Compare commits
12 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 admin
|
200ab6530b | ||
|
admin
|
5622ce2735 | ||
|
admin
|
afc939bb3c | ||
|
admin
|
b505ce4ba0 | ||
|
admin
|
5121536f10 | ||
|
admin
|
e4f022a0d9 | ||
|
admin
|
b9b56c47c0 | ||
|
admin
|
1fe9f84893 | ||
|
admin
|
7f7081d127 | ||
|
admin
|
e881115c43 | ||
|
admin
|
37cb83c166 | ||
|
admin
|
3332eb0919 |
@@ -228,8 +228,16 @@ jobs:
|
||||
|
||||
repo = os.environ.get("GITHUB_REPOSITORY", "?")
|
||||
sha = os.environ.get("GITHUB_SHA", "?")
|
||||
run = os.environ.get("GITHUB_RUN_NUMBER", "?")
|
||||
srv = os.environ.get("GITHUB_SERVER_URL", "https://gitea.dooplex.hu")
|
||||
# R-1135: the link is for a PERSON, so it is the public address and the run ID.
|
||||
# NOT GITHUB_SERVER_URL: the runner registers at the in-cluster address, so that variable
|
||||
# reads http://gitea.gitea-system.svc.cluster.local:3000, which nobody outside the cluster
|
||||
# can open (forced-test mail, job 1997). NOT GITHUB_RUN_NUMBER: Gitea 1.26 reads
|
||||
# /actions/runs/<n> as a run id first, so a run number that is also an older run's id
|
||||
# opens THAT run (measured 2026-10-18: felhom.eu /actions/runs/1116 opened the run whose
|
||||
# id is 1116 = run number 613). The link is printed too, so the job log carries it.
|
||||
run = os.environ.get("GITHUB_RUN_ID", "?")
|
||||
srv = "https://gitea.dooplex.hu"
|
||||
print("ALARM-LINK %s/%s/actions/runs/%s" % (srv, repo, run))
|
||||
|
||||
# R-265: how long the run took, so a reap is self-identifying. An honest gate failure
|
||||
# lands in well under a minute; a multi-minute figure means the job hit its own timeout
|
||||
|
||||
@@ -178,6 +178,12 @@ something, not only sessions that touch `documentation/` — which is why it is
|
||||
rows — a run can sit several pages earlier. **Scan every page** and match on `head_sha`; with a
|
||||
few hundred jobs that is a handful of requests. Guessing the page produced three consecutive
|
||||
false "no CI job for this commit" readings in one session.
|
||||
3. **A rerun REPLACES the attempt the `jobs` endpoint shows** (R-1137, measured 2026-10-18): the job
|
||||
keeps its id, `run_attempt` becomes 2, `started_at`, `conclusion` and the log are the rerun's — the
|
||||
red first attempt is gone from `jobs` and its log (controller jobs 1944, 1959: failure mails, now
|
||||
green). **A matched job with `run_attempt` > 1 is not a plain green:** list `actions/tasks` (same
|
||||
paging, match `head_sha`) — one task per attempt, the verdict in `status`, so it reads
|
||||
„failure, then rerun success". The first attempt's log is not reachable by the API.
|
||||
|
||||
An unchecked green is an assumption, not an observation — and so is a green read off a field the
|
||||
API never populates.
|
||||
|
||||
+13
@@ -16,6 +16,19 @@
|
||||
> and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
|
||||
|
||||
|
||||
> **2026-10-18 (evening) — controller 0.331.0 is the floor (MinAgent 0.158.1): OnlyOffice opens and saves from FileBrowser
|
||||
> and Nextcloud, FileBrowser back at once after a restart (R-1018), a removal deletes a volume the definition dropped
|
||||
> (R-1117); catalog `30eea97`: Immich/Nextcloud Redis without a volume; golden 0.331.0 baked, NOT vouched; a fresh install
|
||||
> from the ISO proved installer 1.34.0 + vouched golden/agent + auto-floor (R-1148); agent `main` carries R-978, R-973,
|
||||
> R-1093 unreleased. *Decided by CC unattended — operator may reverse:* the R-973 cap numbers (3 successful daily-tier runs
|
||||
> per 24 h, one weekly off-site run per 6 days; `07` §6.1). Tester4 is kept as the standing fresh-install customer
|
||||
> (operator). `REPORT-evening-2026-10-18.md`.**
|
||||
|
||||
> **2026-10-18 (day) — hub 0.158.0 DEPLOYED (access log live, agent-only vouch, R-895 first verdict 2026-10-20);
|
||||
> controller 0.330.0 is the floor (R-1144); agent 0.159.2 released and on the three test hosts, NOT vouched; installer
|
||||
> 1.34.0 published (vault-first step 4b, R-1145; fresh install unproven, R-1148); estimator Immich peak 3,983 MB
|
||||
> (R-1147).** Independent review of the night: `audits/day-2026-10-18/P2/`. `REPORT-day-2026-10-18.md`.
|
||||
|
||||
> **2026-10-18 (night) — controller 0.329.0 is the floor (MinAgent 0.158.1); golden 0.329.0 baked, NOT vouched; hub 0.158.0
|
||||
> built, NOT deployed.** Each app's own `appdata/<folder>` (R-1142), empty allow-list (R-981), drive retirement asks the
|
||||
> agent first (R-1063), plain no-durable-id refusal (R-1069), `:latest` for releases only (R-1143), Immich 3072M/2048M
|
||||
|
||||
@@ -0,0 +1,139 @@
|
||||
# REPORT — day 2026-10-18
|
||||
|
||||
## In plain words
|
||||
|
||||
- **The hub update is live.** Its own access log works and writes no secret (tested live with a fake token). You can
|
||||
now vouch an agent without a new golden. The off-site snapshot check gives its first verdict on 20 October.
|
||||
- **A fresh reviewer read last night's code.** One medium finding: a stale host key could have left the emergency
|
||||
password unknown. Today's installer change (save in the hub first, then set) already closes it. Three low findings:
|
||||
two fixed today, one is a known design limit, now written in its row.
|
||||
- **„Retire anyway":** when the host says no, the drive's apps start again. Where the host's disk list already says no,
|
||||
nothing is stopped at all. Controller 0.330.0 is the floor for every box.
|
||||
- **Agent 0.159.2** runs on demo-hp, Tester 1 and demo-felhom (your yes). A whole-box backup ran with no pool check.
|
||||
**The vouch is yours** (STATUS).
|
||||
- **Installer 1.34.0 is published** (your yes): the emergency password is saved in the hub first, then set, then
|
||||
checked with a login. Proven on demo-hp. A fresh install with it has not run yet (row R-1148).
|
||||
- **The calculator** shows Immich's bigger figure (your yes). Immich alone on an 8 GB machine now reads „does not fit".
|
||||
- **The old-restic check has not run.** demo-hp's clean-up comes only after tonight's backup (2026-10-19 about 04:16
|
||||
Budapest). The STATUS item stays open.
|
||||
|
||||
## 1. Hub 0.158.0 deploy
|
||||
|
||||
ArgoCD: only `Deployment/hub` was OutOfSync; synced that resource alone → Synced/Healthy, image `felhom-hub:0.158.0`,
|
||||
startup log `felhom-hub 0.158.0 starting` + `access log: /data/access-log …, kept 90 days`. Floor read back from the hub
|
||||
DB with its WAL: 0.329.0 / 0.158.1 at deploy time (`audits/day-2026-10-18/P1/hub-deploy-readback.txt`). Reports from all
|
||||
three boxes in the access log within two minutes (sources .101, .149, .155).
|
||||
- **Access log (R-1140, closed):** today's file `access-2026-10-18.log`, mode 0600. A fresh 48-hex fake token sent in a
|
||||
query, a `/bind/<token>` path, a `session=` query, a Bearer header, a Cookie and a POST body: found 0 times; control
|
||||
(the same file with the token appended) 1. Secret shapes (Bearer value, a 32+ character run, `password=`, `token=`,
|
||||
`session=`): 0; control 1. `/bind/<token>` is written `/bind/[redacted]` (`P1/access-log-live-test.txt`).
|
||||
- **Agent-only vouch:** read-only — `/configuration` loads with CC's token (Day-0 section, golden 0.329.0, agent 0.159.1);
|
||||
the save (`/configuration/artifacts`) answers 403 to the token, by design. No manifest change by CC.
|
||||
- **Off-site alarm (R-895, NARROWED):** no fixture route exists in the hub for it; the unit tests are the proof so far.
|
||||
Tomorrow's 07:10 run is the baseline (no verdict by design); the first verdict is 2026-10-20 07:10 — a DUE-CHECKS row.
|
||||
|
||||
## 2. The independent review
|
||||
|
||||
A fresh subagent with no context from the night reviewed controller v0.328.0→v0.329.0, hub 0.157.0→0.158.0, the agent's
|
||||
orphan-check change and the installer's `--rotate-recovery-only`. Its report was written to a file and read back
|
||||
(`audits/day-2026-10-18/P2/independent-review.md`, 54 lines). Verdicts (`P2/verdicts.md`):
|
||||
|
||||
| # | Finding | Verdict |
|
||||
|---|---|---|
|
||||
| F1 medium | rotate-only: unauthenticated healthz, then chpasswd, then a vault that a stale key fails → an unvaulted password | REAL in the night's code → **fixed** by R-1145 (vault first); harness `R1145-e`, fails against HEAD |
|
||||
| F2 low–medium | `offsite_snapshots_unexplained` is explained by the box's own reported run time | REAL, by design (decision 68) → written into R-895; the custody alarm `_vanished` is not affected |
|
||||
| F3 low | „anyway" stops apps before the agent is asked | REAL, was R-1144 → **fixed** (controller 0.330.0) |
|
||||
| F4 low | host key in curl's argv during the vault PUT | REAL, pre-existing → **fixed** (header file) |
|
||||
|
||||
## 3. R-1144
|
||||
|
||||
`decommissionAnyway`: reads the agent's disk list first (a role other than user-data, or the backup target → the plain
|
||||
refusal, nothing stopped); after a refusal past the stops (policy refusal or a failed agent call) starts exactly the apps
|
||||
that were running; a drive the agent let go keeps its apps stopped. Household text HU + EN. Seam `decomStacks`, so no
|
||||
test reaches docker. Three tests, two red-proofs (`P3/redproof-r1144.txt`). Not pressed live: no test box has a drive
|
||||
that is safe to retire.
|
||||
|
||||
## 4. Agent 0.159.2
|
||||
|
||||
Released with `release-agent.sh` (code pushed first, CHANGELOG after — the `release-complete` hook refuses the other
|
||||
order): sha256 `4d98868e922d6c10665a6c0da9323e8627ea9c589094e81d27d741e625d9d8f9`, bundle
|
||||
`477704ea2980948433ffc34bb59f008cc11410fd9683d386bfd3e2f085d55bc9` (read back from the registry). **demo-hp proof:** a
|
||||
whole-guest backup of 9201 through the dashboard (`/api/guest-backup/trigger`, snapshot mode, completed in 7.5 min):
|
||||
**0** `felhom-thin-check` sudo lines; control — the night's backup on 0.159.1 at 04:33 had **1**
|
||||
(`P4/demo-hp-backup-journal.txt`). The failure path stays covered by the agent's fixture tests. **Operator: yes** →
|
||||
Tester 1 and demo-felhom by signed jobs (agent_update + agent_config_update): both `signed op COMPLETED`, capability
|
||||
probe 75/75, `update committed` 0.159.2, and a host report on 0.159.2 from each (`P4/`). **Not vouched** — STATUS.
|
||||
|
||||
## 5. The password order (R-1145, R-1146)
|
||||
|
||||
Step 4b (install and rotate-only): generate → PUT to the vault (200 = the hub's DB write is done) → chpasswd (one retry)
|
||||
→ a PVE API login with the new value. **The states that can remain, and why each is safe or not:**
|
||||
|
||||
| State | When | Safe? |
|
||||
|---|---|---|
|
||||
| nothing changed | the vault refuses or is unreachable (a stale key included) | safe — root and the vault keep their old, matching pair |
|
||||
| root = vault = new, PVE login 200 | the normal end | safe |
|
||||
| vault = new, root = previous | chpasswd fails twice (or the run is killed between vault and set) | **not fully safe:** the vaulted value does not open the console; root keeps its previous password (the shadow line is fingerprinted before/after to prove it). The host key cannot read the vault back (by design), so the previous value cannot be re-vaulted; the log says the state in words, and the next run fixes it (it vaults first again). |
|
||||
| root = vault = new, PVE login refused | pveproxy trouble | safe for the shell; the run dies and says the web login refused |
|
||||
|
||||
The old order's dangerous state (root = new, vault = old) is no longer reachable. The hub cannot tell the installer its
|
||||
„last vaulted" time (no host-readable route); the installer trusts the PUT's 200, and CC checked the time moved in the
|
||||
live proof. Live on demo-hp: vault `set_at` 2026-07-21 → 2026-10-18T10:43:33Z, the new value gets a PVE ticket (200),
|
||||
the old one 401 (`P5/demo-hp-rotation.txt`). Harness: 52 passed / 0 failed (was 45/2); R1145-a..e red-proofed against
|
||||
HEAD. Installer **1.34.0 published** on the operator's yes: tag `installer-v1.34.0`, both webpage pins, ArgoCD synced
|
||||
the webpage Deployment only; the served file's sha256 = the tag's (`df722ee4…`). R-1146: SC2066 and GL8-F6 fixed, the
|
||||
harness is gate `hostinstall-harness` with two decoys.
|
||||
|
||||
## 6. Calculator (R-1147)
|
||||
|
||||
Before/after (`audits/day-2026-10-18/P6-before-after.md`): Immich peak 3,290 → 3,983 MB (typical unchanged 1,557). The
|
||||
one changed verdict: **Immich alone on 8 GB: fits, but tight → does not fit**. The family starter set is unchanged.
|
||||
**Operator: yes** → published (cache-bust v5); live `sizing-data.json?v=5` serves 3,983. SIZING.md's table and the
|
||||
pinned estimator tests moved with it. R-1036 closed (D14 = no).
|
||||
|
||||
## 7. The old-restic check
|
||||
|
||||
**Not run — the prune has not happened yet.** The hub allows demo-hp a clean-up window 6 days 12 hours after the last
|
||||
one (2026-10-12 02:16:53 UTC → from 2026-10-18 14:16:53 UTC). But the box asks for a window only after its own nightly
|
||||
off-site run, and that runs at 04:15 CEST. So the first real 0.19.1 prune comes **2026-10-19 at about 02:16 UTC**
|
||||
(04:16 Budapest). Read at 14:33 UTC: no `[offbox]` line since the 11:09 restart, the scheduler's next run 2026-10-19
|
||||
04:15 CEST, the hub's last window still id 9 (`P8/cleanup-window-not-yet.txt`, the hub DB read with its WAL). CC did not
|
||||
grant a window by hand (that is the operator's). The STATUS item stays open, with the corrected time; the check script
|
||||
is ready (`rx.sh` + a wrapper that lists and restores the newest, the oldest and the newest 0.14-made snapshot with both
|
||||
restics and compares tree hashes).
|
||||
|
||||
## 8. Versions, commits, fixtures
|
||||
|
||||
- Hub **0.158.0** deployed (felhom.eu `4c319dde`).
|
||||
- Controller **0.330.0** — `6c6bd87`; floor 0.330.0 / MinAgent 0.158.1 at 11:10:59 UTC (303 `floor_set`, read back with
|
||||
the WAL); per-box floors set and cleared; box walk green on the three test boxes (0 refusals, all healthy, login and
|
||||
files 200, https-only OK).
|
||||
- Agent **0.159.2** — `65c1994` (code), tag `v0.159.2`, CHANGELOG `e25454c`.
|
||||
- Installer **1.34.0** — felhom.eu `88aecf55` (vault-first + harness), `624bcdc3` (1.34.0, tagged), `3332eb09` (pins).
|
||||
- Estimator — `37cb83c1`. Fixtures: none changed (the new texts travel in JSON).
|
||||
|
||||
## 9. Register — 173 before, 168 after; opened 1, closed 6
|
||||
|
||||
Closed: R-1140, R-1144, R-1145, R-1146, R-1147, R-1036. Opened: R-1148. Narrowed: R-895 (dated check 2026-10-20).
|
||||
|
||||
## 10. Observations
|
||||
|
||||
1. Installer 1.34.0's default path has not run in a fresh install. FILED: R-1148.
|
||||
2. The review's F2 (box-reported run times explain new snapshots). NOT-A-FINDING as a new row: a known design limit,
|
||||
recorded in R-895.
|
||||
3. `release-agent.sh` vs the `release-complete` hook: the CHANGELOG must follow the release. NOT-A-FINDING: the documented
|
||||
order (memory and skill); I tried the other order first and the hook refused it, as designed.
|
||||
4. The estimator's new Immich figure is `memory.current` (with cache), not the `used` measure it normally takes.
|
||||
NOT-A-FINDING: on the safe side, said in SIZING.md, and approved by the operator with the table in front of them.
|
||||
5. A safety check refused a `sh -c` with an unguarded `rm "$H"`. NOT-A-FINDING: rewritten with `${H:?}` in a helper.
|
||||
|
||||
## Teardown — three layers
|
||||
|
||||
- **Machines:** demo-hp 9201 — one whole-guest backup taken (kept, like any backup); no app installed or removed today.
|
||||
demo-hp host — the installer copy shredded after the rotation; root password rotated on purpose (new value in the
|
||||
vault). Tester 1, demo-felhom — agent 0.159.2 and controller 0.330.0 through their normal paths; nothing else.
|
||||
- **Hub:** hub 0.158.0; global floor 0.330.0 / 0.158.1; no per-box floor; signed jobs consumed. No vouch by CC.
|
||||
- DooPlex: builds only; ArgoCD synced two Deployments (hub, webpage), each alone.
|
||||
|
||||
Instruction files: none edited. System poster: none of the three (the poster shows backup retentions; the hub's access
|
||||
log is not on it). Architecture documents read: `02`, `03`, `05`, `07`, `09` §3 decision 250; `break-glass.md`.
|
||||
@@ -0,0 +1,149 @@
|
||||
# REPORT — evening → night 2026-10-18
|
||||
|
||||
## How I read the brief
|
||||
|
||||
- **Part 5, R-1135:** the brief says the mail should use the public Gitea URL — the register row says the same, and that
|
||||
is what was done (the CI helper first read the brief's wording the other way round and followed the row).
|
||||
- **R-1052** was already closed (2026-10-15); Part 1 proves R-1148 and re-proves R-1052's path with tonight's golden.
|
||||
- **Part 6, Immich:** 9202's Immich lives on `/mnt/sizing-bench`, a hand-made bench folder outside `/mnt/felhom-drives/`,
|
||||
so the allow-list refuses its definition (see Observations); the restore half of the measurement ran on Nextcloud.
|
||||
- **The operator kept Tester4** (asked at 21:20): not deleted; its old host must go before its next install (R-1154).
|
||||
|
||||
## In plain words
|
||||
|
||||
- **The morning list:** vouch golden 0.331.0; say yes or no to the agent release with three fixes; two decisions (one
|
||||
sign-in, local backup retention).
|
||||
- **A brand-new box from nothing works end to end** with installer 1.34.0: emergency password saved in the hub first,
|
||||
then set, then the web login took it; the approved golden and agent; the box moved itself to the floor.
|
||||
- **OnlyOffice now really works** from FileBrowser and from Nextcloud. Before tonight FileBrowser could not open a
|
||||
document and Nextcloud lost every save while saying „saved". Fixed in controller 0.331.0, now the floor for every box.
|
||||
- **One sign-in for the file manager can be built safely**, but only with two safeguards — measured, design note written.
|
||||
- **Three agent fixes are written and tested, not released.**
|
||||
- **CI:** the failure mail's link opens from outside; the 5-minute CI timeout never worked (filed); a rerun hides the
|
||||
first try's log, and the check now looks for it.
|
||||
- **Redis for Immich and Nextcloud has no disk volume any more**, after a test; the test found that removing an app left
|
||||
an old volume behind — fixed too.
|
||||
- **Golden 0.331.0 is baked** (not vouched).
|
||||
- **The old-restic check:** §9.
|
||||
|
||||
## 1. The morning list
|
||||
|
||||
1. **Vouch golden 0.331.0** — sha256 `3881de62b0986ccbe5e55580e3f1bb9765d65b8d898f67c6339bac105244f84f` (registry round
|
||||
trip = the bake), agent 0.159.2 unchanged, **Min agent 0.158.1**.
|
||||
2. **Agent release (R-978, R-973, R-1093) — may I?** If yes: release, prove on demo-hp, ask for the vouch.
|
||||
3. **Decide D16** (R-1100: build one sign-in with the two safeguards?) and **D17** (R-1149: local whole-box backups
|
||||
„last 3" or „one per day, 3 days"?). STATUS has both.
