 MiB (host 7939 MiB; clamp(host-4096, min 4096, max host-2048), ceiling host-1024)
+2026-10-18T20:03:05+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   auto-sized guest cores: 3 (host 4 cores; host-1, min 2)
+2026-10-18T20:03:05+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] felhom-host-install v1.34.0 — mode=appliance customer=Tester4 vmid=9201
+2026-10-18T20:03:05+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 1/8 pre-flight
+2026-10-18T20:03:06+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve)
+2026-10-18T20:03:07+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   node: tester4 (auto)
+2026-10-18T20:03:07+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   agent config: /etc/felhom-agent/agent.json
+2026-10-18T20:03:07+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   agent: not installed yet — will be fetched + installed in step 5/8
+2026-10-18T20:03:07+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   local-lvm free: ~54 GiB
+2026-10-18T20:03:07+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN] local-lvm free ~54 GiB is below the recommended 120 GiB — the install continues; proceed only if you sized the grows deliberately
+2026-10-18T20:03:07+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   free RAM: ~6371 MiB
+2026-10-18T20:03:09+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   existing guests on this host: 0 (pct+qm)
+2026-10-18T20:03:09+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   archive storage 'local' present
+2026-10-18T20:03:11+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   acl storage 'felhom-pbs' not present yet — expected: the PBS-DR tier creates it; the grant is pre-positioned deliberately
+2026-10-18T20:03:11+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   dnsmasq: not present before Felhom — recorded; uninstall will remove it again if we install it
+2026-10-18T20:03:12+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   hub reachable (https://hub.felhom.eu)
+2026-10-18T20:03:12+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   customer 'Tester4' exists + passphrase valid
+2026-10-18T20:03:13+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   golden: none local — will fetch + verify from Gitea in step 7/8
+2026-10-18T20:03:15+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] pre-flight passed
+2026-10-18T20:03:15+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 2/8 Proxmox API token
+2026-10-18T20:03:19+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   token minted (secret captured, not logged)
+2026-10-18T20:03:41+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   scoped ACL applied (Base@/, Guest@/pool/felhom + /vms/990000..990009, Store@[local local-lvm felhom-pbs])
+2026-10-18T20:03:42+02:00 tester4 felhom-bootstrap.sh[3647]: [SKIP]   old broad role FelhomAgent already absent
+2026-10-18T20:03:42+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 3/8 compute volume grows
+2026-10-18T20:03:42+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   auto-computed from a 54 GiB thin pool (16 §7: 50/100/130 GiB)
+2026-10-18T20:03:42+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   grows: rootfs +0G (->32G), data +26G (->50G, ONE volume)
+2026-10-18T20:03:42+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 4/8 host enrollment (POST /host-enroll)
+2026-10-18T20:03:42+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   host MINTED (first enroll)
+2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   host_id: Tester4-31fa0e (api_key captured, not logged)
+2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 4b/8 break-glass credential (root@pam console password → hub vault)
+2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   recovery password vaulted at the hub (stored) — now setting it on root@pam
+2026-10-18T20:03:43+02:00 tester4 chpasswd[3936]: pam_unix(chpasswd:chauthtok): password changed for root
+2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   root@pam password vaulted, set, and the PVE login takes it (retrieve via the operator /admin path; never logged here)
+2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN]   NOTE: the root@pam password just CHANGED — the old one now fails at the PVE web GUI (:8006).
+2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN]         Retrieve the new one at hub → host page (vaulted recovery credential).
+2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 5/8 agent install (fetch + verify + install)
+2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   disabled pve-enterprise.sources (Enabled: no)
+2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   disabled ceph.sources (Enabled: no)
+2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   added pve-no-subscription.sources (suite=trixie)
+2026-10-18T20:03:44+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   apt repos aligned to no-subscription (changed; apt-get update OK)
+2026-10-18T20:03:44+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN]   no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged)
+2026-10-18T20:03:44+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   manifest: agent v0.159.2 (sha 4d98868e922d6c10…), golden v0.329.0
+2026-10-18T20:03:44+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   fetching agent binary v0.159.2 from Gitea …
+2026-10-18T20:03:45+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   verified sha256 4d98868e922d6c10… matches the hub manifest
+2026-10-18T20:03:45+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   installed /usr/local/bin/felhom-agent (felhom-agent 0.159.2)
+2026-10-18T20:03:45+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   installing the 'sudo' package (required for the non-root agent model) …
+2026-10-18T20:03:48+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   sudo installed (Sudo version 1.9.16p2)
+2026-10-18T20:03:48+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   installing the 'age' package (escrow ceremony identity-wrap dependency) …
+2026-10-18T20:03:51+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   age installed (1.2.1)
+2026-10-18T20:03:51+02:00 tester4 useradd[4161]: new group: name=felhom-agent, GID=990
+2026-10-18T20:03:51+02:00 tester4 useradd[4161]: new user: name=felhom-agent, UID=999, GID=990, home=/home/felhom-agent, shell=/usr/sbin/nologin, from=none
+2026-10-18T20:03:51+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   created service user felhom-agent
+2026-10-18T20:03:51+02:00 tester4 usermod[4169]: add 'felhom-agent' to group 'systemd-journal'
+2026-10-18T20:03:51+02:00 tester4 usermod[4169]: add 'felhom-agent' to shadow group 'systemd-journal'
+2026-10-18T20:03:51+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   added felhom-agent to systemd-journal (unprivileged journal read for NAS verify)
+2026-10-18T20:03:53+02:00 tester4 useradd[4209]: new group: name=felhom-op, GID=1000
+2026-10-18T20:03:53+02:00 tester4 useradd[4209]: new user: name=felhom-op, UID=1000, GID=1000, home=/home/felhom-op, shell=/bin/bash, from=none
+2026-10-18T20:03:53+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   verified sha256 477704ea29809484… matches the hub manifest
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4246]: os-apply: BUNDLE START agent=0.159.2 sha=477704ea29809484 authority=installer files=31 write=30 same=1 kept=0 skipped=0
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4248]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-selfupdate-guarded (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4249]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-pbs-apply (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4250]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-backup-target-apply (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4251]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-vzdump-partial-clean (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4252]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-thin-check (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4253]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-internal-place (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4254]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-crash-guard (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4255]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-priv-apply (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4256]: os-apply: BUNDLE WROTE /var/lib/vz/snippets/felhom-guest-hook.sh (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4257]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-shared-parent.sh (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4258]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-shared-parent.service (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4259]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard.service (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4260]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.service (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4261]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.timer (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4262]: os-apply: BUNDLE WROTE /etc/felhom/crash-guard.conf (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4263]: os-apply: BUNDLE WROTE /etc/grub.d/01_felhom_oneshot (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4264]: os-apply: BUNDLE WROTE /etc/grub.d/42_felhom_oneshot (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4265]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4266]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent-rollback.service (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4267]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service.d/felhom-agent-limits.conf (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4268]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mgmt-watchdog (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4269]: os-apply: BUNDLE WROTE /etc/tmpfiles.d/felhom-privsep.conf (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4270]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.service (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4271]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.timer (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4272]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-sshd.service (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4273]: os-apply: BUNDLE WROTE /etc/felhom-oob.nft (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4274]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-oob-nft.service (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4275]: os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-op (new)
+2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4276]: os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-agent (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-os-apply[4395]: os-apply: BUNDLE DONE agent=0.159.2 written=30 same=1 self-check=ok signers-created=False
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE START agent=0.159.2 sha=477704ea29809484 authority=installer files=31 write=30 same=1 kept=0 skipped=0
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mkfs-guarded (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-selfupdate-guarded (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-pbs-apply (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-backup-target-apply (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-vzdump-partial-clean (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-thin-check (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-internal-place (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-crash-guard (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-priv-apply (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /var/lib/vz/snippets/felhom-guest-hook.sh (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-shared-parent.sh (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-shared-parent.service (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard.service (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.service (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.timer (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/felhom/crash-guard.conf (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/grub.d/01_felhom_oneshot (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/grub.d/42_felhom_oneshot (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent-rollback.service (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service.d/felhom-agent-limits.conf (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mgmt-watchdog (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/tmpfiles.d/felhom-privsep.conf (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.service (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.timer (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-sshd.service (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/felhom-oob.nft (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/systemd/system/felhom-oob-nft.service (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-op (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-agent (new)
+2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]:   os-apply: BUNDLE DONE agent=0.159.2 written=30 same=1 self-check=ok signers-created=False
+2026-10-18T20:03:56+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   installed every root-owned file from config bundle v0.159.2 (sha 477704ea29809484…; checked, previous copies kept)
+2026-10-18T20:03:56+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   OOB felhom-sshd instance + static belt from the bundle (agent renders config + fills sets once oob.enabled)
+2026-10-18T20:03:56+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 5b/8 internal data place (Belső tárhely)
+2026-10-18T20:03:58+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   no internal place: only -44 GiB free for it (pool 54, reserve 16, promised 0, planned 82; needs 20)
+2026-10-18T20:03:58+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 6/8 agent config + service
+2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN]   backup target: DEGRADED — no eligible second drive, so the whole-system backup stays on the SYSTEM drive.
