security watch sees runtimes (R-1327) and DooPlex (R-1328); HTTP2Shell rows R-1329–R-1332; R-1326 closed
gates / gates (push) Successful in 3m27s
gates / gates (push) Successful in 3m27s
- scripts/image_runtime.py: Node / Python Brotli / brotlicffi / apk / dpkg read from an image's registry config and layers (no pull; HEAD for the nightly digest; zstd via the zstd program where present; quay.io, index.docker.io). - security_watch.py: a „runtime" source (security_watch_runtimes.json), cached by digest in state.json (154 images, filled on DooPlex tonight); ghcr.io tag lists are paged; the DooPlex group (own block, homelab next-step). - dooplex_inventory.py + documentation/security-watch/dooplex-workloads.txt (89 images, homelab-manifests 5aeec8d). - Tests W10–W12 (58 checks) + test_image_runtime.py (13), each red-proved. - audits/http2shell-2026-10-27: the Home Assistant lane walk (proven), HOMELAB-LIST.md (19 to update), the run log. - 08 §11 design line; 09 §3 decision 276 (HA monthly = same main version; decided by CC unattended).
This commit is contained in:
admin committed
1 parent
503692a1da
commit
f5a4995da5
21 files changed
+3498
-29
No files matched your search
@@ -684,3 +684,16 @@ The memory is `documentation/security-watch/state.json`, committed by the job it
|
||||
that it did. A job that does not finish mails „[felhom CI] security watch FAILED". The mail starts the security-fix lane
|
||||
(capability map B23).
|
||||
|
||||
**[DESIGN — R-1327/R-1328, built 2026-10-27 night, commit only] A fourth source, „runtime", and a third group,
|
||||
„DooPlex".** HTTP2Shell (CVE-2026-111497) sat in the Node.js and Python Brotli INSIDE app images, where no app notice
|
||||
mentions it. The watch now reads each pin's image (`scripts/image_runtime.py`: the registry config, then only where
|
||||
needed the layers — Alpine/Debian package databases, Node's `node_version.h`, Python `.dist-info` — never a pull) and
|
||||
matches it against `scripts/security_watch_runtimes.json`; a hit is an ADVISORY with source „runtime", a read that
|
||||
fails is NOT CHECKED. Results are cached by the tag's digest in `state.json` (`runtime_cache`) and the nightly lookup is
|
||||
a HEAD request (Docker Hub does not count it against the anonymous pull limit — the first run's GETs hit HTTP 429).
|
||||
**Decided by CC unattended 2026-10-27 — operator may reverse:** the CI runner has no zstd (Python 3.13 has none), so
|
||||
images with zstd layers (Home Assistant) are read on DooPlex by a filling run (`--no-mail`, the stored Docker Hub login
|
||||
through `sec run`) and committed into the cache; CI reads them from there and lists a new unread zstd image as NOT
|
||||
CHECKED — instead of a new dependency in CI. The DooPlex group (`documentation/security-watch/dooplex-workloads.txt`,
|
||||
from homelab-manifests) is read the same way and mailed in its own block; Felhom changes nothing on DooPlex.
|
||||
|
||||
@@ -1145,6 +1145,14 @@ its length, and both fixes cost something the household would notice — operato
|
||||
overwrite its records with no login; no box runs it; an installed copy is not touched. *Operator, 2026-10-27 21:33
|
||||
(CC's pick).*
|
||||
|
||||
276. **A Home Assistant monthly release (2026.9 → 2026.10) is the SAME main version for the ladder, so a security fix
|
||||
may ride the lane.** *Decided by CC unattended 2026-10-27 — operator may reverse.* Options: A) the lane — the one
|
||||
comparator (`stacks.CompareImageRefs`, Q3) parses „2026" as the major, a notice id exists (CVE-2026-111497, Python
|
||||
Brotli 1.2.0 → 1.2.1 inside the image); cost: a monthly HA release carries feature changes into the night lane;
|
||||
B) a normal step — cost: a second rule beside the comparator for one app's version shape (Q3 warns that is how a
|
||||
major gets automated by accident). Why A: the brief („a normal step if it counts as a main version in our ladder
|
||||
rules, else the lane") and the one-comparator rule; the box walk + soak is the guard either way.
|
||||
|
||||
### 2026-10-27 (attended release block) — the line-test hold is fixed the same day; R-1218's live proof is waived
|
||||
|
||||
269. **The line-test hold waits until the held app has really slowed down — fixed in the controller the same day.**
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
# DooPlex (homelab) — what to update, from the security watch (R-1328)
|
||||
|
||||
Read only: Felhom changes nothing on DooPlex. Source: the watch's run of 2026-10-27 night over
|
||||
`documentation/security-watch/dooplex-workloads.txt` (homelab-manifests `image:` lines; Helm-chart images are NOT
|
||||
in it). „Catalog ahead" = the Felhom catalog already ships a different (walked) tag of the same image.
|
||||
|
||||
| Image | DooPlex tag | Where | What is bad (fixed in) | Catalog ahead |
|
||||
|---|---|---|---|---|
|
||||
| `actualbudget/actual-server` | `26.10.0` | actualbudget-system/actualbudget.yaml | CVE-2026-111497 — Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | `26.9.0` |
|
||||
| `advplyr/audiobookshelf` | `2.37.1` | audiobookshelf-system/audiobookshelf.yaml | CVE-2026-111497 — Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | — |
|
||||
| `codewithcj/sparkyfitness_server` | `v1.9.0` | workout-system/sparkyfitness.yaml | CVE-2026-111497 — Node.js 24.22.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | `v0.17.3` |
|
||||
| `crocodilestick/calibre-web-automated` | `dev` | calibre-system/cwa.yaml | CVE-2026-111497 — Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322 (fixed: 1.2.1) | `v4.0.8` |
|
||||
| `docker.io/calcom/cal.com` | `v6.2.0` | booking-system/booking.yaml | CVE-2026-111497 — Node.js 20.20.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 22.23.4, 24.22.1, 26.12.1) | — |
|
||||
| `flomp/wanderer-db` | `v0.21.0` | wanderer-system/wanderer.yaml | GHSA-vprp-gr6m-j375 — ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources (fixed: v0.21.2); GHSA-3xp7-7492-j2q6 — ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources (fixed: v0.21.2); GHSA-j9m4-8qwf-jvx6 — SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources (fixed: v0.21.2) | `v0.20.0` |
|
||||
| `flomp/wanderer-web` | `v0.21.0` | wanderer-system/wanderer.yaml | GHSA-vprp-gr6m-j375 — ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources (fixed: v0.21.2); GHSA-3xp7-7492-j2q6 — ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources (fixed: v0.21.2); GHSA-j9m4-8qwf-jvx6 — SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources (fixed: v0.21.2) | `v0.20.0` |
|
||||
| `ghcr.io/gethomepage/homepage` | `v1.13.2` | homepage-system/homepage-orsi.yaml, homepage-system/homepage.yaml | GHSA-669x-4pg4-w24r — Homepage service proxy allows client-controlled methods and bodies to configured widget endpoints (fixed: 2.2.0); CVE-2026-111497 — Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 22.23.4) | — |
|
||||
| `ghcr.io/immich-app/immich-machine-learning` | `v2.7.5` | immich-system/immich.yaml | GHSA-q89f-h332-8q2h — Authenticated SVG upload reaches ImageMagick coders and enables RCE (fixed: v3.2.4); GHSA-h5w4-vjv4-9r5q — Incorrect sanitization of continue URL on the /maintenance endpoint (fixed: a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 — A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API (fixed: v3.2.0) | `v3.2.4` |
|
||||
| `ghcr.io/immich-app/immich-server` | `v2.7.5` | immich-system/immich.yaml | GHSA-q89f-h332-8q2h — Authenticated SVG upload reaches ImageMagick coders and enables RCE (fixed: v3.2.4); GHSA-h5w4-vjv4-9r5q — Incorrect sanitization of continue URL on the /maintenance endpoint (fixed: a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 — A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API (fixed: v3.2.0) | `v3.2.4` |
|
||||
| `ghcr.io/lukegus/termix` | `release-2.9.2` | termix-system/termix.yaml | CVE-2026-111497 — Node.js 26.10.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 26.12.1) | `2.8.0` |
|
||||
| `ghcr.io/paperless-ngx/paperless-ngx` | `3.3.4` | paperless-system/paperless.yaml | CVE-2026-111497 — Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322 (fixed: 1.2.1) | `2.20.15` |
|
||||
| `gitea/gitea` | `1.26.2` | gitea-system/gitea.yaml | GHSA-wx44-9m3m-rjqx — Locked issues and comments still accept reactions through the web UI (fixed: 28.2.0); GHSA-4jmf-h2cm-hg7w — Cross-Site Request Forgery on `POST /{owner}/{repo}/topics` (fixed: 28.2.0); GHSA-8j56-f865-gqq2 — Draft releases include attachment metadata from other repositories (fixed: 28.2.0) | `1.27.3` |
|
||||
| `grafana/grafana` | `13.2.4` | mon-system/monitoring.yaml | GHSA-8xmm-x63g-f6xv — Stored XSS in ResourcePicker component (fixed: no fixed version named yet); GHSA-4724-7jwc-3fpw — Spoofing originalUrl of snapshots (fixed: the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 — Email addresses and usernames can not be trusted (fixed: the range is unreadable — check by hand) | — |
|
||||
| `louislam/uptime-kuma` | `2.5.6` | uptimekuma-system/uptimekuma.yaml | GHSA-qjxc-h5jf-c7rj — GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extra (fixed: the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 — ⬆️ Security Fixes (fixed: 2.5.8); release:louislam/uptime-kuma@2.5.7 — ⬆️ Security Fixes (fixed: 2.5.7) | `2.5.7` |
|
||||
| `outlinewiki/outline` | `1.11.0` | outline-system/outline.yaml | GHSA-x4w3-9p9j-cprh — users.update_role reveals whether a user id from another team exists and which role it has (fixed: 1.12.0); GHSA-rq53-m97j-f2pg — Unpublished documents remain publicly accessible and their shares cannot be revoked (fixed: 1.12.0); GHSA-h6ff-rw9x-5mq2 — Authenticated members can publish documents into private collections through a retained parent link (fixed: 1.12.0) | `1.12.0` |
|
||||
| `redis` | `8.10.2` | plantit-system/plantit.yaml | GHSA-c8h9-259x-jff4 — Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution (fixed: the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 — Lua Use-After-Free may lead to remote code execution (fixed: no fixed version named yet); GHSA-93m2-935m-8rj3 — Use-After-Free in unblock client flow may lead to remote code execution (fixed: no fixed version named yet) | `7.4-alpine` |
|
||||
| `rommapp/romm` | `5.4.0` | arcade-system/romm.yaml | release:rommapp/romm@5.4.1 — While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible (fixed: 5.4.1); CVE-2026-111497 — Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | `5.4.1` |
|
||||
| `vabene1111/recipes` | `2.6.15` | tandoor-system/tandoor.yaml | CVE-2026-111497 — Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) | — |
|
||||
|
||||
**19 images to update.**
|
||||
|
||||
## NOT CHECKED (the watch could not read them)
|
||||
|
||||
- `advplyr/audiobookshelf:2.37.1` — https://hub.docker.com/v2/repositories/advplyr/audiobookshelf/tags: The read operation timed out
|
||||
- `gitea.dooplex.hu/admin/felhom-act-runner:0.1.0` — registry gitea.dooplex.hu: no anonymous token route
|
||||
- `gitea.dooplex.hu/admin/jarr:latest` — registry gitea.dooplex.hu: no anonymous token route
|
||||
- `gitea.dooplex.hu/admin/recipe-importer:latest` — registry gitea.dooplex.hu: no anonymous token route
|
||||
- `gitea.dooplex.hu/admin/revfulop-calendar:1.6.2` — registry gitea.dooplex.hu: no anonymous token route
|
||||
- `gitea.dooplex.hu/admin/sparkyfitness-export:0.3.0` — registry gitea.dooplex.hu: no anonymous token route
|
||||
- `gitea.dooplex.hu/admin/wan-probe:0.1.0` — registry gitea.dooplex.hu: no anonymous token route
|
||||
- `minio/minio:latest` — Docker registry tags of minio/minio: HTTP 401; manifest minio/minio:latest: HTTP 401
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# HTTP2Shell (CVE-2026-111497) — 2026-10-27 night, unattended after 22:40 CET
|
||||
|
||||
The Brotli decoder bug in Node.js (fixed 22.23.4 / 24.22.1 / 26.12.1; 20, 23, 25 get no fix) and Python `brotli`
|
||||
(fixed 1.0.10 / 1.1.1 / 1.2.1) / `brotlicffi` (1.2.1.0). Sources read in the session: the CVE record via security
|
||||
press (Brandefense, Aikido, SOCRadar, Phoenix Security), PYSEC-2026-4322/4323.