|
||||
4. Before Tester4's next install: delete its old host `Tester4-31fa0e` (Hosts page).
|
||||
|
||||
## 2. Fresh install from nothing (R-1148, R-1052) — `audits/newbox-2026-10-18/`
|
||||
|
||||
| UTC | Step | Result |
|
||||
|---|---|---|
|
||||
| 17:42:21 | Tester4 created by the operator | bind mail sent |
|
||||
| 17:43:15 | VM 9302 `newbox-r1148` on demo-hp, ISO 1.29.0 (sha = published) | 8 GB / 4 cores / 120 GB on `/mnt/hdd_1` root |
|
||||
| 17:50:19 | Install pressed (graphical, Hungarian keyboard kept) | installed, rebooted, pairing code on the console |
|
||||
| 18:02:58 | bind: mailed link + pairing code + owner phrase (operator's 0600 file, shredded) | „Sikeres összekötés" |
|
||||
| 18:03:43 | step 4b: vault → chpasswd → PVE login | `[OK] … vaulted, set, and the PVE login takes it`; hub `set_at` same second |
|
||||
| 18:03:44 | step 5: the hub manifest | agent **0.159.2**, golden **0.329.0** — the vouched pair, both sha-verified |
|
||||
| 18:05:37 → 18:05:51 | first controller reports | 0.329.0, then **0.330.0** (`initiated_by: auto-floor` at 18:05:38) — 2 min 47 s after the bind |
|
||||
| 18:17:14 | CC's PVE login from DooPlex | vaulted value **200**, installer value **401** |
|
||||
| 18:18:32 → 18:20:05 | claim (setup code mail), BentoPDF | claimed; BentoPDF healthy |
|
||||
| 18:24:15 | household „turn off" | hub `deliberate_off_at` set; VM stopped |
|
||||
| — | teardown | name read twice, VM 9302 destroyed, disk gone; other VMs untouched; Tester4 kept (operator) |
|
||||
|
||||
## 3. OnlyOffice (R-1018) — `audits/onlyoffice-2026-10-18/`
|
||||
|
||||
On 0.330.0: FileBrowser → the editor loaded, the document never did (OnlyOffice fetched `https://files.<domain>` → 403);
|
||||
Nextcloud → edit and „All changes saved", but the file kept the old text (`http://onlyoffice:80cache/…`). Switching the
|
||||
link on/off left files.<domain> 502 for 4 min 8 s / 3 min 38 s. **Fixed (controller 0.331.0):** FileBrowser
|
||||
`server.internalUrl`, Nextcloud's slash, the gate after a FileBrowser restart. On rc.1: both open, edit, save, read back
|
||||
(„… RC1-FB-OK", „… RC1-NC-OK"); the stop revokes both (no editor; Nextcloud 404); the stop's outage one 2-s sample.
|
||||
|
||||
## 4. One sign-in spike (R-1100 → READY) — `audits/proxyauth-spike-2026-10-18/DESIGN-NOTE.md`
|
||||
|
||||
Traefik forwardAuth strips a client's header (any case, twice) and its own value wins — measured. But an app container
|
||||
reaching FileBrowser directly logs in with a forged header (200), and the dashboard cookie never reaches `files.`. Verdict:
|
||||
build only with a files-only ticket cookie and a per-box secret header name. Everything on 9202 removed (users, routes,
|
||||
stand-in container, config).
|
||||
|
||||
## 5. Agent fixes (committed, NOT released) — felhom-agent `REPORT.md`
|
||||
|
||||
R-1093 `f7b7308` + `0963bae` (and a fail-open hole closed after a background review), R-978 `8561dc8`, R-973 `f17e197`;
|
||||
tests and red-proofs for each; CI job 2062 success. R-1093 live: a loop disk on demo-hp showed the probe's condition holds.
|
||||
|
||||
## 6. CI (R-1135, R-1136, R-1137 closed)
|
||||
|
||||
Link public and by run id (forced mail 18:46:01Z, job 2067, one mail). The runner's real limit is 3 h; the job-level
|
||||
5-minute timeout is not enforced (R-265 corrected; R-1152 for the step-level one). A rerun replaces the job's attempt; the
|
||||
pull-check recipe in `CLAUDE.md` now reads `actions/tasks` (instruction-file edit by the CI helper: felhom.eu `CLAUDE.md`
|
||||
CI recipe, item 3 added — a proven fact, stricter; `b9b56c47`).
|
||||
|
||||
## 7. Redis volumes (R-1117 closed) — `audits/redis-volumes-2026-10-18/`
|
||||
|
||||
(a) Both apps healthy on the new shape; Immich's metadata job ran (0 → 11, 0 failed); Nextcloud `cron.php` rc 0, WebDAV
|
||||
200. (b) The dump skips the dropped volume (the old tar gone from the unit); a second-drive restore from a copy made WITH
|
||||
the volume: 3/3 volumes, 1/1 database, healthy — it brings back that copy's compose (by design). (c) The old volume stays
|
||||
attached under the tmpfs; **a removal left it behind** — fixed (controller 0.331.0, red-proofed). Templates changed
|
||||
(catalog `30eea97`); Nextcloud on 9202 took it through the sync + restart (tmpfs, `save ""`).
|
||||
|
||||
## 8. Controller release and golden — `audits/evening-2026-10-18/P7/`, `tests/golden-0.331.0-2026-10-18/`
|
||||
|
||||
0.331.0 (digest `1b11d25a…`): per-box floors 20:44:00 → all three on 0.331.0 within 20 s; box walk green (0 refusals,
|
||||
0 unhealthy, FileBrowser re-published in 5–6 s, public pages 200 after one 20-s blip each on two names, https-only 28 OK);
|
||||
**global floor 0.331.0 / 0.158.1 at 20:48:56 UTC**, read back with the WAL; per-box floors cleared. Golden 0.331.0 baked
|
||||
after it, round trip = bake sha, token checks 0 with a working control, teardown clean. No controller push after the bake.
|
||||
|
||||
## 9. The old-restic check (Part 8)
|
||||
|
||||
PENDING — filled in when demo-hp's clean-up window has run (after its 04:15 CEST night run). A watcher runs the check by
|
||||
itself; at 20:57 UTC both restics listed 310 snapshots (`audits/evening-2026-10-18/P8-precheck.txt`).
|
||||
|
||||
## 10. Versions, commits, fixtures, rows
|
||||
|
||||
- Controller **0.331.0** — `772ef36`, `8ae9178` (+ `615940d` CI); rc.1 on 9202 only. Agent `main` `f7b7308` `8561dc8`
|
||||
`0963bae` `f17e197` `79ba884` `1693da4` — unreleased. Catalog `c97eb1c`, `30eea97`. felhom.eu `1fe9f848`, `b9b56c47`,
|
||||
this commit. Golden **0.331.0** baked. Hub unchanged (0.158.0).
|
||||
- Fixtures: none changed — no page changed.
|
||||
- **Register: 168 before, 168 after; closed 6** (R-1148, R-1018, R-1117, R-1135, R-1136, R-1137), **opened 6**
|
||||
(R-1149, R-1150, R-1151, R-1152, R-1153, R-1154). Updated: R-1100 (READY), R-978, R-973, R-1093 (fixed in agent
|
||||
`main`), R-265 (corrected).
|
||||
|
||||
## Observations
|
||||
|
||||
1. Installer password, golden and agent all proven in one fresh install. — closes R-1148 (not a finding).
|
||||
2. FileBrowser's office preview answered 500 with the link on. FILED: R-1153.
|
||||
3. A reinstall reuses an old host and skips two re-issues; now recurring with the kept Tester4. FILED: R-1154.
|
||||
4. The R-973 cap leaves the local keep-last 3 floodable within a day. FILED: R-1149.
|
||||
5. The cap's refusal reaches the operator with a misleading event text. FILED: R-1150.
|
||||
6. R-978's typed-back confirmation is browser-only. FILED: R-1151.
|
||||
7. The CI job timeout is inert. FILED: R-1152.
|
||||
8. 9202's Immich sits on `/mnt/sizing-bench`, outside `/mnt/felhom-drives/`, so the allow-list refuses its definition every
|
||||
15 minutes since 0.328.0 and a restore of it is refused. NOT-A-FINDING: the check works as designed; the folder is a
|
||||
hand-made bench artifact (R-994), not a shape a real box has.
|
||||
9. A restore brings back the backup's own compose (the old Redis volume with it). NOT-A-FINDING: by design (R-47: the
|
||||
unit's compose becomes the live one); the older shape works.
|
||||
10. My commit `7f7081d1` (day session) carries a „Co-Authored-By" trailer, against both briefs' rule 10. NOT-A-FINDING:
|
||||
my slip; it is pushed and cannot be rewritten without a force-push (forbidden); no later commit has one.
|
||||
11. I started the catalog's FULL gate run on DooPlex, whose third gate starts containers. NOT-A-FINDING: stopped at gate 2
|
||||
(a network check), no container was made (checked), the fast run used instead.
|
||||
12. One OnlyOffice „Connection is lost" on the first rc.1 attempt, after two blind clicks. NOT-A-FINDING: not reproduced;
|
||||
the next attempt saved; no container restarted in between.
|
||||
13. Two public names answered 000 once in the box walk. NOT-A-FINDING: 18 of 18 retries answered 200 in < 0.2 s.
|
||||
14. The R-1100 row named the config key `proxyAuth`; it is `auth.methods.proxy`. NOT-A-FINDING: corrected in the row.
|
||||
|
||||
## Teardown — three layers
|
||||
|
||||
- **Machines:** VM 9302 destroyed (its disk gone). 9202: OnlyOffice and Nextcloud removed through the product (their
|
||||
volumes, data and backup copies), the test documents deleted, the spike's route file, container, FileBrowser users and
|
||||
proxy setting removed, helper files and the Immich scratch password shredded; Immich keeps the new Redis shape by hand
|
||||
(= the template); 9202 on controller 0.331.0. `nextcloud_nextcloud_redis_data` (the orphan the pre-fix
|
||||
removal left) removed by name afterwards; no Nextcloud volume remains. demo-hp host: the loop-disk file removed. Drill VM: CT 9100 purged, VM off,
|
||||
disk `virgin`.
|
||||
- **Hub:** global floor 0.331.0 / 0.158.1, no per-box floor; Tester4 and its host `Tester4-31fa0e` kept (operator); no
|
||||
vouch, no deploy.
|
||||
- **DooPlex:** builds and the golden bake only; the headless browser as a test client; no Docker cleanup.
|
||||
|
||||
Architecture read: `01`, `02`, `03` §8a, `04`, `05`, `07` §6/§8, `09` §3 decisions 162/250; `target-selection.md`,
|
||||
`nightly-rotation.md`, `RUNBOOK-manual-build.md` §4. Documents changed: `03` §8a, `07` §6.1 and §8 row 10,
|
||||
`target-selection.md` (Tester4). System poster: none of the three (no listed fact changed). `unproven.py --summary`:
|
||||
not walked 35 of 55 — unchanged.
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
**Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.**
|
||||
|
||||
**Updated 2026-10-18 (night).** Controller 0.329.0 is the floor for every box (21:36 UTC, MinAgent 0.158.1), after the three test boxes: each app reaches only its own data folder on the drive; homepage no longer controls Docker, so no app has a special right; when the host refuses to retire a drive, nothing changes and the household reads why; a virtual disk without a serial gets a plain sentence. Immich gets 3 GB (it was killed twice at 2 GB on a 4,000-photo import). Golden 0.329.0 is baked, NOT vouched. Hub 0.158.0 is built, NOT deployed — `REPORT-night-2026-10-18.md`. **Earlier:** **Updated 2026-10-17 (evening).** Controller 0.328.0 is the floor for every box (17:22 local): the box refuses a catalog change that asks for dangerous container rights (your D2 = A). Agent 0.159.1 (a gone, decommissioned drive is forgotten; an orphan thin snapshot is named in the backup failure; new Go) — runs on demo-hp, Tester 1 and demo-felhom; **your vouch in the hub is still open**. New emergency root passwords on demo-hp, Tester 1, demo-felhom (your D1 = A; read them in the hub). Hub 0.157.0 deployed on your yes — `REPORT-agent-allowlist-rotation-2026-10-17.md`. **Earlier:** **Updated 2026-10-17 (afternoon, later).** Controller 0.327.1 is the floor for every box since 12:06 UTC: FileBrowser is published only after its default password is checked (your D11 = A), and the install check uses real memory amounts with a clear message (your D10 = A) — `REPORT-filebrowser-memory-ci-2026-10-17.md`. **Earlier:** Controller 0.326.0 is the floor for every box since 09:55 UTC: FileBrowser's default password is checked at every FileBrowser start. Tester 1 is back on the live app list (test apps and drives removed); six memory limits raised — `REPORT-tester1-limits-filebrowser-2026-10-17.md`. **Earlier today:** controller 0.325.0 was the floor since 08:21 UTC (after the three test boxes): two more password doors count a try before checking it, family sign-ins are stored as fingerprints, a file-share rename always applies; five apps' Redis saves snapshots now, which a full disk cannot damage — `REPORT-burndown-3-2026-10-17.md`. **Earlier (2026-10-17 night):** controller 0.324.0 was the floor for every box since 02:46 UTC (all three test boxes made tonight's off-site backup on it first): a restore now brings the database password back with the data (your 1A), restic 0.19.1 (your 2A), dashboard hardening — `REPORT-night-2026-10-17.md`. **Earlier (2026-10-16 evening):** 0.323.0, Debian 13 — `REPORT-debian13-restic-2026-10-16.md`. **Earlier (midday):** Controller 0.319.0 (the app page in panels, the login in one panel) is the floor, MinAgent 0.158.1 — `REPORT-app-page-tuning-2026-10-16.md`. **Earlier (morning):** Storage identity build B shipped: agent 0.158.1 and golden 0.318.0 vouched by you, controller 0.318.0 is the floor (MinAgent 0.158.1), installer 1.33.0 published — new one-disk boxes get their own data area. Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
|
||||
**Updated 2026-10-18 (evening).** A brand-new box was installed from nothing on demo-hp (your test customer Tester4): the emergency password was saved in the hub first, then set, and the web login took it; the box came up on the approved golden and moved to the floor by itself in under 3 minutes; its agent was the approved one. OnlyOffice now opens AND saves documents from FileBrowser and from Nextcloud (before tonight: FileBrowser could not open one, and Nextcloud lost every save while saying „saved") — controller 0.331.0 is the floor for every box (22:48 local). Immich's and Nextcloud's Redis no longer have a disk volume. Three agent fixes are written and tested, NOT released (your yes). Golden 0.331.0 is baked, NOT vouched — `REPORT-evening-2026-10-18.md`. **Earlier:** **Updated 2026-10-18 (day).** Hub 0.158.0 is live (your yes): its own 90-day access log works and writes no secret (tested with a fake token); you can vouch an agent without a new golden; the off-site snapshot check gives its first verdict on 20 October. Controller 0.330.0 is the floor (13:10 local): if the host refuses „retire anyway", the drive's apps start again. Agent 0.159.2 runs on the three test hosts (your yes; no pool check on a good backup) — **vouch it**. Installer 1.34.0 is published (your yes): the emergency password is saved in the hub first, then set. The calculator shows Immich's bigger figure (your yes). A fresh reviewer read last night's code: one medium finding, already closed by today's installer change — `REPORT-day-2026-10-18.md`. **Earlier:** **Updated 2026-10-18 (night).** Controller 0.329.0 is the floor for every box (21:36 UTC, MinAgent 0.158.1), after the three test boxes: each app reaches only its own data folder on the drive; homepage no longer controls Docker, so no app has a special right; when the host refuses to retire a drive, nothing changes and the household reads why; a virtual disk without a serial gets a plain sentence. Immich gets 3 GB (it was killed twice at 2 GB on a 4,000-photo import). Golden 0.329.0 is baked, NOT vouched. Hub 0.158.0 is built, NOT deployed — `REPORT-night-2026-10-18.md`. **Earlier:** **Updated 2026-10-17 (evening).** Controller 0.328.0 is the floor for every box (17:22 local): the box refuses a catalog change that asks for dangerous container rights (your D2 = A). Agent 0.159.1 (a gone, decommissioned drive is forgotten; an orphan thin snapshot is named in the backup failure; new Go) — runs on demo-hp, Tester 1 and demo-felhom; **your vouch in the hub is still open**. New emergency root passwords on demo-hp, Tester 1, demo-felhom (your D1 = A; read them in the hub). Hub 0.157.0 deployed on your yes — `REPORT-agent-allowlist-rotation-2026-10-17.md`. **Earlier:** **Updated 2026-10-17 (afternoon, later).** Controller 0.327.1 is the floor for every box since 12:06 UTC: FileBrowser is published only after its default password is checked (your D11 = A), and the install check uses real memory amounts with a clear message (your D10 = A) — `REPORT-filebrowser-memory-ci-2026-10-17.md`. **Earlier:** Controller 0.326.0 is the floor for every box since 09:55 UTC: FileBrowser's default password is checked at every FileBrowser start. Tester 1 is back on the live app list (test apps and drives removed); six memory limits raised — `REPORT-tester1-limits-filebrowser-2026-10-17.md`. **Earlier today:** controller 0.325.0 was the floor since 08:21 UTC (after the three test boxes): two more password doors count a try before checking it, family sign-ins are stored as fingerprints, a file-share rename always applies; five apps' Redis saves snapshots now, which a full disk cannot damage — `REPORT-burndown-3-2026-10-17.md`. **Earlier (2026-10-17 night):** controller 0.324.0 was the floor for every box since 02:46 UTC (all three test boxes made tonight's off-site backup on it first): a restore now brings the database password back with the data (your 1A), restic 0.19.1 (your 2A), dashboard hardening — `REPORT-night-2026-10-17.md`. **Earlier (2026-10-16 evening):** 0.323.0, Debian 13 — `REPORT-debian13-restic-2026-10-16.md`. **Earlier (midday):** Controller 0.319.0 (the app page in panels, the login in one panel) is the floor, MinAgent 0.158.1 — `REPORT-app-page-tuning-2026-10-16.md`. **Earlier (morning):** Storage identity build B shipped: agent 0.158.1 and golden 0.318.0 vouched by you, controller 0.318.0 is the floor (MinAgent 0.158.1), installer 1.33.0 published — new one-disk boxes get their own data area. Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
|
||||
`documentation/backlog/STATUS-HISTORY.md`. Reports: `REPORT-night-2026-10-14.md`, `REPORT-immich-rollout-2026-10-14.md`, `REPORT-seo-felho-tarhely-2026-10-14.md`, `REPORT-immich-repair-2026-10-14.md`, `REPORT-power-cut-fixes-2026-10-14.md`, `REPORT-night-power-2026-10-13.md`, `REPORT-poweroff.md`.
|
||||
|
||||
## What works
|
||||
@@ -29,7 +29,7 @@
|
||||
- 65 apps in the catalog. New today: Prowlarr — you enter your download sources once, and Sonarr and Radarr get them, linked by the box with no button (the website lists 63 apps — R-1036). OS updates, the kernel lane too, run at night.
|
||||
- The hub is closed again after the 2026-10-12 security review; one box cannot read another's data.
|
||||
|
||||
- Felhom runs in a virtual machine on OpenMediaVault 8, tried on an exact copy of the first outside tester's box: install, bind, claim, apps, backup, and back by itself after an OMV restart. The Hungarian guide for him is `documentation/pilot/GUIDE-omv-kvm-hu.md`; open: one-disk Jellyfin (R-1068), NAS films for Jellyfin (R-1071, yours), no disk health in a VM (R-1073, yours). Waits on you: send the guide; delete test customer Tester4 in the hub.
|
||||
- Felhom runs in a virtual machine on OpenMediaVault 8, tried on an exact copy of the first outside tester's box: install, bind, claim, apps, backup, and back by itself after an OMV restart. The Hungarian guide for him is `documentation/pilot/GUIDE-omv-kvm-hu.md`; open: one-disk Jellyfin (R-1068), NAS films for Jellyfin (R-1071, yours), no disk health in a VM (R-1073, yours). Waits on you: send the guide.
|
||||
- A second local copy counts only when it is on a different physical disk, and the box can prove it. Inside a virtual machine the box makes the copy but says „A Felhom nem tudja ellenőrizni…" (Tester 1). On real disks nothing changes (demo-hp, N100). A NAS never hides the „only one copy" notice. A box with no drive refuses a media app in words, with a link to the Meghajtók page. Live on the three test boxes; the NAS and no-drive parts are unit-tested only. Next: build B (the internal place on one-disk boxes, R-1079). Your rulings D1–D6 are in the design (`architecture/16-storage-physical-identity.md`).
|
||||
- **One-disk boxes get their own data area** (2026-10-16): a new install makes a „Belső tárhely" on the disk, outside every whole-box copy, and media apps install there with no extra step (proven on a fresh 512 GB box: 213 GiB area, Jellyfin with no extra step). A disk split into parts can be used part by part. The backup offer no longer promises disk-failure safety when it cannot check the disk, and `/mnt/sys_drive` is no longer offered.
|
||||
|
||||
@@ -41,7 +41,7 @@
|
||||
|
||||
## What we work on
|
||||
- **CC's secrets** (R-1118): done 2026-10-17 — the store, `sec`, the guards in every CC session (option B: `bash -x` and `curl -v` allowed inside `sec run`), the nightly check (linger on). The old credentials file and its three copies are deleted.
|
||||
- **After 2026-10-18 14:16 UTC** (demo-hp's next clean-up window): check that the old restic (image 0.322.0) still lists and restores demo-hp's store after its first real 0.19.1 prune (`audits/night-restore-2026-10-17/tools/rx.sh`). Everything else of R-1105/R-1107 is done.
|
||||
- **After 2026-10-19 02:15 UTC** (demo-hp's next clean-up window, after its 04:15 CEST night run; the evening session left a watcher that runs the check by itself when the hub records the window closed — `scratchpad p8-watch.sh`; by hand: `rx.sh` + `xver-after-prune.sh` in guest 9201; both restics listed 310 snapshots at 20:57 UTC, `audits/evening-2026-10-18/P8-precheck.txt`): check that the old restic (image 0.322.0) still lists and restores demo-hp's store after its first real 0.19.1 prune (`audits/night-restore-2026-10-17/tools/rx.sh`). Everything else of R-1105/R-1107 is done.
|
||||
- The power-cut findings still open (R-1004, R-1005, R-1010, R-1013). R-1012 closed: agent 0.159.1 names an orphan thin snapshot in the backup failure.
|
||||
- Media apps on every drive (R-1023): live with the 0.313.0 floor — every drive in every media app, a new drive made ready by the box, a pulled drive loses nothing, a safe removal lets go first and the drive comes back by itself.
