admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,958 Commits 1 Branch 14 Tags
e8c8fc309b236201a53ff6759580cab062976128
Commit Graph
236 Commits
Author SHA1 Message Date
admin 35e546a951 Deploy hub v0.149.0 (R-998: the deliberate-off hold) 2026-10-13 20:20:25 +02:00
dandClaude Opus 5.5 fa5c13eac1 manifests/webpage: nginx gzip for text (R-931); a pod annotation so the subPath config reloads on sync
gates / gates (push) Successful in 6m11s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-12 16:59:12 +02:00
admin 8d34d60740 manifests: hub 0.148.0 (SECURITY, R-951)
gates / gates (push) Successful in 6m11s
Details
2026-10-12 16:55:26 +02:00
adminandClaude Opus 5.5 0fbba61030 manifests: hub 0.147.0 (the operator's answers S4, S6, S10, S29, S30, S32, S33)
gates / gates (push) Successful in 6m14s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-12 15:27:07 +02:00
adminandClaude Opus 5.5 2db785daf4 manifests: hub 0.146.0
gates / gates (push) Successful in 6m8s
Details 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
 2026-10-10 16:16:48 +02:00
adminandClaude Opus 5.5 b4083a06ed manifests: hub 0.145.0
gates / gates (push) Successful in 5m55s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-10 09:40:08 +02:00
admin e467785fd3 security: rotate the published secrets and de-git felhom.secret.yaml (R-925, P1)
gates / gates (push) Successful in 5m23s
Details 
WHY .gitignore "was not working": it was working. git never consults
.gitignore for a file it ALREADY TRACKS. The rule `*secret*` matched fine --
proved by dropping an untracked copy in and watching check-ignore name
`.gitignore:3:*secret*`. The file had been tracked since feea0606, which is
ironically the commit that de-gitted the Resend key.

WHAT THE EXPOSED VALUE ACTUALLY WAS. Not an analytics password: the GITEA
ADMIN ACCOUNT PASSWORD (is_admin true; /api/v1/admin/users answered 200), in
a repo gitea.dooplex.hu serves anonymously to the internet. That is push
access to every repo -- including the one whose website/ is git-synced live
and whose scripts/ is published by tag to every new box installer (R-110).
Re-ranked P2 -> P1 on that measurement; my first ranking had only measured
the analytics blast radius.

Every committed value was still live. Nothing had ever been rotated.

ROTATED (values never echoed; written to a 0600 file on DooPlex):
  umami-config        APP_SECRET + POSTGRES_PASSWORD. The password was
                      changed INSIDE postgres (ALTER USER) as well as in the
                      Secret -- the env var is only read at first init, so
                      patching the Secret alone would have changed nothing.
  healthchecks-config SECRET_KEY + SUPERUSER_PASSWORD (nothing consumes them,
                      there is no healthchecks Deployment).
  gitea-creds         no longer holds the admin password at all: a SCOPED
                      token (read:package + read:repository).
  gitea admin         new random password; gitea-system/gitea-admin updated.

VERIFIED, not assumed:
  - new admin password -> 200, OLD PUBLISHED PASSWORD -> 401 (the leak is dead)
  - umami: a real beacon returns 200 (so the app authenticates to postgres and
    writes) while a bogus site id still returns 400 (so the 200 means something)
  - hub: "Registry version check: latest = 0.304.0" AND "Template fetched
    (5881 bytes)", no auth failures
  - BOTH token scopes are load-bearing, and the second was found by breaking
    it: a package-only token made the hub log "Template fetch: unexpected
    status 403", because the template fetcher reads a raw file out of the
    felhom-controller repo, not the registry.

AN INCIDENT CAUSED BY THE FIX, recorded because it is the useful part: the
rollout restart needed to pick up the new umami secret put umami into
CrashLoopBackOff and took stats.felhom.eu down (503) for ~4 minutes. Not the
rotation -- at memory 512Mi that pod runs for months but CANNOT RESTART:
startup (Prisma + Next.js) peaks over the limit and is OOMKilled (exit 137).
Raised to 1Gi IN THE MANIFEST, not just live, per .claude/rules/manifests.md
("never bare kubectl set -- the next sync reverts it and the fix silently
disappears").

THE GATE: KNOWN_BACKLOG is removed from manifest_bearer_gate.py, as its own
comment instructed. Red-proofed with a decoy: exit 1 with it, exit 0 without.
An exemption kept this visible for three months and changed nothing.

WHAT REMAINS (operator, and it is bigger than what was fixed): the same
password is still the admin password in ~12 other namespaces -- nextcloud,
paperless, bookstack (a DATABASE ROOT password), tandoor, calibre,
adventurelog, gokapi, qbittorrent, servarr, homepage. Rotating Gitea does not
touch them. Also owed: a kisfenyo Gitea token sits in plaintext in the local
homelab-manifests remote URL and was printed to a session transcript during
this investigation, so it should be replaced regardless (R-580's shape).