|
||||
|
||||
## What the images carry (read from the registries, `scripts/image_runtime.py`, no pull)
|
||||
|
||||
Checked against the live containers on demo-hp 9201 where one runs: Home Assistant 2026.9.4 Python Brotli 1.2.0 (live:
|
||||
1.2.0), RomM 5.3.1 Node 24.18.1 (live: v24.18.1), Paperless 2.20.15 Brotli 1.1.0 (live: 1.1.0). The candidates: Home
|
||||
Assistant 2026.10.4 Brotli **1.2.1**; RomM 5.4.1 (the newest) still Node 24.18.1; Immich v3.3.5 Node **24.22.1**.
|
||||
|
||||
**The whole catalog (the watch's filling run, `--no-mail`):** 20 catalog apps and one box program carry a bad runtime
|
||||
(R-1332); DooPlex: 19 images to update (`HOMELAB-LIST.md`, R-1328). Positive controls named: Home Assistant, RomM;
|
||||
negative control audiobookshelf 2.37.2 CURRENT.
|
||||
|
||||
## Steps (drill only — the live push waits for the operator)
|
||||
|
||||
- **Home Assistant 2026.9.4 → 2026.10.4**, a lane step (`09` §3 decision 276): `walks/home-assistant/` — proven on 9202
|
||||
through the guarded Update (135 s), the seeded owner logged in after, soak peak 30.6 % (anon), no kill, no restart;
|
||||
written to the drill (`3c8ebb5`, superseded step `steps/4f987bb4b035eef9.yml`).
|
||||
- **Immich v3.2.4 → v3.3.5**, a lane step (R-1322): `walks/immich/` (see its walk.txt). 9202's old Immich was removed
|
||||
through the product first (its drive folder kept: the drive path could not be resolved — R-442, right).
|
||||
- **Wanderer hidden** (D59): drill `ee18bff`; the live change is `wanderer-hidden.patch` (not committed to the live
|
||||
catalog at night).
|
||||
- RomM: no fixed release exists (R-1330). Paperless: decodes only replies to its own outbound calls (R-1331).
|
||||
|
||||
## Decided by CC unattended (operator may reverse)
|
||||
|
||||
Home Assistant as a lane step (decision 276); the runtime cache filled on DooPlex with the stored Docker Hub login
|
||||
instead of a zstd dependency in CI (08 §11); no Paperless step; RomM kept (pick in STATUS); the live catalog changes
|
||||
kept as patches, not commits, at night.
|
||||
@@ -0,0 +1,15 @@
|
||||
mirror main 6d5751db
|
||||
|
||||
26: repo_url: file:///opt/docker/felhom-controller/drill-catalog.git
|
||||
|
||||
2026/10/27 21:56:30 sync.go:344: [WARN] [sync] git.repo_url changed (cache was cloned from https://gitea.dooplex.hu/admin/app-catalog-felhom.eu.git, config says file:///opt/docker/felhom-controller/dr
|
||||
2026/10/27 21:56:30 sync.go:318: [INFO] [sync] Cloning file:///opt/docker/felhom-controller/drill-catalog.git → /opt/docker/felhom-controller/data/catalog-cache
|
||||
2026/10/27 21:56:31 sync.go:511: [WARN] [sync] immich: catalog definition REFUSED by the allow-list — the app keeps its last good compose, nothing written: the catalog definition of immich asks for
|
||||
2026/10/27 21:56:31 sync.go:261: [INFO] [sync] catalog moved 540f18552bbf -> 6d5751dbdce2 (0 new, 0 stack dir(s) changed)
|
||||
2026/10/27 21:56:31 sync.go:299: [INFO] [sync] Catalog sync complete
|
||||
2026/10/27 21:56:31 sync.go:142: [INFO] [sync] Initial sync: Sablonok frissítve — a katalógus új változata betöltve; a telepített alkalmazások fájljai nem változtak
|
||||
|
||||
expect n8n/docker-compose.yml ∋ N8N_DIAGNOSTICS_ENABLED=false: 1
|
||||
expect opengist/docker-compose.yml ∋ 256M: 2
|
||||
expect homepage/.felhom.yml ∋ family_gate: true: 1
|
||||
drill main 6d5751d, box cache 6d5751d: DRILL-CONFIRMED
|
||||
+219
@@ -0,0 +1,219 @@
|
||||
{
|
||||
"app": "home-assistant",
|
||||
"walk": "security",
|
||||
"box_walk_version": 1,
|
||||
"verdict": "proven",
|
||||
"venue": "box 9202 (drill catalog), the guarded Update",
|
||||
"from": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.9.4"
|
||||
},
|
||||
"to": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"observables_before": {
|
||||
"pinned_images": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.9.4"
|
||||
},
|
||||
"installed_images": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.9.4"
|
||||
},
|
||||
"catalog_images": null,
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/home-assistant/home-assistant:2026.9.4@sha256:3e6710a7ab2a61311d9d899b719f6c3657791c63e8f4942cec4ebc42401d6b76"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"home-assistant ghcr.io/home-assistant/home-assistant:2026.9.4@sha256:3e6710a7ab2a61311d9d899b719f6c3657791c63e8f4942cec4ebc42401d6b76 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"setup_gate_before": {
|
||||
"browser": {
|
||||
"status": "302",
|
||||
"redirect": "https://felhom.enkisfelhom.hu/__gate/start?…"
|
||||
},
|
||||
"script": {
|
||||
"status": "401",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"seed": "read_back",
|
||||
"drill_commit": "9f2522e80bd1",
|
||||
"sync_waited_s": 4.5,
|
||||
"badge_before": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Újabb változat érhető el ehhez az alkalmazáshoz. A frissítés indításához nyomd meg a Frissítés gombot.",
|
||||
"text": "Frissítés elérhető — ma"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "A newer version of this app is available. Select the Update button to start it.",
|
||||
"text": "Update available — today"
|
||||
}
|
||||
]
|
||||
},
|
||||
"measured_at": "2026-10-27T22:00:02Z",
|
||||
"update": {
|
||||
"accepted": true,
|
||||
"http": "202",
|
||||
"phases": [
|
||||
{
|
||||
"t": 0.0,
|
||||
"phase": "backing-up",
|
||||
"label": "Biztonsági mentés készül a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 7.2,
|
||||
"phase": "safety-dump",
|
||||
"label": "Adatbázis pillanatkép…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 8.2,
|
||||
"phase": "pulling",
|
||||
"label": "Új verzió letöltése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 113.9,
|
||||
"phase": "copying",
|
||||
"label": "Az adatok másolása a frissítés előtt…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 125.2,
|
||||
"phase": "verifying",
|
||||
"label": "Működés ellenőrzése…",
|
||||
"updating": true,
|
||||
"error": null,
|
||||
"hold": null
|
||||
},
|
||||
{
|
||||
"t": 135.5,
|
||||
"phase": "done",
|
||||
"label": "Frissítve",
|
||||
"updating": false,
|
||||
"error": null,
|
||||
"hold": null
|
||||
}
|
||||
],
|
||||
"duration_s": 135.5,
|
||||
"final_phase": "done",
|
||||
"update_error": null,
|
||||
"hold_reason": null,
|
||||
"state": "running"
|
||||
},
|
||||
"observables_after": {
|
||||
"pinned_images": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"installed_images": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"catalog_images": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"live_compose_image_lines": [
|
||||
"image: ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
],
|
||||
"docker_inspect": [
|
||||
"home-assistant ghcr.io/home-assistant/home-assistant:2026.10.4 running=true restarts=0"
|
||||
]
|
||||
},
|
||||
"badge_after": {
|
||||
"hu": [
|
||||
{
|
||||
"title": "Ez az alkalmazás a legfrissebb elérhető változatot futtatja.",
|
||||
"text": "Naprakész"
|
||||
}
|
||||
],
|
||||
"en": [
|
||||
{
|
||||
"title": "This app is running the newest version available.",
|
||||
"text": "Up to date"
|
||||
}
|
||||
]
|
||||
},
|
||||
"state_after": "running",
|
||||
"hold_after": null,
|
||||
"to_digests": {
|
||||
"home-assistant": "sha256:23f4dfbb69ce76315dbc4de7915504f1c2dcecd7ca2648113a493a385972e133"
|
||||
},
|
||||
"four_observables": {
|
||||
"pinned": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"installed": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"catalog": {
|
||||
"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
},
|
||||
"live_compose": [
|
||||
"ghcr.io/home-assistant/home-assistant:2026.10.4"
|
||||
]
|
||||
},
|
||||
"seed_read_after": true,
|
||||
"setup_gate_after": {
|
||||
"browser": {
|
||||
"status": "404",
|
||||
"redirect": null
|
||||
},
|
||||
"script": {
|
||||
"status": "404",
|
||||
"redirect": null
|
||||
}
|
||||
},
|
||||
"memory": {
|
||||
"soak_s": 600,
|
||||
"interval_s": 10,
|
||||
"samples": 60,
|
||||
"containers": {
|
||||
"home-assistant": {
|
||||
"samples": 60,
|
||||
"anon_peak_bytes": 328122368,
|
||||
"limit_bytes": 1073741824,
|
||||
"anon_peak_pct": 30.6,
|
||||
"cgroup_peak_pct": 41.2,
|
||||
"oom_kill_delta": 0,
|
||||
"oom_killed_flag": false,
|
||||
"restarts_delta": 0,
|
||||
"running_all_samples": true,
|
||||
"cgroup": "/sys/fs/cgroup/system.slice/docker-8a9bb18a5dd2eec74901443f9a0e65ea05d9ec8adc66fc0604ae443ae2af7905.scope"
|
||||
}
|
||||
},
|
||||
"oom_kills": 0,
|
||||
"restarts": 0,
|
||||
"peak_pct": 30.6
|
||||
},
|
||||
"why": "the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back",
|
||||
"log": [
|
||||
"22:57:43 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}",
|
||||
"22:59:44 [1] deployed, controller state=running, pinned={'home-assistant': 'ghcr.io/home-assistant/home-assistant:2026.9.4'}",
|
||||
"22:59:44 gate: ha is gated — passed as the household (cookie set)",
|
||||
"22:59:47 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}",
|
||||
"22:59:48 home-assistant: /api/onboarding/users http=200",
|
||||
"22:59:48 home-assistant: login as the seeded owner ok=True",
|
||||
"22:59:49 [5] drill commit 9f2522e80bd1: home-assistant ghcr.io/home-assistant/home-assistant:2026.9.4 -> ghcr.io/home-assistant/home-assistant:2026.10.4 (push rc=0)",
|
||||
"22:59:58 [5] the box's drill mirror now at 9f2522e8",
|
||||
"23:00:03 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}",
|
||||
"23:00:03 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None",
|
||||
"23:00:10 + 7.2s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None",
|
||||
"23:00:11 + 8.2s phase=pulling label=Új verzió letöltése… err=None hold=None",
|
||||
"23:01:57 + 113.9s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None",