|
||||
|
||||
@@ -58,21 +58,22 @@
|
||||
| D7 | R-990, R-989 | Rule yes / no / later on the forum ideas (`audits/forum-research-2026-10-12/FELHOM.md` §5) and the selfh.st ideas (`audits/selfhst-survey-2026-10-12/FELHOM.md` §6) | — | — | nothing changes; the research ages | — |
|
||||
| D8 | R-206 | Install DooPlex's Docker settings from git (restarts Docker), and prune the build cache weekly: yes or no? | **Yes, in a quiet window** | — | a rebuild of DooPlex still has the settings in git | — |
|
||||
| D13 | R-1140 | **DECIDED 2026-10-17: A** — the hub keeps its own access log, 90 days. Built in hub 0.158.0 (≈ 19 MB for 90 days: the hub serves ≈ 1,870 requests a day, not 500); it waits for your deploy yes (morning list). | done | — | — | — |
|
||||
| D14 | R-1036 | The apps page lacks Plant-it and wger. Both are closed to new installs (wger hidden, Plant-it abandoned by its makers): add their cards anyway? | **No — leave them off** and close the row; the site shows only what a visitor can install | Yes: first open them for install again (wger's login throttle, Plant-it has no upstream), then the cards | nothing changes; the site lists 62 catalog apps, all installable | — |
|
||||
| D15 | R-1147 | The public machine estimator sizes Immich from a 200-photo test. Tonight's 4,000-photo test needed more. May the public figures move up? | **Yes** — CC re-runs the estimator with the new figures and shows you the before/after first | No: the page keeps the old Immich figure | a buyer with a big photo library may pick too small a machine | — |
|
||||
| D14 | R-1036 | **DECIDED 2026-10-18: no** — wger and Plant-it stay off the site; it shows only apps a visitor can install. | done | — | — | — |
|
||||
| D15 | R-1147 | **DECIDED 2026-10-18: yes** — the estimator's Immich peak is 3,983 MB (was 3,290); Immich alone on 8 GB now reads „does not fit". Live. | done | — | — | — |
|
||||
| D10 | R-1125 | **DECIDED 2026-10-17: A** — the 23 memory requests now match real use (catalog `1af6ea7`); the install refusal and page say what to do (controller 0.327.0). An 8 GB box no longer installs the whole household set. | done | — | — | — |
|
||||
| D11 | R-1126 | **DECIDED 2026-10-17: A** — FileBrowser is published only after its default password is checked; it never answers on the default (controller 0.327.1). The tunnel still runs before the claim, by design (`01` §5). | done | — | — | — |
|
||||
| D12 | R-1129 | **CLOSED 2026-10-17: not a defect** — CC misread the CI log; the failure mail always worked. A forced test mail went to admin@felhom.eu at 10:48:54 UTC (CC saw it arrive). Your key change did no harm. | done | — | — | — |
|
||||
| D9 | R-1062 | The N100's USB drive is also its whole-box backup drive. Split it in two anyway? | **No — keep one drive**; the lived-in box keeps its nightly whole-box backup | Split: the box loses its local whole-box backup (or add a second drive first) | it stays one drive; multi-drive tests stay on Tester 1 | — |
|
||||
| D16 | R-1100 | One sign-in for the dashboard and the file manager: build it? (tested tonight: the router can pass the user safely, but any app on the box could fake it unless the header name is a per-box secret) | **Yes, with the two safeguards in the design note** (a files-only ticket + a secret header name), about one release | No: households keep signing in to the file manager once | nothing changes; the second sign-in stays | — |
|
||||
| D17 | R-1149 | The box's local whole-box backups keep the last 3 copies; a broken-in box can replace all 3 in one day. Keep „last 3", or keep „one per day, 3 days"? | **One per day, 3 days** — same disk use, cannot be flooded in a day | Keep „last 3": flooding stays possible within one day (the new cap slows it) | it stays „last 3" | — |
|
||||
|
||||
## Waiting on you — do
|
||||
- **Vouch golden 0.329.0 and agent 0.159.1 together** (Configuration → Day-0 artifacts): golden sha256 `58dc40df555676d87200e5cb24cdc65f39cbacb2417e15a1955013526de4f68c`, agent sha256 `de8f6ad96860ec399757a88d8bbb0191c089c9bb99db8212482c12daab41aff9` (read from the registry tonight: matches), bundle `2af3d27d686fe611f3f44e89ba3d5123a5572f51eaf87e0ac63df00a41e67cd6`, Min agent **0.158.1**. If you do not: a new box installs golden 0.318.0 with agent 0.158.1 and then updates itself to the floor.
|
||||
- **May I deploy hub 0.158.0** (you can vouch an agent without a new golden; the alarm for missing off-site copies; the hub's own 90-day access log)? Built tonight, not installed (night rule). The next daytime session asks you. If you say no: the hub stays 0.157.0 and nothing changes.
|
||||
- **Sunday night's golden:** a golden at the floor's version (0.329.0) already exists, unvouched. The Sunday rotation does not bake a duplicate (runbook updated); it repeats the vouch line above if it is still open, and bakes only if the floor has moved above 0.329.0.
|
||||
- **Vouch golden 0.331.0** (Configuration → Day-0 artifacts): golden sha256 `3881de62b0986ccbe5e55580e3f1bb9765d65b8d898f67c6339bac105244f84f` (read back from the registry 2026-10-18), agent **0.159.2** unchanged (already vouched), **Min agent 0.158.1**. This is the Sunday golden (the floor 0.331.0 is above the vouched 0.329.0). If you do not: a new box installs 0.329.0 and updates itself to the floor in about 3 minutes (proven tonight).
|
||||
- **Agent release with three fixes (R-978, R-973, R-1093) — may I?** Starting the recovery-code setup again no longer spoils the written-down code; a broken-into box program cannot run the whole-box backup again and again to push out old copies (3 a day, 1 off-site a week — numbers I chose, you may change them); an empty partition no longer asks „data will be erased". Tested, red-proved, in the agent's main branch. If you say yes: I release, prove on demo-hp, and ask you to vouch. If not: they wait.
|
||||
- **Nézd meg a demo-hp-n a Calibre-Web „Adatok és mentés" fülét és a Fájlkezelőt** (`felhom.enkisfelhom.hu`, controller 0.321.0, minden dobozon kiadva). A mentés egy részben, egyszerű szavakkal; a Fájlkezelő nem kér frissítést és nem ajánl „Install app"-ot.
|
||||
- **Look at `roms/roms/` on the N100's drive in the file manager (R-1099).** RomM now scans `roms/<platform>/`. A game uploaded through RomM before today sits one folder deeper: if there are platform folders in `roms/roms/`, move them up into `roms/` and press „Scan” in RomM. If not: those games show under a platform called „roms”.
|
||||
- **Nézd meg a Calibre-Web oldalát a demo-hp-n** (`felhom.enkisfelhom.hu`, controller 0.319.0, minden dobozon kiadva). A fejléc, a fülsor és minden rész most külön panel (az „A” stílus). A belépési adatok egy panelben vannak, egymás mellett. A Calibre-Web jelszaváról a doboz nem tud, mert az alkalmazás előbb települt, mint hogy a sablonban jelszó lett volna — ezt most egy mondat mondja ki. Ha nem tetszik, írd meg, mit változtassak. Ha nem nézed meg: semmi nem romlik el.
|
||||
- **Discard two unclaimed boxes and delete Tester4** (hub, browser only): the build B scratch VMs registered as unclaimed boxes — registration ids 40 (`b43afa10…`) and 41 (`9c78ea30…`); both VMs are destroyed. Tester4 (the throwaway customer) is switched off the household way. If not: two dead entries stay in the Hosts list and Tester4 stays in Customers.
|
||||
- **Discard two unclaimed boxes** (hub, browser only): the build B scratch VMs registered as unclaimed boxes — registration ids 40 (`b43afa10…`) and 41 (`9c78ea30…`); both VMs are destroyed. If not: two dead entries stay in the Hosts list. **Tester4 stays** (your word, 2026-10-18) as the fresh-install customer; **before its next install, delete its old host `Tester4-31fa0e`** (Hosts page) — otherwise the new install silently reuses the old host and skips two re-issues.
|
||||
- System poster needs a refresh: one-disk boxes now have a data area („Belső tárhely") on the system disk, outside the whole-guest backups (facts file updated 2026-10-16).
|
||||
- **Olvasd el a Plex és a Sonarr útmutatót a demo-hp-n** (az alkalmazás oldalán az „Útmutató” fül). Ha más formát szeretnél, egy menetben átírom mind a 62-t. A robot 2026-10-16-án bejelentkezve megnézte: mindkét oldal megjelenik magyarul és angolul, 4 rész és a GYIK, minden sor egyezik a katalógussal. Ha nem nézed meg: csak a forma marad emberi szemmel nem látott.
|
||||
- **Nézd meg az AdventureLog és a Plex oldalát a demo-hp-n, a rendes címén** (`felhom.enkisfelhom.hu`). A túl nagy keret javítva: a tartalom most 32 képpontra van a bal oszloptól és 36-ra a tetejétől (előtte 80 és 64 volt). Az alkalmazás oldala mostantól egy hasábban van: egy szélesség, vékony vonalak a szakaszok között, aláhúzott fül, és doboz csak ott, ahol az alkalmazás vár rád (kék) vagy ahol valami kockázatos (sárga). A „sikeres frissítés" sáv kis szürke sorrá vált a név alatt. Ha nem nézed meg: a felület él, csak senki nem látta még böngészőben.
|
||||
|
||||
@@ -544,6 +544,12 @@ nicety.
|
||||
**loses Felhom's backup guarantees** — no PBS verify / monitoring on storage we can't reach. An
|
||||
honest signup-time tradeoff, not a hidden one.
|
||||
|
||||
**When the new package reaches the hub (R-978, agent `main` 2026-10-18, unreleased):** a ceremony started again no
|
||||
longer replaces the hub's package when it starts. The package travels with the pending ceremony and is uploaded when its
|
||||
code is claimed, before the code is handed out (an upload failure is a 502 and the code stays claimable). An abandoned
|
||||
ceremony — TTL, a new start, a restart — leaves the first code opening the hub's package. Residual: the typed-back check
|
||||
is the browser's, so a code opened and not written down still replaces the package (R-1151).
|
||||
|
||||
#### Custody across generations — what the hub retains when a blob is superseded (hub v0.60.0; **contract corrected hub v0.93.0, R-198**)
|
||||
|
||||
A ceremony that seals a *different* passphrase does not destroy the blob it replaces: the hub copies
|
||||
|
||||
@@ -222,6 +222,24 @@ Today: `GET /config/{id}` with an `X-Retrieval-Password` (Hungarian passphrase)
|
||||
The existing `configgen` deep-merge + Hungarian-passphrase machinery is the base; it grows the
|
||||
agent-first + key-pinning + restore-mode steps.
|
||||
|
||||
**A reinstall over an existing host record is made loud, never acted on [DESIGN, 2026-10-19 — R-1154, brief
|
||||
2026-10-19; hub v0.159.0].** `POST /host-enroll` is the installer's step 4, run on every pass (a `--resume` too), with
|
||||
the customer's retrieval passphrase; an existing host record is REUSED (same id and key — the reinstalled box takes
|
||||
it over). The clean-slate re-issues (a new claim code mailed to the household, the off-site provider password reset)
|
||||
run only on the MINT path, i.e. after the operator deleted the old host — **the operator's delete is their gate,
|
||||
and stays so.** A reinstall that kept the old record used to skip them in silence. Now the reuse path classifies the
|
||||
old box and re-issues NOTHING: **gone** (no controller wait connection open now, and either `deliberate_off_at`
|
||||
inside its hold or BOTH the host report and the controller report older than `alerting.stale_threshold` or absent —
|
||||
the `hostStatus` threshold and comparison) → the operator-only WARNING `host_reinstall_over_old_host`, mailed to the
|
||||
operator: delete the old host (Hosts page) and run the installer again, or re-issue the claim code and the off-site
|
||||
login from the customer page; **live** → the operator-only INFO `host_reenroll_while_live`, recorded, never mailed.
|
||||
**Why not re-issue automatically** (a security review of the first draft, the same day): the passphrase is a
|
||||
household-held secret typed into the installer, and both re-issues are operator SESSION-ONLY actions — not even an
|
||||
operator token may run them (§17.5; `09` §3 decision 252, R-1055/R-1059: an off-site re-issue „stops its backup for a
|
||||
while"). Re-issuing on the reuse path would give those powers to anyone holding the passphrase whenever the box is
|
||||
switched off or silent. The cost of the loud shape is two operator acts per reinstall that kept its old record. Both
|
||||
event types are hub-origin only. `hub/internal/api/reenroll.go`, pinned by `hub/internal/api/r1154_reenroll_test.go`.
|
||||
|
||||
## 9. DR model
|
||||
|
||||
The headline: the **old heavy infra-backup push retires** — not because the hub authors everything
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,24 @@
|
||||
loop=/dev/loop2
|
||||
--- lsblk p1 (the bug input)
|
||||
{"blockdevices":[{"name":"loop2p1","fstype":null,"pttype":"gpt","mountpoint":null}]}
|
||||
--- blkid -p p1 (empty part)
|
||||
DEVNAME=/dev/loop2p1
|
||||
PART_ENTRY_SCHEME=gpt
|
||||
PART_ENTRY_UUID=2b13a20b-f5a4-4906-9e30-985c170a50ad
|
||||
PART_ENTRY_TYPE=0fc63daf-8483-4772-8e79-3d69d8477de4
|
||||
PART_ENTRY_NUMBER=1
|
||||
PART_ENTRY_OFFSET=2048
|
||||
PART_ENTRY_SIZE=1048576
|
||||
PART_ENTRY_DISK=7:2
|
||||
rc=0
|
||||
--- blkid -p p2 (ext4)
|
||||
TYPE=ext4
|
||||
PART_ENTRY_SCHEME=gpt
|
||||
PART_ENTRY_NUMBER=2
|
||||
rc=0
|
||||
Re-reading the partition table failed.: Invalid argument
|
||||
--- blkid -p p1 (a dos table inside)
|
||||
PTTYPE=dos
|
||||
PART_ENTRY_SCHEME=gpt
|
||||
rc=0
|
||||
ls: cannot access '/root/r1093-scratch.img': No such file or directory
|
||||
@@ -0,0 +1,8 @@
|
||||
tester-1-d70be4 agent_update:
|
||||
uploaded signed op to the hub jobs queue
|
||||
tester-1-d70be4 agent_config_update:
|
||||
uploaded signed op to the hub jobs queue
|
||||
demo-felhom-8363b5 agent_update:
|
||||
uploaded signed op to the hub jobs queue
|
||||
demo-felhom-8363b5 agent_config_update:
|
||||
uploaded signed op to the hub jobs queue
|
||||
@@ -0,0 +1,11 @@
|
||||
tester-1: felhom-agent 0.159.2 | demo-felhom: felhom-agent 0.159.2 | 12:25:17
|
||||
Oct 18 14:23:46 felhom felhom-agent[3912599]: time=2026-10-18T14:23:46.774+02:00 level=WARN msg="signedjobs: signed op COMPLETED" job=c9b02a094671155e op=agent_update
|
||||
Oct 18 14:23:48 felhom felhom-agent[3912599]: time=2026-10-18T14:23:48.727+02:00 level=WARN msg="osupdate: capability probe after the config bundle" ok=75 total=75 degraded=""
|
||||
Oct 18 14:23:48 felhom felhom-agent[3912599]: time=2026-10-18T14:23:48.728+02:00 level=WARN msg="signedjobs: signed op COMPLETED" job=fa2a707792f561ed op=agent_config_update
|
||||
Oct 18 14:24:52 felhom felhom-agent[1371657]: time=2026-10-18T14:24:52.767+02:00 level=WARN msg="selfupdate: update committed" version=0.159.2 wrapper=""
|
||||
Oct 18 14:25:00 demo-felhom felhom-agent[2419165]: time=2026-10-18T14:25:00.552+02:00 level=WARN msg="signedjobs: signed op COMPLETED" job=9d4397117eeed3b9 op=agent_update
|
||||
Oct 18 14:25:01 demo-felhom felhom-agent[2419165]: time=2026-10-18T14:25:01.930+02:00 level=WARN msg="osupdate: capability probe after the config bundle" ok=75 total=75 degraded=""
|
||||
Oct 18 14:25:01 demo-felhom felhom-agent[2419165]: time=2026-10-18T14:25:01.930+02:00 level=WARN msg="signedjobs: signed op COMPLETED" job=63f8321055a65cb8 op=agent_config_update
|
||||
|
||||
[exited with code 0]
|
||||
Oct 18 14:26:05 demo-felhom felhom-agent[3800522]: time=2026-10-18T14:26:05.216+02:00 level=WARN msg="selfupdate: update committed" version=0.159.2 wrapper=""
|
||||
@@ -0,0 +1,23 @@
|
||||
Oct 18 13:12:26 demo-hp felhom-agent[3566597]: time=2026-10-18T13:12:26.461+02:00 level=INFO msg="backup: space preflight passed" vmid=9201 target=local last_archive_bytes=6916890749 need_bytes=9719855260 avail_bytes=12123615232
|
||||
Oct 18 13:12:27 demo-hp felhom-agent[3566597]: time=2026-10-18T13:12:27.526+02:00 level=INFO msg="local-api: backup reached snapshotted (app may resume)" vmid=9201 target=local job=backup-9201-1792321945880394998
|
||||
Oct 18 13:18:22 demo-hp felhom-agent[3566597]: time=2026-10-18T13:18:22.853+02:00 level=INFO msg="janitor: stale-lock sweep deferred — a heavy operation is in flight" busy=backup:local
|
||||
Oct 18 13:19:59 demo-hp felhom-agent[3566597]: time=2026-10-18T13:19:59.260+02:00 level=INFO msg="backup: completed" vmid=9201 target=local archive=local:backup/vzdump-lxc-9201-2026_10_18-13_12_26.tar.zst size_bytes=6938307162 uncovered_volumes=2
|
||||
Oct 18 13:19:59 demo-hp felhom-agent[3566597]: time=2026-10-18T13:19:59.260+02:00 level=INFO msg="local-api: backup job complete" vmid=9201 target=local job=backup-9201-1792321945880394998 archive=local:backup/vzdump-lxc-9201-2026_10_18-13_12_26.tar.zst
|
||||
Oct 18 13:19:59 demo-hp felhom-agent[3566597]: time=2026-10-18T13:19:59.266+02:00 level=INFO msg="local-api: no OS leg after a manual backup — it follows the night's own backup (R-899)" vmid=9201 job=backup-9201-1792321945880394998
|
||||
== sudo felhom-thin-check lines since the trigger:
|
||||
0
|
||||
== sudo lines since the trigger (any helper):
|
||||
26 COMMAND=/usr/bin/chown
|
||||
36 COMMAND=/usr/bin/lsblk
|
||||
98 COMMAND=/usr/bin/lxc-info
|
||||
78 COMMAND=/usr/bin/mkdir
|
||||
8 COMMAND=/usr/bin/wg
|
||||
36 COMMAND=/usr/sbin/blkid
|
||||
75 COMMAND=/usr/sbin/lvs
|
||||
16 COMMAND=/usr/sbin/nft
|
||||
57 COMMAND=/usr/sbin/pct
|
||||
150 COMMAND=/usr/sbin/smartctl
|
||||
|
||||
[exited with code 0]
|
||||
== control: the night's backup on agent 0.159.1 (2026-10-18 04:33 local) ran the check:
|
||||
Oct 18 04:33:15 demo-hp sudo[1664888]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/local/sbin/felhom-thin-check pve data
|
||||
@@ -0,0 +1,3 @@
|
||||
== trigger 2026-10-18T11:11:36Z (local 2026-10-18 13:11:36)
|
||||
200
|
||||
{"data": {"started": true}, "ok": true}
|
||||
@@ -0,0 +1,5 @@
|
||||
felhom-agent 0.159.1
|
||||
Oct 18 04:43:52 demo-hp felhom-agent[3320002]: time=2026-10-18T04:43:52.498+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: DONE rc=0 seconds=0 upgraded=0 (nothing to do)"
|
||||
Oct 18 04:43:53 demo-hp felhom-agent[3320002]: time=2026-10-18T04:43:53.613+02:00 level=INFO msg="osupdate: DONE" run=20261018T024228Z layer=pve vmid=9201 ring=0 trigger=night outcome=nothing healthy=true reason="" upgraded=0 pending=1 not_covered=0 restart_needed=11 reboot_needed=false wrapper_seconds=16.3
|
||||
Oct 18 05:23:06 demo-hp felhom-agent[3320002]: time=2026-10-18T05:23:06.521+02:00 level=INFO msg="backup: restore-test evaluated — nothing due" verdicts="local: no settled archive yet — nothing to prove (newborn or still settling); felhom-pbs: newest settled archive (landed 2026-10-15T20:38:47Z) is already proven"
|
||||
Oct 18 11:23:06 demo-hp felhom-agent[3320002]: time=2026-10-18T11:23:06.557+02:00 level=INFO msg="backup: restore-test evaluated — nothing due" verdicts="local: no settled archive yet — nothing to prove (newborn or still settling); felhom-pbs: newest settled archive (landed 2026-10-15T20:38:47Z) is already proven"
|
||||
@@ -0,0 +1,4 @@
|
||||
wrote envelope to /dev/null
|
||||
uploaded signed op to the hub jobs queue
|
||||
wrote envelope to /dev/null
|
||||
uploaded signed op to the hub jobs queue
|
||||
@@ -0,0 +1,8 @@
|
||||
felhom-agent 0.159.2 11:08:30
|
||||
Oct 18 13:08:17 demo-hp felhom-agent[3320002]: time=2026-10-18T13:08:17.765+02:00 level=WARN msg="signedjobs: signed op COMPLETED" job=763e0b8971dff83c op=agent_update
|
||||
Oct 18 13:08:18 demo-hp felhom-os-apply[3566414]: os-apply: BUNDLE DONE agent=0.159.2 written=0 same=30 self-check=ok signers-created=False
|
||||
Oct 18 13:08:18 demo-hp felhom-agent[3320002]: time=2026-10-18T13:08:18.862+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: BUNDLE DONE agent=0.159.2 written=0 same=30 self-check=ok signers-created=False"
|
||||
Oct 18 13:08:19 demo-hp felhom-agent[3320002]: time=2026-10-18T13:08:19.883+02:00 level=WARN msg="osupdate: capability probe after the config bundle" ok=75 total=75 degraded=""
|
||||
Oct 18 13:08:19 demo-hp felhom-agent[3320002]: time=2026-10-18T13:08:19.884+02:00 level=WARN msg="signedjobs: signed op COMPLETED" job=268dfe26d949094f op=agent_config_update
|
||||
|
||||
[exited with code 0]
|
||||
@@ -0,0 +1,7 @@
|
||||
demo-hp-bb76ea last report 2026-10-18 12:38:33 agent 0.159.2 health None
|
||||
tester-1-d70be4 last report 2026-10-18 12:39:04 agent 0.159.2 health None
|
||||
demo-felhom-8363b5 last report 2026-10-18 12:25:17 agent 0.159.2 health None
|
||||
report keys: ['addresses', 'agent_sha256', 'agent_version', 'audit_tail', 'backups', 'capabilities', 'cloudflared', 'controller_supervisor', 'dr_recipe', 'foreign_key_archives', 'guest_disk_trim', 'guest_net', 'guests', 'host', 'host_id', 'leaf_fingerprint', 'mgmt_plane', 'oob', 'pbs_dr', 'pbs_snapshots', 'reported_at', 'restore_tests', 'storage_targets', 'system', 'wireguard']
|
||||
demo-hp-bb76ea 2026-10-18 12:38:33 agent_version 0.159.2 degraded None cap_ok/total None problems None
|
||||
tester-1-d70be4 2026-10-18 12:39:04 agent_version 0.159.2 degraded None cap_ok/total None problems None
|
||||
demo-felhom-8363b5 2026-10-18 12:25:17 agent_version 0.159.2 degraded None cap_ok/total None problems None
|
||||
@@ -0,0 +1,2 @@
|
||||
felhom-agent sha256 4d98868e922d6c10665a6c0da9323e8627ea9c589094e81d27d741e625d9d8f9
|
||||
felhom-config-bundle.json sha256 477704ea2980948433ffc34bb59f008cc11410fd9683d386bfd3e2f085d55bc9
|
||||
@@ -0,0 +1,102 @@
|
||||
[release-agent] building 0.159.2 …
|
||||
[release-agent] built ok: sha256 4d98868e922d6c10665a6c0da9323e8627ea9c589094e81d27d741e625d9d8f9
|
||||
[release-agent] config bundle built: sha256 477704ea2980948433ffc34bb59f008cc11410fd9683d386bfd3e2f085d55bc9
|
||||
[release-agent] tagging v0.159.2 at 65c1994 …
|
||||
[release-agent] publishing …
|
||||
[publish-agent] publishing /tmp/felhom-agent-bMXfqp (16007752 bytes, sha256 4d98868e922d6c10…) → https://gitea.dooplex.hu/api/packages/admin/generic/felhom-agent/0.159.2/felhom-agent
|
||||
[publish-agent] pre-delete existing artifact: HTTP 404 (404/204 expected)
|
||||
[publish-agent] upload OK (HTTP 201)
|
||||
[publish-agent] round-trip GET verified (sha256 matches)
|
||||
[publish-agent] DONE. Record in the hub operator UI (Configs → Day-0 artifacts): agent 0.159.2 / 4d98868e922d6c10665a6c0da9323e862AGENT_VERSION=0.159.2
|
||||
AGENT_SHA256=4d98868e922d6c10665a6c0da9323e8627ea9c589094e81d27d741e625d9d8f9
|
||||
pre-push [felhom-agent]: running scripts/agent_gates.py --fast ...