+2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN]   It protects against file corruption but NOT against a disk failure. Attach a second drive and assign it in the dashboard.
+2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   creating island bridge vmbr9 (portless, 169.254.253.1/30)
+2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   vmbr9 up: 169.254.253.1/30
+2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   R-50 island ON: local_api=169.254.253.1:8443 (vmbr9); guest net1=169.254.253.2/30; lan_resolver.host_ip=192.168.0.109
+2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   node=tester4  local_api=169.254.253.1:8443  tls_fp=25:C4:B3:61:78:4A…
+2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   wrote /etc/felhom-agent/agent.json (0600 felhom-agent)
+2026-10-18T20:04:00+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   agent --selftest (read-only) passed
+2026-10-18T20:04:03+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   felhom-agent service active (non-root felhom-agent reads the config OK)
+2026-10-18T20:04:03+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   wrote /etc/felhom/os-trust.json + operator-signers (felhom-op-1) — the root-owned slow-lane anchors
+2026-10-18T20:04:03+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 7/8 golden archive
+2026-10-18T20:04:03+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN]   no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged)
+2026-10-18T20:04:04+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   fetching golden v0.329.0 from Gitea → /var/lib/vz/dump/vzdump-lxc-9100-2026_10_18-20_04_04.tar.zst
+2026-10-18T20:04:15+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   verified sha256 58dc40df555676d8… matches the hub manifest
+2026-10-18T20:04:16+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   golden imported + verified: local:backup/vzdump-lxc-9100-2026_10_18-20_04_04.tar.zst
+2026-10-18T20:04:16+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 8/8 provision guest 9201
+2026-10-18T20:04:17+02:00 tester4 felhom-bootstrap.sh[3647]: [SKIP]   pool felhom already exists
+2026-10-18T20:04:17+02:00 tester4 felhom-bootstrap.sh[5665]: === felhom-agent 0.159.2 selftest=provision (vmid=9201 customer=Tester4 hostname=tester4) ===
+2026-10-18T20:04:17+02:00 tester4 felhom-bootstrap.sh[5665]:   --- front half: bring-up (provision) local:backup/vzdump-lxc-9100-2026_10_18-20_04_04.tar.zst → vmid 9201 ---
+2026-10-18T20:05:11+02:00 tester4 felhom-bootstrap.sh[5665]: time=2026-10-18T20:05:11.381+02:00 level=INFO msg="bring-up: pool membership re-asserted" vmid=9201 pool=felhom
+2026-10-18T20:05:11+02:00 tester4 felhom-bootstrap.sh[5665]:   [OK] front half: vmid 9201 up (boot+running) in 54s; MAC=BC:24:11:13:D8:4F
+2026-10-18T20:05:11+02:00 tester4 felhom-bootstrap.sh[5665]:   --- back half: mint per-guest token + populate bootstrap config mount ---
+2026-10-18T20:05:11+02:00 tester4 sudo[6764]:     root : PWD=/ ; USER=root ; COMMAND=/usr/bin/chown --reference=/var/lib/felhom-agent /var/lib/felhom-agent/guests /var/lib/felhom-agent/guests/9201
+2026-10-18T20:05:11+02:00 tester4 sudo[6764]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+2026-10-18T20:05:11+02:00 tester4 sudo[6764]: pam_unix(sudo:session): session closed for user root
+2026-10-18T20:05:11+02:00 tester4 sudo[6767]:     root : PWD=/ ; USER=root ; COMMAND=/usr/bin/chown -R 100000:100000 /var/lib/felhom-agent/guests/9201/bootstrap
+2026-10-18T20:05:11+02:00 tester4 sudo[6767]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+2026-10-18T20:05:11+02:00 tester4 sudo[6767]: pam_unix(sudo:session): session closed for user root
+2026-10-18T20:05:11+02:00 tester4 sudo[6770]:     root : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct set 9201 -mp9 /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1
+2026-10-18T20:05:11+02:00 tester4 sudo[6770]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+2026-10-18T20:05:12+02:00 tester4 sudo[6770]: pam_unix(sudo:session): session closed for user root
+2026-10-18T20:05:12+02:00 tester4 sudo[6851]:     root : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct set 9201 -onboot 1
+2026-10-18T20:05:12+02:00 tester4 sudo[6851]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+2026-10-18T20:05:13+02:00 tester4 sudo[6851]: pam_unix(sudo:session): session closed for user root
+2026-10-18T20:05:13+02:00 tester4 sudo[7056]:     root : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct set 9201 --hookscript local:snippets/felhom-guest-hook.sh
+2026-10-18T20:05:13+02:00 tester4 sudo[7056]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+2026-10-18T20:05:14+02:00 tester4 sudo[7056]: pam_unix(sudo:session): session closed for user root
+2026-10-18T20:05:14+02:00 tester4 sudo[7479]:     root : PWD=/ ; USER=root ; COMMAND=/usr/bin/mkdir -p /mnt/felhom-drives
+2026-10-18T20:05:14+02:00 tester4 sudo[7479]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+2026-10-18T20:05:14+02:00 tester4 sudo[7479]: pam_unix(sudo:session): session closed for user root
+2026-10-18T20:05:14+02:00 tester4 sudo[7485]:     root : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct set 9201 -mp8 /mnt/felhom-drives,mp=/mnt/felhom-drives
+2026-10-18T20:05:14+02:00 tester4 sudo[7485]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
+2026-10-18T20:05:15+02:00 tester4 sudo[7485]: pam_unix(sudo:session): session closed for user root
+2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[5665]: time=2026-10-18T20:05:15.845+02:00 level=INFO msg="provision: back-half complete" vmid=9201 mount=mp9 guest_path=/etc/felhom-bootstrap endpoint=169.254.253.1:8443
+2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[5665]:   [OK] back half: bootstrap mount mp9 → /etc/felhom-bootstrap on vmid 9201 (host dir /var/lib/felhom-agent/guests/9201/bootstrap)
+2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[5665]:   local-api endpoint 169.254.253.1:8443 · leaf fp 7df7cb57504e66d1a1c688fd6d54e4c6c0a1970781c6ac65d2198a1b6e448f22 · token: minted (not printed)
+2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[5665]: === selftest=provision OK — guest 9201 provisioned + bootstrap-mounted (KEPT) ===
+2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[5665]:     next: reboot the guest → the golden's baked controller-bootstrap unit deploys the controller,
+2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[5665]:     which PULLS its controller.yaml from the hub (retrieval passphrase) and merges in this local_api.
+2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   provision completed
+2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   rebooting guest 9201 so the baked controller-bootstrap unit picks up the mount
+2026-10-18T20:05:16+02:00 tester4 pct[7627]: <root@pam> starting task UPID:tester4:00001DDF:00011AB9:6AD50A5C:vzreboot:9201:root@pam:
+2026-10-18T20:05:16+02:00 tester4 pct[7647]: requesting reboot of CT 9201: UPID:tester4:00001DDF:00011AB9:6AD50A5C:vzreboot:9201:root@pam:
+2026-10-18T20:05:27+02:00 tester4 pct[7627]: <root@pam> end task UPID:tester4:00001DDF:00011AB9:6AD50A5C:vzreboot:9201:root@pam: OK
+2026-10-18T20:05:27+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] verify
+2026-10-18T20:05:28+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   pct status: running
+2026-10-18T20:05:29+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   onboot: 1
+2026-10-18T20:05:30+02:00 tester4 felhom-bootstrap.sh[8525]:     mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/felhom,backup=1,size=50G
+2026-10-18T20:05:30+02:00 tester4 felhom-bootstrap.sh[8525]:     mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives
+2026-10-18T20:05:30+02:00 tester4 felhom-bootstrap.sh[8525]:     rootfs: local-lvm:vm-9201-disk-0,size=32G
+2026-10-18T20:05:32+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   pool: guest 9201 is a member of felhom
+2026-10-18T20:05:33+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentBase@/ present (user+token)
+2026-10-18T20:05:34+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentGuest@/pool/felhom present (user+token)
+2026-10-18T20:05:36+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentStore@/storage/local present (user+token)
+2026-10-18T20:05:37+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentStore@/storage/local-lvm present (user+token)
+2026-10-18T20:05:38+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentStore@/storage/felhom-pbs present (user+token)
+2026-10-18T20:05:40+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentGuest@/vms/990000 present (user+token)
+2026-10-18T20:05:41+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentGuest@/vms/990001 present (user+token)
+2026-10-18T20:05:42+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentGuest@/vms/990002 present (user+token)
+2026-10-18T20:05:43+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentGuest@/vms/990003 present (user+token)
+2026-10-18T20:05:45+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentGuest@/vms/990004 present (user+token)
+2026-10-18T20:05:46+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentGuest@/vms/990005 present (user+token)
+2026-10-18T20:05:47+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentGuest@/vms/990006 present (user+token)
+2026-10-18T20:05:48+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentGuest@/vms/990007 present (user+token)
+2026-10-18T20:05:49+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentGuest@/vms/990008 present (user+token)
+2026-10-18T20:05:51+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   acl: FelhomAgentGuest@/vms/990009 present (user+token)
+2026-10-18T20:05:51+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   authz signers: 2 (operator-signed self-update armed)
+2026-10-18T20:05:52+02:00 tester4 felhom-bootstrap.sh[3647]: [OK]   controller: Up 6 seconds (healthy) (after ~0s)
+2026-10-18T20:05:53+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   controller image: gitea.dooplex.hu/admin/felhom-controller:0.330.0
+2026-10-18T20:05:54+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN]   cloudflared not visible yet
+2026-10-18T20:05:54+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO]   (confirm in the hub UI that host Tester4-31fa0e reports guest 9201)
+2026-10-18T20:05:54+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] Day-0 provision SUCCESS — vmid=9201 host_id=Tester4-31fa0e customer=Tester4 golden=local:backup/vzdump-lxc-9100-2026_10_18-20_04_04.tar.zst
+2026-10-18T20:05:54+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] root@pam was rotated + vaulted at step 4b — retrieve at hub → host page (the old GUI password no longer works).