|
||||
"23:02:08 + 125.2s phase=verifying label=Működés ellenőrzése… err=None hold=None",
|
||||
"23:02:18 + 135.5s phase=done label=Frissítve err=None hold=None",
|
||||
"23:02:38 home-assistant: login as the seeded owner ok=True",
|
||||
"23:02:38 [7] memory soak 600 s …",
|
||||
"23:12:44 [7] soak: peak 30.6% of the limit (anon), kills 0, restarts 0"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
22:57:43 [1] deploy -> 202 {'ok': True, 'message': 'Telepítés elindítva – az állapot a kártyán követhető'}
|
||||
22:59:44 [1] deployed, controller state=running, pinned={'home-assistant': 'ghcr.io/home-assistant/home-assistant:2026.9.4'}
|
||||
22:59:44 gate: ha is gated — passed as the household (cookie set)
|
||||
22:59:47 [2] setup gate as installed: {'browser': {'status': '302', 'redirect': 'https://felhom.enkisfelhom.hu/__gate/start?…'}, 'script': {'status': '401', 'redirect': None}}
|
||||
22:59:48 home-assistant: /api/onboarding/users http=200
|
||||
22:59:48 home-assistant: login as the seeded owner ok=True
|
||||
22:59:49 [5] drill commit 9f2522e80bd1: home-assistant ghcr.io/home-assistant/home-assistant:2026.9.4 -> ghcr.io/home-assistant/home-assistant:2026.10.4 (push rc=0)
|
||||
22:59:58 [5] the box's drill mirror now at 9f2522e8
|
||||
23:00:03 [6] Update -> 202 {'ok': True, 'data': {'accepted': True, 'completed': False}, 'message': 'Frissítés elindult – az állapot a kártyán követhető'}
|
||||
23:00:03 + 0.0s phase=backing-up label=Biztonsági mentés készül a frissítés előtt… err=None hold=None
|
||||
23:00:10 + 7.2s phase=safety-dump label=Adatbázis pillanatkép… err=None hold=None
|
||||
23:00:11 + 8.2s phase=pulling label=Új verzió letöltése… err=None hold=None
|
||||
23:01:57 + 113.9s phase=copying label=Az adatok másolása a frissítés előtt… err=None hold=None
|
||||
23:02:08 + 125.2s phase=verifying label=Működés ellenőrzése… err=None hold=None
|
||||
23:02:18 + 135.5s phase=done label=Frissítve err=None hold=None
|
||||
23:02:38 home-assistant: login as the seeded owner ok=True
|
||||
23:02:38 [7] memory soak 600 s …
|
||||
23:12:44 [7] soak: peak 30.6% of the limit (anon), kills 0, restarts 0
|
||||
23:12:44 [9] verdict proven -> /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0b76c4d7-9b39-4e4e-869d-d0d2c6006331/scratchpad/p2ev/home-assistant/verdict.json
|
||||
23:12:44 RESULT proven — the security-fix step ran on the box through the guarded Update; healthy, TO on all four observables, no undo, no hold, a clean soak, seed read back
|
||||
23:12:49 [X] stop -> 200 {'ok': True, 'message': 'Stack home-assistant stop completed'}
|
||||
23:13:21 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'home-assistant', 'volumes_removed': ['home-assistant_homeassistant_config'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [
|
||||
23:13:30 [X] after remove: deployed=False leftovers=''
|
||||
@@ -0,0 +1,3 @@
|
||||
STEP home-assistant: the superseded step {'home-assistant': 'ghcr.io/home-assistant/home-assistant:2026.9.4'} keeps its definition at steps/4f987bb4b035eef9.yml
|
||||
STEP home-assistant: … and its .felhom.yml at steps/4f987bb4b035eef9.felhom.yml
|
||||
WROTE home-assistant: {'home-assistant': 'ghcr.io/home-assistant/home-assistant:2026.9.4'} -> {'home-assistant': 'ghcr.io/home-assistant/home-assistant:2026.10.4'} peak 30.6% marks {'files_may_change': False, 'needs_person': None, 'memory_tight': False}
|
||||
@@ -0,0 +1,16 @@
|
||||
diff --git a/templates/wanderer/.felhom.yml b/templates/wanderer/.felhom.yml
|
||||
index e9582f8..ccb6a02 100644
|
||||
--- a/templates/wanderer/.felhom.yml
|
||||
+++ b/templates/wanderer/.felhom.yml
|
||||
@@ -12,6 +12,11 @@ slug: "wanderer"
|
||||
# changes an image: line must set this to the same day (see CLAUDE.md).
|
||||
catalog_since: "2026-07-21"
|
||||
|
||||
+# D59 (operator 2026-10-27 21:33, felhom.eu `09` §3 decision 275; R-1313): hidden until Wanderer's big step is done —
|
||||
+# v0.20.0 lets any ActivityPub server on the internet overwrite its records with no login. Hidden = not offered for new
|
||||
+# installs; an installed Wanderer keeps working in full (no box runs it on 2026-10-27). The big step un-hides it.
|
||||
+lifecycle: hidden
|
||||
+
|
||||
# --- Resource hints (displayed on deploy screen) ---
|
||||
resources:
|
||||
mem_request: "350M"
|
||||
@@ -0,0 +1,205 @@
|
||||
/mnt/5_hdd/felhom.eu/git/felhom.eu/scripts/security_watch.py:829: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datesecurity watch 2026-10-27: 197 pins (11 box/build, 97 app, 89 DooPlex); GitHub key ABSENT — apps' advisories in a 2-night rotation
|
||||
ADVISORY doop actualbudget/actual-server 26.10.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY doop advplyr/audiobookshelf 2.37.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY box cloudflare/cloudflared 2026.10.4 feed:cloudflare-blog:01M5DK5J81T0VC8YTBR2FKD8A3 (fixed read the notice); vulnnotes:cloudflared@2026.10.5:VULN-183456 (fixed 2026.10.5)
|
||||
ADVISORY doop codewithcj/sparkyfitness_server v1.9.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY doop crocodilestick/calibre-web-automated dev CVE-2026-111497 (fixed 1.2.1)
|
||||
ADVISORY doop docker.io/calcom/cal.com v6.2.0 CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
ADVISORY doop flomp/wanderer-db v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 1 more
|
||||
ADVISORY doop flomp/wanderer-web v0.21.0 GHSA-vprp-gr6m-j375 (fixed v0.21.2); GHSA-3xp7-7492-j2q6 (fixed v0.21.2); GHSA-j9m4-8qwf-jvx6 (fixed v0.21.2); GHSA-fprh-3pp9-68m9 (fixed v0.21.2); … 2 more
|
||||
ADVISORY doop ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
|
||||
ADVISORY doop ghcr.io/immich-app/immich-machine-learning v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 7 more
|
||||
ADVISORY doop ghcr.io/immich-app/immich-server v2.7.5 GHSA-q89f-h332-8q2h (fixed v3.2.4); GHSA-h5w4-vjv4-9r5q (fixed a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 (fixed v3.2.0); GHSA-72rm-x7xr-v679 (fixed v3.3.0); … 8 more
|
||||
ADVISORY doop ghcr.io/lukegus/termix release-2.9.2 CVE-2026-111497 (fixed 26.12.1)
|
||||
ADVISORY doop ghcr.io/paperless-ngx/paperless-ngx 3.3.4 CVE-2026-111497 (fixed 1.2.1)
|
||||
ADVISORY doop gitea/gitea 1.26.2 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 127 more
|
||||
ADVISORY doop grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
ADVISORY box gtstef/filebrowser 1.5.8-stable GHSA-gfgm-886h-6r47 (fixed 2.0.2-stable, 2.1.4-beta); GHSA-wxj5-g3qp-g732 (fixed 2.0.2-stable, 2.1.3-beta); GHSA-3j46-5w28-f8p2 (fixed 2.1.0-stable, 2.1.3-beta); GHSA-4vrc-935w-xxq2 (fixed 2.1.0-stable, 2.1.3-beta); … 31 more
|
||||
ADVISORY doop louislam/uptime-kuma 2.5.6 GHSA-qjxc-h5jf-c7rj (fixed the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8); release:louislam/uptime-kuma@2.5.7 (fixed 2.5.7); CVE-2026-111497 (fixed 22.23.4)
|
||||
ADVISORY doop outlinewiki/outline 1.11.0 GHSA-x4w3-9p9j-cprh (fixed 1.12.0); GHSA-rq53-m97j-f2pg (fixed 1.12.0); GHSA-h6ff-rw9x-5mq2 (fixed 1.12.0); GHSA-rvj7-2gww-6xfq (fixed 1.12.0); … 3 more
|
||||
ADVISORY doop redis 8.10.2 GHSA-c8h9-259x-jff4 (fixed the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 (fixed no fixed version named yet); GHSA-93m2-935m-8rj3 (fixed no fixed version named yet); GHSA-m8fj-85cg-7vhp (fixed the range is unreadable — check by hand); … 8 more
|
||||
ADVISORY doop rommapp/romm 5.4.0 release:rommapp/romm@5.4.1 (fixed 5.4.1); CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY doop vabene1111/recipes 2.6.15 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app actualbudget/actual-server 26.9.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app calcom/cal.com v6.2.0 GHSA-p3f6-52gv-cj7m (fixed the range is unreadable — check by hand); GHSA-cpf2-q635-xrwx (fixed the range is unreadable — check by hand); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
ADVISORY app codewithcj/sparkyfitness_server v0.17.3 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app crocodilestick/calibre-web-automated v4.0.8 CVE-2026-111497 (fixed 1.2.1)
|
||||
ADVISORY app fallenbagel/jellyseerr 2.7.3 CVE-2026-111497 (fixed 22.23.4)
|
||||
ADVISORY app flomp/wanderer-db v0.20.0 release:open-wanderer/wanderer@v0.21.2 (fixed v0.21.2); release:open-wanderer/wanderer@v0.21.0 (fixed v0.21.0)
|
||||
ADVISORY app flomp/wanderer-web v0.20.0 release:open-wanderer/wanderer@v0.21.2 (fixed v0.21.2); release:open-wanderer/wanderer@v0.21.0 (fixed v0.21.0); CVE-2026-111497 (fixed 22.23.4)
|
||||
ADVISORY app freikin/dawarich 1.15.3 release:Freika/dawarich@1.17.0 (fixed 1.17.0); CVE-2026-111497 (fixed 22.23.4, 24.22.1, 26.12.1)
|
||||
ADVISORY app ghcr.io/alexta69/metube 2026.09.29 CVE-2026-111497 (fixed 1.2.1)
|
||||
ADVISORY app ghcr.io/diced/zipline 4.8.0 CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app ghcr.io/gethomepage/homepage v1.13.2 GHSA-669x-4pg4-w24r (fixed 2.2.0); CVE-2026-111497 (fixed 22.23.4)
|
||||
ADVISORY app ghcr.io/home-assistant/home-assistant 2026.9.4 CVE-2026-111497 (fixed 1.2.1)
|
||||
ADVISORY app ghcr.io/immich-app/immich-machine-learning v3.2.4 release:immich-app/immich@v3.3.5 (fixed v3.3.5)
|
||||
ADVISORY app ghcr.io/immich-app/immich-server v3.2.4 release:immich-app/immich@v3.3.5 (fixed v3.3.5); CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app ghcr.io/karakeep-app/karakeep 0.33.2 release:karakeep-app/karakeep@v0.34.1 (fixed v0.34.1); release:karakeep-app/karakeep@v0.34.0 (fixed v0.34.0); CVE-2026-111497 (fixed 24.22.1)
|
||||
ADVISORY app ghcr.io/lukegus/termix 2.8.0 GHSA-6gr3-r7jx-wfmh (fixed >= 26.10.0); GHSA-frx8-qqgg-7j7g (fixed >= 26.10.0); GHSA-3q2m-5r5p-w45r (fixed >= 26.10.0); GHSA-rgf3-2q88-q4wp (fixed >= 26.10.0); … 9 more
|
||||