|
||||
agent_gates — 4 gate(s) [--fast]
|
||||
--fast SKIPPED (deliberate periodic runs, never in a hook): published, gate-decoys
|
||||
|
||||
==============================================================================
|
||||
== gate: reuse-refs (reuse_refs_check.py /mnt/5_hdd/felhom.eu/git/felhom-agent)
|
||||
==============================================================================
|
||||
note [felhom-agent] line 189: localapi/debuglogs_test.go (resolved by suffix → internal/localapi/debuglogs_test.go)
|
||||
note [felhom-agent] line 205: hub/internal/store/dr_recipe.go (cross-repo → felhom.eu/hub/internal/store/dr_recipe.go)
|
||||
OK [felhom-agent]: 117 cited paths — exact 115, suffix 1, ambiguous 0, cross-repo 1, FAILED 0 (siblings searched: app-catalog-felhom.eu, cc-secrets, felhom-controller, felhom.eu, felhom.eu-media, felhom.eu-sizing-push, felhom.eu-wt-sizing)
|
||||
|
||||
==============================================================================
|
||||
== gate: instructions (instructions_gate.py /mnt/5_hdd/felhom.eu/git/felhom-agent)
|
||||
==============================================================================
|
||||
instructions_gate: /mnt/5_hdd/felhom.eu/git/felhom-agent
|
||||
CLAUDE.md effective lines : 108 (ceiling 200)
|
||||
version literals : 0
|
||||
TEMPORARY blocks : 0
|
||||
rule files : 6 (5 path-scoped)
|
||||
workspace file : SYMLINK -> felhom.eu/documentation/runbooks/workspace-CLAUDE.md (resolves to the versioned copy)
|
||||
memory index : 200 lines (ceiling 200), 24953 bytes (ceiling 25600)
|
||||
memory index content : 28 version literal(s), 3 host address(es), 0 expired statement(s) [WARN only]
|
||||
memory topic files : 181 indexed, 4 orphaned, 41 archived
|
||||
register citations : 6 cited, 1109 register items known
|
||||
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:31: version literal '0.14.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- **[restic 0.14.0 `--verify` is size+mtime, NOT content](restic-0140-verify-and-lock-sema
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:89: version literal '0.142.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- [Offsite continuity](offsite-continuity-2026-07-17.md) — ctrl 0.142.0 orphan guard + hub
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:89: version literal '0.60.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- [Offsite continuity](offsite-continuity-2026-07-17.md) — ctrl 0.142.0 orphan guard + hub
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:96: version literal '0.152.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- **[Hub operator UI: CC uses its token HUB_TOKEN, not the password](hub-operator-ui-basic
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:100: version literal '0.90.1' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- [Agent 0.90.1 is wrapper-only](agent-0901-is-wrapper-only.md) — do NOT publish the binar
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:102: version literal '0.144.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- [SMB „Megosztás" R-7 slice 1](smb-sharing-r7-slice1-2026-07-18.md) — ctrl 0.144.0 + felh
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md: ... and 22 more version literal(s) — full list from the tally counts above.
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:58: host address '192.168.0.192' — operations/nodes.md is the single home for these. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- [hub.felhom.eu resolves to the LAN here](hub-resolves-to-lan-on-dooplex-network.md) — 19
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:77: host address '167.233.158.164' — operations/nodes.md is the single home for these. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- [Offsite PBS box RAM ceiling](offsite-pbs-box-ram-ceiling-2026-07-27.md) — **root SSH =
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:185: host address '192.168.0.180' — operations/nodes.md is the single home for these. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- **CC runs ON DooPlex** (192.168.0.180) — repos `/mnt/5_hdd/felhom.eu/git/felhom-*`, buil
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory: 4 top-level topic file(s) are not referenced by MEMORY.md, so nothing will ever read them: f10-demo-hp-offsite-resolved-2026-07-23.md, launcher-v0163-2026-07-24.md, peti-return-p1-stop-2026-07-13.md, stopped-not-fault-v0164-2026-07-24.md
|
||||
|
||||
instructions_gate: OK (11 warning(s))
|
||||
|
||||
==============================================================================
|
||||
== gate: release-complete (check-release-complete.py)
|
||||
==============================================================================
|
||||
check-release-complete — the newest CHANGELOG version is a complete release
|
||||
newest CHANGELOG version: v0.159.1
|
||||
ok tag v0.159.1 -> 5c3b218822, an ancestor of HEAD
|
||||
ok package 0.159.1 is downloadable
|
||||
|
||||
check-release-complete: v0.159.1 is tagged, placed and published.
|
||||
|
||||
==============================================================================
|
||||
== gate: observations (observations_gate.py /mnt/5_hdd/felhom.eu/git/felhom-agent)
|
||||
==============================================================================
|
||||
observations gate OK — REPORT.md has no observations section (nothing to check)
|
||||
|
||||
==============================================================================
|
||||
== summary
|
||||
==============================================================================
|
||||
reuse-refs OK (exit 0)
|
||||
instructions OK (exit 0)
|
||||
release-complete OK (exit 7ea9c589094e81d27d741e625d9d8f9
|
||||
[release-agent] config bundle published (HTTP 201)
|
||||
[release-agent] pushing v0.159.2 …
|
||||
remote: . Processing 1 references
|
||||
remote: Processed 1 references in total
|
||||
To https://gitea.dooplex.hu0)
|
||||
observations OK (exit 0)
|
||||
|
||||
all agent gates OK
|
||||
pre-push [felhom-agent]: gates OK - push proceeding.
|
||||
|
||||
RELEASED — and installable, verified by download, not by this script's own say-so.
|
||||
|
||||
version : 0.159.2
|
||||
tag : v0.159.2
|
||||
sha256 : 4d98868e922d6c10665a6c0da9323e8627ea9c589094e81d27d741e625d9d8f9
|
||||
bundle : 477704ea2980948433ffc34bb59f008cc11410fd9683d386bfd3e2f085d55bc9 (felhom-config-bundle.json — vouch it with the agent)
|
||||
|
||||
NOT VOUCHED. Vouching is what points machines at this version and stays you/admin/felhom-agent.git
|
||||
* [new tag] v0.159.2 -> v0.159.2
|
||||
[release-agent] verifying by independent download …
|
||||
r deliberate act:
|
||||
hub operator UI → Configs → Day-0 artifacts. Until then boxes keep installing the previous one.
|
||||
@@ -0,0 +1,4 @@
|
||||
== published installer read back 2026-10-18T12:32:10Z
|
||||
SCRIPT_VERSION="1.34.0" # the SINGLE version source (F-1): -h and the run banners follow it.
|
||||
served sha256 df722ee49f38da595e7c7017aa932b45853696c5282bc408b67a5fb8f141b67a
|
||||
tag sha256 df722ee49f38da595e7c7017aa932b45853696c5282bc408b67a5fb8f141b67a
|
||||
@@ -0,0 +1,28 @@
|
||||
# Website calculator — Immich before/after (2026-10-18)
|
||||
|
||||
Immich peak: **3,290 MB → 3,983 MB** (the kernel in-use figure from the 4,000-photo import, all four containers; the heap alone peaked at 2,777 MB). Immich typical: **1,557 MB, unchanged** (rest after the import: 1,230 MB heap — the raise-only rule keeps the higher). Headroom ×1.5, guest rule and platform unchanged.
|
||||
|
||||
## Immich alone — peak with the platform: 3,760 → 4,453 MB
|
||||
|
||||
| Machine | guest memory | before | after |
|
||||
|---|---|---|---|
|
||||
| 8 GB | 4,096 MB | fits, but tight | does not fit **(changes)** |
|
||||
| 12 GB | 7,580 MB | fits well | fits well |
|
||||
| 16 GB | 11,676 MB | fits well | fits well |
|
||||
| 24 GB | 19,868 MB | fits well | fits well |
|
||||
| 32 GB | 28,060 MB | fits well | fits well |
|
||||
| 48 GB | 44,444 MB | fits well | fits well |
|
||||
| 64 GB | 60,828 MB | fits well | fits well |
|
||||
|
||||
## Family starter set — peak with the platform: 6,021 → 6,714 MB
|
||||
|
||||
| Machine | guest memory | before | after |
|
||||
|---|---|---|---|
|
||||
| 8 GB | 4,096 MB | does not fit | does not fit |
|
||||
| 12 GB | 7,580 MB | fits, but tight | fits, but tight |
|
||||
| 16 GB | 11,676 MB | fits well | fits well |
|
||||
| 24 GB | 19,868 MB | fits well | fits well |
|
||||
| 32 GB | 28,060 MB | fits well | fits well |
|
||||
| 48 GB | 44,444 MB | fits well | fits well |
|
||||
| 64 GB | 60,828 MB | fits well | fits well |
|
||||
|
||||
@@ -0,0 +1,27 @@
|
||||
=== demo-hp (enkisfelhom.hu)
|
||||
containers: 24 running; not healthy/running: traefik Up 2 days;
|
||||
unhealthy: 0
|
||||
2026/10/18 11:09:36 updater.go:855: [INFO] [selfupdate] Post-update startup: update successful (0.329.0 → 0.330.0)
|
||||
allow-list refusals since start: 0
|
||||
2026/10/18 11:09:36 sync.go:142: [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
|
||||
installed apps (stacks with app.yaml): 12
|
||||
public https://felhom.enkisfelhom.hu/login: 200
|
||||
public https://files.enkisfelhom.hu/: 200
|
||||
=== demo-felhom (demo-felhom.eu)
|
||||
containers: 9 running; not healthy/running: traefik Up 2 days;
|
||||
unhealthy: 0
|
||||
2026/10/18 11:09:25 [INFO] [selfupdate] Post-update startup: update successful (0.329.0 → 0.330.0)
|
||||
allow-list refusals since start: 0
|
||||
2026/10/18 11:09:26 [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
|
||||
installed apps (stacks with app.yaml): 5
|
||||
public https://felhom.demo-felhom.eu/login: 200
|
||||
public https://files.demo-felhom.eu/: 200
|
||||
=== tester-1 (enkicsifelhom.hu)
|
||||
containers: 10 running; not healthy/running: traefik Up 2 days;
|
||||
unhealthy: 0
|
||||
2026/10/18 11:09:35 [INFO] [selfupdate] Post-update startup: update successful (0.329.0 → 0.330.0)
|
||||
allow-list refusals since start: 0
|
||||
2026/10/18 11:09:36 [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
|
||||
installed apps (stacks with app.yaml): 3
|
||||
public https://felhom.enkicsifelhom.hu/login: 200
|
||||
public https://files.enkicsifelhom.hu/: 200
|
||||
@@ -0,0 +1,12 @@
|
||||
== global floor 2026-10-18T11:10:59Z
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /configuration?flash=floor_set
|
||||
clear tester-1:
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /customers/tester-1?flash=floor_set
|
||||
clear demo-hp:
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /customers/demo-hp?flash=floor_set
|
||||
clear demo-felhom:
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /customers/demo-felhom?flash=floor_set
|
||||
@@ -0,0 +1,9 @@
|
||||
set tester-1:
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /customers/tester-1?flash=floor_set
|
||||
set demo-hp:
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /customers/demo-hp?flash=floor_set
|
||||
set demo-felhom:
|
||||
HTTP/1.1 303 See Other
|
||||
Location: /customers/demo-felhom?flash=floor_set
|
||||
@@ -0,0 +1,3 @@
|
||||
('min_controller_version', '0.330.0')
|
||||
('min_controller_version_declared_min_agent', '0.330.0=0.158.1')
|
||||
per-box floors set: 0
|
||||
@@ -0,0 +1,2 @@
|
||||
OK http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1
|
||||
== every public name redirects http -> https
|
||||
@@ -0,0 +1,20 @@
|
||||
# P8 — old-restic check: NOT RUN (the clean-up window has not opened). Read 2026-10-18T14:33:43Z.
|
||||
|
||||
## demo-hp's clean-up windows (hub DB with its WAL, one tar)
|
||||
id|customer|opened_at|closes_by|closed_at|box_result
|
||||
9|demo-hp|2026-10-12 02:16:53|2026-10-12 02:36:53|2026-10-12 02:17:06|pruned
|
||||
6|demo-hp|2026-10-05 05:25:53|2026-10-05 05:45:53|2026-10-05 05:26:04|pruned
|
||||
2|demo-hp|2026-10-04 05:36:14|2026-10-04 05:56:14|2026-10-04 05:36:17|nothing
|
||||
|
||||
## The rule (hub/internal/offsitekeys/service.go:255)
|
||||
windowCadence = 6*24*time.Hour + 12*time.Hour // "weekly", with slack for the night chain's drift
|
||||
Last window 2026-10-12 02:16:53 UTC + 6 d 12 h = 2026-10-18 14:16:53 UTC (the STATUS time).
|
||||
The box asks for a window only AFTER its nightly off-site run (controller backup/offbox_window.go header).
|
||||
|
||||
## demo-hp guest 9201 controller (docker logs since 06:00 UTC, [offbox] lines + scheduler)
|
||||
felhom-controller gitea.dooplex.hu/admin/felhom-controller:0.330.0 Up 3 hours (healthy)
|
||||
2026/10/18 11:09:36 scheduler.go:150: [INFO] [scheduler] Daily job offbox-backup scheduled for 2026-10-19 04:15 CEST
|
||||
2026/10/18 11:09:36 scheduler.go:85: [DEBUG] [scheduler] daily job registered: name="offbox-backup" schedule="04:15" nextRun=2026-10-19T04:15:00+02:00 totalJobs=15
|
||||
2026/10/18 11:09:36 scheduler.go:85: [DEBUG] [scheduler] daily job offbox-backup: next run at 2026-10-19 04:15:00 CEST (waiting 15h5m23s)
|
||||
|
||||
Next run: 2026-10-19 04:15 CEST = 02:15 UTC; the window opens right after it. No window was asked for or granted by CC.