+2026-10-18T20:05:54+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: host-install SUCCESS — writing done-flag, disabling unit, scrubbing secrets
+2026-10-18T20:05:54+02:00 tester4 systemd[1]: felhom-bootstrap.service: Deactivated successfully.
+2026-10-18T20:05:54+02:00 tester4 systemd[1]: Finished felhom-bootstrap.service - Felhom host bootstrap (fetch + run felhom-host-install.sh unattended, retry until success).
+2026-10-18T20:05:54+02:00 tester4 systemd[1]: felhom-bootstrap.service: Consumed 1min 32.507s CPU time, 884.4M memory peak.
+=== agent
+2026-10-18T20:04:00+02:00 tester4 systemd[1]: Started felhom-agent.service - Felhom host agent (Proxmox host tier; hub control loop + PBS verify + storage watchdog).
+2026-10-18T20:04:00+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:00.468+02:00 level=INFO msg="felhom-agent daemon starting" version=0.159.2 host_id=Tester4-31fa0e hub_url=https://hub.felhom.eu interval_s=900
+2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.336+02:00 level=INFO msg="backup: restore-test scheduler starting (per-archive due-check)" eval_interval=6h0m0s settle=24h0m0s
+2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.336+02:00 level=INFO msg="pbs: verify loop starting" cadence=6h0m0s
+2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.336+02:00 level=INFO msg="storage: watchdog starting" interval=5s debounce=15s
+2026-10-18T20:04:01+02:00 tester4 sudo[4892]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:04:01+02:00 tester4 sudo[4936]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.874+02:00 level=INFO msg="selfheal: node watchdog starting" mode=appliance interval_s=60
+2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.875+02:00 level=INFO msg="guestnet: watchdog starting" interval=1m0s min_heal_interval=10m0s max_heals_per_hour=3 settle=3m0s
+2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.925+02:00 level=INFO msg="guest-power: watchdog started" interval=1m0s max_attempts=3
+2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.925+02:00 level=INFO msg="fstrim: weekly guest disk trim starting" schedule="weekly, due Wednesday from 10:00 host-local time; starts only 10:00-20:59; never beside a backup or restore-test"
+2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.925+02:00 level=INFO msg="janitor: starting (restore-test scratch retry + stale-lock sweep)" interval=10m0s
+2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.925+02:00 level=INFO msg="controller-supervisor: started" interval=30s confirm_sweeps=2 crashloop_max=3 crashloop_window=15m0s slow_crashloop_max=5 slow_crashloop_window=24h0m0s guests_dir=/var/lib/felhom-agent/guests
+2026-10-18T20:04:02+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:02.544+02:00 level=INFO msg="wgtunnel: registered with hub" pubkey="pUKC3lzCxXNARPkI70LtbsxdyW9QateJH1VDhAnvYD8=" assigned_ip=10.77.0.6/32 existed=false generation=1 sync=ok
+2026-10-18T20:04:03+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:03.198+02:00 level=INFO msg="wgtunnel: tunnel conf applied" endpoint=167.233.158.164:443 dns_name=ep0.felhom.eu assigned_ip=10.77.0.6/32 action=enable
+2026-10-18T20:04:07+02:00 tester4 sudo[5602]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl restart dnsmasq
+2026-10-18T20:04:22+02:00 tester4 sudo[5850]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:04:42+02:00 tester4 sudo[5963]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:05:02+02:00 tester4 sudo[6050]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:05:13+02:00 tester4 sudo[6939]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:05:16+02:00 tester4 sudo[7665]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:05:17+02:00 tester4 sudo[7695]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:05:22+02:00 tester4 sudo[7847]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:05:31+02:00 tester4 sudo[9006]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:05:31+02:00 tester4 sudo[9182]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:05:32+02:00 tester4 sudo[9449]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:05:33+02:00 tester4 sudo[9536]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:05:42+02:00 tester4 sudo[9917]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
+2026-10-18T20:05:43+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:05:43.703+02:00 level=INFO msg="controller-swap: image file written, restarting bootstrap" vmid=9201 target=gitea.dooplex.hu/admin/felhom-controller:0.330.0
+2026-10-18T20:05:43+02:00 tester4 sudo[9961]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct exec 9201 -- systemctl restart felhom-controller-bootstrap.service
@@ -0,0 +1,7 @@
+2026-10-18 18:04:02|0.159.2|0|0||
+2026-10-18 18:19:07|0.159.2|1|1||9201
+33652|2026-10-18 18:05:37|0.329.0|1
+33653|2026-10-18 18:05:51|0.330.0|1
+33657|2026-10-18 18:18:34|0.330.0|1
+33658|2026-10-18 18:19:27|0.330.0|1
+33659|2026-10-18 18:20:46|0.330.0|1
@@ -0,0 +1,6 @@
+login 302
+{"data":{"powering_off":true},"ok":true}
+ poweroff 202
+18:24:15
+18:24:45 VM 9302: status: stopped
+Tester4-31fa0e|2026-10-18 18:24:18|2026-10-18T18:24:15Z
@@ -0,0 +1,12 @@
+read 1: 9302 name=newbox-r1148
+read 2: 9302 name=newbox-r1148
+scsi0: nvme-scratch:9302/vm-9302-disk-0.raw,size=120G
+purging VM 9302 from related configurations..
+Configuration file 'nodes/demo-hp/qemu-server/9302.conf' does not exist
+ls: cannot access '/mnt/hdd_1/images/9302': No such file or directory
+      VMID NAME                 STATUS     MEM(MB)    BOOTDISK(GB) PID       
+       341 night1004-tester1    running    8192             200.00 1851      
+VMID       Status     Lock         Name                
+9201       running                 demo-hp             
+9202       running                 demo-hp-scratch     
+9401       stopped                 upgrade-harness     
@@ -0,0 +1,33 @@
+# R-1148 — a fresh install from nothing with installer 1.34.0 (2026-10-18 evening)
+
+Throwaway customer **Tester4** (created by the operator; domain `tester4.test`, a reserved name that never resolves; no
+off-site, no PBS-DR — nothing on ep0). VM 9302 `newbox-r1148` on demo-hp (Tier 1; 8 GB / 4 cores / 120 GB raw on
+`nvme-scratch` = `/mnt/hdd_1` root) from the public ISO 1.29.0 (checksum = the published one). The ISO fetches
+`felhom-host-install.sh` at run time from `https://felhom.eu/scripts/` — served 1.34.0 (`SCRIPT_VERSION` read live). The
+graphical installer was driven with `qm sendkey`, the Hungarian keyboard kept, as a household would. The household's
+path: the mailed bind link + the pairing code on the console + the owner phrase (the operator put it in a 0600 file;
+shredded after), then the mailed setup code.
+
+| file | what it shows |
+|---|---|
+| `02-timeline.txt` | every step with its time (UTC below the line) |
+| `03-bind.txt` | the bind page's answer: „Sikeres összekötés" |
+| `04-pve-login-check.txt` | CC's own PVE API login from DooPlex, status codes only: the **vaulted** value 200; the value typed at install 401 |
+| `05-claim-and-version.txt` | the claim (302 /) and the box's own `/api/selfupdate/status`: 0.329.0 → 0.330.0, `initiated_by: auto-floor` |
+| `07-first-app.txt` | BentoPDF installed through the dashboard's API: deploy 202, running, healthy |
+| `08-bootstrap-journal.txt` | the box's `felhom-bootstrap` journal (scanned for secret shapes: 0) |
+| `09-hub-reports.txt` | the hub's host reports (agent 0.159.2) and the controller's own reports (0.329.0, then 0.330.0) |
+| `10-poweroff.txt` | the household's „turn off" (202), the hub's `deliberate_off_at` |
+| `99-teardown.txt` | the name read back twice, VM 9302 destroyed with its disk; the other VMs listed |
+| `screens/` | installer and console |
+
+**Step 4b (R-1145) in the full sequence:** `recovery password vaulted at the hub (stored) — now setting it on root@pam`
+→ chpasswd → `[OK] root@pam password vaulted, set, and the PVE login takes it`, all at 18:03:43 UTC; the hub's
+`host_recovery.set_at` is the same second. **The golden and the agent:** the hub manifest named agent v0.159.2 (sha
+`4d98868e…`) and golden v0.329.0 — the two vouched artifacts; both verified by sha256. The box came up on 0.329.0 and
+moved to the floor 0.330.0 by itself 2 min 47 s after the bind.
