fixes 2026-10-21: evidence so far (R-1176 live proof, R-1192 freeze measured, R-1191 on 9202); design notes 03 §8a / 07 §7.0, §8.2a (D25) / 05 §16.5 (DST)

documentation/audits/fixes-2026-10-21/tools/install7.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+"""install7.py — the rehearsal's other seven apps, installed one by one through the install API (the request the install
+page sends), each waited on until running. Passwords from env names (under `sec run`); nothing secret is printed."""
+import json, os, sys, time
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import ctl
+B = "/mnt/felhom-drives/belso"
+E = os.environ
+apps = [
+    ("immich", {"SUBDOMAIN": "photos", "HDD_PATH": B}),
+    ("paperless-ngx", {"SUBDOMAIN": "paperless", "HDD_PATH": B, "PAPERLESS_ADMIN_USER": "irisz", "PAPERLESS_ADMIN_PASSWORD": E["REHEARSAL_2026_10_20_IRISZ_PW"], "PAPERLESS_OCR_LANGUAGE": "hun+eng"}),
+    ("vaultwarden", {"SUBDOMAIN": "vault", "SIGNUPS_ALLOWED": "true"}),
+    ("mealie", {"SUBDOMAIN": "recipes", "ADMIN_PASSWORD": E["REHEARSAL_2026_10_20_KATA_PW"]}),
+    ("actualbudget", {"SUBDOMAIN": "budget"}),
+    ("radicale", {"SUBDOMAIN": "calendar", "RADICALE_USER": "csalad", "RADICALE_PASSWORD": E["REHEARSAL_2026_10_20_APP_RADICALE"]}),
+    ("bookstack", {"SUBDOMAIN": "wiki", "ADMIN_PASSWORD": E["REHEARSAL_2026_10_20_APP_BOOKSTACK"]}),
+]
+def say(*a): print(time.strftime("%H:%M:%SZ", time.gmtime()), *a, flush=True)
+for name, vals in apps:
+    t0 = time.time()
+    c, b = ctl.call("POST", f"/api/stacks/{name}/deploy", {"stack_name": name, "values": vals})
+    say(name, "deploy", c, (b.get("message") or b.get("error") or "")[:200] if isinstance(b, dict) else b)
+    if c not in ("200", "202"):
+        continue
+    while time.time() - t0 < 900:
+        time.sleep(10)
+        c2, d = ctl.call("GET", f"/api/stacks/{name}")
+        dd = (d.get("data") or {}) if isinstance(d, dict) else {}
+        if not dd.get("deploying") and dd.get("state") in ("running", "error", "stopped"):
+            break
+    say(name, "→", dd.get("state"), f"{int(time.time()-t0)} s")
+c, d = ctl.call("GET", "/api/system/memory")
+say("memory:", json.dumps(d, ensure_ascii=False)[:400])