|
||||
@@ -0,0 +1,23 @@
|
||||
Mon Oct 19 01:24:39 UTC 2026
|
||||
200
|
||||
{"data": {"started": true}, "ok": true}
|
||||
200
|
||||
{
|
||||
"data": {
|
||||
"backup": {
|
||||
"target_id": "local",
|
||||
"vmid": 9201,
|
||||
"archive": "local:backup/vzdump-lxc-9201-2026_10_19-03_25_27.tar.zst",
|
||||
"mode": "snapshot",
|
||||
"crash_consistent": true,
|
||||
"size_bytes": 6864786948,
|
||||
"success": true,
|
||||
"started_at": "2026-10-19T01:25:26Z",
|
||||
"duration_seconds": 443.050964897
|
||||
},
|
||||
"error": "",
|
||||
"job_id": "backup-9201-1792373126635435331",
|
||||
"phase": "done"
|
||||
},
|
||||
"ok": true
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
Mon Oct 19 01:52:00 UTC 2026
|
||||
tester-1-d70be4 agent_update:
|
||||
signed: op=agent_update host=tester-1-d70be4 guest="" key_id=felhom-op-1 nonce=3516434bfa0c5c47295e3de0a8bd20c7 expires=2026-10-19T02:37:00Z
|
||||
uploaded signed op to the hub jobs queue
|
||||
tester-1-d70be4 agent_config_update:
|
||||
signed: op=agent_config_update host=tester-1-d70be4 guest="" key_id=felhom-op-1 nonce=2dfc5b3e216030c82add18ba69899b41 expires=2026-10-19T02:37:00Z
|
||||
uploaded signed op to the hub jobs queue
|
||||
demo-felhom-8363b5 agent_update:
|
||||
signed: op=agent_update host=demo-felhom-8363b5 guest="" key_id=felhom-op-1 nonce=8f3a6c280cb124c6f85a4039c5b112dc expires=2026-10-19T02:37:00Z
|
||||
uploaded signed op to the hub jobs queue
|
||||
demo-felhom-8363b5 agent_config_update:
|
||||
signed: op=agent_config_update host=demo-felhom-8363b5 guest="" key_id=felhom-op-1 nonce=dc2ead6937a38d0a2d8acd4abf57bef9 expires=2026-10-19T02:37:00Z
|
||||
uploaded signed op to the hub jobs queue
|
||||
@@ -0,0 +1,17 @@
|
||||
2026-10-19T01:55:42Z tester-1: felhom-agent 0.160.0 | demo-felhom: felhom-agent 0.160.0
|
||||
Oct 19 03:54:05 felhom felhom-agent[1371657]: time=2026-10-19T03:54:05.642+02:00 level=WARN msg="signedjobs: signed op COMPLETED" job=a254c4ec38459c7c op=agent_update
|
||||
Oct 19 03:54:06 felhom felhom-agent[1371657]: time=2026-10-19T03:54:06.786+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: BUNDLE DONE agent=0.160.0 written=0 same=30 self-check=ok signers-created=False"
|
||||
Oct 19 03:54:07 felhom felhom-agent[1371657]: time=2026-10-19T03:54:07.652+02:00 level=WARN msg="osupdate: capability probe after the config bundle" ok=75 total=75 degraded=""
|
||||
Oct 19 03:54:07 felhom felhom-agent[1371657]: time=2026-10-19T03:54:07.653+02:00 level=WARN msg="signedjobs: signed op COMPLETED" job=a66f7fc0b9fd8fb6 op=agent_config_update
|
||||
Oct 19 03:54:08 felhom felhom-agent[2443463]: time=2026-10-19T03:54:08.649+02:00 level=INFO msg="backup tier armed" target=local cadence=24h0m0s keep_last=3 prune="keep-daily=3" wait_timeout=30m0s prune_pbs_allowed=false primary=true
|
||||
Oct 19 03:54:08 felhom felhom-agent[2443463]: time=2026-10-19T03:54:08.649+02:00 level=INFO msg="backup tier armed" target=felhom-pbs cadence=168h0m0s keep_last=0 prune="" wait_timeout=12h0m0s prune_pbs_allowed=false primary=false
|
||||
Oct 19 03:55:10 felhom felhom-agent[2443463]: time=2026-10-19T03:55:10.315+02:00 level=WARN msg="selfupdate: update committed" version=0.160.0 wrapper=""
|
||||
Oct 19 03:55:15 demo-felhom felhom-os-apply[498026]: os-apply: BUNDLE DONE agent=0.160.0 written=0 same=30 self-check=ok signers-created=False
|
||||
Oct 19 03:55:15 demo-felhom felhom-agent[3800522]: time=2026-10-19T03:55:15.698+02:00 level=INFO msg="osupdate: wrapper" line="os-apply: BUNDLE DONE agent=0.160.0 written=0 same=30 self-check=ok signers-created=False"
|
||||
Oct 19 03:55:16 demo-felhom felhom-agent[3800522]: time=2026-10-19T03:55:16.340+02:00 level=WARN msg="osupdate: capability probe after the config bundle" ok=75 total=75 degraded=""
|
||||
Oct 19 03:55:16 demo-felhom felhom-agent[3800522]: time=2026-10-19T03:55:16.340+02:00 level=WARN msg="signedjobs: signed op COMPLETED" job=7dde89f299a0684c op=agent_config_update
|
||||
Oct 19 03:55:17 demo-felhom felhom-agent[498196]: time=2026-10-19T03:55:17.698+02:00 level=INFO msg="backup tier armed" target=felhom-backup cadence=24h0m0s keep_last=3 prune="keep-daily=3" wait_timeout=30m0s prune_pbs_allowed=false primary=true
|
||||
Oct 19 03:55:17 demo-felhom felhom-agent[498196]: time=2026-10-19T03:55:17.698+02:00 level=INFO msg="backup tier armed" target=felhom-pbs cadence=168h0m0s keep_last=0 prune="" wait_timeout=12h0m0s prune_pbs_allowed=false primary=false
|
||||
Oct 19 03:56:19 demo-felhom felhom-agent[498196]: time=2026-10-19T03:56:19.667+02:00 level=WARN msg="selfupdate: update committed" version=0.160.0 wrapper=""
|
||||
|
||||
[exited with code 0]
|
||||
@@ -0,0 +1,29 @@
|
||||
Volid Format Type Size VMID
|
||||
local:backup/vzdump-lxc-9100-2026_08_21-17_59_15.tar.zst tar.zst backup 656970239 9100
|
||||
local:backup/vzdump-lxc-9201-2026_10_19-03_25_27.tar.zst tar.zst backup 6864786948 9201
|
||||
local:backup/felhom-golden-0.236.0.tar.zst tar.zst backup 654115664
|
||||
Oct 19 03:23:37 demo-hp felhom-agent[2622137]: time=2026-10-19T03:23:37.628+02:00 level=INFO msg="backup tier armed" target=local cadence=24h0m0s keep_last=1 prune="keep-daily=1" wait_timeout=30m0s prune_pbs_allowed=false primary=true
|
||||
Oct 19 03:23:37 demo-hp felhom-agent[2622137]: time=2026-10-19T03:23:37.628+02:00 level=INFO msg="backup tier armed" target=felhom-pbs cadence=168h0m0s keep_last=0 prune="" wait_timeout=12h0m0s prune_pbs_allowed=false primary=false
|
||||
Oct 19 03:24:39 demo-hp felhom-agent[2622137]: time=2026-10-19T03:24:39.730+02:00 level=WARN msg="selfupdate: update committed" version=0.160.0 wrapper=""
|
||||
Oct 19 03:32:49 demo-hp felhom-agent[2622137]: time=2026-10-19T03:32:49.686+02:00 level=INFO msg="backup: completed" vmid=9201 target=local archive=local:backup/vzdump-lxc-9201-2026_10_19-03_25_27.tar.zst size_bytes=6864786948 uncovered_volumes=2
|
||||
Oct 19 03:32:49 demo-hp felhom-agent[2622137]: time=2026-10-19T03:32:49.686+02:00 level=INFO msg="local-api: backup job complete" vmid=9201 target=local job=backup-9201-1792373126635435331 archive=local:backup/vzdump-lxc-9201-2026_10_19-03_25_27.tar.zst
|
||||
-rw------- 1 felhom-agent felhom-agent 323 Oct 19 03:32 /var/lib/felhom-agent/backup-success-state.json
|
||||
[
|
||||
{
|
||||
"target": "felhom-pbs",
|
||||
"vmid": 9201,
|
||||
"started_at": "2026-10-15T20:38:46Z",
|
||||
"recent": [
|
||||
"2026-10-15T20:38:46Z"
|
||||
]
|
||||
},
|
||||
{
|
||||
"target": "local",
|
||||
"vmid": 9201,
|
||||
"started_at": "2026-10-19T01:25:26Z",
|
||||
"recent": [
|
||||
"2026-10-18T11:12:25Z",
|
||||
"2026-10-19T01:25:26Z"
|
||||
]
|
||||
}
|
||||
]
|
||||
@@ -0,0 +1,33 @@
|
||||
Mon Oct 19 01:22:11 UTC 2026
|
||||
felhom-agent 0.159.2
|
||||
demo-hp-bb76ea
|
||||
Volid Format Type Size VMID
|
||||
local:backup/vzdump-lxc-9100-2026_08_21-17_59_15.tar.zst tar.zst backup 656970239 9100
|
||||
local:backup/vzdump-lxc-9201-2026_10_18-13_12_26.tar.zst tar.zst backup 6938307162 9201
|
||||
local:backup/felhom-golden-0.236.0.tar.zst tar.zst backup 654115664
|
||||
"local_backup_retention": 1
|
||||
VMID NAME STATUS MEM(MB) BOOTDISK(GB) PID
|
||||
341 night1004-tester1 running 8192 200.00 1851
|
||||
perl: warning: Setting locale failed.
|
||||
perl: warning: Please check that your locale settings:
|
||||
LANGUAGE = (unset),
|
||||
LC_ALL = (unset),
|
||||
LC_CTYPE = "UTF-8",
|
||||
LC_NUMERIC = (unset),
|
||||
LC_COLLATE = (unset),
|
||||
LC_TIME = (unset),
|
||||
LC_MESSAGES = (unset),
|
||||
LC_MONETARY = (unset),
|
||||
LC_ADDRESS = (unset),
|
||||
LC_IDENTIFICATION = (unset),
|
||||
LC_MEASUREMENT = (unset),
|
||||
LC_PAPER = (unset),
|
||||
LC_TELEPHONE = (unset),
|
||||
LC_NAME = (unset),
|
||||
LANG = "en_US.UTF-8"
|
||||
are supported and installed on your system.
|
||||
perl: warning: Falling back to a fallback locale ("en_US.UTF-8").
|
||||
VMID Status Lock Name
|
||||
9201 running demo-hp
|
||||
9202 running demo-hp-scratch
|
||||
9401 stopped upgrade-harness
|
||||
@@ -0,0 +1,9 @@
|
||||
Mon Oct 19 01:22:47 UTC 2026
|
||||
demo-hp-bb76ea agent_update:
|
||||
signed: op=agent_update host=demo-hp-bb76ea guest="" key_id=felhom-op-1 nonce=71396ac328c9ea3192d027b830ec0990 expires=2026-10-19T02:07:47Z
|
||||
wrote envelope to /dev/null
|
||||
uploaded signed op to the hub jobs queue
|
||||
demo-hp-bb76ea agent_config_update:
|
||||
signed: op=agent_config_update host=demo-hp-bb76ea guest="" key_id=felhom-op-1 nonce=603f1d8ed0937492cf01a05146fc9e48 expires=2026-10-19T02:07:47Z
|
||||
wrote envelope to /dev/null
|
||||
uploaded signed op to the hub jobs queue
|
||||
@@ -0,0 +1,5 @@
|
||||
Mon Oct 19 01:47:33 UTC 2026
|
||||
code 0 (the stored demo-hp code, before):
|
||||
HTTP 200 opens; restic_pw_sha256 8a9e33aa
|
||||
control, a wrong code:
|
||||
HTTP 400 the recovery code did not open the sealed bundle — nothing was written
|
||||
@@ -0,0 +1,11 @@
|
||||
01:47:43Z start 200 {"data":{"job_id":"escrow-1792374463410689900","phase":"running"},"error":"","ok":true}
|
||||
|
||||
status 200 {"phase": "done", "claimable": true, "uploaded": false, "restic_pw_sealed": true, "detail": ""}
|
||||
claim 200 code words: 10 {"confirm_required": true, "verify_positions": [3, 10]}
|
||||
status after claim {"phase": "done", "claimed": true, "uploaded": false}
|
||||
confirm with one wrong word 422 A megadott szavak nem egyeznek — ellenőrizd a felírt kódot.
|
||||
01:47:47Z confirm with the right words 200 {"uploaded": true}
|
||||
code 1 after the confirm:
|
||||
HTTP 200 opens; restic_pw_sha256 8a9e33aa
|
||||
code 0 after the confirm:
|
||||
HTTP 422 the recovery code is correct, but it belongs to an EARLIER sealed package (superseded 2026-10-19T01:47:47Z), not the one
|
||||
@@ -0,0 +1,9 @@
|
||||
01:48:09Z start 200 {"data":{"job_id":"escrow-1792374489199785658","phase":"running"},"error":"","ok":true}
|
||||
|
||||
status 200 {"phase": "done", "claimable": true, "uploaded": false, "restic_pw_sealed": true, "detail": ""}
|
||||
claim 200 code words: 10 {"confirm_required": true, "verify_positions": [5, 10]}
|
||||
status after claim {"phase": "done", "claimed": true, "uploaded": false}
|
||||
after the abandon — code 1 (stored):
|
||||
HTTP 200 opens; restic_pw_sha256 8a9e33aa
|
||||
code 2 (shown, never typed back):
|
||||
HTTP 400 the recovery code did not open the sealed bundle — nothing was written
|
||||
@@ -0,0 +1,23 @@
|
||||
time=2026-10-19T03:47:33.706+02:00 level=INFO msg="local-api: recovering the offsite repository password from the sealed escrow (R via body, never logged/persisted)" vmid=9201
|
||||
time=2026-10-19T03:47:34.786+02:00 level=INFO msg="local-api: offsite repository password RECOVERED from the sealed escrow — returning that field ONLY (the tunnel token, the PBS token and the WG key stay inside the agent and are not returned)" vmid=9201 rest
|
||||
time=2026-10-19T03:47:35.044+02:00 level=INFO msg="local-api: recovering the offsite repository password from the sealed escrow (R via body, never logged/persisted)" vmid=9201
|
||||
time=2026-10-19T03:47:36.053+02:00 level=WARN msg="local-api: offsite key recovery: the fetched bundle did not open with the supplied recovery code" vmid=9201 err="escrow: the recovery code did not unwrap the identity escrow (wrong recovery code, or a corrupt
|
||||
time=2026-10-19T03:47:43.409+02:00 level=INFO msg="local-api: staged offsite restic repo password for escrow (field name only)" vmid=9201
|
||||
time=2026-10-19T03:47:43.410+02:00 level=INFO msg="local-api: escrow ceremony started (controller-driven)" vmid=9201 job_id=escrow-1792374463410689900
|
||||
felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/local/bin/felhom-agent --config /etc/felhom-agent/agent.json --selftest=escrow-create --upload --output=json
|
||||
time=2026-10-19T03:47:45.992+02:00 level=INFO msg="local-api: escrow ceremony complete — R claimable (in-memory, one-shot); package uploads at the claim" job_id=escrow-1792374463410689900 restic_pw_sealed=true uploaded=false claim_ttl_s=600 duration_ms=2581
|
||||
time=2026-10-19T03:47:47.507+02:00 level=INFO msg="local-api: escrow ceremony R claimed — the package waits for the typed-back words (R-1151)" vmid=9201 job_id=escrow-1792374463410689900 confirm_ttl_s=1800
|
||||
time=2026-10-19T03:47:47.550+02:00 level=INFO msg="local-api: escrow confirm — the typed words do not match; still waiting (R-1151)" vmid=9201
|
||||
time=2026-10-19T03:47:47.619+02:00 level=INFO msg="local-api: escrow confirm — words typed back; the new package is on the hub (R-1151)" vmid=9201 job_id=escrow-1792374463410689900 duration_ms=48
|
||||
time=2026-10-19T03:47:48.247+02:00 level=INFO msg="local-api: recovering the offsite repository password from the sealed escrow (R via body, never logged/persisted)" vmid=9201
|
||||
time=2026-10-19T03:47:49.287+02:00 level=INFO msg="local-api: offsite repository password RECOVERED from the sealed escrow — returning that field ONLY (the tunnel token, the PBS token and the WG key stay inside the agent and are not returned)" vmid=9201 rest
|
||||
time=2026-10-19T03:47:49.635+02:00 level=INFO msg="local-api: recovering the offsite repository password from the sealed escrow (R via body, never logged/persisted)" vmid=9201
|
||||
time=2026-10-19T03:48:09.199+02:00 level=INFO msg="local-api: staged offsite restic repo password for escrow (field name only)" vmid=9201
|
||||
time=2026-10-19T03:48:09.199+02:00 level=INFO msg="local-api: escrow ceremony started (controller-driven)" vmid=9201 job_id=escrow-1792374489199785658
|
||||
felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/local/bin/felhom-agent --config /etc/felhom-agent/agent.json --selftest=escrow-create --upload --output=json
|
||||
time=2026-10-19T03:48:11.881+02:00 level=INFO msg="local-api: escrow ceremony complete — R claimable (in-memory, one-shot); package uploads at the claim" job_id=escrow-1792374489199785658 restic_pw_sealed=true uploaded=false claim_ttl_s=600 duration_ms=2681
|
||||
time=2026-10-19T03:48:13.294+02:00 level=INFO msg="local-api: escrow ceremony R claimed — the package waits for the typed-back words (R-1151)" vmid=9201 job_id=escrow-1792374489199785658 confirm_ttl_s=1800
|
||||
time=2026-10-19T03:48:14.059+02:00 level=INFO msg="local-api: recovering the offsite repository password from the sealed escrow (R via body, never logged/persisted)" vmid=9201
|
||||
time=2026-10-19T03:48:15.141+02:00 level=INFO msg="local-api: offsite repository password RECOVERED from the sealed escrow — returning that field ONLY (the tunnel token, the PBS token and the WG key stay inside the agent and are not returned)" vmid=9201 rest
|
||||
time=2026-10-19T03:48:15.389+02:00 level=INFO msg="local-api: recovering the offsite repository password from the sealed escrow (R via body, never logged/persisted)" vmid=9201
|
||||
time=2026-10-19T03:48:17.435+02:00 level=WARN msg="local-api: offsite key recovery: the fetched bundle did not open with the supplied recovery code" vmid=9201 err="escrow: the recovery code did not unwrap the identity escrow (wrong recovery code, or a corrupt
|
||||
@@ -0,0 +1,4 @@
|
||||
Mon Oct 19 02:08:15 UTC 2026
|
||||
demo-felhom-8363b5|0.160.0|2026-10-19 01:55:31
|
||||
demo-hp-bb76ea|0.160.0|2026-10-19 01:53:50
|
||||
tester-1-d70be4|0.160.0|2026-10-19 01:54:15
|
||||
@@ -0,0 +1,36 @@
|
||||
== root@192.168.0.154
|
||||
Mon Oct 19 01:51:20 UTC 2026
|
||||
felhom-agent 0.159.2
|
||||
"host_id": "tester-1-d70be4"
|
||||
"local_backup_retention": 3
|
||||
Volid Format Type Size VMID
|
||||
local:backup/vzdump-lxc-9100-2026_10_04-21_40_45.tar.zst tar.zst backup 648135998 9100
|
||||
local:backup/vzdump-lxc-9201-2026_10_15-22_43_40.tar.zst tar.zst backup 3364084456 9201
|
||||
local:backup/vzdump-lxc-9201-2026_10_17-04_32_43.tar.zst tar.zst backup 3479976346 9201
|
||||
local:backup/vzdump-lxc-9201-2026_10_18-04_37_41.tar.zst tar.zst backup 1867626596 9201
|
||||
== felhom-pve
|
||||
Mon Oct 19 01:51:13 UTC 2026
|
||||
felhom-agent 0.159.2
|
||||
"host_id": "demo-felhom-8363b5"
|
||||
"local_backup_retention": 3
|
||||
Volid Format Type Size VMID
|
||||
local:backup/vzdump-lxc-9100-2026_07_18-18_30_52.tar.zst tar.zst backup 612397450 9100
|
||||
local:backup/vzdump-lxc-9100-2026_07_20-17_50_57.tar.zst tar.zst backup 648549366 9100
|
||||
local:backup/vzdump-lxc-9100-2026_08_03-06_58_00.tar.zst tar.zst backup 649547835 9100
|
||||
local:backup/vzdump-lxc-9100-2026_08_03-09_15_34.tar.zst tar.zst backup 649547835 9100
|
||||
local:backup/vzdump-lxc-9201-2026_07_28-01_27_56.tar.zst tar.zst backup 5820882781 9201
|
||||
local:backup/vzdump-lxc-9201-2026_07_28-06_44_22.tar.zst tar.zst backup 5840583923 9201
|
||||
local:backup/vzdump-lxc-9201-2026_07_28-17_53_26.tar.zst tar.zst backup 5929975285 9201
|
||||
{'local_backup_target': 'felhom-backup', 'local_backup_retention': 3, 'restore_test_cadence_seconds': 0, 'backup_cadence_seconds': 0, 'backup_targets': [{'target_id': 'felhom-pbs', 'cadence_seconds': 604800, 'keep_last': 0}]}
|
||||
Name Type Status Total (KiB) Used (KiB) Available (KiB) %
|
||||
felhom-backup dir active 960303848 7518604 903930732 0.78%
|
||||
felhom-pbs pbs active 0 0 0 0.00%
|
||||
local dir active 98497780 33631712 59816520 34.14%
|
||||
local-lvm lvmthin active 365760512 11082543 354677968 3.03%
|
||||
time=2026-10-16T05:03:53.319+02:00 level=INFO msg="backup: completed" vmid=9201 target=felhom-backup archive=felhom-backup:backup/vzdump-lxc-9201-2026_10_16-05_03_12.tar.zst size_bytes=1300947312 uncovered_volumes=2
|
||||
time=2026-10-17T05:07:43.382+02:00 level=INFO msg="backup: completed" vmid=9201 target=felhom-backup archive=felhom-backup:backup/vzdump-lxc-9201-2026_10_17-05_07_02.tar.zst size_bytes=1334976334 uncovered_volumes=2
|
||||
time=2026-10-18T05:08:13.307+02:00 level=INFO msg="backup: completed" vmid=9201 target=felhom-backup archive=felhom-backup:backup/vzdump-lxc-9201-2026_10_18-05_07_32.tar.zst size_bytes=1296570428 uncovered_volumes=2
|
||||
Volid Format Type Size VMID
|
||||
felhom-backup:backup/vzdump-lxc-9201-2026_10_16-05_03_12.tar.zst tar.zst backup 1300947312 9201
|
||||
felhom-backup:backup/vzdump-lxc-9201-2026_10_17-05_07_02.tar.zst tar.zst backup 1334976334 9201
|
||||
felhom-backup:backup/vzdump-lxc-9201-2026_10_18-05_07_32.tar.zst tar.zst backup 1296570428 9201
|
||||
@@ -0,0 +1,32 @@
|
||||
time=2026-10-19T03:49:56.342+02:00 level=INFO msg="audit: gate decision" class=storage_wipe host=demo-hp-bb76ea guest="" source=one_shot_job disposition=customer_confirmable allowed=false reason=pending_confirmation key_id="" nonce="" durab
|
||||
time=2026-10-19T03:49:56.342+02:00 level=INFO msg="gate decision (storage wipe)" role=user-data disposition=customer_confirmable allowed=false reason=pending_confirmation durable_id=byid:wwn-0x3333333000000fa0-part1+fsuuid:ef8fc766-1e12-491
|
||||
time=2026-10-19T03:49:56.342+02:00 level=WARN msg="local-api: user-data data-bearing format refused" vmid=9201 device=/dev/sdb1 durable_id=byid:wwn-0x3333333000000fa0-part1+fsuuid:ef8fc766-1e12-491e-b6f2-31433e1989c8 reason=pending_confirma
|
||||
felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
backup-success-state.json
|
||||
controller-swap-9201.json
|
||||
drive-intents.json
|
||||
escrow-stage
|
||||
felhom-sshd
|
||||
format-job.json
|
||||
guest-binds.json
|
||||
guest-disk-trim.json
|
||||
guests
|
||||
journal.log
|
||||
local-api.crt
|
||||
local-api.key
|
||||
local-tokens.log
|
||||
nonces.log
|
||||
os
|
||||
pbsdr
|
||||
restore-test-state.json
|
||||
selfupdate
|
||||
units
|
||||
wg
|
||||
@@ -0,0 +1,39 @@
|
||||
Mon Oct 19 01:49:49 UTC 2026
|
||||
new test disk: /dev/sdb
|
||||
NAME SIZE MODEL
|
||||
sdb 64M scsi_debug
|
||||
--- the empty partition (the R-1093 input):
|
||||
{
|
||||
"blockdevices": [
|
||||
{
|
||||
"name": "sdb1",
|
||||
"fstype": null,
|
||||
"pttype": "gpt"
|
||||
}
|
||||
]
|
||||
}
|
||||
DEVNAME=/dev/sdb1
|
||||
PART_ENTRY_SCHEME=gpt
|
||||
PART_ENTRY_UUID=aec56a69-b9a0-46de-9c8e-911ca8558717
|
||||
PART_ENTRY_TYPE=0fc63daf-8483-4772-8e79-3d69d8477de4
|
||||
PART_ENTRY_NUMBER=1
|
||||
PART_ENTRY_OFFSET=2048
|
||||
PART_ENTRY_SIZE=126976
|
||||
PART_ENTRY_DISK=8:16
|
||||
blkid rc=0
|
||||
lrwxrwxrwx 1 root root 9 Oct 19 03:49 scsi-33333333000000fa0 -> ../../sdb
|
||||
lrwxrwxrwx 1 root root 10 Oct 19 03:49 scsi-33333333000000fa0-part1 -> ../../sdb1
|
||||
lrwxrwxrwx 1 root root 9 Oct 19 03:49 wwn-0x3333333000000fa0 -> ../../sdb
|
||||
--- POST /disks/format on the EMPTY partition (no confirmation sent):
|
||||
HTTP 200 {"ok":true,"data":{"vmid":9201,"device":"/dev/sdb1","formatted":true,"data_bearing":false,"reason":"blank device formatted ext4","durable_id":"byid:wwn-0x3333333000000fa0-part1","fs_uuid":"ef8fc766-1e12-491e-b6f2-31433e1989c8"}}
|
||||
|
||||
--- the partition now:
|
||||
TYPE=ext4
|
||||
PART_ENTRY_SCHEME=gpt
|
||||
--- CONTROL: the same call again, on the now-ext4 partition:
|
||||
HTTP 403 {"ok":false,"data":{"vmid":9201,"device":"/dev/sdb1","formatted":false,"data_bearing":true,"reason":"device has a ext4 filesystem","role":"user-data","needs_confirmation":true,"durable_id":"byid:wwn-0x3333333000000fa0-part1+fsuuid:ef8fc766-1e12-491e-b6f2-31433e1989c8"},"error":"device is data-bearing — customer confirmation required"}
|
||||
|
||||
--- teardown
|
||||
not mounted
|
||||
scsi_debug removed
|
||||
0
|
||||
@@ -0,0 +1,102 @@
|
||||
[release-agent] building 0.160.0 …
|
||||
[release-agent] built ok: sha256 7ebb547f2b1ab93544ba828d3040351b60c4126327a5b85bbcb33f8f2b3dfca1
|
||||
[release-agent] config bundle built: sha256 6b06090190ff609af1fe9842447ebf385fd52da4be382bc7ca708b558c8e202f
|
||||
[release-agent] tagging v0.160.0 at c11e3e2 …
|
||||
[release-agent] publishing …
|
||||
[publish-agent] publishing /tmp/felhom-agent-YBD0P9 (16071264 bytes, sha256 7ebb547f2b1ab935…) → https://gitea.dooplex.hu/api/packages/admin/generic/felhom-agent/0.160.0/felhom-agent
|
||||
[publish-agent] pre-delete existing artifact: HTTP 404 (404/204 expected)
|
||||
[publish-agent] upload OK (HTTP 201)
|
||||
[publish-agent] round-trip GET verified (sha256 matches)
|
||||
[publish-agent] DONE. Record in the hub operator UI (Configs → Day-0 artifacts): agent 0.160.0 / 7ebb547f2b1ab93544ba828d3040351b6AGENT_VERSION=0.160.0
|
||||
AGENT_SHA256=7ebb547f2b1ab93544ba828d3040351b60c4126327a5b85bbcb33f8f2b3dfca1
|
||||
pre-push [felhom-agent]: running scripts/agent_gates.py --fast ...