NOT a finding: homelab-manifests is private (404 anonymously) and does not
contain the password; ArgoCD's repo credential is a separate token and was
untouched by the rotation.
 2026-10-09 13:21:18 +02:00
adminandClaude Opus 5.5 702e19ee58 manifests: hub 0.144.0 (operator present)
gates / gates (push) Successful in 4m20s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-09 07:22:48 +02:00
adminandClaude Opus 5.5 d14578922f deploy hub 0.143.1 (Reply-To; operator attending, decisions 162/176)
gates / gates (push) Successful in 3m16s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-07 18:52:44 +02:00
adminandClaude Opus 5.5 0ece2ff743 deploy hub 0.143.0 (the kernel lane; operator attending, decision 162)
gates / gates (push) Successful in 3m27s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-07 15:38:08 +02:00
adminandClaude Opus 5.5 374213f279 manifests: hub 0.142.0
gates / gates (push) Successful in 3m14s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-07 13:12:30 +02:00
adminandClaude Opus 5.5 011a481a32 manifests: hub 0.141.0
gates / gates (push) Successful in 2m57s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-07 08:56:04 +02:00
admin 035aaaad79 HUB pvc to 4G
gates / gates (push) Successful in 2m50s
Details
2026-10-07 07:33:15 +02:00
adminandClaude Opus 5.5 e0bdd52ba2 manifests: hub 0.140.0
gates / gates (push) Successful in 2m39s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-06 19:23:08 +02:00
adminandClaude Opus 5.5 929e59e8f4 manifests: hub 0.139.0
gates / gates (push) Failing after 2m38s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-06 11:54:21 +02:00
adminandClaude Opus 5.5 dbede7975e installer 1.32.0 published: both webpage.yaml pins -> installer-v1.32.0 (09 decisions 137-138 recorded)
gates / gates (push) Successful in 2m11s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-06 07:50:48 +02:00
adminandClaude Opus 5.5 edde9e137a manifests: hub 0.138.0 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-06 00:33:33 +02:00
adminandClaude Opus 5.5 81d04a6ae2 manifests: hub 0.137.0 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-05 19:48:34 +02:00
adminandClaude Opus 5.5 5d8922e619 manifests: hub 0.136.0
gates / gates (push) Successful in 44s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-05 14:29:45 +02:00
adminandClaude Opus 5.5 d4be9f6ff1 hub v0.136.0: nightly VACUUM INTO snapshot, keep 2 (R-173 decision A); hub PVC 2Gi + Longhorn default group; 09 rulings 125-127; 05 §16.3
gates / gates (push) Failing after 14m0s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-05 14:28:30 +02:00
adminandClaude Opus 5.5 2b30733b0d manifests: hub 0.135.0
gates / gates (push) Successful in 32s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-05 11:14:01 +02:00
adminandClaude Opus 5.5 ff25f1076d manifests: hub 0.134.0
gates / gates (push) Successful in 33s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-05 09:49:28 +02:00
adminandClaude Opus 5.5 c01d48f457 manifests: installer 1.31.0 (scripts sync ref)
gates / gates (push) Successful in 31s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 20:21:52 +02:00
adminandClaude Opus 5.5 877e89ee2a manifests: hub 0.133.0
gates / gates (push) Successful in 36s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 20:19:40 +02:00
adminandClaude Opus 5.5 c9052264f7 manifests: publish installer 1.30.0 (both git-sync refs)
gates / gates (push) Successful in 34s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 17:36:21 +02:00
adminandClaude Opus 5.5 245886ee92 manifests: revert the TEST-ONLY Docker approval wait (ruled 2 nights)
gates / gates (push) Successful in 30s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 16:28:52 +02:00
adminandClaude Opus 5.5 30cfdc1dc5 manifests: TEST-ONLY Docker approval wait 0 nights (os-docker-crash Part B; reverted in the same session)
gates / gates (push) Successful in 31s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 16:27:19 +02:00
adminandClaude Opus 5.5 3de64b138d manifests: hub 0.132.0
gates / gates (push) Successful in 30s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 16:17:23 +02:00
adminandClaude Opus 5.5 0e970ba384 manifests: revert the TEST-ONLY OS approval wait (ruled 24h + 1 night)
gates / gates (push) Successful in 31s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 14:41:35 +02:00
adminandClaude Opus 5.5 a73f728a55 manifests: TEST-ONLY OS approval wait 2m / 0 nights (os-host-lane Part B ring-1 proof; reverted in the same session)
gates / gates (push) Successful in 28s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 14:38:17 +02:00
adminandClaude Opus 5.5 771e12445c manifests: hub 0.131.1
gates / gates (push) Successful in 30s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 13:40:46 +02:00