ADVISORY app ghcr.io/paperless-ngx/paperless-ngx 2.20.15 GHSA-c8f3-pqr2-rr24 (fixed 3.3.2); GHSA-2jhj-xqrq-rmrq (fixed 3.1.2); CVE-2026-111497 (fixed 1.1.1)
|
||||
ADVISORY app ghcr.io/papra-hq/papra 26.6.2-rootless CVE-2026-111497 (fixed 26.12.1)
|
||||
ADVISORY app ghcr.io/seanmorley15/adventurelog-backend v0.13.0 release:seanmorley15/AdventureLog@v0.13.1 (fixed v0.13.1)
|
||||
ADVISORY app ghcr.io/seanmorley15/adventurelog-frontend v0.13.0 release:seanmorley15/AdventureLog@v0.13.1 (fixed v0.13.1); CVE-2026-111497 (fixed 26.12.1)
|
||||
ADVISORY app ghcr.io/tandoorrecipes/recipes 2.6.15 GHSA-5f74-7rgh-pc97 (fixed a version after 2.6.15 (the notice names none)); GHSA-pcq2-64qw-jm4x (fixed no fixed version named yet); GHSA-69q3-5q6x-7hmx (fixed no fixed version named yet); GHSA-xq7g-9q95-vjc6 (fixed a version after 2.6.15 (the notice names none)); … 7 more
|
||||
ADVISORY app ghost 6.67.0-alpine CVE-2026-111497 (fixed 22.23.4)
|
||||
ADVISORY app gitea/gitea 1.27.3 GHSA-wx44-9m3m-rjqx (fixed 28.2.0); GHSA-4jmf-h2cm-hg7w (fixed 28.2.0); GHSA-8j56-f865-gqq2 (fixed 28.2.0); GHSA-fxq4-gr55-7x5g (fixed 28.2.0); … 37 more
|
||||
ADVISORY app glanceapp/glance v0.8.5 GHSA-r225-jhr6-68cc (fixed >= 0.8.7)
|
||||
ADVISORY app grafana/grafana 13.2.4 GHSA-8xmm-x63g-f6xv (fixed no fixed version named yet); GHSA-4724-7jwc-3fpw (fixed the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 (fixed the range is unreadable — check by hand); GHSA-8wjh-59cw-9xh4 (fixed no fixed version named yet); … 2 more
|
||||
ADVISORY app louislam/uptime-kuma 2.5.7 release:louislam/uptime-kuma@2.5.8 (fixed 2.5.8)
|
||||
ADVISORY app n8nio/n8n 2.44.7 GHSA-365g-vjw2-grx8 (fixed no fixed version named yet)
|
||||
ADVISORY app rommapp/romm 5.4.1 CVE-2026-111497 (fixed 24.22.1)
|
||||
NOT CHECKED doop gitea.dooplex.hu/admin/felhom-act-runner 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
NOT CHECKED doop gitea.dooplex.hu/admin/jarr latest registry gitea.dooplex.hu: no anonymous token route
|
||||
NOT CHECKED doop gitea.dooplex.hu/admin/recipe-importer latest registry gitea.dooplex.hu: no anonymous token route
|
||||
NOT CHECKED doop gitea.dooplex.hu/admin/revfulop-calendar 1.6.2 registry gitea.dooplex.hu: no anonymous token route
|
||||
NOT CHECKED doop gitea.dooplex.hu/admin/sparkyfitness-export 0.3.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
NOT CHECKED doop gitea.dooplex.hu/admin/wan-probe 0.1.0 registry gitea.dooplex.hu: no anonymous token route
|
||||
NOT CHECKED doop minio/minio latest Docker registry tags of minio/minio: HTTP 401; manifest minio/minio:latest: HTTP 401
|
||||
BEHIND doop getmeili/meilisearch v1.11.3 newest v1.56.0
|
||||
BEHIND doop ghcr.io/diced/zipline 4.8.1 newest 4.8.2
|
||||
BEHIND app getmeili/meilisearch v1.41.0 newest v1.56.0
|
||||
BEHIND app getmeili/meilisearch v1.36.0 newest v1.56.0
|
||||
BEHIND app ghcr.io/hargata/lubelogger v1.7.3 newest v1.7.4
|
||||
BEHIND app ghcr.io/kozea/radicale 3.8.1 newest 3.9.0
|
||||
BEHIND app gotson/komga 1.28.0 newest 1.29.1
|
||||
BEHIND app kimai/kimai2 2.67.0 newest 2.71.0
|
||||
BEHIND app lscr.io/linuxserver/bookstack 26.09.2 newest 26.09.20260929
|
||||
BEHIND app nextcloud 34.0.4-apache newest 34.0.5-apache
|
||||
BEHIND app nginx 1.30.5-alpine newest 1.31.8-alpine
|
||||
BEHIND app qbittorrentofficial/qbittorrent-nox 5.2.4-1 newest 5.3.0-2
|
||||
GAP buil alpine 3.24.2 newest 3.24.3
|
||||
GAP buil alpine 3.24.2 newest 3.24.3
|
||||
GAP doop alpine/k8s 1.37.1
|
||||
GAP doop arcadiatechnology/crafty-4 4.11.0
|
||||
GAP doop bhgedigital/envsubst latest
|
||||
GAP doop busybox 1.38
|
||||
GAP doop codercom/code-server 4.143.1
|
||||
GAP buil debian 13.7-slim
|
||||
GAP buil debian 13.7-slim
|
||||
GAP doop docker.io/bitnamilegacy/postgresql 17.6.0-debian-12-r3
|
||||
GAP doop docker.io/library/nextcloud 34.0.5-apache
|
||||
GAP doop docker.io/valkey/valkey 9.2-alpine
|
||||
GAP doop filebrowser/filebrowser v2.63.23
|
||||
GAP doop ghcr.io/cloudnative-pg/postgresql 17.2 newest 17.11
|
||||
GAP doop ghcr.io/headlamp-k8s/headlamp v0.46.0
|
||||
GAP doop ghcr.io/immich-app/postgres 16-vectorchord0.3.0
|
||||
GAP doop ghcr.io/jimmidyson/configmap-reload v0.15.0
|
||||
GAP doop ghcr.io/onedr0p/exportarr v2.3.0
|
||||
GAP doop ghcr.io/seerr-team/seerr v3.5.1
|
||||
GAP doop ghcr.io/seriousm4x/upsnap 5
|
||||
GAP doop ghcr.io/stakater/reloader v1.4.22 newest v1.4.23
|
||||
GAP doop ghcr.io/tautulli/tautulli v2.18.2
|
||||
GAP doop griefed/serverpackcreator 8.1.2
|
||||
GAP doop gtstef/filebrowser 1.5.8-stable
|
||||
GAP doop guacamole/guacamole 1.6.0
|
||||
GAP doop guacamole/guacd 1.6.0
|
||||
GAP doop index.docker.io/plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
GAP doop itzg/mc-backup 2026.10.1 newest 2026.10.2
|
||||
GAP doop itzg/minecraft-server 2026.10.0-java21 newest 2026.10.1-java17
|
||||
GAP doop linuxserver/bookstack 26.09.20260929
|
||||
GAP doop linuxserver/prowlarr version-2.6.5.5623
|
||||
GAP doop linuxserver/qbittorrent 5.3.0
|
||||
GAP doop linuxserver/radarr version-6.4.4.10685
|
||||
GAP doop linuxserver/sonarr version-4.0.20.3014
|
||||
GAP doop mariadb 11
|
||||
GAP doop mikefarah/yq 4.54.1
|
||||
GAP doop mongodb/mongodb-community-server 8.0.5-ubuntu2204 newest 8.3.13-ubuntu2204
|
||||
GAP doop msdeluise/plant-it-server 0.10.0
|
||||
GAP doop mysql 8.4
|
||||
GAP doop nicolaka/netshoot latest
|
||||
GAP doop postgis/postgis 16-3.5
|
||||
GAP doop postgres 15-alpine
|
||||
GAP doop postgres 16-alpine
|
||||
GAP doop privatebin/nginx-fpm-alpine 2.0.6 newest 2.1.0
|
||||
GAP doop prom/alertmanager v0.34.1
|
||||
GAP doop prom/node-exporter v1.12.1
|
||||
GAP doop prom/prometheus v3.15.0 newest v3.15.1
|
||||
GAP doop prometheuscommunity/smartctl-exporter v0.15.0
|
||||
GAP doop python 3.15-bookworm
|
||||
GAP doop quay.io/jetstack/version-checker v0.11.0
|
||||
GAP doop quay.io/prometheus/blackbox-exporter v0.29.1
|
||||
GAP doop renovate/renovate 44.181.1 newest 44.190.0
|
||||
GAP doop tailscale/tailscale v1.104.2
|
||||
GAP app emby/embyserver 4.11.0.4 newest 4.11.0.11
|
||||
GAP app ghcr.io/immich-app/postgres 16-vectorchord0.4.3-pg
|
||||
GAP app ghcr.io/karakeep-app/karakeep-chrome 151.0.7922.47-r1
|
||||
GAP app mariadb 12.3
|
||||
GAP app mariadb 11.4 newest 11.8
|
||||
GAP app mariadb 11.8
|
||||
GAP app mariadb 12.3
|
||||
GAP app mariadb 11.8
|
||||
GAP app msdeluise/plant-it 0.10.0
|
||||
GAP app plexinc/pms-docker 1.43.5.11029-6bf8af3f0
|
||||
GAP app postgis/postgis 16-3.5-alpine
|
||||
GAP app postgis/postgis 17-3.5-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 17-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 18-alpine
|
||||
GAP app postgres 17-alpine
|
||||
GAP app postgres 16-alpine
|
||||
GAP app registry.gitlab.com/crafty-controller/crafty-4 4.11.0
|
||||
FLOATING doop ghcr.io/seanmorley15/adventurelog-backend latest
|
||||
FLOATING doop ghcr.io/seanmorley15/adventurelog-frontend latest
|
||||
FLOATING doop nginx 1.31-alpine
|
||||
FLOATING doop redis 8-alpine
|
||||
FLOATING doop redis 8.10-alpine
|
||||
FLOATING app ghcr.io/claperco/claper 2.5
|
||||
FLOATING app ghcr.io/thomiceli/opengist 1.15
|
||||
FLOATING app jellyfin/jellyfin 12.4
|
||||
FLOATING app lscr.io/linuxserver/prowlarr version-2.6.5.5623
|
||||
FLOATING app lscr.io/linuxserver/sabnzbd version-5.1.3
|
||||
FLOATING app lscr.io/linuxserver/transmission version-4.1.3-r0
|
||||
FLOATING app nzbgetcom/nzbget v26.3
|
||||
FLOATING app redis 7.4-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app redis 7-alpine
|
||||
FLOATING app wger/server 2.7
|
||||
SELF box gitea.dooplex.hu/admin/felhom-samba 1.2.0
|
||||
SELF app gitea.dooplex.hu/admin/recipe-importer v0.9.11
|
||||
CURRENT doop codewithcj/sparkyfitness v1.9.0
|
||||
CURRENT doop f0rc3/gokapi v2.2.4
|
||||
CURRENT doop ghcr.io/alam00000/bentopdf 2.8.10
|
||||
CURRENT doop ghcr.io/thomiceli/opengist 1.15.3
|
||||
CURRENT doop glanceapp/glance v0.8.7
|
||||
CURRENT buil golang 1.27.3-trixie
|
||||
CURRENT buil golang 1.27.3-alpine3.24
|
||||
CURRENT doop onlyoffice/documentserver 9.4.0
|
||||
CURRENT buil restic 0.19.1
|
||||
CURRENT box traefik v3.7.16
|
||||
CURRENT doop vaultwarden/server 1.37.4
|
||||
CURRENT app codewithcj/sparkyfitness v0.17.3
|
||||
CURRENT app deluan/navidrome 0.64.2
|
||||
CURRENT app docmost/docmost 0.97.0
|
||||
CURRENT app f0rc3/gokapi v1.9.6
|
||||
CURRENT app ghcr.io/advplyr/audiobookshelf 2.37.2
|
||||
CURRENT app ghcr.io/alam00000/bentopdf v2.8.10
|
||||
CURRENT app ghcr.io/cmintey/wishlist v0.69.0
|
||||
CURRENT app ghcr.io/gramps-project/grampsweb v25.6.0
|
||||
CURRENT app ghcr.io/grimmory-tools/grimmory v3.5.0
|
||||
CURRENT app ghcr.io/mealie-recipes/mealie v3.29.0
|
||||
CURRENT app ghcr.io/sysadminsmedia/homebox 0.27.1
|
||||
CURRENT app lscr.io/linuxserver/code-server 4.143.1
|
||||
CURRENT app lscr.io/linuxserver/grocy 4.7.1
|
||||
CURRENT app lscr.io/linuxserver/radarr 6.4.4
|
||||
CURRENT app lscr.io/linuxserver/sonarr 4.0.20
|
||||
CURRENT app lukevella/rallly 4.16.3
|
||||
CURRENT app onlyoffice/documentserver 9.4.0
|
||||
CURRENT app outlinewiki/outline 1.12.0
|
||||
CURRENT app privatebin/pdo 2.1.0
|
||||
CURRENT app vaultwarden/server 1.37.4-alpine
|
||||
CURRENT app vikunja/vikunja 2.7.1
|
||||
COUNTS ADVISORY=49 BEHIND=12 CURRENT=32 FLOATING=20 GAP=75 NOT_CHECKED=7 SELF=2
|
||||
REQUESTS api.github.com=49 api.osv.dev=1 auth.docker.io=1 blog.cloudflare.com=1 ghcr.io=174 github.com=64 hub.docker.com=225 raw.githubusercontent.com=1 registry-1.docker.io=1
|
||||
MAIL (not sent, --no-mail): [Felhom security] termix, wanderer-db, wanderer-web, immich-machine-learning … — 58 new advisories
|
||||
MAIL (not sent, --no-mail): [Felhom security] the watch could not check runtime
|
||||
STATE wtime.datetime.now(datetime.UTC).