|
||||
agent_gates — 4 gate(s) [--fast]
|
||||
--fast SKIPPED (deliberate periodic runs, never in a hook): published, gate-decoys
|
||||
|
||||
==============================================================================
|
||||
== gate: reuse-refs (reuse_refs_check.py /mnt/5_hdd/felhom.eu/git/felhom-agent)
|
||||
==============================================================================
|
||||
note [felhom-agent] line 190: localapi/debuglogs_test.go (resolved by suffix → internal/localapi/debuglogs_test.go)
|
||||
note [felhom-agent] line 206: hub/internal/store/dr_recipe.go (cross-repo → felhom.eu/hub/internal/store/dr_recipe.go)
|
||||
OK [felhom-agent]: 118 cited paths — exact 116, suffix 1, ambiguous 0, cross-repo 1, FAILED 0 (siblings searched: app-catalog-felhom.eu, cc-secrets, felhom-controller, felhom.eu, felhom.eu-media, felhom.eu-sizing-push, felhom.eu-wt-sizing)
|
||||
|
||||
==============================================================================
|
||||
== gate: instructions (instructions_gate.py /mnt/5_hdd/felhom.eu/git/felhom-agent)
|
||||
==============================================================================
|
||||
instructions_gate: /mnt/5_hdd/felhom.eu/git/felhom-agent
|
||||
CLAUDE.md effective lines : 108 (ceiling 200)
|
||||
version literals : 0
|
||||
TEMPORARY blocks : 0
|
||||
rule files : 6 (5 path-scoped)
|
||||
workspace file : SYMLINK -> felhom.eu/documentation/runbooks/workspace-CLAUDE.md (resolves to the versioned copy)
|
||||
memory index : 200 lines (ceiling 200), 25109 bytes (ceiling 25600)
|
||||
memory index content : 28 version literal(s), 3 host address(es), 0 expired statement(s) [WARN only]
|
||||
memory topic files : 183 indexed, 4 orphaned, 41 archived
|
||||
register citations : 6 cited, 1116 register items known
|
||||
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:31: version literal '0.14.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- **[restic 0.14.0 `--verify` is size+mtime, NOT content](restic-0140-verify-and-lock-sema
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:90: version literal '0.142.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- [Offsite continuity](offsite-continuity-2026-07-17.md) — ctrl 0.142.0 orphan guard + hub
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:90: version literal '0.60.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- [Offsite continuity](offsite-continuity-2026-07-17.md) — ctrl 0.142.0 orphan guard + hub
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:97: version literal '0.152.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- **[Hub operator UI: CC uses its token HUB_TOKEN, not the password](hub-operator-ui-basic
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:101: version literal '0.90.1' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- [Agent 0.90.1 is wrapper-only](agent-0901-is-wrapper-only.md) — do NOT publish the binar
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:103: version literal '0.144.0' — the fleet is not uniform, so it is stale within a day. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- [SMB „Megosztás" R-7 slice 1](smb-sharing-r7-slice1-2026-07-18.md) — ctrl 0.144.0 + felh
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md: ... and 22 more version literal(s) — full list from the tally counts above.
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:59: host address '192.168.0.192' — operations/nodes.md is the single home for these. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- [hub.felhom.eu resolves to the LAN here](hub-resolves-to-lan-on-dooplex-network.md) — 19
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:78: host address '167.233.158.164' — operations/nodes.md is the single home for these. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- [Offsite PBS box RAM ceiling](offsite-pbs-box-ram-ceiling-2026-07-27.md) — **root SSH =
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory/MEMORY.md:186: host address '192.168.0.180' — operations/nodes.md is the single home for these. Not a failure: Claude writes this file between sessions, so this warning is aimed at the model that will next edit it, not at whoever is pushing.
|
||||
- **CC runs ON DooPlex** (192.168.0.180) — repos `/mnt/5_hdd/felhom.eu/git/felhom-*`, buil
|
||||
WARNING: /mnt/5_hdd/felhom.eu/git/.claude-memory: 4 top-level topic file(s) are not referenced by MEMORY.md, so nothing will ever read them: f10-demo-hp-offsite-resolved-2026-07-23.md, launcher-v0163-2026-07-24.md, peti-return-p1-stop-2026-07-13.md, stopped-not-fault-v0164-2026-07-24.md
|
||||
|
||||
instructions_gate: OK (11 warning(s))
|
||||
|
||||
==============================================================================
|
||||
== gate: release-complete (check-release-complete.py)
|
||||
==============================================================================
|
||||
check-release-complete — the newest CHANGELOG version is a complete release
|
||||
newest CHANGELOG version: v0.159.2
|
||||
ok tag v0.159.2 -> 65c1994d3b, an ancestor of HEAD
|
||||
ok package 0.159.2 is downloadable
|
||||
|
||||
check-release-complete: v0.159.2 is tagged, placed and published.
|
||||
|
||||
==============================================================================
|
||||
== gate: observations (observations_gate.py /mnt/5_hdd/felhom.eu/git/felhom-agent)
|
||||
==============================================================================
|
||||
observations gate OK — REPORT.md has no observations section (nothing to check)
|
||||
|
||||
==============================================================================
|
||||
== summary
|
||||
==============================================================================
|
||||
reuse-refs OK (exit 0)
|
||||
instructions OK (exit 0)
|
||||
release-complete OK (exit 0c4126327a5b85bbcb33f8f2b3dfca1
|
||||
[release-agent] config bundle published (HTTP 201)
|
||||
[release-agent] pushing v0.160.0 …
|
||||
remote: . Processing 1 references
|
||||
remote: Processed 1 references in total
|
||||
To https://gitea.dooplex.hu0)
|
||||
observations OK (exit 0)
|
||||
|
||||
all agent gates OK
|
||||
pre-push [felhom-agent]: gates OK - push proceeding.
|
||||
|
||||
RELEASED — and installable, verified by download, not by this script's own say-so.
|
||||
|
||||
version : 0.160.0
|
||||
tag : v0.160.0
|
||||
sha256 : 7ebb547f2b1ab93544ba828d3040351b60c4126327a5b85bbcb33f8f2b3dfca1
|
||||
bundle : 6b06090190ff609af1fe9842447ebf385fd52da4be382bc7ca708b558c8e202f (felhom-config-bundle.json — vouch it with the agent)
|
||||
|
||||
NOT VOUCHED. Vouching is what points machines at this version and stays you/admin/felhom-agent.git
|
||||
* [new tag] v0.160.0 -> v0.160.0
|
||||
[release-agent] verifying by independent download …
|
||||
r deliberate act:
|
||||
hub operator UI → Configs → Day-0 artifacts. Until then boxes keep installing the previous one.
|
||||
@@ -0,0 +1,11 @@
|
||||
control (before the window): jobs with run_attempt>1: 17
|
||||
('felhom-controller', 1401, 2, '2026-10-06T00:44:57Z', 'success')
|
||||
('felhom-controller', 1357, 2, '2026-10-05T15:05:37Z', 'success')
|
||||
('felhom-controller', 1549, 2, '2026-10-08T08:26:11Z', 'success')
|
||||
('felhom-controller', 1639, 2, '2026-10-10T13:09:06Z', 'success')
|
||||
('felhom-agent', 1579, 2, '2026-10-09T04:58:15Z', 'success')
|
||||
('app-catalog-felhom.eu', 1368, 2, '2026-10-05T17:15:12Z', 'success')
|
||||
window since 2026-10-12T12:00:00Z : jobs with run_attempt>1: 3
|
||||
('felhom-controller', 1944, 2, '2026-10-16T13:50:35Z', 'success')
|
||||
('felhom-controller', 1959, 2, '2026-10-16T17:07:53Z', 'success')
|
||||
('felhom-controller', 1991, 2, '2026-10-17T09:59:02Z', 'success')
|
||||
@@ -0,0 +1,4 @@
|
||||
felhom.eu 1645 log bytes 38590
|
||||
felhom.eu 1646 log bytes 38503
|
||||
felhom-controller 1639 log bytes 18965
|
||||
felhom.eu 1738 log bytes 46399
|
||||
@@ -0,0 +1,26 @@
|
||||
window since 2026-10-12T12:00:00Z: 381 jobs in 4 repos; not-success 25; with no log (lost) 0
|
||||
not-success ('felhom.eu', 1738, 'c2a6cf7a', 'completed', 'failure', '2026-10-13T04:47:12Z', 1) has log
|
||||
not-success ('felhom.eu', 1747, 'ed59bf3c', 'completed', 'failure', '2026-10-13T17:28:57Z', 1) has log
|
||||
not-success ('felhom.eu', 1796, 'a2ca6eb4', 'completed', 'failure', '2026-10-14T16:51:48Z', 1) has log
|
||||
not-success ('felhom.eu', 1889, '6749118c', 'completed', 'failure', '2026-10-15T19:21:34Z', 1) has log
|
||||
not-success ('felhom.eu', 1993, 'b9c4f73b', 'completed', 'failure', '2026-10-17T10:02:08Z', 1) has log
|
||||
not-success ('felhom.eu', 1997, '498b9139', 'completed', 'failure', '2026-10-17T10:42:11Z', 1) has log
|
||||
not-success ('felhom-controller', 1865, 'e66d4669', 'completed', 'failure', '2026-10-15T16:37:58Z', 1) has log
|
||||
not-success ('felhom-controller', 1867, 'fe0228c8', 'completed', 'failure', '2026-10-15T17:05:00Z', 1) has log
|
||||
not-success ('felhom-controller', 1869, 'db52f5a4', 'completed', 'failure', '2026-10-15T17:27:25Z', 1) has log
|
||||
not-success ('felhom-controller', 1870, '83392064', 'completed', 'failure', '2026-10-15T17:32:48Z', 1) has log
|
||||
not-success ('felhom-controller', 1871, '9cc7ffcf', 'completed', 'failure', '2026-10-15T18:08:11Z', 1) has log
|
||||
not-success ('felhom-controller', 1873, '7f3e58ff', 'completed', 'failure', '2026-10-15T18:30:00Z', 1) has log
|
||||
not-success ('felhom-controller', 1875, '48d86748', 'completed', 'failure', '2026-10-15T18:33:27Z', 1) has log
|
||||
not-success ('felhom-controller', 1876, '006ceab5', 'completed', 'failure', '2026-10-15T18:41:12Z', 1) has log
|
||||
not-success ('felhom-controller', 1877, 'f908eee2', 'completed', 'failure', '2026-10-15T18:45:59Z', 1) has log
|
||||
not-success ('felhom-controller', 1878, '02252556', 'completed', 'failure', '2026-10-15T18:46:27Z', 1) has log
|
||||
not-success ('felhom-controller', 1879, '9e68e526', 'completed', 'failure', '2026-10-15T18:51:46Z', 1) has log
|
||||
not-success ('felhom-controller', 1880, '8c7aa10a', 'completed', 'failure', '2026-10-15T18:52:08Z', 1) has log
|
||||
not-success ('felhom-controller', 1882, 'ec438479', 'completed', 'failure', '2026-10-15T18:57:00Z', 1) has log
|
||||
not-success ('felhom-controller', 1883, 'f9151f08', 'completed', 'failure', '2026-10-15T19:04:54Z', 1) has log
|
||||
not-success ('felhom-controller', 1884, '4261a38b', 'completed', 'failure', '2026-10-15T19:05:47Z', 1) has log
|
||||
not-success ('felhom-controller', 1887, 'c6a56712', 'completed', 'failure', '2026-10-15T19:09:40Z', 1) has log
|
||||
not-success ('felhom-controller', 1990, '334df7db', 'completed', 'failure', '2026-10-17T09:53:24Z', 1) has log
|
||||
not-success ('felhom-controller', 2036, 'e30091bf', 'completed', 'failure', '2026-10-17T15:30:09Z', 1) has log
|
||||
not-success ('app-catalog-felhom.eu', 2067, 'c97eb1c9', 'completed', 'failure', '2026-10-18T18:45:53Z', 1) has log
|
||||
@@ -0,0 +1,16 @@
|
||||
task fields: ['created_at', 'display_title', 'event', 'head_branch', 'head_sha', 'id', 'name', 'run_number', 'run_started_at', 'status', 'updated_at', 'url', 'workflow_id']
|
||||
{'id': 1991, 'name': 'gates', 'head_sha': 'b69585789a9fa34a7c33faf24da44926f166a9da', 'run_number': 393, 'status': 'success', 'event': 'push', 'created_at': '2026-10-16T21:50:09Z', 'run_started_at': '2026-10-16T21:50:09Z', 'updated_at': '2026-10-16T21:50:58Z'}
|
||||
{'id': 1959, 'name': 'gates', 'head_sha': 'f30a80841e372abf9d7992dc9eb3eec607078e90', 'run_number': 379, 'status': 'success', 'event': 'push', 'created_at': '2026-10-16T13:19:24Z', 'run_started_at': '2026-10-16T13:19:24Z', 'updated_at': '2026-10-16T13:20:14Z'}
|
||||
{'id': 1639, 'name': 'gates', 'head_sha': '1cb43a21a2dc5cd44fbcc0749b460dba1ffa8088', 'run_number': 326, 'status': 'success', 'event': 'push', 'created_at': '2026-10-10T07:55:47Z', 'run_started_at': '2026-10-10T07:55:47Z', 'updated_at': '2026-10-10T07:56:52Z'}
|
||||
job 1944 sha c02c9d83 attempt 2 created 2026-10-16T13:50:35Z started 2026-10-16T14:02:29Z completed 2026-10-16T14:03:21Z
|
||||
job 1959 sha 29a3ce8c attempt 2 created 2026-10-16T17:07:53Z started 2026-10-16T17:19:08Z completed 2026-10-16T17:20:00Z
|
||||
job 1991 sha 3e8d0276 attempt 2 created 2026-10-17T09:59:02Z started 2026-10-17T10:15:35Z completed 2026-10-17T10:16:23Z
|
||||
task 2015 for job 1991 success 2026-10-17T10:15:35Z -> 2026-10-17T10:16:24Z
|
||||
task 2011 for job 1991 failure 2026-10-17T09:59:02Z -> 2026-10-17T09:59:49Z
|
||||
task 1980 for job 1959 success 2026-10-16T17:19:08Z -> 2026-10-16T17:20:00Z
|
||||
task 1978 for job 1959 failure 2026-10-16T17:07:54Z -> 2026-10-16T17:08:42Z
|
||||
task 1964 for job 1944 success 2026-10-16T14:02:29Z -> 2026-10-16T14:03:21Z
|
||||
task 1962 for job 1944 failure 2026-10-16T13:50:35Z -> 2026-10-16T13:51:24Z
|
||||
CONTROL job 1639 (a known lost attempt, 2026-10-10) sha 9e5b8814
|
||||
task 1655 success 2026-10-10T13:22:35Z -> 2026-10-10T13:23:51Z
|
||||
task 1653 failure 2026-10-10T13:09:10Z -> 2026-10-10T13:20:58Z
|
||||
@@ -0,0 +1,4 @@
|
||||
## per-customer floors 0.331.0 / MinAgent 0.158.1 — 20:44:00
|
||||
tester-1: HTTP/1.1 303 See Other Location: /customers/tester-1?flash=floor_set
|
||||
demo-hp: HTTP/1.1 303 See Other Location: /customers/demo-hp?flash=floor_set
|
||||
demo-felhom: HTTP/1.1 303 See Other Location: /customers/demo-felhom?flash=floor_set
|
||||
@@ -0,0 +1,6 @@
|
||||
demo-felhom|2026-10-18 20:44:04|0.330.0
|
||||
demo-felhom|2026-10-18 20:44:16|0.331.0
|
||||
demo-hp|2026-10-18 20:44:04|0.330.0
|
||||
demo-hp|2026-10-18 20:44:19|0.331.0
|
||||
tester-1|2026-10-18 20:44:03|0.330.0
|
||||
tester-1|2026-10-18 20:44:18|0.331.0
|
||||
@@ -0,0 +1,52 @@
|
||||
=== demo-hp (enkisfelhom.hu) 20:45:54
|
||||
containers: 24 running; not healthy/running: traefik Up 2 days;
|
||||
unhealthy: 0
|
||||
2026/10/18 20:44:12 updater.go:855: [INFO] [selfupdate] Post-update startup: update successful (0.330.0 → 0.331.0)
|
||||
allow-list refusals since start: 0
|
||||
2026/10/18 20:44:13 sync.go:142: [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
|
||||
installed apps (stacks with app.yaml): 12
|
||||
2026/10/18 20:44:14 handlers.go:3887: [INFO] [web] FileBrowser mounts synced (recreated) — 1 storage path(s), config updated
|
||||
2026/10/18 20:44:19 filebrowser_gate.go:94: [INFO] [infra] filebrowser: default login refused for this run — joined traefik-public, files.<domain> s
|
||||
public https://felhom.enkisfelhom.hu/login: 000
|
||||
public https://files.enkisfelhom.hu/: 200
|
||||
=== demo-felhom (demo-felhom.eu) 20:46:13
|
||||
containers: 9 running; not healthy/running: traefik Up 2 days;
|
||||
unhealthy: 0
|
||||
2026/10/18 20:44:02 [INFO] [selfupdate] Post-update startup: update successful (0.330.0 → 0.331.0)
|
||||
allow-list refusals since start: 0
|
||||
2026/10/18 20:44:02 [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
|
||||
installed apps (stacks with app.yaml): 5
|
||||
2026/10/18 20:44:03 [INFO] [web] FileBrowser mounts synced (recreated) — 1 storage path(s), config updated
|
||||
2026/10/18 20:44:09 [INFO] [infra] filebrowser: default login refused for this run — joined traefik-public, files.<domain> served (R-1126)
|
||||
public https://felhom.demo-felhom.eu/login: 200
|
||||
public https://files.demo-felhom.eu/: 200
|
||||
=== tester-1 (enkicsifelhom.hu) 20:46:16
|
||||
containers: 10 running; not healthy/running: traefik Up 2 days;
|
||||
unhealthy: 0
|
||||
2026/10/18 20:44:11 [INFO] [selfupdate] Post-update startup: update successful (0.330.0 → 0.331.0)
|
||||
allow-list refusals since start: 0
|
||||
2026/10/18 20:44:12 [INFO] [sync] Initial sync: Sablonok naprakészek — nincs változás
|
||||
installed apps (stacks with app.yaml): 3
|
||||
2026/10/18 20:44:13 [INFO] [web] FileBrowser mounts synced (recreated) — 5 storage path(s), config updated
|
||||
2026/10/18 20:44:18 [INFO] [infra] filebrowser: default login refused for this run — joined traefik-public, files.<domain> served (R-1126)
|
||||
public https://felhom.enkicsifelhom.hu/login: 200
|
||||
public https://files.enkicsifelhom.hu/: 000
|
||||
## retries 20:47:49
|
||||
20:47:49 https://felhom.enkisfelhom.hu/login: 200 0.156759s
|
||||
20:47:49 https://files.enkisfelhom.hu/: 200 0.151312s
|
||||
20:47:49 https://felhom.enkicsifelhom.hu/login: 200 0.154273s
|
||||
20:47:49 https://files.enkicsifelhom.hu/: 200 0.186791s
|
||||
20:47:50 https://felhom.demo-felhom.eu/login: 200 0.129644s
|
||||
20:47:50 https://files.demo-felhom.eu/: 200 0.148989s
|
||||
20:48:00 https://felhom.enkisfelhom.hu/login: 200 0.138598s
|
||||
20:48:00 https://files.enkisfelhom.hu/: 200 0.137951s
|
||||
20:48:00 https://felhom.enkicsifelhom.hu/login: 200 0.168040s
|
||||
20:48:00 https://files.enkicsifelhom.hu/: 200 0.160295s
|
||||
20:48:01 https://felhom.demo-felhom.eu/login: 200 0.172388s
|
||||
20:48:01 https://files.demo-felhom.eu/: 200 0.177437s
|
||||
20:48:11 https://felhom.enkisfelhom.hu/login: 200 0.151194s
|
||||
20:48:11 https://files.enkisfelhom.hu/: 200 0.166961s
|
||||
20:48:11 https://felhom.enkicsifelhom.hu/login: 200 0.130657s
|
||||
20:48:11 https://files.enkicsifelhom.hu/: 200 0.139520s
|
||||
20:48:12 https://felhom.demo-felhom.eu/login: 200 0.166568s
|
||||
20:48:12 https://files.demo-felhom.eu/: 200 0.148200s
|
||||
@@ -0,0 +1,33 @@
|
||||
control NEGATIVE (a stub answering 200 over plain http): convicted, as it must (200 -)
|
||||
== tester-1 (enkicsifelhom.hu): 6 public name(s)
|
||||
OK control POSITIVE http://felhom.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://files.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://files.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://paperless.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paperless.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://paste.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://paste.enkicsifelhom.hu/r1033-check?q=1
|
||||
OK http://wiki.enkicsifelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkicsifelhom.hu/r1033-check?q=1
|
||||
== demo-hp (enkisfelhom.hu): 14 public name(s)
|
||||
OK http://arcade.enkisfelhom.hu/r1033-check?q=1 -> 301 https://arcade.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://books.enkisfelhom.hu/r1033-check?q=1 -> 301 https://books.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://docs.enkisfelhom.hu/r1033-check?q=1 -> 301 https://docs.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://felhom.enkisfelhom.hu/r1033-check?q=1 -> 301 https://felhom.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://files.enkisfelhom.hu/r1033-check?q=1 -> 301 https://files.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://gist.enkisfelhom.hu/r1033-check?q=1 -> 301 https://gist.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://ha.enkisfelhom.hu/r1033-check?q=1 -> 301 https://ha.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1 -> 301 https://no-such-name-r1033.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://papir.enkisfelhom.hu/r1033-check?q=1 -> 301 https://papir.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://paste.enkisfelhom.hu/r1033-check?q=1 -> 301 https://paste.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://pdf.enkisfelhom.hu/r1033-check?q=1 -> 301 https://pdf.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://plex.enkisfelhom.hu/r1033-check?q=1 -> 301 https://plex.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://travel.enkisfelhom.hu/r1033-check?q=1 -> 301 https://travel.enkisfelhom.hu/r1033-check?q=1
|
||||
OK http://wiki.enkisfelhom.hu/r1033-check?q=1 -> 301 https://wiki.enkisfelhom.hu/r1033-check?q=1
|
||||
== demo-felhom (demo-felhom.eu): 8 public name(s)
|
||||
OK http://felhom.demo-felhom.eu/r1033-check?q=1 -> 301 https://felhom.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://files.demo-felhom.eu/r1033-check?q=1 -> 301 https://files.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://gist.demo-felhom.eu/r1033-check?q=1 -> 301 https://gist.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1 -> 301 https://no-such-name-r1033.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://prowlarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://prowlarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://radarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://radarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://sonarr.demo-felhom.eu/r1033-check?q=1 -> 301 https://sonarr.demo-felhom.eu/r1033-check?q=1
|
||||
OK http://torrent.demo-felhom.eu/r1033-check?q=1 -> 301 https://torrent.demo-felhom.eu/r1033-check?q=1
|
||||
== every public name redirects http -> https
|
||||
@@ -0,0 +1,15 @@
|
||||
## global floor 20:48:56
|
||||
HTTP/1.1 303 See Other Location: /configuration?flash=floor_set
|
||||
## read back (hub.db + -wal + -shm in one tar)
|
||||
min_controller_version|0.331.0
|
||||
min_controller_version_declared_min_agent|0.331.0=0.158.1
|
||||
## clear the per-customer floors 20:49:09
|
||||
tester-1: HTTP/1.1 303 See Other Location: /customers/tester-1?flash=floor_set
|
||||
demo-hp: HTTP/1.1 303 See Other Location: /customers/demo-hp?flash=floor_set
|
||||
demo-felhom: HTTP/1.1 303 See Other Location: /customers/demo-felhom?flash=floor_set
|
||||
, status TEXT NOT NULL DEFAULT 'active', min_controller_version TEXT NOT NULL DEFAULT '', config_version INTEGER NOT NULL DEFAULT 1, dr_tier INTEGER NOT NULL DEFAULT 0, min_controller_declared_min_agent TEXT NOT NULL DEFAULT '', language TEXT NOT NULL DEFAULT 'hu', min_controller_set_at TEXT NOT NULL DEFAULT '', api_key_hash TEXT NOT NULL DEFAULT '');
