admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,006 Commits 1 Branch 9 Tags
554b237ba9f3cf62b54fce47e081afd013536be1
Commit Graph

237 Commits

Author SHA1 Message Date
admin 70250ffb95 hub: deploy v0.150.0 (app_repaired_after_crash, R-1007) — operator present
gates / gates (push) Successful in 6m46s
Details 
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
 2026-10-14 17:03:49 +02:00
admin 35e546a951 Deploy hub v0.149.0 (R-998: the deliberate-off hold) 2026-10-13 20:20:25 +02:00
d fa5c13eac1 manifests/webpage: nginx gzip for text (R-931); a pod annotation so the subPath config reloads on sync
gates / gates (push) Successful in 6m11s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-12 16:59:12 +02:00
admin 8d34d60740 manifests: hub 0.148.0 (SECURITY, R-951)
gates / gates (push) Successful in 6m11s
Details
2026-10-12 16:55:26 +02:00
admin 0fbba61030 manifests: hub 0.147.0 (the operator's answers S4, S6, S10, S29, S30, S32, S33)
gates / gates (push) Successful in 6m14s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-12 15:27:07 +02:00
admin 2db785daf4 manifests: hub 0.146.0
gates / gates (push) Successful in 6m8s
Details 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
 2026-10-10 16:16:48 +02:00
admin b4083a06ed manifests: hub 0.145.0
gates / gates (push) Successful in 5m55s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-10 09:40:08 +02:00
admin e467785fd3 security: rotate the published secrets and de-git felhom.secret.yaml (R-925, P1)
gates / gates (push) Successful in 5m23s
Details 
WHY .gitignore "was not working": it was working. git never consults
.gitignore for a file it ALREADY TRACKS. The rule `*secret*` matched fine --
proved by dropping an untracked copy in and watching check-ignore name
`.gitignore:3:*secret*`. The file had been tracked since feea0606, which is
ironically the commit that de-gitted the Resend key.

WHAT THE EXPOSED VALUE ACTUALLY WAS. Not an analytics password: the GITEA
ADMIN ACCOUNT PASSWORD (is_admin true; /api/v1/admin/users answered 200), in
a repo gitea.dooplex.hu serves anonymously to the internet. That is push
access to every repo -- including the one whose website/ is git-synced live
and whose scripts/ is published by tag to every new box installer (R-110).
Re-ranked P2 -> P1 on that measurement; my first ranking had only measured
the analytics blast radius.

Every committed value was still live. Nothing had ever been rotated.

ROTATED (values never echoed; written to a 0600 file on DooPlex):
  umami-config        APP_SECRET + POSTGRES_PASSWORD. The password was
                      changed INSIDE postgres (ALTER USER) as well as in the
                      Secret -- the env var is only read at first init, so
                      patching the Secret alone would have changed nothing.
  healthchecks-config SECRET_KEY + SUPERUSER_PASSWORD (nothing consumes them,
                      there is no healthchecks Deployment).
  gitea-creds         no longer holds the admin password at all: a SCOPED
                      token (read:package + read:repository).
  gitea admin         new random password; gitea-system/gitea-admin updated.

VERIFIED, not assumed:
  - new admin password -> 200, OLD PUBLISHED PASSWORD -> 401 (the leak is dead)
  - umami: a real beacon returns 200 (so the app authenticates to postgres and
    writes) while a bogus site id still returns 400 (so the 200 means something)
  - hub: "Registry version check: latest = 0.304.0" AND "Template fetched
    (5881 bytes)", no auth failures
  - BOTH token scopes are load-bearing, and the second was found by breaking
    it: a package-only token made the hub log "Template fetch: unexpected
    status 403", because the template fetcher reads a raw file out of the
    felhom-controller repo, not the registry.

AN INCIDENT CAUSED BY THE FIX, recorded because it is the useful part: the
rollout restart needed to pick up the new umami secret put umami into
CrashLoopBackOff and took stats.felhom.eu down (503) for ~4 minutes. Not the
rotation -- at memory 512Mi that pod runs for months but CANNOT RESTART:
startup (Prisma + Next.js) peaks over the limit and is OOMKilled (exit 137).
Raised to 1Gi IN THE MANIFEST, not just live, per .claude/rules/manifests.md
("never bare kubectl set -- the next sync reverts it and the fix silently
disappears").