|
||||
today = datetime.date.fromisoformat(opts["today"]) if "today" in opts else datetime.datetime.utcnow().date()
|
||||
ritten: /tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0b76c4d7-9b39-4e4e-869d-d0d2c6006331/scratchpad/watch-state-fill2.json (292 known advisories)
|
||||
@@ -26,6 +26,12 @@
|
||||
|
||||
---
|
||||
|
||||
## 2026-10-27 (late evening) — R-1326 closed: the hub gets time to start (full text of the row: `git show 503692a1:documentation/backlog/OPEN-ITEMS.md`)
|
||||
|
||||
| Row | What | Closed | Evidence |
|
||||
|---|---|---|---|
|
||||
| **R-1326** | **The hub's start-up eats half its liveness margin: hub 0.174.0 took 36 s from „starting" to „Listening on :8080" (0.174.1: 31 s), and the liveness probe (`initialDelaySeconds` 5, `periodSeconds` 30, `failureThreshold` 3) kills the container after ~65 s of failed probes.** (P3) | CLOSED 2026-10-27 22:22 CET — a `startupProbe` (36 × 5 s = 180 s, 5× the measured 31–36 s start) holds the liveness probe off until the hub answers; `manifests/hub.yaml` `a69ddbde` (CI 2441), deployed on the operator's yes (hub-only sync). The pod started ONCE: „starting" 22:21:47 → „Listening" 22:22:22 (35 s), only the startup probe failed meanwhile, 0 restarts; 30-minute watch: 0 warning-or-worse events, 0 WARN lines, 12 box reports, Synced/Healthy. | `manifests/hub.yaml`; this entry |
|
||||
|
||||
## 2026-10-27 (evening) — R-1299 closed: the clean-up window button (full text of the row: `git show 714ee236:documentation/backlog/OPEN-ITEMS.md`)
|
||||
|
||||
| Row | What | Closed | Evidence |
|
||||
|
||||
@@ -124,7 +124,7 @@ stopping line that lies.
|
||||
| **R-494** | Install & onboarding | P4 | **NARROWED 2026-09-14 by operator ruling → [P3-LOW] the hub COULD create the tunnel at customer creation, for a domain already on Cloudflare. Not blocking: every customer has their own domain and the operator creates the tunnel per day-0 A.1 (`architecture/01-topology-and-trust.md`).** *Original finding, kept:* **[P1-HIGH] A new customer's dashboard has NO reachable address unless the operator hand-makes a Cloudflare tunnel — the link in the setup-code mail is dead.** MEASURED 2026-09-14 on a fresh install from the public ISO (drill intervention **I1**): the claim mail points at `https://felhom.drill0242.felhom.eu`; that name has **no A and no AAAA** record (`dig @1.1.1.1`, control `felhom.enkisfelhom.hu` resolves); the hub has **no tunnel- or DNS-creation code** (`hub/internal/cloudflare/` holds only geo-rule removal; `cf_tunnel_token` is a pasted, optional form field, `configs.go:1478`) — day-0 runbook A.1 makes it a manual Cloudflare-dashboard step that nothing on the customer-create page asks for; the box's own split-horizon resolver on the appliance LAN IP answered `google.com` but not the dashboard name at 13:27:39Z; the agent applied the record at **13:27:44Z** (`lanresolver: applied split-horizon record … ip=192.168.0.158`, 3 m 46 s after the controller started), so the box CAN answer the name — **but only to a device that uses the box as its DNS server, and no document, screen or mail tells a household to do that**; the router and the installer-offered DNS answer nothing. The page was reachable only at the guest's LAN address with the name forced (`curl --resolve …:443:192.168.0.158`). **A volunteer could not have done that.** **What it needs:** an operator ruling — the hub creates the tunnel and DNS at customer creation, or the product gives a household a LAN address that works with no DNS change. | **READY — rank P3-LOW; owner: CC** **Re-ranked 2026-10-03: P3→P4: operator-side automation; the operator creates the tunnel by hand per the day-0 runbook.** | — | — | CC |
|
||||
| **R-504** | Install & onboarding | P4 | **[P3-LOW] `iso.felhom.eu` cannot show an index page on its own — its root returns 404, and the download page lives on the website instead.** MEASURED 2026-09-14: `https://iso.felhom.eu/` and `/index.html` → 404; only named objects answer. The host is an R2 bucket behind a custom domain; whether R2 would serve an uploaded `index.html` at `/` was **not measured** (uploading anything to the public bucket is a publication). The ISO v1.27.0 task puts the Hungarian download page at `felhom.eu/letoltes` (published with the ISO, after the operator's yes). **Remaining:** a redirect from `iso.felhom.eu/` to that page needs a Cloudflare rule the session has no credential for. | **WAITING-ON-OPERATOR — rank P3-LOW; owner: operator (Cloudflare rule)** **Re-ranked 2026-10-03: P3→P4: households are sent to the website's download page; the bare address is cosmetic.** | — | — | operator |
|
||||
|
||||
## Apps & catalog — 19 rows (P3 8, P4 11)
|
||||
## Apps & catalog — 23 rows (P2 2, P3 10, P4 11)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
@@ -147,6 +147,10 @@ stopping line that lies.
|
||||
| **R-1215** | Apps & catalog | P4 | **One Immich photo upload hung 10 minutes with no answer and was not stored, while the box was healthy.** Night soak 2026-10-21 (`audits/night-2026-10-21/P1-soak/08-load/proof.log`): cycle 36, `IMG_20120021.jpg` sent 19:38:30 UTC, the uploader gave up at its 600 s read limit; Immich's database holds 302 photos for that user, the other cycles 303 (`P1-soak/09-immich-cycle36.txt`). At that moment memory „full" pressure was 3.9 % and `/api/health` answered in 0.26 s. 1 of about 26 000 uploads that night. Not diagnosed: Immich restarted at 02:16 for the off-site dump, so its log of 19:38 is gone. The Immich phone app retries a failed upload. | WATCHING — **2026-10-22 night:** not reproducible tonight; the Immich server log of 19:38 is gone (Immich restarted at 02:16 for the off-site dump). What the household sees: the upload fails after 10 minutes and the Immich phone app sends it again. | — | Watch the next long upload run with the Immich server log saved; file upstream only with a log | CC |
|
||||
| **R-1267** | Apps & catalog | P4 | **Every recreate of Immich leaves one empty anonymous Docker volume behind: the image declares `VOLUME /data`, the template does not map it.** Found 2026-10-24 (review round 2, while putting 9202 back): 9202 holds 296 empty anonymous volumes; each night chain's recreate of `immich-server` made a new one (12:58, 13:00, 13:01 — the three test runs; the two dangling ones this session made were removed by name, nothing pruned). The photos are NOT affected: Immich picks `/usr/src/app/upload` whenever both folders exist (`detectMediaLocation` in the image's `server/dist/services/storage.service.js:28-39`), and the template binds that folder (`templates/immich/docker-compose.yml:49`) — NOT-A-FINDING for data placement. **Seen again 2026-10-24 night on Tester 1:** privatebin's image declares `/run`, `/tmp` and `/var/lib/nginx/tmp` as volumes — each recreate (the night dump's stop/start) leaves three empty anonymous volumes; the same class as Immich's `/data` (`audits/restore-holes-2026-10-24/P1-tester1/42-anon-volumes.txt`). | OPEN **2026-10-24 (catalog sweep):** the same class for OnlyOffice and RomM (RomM's image volume `/romm` holds only the empty mount points of its binds); after every catalog app had been removed WITH data, the sweep box still held 52 such volumes (PrivateBin 21, OnlyOffice 8, RomM 8, Immich 3, and 12 from 12:50–12:52 before the batch, holding the same nginx folders as PrivateBin's) — remove-with-data does not see them (no compose project label). All small (4–72 KB), no household data (`audits/catalog-sweep-2026-10-24/_box/anon-volumes.txt`). | — | declare the image's VOLUME paths as tmpfs or named volumes in the catalog (Immich, privatebin), or remove the dangling ones a recreate leaves, by name | CC |
|
||||
| **R-1268** | Backup & restore | P3 | **Remove with „remove backups” leaves a restore's undo copy on the drive (`backups/restore-undo/<app>/`).** Seen 2026-10-24 night on Tester 1 (restore-holes Part 1, run 1): MeTube was held for support after a failed crash put-back, then removed with `remove_backups=true` — the 1.5 GB copy stayed (the removal deletes `backups/primary` and the second-drive mirror, not `restore-undo`), and nothing lists it (`audits/restore-holes-2026-10-24/P1-tester1/14-run1-teardown.txt`; removed by hand, CC's own test data). The copy is kept on purpose while a hold exists; after the app is gone it is orphaned. | OPEN | — | Remove with `remove_backups` also deletes the app's `restore-undo` folder (under the same path guard), or lists it as a kept copy | CC |
|
||||
| **R-1329** | Apps & catalog | P3 | **cal.com runs on Node.js 20, which gets no security fixes any more** — v6.2.0 carries Node 20.20.0 (no fixed release on the 20 line for CVE-2026-111497) and Debian 12's unpatched `libbrotli1` 1.0.9-2+b6 (fixed: 1.0.9-2+deb12u1); the same image runs in the catalog and on DooPlex. Read from the image 2026-10-27. | OPEN | — | a cal.com release on Node 22/24 (a big step: its own walk); until then the watch lists it nightly | CC |
|
||||
| **R-1330** | Apps & catalog | P2 | **RomM's newest release (5.4.1) still ships Node.js 24.18.1 (CVE-2026-111497, fixed 24.22.1)** — no newer RomM exists (tags read 2026-10-27). Exposure: Node is IN the image but no Node process runs (RomM serves through Python gunicorn/rq and nginx — `ps` on demo-hp 9201), and RomM sits behind the setup gate. | OPEN — **CC's pick: keep RomM offered, take the first RomM release with Node ≥ 24.22.1 as a lane step** (decided by CC unattended 2026-10-27 — operator may reverse; STATUS asks) | — | the watch flags it nightly (R-1327); the step when RomM ships | CC |
|
||||
| **R-1331** | Apps & catalog | P3 | **Paperless-ngx 2.20.15 carries Python Brotli 1.1.0 (CVE-2026-111497, fixed 1.1.1/1.2.1)** — its web side only COMPRESSES (whitenoise, compression_middleware); the DECODERS are urllib3's and httpx's, for replies to requests Paperless itself makes (its own outbound calls), never for what a visitor sends. Read in the running container on demo-hp 9201, 2026-10-27. | OPEN — no step tonight (decided by CC unattended — operator may reverse): the bad path needs a hostile server Paperless calls | — | take the first Paperless release with Brotli ≥ 1.2.1 as a normal step | CC |
|
||||
| **R-1332** | Apps & catalog | P2 | **Twenty catalog apps ship a runtime with HTTP2Shell (CVE-2026-111497) inside their image — the first runtime read of the whole catalog, 2026-10-27 night (R-1327):** actualbudget 26.9.0 (Node.js 24.20.0 → 24.22.1); adventurelog v0.13.0 (Node.js 26.3.0 → 26.12.1); calcom v6.2.0 (Node.js 20.20.0 → 22.23.4); calibre-web v4.0.8 (py-Brotli 1.2.0 → 1.2.1); dawarich 1.15.3 (Node.js 20.19.2 → 22.23.4); ghost 6.67.0-alpine (Node.js 22.23.3 → 22.23.4); home-assistant 2026.9.4 (py-Brotli 1.2.0 → 1.2.1); homepage v1.13.2 (Node.js 22.22.3 → 22.23.4); immich v3.2.4 (Node.js 24.21.0 → 24.22.1); karakeep 0.33.2 (Node.js 24.18.1 → 24.22.1); metube 2026.09.29 (py-Brotli 1.2.0 → 1.2.1); paperless-ngx 2.20.15 (py-Brotli 1.1.0 → 1.1.1); papra 26.6.2-rootless (Node.js 26.4.0 → 26.12.1); romm 5.4.1 (Node.js 24.18.1 → 24.22.1); seerr 2.7.3 (Node.js 22.18.0 → 22.23.4); sparkyfitness v0.17.3 (Node.js 24.18.0 → 24.22.1); tandoor 2.6.15 (Node.js 24.18.1 → 24.22.1); termix 2.8.0 (Node.js 26.9.0 → 26.12.1); wanderer v0.20.0 (Node.js 22.23.1 → 22.23.4); zipline 4.8.0 (Node.js 24.21.0 → 24.22.1). Plus one BOX program: the file manager `gtstef/filebrowser:1.5.8-stable` carries Alpine `brotli-libs` 1.2.0-r1 (a controller release when upstream rebuilds). None of these has a notice of its own. | OPEN — home-assistant and immich: lane steps walked tonight (drill, the live push waits for the operator); romm: R-1330; calcom: R-1329; paperless: R-1331; the rest: each app's next release whose image carries the fixed runtime, walked as a lane step — the watch lists them every night until then | — | per app: the first upstream image with Node ≥ 22.23.4 / 24.22.1 / 26.12.1 or Brotli ≥ 1.2.1, a lane step; close when the watch's runtime list is empty | CC |
|
||||
|
||||
|
||||
## App updates — 15 rows (P2 3, P3 12)
|
||||
@@ -293,7 +297,7 @@ stopping line that lies.