|
||||
demo-felhom|[]|[]
|
||||
demo-hp|[]|[]
|
||||
tester-1|[]|[]
|
||||
Tester-2|[]|[]
|
||||
Tester4|[]|[]
|
||||
@@ -0,0 +1,2 @@
|
||||
0.322.0: 310 snapshots restic=restic 0.14.0
|
||||
0.331.0: 310 snapshots restic=restic 0.19.1
|
||||
@@ -0,0 +1,12 @@
|
||||
iso=/var/lib/vz/template/iso/felhom-installer-1.29.0-pve9.2-1.iso sha256=dceacae5da247d76
|
||||
Formatting '/mnt/hdd_1/images/9302/vm-9302-disk-0.raw', fmt=raw size=128849018880 preallocation=off
|
||||
scsi0: successfully created disk 'nvme-scratch:9302/vm-9302-disk-0.raw,size=120G'
|
||||
update VM 9302: -boot order=scsi0;ide2
|
||||
boot: order=scsi0;ide2
|
||||
cores: 4
|
||||
ide2: local:iso/felhom-installer-1.29.0-pve9.2-1.iso,media=cdrom,size=1665356K
|
||||
memory: 8192
|
||||
name: newbox-r1148
|
||||
net0: virtio=BC:24:11:0F:7C:57,bridge=vmbr0
|
||||
scsi0: nvme-scratch:9302/vm-9302-disk-0.raw,size=120G
|
||||
19:43:15
|
||||
@@ -0,0 +1,22 @@
|
||||
install pressed 19:50:19 CEST
|
||||
bind posted 20:02:58 CEST
|
||||
--- read from the hub DB (copied with its WAL), the box's journal, and the box's own /api/selfupdate/status (all UTC) ---
|
||||
17:42:21 hub: customer Tester4 created by the operator; the bind mail sent at once (Gmail catch-all)
|
||||
17:43:15 VM 9302 created on demo-hp (8 GB / 4 cores / 120 GB on nvme-scratch at /mnt/hdd_1 root); ISO 1.29.0 (sha256 dceacae5… = published)
|
||||
17:50:19 Install pressed (graphical installer, Hungarian layout kept, driven by qm sendkey; screens/)
|
||||
~18:02 console: pairing code shown (screens/13-now.png)
|
||||
18:02:58 bind through the mailed link + pairing code + owner phrase: „Sikeres összekötés" (03-bind.txt)
|
||||
18:03:13 setup-code mail
|
||||
18:03:42 hub: host Tester4-31fa0e created
|
||||
18:03:43 step 4b/8: „recovery password vaulted at the hub (stored) — now setting it on root@pam"; chpasswd; „[OK] root@pam password vaulted, set, and the PVE login takes it"
|
||||
18:03:43 hub: host_recovery.set_at for Tester4-31fa0e (the same second)
|
||||
18:03:44 step 5/8: manifest agent v0.159.2 (sha 4d98868e…), golden v0.329.0; agent sha256 verified = hub manifest; bundle 477704ea… verified
|
||||
18:04:02 first host report: agent 0.159.2
|
||||
18:05:37 first controller report: 0.329.0 (the vouched golden)
|
||||
18:05:38 the box's own record: update 0.329.0 -> 0.330.0 initiated_by „auto-floor"; completed 18:05:45
|
||||
18:05:51 controller report: 0.330.0
|
||||
18:05:54 „Day-0 provision SUCCESS — vmid=9201 host_id=Tester4-31fa0e customer=Tester4"
|
||||
18:17:14 CC's own PVE login from DooPlex: vaulted value 200; the installer's typed value 401 (04-pve-login-check.txt)
|
||||
18:18:32 dashboard claimed with the mailed setup code (302 /)
|
||||
18:19:25 BentoPDF deploy 202; 18:20:05 running, container healthy (07-first-app.txt)
|
||||
=> Install pressed to the floor: 15 min 26 s. Bind to the floor: 2 min 47 s. Nobody pressed an update.
|
||||
@@ -0,0 +1 @@
|
||||
Felhom — Doboz összekötése Felhom doboz összekötése Sikeres összekötés. A doboz kb. egy percen belül folytatja a telepítést. Ezt az oldalt bezárhatod — a beállítás a háttérben befejeződik, és a vezérlőpultod hamarosan elérhető lesz. Felhom.eu
|
||||
@@ -0,0 +1,2 @@
|
||||
18:17:14 PVE login with the VAULTED value: HTTP 200
|
||||
18:17:17 PVE login with the INSTALLER value (typed at install): HTTP 401
|
||||
@@ -0,0 +1,7 @@
|
||||
GET /claim 200
|
||||
csrf_len 64
|
||||
HTTP/1.1 302 Found
|
||||
Location: /
|
||||
18:18:32
|
||||
{"ok":true,"data":{"running":false,"last_check":{"current_version":"0.330.0","latest_version":"0.330.0","update_available":false,"checked_at":"2026-10-18T18:06:16Z"},"last_state":{"status":"success","previous_version":"0.329.0","previous_image":"gitea.dooplex.hu/admin/felhom-controller:0.329.0","target_version":"0.330.0","target_image":"gitea.dooplex.hu/admin/felhom-controller:0.330.0","initiated_at":"2026-10-18T18:05:38Z","initiated_by":"auto-floor","completed_at":"2026-10-18T18:05:45Z"}}}
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
{"ok":false,"error":"dashboard not yet claimed"}
|
||||
@@ -0,0 +1,8 @@
|
||||
login 302
|
||||
csrf_len 64
|
||||
{"ok":true,"data":{"app_config":null,"domain":"tester4.test","logo_url":"/static/assets/bentopdf-logo.svg","metadata":{"display_name":"BentoPDF","description":"Adatvédelmi fókuszú PDF eszköztár","category":"tools","subdomain":"pdf","slug":"bentopdf","catalog_since":"2026-07-12","resources":{"me
|
||||
{"ok":true,"message":"Telepítés elindítva – az állapot a kártyán követhető"}
|
||||
deploy 202
|
||||
18:19:25
|
||||
18:20:05 "state":"running" "deployed":true "state":"running" "deployed":true
|
||||
bentopdf ghcr.io/alam00000/bentopdf:v2.8.6 Up 20 seconds (healthy)
|
||||
@@ -0,0 +1,255 @@
|
||||
2026-10-18T19:53:32+02:00 tester4 systemd[1]: Starting felhom-bootstrap.service - Felhom host bootstrap (fetch + run felhom-host-install.sh unattended, retry until success)...
|
||||
2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: console: pvebanner.service masked (it would rewrite /etc/issue with the Proxmox admin URL on every boot)
|
||||
2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: console: /etc/issue is the Felhom text (no admin URL)
|
||||
2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: PAIRING mode (generic ISO, no baked customer/passphrase) — hub=https://hub.felhom.eu
|
||||
2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: registering unclaimed appliance at the hub
|
||||
2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: registered — appliance token stored (0600); waiting for the operator or a customer self-bind
|
||||
2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: console font -> Lat2-Terminus16 (Latin-2, ő/ű capable)
|
||||
2026-10-18T19:53:33+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: not bound yet — polling every 30s until the operator or a customer self-bind lands (this is the normal waiting state, not an error)
|
||||
2026-10-18T20:03:04+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: bind DELIVERED — writing credentials to the env and switching to direct install
|
||||
2026-10-18T20:03:04+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: fetching host-install: https://felhom.eu/scripts/felhom-host-install.sh
|
||||
2026-10-18T20:03:05+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: running host-install (customer=Tester4 mode=appliance hub=https://hub.felhom.eu)
|
||||
2026-10-18T20:03:05+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] auto-sized guest RAM: 4096 MiB (host 7939 MiB; clamp(host-4096, min 4096, max host-2048), ceiling host-1024)
|
||||
2026-10-18T20:03:05+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] auto-sized guest cores: 3 (host 4 cores; host-1, min 2)
|
||||
2026-10-18T20:03:05+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] felhom-host-install v1.34.0 — mode=appliance customer=Tester4 vmid=9201
|
||||
2026-10-18T20:03:05+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 1/8 pre-flight
|
||||
2026-10-18T20:03:06+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve)
|
||||
2026-10-18T20:03:07+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] node: tester4 (auto)
|
||||
2026-10-18T20:03:07+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] agent config: /etc/felhom-agent/agent.json
|
||||
2026-10-18T20:03:07+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] agent: not installed yet — will be fetched + installed in step 5/8
|
||||
2026-10-18T20:03:07+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] local-lvm free: ~54 GiB
|
||||
2026-10-18T20:03:07+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN] local-lvm free ~54 GiB is below the recommended 120 GiB — the install continues; proceed only if you sized the grows deliberately
|
||||
2026-10-18T20:03:07+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] free RAM: ~6371 MiB
|
||||
2026-10-18T20:03:09+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] existing guests on this host: 0 (pct+qm)
|
||||
2026-10-18T20:03:09+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] archive storage 'local' present
|
||||
2026-10-18T20:03:11+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] acl storage 'felhom-pbs' not present yet — expected: the PBS-DR tier creates it; the grant is pre-positioned deliberately
|
||||
2026-10-18T20:03:11+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] dnsmasq: not present before Felhom — recorded; uninstall will remove it again if we install it
|
||||
2026-10-18T20:03:12+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] hub reachable (https://hub.felhom.eu)
|
||||
2026-10-18T20:03:12+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] customer 'Tester4' exists + passphrase valid
|
||||
2026-10-18T20:03:13+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] golden: none local — will fetch + verify from Gitea in step 7/8
|
||||
2026-10-18T20:03:15+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] pre-flight passed
|
||||
2026-10-18T20:03:15+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 2/8 Proxmox API token
|
||||
2026-10-18T20:03:19+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] token minted (secret captured, not logged)
|
||||
2026-10-18T20:03:41+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] scoped ACL applied (Base@/, Guest@/pool/felhom + /vms/990000..990009, Store@[local local-lvm felhom-pbs])
|
||||
2026-10-18T20:03:42+02:00 tester4 felhom-bootstrap.sh[3647]: [SKIP] old broad role FelhomAgent already absent
|
||||
2026-10-18T20:03:42+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 3/8 compute volume grows
|
||||
2026-10-18T20:03:42+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] auto-computed from a 54 GiB thin pool (16 §7: 50/100/130 GiB)
|
||||
2026-10-18T20:03:42+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] grows: rootfs +0G (->32G), data +26G (->50G, ONE volume)
|
||||
2026-10-18T20:03:42+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 4/8 host enrollment (POST /host-enroll)
|
||||
2026-10-18T20:03:42+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] host MINTED (first enroll)
|
||||
2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] host_id: Tester4-31fa0e (api_key captured, not logged)
|
||||
2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 4b/8 break-glass credential (root@pam console password → hub vault)
|
||||
2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] recovery password vaulted at the hub (stored) — now setting it on root@pam
|
||||
2026-10-18T20:03:43+02:00 tester4 chpasswd[3936]: pam_unix(chpasswd:chauthtok): password changed for root
|
||||
2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] root@pam password vaulted, set, and the PVE login takes it (retrieve via the operator /admin path; never logged here)
|
||||
2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN] NOTE: the root@pam password just CHANGED — the old one now fails at the PVE web GUI (:8006).
|
||||
2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN] Retrieve the new one at hub → host page (vaulted recovery credential).
|
||||
2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 5/8 agent install (fetch + verify + install)
|
||||
2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] disabled pve-enterprise.sources (Enabled: no)
|
||||
2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] disabled ceph.sources (Enabled: no)
|
||||
2026-10-18T20:03:43+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] added pve-no-subscription.sources (suite=trixie)
|
||||
2026-10-18T20:03:44+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] apt repos aligned to no-subscription (changed; apt-get update OK)
|
||||
2026-10-18T20:03:44+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN] no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged)
|
||||
2026-10-18T20:03:44+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] manifest: agent v0.159.2 (sha 4d98868e922d6c10…), golden v0.329.0
|
||||
2026-10-18T20:03:44+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] fetching agent binary v0.159.2 from Gitea …
|
||||
2026-10-18T20:03:45+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] verified sha256 4d98868e922d6c10… matches the hub manifest
|
||||
2026-10-18T20:03:45+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] installed /usr/local/bin/felhom-agent (felhom-agent 0.159.2)
|
||||
2026-10-18T20:03:45+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] installing the 'sudo' package (required for the non-root agent model) …
|
||||
2026-10-18T20:03:48+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] sudo installed (Sudo version 1.9.16p2)
|
||||
2026-10-18T20:03:48+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] installing the 'age' package (escrow ceremony identity-wrap dependency) …
|
||||
2026-10-18T20:03:51+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] age installed (1.2.1)
|
||||
2026-10-18T20:03:51+02:00 tester4 useradd[4161]: new group: name=felhom-agent, GID=990
|
||||
2026-10-18T20:03:51+02:00 tester4 useradd[4161]: new user: name=felhom-agent, UID=999, GID=990, home=/home/felhom-agent, shell=/usr/sbin/nologin, from=none
|
||||
2026-10-18T20:03:51+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] created service user felhom-agent
|
||||
2026-10-18T20:03:51+02:00 tester4 usermod[4169]: add 'felhom-agent' to group 'systemd-journal'
|
||||
2026-10-18T20:03:51+02:00 tester4 usermod[4169]: add 'felhom-agent' to shadow group 'systemd-journal'
|
||||
2026-10-18T20:03:51+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] added felhom-agent to systemd-journal (unprivileged journal read for NAS verify)
|
||||
2026-10-18T20:03:53+02:00 tester4 useradd[4209]: new group: name=felhom-op, GID=1000
|
||||
2026-10-18T20:03:53+02:00 tester4 useradd[4209]: new user: name=felhom-op, UID=1000, GID=1000, home=/home/felhom-op, shell=/bin/bash, from=none
|
||||
2026-10-18T20:03:53+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] verified sha256 477704ea29809484… matches the hub manifest
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4246]: os-apply: BUNDLE START agent=0.159.2 sha=477704ea29809484 authority=installer files=31 write=30 same=1 kept=0 skipped=0
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4248]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-selfupdate-guarded (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4249]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-pbs-apply (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4250]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-backup-target-apply (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4251]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-vzdump-partial-clean (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4252]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-thin-check (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4253]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-internal-place (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4254]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-crash-guard (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4255]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-priv-apply (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4256]: os-apply: BUNDLE WROTE /var/lib/vz/snippets/felhom-guest-hook.sh (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4257]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-shared-parent.sh (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4258]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-shared-parent.service (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4259]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard.service (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4260]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.service (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4261]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.timer (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4262]: os-apply: BUNDLE WROTE /etc/felhom/crash-guard.conf (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4263]: os-apply: BUNDLE WROTE /etc/grub.d/01_felhom_oneshot (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4264]: os-apply: BUNDLE WROTE /etc/grub.d/42_felhom_oneshot (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4265]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4266]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent-rollback.service (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4267]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service.d/felhom-agent-limits.conf (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4268]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mgmt-watchdog (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4269]: os-apply: BUNDLE WROTE /etc/tmpfiles.d/felhom-privsep.conf (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4270]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.service (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4271]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.timer (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4272]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-sshd.service (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4273]: os-apply: BUNDLE WROTE /etc/felhom-oob.nft (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4274]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-oob-nft.service (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4275]: os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-op (new)
|
||||
2026-10-18T20:03:54+02:00 tester4 felhom-os-apply[4276]: os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-agent (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-os-apply[4395]: os-apply: BUNDLE DONE agent=0.159.2 written=30 same=1 self-check=ok signers-created=False
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE START agent=0.159.2 sha=477704ea29809484 authority=installer files=31 write=30 same=1 kept=0 skipped=0
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mkfs-guarded (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-selfupdate-guarded (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-pbs-apply (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-backup-target-apply (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-vzdump-partial-clean (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-thin-check (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-internal-place (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-crash-guard (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-priv-apply (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /var/lib/vz/snippets/felhom-guest-hook.sh (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-shared-parent.sh (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-shared-parent.service (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard.service (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.service (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.timer (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/felhom/crash-guard.conf (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/grub.d/01_felhom_oneshot (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/grub.d/42_felhom_oneshot (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent-rollback.service (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service.d/felhom-agent-limits.conf (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mgmt-watchdog (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/tmpfiles.d/felhom-privsep.conf (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.service (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.timer (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-sshd.service (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/felhom-oob.nft (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/systemd/system/felhom-oob-nft.service (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-op (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-agent (new)
|
||||
2026-10-18T20:03:55+02:00 tester4 felhom-bootstrap.sh[4398]: os-apply: BUNDLE DONE agent=0.159.2 written=30 same=1 self-check=ok signers-created=False
|
||||
2026-10-18T20:03:56+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] installed every root-owned file from config bundle v0.159.2 (sha 477704ea29809484…; checked, previous copies kept)
|
||||
2026-10-18T20:03:56+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] OOB felhom-sshd instance + static belt from the bundle (agent renders config + fills sets once oob.enabled)
|
||||
2026-10-18T20:03:56+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 5b/8 internal data place (Belső tárhely)
|
||||
2026-10-18T20:03:58+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] no internal place: only -44 GiB free for it (pool 54, reserve 16, promised 0, planned 82; needs 20)
|
||||
2026-10-18T20:03:58+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 6/8 agent config + service
|
||||
2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN] backup target: DEGRADED — no eligible second drive, so the whole-system backup stays on the SYSTEM drive.
