admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: GL-8 wrap — runbook F3/F6 notes, findings FIXED, REPORT, decision log

Browse Source 
day0-install: F3 (no --allow-new-leaf on a populated BYO host) + F6 (:53 must
be free, refusal + remediation). GO-LIVE-PACKAGE + DRILL-GL6 ledger flip
F1/F3/F6 -> FIXED v1.12.0; GL-7 unblocked; F2/F7 stay open. CONTEXT + REPORT.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-08 19:40:57 +02:00
parent 18a556a514
commit fb8e5111cf
5 changed files with 95 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
REPORT.md
+51 -42
View File
@@ -2,57 +2,66 @@
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
## RUNBOOK GL-6 — supervised go-live drill (demo box, two full cycles) — 2026-07-08
## TASK GL-8 — BYO coexistence hardening (host-install v1.12.0) — 2026-07-08
Full per-phase record: `documentation/pilot/DRILL-GL6-2026-07-08.md`. Supervised, Viktor gating
every phase; destructive (guest 9201 destroyed + rebuilt twice on felhom-pve). Go-live item **G7**
and the live-validation landing zone for GL-1…GL-5b. Ended with the demo healthy on normal life.
**Baseline confirmed:** felhom.eu `1dc86523`, `SCRIPT_VERSION="1.11.3"` → **`1.12.0`** (`18a556a5`).
Three independent fixes from the GL-6 drill findings, one file, one theme (BYO = Felhom is a guest
on a host it doesn't own). felhom.eu only; agent untouched. §13 STOP honored — no live install/
uninstall; the F6 refuse path is a read-only preflight die (safe to exercise), proven on felhom-pve.
**Baselines:** felhom.eu `bd97bc34` → **`87ba30ae`** (host-install `v1.11.1` → **`v1.11.3`** — two
fixes shipped mid-drill). felhom-agent `7f073936` (v0.76.0). Manifest confirmed vouching agent
0.76.0 + golden 0.103.0.
### The three fixes
### Result: DRILL COMPLETE — all gates GO
- **F3 — leaf guard narrowed.** The populated-host leaf-regeneration guard tested `pct list` (ANY
guest) and so over-fired on a BYO host's own non-Felhom guests, forcing `--allow-new-leaf` on
every fresh byo install. Now it tests `[[ -n "$(felhom_guests)" ]]` (the `/etc/felhom-bootstrap`
detector) — it fires only when a real Felhom guest exists (whose pinned fingerprint a leaf regen
would orphan — the 2026-06-28 incident). `--preserve-state-from` / `--allow-new-leaf` unchanged.
- **F6 — foreign `:53` refuse (byo), Viktor's §8 option 1.** In byo the agent's lan_resolver stays
off, so any `:53` bind is the owner's. GL-2's informational `:53` line is promoted to an actionable
gate that **`die`s with remediation and mutates nothing** — Felhom does not stop/mask/kill a DNS
service on a host it doesn't own (the break-glass analog). No stop/mask path, no consent-ack leg
(nothing to consent to). `ss` failure/absence degrades to a warn. Appliance mode untouched.
- **F1 — uninstall config purge.** The teardown removed `agent.json` but left `${agent_cfg}.bak*`
siblings — a GL-6 residue held a **live hub api_key**. Now it removes the config AND every `.bak*`
sibling, then the dir; the KEPT/WIPED statement + summary say "config (+ its .bak backups)". Paths
logged, contents never. GL-4 Scenario-D parity still green (the GL4-D token set unchanged — the
config removal was already covered).
- **Key-pin chain (GL-1's whole point) — legs 1–4 all green:** box==repo==password-manager
fingerprints; signers ARMED from first boot (byo + appliance); the **pinned operational key
authorized a real signed `agent_update` round-trip** 0.76.0→0.76.1→0.76.0 (verify vs pinned
`felhom-op-1` + nonce, A/B swap, dwell, commit, crash-guard silent), throwaway 0.76.1 deleted.
- **Two full destroy/rebuild cycles + two clean uninstalls.** Uninstall: busy-drive prop handled
(warn+guidance, never `-l/-f`, statement=retry), KEPT/WIPED statement verbatim, host audit clean,
**drive data intact on all three checks** (witness hash matched). byo (Phase 2) + appliance
(Phase 6) installs both green; appliance's 4b vaulted the root@pam recovery credential to the hub.
- **C7 live-validated:** an induced pool-membership drop made `step_verify` `log_error` +
WITH-WARNINGS (read-only); repaired via `--adopt-pool` → green.
- **Drive re-enrollment via the real UI** (Chrome bridge) — additive, pre-drill data reappeared;
restore-test `mount_parity: ok` on both PBS (5m35s) and local tiers.