|
||||
| **R-1285** | Box system & updates | P4 | **D43's removal of our SSH drop-in from a BYO host happens one bundle LATE: the bundle run that delivers agent 0.165.0 is planned by the box's OLD (0.164.0) wrapper, which writes the drop-in as before („same"), and only then replaces itself.** Measured 2026-10-25 on the BYO test host (VM 9371 on demo-hp, `Tester4-f967d4`; attended release run): 0.164.0 day-0 → signed `agent_update` + `agent_config_update` 0.165.0 → the planted drop-in still there; a second `agent_config_update` (same bundle) → `BUNDLE REMOVED … (ours, on a BYO host — D43)`, nothing written, `sshd -T` the owner's own `permitrootlogin yes` (`audits/release-2026-10-26/byo/byo-proof.txt`). No box is affected today (the fleet's only BYO host is this test host); a fresh BYO install on ≥ 0.165.0 runs the new wrapper from the start. | **VERIFY** — 2026-10-27: agent v0.167.0 RELEASED; in the NORMAL signed delivery the pass now runs right after the commit on all three boxes („running the bundle policy pass after the self-update commit (R-1285)” → `BUNDLE POLICY DONE install_mode=appliance removed=0`; `audits/release-2026-10-27/agent-0167-tester1-demofelhom.txt`). Not live: a BYO box coming FROM 0.164.0 (none in the fleet). **Earlier:** **VERIFY** — 2026-10-26: agent `b1bc63d` (unreleased) — the new agent runs the bundle-policy pass once right after its self-update commits (`selfupdate.SetOnCommitted`); test in the real order (commit, then one pass), red-proved. **Not live:** only a box coming FROM 0.164.0 discriminates (0.165.0's wrapper already applies D43), which needs a signed downgrade chain on a BYO box — the live proof rides the next agent release. **Earlier:** **OPEN** — 2026-10-26 (agent 0.166.0 released, attended run): the policy pass is wired, but in the normal delivery it does NOT run: the box gets `agent_update` and `agent_config_update` in ONE pass, and the bundle job runs in the OLD process (demo-hp: pid 1966780, agent 0.165.0, bundle 09:03:07–09:03:09 CET; the restart into 0.166.0 at 09:03:10) — no `bundle policy pass` line on any of the three boxes. So a BYO host coming from 0.164.0 still loses our drop-in one release late. The night proof (`audits/night-2026-10-25/rig/r1285-live.txt`) ran a bundle under an agent that was ALREADY 0.166.0-code, so it did not cover this order. No BYO host is in the fleet today. Fix options: the agent runs the pass once at start-up after `update committed`; or the release procedure sends the bundle job only after the commit. **Earlier state:** **VERIFY** — fixed on main 2026-10-25 night (agent `abcc1e6`), waits for the agent release + the vouch: the agent runs the wrapper's `bundle-policy` pass after every install (red-proved, `redproof-r1285.txt`). **Live on the rig in ONE signed run** (BYO host, staged as upgraded from 0.164.0: the new agent by hand, the old 0.164.0 wrapper on disk, our drop-in planted; one `agent_config_update` of a test bundle): the old wrapper installed the bundle and replaced itself, then „BUNDLE POLICY REMOVED … (ours, on a BYO host)", `sshd -T` the owner's own `permitrootlogin yes` (`rig/r1285-live.txt`); the test package deleted from the registry after. **Earlier state:** OPEN | — | either the wrapper plans again after it replaced itself (one agent change + a test that a 0.164.0→0.165.0 bundle on a BYO record removes our copy in ONE run, red first), or the release procedure sends a BYO box's config bundle twice; until then a BYO box upgraded from ≤ 0.164.0 keeps our drop-in until its next bundle | CC |
|
||||
|
||||
|
||||
## Monitoring & notifications — 21 rows (P2 1, P3 13, P4 7)
|
||||
## Monitoring & notifications — 23 rows (P2 3, P3 13, P4 7)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
@@ -318,8 +322,10 @@ stopping line that lies.
|
||||
| **R-1224** | Monitoring & notifications | P4 | **The operator's 1-hour mail cooldown for `wg_tunnel_stale` is per customer, not per host, and `wg_tunnel_ok` does not end it.** Fresh review 2026-10-23 night (`REPORT-night-2026-10-23.md`, H3): `notify/dispatcher.go:620` keys the cooldown `customerID:eventType`. Two hosts of one household going stale within an hour, or stale → ok → stale, store a second event row but mail once (the suppression is in `notification_log`). | OPEN | — | Key the cooldown by `host_id` from the details for host-scoped operator events, and let the matching ok event end it; a dispatcher test with two hosts; rides a hub deploy | CC |
|
||||
| **R-1233** | Monitoring & notifications | P4 | **`[ERROR] [stacks] execCommand failed: exit status 1` names no command.** Seen once a night (2026-10-21 00:30:49 and 2026-10-23 02:17:14 UTC, each right after an app stopped for its dump); the command and stderr go only into the returned error, which the caller may drop (`internal/stacks/manager.go:1757`). An ERROR nobody can judge. | OPEN | — | Log the command's first two words (`docker inspect`, never the arguments — `docker exec … psql` can carry a password) and the stderr's first line; find the caller of the nightly one | CC |
|
||||
| **R-1296** | Monitoring & notifications | P4 | **When ep0's tenancy script refuses, the hub log shows only its one-line error — PBS's own reason (the 403 `missing Datastore.Audit|Datastore.Backup on …`) stays in the script's stderr, which the hub drops on a refusal.** Found 2026-10-26 diagnosing R-1295: the cause was visible only by reading ep0's proxy journal over root SSH. `hub/internal/tenantsync/client.go` `parseResponse` returns the JSON error and ignores stderr; the script keeps secrets off stderr by design (its header), so the tail is safe to log. | OPEN | — | append the last ~3 stderr lines to the refusal error (bounded, never stdout); a test that a secret on stdout never appears | CC |
|
||||
| **R-1327** | Monitoring & notifications | P2 | **The security watch could not see a bug in the RUNTIME under an app — HTTP2Shell (CVE-2026-111497, the Brotli decoder in Node.js and Python's `brotli`/`brotlicffi`, 2026-10-21) never reaches an app's own notices, so Home Assistant and RomM ran the bad code on the test boxes unseen.** Measured 2026-10-27 from the images (`scripts/image_runtime.py`, registry config + layers, no pull): Home Assistant 2026.9.4 Python Brotli 1.2.0 (2026.10.4: 1.2.1); RomM 5.3.1 and 5.4.1 Node 24.18.1 (fixed 24.22.1); Immich v3.2.4 Node 24.21.0 (v3.3.5: 24.22.1); cal.com v6.2.0 Node 20.20.0; Paperless 2.20.15 Brotli 1.1.0 — each matching a live container where one runs. | **VERIFY** — BUILT 2026-10-27 night (commit only): the watch reads every pin's runtime (`security_watch_runtimes.json`: Node, Python Brotli, brotlicffi, Alpine brotli-libs for our own images), an ADVISORY with source „runtime", cached by image digest in `state.json` (`runtime_cache`) — CI has no zstd, so the cache is filled on DooPlex; a new zstd image in CI is NOT CHECKED with the way to fill it. Tests W10 (W1–W12: 58 checks), red-proved. Not in the table: Debian `libbrotli1` (Debian 13's fixed version not known tonight). Waits for: the first CI night naming Home Assistant and RomM. | — | CI's first nightly run lists HA and RomM as ADVISORY (runtime) and audiobookshelf as not; then close | CC |
|
||||
| **R-1328** | Monitoring & notifications | P2 | **DooPlex's own workloads were not in the security watch at all** — about ten public apps there carry a bad Brotli/Node (HTTP2Shell), on the host that runs the hub, Gitea, the registry and the backups. | **VERIFY** — BUILT 2026-10-27 night (commit only): `scripts/dooplex_inventory.py` lists every `image:` of homelab-manifests (89 images, `documentation/security-watch/dooplex-workloads.txt`; NOT Helm-chart images — said in the file); the watch reads them as the group „dooplex" (operator mails only, own block, „Next: the homelab session"); an image in the private registry is NOT CHECKED with the reason. Tests W12, red-proved. The homelab session's list: `documentation/audits/http2shell-2026-10-27/HOMELAB-LIST.md`. Felhom changes nothing on DooPlex. | — | the first CI night shows the DooPlex block; the homelab session works its list | CC |
|
||||
|
||||
## Hub & operator — 13 rows (P3 4, P4 9)
|
||||
## Hub & operator — 12 rows (P3 3, P4 9)
|
||||
|
||||
| ID | Category | Sev | What | State | Blocked on | Next action | Owner |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
@@ -335,7 +341,6 @@ stopping line that lies.