+
+Not walked: an SSH key login — CC logged in with the vaulted password (`sshpass -f`, file 0600, shredded after).
+
+**Left for the operator (session only):** delete customer Tester4 on the hub — allowed from 19:09 UTC (the last report
+18:24:18 + the 45-minute stale threshold); a 409 before that is by design (R-599).
@@ -0,0 +1,8 @@
+18:41:08
+25293 bytes, mtime 2026-10-18 18:40:29.429360235 +0000, owner 1000
+text: R1018 BEFORE EDITED-FB-1849
+2026/10/18 20:39:38 POST    | 200 | 172.18.0.7      | admin        | 0ms          | "/api/office/callback?auth=[redacted]&path=%2Fr1018%2Fteszt.docx&source=SCRATCH+HDD"
+2026/10/18 20:39:53 POST    | 200 | 172.18.0.7      | admin        | 0ms          | "/api/office/callback?auth=[redacted]&path=%2Fr1018%2Fteszt.docx&source=SCRATCH+HDD"
+2026/10/18 20:39:53 [INFO ] OnlyOffice Server is downloading file: /r1018/teszt.docx (documentId: 795feeebca16ab3ab1aae0dd352e9932fffa9efe0a9a927d6c3100ce98f20e6d)
+2026/10/18 20:40:29 [INFO ] OnlyOffice callback: successfully saved document to path=/r1018/teszt.docx
+2026/10/18 20:40:29 POST    | 200 | 172.18.0.7      | admin        | 5ms          | "/api/office/callback?auth=[redacted]&path=%2Fr1018%2Fteszt.docx&source=SCRATCH+HDD"
@@ -0,0 +1,4 @@
+text: R1018 NC BEFORE
+18:45:21
+text:  EDITED-NC-1847R1018 NC BEFORE EDITED-NC-1844
+18:47:25
@@ -0,0 +1,14 @@
+18:48:16 files /login 502
+18:48:31 files /login 502
+18:48:46 files /login 502
+18:49:01 files /login 502
+18:49:16 files /login 502
+18:49:31 files /login 502
+18:49:46 files /login 502
+18:50:01 files /login 502
+18:50:16 files /login 502
+18:50:31 files /login 502
+18:50:46 files /login 502
+18:51:01 files /login 502
+18:51:16 files /login 502
+18:51:31 files /login 200
@@ -0,0 +1,7 @@
+18:51:56 goto https://files.enkisfelhom.hu/files/SCRATCH%20HDD/r1018/teszt.docx -> https://files.enkisfelhom.hu/files/SCRATCH%20HDD/r1018/teszt.docx
+18:52:11 shot 11-fb-after-stop
+18:52:11 eval -> []
+18:52:11 goto https://cloud.enkisfelhom.hu/apps/onlyoffice/78 -> https://cloud.enkisfelhom.hu/apps/onlyoffice/78
+18:52:27 shot 12-nc-after-stop
+18:52:27 eval -> ["Nextcloud", [], "Nextcloud\nPage not found\n\nThe page could not be found on the server or you may not be allowed to view it.\n\nBack to Nextcloud\n\nNextcloud – a safe home for all your data"]
+LOG ('http', 404, 'https://cloud.enkisfelhom.hu/apps/onlyoffice/78')
@@ -0,0 +1,6 @@
+## rc.1 walk 19:12:09
+FileBrowser file text: R1018 BEFORE EDITED-FB-1849
+Nextcloud file text:  EDITED-NC-1847R1018 NC BEFORE EDITED-N RC1-NC-OKC-1844
+## rc.1 FileBrowser walk, second try 19:14:39
+mtime 2026-10-18 19:13:58.691684571 +0000
+FileBrowser file text: R1018 BEFORE EDITED-FB-1849 RC1-FB-OK
@@ -0,0 +1,10 @@
+stop pressed 19:14:54
+{"ok": true, "message": "Stack onlyoffice stop completed"}
+      1 19:15:06 files 200
+      1 19:15:08 files 502
+     43 19:15:10 files 200
+2026/10/18 19:15:06 manager.go:1463: [INFO] [stacks] Restarting stack: filebrowser
+2026/10/18 19:15:07 manager.go:1493: [INFO] [stacks] Stack filebrowser restarted successfully (took 1.1s)
+2026/10/18 19:15:07 lifecycle.go:61: [INFO] [integrations] Integration onlyoffice:filebrowser suspended (stack onlyoffice stopped)
+2026/10/18 19:15:07 lifecycle.go:61: [INFO] [integrations] Integration onlyoffice:nextcloud suspended (stack onlyoffice stopped)
+2026/10/18 19:15:09 filebrowser_gate.go:94: [INFO] [infra] filebrowser: default login refused for this run — joined traefik-public, files.<domain> served (R-1126)
@@ -0,0 +1,31 @@
+# R-1018 — the OnlyOffice links, live (2026-10-18 evening)
+
+Scratch 9202 (demo-hp, Tier 0), controller 0.330.0 then 0.331.0-rc.1. OnlyOffice 9.4.0 and Nextcloud 34.0.4 installed
+through the dashboard API (`POST /api/stacks/<n>/deploy`), each link switched on through `POST /api/integrations/
+onlyoffice/<target>` — the calls the app page makes. The browser: Playwright's headless Chrome shell on DooPlex, the box's
+public names (`files.`, `office.`, `cloud.` `enkisfelhom.hu`) mapped to 9202's LAN address (`--host-resolver-rules`), as
+in `audits/filebrowser-memory-ci-2026-10-17/tools/cdp_shot.py`; the driver is in the session scratchpad (`cdp.py`). The
+FileBrowser and Nextcloud passwords came from the dashboard's own reveal buttons into 0600 files, typed by CDP, never
+printed. Test documents: `r1018/teszt.docx` on the scratch drive, `r1018-nc.docx` in Nextcloud (WebDAV).
+
+| Step | 0.330.0 | 0.331.0-rc.1 |
+|---|---|---|
+| link on → files.<domain> | **502 for 4 min 8 s** (FileBrowser re-created off traefik-public, R-1126, until the next 5-min round) | 200 throughout |
+| FileBrowser → open .docx | editor frame loads, document never does: OnlyOffice fetched `https://files.<domain>/api/resources/download…` → **403** (the public name leads to another box, 9201) — `screens/04` | opens (`screens/15`) |
+| FileBrowser → edit, close, read the file on the drive | — (by-hand `server.internalUrl` on 0.330.0: „R1018 BEFORE EDITED-FB-1849", `01-filebrowser-save-readback.txt`) | „… RC1-FB-OK", mtime 19:13:58 (`05-rc1-walk.txt`) |
+| Nextcloud → open .docx | opens, edits, „All changes saved" (`screens/09`) — **but the file keeps the old text**: Nextcloud fetched `http://onlyoffice:80cache/files/…`, „Track: 78 status 2 error" (`02-nextcloud-save-readback.txt`) | the link re-applied the value with its slash at OnlyOffice's start; the file holds „RC1-NC-OK" |
+| OnlyOffice stopped | FileBrowser: no editor frame; Nextcloud `/apps/onlyoffice/78` **404** — the revoke-on-stop rule (`lifecycle.go:10-13`) holds (`04-after-stop-browser.txt`, `screens/11`, `12`); files.<domain> **502 for 3 min 38 s** (`03-files-outage-after-stop.txt`) | one 502 sample (≈ 2 s), FileBrowser re-published 3 s after its restart (`06-rc1-files-after-stop.txt`) |
+
+Red-proofs of the three fixes: `redproof-fix1.txt` (FileBrowser `server.internalUrl`), `redproof-fix2.txt` (Nextcloud
+`DocumentServerInternalUrl` slash), `redproof-fix3.txt` (the gate after `RestartStack("filebrowser")`).
+
+Also seen, not fixed (outside the links): FileBrowser's `/api/resources/preview` answers 500 for the .docx (an office
+preview goes through OnlyOffice's converter); Nextcloud's previews log `Request to http://onlyoffice:80converter` on
+0.330.0 — the same missing slash, fixed with it.
+
+One first rc.1 FileBrowser attempt showed OnlyOffice's „Connection is lost" after the driver clicked two fixed spots
+where pop-ups had been the time before (none were there); the next attempt, with no blind clicks, saved. No restart of
+either container happened in between (both „Up 5–6 minutes").