THE GATE: KNOWN_BACKLOG is removed from manifest_bearer_gate.py, as its own
comment instructed. Red-proofed with a decoy: exit 1 with it, exit 0 without.
An exemption kept this visible for three months and changed nothing.

WHAT REMAINS (operator, and it is bigger than what was fixed): the same
password is still the admin password in ~12 other namespaces -- nextcloud,
paperless, bookstack (a DATABASE ROOT password), tandoor, calibre,
adventurelog, gokapi, qbittorrent, servarr, homepage. Rotating Gitea does not
touch them. Also owed: a kisfenyo Gitea token sits in plaintext in the local
homelab-manifests remote URL and was printed to a session transcript during
this investigation, so it should be replaced regardless (R-580's shape).

NOT a finding: homelab-manifests is private (404 anonymously) and does not
contain the password; ArgoCD's repo credential is a separate token and was
untouched by the rotation.
 2026-10-09 13:21:18 +02:00
admin 702e19ee58 manifests: hub 0.144.0 (operator present)
gates / gates (push) Successful in 4m20s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-09 07:22:48 +02:00
admin d14578922f deploy hub 0.143.1 (Reply-To; operator attending, decisions 162/176)
gates / gates (push) Successful in 3m16s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-07 18:52:44 +02:00
admin 0ece2ff743 deploy hub 0.143.0 (the kernel lane; operator attending, decision 162)
gates / gates (push) Successful in 3m27s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-07 15:38:08 +02:00
admin 374213f279 manifests: hub 0.142.0
gates / gates (push) Successful in 3m14s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-07 13:12:30 +02:00
admin 011a481a32 manifests: hub 0.141.0
gates / gates (push) Successful in 2m57s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-07 08:56:04 +02:00
admin 035aaaad79 HUB pvc to 4G
gates / gates (push) Successful in 2m50s
Details
2026-10-07 07:33:15 +02:00
admin e0bdd52ba2 manifests: hub 0.140.0
gates / gates (push) Successful in 2m39s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-06 19:23:08 +02:00
admin 929e59e8f4 manifests: hub 0.139.0
gates / gates (push) Failing after 2m38s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-06 11:54:21 +02:00
admin dbede7975e installer 1.32.0 published: both webpage.yaml pins -> installer-v1.32.0 (09 decisions 137-138 recorded)
gates / gates (push) Successful in 2m11s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-06 07:50:48 +02:00
admin edde9e137a manifests: hub 0.138.0 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-06 00:33:33 +02:00
admin 81d04a6ae2 manifests: hub 0.137.0 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-05 19:48:34 +02:00
admin 5d8922e619 manifests: hub 0.136.0
gates / gates (push) Successful in 44s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-05 14:29:45 +02:00
admin d4be9f6ff1 hub v0.136.0: nightly VACUUM INTO snapshot, keep 2 (R-173 decision A); hub PVC 2Gi + Longhorn default group; 09 rulings 125-127; 05 §16.3
gates / gates (push) Failing after 14m0s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-05 14:28:30 +02:00
admin 2b30733b0d manifests: hub 0.135.0
gates / gates (push) Successful in 32s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-05 11:14:01 +02:00
admin ff25f1076d manifests: hub 0.134.0
gates / gates (push) Successful in 33s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-05 09:49:28 +02:00
admin c01d48f457 manifests: installer 1.31.0 (scripts sync ref)
gates / gates (push) Successful in 31s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 20:21:52 +02:00
admin 877e89ee2a manifests: hub 0.133.0
gates / gates (push) Successful in 36s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 20:19:40 +02:00
admin c9052264f7 manifests: publish installer 1.30.0 (both git-sync refs)
gates / gates (push) Successful in 34s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 17:36:21 +02:00
admin 245886ee92 manifests: revert the TEST-ONLY Docker approval wait (ruled 2 nights)
gates / gates (push) Successful in 30s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 16:28:52 +02:00
admin 30cfdc1dc5 manifests: TEST-ONLY Docker approval wait 0 nights (os-docker-crash Part B; reverted in the same session)