|
||||
| **R-1056** | Hub & operator | P4 | **Five operator routes fit no token group, so they are session only until the operator places them:** apps reset-telemetry and dismiss-issues, the Configuration asset re-seed, the off-site WireGuard endpoint save, the off-site abandon-cancel (`05` §17.3). Nothing needs them by token today. | WAITING-ON-OPERATOR — filed 2026-10-15 by the token build | operator decision | Place each in a group, or leave session only | operator |
|
||||
| **R-1164** | Hub & operator | P4 | **Move the website to Hetzner (maybe the JARRs.eu prod server) — an operator idea, no decision asked yet.** If it is done, the website's git-syncs must read the public `https://gitea.dooplex.hu/admin/felhom.eu.git` again: since 2026-10-19 (R-1163) all four read Gitea in-cluster, which works only inside the DooPlex cluster (`01-topology-and-trust.md` §7, `manifests/webpage.yaml`). | OPEN | the operator's idea becoming a decision | When decided: switch the four `--repo` values together (gate 6 keeps them identical); keep `--max-failures=-1` | operator |
|
||||
| **R-1293** | Hub & operator | P4 | **Once a year the hub's 02:00 database copy never reaches ep0, and the 20:00 copy is pushed twice instead.** Measured 2026-10-26 during R-1183's read (`audits/night-2026-10-25/r1183-measurement-2026-10-26.txt`): on 2026-10-25 (the clocks go back) 02:00–03:00 happens twice. The hub's `nextDailyRun` uses `time.Date`, which picks the SECOND 02:00 (CET, 01:00Z — measured with Go). DooPlex's `felhom-hub-db-backup.timer` fired at the FIRST 02:30 (CEST, 00:31Z) and pushed `hub-20261024T180000Z.db`, 391 min old — under the 7 h limit, so no refusal and no alarm; the 08:30 push took the 08:00 copy. Effect: for one morning a year ep0's newest hub copy is 12 h old, not 6 h; nothing is lost on the hub. The spring night (2027-03-28, 02:00–03:00 does not exist) is not measured. | OPEN | — | pick one: the push refuses (and says so) a newest snapshot older than the slot it serves, or the hub and the timer agree on one 02:00; then read the 2027-03-28 night (DUE-CHECKS) | CC |
|
||||
| **R-1326** | Hub & operator | P3 | **The hub's start-up eats half its liveness margin: hub 0.174.0 took 36 s from „starting" to „Listening on :8080" (0.174.1: 31 s), and the liveness probe (`initialDelaySeconds` 5, `periodSeconds` 30, `failureThreshold` 3) kills the container after ~65 s of failed probes.** Seen 2026-10-27 at both deploys: two `Liveness probe failed … connection refused` events at start, then ready. The hub's database keeps growing (559 MB on 2026-10-27 04:05); a start-up past ~65 s would restart the hub in a loop at every deploy. No startup probe is set. | OPEN | — | Measure what the start spends its 30 s on (DB open, migrations, checkers); then a `startupProbe` (e.g. 10 s × 18) in `manifests/hub.yaml`, or move the slow work after `Listen` | CC |
|
||||
|
||||
## Business & legal — 14 rows (P2 4, P3 2, P4 8)
|
||||
|
||||
@@ -364,7 +369,7 @@ stopping line that lies.
|
||||
| **R-1240** | Process & tooling | P4 | **Scratch guest 9202 holds 34 saved copies of its `controller.yaml`, each carrying the catalog's git token** (`controller.yaml.pre-<session>`, 2026-09-21 → 2026-10-17, root 0600, inside the guest's controller volume). Every drill session that repointed 9202 saved one and none removed it after its byte-identical restore. Found 2026-10-23 (the D39 session removed its own after `cmp` proved it identical). Not read: whether the token in them is still live (R-925 rotated tokens). | **OPEN** | — | read which token the copies carry (by hash, never printed); if the live one, delete the copies; add „remove the save after an identical restore" to `repoint.py restore` | CC |
|
||||
| **R-1081** | Process & tooling | P4 | **Two published controller tags hold content that is not what their number says: `0.315.0` and `0.316.3`.** Both were caused by CC on 2026-10-15, and both by the same shape — a guard that was not on the path the work takes. **`0.316.3`:** the build directory's `build.sh` is a symlink into the SHARED clone's working copy, which predated the `FELHOM_REPO_DIR` override, so the override was silently ignored and the build copied that tree — which held 31 uncommitted files of another session's physical-disk storage work. The banner printed `Commit: 0225255` with no `Repo:` line. **Nobody deployed it; that was luck, not a control.** Fixed at the root in controller v0.316.4: `build.sh` now refuses `--push` from a tree that is dirty, not at `origin/main`, or not a git checkout, with four test cases red-proved. **Neither tag is re-pushed or deleted** — a version number is pushed once, and that applies to numbers CC spoiled. **No box runs either:** demo-hp 9201 is on 0.317.0, the floor is 0.314.0, and the button offers the highest tag. **`0.315.0`:** Caused by CC on 2026-10-15 while proving R-1080's own fix: the guard was added to `controller/build.sh` in the repo, but the documented release command runs `$FELHOM_ROOT/build/felhom-controller/build.sh`, which was a **separate copy taken 2026-07-18** and had no guard. Running the refusal against a real existing tag therefore rebuilt and re-pushed 0.315.0 — a fourth time — with v0.316.0's code under it (digest `8887343011d6` → `b809201841f7`). **Fixed at the root in the same session:** the build directory's script is now a symlink to the repo's, the old copy kept beside it as `build.sh.stale-copy-2026-07-18`, and the refusal was then proven to fire from the documented path. **No box is affected:** nothing runs 0.315.0 (demo-hp 9201 is on 0.316.2), the floor is 0.314.0, and the household button offers the highest tag. What remains is two tags that must never be deployed and are no longer reproducible from the registry. | **OPEN** — filed 2026-10-15; nothing to do unless someone needs one of those two images, and then the answer is the current release | — | Leave them. If an audit ever needs the real 0.315.0 or 0.316.3, build it from the matching commit under a NEW number and say so | CC |
|
||||
| **R-1034** | Process & tooling | P3 | **Gate 17 checks the FAQ JSON-LD on two pages only, by a hard-coded list — a FAQPage anywhere else is unchecked.** `scripts/site_gates.py` gate 17 loops `for p in ("gyik.html", os.path.join("en", "faq.html"))`, so its „JSON-LD equals the visible questions and answers” guarantee stops at those two files. **Since 2026-10-14 two more pages carry a FAQPage block the gate never reads:** `/sajat-felho-tarhely` and `/en/own-cloud-storage`. Their JSON-LD was *derived* from the visible headings and paragraphs by a script and then verified verbatim against the rendered text, so it is correct today — but nothing stops the next copy edit moving the visible text and leaving the structured data behind, which is exactly the failure gate 17 exists to catch, and the one Google penalises. **Why it is not a one-line fix:** gate 17's extractor is written for the FAQ pages' accordion markup (`<button class="faq-question">` … `<div class="faq-answer-inner">`); the new pages use plain `<h2>` + `<h3>`/`<p>` sections, so widening the scope needs a second extractor beside the first. **Scope is a fact** (repo `CLAUDE.md`: prefer a walk over a hand-maintained list) — the gate should scan **every page containing a FAQPage block**, not a named pair, or the next page to carry one is unguarded in the same way. A decoy is owed for the widened gate (R-421). | **OPEN** | — | widen gate 17 to every page carrying a FAQPage block, second extractor + decoy | CC |
|
||||
| **R-987** | Process & tooling | P4 | **The 53 catalog app images have never been scanned for known vulnerabilities.** Fix: a monthly trivy pass over the images the catalog pins, reported, not gating. | OPEN | — | Add to the monthly re-test | CC |
|
||||
| **R-987** | Process & tooling | P4 | **The 53 catalog app images have never been scanned for known vulnerabilities.** Fix: a monthly trivy pass over the images the catalog pins, reported, not gating. | **OPEN** — 2026-10-27 evidence: HTTP2Shell (CVE-2026-111497) sat in the RUNTIME of five catalog images (Home Assistant, RomM, Immich, cal.com, Paperless) and no notice of theirs said so; the nightly watch now reads each image's runtime (R-1327) — a full scan of every package is still this row. **Earlier:** OPEN | — | Add to the monthly re-test | CC |
|
||||
| **R-733** | Process & tooling | P3 | **[P3-LOW] The test bench has NO swap and the boxes have 512 MiB — so a box proof can pass on swap where the bench fails, and nobody records whether a customer guest has swap.** MEASURED 2026-09-30 (R-732): immich's first start was OOM-killed 61–104 times on the bench (swap 0) and passed on 9202 by swapping ~108 MB; the bench given 512 MiB swap passed too. demo-hp 9201, 9202 and demo-felhom 9201 all read `swap: 512`; the golden's guest config is not recorded in its bake evidence, so a customer guest's swap is NOT measured. The harness's memory watch judges `anon` against the limit and never reads `memory.swap.current`. **Needs:** the golden's `swap` read and recorded; the box walk and the harness report `memory.swap.peak` beside `anon`; a decision whether proofs run with swap off (the stricter venue, as R-732's fix was proven). | **READY — rank P3-LOW; owner: CC (harness + golden evidence)** **2026-10-06 night: NARROWED** — the harness records each container's `swap_peak` and the venue's swap (catalog branch `night-held-2026-10-06`, `3f4611c`; SwapRecorded red-proved; bench SwapTotal 0 kB, 9202 524288 kB). LEFT: the golden's swap in its bake evidence, the box walk's record, and whether proofs run with swap off. | — | — | CC |
|
||||
| **R-902** | Process & tooling | P3 | **The contact form's mailer has no source in any repository: the running image cannot be rebuilt or changed.** FOUND 2026-10-08 (website refresh, brief Part C5). `manifests/contact-mailer.yaml` names `contact-mailer:latest` with `imagePullPolicy: Never` (imported into k3s by hand); the binary in the pod is `/app/contact-mailer` dated 2026-02-05, Go module `github.com/felhom/contact-mailer` (devel). Searched: `git log --all` of felhom.eu (only the manifest), every repo under `/mnt/5_hdd/felhom.eu/git`, `find /mnt/5_hdd/felhom.eu ~ -maxdepth 5 -iname '*contact-mailer*'`. READ from the binary (strings, read-only `kubectl exec … cat`): ONE send per form (`sendViaResend`) to `TO_EMAIL`, `reply_to` = the visitor; nothing is sent back to the visitor; the operator's notification is Hungarian (`buildEmailHTML`, „Csatolmány … fájl"). The English form needs no mailer change (its subject labels carry „(EN)"). `audits/website-refresh-2026-10-08/mailer.md` | **OPEN — NARROWED 2026-10-08 (search done, NOT FOUND): owner: operator.** A read-only search found no source on DooPlex (55,548 `*.go`/`go.mod`/`Dockerfile*` files, every disk, media/Longhorn/containerd/PBS excluded by name), in the web editor's storage and file history, in all 10 Gitea repositories' history, or in Docker's build cache (oldest record 2026-09-28). The binary's own clues: one file `/build/main.go`, go1.23.12, no `vcs.*` stamp; image built 2026-02-05 10:40 by BuildKit. The binary is now KEPT in git (`audits/mailer-source-2026-10-08/contact-mailer.bin`), so a DooPlex rebuild no longer loses the program. A replacement plan is written (`audits/mailer-source-2026-10-08/PLAN-replacement.md`); one question left: is the February folder on the operator's Windows workstation? | — | Operator: look on the workstation; if absent, build the replacement from the plan (attended deploy) | operator |
|
||||
| **R-935** | Process & tooling | P3 | **Something sets `core.bare = true` on the shared `felhom.eu` checkout, and then every git command there fails („this operation must be run in a work tree").** SEEN 2026-10-12 evening twice: `.git/config` changed at 16:29:37 and 16:37:33 CEST, each time with `core.bare=true`; restored by hand both times (`git config core.bare false`, a flag only, no file touched). **Not caused by the gates:** `repo_gates.py --fast` run plainly and with `GIT_DIR=.git` (as a hook gets it) left the flag `false`; a scratch `git init --bare <path>` under `GIT_DIR` does not flip the parent either. The first flip came while this session did not touch the repo; another session pushed to main at 16:44 from elsewhere. | **OPEN** — 2026-10-12 later: across this session's next push the flag stayed `false` (read before and after); not this session's pushes. **OPEN** — NEW 2026-10-12 **Note 2026-10-12 (security review):** at least some of these flips match the security review's pushes from a git worktree of this clone (about 16:29 and 16:37): inside the pre-push hook, `scripts/test_gate_decoys.py`'s poster-facts case runs `git init`/`git config`/`git commit` with the hook's inherited `GIT_DIR`, so it wrote into the real repository — four test commits in the worktree and `user.name d` / `user.email d@d` in the shared `.git/config` (the review removed that `[user]` section at about 16:50; commits 6c2c3dd5 and 186f3aa3 carry that author). The review stopped pushing from the worktree. Fix: the test helper must drop `GIT_DIR`, `GIT_WORK_TREE` and `GIT_INDEX_FILE` from its environment. | finding the writer | Watch `.git/config` (an inotify or audit rule on the file) during a day with the parallel sessions; name the command; fix it there | CC |
|
||||
|
||||
@@ -0,0 +1,93 @@
|
||||
# DooPlex (homelab) workload images — the security watch's „dooplex" group (R-1328). GENERATED by
|
||||
# scripts/dooplex_inventory.py from homelab-manifests 5aeec8d (2026-10-27) — read only; nothing on DooPlex is changed from