+
+Teardown: OnlyOffice removed through the product (`remove_hdd_data`, `remove_backups`: both volumes removed). Nextcloud
+stays on 9202 for Part 6 of the same brief; the test documents are removed with it.
@@ -0,0 +1,9 @@
+## red-proof 1: the internalUrl line removed
+=== RUN   TestFileBrowserConfig_R1018_InternalURLIsTheContainer
+    infra_test.go:269: server.internalUrl = "" — OnlyOffice would be handed the public files address
+--- FAIL: TestFileBrowserConfig_R1018_InternalURLIsTheContainer (0.00s)
+FAIL
+FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/infra	0.008s
+## restored
+--- PASS: TestFileBrowserConfig_R1018_InternalURLIsTheContainer (0.00s)
+ok  	gitea.dooplex.hu/admin/felhom-controller/internal/infra	0.007s
@@ -0,0 +1,10 @@
+## red-proof 2: the slash removed from ncDocServerInternalURL
+=== RUN   TestNextcloudApply_R1018_InternalAddressesTakeAPath
+    onlyoffice_nextcloud_test.go:34: DocumentServerInternalUrl "http://onlyoffice:80" + "cache/files/data/2153553391_5872/output.docx/output.docx" is not a URL: parse "http://onlyoffice:80cache/files/data/2153553391_5872/output.docx/output.docx": invalid port ":80cache" after host
+    onlyoffice_nextcloud_test.go:34: DocumentServerInternalUrl "http://onlyoffice:80" + "converter?shardkey=thumb_1" is not a URL: parse "http://onlyoffice:80converter?shardkey=thumb_1": invalid port ":80converter" after host
+--- FAIL: TestNextcloudApply_R1018_InternalAddressesTakeAPath (0.00s)
+FAIL
+FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/integrations	0.007s
+## restored
+--- PASS: TestNextcloudApply_R1018_InternalAddressesTakeAPath (0.00s)
+ok  	gitea.dooplex.hu/admin/felhom-controller/internal/integrations	(cached)
@@ -0,0 +1,9 @@
+## red-proof 3: the gate call removed from RestartStack
+=== RUN   TestRestartStack_R1018_FileBrowserPublishedAgainAtOnce
+    filebrowser_restart_gate_test.go:129: FileBrowser was not published again after its restart — files.<domain> stays 502 until a base-stack round
+--- FAIL: TestRestartStack_R1018_FileBrowserPublishedAgainAtOnce (10.31s)
+FAIL
+FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	10.318s
+## restored
+--- PASS: TestRestartStack_R1018_FileBrowserPublishedAgainAtOnce (0.31s)
+ok  	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	0.320s
@@ -0,0 +1,47 @@
+## 19:43:05 — FileBrowser 1.5.6 with auth.methods.proxy {enabled, header X-Felhom-User} on scratch 9202
+### control route filesopen (no middleware)
+no header:            401
+forged header:        200  body: {"name":"scratch_hdd","size":132976640,"modified":"2026-10-18T20:34:20.752138936+02:00","type":"directory","hidden":fals
+### strip route filesspike (forwardAuth -> controller /api/health, authResponseHeaders [X-Felhom-User])
+no header:            404  body: 
+<!DOCTYPE html>
+<html lang="hu">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initi
+forged header:        404  body: 
+<!DOCTYPE html>
+<html lang="hu">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initi
+forged, other case:   404
+forged, twice:        404
+
+## 19:44:02 — auth stand-in: /always = 200 and NO user header; /cookie = 200 + X-Felhom-User: household-sso only with cookie spike=ok
+### filesspike (forwardAuth /always, authResponseHeaders [X-Felhom-User])
+header [none]: 401 {"status":401,"message":"no token present in request"}
+header [X-Felhom-User: spike-stranger2]: 401 {"status":401,"message":"no token present in request"}
+header [x-felhom-user: spike-stranger3]: 401 {"status":401,"message":"no token present in request"}
+two forged headers: 401 {"status":401,"message":"no token present in request"}
+### filessso (forwardAuth /cookie)
+forged header, no cookie: 401 
+cookie ok, no header: 404 404 page not found 
+cookie ok + forged header attacker: 404 404 page not found 
+### filessso again, on the drive listing (19:44:14)
+cookie ok, no header: 200 {"name":"scratch_hdd","size":132976640,"modified":"2026-10-18T20:34:20.752138936+02:00","t
+cookie ok + forged header attacker: 200 {"name":"scratch_hdd","size":132976640,"modified":"2026-10-18T20:34:20.752138936+02:00","t
+cookie wrong + forged header attacker: 401 
+### FileBrowser's own request log (user column) since 19:43
+2026/10/18 21:43:05[33m GET     | 401 | 172.18.0.3      | N/A          | 0ms          | "/api/resources?path=%2F&source=SCRATCH%20HDD"[0m
+2026/10/18 21:43:05 GET     | 200 | 172.18.0.3      | spike-stra.. | 80ms         | "/api/resources?path=%2F&source=SCRATCH%20HDD"
+2026/10/18 21:44:02[33m GET     | 401 | 172.18.0.3      | N/A          | 0ms          | "/api/resources?path=%2F&source=SCRATCH%20HDD"[0m
+2026/10/18 21:44:02[33m GET     | 401 | 172.18.0.3      | N/A          | 0ms          | "/api/resources?path=%2F&source=SCRATCH%20HDD"[0m
+2026/10/18 21:44:02[33m GET     | 401 | 172.18.0.3      | N/A          | 0ms          | "/api/resources?path=%2F&source=SCRATCH%20HDD"[0m
+2026/10/18 21:44:02[33m GET     | 401 | 172.18.0.3      | N/A          | 0ms          | "/api/resources?path=%2F&source=SCRATCH%20HDD"[0m
+2026/10/18 21:44:14 GET     | 200 | 172.18.0.3      | household-.. | 79ms         | "/api/resources?path=%2F&source=SCRATCH%20HDD"
+2026/10/18 21:44:14 GET     | 200 | 172.18.0.3      | household-.. | 2ms          | "/api/resources?path=%2F&source=SCRATCH%20HDD"
+### an app container on traefik-public talks to FileBrowser directly, no router (19:44:27)
+from nextcloud, no header: 401
+from nextcloud, forged X-Felhom-User: app-forged: 200
+nextcloud networks: nextcloud_nextcloud-internal traefik-public 
@@ -0,0 +1,6 @@
+login 200 token_len 355
+users 200 [(1, 'admin', 'password'), (2, 'spike-stranger', 'proxy'), (3, 'household-sso', 'proxy'), (4, 'app-forged', 'proxy')]
+delete spike-stranger 200 
+delete household-sso 200 
+delete app-forged 200 
+users after 200 [(1, 'admin')]
@@ -0,0 +1,11 @@
+0
+2026/10/18 21:46:05 [INFO ] Auth Methods             : [password]
+0
+controller.yml
+filebrowser.yml
+forwarded.yml
+serverstransports.yml
+felhom-filebrowser traefik-public 
+filesspike: 404
+filesopen: 404
+files: 401
@@ -0,0 +1,59 @@
+# R-1100 — one sign-in for the dashboard and FileBrowser: the spike (2026-10-18 evening)
+
+Measured on scratch 9202 (demo-hp, Tier 0): FileBrowser Quantum `gtstef/filebrowser:1.5.6-stable` (source read at tag
+`v1.5.6-stable`, commit `5d9b4df2`), Traefik v3.7.13, controller 0.331.0-rc.1. Nothing was built; every change on 9202 was
+removed (`03-teardown.txt`). Evidence: `01-strip.txt` (every request and answer), `02-teardown-users.txt`.
+
+## What FileBrowser's proxy auth is (source, at the pinned tag)
+
+- The config key is **`auth.methods.proxy`** (`backend/common/settings/auth.go:58`, json `proxy` — not `proxyAuth`, as the
+  row said), with `enabled` and `header` (`auth.go:75-78`: „FileBrowser blindly accepts the header value as username").
+- Any request that carries the header is that user (`backend/http/middleware.go:302-307` on login, `:384-401` on every API
+  call, `:494-520` `getProxyUser`). **A name FileBrowser has never seen is created on the spot**
+  (`backend/http/auth.go:81-106`), with the user defaults. A name that exists as a password user is refused
+  (`auth.go:107-108`, `ErrWrongLoginMethod`) — so the household's `admin` cannot be reached by a header; a header user
+  is a separate FileBrowser user.
+
+## What was measured
+
+| Request | Answer |
+|---|---|
+| a route with no middleware, forged `X-Felhom-User: spike-stranger` | **200 — the drive's listing**; FileBrowser created the user |
+| Traefik `forwardAuth` that answers 200 and sets NO user header, `authResponseHeaders: [X-Felhom-User]`; forged header (also lower-case, also twice) | **401** from FileBrowser („no token present") — Traefik removed the client's header |
+| `forwardAuth` that sets `X-Felhom-User: household-sso` only for a valid cookie; cookie ok + forged `attacker` | 200 as **`household-sso`** (FileBrowser's own request log names the user) — the auth answer replaced the forged value |
+| the same, wrong cookie + forged header | 401 from the auth step; FileBrowser never reached |
+| **from inside the Nextcloud container**, straight to `http://filebrowser:80`, forged header | **200** — no Traefik on that path |
+
+So: **Traefik can pass the header only for a valid session and strips one a client sends — proven.** But the header is
+also trusted from any container that reaches FileBrowser's port, and every app sits on `traefik-public` with it.