adminandClaude Opus 5.5 693f3b45aa manifests: hub 0.131.0
gates / gates (push) Successful in 31s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 13:05:59 +02:00
adminandClaude Opus 5.5 e55b2ceb63 manifests: serve the installer from installer-v1.29.0
gates / gates (push) Successful in 29s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 11:40:40 +02:00
adminandClaude Opus 5.5 0e22a0ecc7 manifests: revert the TEST-ONLY OS approval wait (ruled 24h + 1 night)
gates / gates (push) Successful in 29s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 11:14:42 +02:00
adminandClaude Opus 5.5 44992360a4 manifests: TEST-ONLY OS approval wait 2m / 0 nights (Part G 2; reverted in the same session)
gates / gates (push) Successful in 29s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 11:12:04 +02:00
adminandClaude Opus 5.5 66b7540b7a manifests: hub 0.130.0
gates / gates (push) Successful in 30s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 10:58:53 +02:00
adminandClaude Opus 5.5 85e3e05e10 manifests: hub 0.129.0
gates / gates (push) Successful in 28s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 08:58:02 +02:00
adminandClaude Opus 5.5 7a0d0c027d hub: remove the OFFSITE_ABANDON_DELAY=3m test configuration (decision-74 live proof done) — set-aside deletions wait 7 days again
gates / gates (push) Successful in 28s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 07:12:33 +02:00
adminandClaude Opus 5.5 5eee18cf16 hub v0.128.0 deployed — with OFFSITE_ABANDON_DELAY=3m as a logged TEST configuration for the decision-74 live proof (reverted next)
gates / gates (push) Successful in 30s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-04 07:06:40 +02:00
adminandClaude Opus 5.5 cdfcc47b15 hub v0.127.0 deployed: manifest image tag + required OFFSITE_SECRET_KEY (Secret/offsite-secret-key, created out-of-band)
gates / gates (push) Successful in 29s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-10-03 16:58:23 +02:00
adminandClaude Opus 5.5 7e50098088 manifests: hub 0.126.0
gates / gates (push) Successful in 26s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-30 10:36:53 +02:00
admin 27641ce9e7 added IE
gates / gates (push) Successful in 25s
Details
2026-09-30 10:15:01 +02:00
adminandClaude Opus 5.5 f12f8609fc manifests: hub 0.125.0 (R-688)
gates / gates (push) Successful in 23s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-25 13:28:37 +02:00
adminandClaude Opus 5.5 068e06537a manifests: hub 0.124.0
gates / gates (push) Successful in 24s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-24 16:27:41 +02:00
adminandClaude Opus 5.5 b33a33130e manifests: hub 0.123.0 (decision 28 app_stopped_unhealthy)
gates / gates (push) Successful in 27s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-24 11:39:17 +02:00
adminandClaude Opus 5.5 500488cad6 manifests: hub 0.122.0 (R-659 app_hold_no_whole_copy)
gates / gates (push) Successful in 28s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-24 07:34:19 +02:00
adminandClaude Opus 5.5 3add9fa678 manifests: hub 0.121.0 (app_oom_storm, R-636)
gates / gates (push) Successful in 25s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-23 17:18:14 +02:00
adminandClaude Opus 5.5 7caa24ffe1 manifests: hub 0.120.0 (app_update_undone/held reach the household)
gates / gates (push) Successful in 25s
Details 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-23 13:48:50 +02:00
adminandClaude Opus 5 83b558b3ea deploy hub 0.119.0 (R-597)
gates / gates (push) Successful in 23s
Details 
Rollback: set this line back to felhom-hub:0.118.1, commit, sync.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-21 07:57:59 +02:00
adminandClaude Opus 5 a2c52ebf2a hub v0.118.1: the test mail follows the language too (R-558)
gates / gates (push) Successful in 23s
Details 
Found during v0.118.0's own live proof, which is the only reason it was found:
I went to press "send test notification" for the English demo box and read
sendTestEmail first.

It had its own hardcoded Hungarian subject and body and never went through
FormatCustomerEmail, so it was the one customer mail v0.118.0 did not localise
— and it is the only customer mail an operator can trigger on demand, which
makes it the one most likely to be used to check whether the localisation
works. Pressing the button for an English household would have answered that
question wrongly, and convincingly.

The two sentences are extracted byte-for-byte into the bundle, so the Hungarian
test mail is unchanged. Red-proofed against the hardcoded version.

The general form worth keeping: the surface you would use to CHECK a feature is
the one most worth checking first. A broken instrument that reports success is
worse than a broken feature.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
 2026-09-18 16:25:20 +02:00