|
||||
# here. NOT in this list: images a Helm chart picks inside its own templates (Longhorn, ArgoCD, cert-manager,
|
||||
# the ingress controller and the like) — they are in no `image:` line of the repo.
|
||||
actualbudget/actual-server:26.10.0 actualbudget-system/actualbudget.yaml
|
||||
advplyr/audiobookshelf:2.37.1 audiobookshelf-system/audiobookshelf.yaml
|
||||
alpine/k8s:1.37.1 admin-system/authentik-shm-cleaner.yaml, admin-system/crashloop-restarter.yaml, jarr-nightly-system/reset.yaml
|
||||
arcadiatechnology/crafty-4:4.11.0 crafty-system/crafty.yaml
|
||||
bhgedigital/envsubst:latest mon-system/alertmanager.yaml
|
||||
busybox:1.38 admin-system/wan-monitor.yaml, arcade-system/romm.yaml, booking-system/booking.yaml, gitea-system/gitea.yaml, jarr-nightly-system/app.yaml, jarrs-system/jarr-dev.yaml, web-system/web.yaml, workout-system/sparkyfitness.yaml
|
||||
codercom/code-server:4.143.1 code-system/code.yaml
|
||||
codewithcj/sparkyfitness:v1.9.0 workout-system/sparkyfitness.yaml
|
||||
codewithcj/sparkyfitness_server:v1.9.0 workout-system/sparkyfitness.yaml
|
||||
crocodilestick/calibre-web-automated:dev calibre-system/cwa.yaml
|
||||
docker.io/bitnamilegacy/postgresql:17.6.0-debian-12-r3 nextcloud-system/nextcloud.yaml
|
||||
docker.io/calcom/cal.com:v6.2.0 booking-system/booking.yaml
|
||||
docker.io/library/nextcloud:34.0.5-apache nextcloud-system/nextcloud.yaml
|
||||
docker.io/valkey/valkey:9.2-alpine immich-system/immich.yaml
|
||||
f0rc3/gokapi:v2.2.4 fileshare-system/gokapi.yaml
|
||||
filebrowser/filebrowser:v2.63.23 orsi-system/filebrowser.yaml, web-system/web.yaml
|
||||
flomp/wanderer-db:v0.21.0 wanderer-system/wanderer.yaml
|
||||
flomp/wanderer-web:v0.21.0 wanderer-system/wanderer.yaml
|
||||
getmeili/meilisearch:v1.11.3 wanderer-system/wanderer.yaml
|
||||
ghcr.io/alam00000/bentopdf:2.8.10 office-system/bentopdf.yaml
|
||||
ghcr.io/cloudnative-pg/postgresql:17.2 database-system/postgresql-backup.yaml
|
||||
ghcr.io/diced/zipline:4.8.1 zipline-system/zipline.yaml
|
||||
ghcr.io/gethomepage/homepage:v1.13.2 homepage-system/homepage-orsi.yaml, homepage-system/homepage.yaml
|
||||
ghcr.io/headlamp-k8s/headlamp:v0.46.0 headlamp-system/headlamp.yaml
|
||||
ghcr.io/immich-app/immich-machine-learning:v2.7.5 immich-system/immich.yaml
|
||||
ghcr.io/immich-app/immich-server:v2.7.5 immich-system/immich.yaml
|
||||
ghcr.io/immich-app/postgres:16-vectorchord0.3.0 immich-system/immich.yaml
|
||||
ghcr.io/jimmidyson/configmap-reload:v0.15.0 mon-system/monitoring.yaml
|
||||
ghcr.io/lukegus/termix:release-2.9.2 termix-system/termix.yaml
|
||||
ghcr.io/onedr0p/exportarr:v2.3.0 mon-system/monitoring.yaml
|
||||
ghcr.io/paperless-ngx/paperless-ngx:3.3.4 paperless-system/paperless.yaml
|
||||
ghcr.io/seanmorley15/adventurelog-backend:latest adventurelog-system/adventurelog.yaml
|
||||
ghcr.io/seanmorley15/adventurelog-frontend:latest adventurelog-system/adventurelog.yaml
|
||||
ghcr.io/seerr-team/seerr:v3.5.1 servarr-system/servarr.yaml
|
||||
ghcr.io/seriousm4x/upsnap:5 admin-system/upsnap.yaml
|
||||
ghcr.io/stakater/reloader:v1.4.22 control-system/reloader.yaml
|
||||
ghcr.io/tautulli/tautulli:v2.18.2 servarr-system/tautulli.yaml
|
||||
ghcr.io/thomiceli/opengist:1.15.3 opengist-system/opengist.yaml
|
||||
gitea.dooplex.hu/admin/felhom-act-runner:0.1.0 gitea-system/act-runner.yaml
|
||||
gitea.dooplex.hu/admin/jarr:latest jarr-nightly-system/app.yaml, jarrs-system/jarr-dev.yaml
|
||||
gitea.dooplex.hu/admin/recipe-importer:latest tandoor-system/recipe-importer.yaml
|
||||
gitea.dooplex.hu/admin/revfulop-calendar:1.6.2 orsi-system/revfulop-calendar.yaml
|
||||
gitea.dooplex.hu/admin/sparkyfitness-export:0.3.0 workout-system/sparkyfitness-export.yaml
|
||||
gitea.dooplex.hu/admin/wan-probe:0.1.0 admin-system/wan-monitor.yaml
|
||||
gitea/gitea:1.26.2 gitea-system/gitea.yaml
|
||||
glanceapp/glance:v0.8.7 glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml
|
||||
grafana/grafana:13.2.4 mon-system/monitoring.yaml
|
||||
griefed/serverpackcreator:8.1.2 crafty-system/serverpackcreator.yaml
|
||||
gtstef/filebrowser:1.5.8-stable kisfenyo-system/filebrowser-quantum.yaml
|
||||
guacamole/guacamole:1.6.0 kisfenyo-system/guacamole.yaml
|
||||
guacamole/guacd:1.6.0 kisfenyo-system/guacamole.yaml
|
||||
index.docker.io/plexinc/pms-docker:1.43.5.11029-6bf8af3f0 docs/incidents/HM-040/plex-config-rebuild-job.yaml, docs/incidents/HM-040/plex-db-diagnosis-job.yaml, docs/incidents/HM-040/scratch-securitycontext-test.yaml
|
||||
itzg/mc-backup:2026.10.1 crafty-system/minecraft-tlauncher.yaml
|
||||
itzg/minecraft-server:2026.10.0-java21 crafty-system/minecraft-tlauncher.yaml
|
||||
linuxserver/bookstack:26.09.20260929 bookstack-system/bookstack.yaml
|
||||
linuxserver/prowlarr:version-2.6.5.5623 servarr-system/servarr.yaml
|
||||
linuxserver/qbittorrent:5.3.0 servarr-system/servarr.yaml
|
||||
linuxserver/radarr:version-6.4.4.10685 servarr-system/servarr.yaml
|
||||
linuxserver/sonarr:version-4.0.20.3014 servarr-system/servarr.yaml
|
||||
louislam/uptime-kuma:2.5.6 uptimekuma-system/uptimekuma.yaml
|
||||
mariadb:11 arcade-system/romm.yaml, bookstack-system/bookstack.yaml
|
||||
mikefarah/yq:4.54.1 glance-system/glance-kisfenyo.yaml, glance-system/glance-orsi.yaml
|
||||
minio/minio:latest outline-system/outline.yaml
|
||||
mongodb/mongodb-community-server:8.0.5-ubuntu2204 crafty-system/serverpackcreator.yaml
|
||||
msdeluise/plant-it-server:0.10.0 plantit-system/plantit.yaml
|
||||
mysql:8.4 plantit-system/plantit.yaml
|
||||
nginx:1.31-alpine web-system/web.yaml
|
||||
nicolaka/netshoot:latest admin-system/toolbox.yaml
|
||||
onlyoffice/documentserver:9.4.0 office-system/onlyoffice.yaml
|
||||
outlinewiki/outline:1.11.0 outline-system/outline.yaml
|
||||
postgis/postgis:16-3.5 adventurelog-system/adventurelog.yaml
|
||||
postgres:15-alpine workout-system/sparkyfitness.yaml
|
||||
postgres:16-alpine jarr-nightly-system/data.yaml, jarrs-system/jarr-dev.yaml
|
||||
privatebin/nginx-fpm-alpine:2.0.6 privatebin-system/privatebin.yaml
|
||||
prom/alertmanager:v0.34.1 mon-system/alertmanager.yaml
|
||||
prom/node-exporter:v1.12.1 mon-system/monitoring.yaml
|
||||
prom/prometheus:v3.15.0 mon-system/monitoring.yaml
|
||||
prometheuscommunity/smartctl-exporter:v0.15.0 admin-system/smartctl-exporter.yaml
|
||||
python:3.15-bookworm glance-system/glance-helper.yaml
|
||||
quay.io/jetstack/version-checker:v0.11.0 version-checker-system/version-checker.yaml
|
||||
quay.io/prometheus/blackbox-exporter:v0.29.1 admin-system/wan-monitor.yaml
|
||||
redis:8-alpine booking-system/booking.yaml, jarr-nightly-system/data.yaml, jarrs-system/jarr-dev.yaml, outline-system/outline.yaml, paperless-system/paperless.yaml
|
||||
redis:8.10-alpine arcade-system/romm.yaml
|
||||
redis:8.10.2 plantit-system/plantit.yaml
|
||||
renovate/renovate:44.181.1 admin-system/renovate.yaml
|
||||
rommapp/romm:5.4.0 arcade-system/romm.yaml
|
||||
tailscale/tailscale:v1.104.2 admin-system/tailscale.yaml
|
||||
vabene1111/recipes:2.6.15 tandoor-system/tandoor.yaml
|
||||
vaultwarden/server:1.37.4 vaultwarden-system/vaultwarden.yaml
|
||||
File diff suppressed because it is too large.
Load diff
Reference in new issue
Block a user