+
+## The three things a build must solve
+
+1. **The session cannot be read on `files.<domain>`.** The dashboard cookie `felhom_session` has no `Domain`
+   (`controller/internal/web/auth.go:197-205`), so a browser never sends it to `files.<domain>`, and a forward-auth there
+   sees nothing. **Do not widen it to `Domain=<domain>`**: every app's subdomain — third-party code — would then receive the
+   dashboard session. Instead a files-only ticket: „Fájlok ↗" goes through the dashboard, which mints a one-time,
+   ~60-second token; `files.<domain>/_felhom/sso?t=…` (a Traefik route to the controller) swaps it for a host-only,
+   HttpOnly, Secure cookie for `files.<domain>`; the forward-auth checks that cookie and answers the header.
+2. **Any app container can forge the header** (measured). Two cheap closes, either enough, both better:
+   (a) **the header name is a per-box secret** (`X-Felhom-User-<32 hex>`), written only into FileBrowser's config and
+   Traefik's dynamic file — an app that does not know the name cannot send it; (b) FileBrowser **off `traefik-public`**:
+   Traefik joins `felhom-filebrowser` instead (and OnlyOffice too, for its `server.internalUrl`, R-1018). (b) changes the
+   R-1126 gate's shape; (a) does not.
+3. **Header users are new FileBrowser users.** The household's files permissions for that user must be set by the box (the
+   user defaults decide today); shares the household made as `admin` stay `admin`'s; logout needs
+   `logoutRedirectUrl` to the dashboard.
+
+## Unchanged by it
+
+- **The password reveal (R-513)** stays: `admin` remains a password user — the fallback when the ticket path fails, and
+  the operator's. The „Fájlok ↗" button would no longer need it.
+- **The R-1126 gate** keeps checking `admin`'s default login; header users do not touch it.
+
+## Cost and recommendation
+
+Controller only (no agent, no hub): a ticket endpoint and a forward-auth endpoint, one Traefik route + middleware, the
+FileBrowser config block with a secret header name, the header user's permissions, tests for each refusal (forged header
+via Traefik; forged header from an app container — with a secret name; stale/replayed ticket; wrong host). About one
+release. **Recommendation: build it with (1) the ticket cookie and (2a) the secret header name**; do not ship header
+trust without 2a — the measured app-container path would hand every app the household's files.
@@ -0,0 +1,41 @@
+run at 19:49:37
+{"ok": true, "message": "Mentés elindítva"}
+2026/10/18 19:49:38 dbdump.go:171: [DEBUG] DiscoverDatabases: skipping container immich-server (image=ghcr.io/immich-app/immich-server:v3.2.4, not a database)
+2026/10/18 19:49:38 dbdump.go:178: [DEBUG] DiscoverDatabases: found postgres container: immich-postgres (id=5865007e1ebd)
+2026/10/18 19:49:38 dbdump.go:198: [DEBUG] DiscoverDatabases: immich-postgres → stack=immich, dbUser=immich, dbName=immich
+2026/10/18 19:49:38 dbdump.go:171: [DEBUG] DiscoverDatabases: skipping container immich-machine-learning (image=ghcr.io/immich-app/immich-machine-learning:v3.2.4, not a database)
+2026/10/18 19:49:38 dbdump.go:171: [DEBUG] DiscoverDatabases: skipping container immich-redis (image=redis:7-alpine, not a database)
+2026/10/18 19:49:39 dbdump.go:277: [DEBUG] DumpOne: starting dump for container=immich-postgres, stack=immich, dbType=postgres, dest=/mnt/sizing-bench/backups/primary/immich/db-dumps/immich-postgres.s
+2026/10/18 19:49:39 dbdump.go:314: [DEBUG] DumpOne: pg_dump command: docker exec 5865007e1ebd pg_dump -U immich -d immich --clean --if-exists --no-owner --no-privileges
+2026/10/18 19:49:40 dbdump.go:424: [DEBUG] DumpOne: completed immich-postgres → immich-postgres.sql (size=51.2 MB, valid=true, tables=71, duration=1.179s)
+2026/10/18 19:49:40 dbdump.go:429: [INFO] [backup] DB dump: immich-postgres → immich-postgres.sql (51.2 MB, 1.179s, 71 tables)
+2026/10/18 19:49:40 data_versions.go:131: [DEBUG] [backup] immich: stamped db-dumps/immich-postgres.sql (53711499 B) with pins [ghcr.io/immich-app/immich-server:v3.2.4@sha256:d317916b28090c33eb36b3084
+2026/10/18 19:49:40 backup.go:1003: [INFO] [backup] Stopping immich for safe volume dump
+2026/10/18 19:49:41 backup.go:877: [DEBUG] [backup] Dumping volume immich_immich_ml_cache for immich
+unit=
+/mnt/sizing-bench/backups/primary/immich/:
+total 36
+drwxr-xr-x 5 root root 4096 19:50:44 .
+drwxr-xr-x 3 root root 4096 14:09:21 ..
+drwxr-xr-x 2 root root 4096 19:50:44 compose
+-rw-r--r-- 1 root root 4889 19:49:49 data-stamps.json
+drwxr-xr-x 2 root root 4096 19:49:40 db-dumps
+-rw-r--r-- 1 root root 7983 19:50:44 manifest.json
+drwxr-xr-x 2 root root 4096 19:49:49 volume-dumps
+
+/mnt/sizing-bench/backups/primary/immich/volume-dumps/:
+total 1111744
+drwxr-xr-x 2 root root      4096 19:49:49 .
+drwxr-xr-x 5 root root      4096 19:50:44 ..
+-rw-r--r-- 1 root root 823764480 19:49:42 immich_immich_ml_cache.tar
+-rw-r--r-- 1 root root 283049472 19:49:47 immich_immich_postgres_data.tar
+-rw-r--r-- 1 root root  31591424 19:49:49 immich_immich_redis_data.tar
+2026/10/18 19:49:41 backup.go:877: [DEBUG] [backup] Dumping volume immich_immich_ml_cache for immich
+2026/10/18 19:49:46 backup.go:877: [DEBUG] [backup] Dumping volume immich_immich_postgres_data for immich
+2026/10/18 19:49:49 backup.go:877: [DEBUG] [backup] Dumping volume immich_immich_redis_data for immich
+2026/10/18 19:49:49 backup.go:1019: [INFO] [backup] Restarting immich after volume dump
+2026/10/18 19:49:59 manager.go:920: [DEBUG] [stacks] restart-policy of down member "immich-server" = "unless-stopped"
+2026/10/18 19:50:44 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for immich → /mnt/sizing-bench/backups/primary/immich (images=4, secrets-referenced=1, data_keys=
+immich_immich_ml_cache
+immich_immich_postgres_data
+immich_immich_redis_data
@@ -0,0 +1,13 @@
+edited /opt/docker/stacks/immich/docker-compose.yml
+132c132
+<     command: redis-server --appendonly no
+---
+>     command: redis-server --save "" --appendonly no
+135,136c135,136
+<     volumes:
+<       - immich_redis_data:/data
+---
+>     tmpfs:
+>       - /data
+152d151
+<   immich_redis_data:
@@ -0,0 +1,44 @@
+restart at 19:52:31
+{"ok": true, "data": {"state": "starting"}, "message": "Stack immich restart requested — state now: starting"}
+immich-server Up About a minute (healthy)
+immich-postgres Up About a minute (healthy)
+immich-machine-learning Up About a minute (healthy)
+immich-redis Up About a minute (healthy)
+mounts: volume:immich_immich_redis_data/data  tmpfs: map[/data:]
+save  
+39
+backgroundTask backupDatabase duplicateDetection editor faceDetection facialRecognition integrityCheck library metadataExtraction migration notifications ocr 
+{"res":"pong"}
+[32m[Nest] 29  - [39m10/18/2026, 9:52:51 PM [32m    LOG[39m [33m[Api:RoutesResolver][39m [32mJobController {/api/jobs}:[39m
+[32m[Nest] 29  - [39m10/18/2026, 9:52:51 PM [32m    LOG[39m [33m[Api:RouterExplorer][39m [32mMapped {/api/jobs, GET} route[39m
+[32m[Nest] 29  - [39m10/18/2026, 9:52:51 PM [32m    LOG[39m [33m[Api:RouterExplorer][39m [32mMapped {/api/jobs, POST} route[39m
+[32m[Nest] 29  - [39m10/18/2026, 9:52:51 PM [32m    LOG[39m [33m[Api:RouterExplorer][39m [32mMapped {/api/jobs/:name, PUT} route[39m
+[32m[Nest] 29  - [39m10/18/2026, 9:52:51 PM [32m    LOG[39m [33m[Api:RouterExplorer][39m [32mMapped {/api/queues/:name/jobs, GET} route[39m
+[32m[Nest] 29  - [39m10/18/2026, 9:52:51 PM [32m    LOG[39m [33m[Api:RouterExplorer][39m [32mMapped {/api/queues/:name/jobs, DELETE} route[39m
+old volume: immich_immich_redis_data labels=map[com.docker.compose.config-hash:730e1778edc1a7fb43e276ccfc1c6e7d304775266ab19bae03c9ebec05eaf65b com.docker.compose.project:immich com.docker.compose.version:5.5.1 com.docker.compose.volume:immich_redis_data]
+used by: immich-redis
+tmpfs /data tmpfs rw,nosuid,nodev,noexec,relatime,mode=755,uid=100000,gid=100000,inode64 0 0
+total 4
+drwxr-xr-x    2 redis    root            40 Oct 18 21:52 .