gates / gates (push) Successful in 31s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 16:27:19 +02:00
admin 3de64b138d manifests: hub 0.132.0
gates / gates (push) Successful in 30s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 16:17:23 +02:00
admin 0e970ba384 manifests: revert the TEST-ONLY OS approval wait (ruled 24h + 1 night)
gates / gates (push) Successful in 31s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 14:41:35 +02:00
admin a73f728a55 manifests: TEST-ONLY OS approval wait 2m / 0 nights (os-host-lane Part B ring-1 proof; reverted in the same session)
gates / gates (push) Successful in 28s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 14:38:17 +02:00
admin 771e12445c manifests: hub 0.131.1
gates / gates (push) Successful in 30s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 13:40:46 +02:00
admin 693f3b45aa manifests: hub 0.131.0
gates / gates (push) Successful in 31s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 13:05:59 +02:00
admin e55b2ceb63 manifests: serve the installer from installer-v1.29.0
gates / gates (push) Successful in 29s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 11:40:40 +02:00
admin 0e22a0ecc7 manifests: revert the TEST-ONLY OS approval wait (ruled 24h + 1 night)
gates / gates (push) Successful in 29s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 11:14:42 +02:00
admin 44992360a4 manifests: TEST-ONLY OS approval wait 2m / 0 nights (Part G 2; reverted in the same session)
gates / gates (push) Successful in 29s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 11:12:04 +02:00
admin 66b7540b7a manifests: hub 0.130.0
gates / gates (push) Successful in 30s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 10:58:53 +02:00
admin 85e3e05e10 manifests: hub 0.129.0
gates / gates (push) Successful in 28s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 08:58:02 +02:00
admin 7a0d0c027d hub: remove the OFFSITE_ABANDON_DELAY=3m test configuration (decision-74 live proof done) — set-aside deletions wait 7 days again
gates / gates (push) Successful in 28s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 07:12:33 +02:00
admin 5eee18cf16 hub v0.128.0 deployed — with OFFSITE_ABANDON_DELAY=3m as a logged TEST configuration for the decision-74 live proof (reverted next)
gates / gates (push) Successful in 30s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 07:06:40 +02:00
admin cdfcc47b15 hub v0.127.0 deployed: manifest image tag + required OFFSITE_SECRET_KEY (Secret/offsite-secret-key, created out-of-band)
gates / gates (push) Successful in 29s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-03 16:58:23 +02:00
admin 7e50098088 manifests: hub 0.126.0
gates / gates (push) Successful in 26s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-30 10:36:53 +02:00
admin 27641ce9e7 added IE
gates / gates (push) Successful in 25s
Details
2026-09-30 10:15:01 +02:00
admin f12f8609fc manifests: hub 0.125.0 (R-688)
gates / gates (push) Successful in 23s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-25 13:28:37 +02:00
admin 068e06537a manifests: hub 0.124.0
gates / gates (push) Successful in 24s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-24 16:27:41 +02:00
admin b33a33130e manifests: hub 0.123.0 (decision 28 app_stopped_unhealthy)
gates / gates (push) Successful in 27s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-24 11:39:17 +02:00
admin 500488cad6 manifests: hub 0.122.0 (R-659 app_hold_no_whole_copy)
gates / gates (push) Successful in 28s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-24 07:34:19 +02:00
admin 3add9fa678 manifests: hub 0.121.0 (app_oom_storm, R-636)
gates / gates (push) Successful in 25s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-23 17:18:14 +02:00
admin 7caa24ffe1 manifests: hub 0.120.0 (app_update_undone/held reach the household)
gates / gates (push) Successful in 25s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-23 13:48:50 +02:00
admin 83b558b3ea deploy hub 0.119.0 (R-597)
gates / gates (push) Successful in 23s
Details 
Rollback: set this line back to felhom-hub:0.118.1, commit, sync.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-21 07:57:59 +02:00