### Tests (harness `hostinstall-mode-harness.sh`, extended)
### Two fixes shipped mid-drill
Static (anywhere): **GL8-F3** (guard uses `felhom_guests`, not `pct list`), **GL8-F6** (byo `:53`
gate refuses+instructs; no `systemctl stop/mask` / `kill` of any `:53`/dnsmasq/resolv service
anywhere), **GL8-F1** (`${agent_cfg}.bak*` removal present) + **GL8-F1b** (behavioural: the exact
glob-removal clears `agent.json` + three `.bak*` + the emptied dir). PVE tier on felhom-pve:
**GL8-F6 live** — the byo preflight **actually refused at `:53`** (felhom-pve's leftover dnsmasq is
bound — the exact GL-6 F6 scenario) with the remediation + `PRE-FLIGHT FAIL (exit 1)`; and the
free-`:53` arm (ss shimmed empty) passes the gate. **36/36 on felhom-pve, 0 failed**; shellcheck
clean; GL-2 Scenario-A + GL-4 Scenario-D regression green.
1. **host-install v1.11.2 (Gate-0 ruling, G3):** empty customer git creds → **anonymous artifact
fetch** (the Felhom artifacts are world-readable by operator ruling; the hub-vouched sha256 stays
the integrity root). All 12 installer fetch targets 200-anon-verified first. Harness `+GL6-ANON`.
2. **host-install v1.11.3 (finding F4, HIGH — Viktor HOLD):** `--resume` fully skipped completed
producer steps (`should_skip X || step_X`), but token/enroll/grows produce in-memory outputs
later steps consume → a resumed install wrote a config missing `hub.host_id`/`proxmox.token`
(daemon crash-loop) and passed `-rootfs-grow ""` (flag parse error). Fix: those three re-run every
pass (idempotent); golden's volid re-derived from local. **Live-proven** (crafted dry-resume +
the subsequent appliance install ran single-shot). Harness `+GL6-F4`; 27/27; shellcheck clean.
**Red-proofs (mutate scratch copy → invariant fails → discard):** RP-F3 (revert to `pct list`) →
GL8-F3 FAILS; RP-F6 (drop the `:53` die) → GL8-F6 FAILS; RP-F1 (narrow to `agent.json` only) →
GL8-F1 FAILS. All confirmed.
### Findings filed (small installer follow-up, none block Peti)
### Judgment calls
F1 config `.bak` residue on uninstall · F2 per-drive `mnt-*.mount` residue · F3 byo fresh install on
a populated host needs `--allow-new-leaf` (guard counts any guest) · F6 leftover broken dnsmasq
breaks LAN-client DNS on a byo host · F7 pool re-assert is bring-up-only (no continuous heal;
`--adopt-pool` repairs). (F5 was a self-corrected misdiagnosis — the public DNS wildcard works.)
- F3 behavioural runtime is impractical to isolate (the guard is inline in step 5, gated on the real
state dir's leaf; felhom-pve has BOTH a leaf and a Felhom guest) — validated grep-level + red-proof;
the true behavioural proof (fresh byo install on a populated non-Felhom host proceeds without
`--allow-new-leaf`) folds into GL-7's Peti install.
- F6 uses the existing `ss -H -ltnup` (UDP+TCP) invocation — catches a UDP-only resolver (dnsmasq)
too, not just TCP.
- F1 is surgical (`${agent_cfg}` + `${agent_cfg}.bak*`, then `rmdir`), not `rm -rf` the dir — respects
a non-default `-config` path that might share a directory.
### Deferred to GL-7 (with Peti)
### NOT live-validated (folds into GL-7 / a demo re-run)
Dashboard password (operator-set via hub — G9) + geo-restriction; **G10** (public dashboard is open
until the operator sets a password) is a GL-7 prerequisite. Full demo app redeploy + LAN-DNS
alignment (re-provision changed the guest DHCP IP) are Viktor's return-to-normal.
The real populated-host byo install proceeding without `--allow-new-leaf` (F3); the real foreign-`:53`
refusal on Peti's box (F6 — proven read-only on felhom-pve here); the real uninstall purging a `.bak`
(F1 — behaviourally unit-tested + grep-verified). All fold into GL-7's Peti day-0 as the live proof.
### Honest leftovers (unchanged)
### Findings status + what's next
S5 customer-data DR drill; G12 parity-on-real-drift + PBS-tier runtime; CGNAT retest; Impl-3;
OOB spike. **Next: GL-7** (Peti's day-0 runbook + tester agreement).
F1/F3/F6 → **FIXED (v1.12.0)** in the GL-6 ledger + GO-LIVE-PACKAGE. **Still open (non-blocking):**
F2 (per-drive `mnt-*.mount` units survive uninstall), F7 (pool re-assert bring-up-only, no continuous
heal — `--adopt-pool` repairs). **GL-7 is unblocked** — Peti's day-0 command needs no `--allow-new-leaf`
workaround. **Next: GL-7** (Peti day-0 runbook + tester agreement).