+drwxr-xr-x    1 root     root          4096 Oct 18 21:52 ..
+[{"Type":"volume","Name":"immich_immich_redis_data","Source":"/var/lib/docker/volumes/immich_immich_redis_data/_data","Destination":"/data","Driver":"local","Mode":"z","RW":true,"Propagation":""}]
+{"com.docker.compose.config-hash":"888272c2acd984cb6996f81bd49b41bdd8d6b2318870cd1a2088ec554dbf0fed"
+"com.docker.compose.depends_on":""
+"com.docker.compose.replace":"immich-redis"
+19:54:10 backgroundTask id= completed=0 failed=0
+19:54:10 library id= completed=0 failed=0
+19:54:10 migration id= completed=0 failed=0
+19:54:10 notifications id= completed=0 failed=0
+19:54:10 metadataExtraction id= completed=0 failed=0
+19:54:10 thumbnailGeneration id= completed=0 failed=0
+19:55:27 backgroundTask id= completed=0 failed=0
+19:55:27 library id= completed=0 failed=0
+19:55:27 migration id= completed=0 failed=0
+19:55:27 notifications id= completed=0 failed=0
+19:55:27 metadataExtraction id= completed=0 failed=0
+19:55:27 thumbnailGeneration id= completed=0 failed=0
+token_len 39
+photos 10 videos 0
+start metadataExtraction (force): 200
+metadataExtraction {'active': 0, 'completed': 0, 'failed': 0, 'delayed': 0, 'waiting': 0, 'paused': 0} {'isPaused': False, 'isActive': False}
+redis: metadataExtraction id=11
@@ -0,0 +1,16 @@
+restore pressed 19:56:29
+302 
+2026/10/18 19:56:29 handlers.go:1831: [DEBUG] [web] backupRestoreHandler: stack=immich snapshot=latest from 172.18.0.3:48626
+2026/10/18 19:56:29 handlers.go:1868: [WARN] [web] restore refused for immich: unit carries no file leg (1 drive path(s))
+---
+immich-server Up 9 minutes (healthy)
+immich-postgres Up 9 minutes (healthy)
+immich-machine-learning Up 9 minutes (healthy)
+immich-redis Up 9 minutes (healthy)
+{"res":"pong"}
+redis mounts: volume:immich_immich_redis_data/data 
+tmpfs /data tmpfs
+immich_immich_redis_data created=2026-10-14T14:06:06Z labels=map[com.docker.compose.config-hash:730e1778edc1a7fb43e276ccfc1c6e7d304775266ab19bae03c9ebec05eaf65b com.docker.compose.project:immich com.docker.compose.version:5.5.1 com.docker.compose.volume:immich_redis_data]
+
+## second-drive unit restore pressed 20:03:36 (unit of 2026-10-18 00:30 UTC, made WITH immich_immich_redis_data.tar)
+302 
@@ -0,0 +1,31 @@
+## Nextcloud: tier-2 copy WITH the Redis volume, started 20:05:16
+{"ok": true, "message": "2. mentés elindítva"}
+20:05:17
+2026/10/18 20:05:17 auth.go:144: [DEBUG] [web] auth: valid session for POST /api/backup/tier2
+2026/10/18 20:05:17 router.go:78: [DEBUG] [api] POST /api/backup/tier2 (path=/backup/tier2)
+2026/10/18 20:05:17 router.go:1323: [INFO] [api] Manual Tier 2 (off-drive) backup triggered
+2026/10/18 20:05:27 tier2.go:470: [INFO] [backup] Tier 2 copied immich → /mnt/felhom-drives/scratch_hdd/backups/secondary/immich (1.2 GB, 2 leg(s), 11s)
+2026/10/18 20:05:30 tier2.go:470: [INFO] [backup] Tier 2 copied nextcloud → /mnt/sizing-bench/backups/secondary/nextcloud (1011.9 MB, 1 leg(s), 3s)
+2026/10/18 20:05:30 tier2.go:470: [INFO] [backup] Tier 2 copied paperless-ngx → /mnt/sizing-bench/backups/secondary/paperless-ngx (125.8 MB, 1 leg(s), 0s)
+2026/10/18 20:05:31 tier2.go:470: [INFO] [backup] Tier 2 copied privatebin → /mnt/felhom-drives/scratch_hdd/backups/secondary/privatebin (8.3 KB, 0 leg(s), 0s)
+2026/10/18 20:05:31 tier2.go:526: [INFO] [backup] Tier 2 run complete: 4 app(s) processed (incl. volume-only — F6)
+/mnt/felhom-drives/scratch_hdd/backups/secondary/immich
+/mnt/felhom-drives/scratch_hdd/backups/secondary/privatebin
+/mnt/sizing-bench/backups/secondary/nextcloud
+/mnt/sizing-bench/backups/secondary/paperless-ngx
+/mnt/sys_drive/felhom-data/backups/secondary/paperless-ngx
+/mnt/felhom-drives/scratch_hdd/backups/primary/nextcloud/volume-dumps/:
+total 964000
+drwxr-xr-x 2 root root      4096 19:50:15 .
+drwxr-xr-x 5 root root      4096 19:50:44 ..
+-rw-r--r-- 1 root root 170889216 19:50:05 nextcloud_nextcloud_db_data.tar
+-rw-r--r-- 1 root root 816219136 19:50:11 nextcloud_nextcloud_html.tar
+-rw-r--r-- 1 root root     11776 19:50:04 nextcloud_nextcloud_redis_data.tar
+
+/mnt/sizing-bench/backups/secondary/nextcloud/recovery-unit/volume-dumps/:
+total 964004
+drwxr-xr-x 2 root root      4096 19:50:15 .
+drwxr-xr-x 5 root root      4096 19:50:44 ..
+-rw-r--r-- 1 root root 170889216 19:50:05 nextcloud_nextcloud_db_data.tar
+-rw-r--r-- 1 root root 816219136 19:50:11 nextcloud_nextcloud_html.tar
+-rw-r--r-- 1 root root     11776 19:50:04 nextcloud_nextcloud_redis_data.tar
@@ -0,0 +1,26 @@
+edited /opt/docker/stacks/nextcloud/docker-compose.yml
+110c110
+<     command: redis-server --appendonly no
+---
+>     command: redis-server --save "" --appendonly no
+113,114c113,114
+<     volumes:
+<       - nextcloud_redis_data:/data
+---
+>     tmpfs:
+>       - /data
+131d130
+<   nextcloud_redis_data:
+restart at 20:06:47
+{"ok": true, "data": {"state": "starting"}, "message": "Stack nextcloud restart requested — state 
+nextcloud Up 52 seconds (healthy)
+nextcloud-db Up 58 seconds (healthy)
+nextcloud-redis Up 57 seconds (healthy)
+tmpfs /data tmpfs
+save  
+{"installed":true,"version":"34.0.4.1","versionstring":"34.0.4","edition":"","maintenance":false,"needsDbUpgrade":false,"productname":"Nextcloud","extendedSupport":false}
+
+cron rc=0
+5
+nextcloud-redis
+webdav GET: 200
@@ -0,0 +1,49 @@
+## Nextcloud second-drive restore pressed 20:09:28 â€” the copy made WITH nextcloud_nextcloud_redis_data.tar; the live compose has NO Redis volume
+302 
+2026/10/18 20:09:28 tier2_whole.go:304: [WARN] [backup] WHOLE restore for nextcloud from the second drive /mnt/sizing-bench/backups/secondary/nextcloud: files by the four rules (never delete, never ov
+2026/10/18 20:09:30 tier2_whole.go:326: [INFO] [backup] whole restore nextcloud: files restored=1 replaced=0 (live kept beside as *.felhom-20261018T200930Z) kept-newer=2 unchanged=106
+2026/10/18 20:09:30 restore_dbcreds.go:114: [INFO] [backup] Restore nextcloud: database password(s) [DB_PASSWORD MYSQL_ROOT_PASSWORD] come from the backup, [] stay as installed (older than the data) â
+2026/10/18 20:09:30 restore_unit.go:393: [INFO] [backup] Restoring nextcloud from recovery unit /mnt/sizing-bench/backups/secondary/nextcloud/recovery-unit: images=3, secrets recovered=3/3, data_keys=
+2026/10/18 20:09:30 restore.go:215: [INFO] [backup] Restoring Docker volume nextcloud_nextcloud_db_data for nextcloud
+---
+Error response from daemon: No such container: nextcloud
+
+
+error: no such object: nextcloud-redis
+Error response from daemon: No such container: nextcloud-redis
+nextcloud_nextcloud_redis_data created=2026-10-18T18:31:13Z labels=map[com.docker.compose.config-hash:d0c5aae5dee81a25758afbc72c23a510ae97ef5e5c37c02afce24bb9b83e5515 com.docker.compose.project:nextcloud com.docker.compose.version:5.6.0 com.docker.compose.volume:nextcloud_redis_data]
+webdav GET after restore: 404
+## after the restore (20:10:37)
+2026/10/18 20:09:30 restore.go:215: [INFO] [backup] Restoring Docker volume nextcloud_nextcloud_db_data for nextcloud
+2026/10/18 20:09:32 restore.go:253: [DEBUG] [backup] Volume nextcloud_nextcloud_db_data restored successfully
+2026/10/18 20:09:32 restore.go:215: [INFO] [backup] Restoring Docker volume nextcloud_nextcloud_html for nextcloud
+2026/10/18 20:09:42 restore.go:253: [DEBUG] [backup] Volume nextcloud_nextcloud_html restored successfully
+2026/10/18 20:09:42 restore.go:215: [INFO] [backup] Restoring Docker volume nextcloud_nextcloud_redis_data for nextcloud
+2026/10/18 20:09:43 restore.go:253: [DEBUG] [backup] Volume nextcloud_nextcloud_redis_data restored successfully
+2026/10/18 20:09:43 restore.go:258: [INFO] [backup] Restored 3 Docker volume(s) for nextcloud
+2026/10/18 20:09:43 restore_db.go:87: [INFO] [backup] Restore nextcloud: replaying DB dump into nextcloud-db (mariadb)
+2026/10/18 20:09:57 restore_db.go:97: [INFO] [backup] Restore nextcloud: replayed 1 DB dump(s)
+2026/10/18 20:10:06 restore.go:298: [DEBUG] [backup] Post-restore health check: nextcloud not yet running, waiting...
+2026/10/18 20:10:11 restore.go:293: [DEBUG] [backup] Post-restore health check: nextcloud is running
+2026/10/18 20:10:11 restore_unit.go:494: [INFO] [backup] Restore-from-unit completed: nextcloud â€” 3 volume(s) of 3 listed, 1 database(s) of 1 listed
+2026/10/18 20:10:11 tier2_restore.go:255: [INFO] [backup] nextcloud: primary unit already carries data â€” left untouched (R-403 never overwrites a richer package with a poorer one)
+2026/10/18 20:10:11 handlers.go:2281: [INFO] [web] Tier-2 whole restore completed (async): stack=nextcloud in 42.745438966s (files restored 1, replaced 0, kept-newer 2, unchanged 106; volumes 3/3, dbs 1/1)
+---
+nextcloud Up 36 seconds (healthy)
+nextcloud-redis Up 41 seconds (healthy)
+nextcloud-db Up 55 seconds (healthy)
+{"installed":true,"version":"34.0.4.1","versionstring":"34.0.4","edition":"","maintenance":false,"needsDbUpgrade":false,"productname":"Nextcloud","extendedSupport":false}
+
+redis mounts: volume:nextcloud_nextcloud_redis_data/data 
+/dev/loop1 /data ext4
+drwxr-xr-x    2 redis    redis         4096 Oct 18 22:09 .
+drwxr-xr-x    1 root     root          4096 Oct 18 22:09 ..
+-rw-------    1 redis    redis         9368 Oct 18 21:50 dump.rdb
+nextcloud_nextcloud_redis_data created=2026-10-18T20:09:42Z labels=map[com.docker.compose.project:nextcloud com.docker.compose.version:5.6.0 com.docker.compose.volume:nextcloud_redis_data]
+total 20
+drwxr-xr-x    2 999      1000          4096 Oct 18 20:09 .
+drwxr-xr-x    1 root     root          4096 Oct 18 20:10 ..
+-rw-------    1 999      1000          9368 Oct 18 19:50 dump.rdb
+used by: nextcloud-redis
+2
+webdav GET after restore: 200
@@ -0,0 +1,13 @@
+## backup run with Immich on the NO-volume compose, 20:11:01
+1
+{"ok": true, "message": "Mentés elindítva"}
+20:12:06
+2026/10/18 20:11:04 backup.go:877: [DEBUG] [backup] Dumping volume immich_immich_ml_cache for immich
+2026/10/18 20:11:09 backup.go:877: [DEBUG] [backup] Dumping volume immich_immich_postgres_data for immich
+2026/10/18 20:11:20 recovery_unit.go:289: [INFO] [backup] Recovery unit captured for immich → /mnt/sizing-bench/backups/primary/immich (images=4, secrets-referenced=1, data_keys=0, portable-carried=
+total 1080892
+drwxr-xr-x 2 root root      4096 20:11:12 .
+drwxr-xr-x 5 root root      4096 20:11:20 ..
+-rw-r--r-- 1 root root 823764480 20:11:05 immich_immich_ml_cache.tar
+-rw-r--r-- 1 root root 283049472 20:11:10 immich_immich_postgres_data.tar
+manifest volume_dumps: ['immich_immich_ml_cache.tar', 'immich_immich_postgres_data.tar']
@@ -0,0 +1,13 @@
+## after the template push (catalog 30eea97) and the sync, 20:25:49
+/opt/docker/stacks/nextcloud/docker-compose.yml:110:    command: redis-server --save "" --appendonly no
+/opt/docker/stacks/nextcloud/docker-compose.yml:113:    tmpfs:
+/opt/docker/stacks/immich/docker-compose.yml:17:#   Redis data         → immich_redis_data       (named volume, NVMe)
+/opt/docker/stacks/immich/docker-compose.yml:132:    command: redis-server --save "" --appendonly no
+/opt/docker/stacks/immich/docker-compose.yml:135:    tmpfs:
+{"ok": true, "data": {"state": "starting"}, "message": "Stack nextcloud restart 
+nextcloud Up 52 seconds (healthy)
+nextcloud-redis Up 57 seconds (healthy)
+nextcloud-db Up 57 seconds (healthy)
+tmpfs /data tmpfs
+save  
+{"installed":true,"version":"34.0.4.1","versionstring":"34.0.4","edition":"","ma
@@ -0,0 +1,22 @@
+22:28:23   [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'nextcloud', 'volumes_removed': ['nextcloud_nextcloud_db_data', 'nextcloud_nextcloud_html'], 'hdd_paths_removed': ['/mnt/felhom
+22:28:32   [X] after remove: deployed=False leftovers='/opt/docker/stacks/nextcloud'
+remove: 200
+0
+nextcloud_nextcloud_redis_data
+ls: cannot access '/mnt/felhom-drives/scratch_hdd/backups/primary/nextcloud': No such file or directory
+ls: cannot access '/mnt/sizing-bench/backups/secondary/nextcloud': No such file or directory
+/mnt/felhom-drives/scratch_hdd/userdata/nextcloud
+ls: cannot access '/mnt/felhom-drives/scratch_hdd/userdata/r1018': No such file or directory
+S10-box-fresh-768-noswap.txt
+S2-box-positive.txt
+controller.yaml.pre-lock-probe
+daemon.json.bak-2026-10-04
+pgsample.sh
+r626-events.txt
+repoint-night1005.sh
+shots
+sizing
+0
+nextcloud_nextcloud_redis_data map[com.docker.compose.project:nextcloud com.docker.compose.version:5.6.0 com.docker.compose.volume:nextcloud_redis_data]
+nextcloud_nextcloud_redis_data
+0
@@ -0,0 +1,9 @@
+## red-proof: the leftover loop removed from RemoveStack
+=== RUN   TestR1117_RemoveDeletesALabelledVolumeTheDefinitionNoLongerDeclares
+    r1117_leftover_volume_test.go:66: left behind: [app_app_redis_data] — a volume with the app's project label outlived its removal
+--- FAIL: TestR1117_RemoveDeletesALabelledVolumeTheDefinitionNoLongerDeclares (26.02s)
+FAIL
+FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	26.027s
+## restored
+--- PASS: TestR1117_RemoveDeletesALabelledVolumeTheDefinitionNoLongerDeclares (26.02s)
+ok  	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	26.027s
				`@@ -0,0 +1 @@`
				`Felhom — Doboz összekötése Felhom doboz összekötése Sikeres összekötés. A doboz kb. egy percen belül folytatja a telepítést. Ezt az oldalt bezárhatod — a beállítás a háttérben befejeződik, és a vezérlőpultod hamarosan elérhető lesz. Felhom.eu`
				`@@ -0,0 +1 @@`
				`{"ok":false,"error":"dashboard not yet claimed"}`