|
||||
2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN] It protects against file corruption but NOT against a disk failure. Attach a second drive and assign it in the dashboard.
|
||||
2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] creating island bridge vmbr9 (portless, 169.254.253.1/30)
|
||||
2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] vmbr9 up: 169.254.253.1/30
|
||||
2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] R-50 island ON: local_api=169.254.253.1:8443 (vmbr9); guest net1=169.254.253.2/30; lan_resolver.host_ip=192.168.0.109
|
||||
2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] node=tester4 local_api=169.254.253.1:8443 tls_fp=25:C4:B3:61:78:4A…
|
||||
2026-10-18T20:03:59+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] wrote /etc/felhom-agent/agent.json (0600 felhom-agent)
|
||||
2026-10-18T20:04:00+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] agent --selftest (read-only) passed
|
||||
2026-10-18T20:04:03+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] felhom-agent service active (non-root felhom-agent reads the config OK)
|
||||
2026-10-18T20:04:03+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] wrote /etc/felhom/os-trust.json + operator-signers (felhom-op-1) — the root-owned slow-lane anchors
|
||||
2026-10-18T20:04:03+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 7/8 golden archive
|
||||
2026-10-18T20:04:03+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN] no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged)
|
||||
2026-10-18T20:04:04+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] fetching golden v0.329.0 from Gitea → /var/lib/vz/dump/vzdump-lxc-9100-2026_10_18-20_04_04.tar.zst
|
||||
2026-10-18T20:04:15+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] verified sha256 58dc40df555676d8… matches the hub manifest
|
||||
2026-10-18T20:04:16+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] golden imported + verified: local:backup/vzdump-lxc-9100-2026_10_18-20_04_04.tar.zst
|
||||
2026-10-18T20:04:16+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] 8/8 provision guest 9201
|
||||
2026-10-18T20:04:17+02:00 tester4 felhom-bootstrap.sh[3647]: [SKIP] pool felhom already exists
|
||||
2026-10-18T20:04:17+02:00 tester4 felhom-bootstrap.sh[5665]: === felhom-agent 0.159.2 selftest=provision (vmid=9201 customer=Tester4 hostname=tester4) ===
|
||||
2026-10-18T20:04:17+02:00 tester4 felhom-bootstrap.sh[5665]: --- front half: bring-up (provision) local:backup/vzdump-lxc-9100-2026_10_18-20_04_04.tar.zst → vmid 9201 ---
|
||||
2026-10-18T20:05:11+02:00 tester4 felhom-bootstrap.sh[5665]: time=2026-10-18T20:05:11.381+02:00 level=INFO msg="bring-up: pool membership re-asserted" vmid=9201 pool=felhom
|
||||
2026-10-18T20:05:11+02:00 tester4 felhom-bootstrap.sh[5665]: [OK] front half: vmid 9201 up (boot+running) in 54s; MAC=BC:24:11:13:D8:4F
|
||||
2026-10-18T20:05:11+02:00 tester4 felhom-bootstrap.sh[5665]: --- back half: mint per-guest token + populate bootstrap config mount ---
|
||||
2026-10-18T20:05:11+02:00 tester4 sudo[6764]: root : PWD=/ ; USER=root ; COMMAND=/usr/bin/chown --reference=/var/lib/felhom-agent /var/lib/felhom-agent/guests /var/lib/felhom-agent/guests/9201
|
||||
2026-10-18T20:05:11+02:00 tester4 sudo[6764]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
|
||||
2026-10-18T20:05:11+02:00 tester4 sudo[6764]: pam_unix(sudo:session): session closed for user root
|
||||
2026-10-18T20:05:11+02:00 tester4 sudo[6767]: root : PWD=/ ; USER=root ; COMMAND=/usr/bin/chown -R 100000:100000 /var/lib/felhom-agent/guests/9201/bootstrap
|
||||
2026-10-18T20:05:11+02:00 tester4 sudo[6767]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
|
||||
2026-10-18T20:05:11+02:00 tester4 sudo[6767]: pam_unix(sudo:session): session closed for user root
|
||||
2026-10-18T20:05:11+02:00 tester4 sudo[6770]: root : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct set 9201 -mp9 /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1
|
||||
2026-10-18T20:05:11+02:00 tester4 sudo[6770]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
|
||||
2026-10-18T20:05:12+02:00 tester4 sudo[6770]: pam_unix(sudo:session): session closed for user root
|
||||
2026-10-18T20:05:12+02:00 tester4 sudo[6851]: root : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct set 9201 -onboot 1
|
||||
2026-10-18T20:05:12+02:00 tester4 sudo[6851]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
|
||||
2026-10-18T20:05:13+02:00 tester4 sudo[6851]: pam_unix(sudo:session): session closed for user root
|
||||
2026-10-18T20:05:13+02:00 tester4 sudo[7056]: root : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct set 9201 --hookscript local:snippets/felhom-guest-hook.sh
|
||||
2026-10-18T20:05:13+02:00 tester4 sudo[7056]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
|
||||
2026-10-18T20:05:14+02:00 tester4 sudo[7056]: pam_unix(sudo:session): session closed for user root
|
||||
2026-10-18T20:05:14+02:00 tester4 sudo[7479]: root : PWD=/ ; USER=root ; COMMAND=/usr/bin/mkdir -p /mnt/felhom-drives
|
||||
2026-10-18T20:05:14+02:00 tester4 sudo[7479]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
|
||||
2026-10-18T20:05:14+02:00 tester4 sudo[7479]: pam_unix(sudo:session): session closed for user root
|
||||
2026-10-18T20:05:14+02:00 tester4 sudo[7485]: root : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct set 9201 -mp8 /mnt/felhom-drives,mp=/mnt/felhom-drives
|
||||
2026-10-18T20:05:14+02:00 tester4 sudo[7485]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
|
||||
2026-10-18T20:05:15+02:00 tester4 sudo[7485]: pam_unix(sudo:session): session closed for user root
|
||||
2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[5665]: time=2026-10-18T20:05:15.845+02:00 level=INFO msg="provision: back-half complete" vmid=9201 mount=mp9 guest_path=/etc/felhom-bootstrap endpoint=169.254.253.1:8443
|
||||
2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[5665]: [OK] back half: bootstrap mount mp9 → /etc/felhom-bootstrap on vmid 9201 (host dir /var/lib/felhom-agent/guests/9201/bootstrap)
|
||||
2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[5665]: local-api endpoint 169.254.253.1:8443 · leaf fp 7df7cb57504e66d1a1c688fd6d54e4c6c0a1970781c6ac65d2198a1b6e448f22 · token: minted (not printed)
|
||||
2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[5665]: === selftest=provision OK — guest 9201 provisioned + bootstrap-mounted (KEPT) ===
|
||||
2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[5665]: next: reboot the guest → the golden's baked controller-bootstrap unit deploys the controller,
|
||||
2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[5665]: which PULLS its controller.yaml from the hub (retrieval passphrase) and merges in this local_api.
|
||||
2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] provision completed
|
||||
2026-10-18T20:05:15+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] rebooting guest 9201 so the baked controller-bootstrap unit picks up the mount
|
||||
2026-10-18T20:05:16+02:00 tester4 pct[7627]: <root@pam> starting task UPID:tester4:00001DDF:00011AB9:6AD50A5C:vzreboot:9201:root@pam:
|
||||
2026-10-18T20:05:16+02:00 tester4 pct[7647]: requesting reboot of CT 9201: UPID:tester4:00001DDF:00011AB9:6AD50A5C:vzreboot:9201:root@pam:
|
||||
2026-10-18T20:05:27+02:00 tester4 pct[7627]: <root@pam> end task UPID:tester4:00001DDF:00011AB9:6AD50A5C:vzreboot:9201:root@pam: OK
|
||||
2026-10-18T20:05:27+02:00 tester4 felhom-bootstrap.sh[3647]: [STEP] verify
|
||||
2026-10-18T20:05:28+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] pct status: running
|
||||
2026-10-18T20:05:29+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] onboot: 1
|
||||
2026-10-18T20:05:30+02:00 tester4 felhom-bootstrap.sh[8525]: mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/felhom,backup=1,size=50G
|
||||
2026-10-18T20:05:30+02:00 tester4 felhom-bootstrap.sh[8525]: mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives
|
||||
2026-10-18T20:05:30+02:00 tester4 felhom-bootstrap.sh[8525]: rootfs: local-lvm:vm-9201-disk-0,size=32G
|
||||
2026-10-18T20:05:32+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] pool: guest 9201 is a member of felhom
|
||||
2026-10-18T20:05:33+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentBase@/ present (user+token)
|
||||
2026-10-18T20:05:34+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentGuest@/pool/felhom present (user+token)
|
||||
2026-10-18T20:05:36+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentStore@/storage/local present (user+token)
|
||||
2026-10-18T20:05:37+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentStore@/storage/local-lvm present (user+token)
|
||||
2026-10-18T20:05:38+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentStore@/storage/felhom-pbs present (user+token)
|
||||
2026-10-18T20:05:40+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentGuest@/vms/990000 present (user+token)
|
||||
2026-10-18T20:05:41+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentGuest@/vms/990001 present (user+token)
|
||||
2026-10-18T20:05:42+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentGuest@/vms/990002 present (user+token)
|
||||
2026-10-18T20:05:43+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentGuest@/vms/990003 present (user+token)
|
||||
2026-10-18T20:05:45+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentGuest@/vms/990004 present (user+token)
|
||||
2026-10-18T20:05:46+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentGuest@/vms/990005 present (user+token)
|
||||
2026-10-18T20:05:47+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentGuest@/vms/990006 present (user+token)
|
||||
2026-10-18T20:05:48+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentGuest@/vms/990007 present (user+token)
|
||||
2026-10-18T20:05:49+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentGuest@/vms/990008 present (user+token)
|
||||
2026-10-18T20:05:51+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] acl: FelhomAgentGuest@/vms/990009 present (user+token)
|
||||
2026-10-18T20:05:51+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] authz signers: 2 (operator-signed self-update armed)
|
||||
2026-10-18T20:05:52+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] controller: Up 6 seconds (healthy) (after ~0s)
|
||||
2026-10-18T20:05:53+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] controller image: gitea.dooplex.hu/admin/felhom-controller:0.330.0
|
||||
2026-10-18T20:05:54+02:00 tester4 felhom-bootstrap.sh[3647]: [WARN] cloudflared not visible yet
|
||||
2026-10-18T20:05:54+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] (confirm in the hub UI that host Tester4-31fa0e reports guest 9201)
|
||||
2026-10-18T20:05:54+02:00 tester4 felhom-bootstrap.sh[3647]: [OK] Day-0 provision SUCCESS — vmid=9201 host_id=Tester4-31fa0e customer=Tester4 golden=local:backup/vzdump-lxc-9100-2026_10_18-20_04_04.tar.zst
|
||||
2026-10-18T20:05:54+02:00 tester4 felhom-bootstrap.sh[3647]: [INFO] root@pam was rotated + vaulted at step 4b — retrieve at hub → host page (the old GUI password no longer works).
|
||||
2026-10-18T20:05:54+02:00 tester4 felhom-bootstrap.sh[1122]: felhom-bootstrap: host-install SUCCESS — writing done-flag, disabling unit, scrubbing secrets
|
||||
2026-10-18T20:05:54+02:00 tester4 systemd[1]: felhom-bootstrap.service: Deactivated successfully.
|
||||
2026-10-18T20:05:54+02:00 tester4 systemd[1]: Finished felhom-bootstrap.service - Felhom host bootstrap (fetch + run felhom-host-install.sh unattended, retry until success).
|
||||
2026-10-18T20:05:54+02:00 tester4 systemd[1]: felhom-bootstrap.service: Consumed 1min 32.507s CPU time, 884.4M memory peak.
|
||||
=== agent
|
||||
2026-10-18T20:04:00+02:00 tester4 systemd[1]: Started felhom-agent.service - Felhom host agent (Proxmox host tier; hub control loop + PBS verify + storage watchdog).
|
||||
2026-10-18T20:04:00+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:00.468+02:00 level=INFO msg="felhom-agent daemon starting" version=0.159.2 host_id=Tester4-31fa0e hub_url=https://hub.felhom.eu interval_s=900
|
||||
2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.336+02:00 level=INFO msg="backup: restore-test scheduler starting (per-archive due-check)" eval_interval=6h0m0s settle=24h0m0s
|
||||
2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.336+02:00 level=INFO msg="pbs: verify loop starting" cadence=6h0m0s
|
||||
2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.336+02:00 level=INFO msg="storage: watchdog starting" interval=5s debounce=15s
|
||||
2026-10-18T20:04:01+02:00 tester4 sudo[4892]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:04:01+02:00 tester4 sudo[4936]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.874+02:00 level=INFO msg="selfheal: node watchdog starting" mode=appliance interval_s=60
|
||||
2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.875+02:00 level=INFO msg="guestnet: watchdog starting" interval=1m0s min_heal_interval=10m0s max_heals_per_hour=3 settle=3m0s
|
||||
2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.925+02:00 level=INFO msg="guest-power: watchdog started" interval=1m0s max_attempts=3
|
||||
2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.925+02:00 level=INFO msg="fstrim: weekly guest disk trim starting" schedule="weekly, due Wednesday from 10:00 host-local time; starts only 10:00-20:59; never beside a backup or restore-test"
|
||||
2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.925+02:00 level=INFO msg="janitor: starting (restore-test scratch retry + stale-lock sweep)" interval=10m0s
|
||||
2026-10-18T20:04:01+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:01.925+02:00 level=INFO msg="controller-supervisor: started" interval=30s confirm_sweeps=2 crashloop_max=3 crashloop_window=15m0s slow_crashloop_max=5 slow_crashloop_window=24h0m0s guests_dir=/var/lib/felhom-agent/guests
|
||||
2026-10-18T20:04:02+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:02.544+02:00 level=INFO msg="wgtunnel: registered with hub" pubkey="pUKC3lzCxXNARPkI70LtbsxdyW9QateJH1VDhAnvYD8=" assigned_ip=10.77.0.6/32 existed=false generation=1 sync=ok
|
||||
2026-10-18T20:04:03+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:04:03.198+02:00 level=INFO msg="wgtunnel: tunnel conf applied" endpoint=167.233.158.164:443 dns_name=ep0.felhom.eu assigned_ip=10.77.0.6/32 action=enable
|
||||
2026-10-18T20:04:07+02:00 tester4 sudo[5602]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/bin/systemctl restart dnsmasq
|
||||
2026-10-18T20:04:22+02:00 tester4 sudo[5850]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:04:42+02:00 tester4 sudo[5963]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:05:02+02:00 tester4 sudo[6050]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:05:13+02:00 tester4 sudo[6939]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:05:16+02:00 tester4 sudo[7665]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:05:17+02:00 tester4 sudo[7695]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:05:22+02:00 tester4 sudo[7847]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:05:31+02:00 tester4 sudo[9006]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:05:31+02:00 tester4 sudo[9182]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:05:32+02:00 tester4 sudo[9449]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:05:33+02:00 tester4 sudo[9536]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:05:42+02:00 tester4 sudo[9917]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- pve/data
|
||||
2026-10-18T20:05:43+02:00 tester4 felhom-agent[4670]: time=2026-10-18T20:05:43.703+02:00 level=INFO msg="controller-swap: image file written, restarting bootstrap" vmid=9201 target=gitea.dooplex.hu/admin/felhom-controller:0.330.0
|
||||
2026-10-18T20:05:43+02:00 tester4 sudo[9961]: felhom-agent : PWD=/ ; USER=root ; COMMAND=/usr/sbin/pct exec 9201 -- systemctl restart felhom-controller-bootstrap.service
|
||||
@@ -0,0 +1,7 @@
|
||||
2026-10-18 18:04:02|0.159.2|0|0||
|
||||
2026-10-18 18:19:07|0.159.2|1|1||9201
|
||||
33652|2026-10-18 18:05:37|0.329.0|1
|
||||
33653|2026-10-18 18:05:51|0.330.0|1
|
||||
33657|2026-10-18 18:18:34|0.330.0|1
|
||||
33658|2026-10-18 18:19:27|0.330.0|1
|
||||
33659|2026-10-18 18:20:46|0.330.0|1
|
||||
@@ -0,0 +1,6 @@
|
||||
login 302
|
||||
{"data":{"powering_off":true},"ok":true}
|
||||
poweroff 202
|
||||
18:24:15
|
||||
18:24:45 VM 9302: status: stopped
|
||||
Tester4-31fa0e|2026-10-18 18:24:18|2026-10-18T18:24:15Z
|
||||
@@ -0,0 +1,12 @@
|
||||
read 1: 9302 name=newbox-r1148
|
||||
read 2: 9302 name=newbox-r1148
|
||||
scsi0: nvme-scratch:9302/vm-9302-disk-0.raw,size=120G
|
||||
purging VM 9302 from related configurations..
|
||||
Configuration file 'nodes/demo-hp/qemu-server/9302.conf' does not exist
|
||||
ls: cannot access '/mnt/hdd_1/images/9302': No such file or directory
|
||||
VMID NAME STATUS MEM(MB) BOOTDISK(GB) PID
|
||||
341 night1004-tester1 running 8192 200.00 1851
|
||||
VMID Status Lock Name
|
||||
9201 running demo-hp
|
||||
9202 running demo-hp-scratch
|
||||
9401 stopped upgrade-harness
|
||||
@@ -0,0 +1,33 @@
|
||||
# R-1148 — a fresh install from nothing with installer 1.34.0 (2026-10-18 evening)
|
||||
|
||||
Throwaway customer **Tester4** (created by the operator; domain `tester4.test`, a reserved name that never resolves; no
|
||||
off-site, no PBS-DR — nothing on ep0). VM 9302 `newbox-r1148` on demo-hp (Tier 1; 8 GB / 4 cores / 120 GB raw on
|
||||
`nvme-scratch` = `/mnt/hdd_1` root) from the public ISO 1.29.0 (checksum = the published one). The ISO fetches
|
||||
`felhom-host-install.sh` at run time from `https://felhom.eu/scripts/` — served 1.34.0 (`SCRIPT_VERSION` read live). The
|
||||
graphical installer was driven with `qm sendkey`, the Hungarian keyboard kept, as a household would. The household's
|
||||
path: the mailed bind link + the pairing code on the console + the owner phrase (the operator put it in a 0600 file;
|
||||
shredded after), then the mailed setup code.
|
||||
|
||||
| file | what it shows |
|
||||
|---|---|
|
||||
| `02-timeline.txt` | every step with its time (UTC below the line) |
|
||||
| `03-bind.txt` | the bind page's answer: „Sikeres összekötés" |
|
||||
| `04-pve-login-check.txt` | CC's own PVE API login from DooPlex, status codes only: the **vaulted** value 200; the value typed at install 401 |
|
||||
| `05-claim-and-version.txt` | the claim (302 /) and the box's own `/api/selfupdate/status`: 0.329.0 → 0.330.0, `initiated_by: auto-floor` |
|
||||
| `07-first-app.txt` | BentoPDF installed through the dashboard's API: deploy 202, running, healthy |
|
||||
| `08-bootstrap-journal.txt` | the box's `felhom-bootstrap` journal (scanned for secret shapes: 0) |
|
||||
| `09-hub-reports.txt` | the hub's host reports (agent 0.159.2) and the controller's own reports (0.329.0, then 0.330.0) |
|
||||
| `10-poweroff.txt` | the household's „turn off" (202), the hub's `deliberate_off_at` |
|
||||
| `99-teardown.txt` | the name read back twice, VM 9302 destroyed with its disk; the other VMs listed |
|
||||
| `screens/` | installer and console |
|
||||
|
||||
**Step 4b (R-1145) in the full sequence:** `recovery password vaulted at the hub (stored) — now setting it on root@pam`
|
||||
→ chpasswd → `[OK] root@pam password vaulted, set, and the PVE login takes it`, all at 18:03:43 UTC; the hub's
|
||||
`host_recovery.set_at` is the same second. **The golden and the agent:** the hub manifest named agent v0.159.2 (sha
|
||||
`4d98868e…`) and golden v0.329.0 — the two vouched artifacts; both verified by sha256. The box came up on 0.329.0 and
|
||||
moved to the floor 0.330.0 by itself 2 min 47 s after the bind.
|
||||
|
||||
Not walked: an SSH key login — CC logged in with the vaulted password (`sshpass -f`, file 0600, shredded after).
|
||||
|
||||
**Left for the operator (session only):** delete customer Tester4 on the hub — allowed from 19:09 UTC (the last report
|
||||
18:24:18 + the 45-minute stale threshold); a 409 before that is by design (R-599).
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 21 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 157 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 137 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 131 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 134 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 134 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 136 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 134 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 133 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 133 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 150 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 149 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 133 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 141 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 126 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
@@ -0,0 +1,8 @@
|
||||
18:41:08
|
||||
25293 bytes, mtime 2026-10-18 18:40:29.429360235 +0000, owner 1000
|
||||
text: R1018 BEFORE EDITED-FB-1849
|
||||
2026/10/18 20:39:38 POST | 200 | 172.18.0.7 | admin | 0ms | "/api/office/callback?auth=[redacted]&path=%2Fr1018%2Fteszt.docx&source=SCRATCH+HDD"
|
||||
2026/10/18 20:39:53 POST | 200 | 172.18.0.7 | admin | 0ms | "/api/office/callback?auth=[redacted]&path=%2Fr1018%2Fteszt.docx&source=SCRATCH+HDD"
|
||||
2026/10/18 20:39:53 [INFO ] OnlyOffice Server is downloading file: /r1018/teszt.docx (documentId: 795feeebca16ab3ab1aae0dd352e9932fffa9efe0a9a927d6c3100ce98f20e6d)
|
||||
2026/10/18 20:40:29 [INFO ] OnlyOffice callback: successfully saved document to path=/r1018/teszt.docx
|
||||
2026/10/18 20:40:29 POST | 200 | 172.18.0.7 | admin | 5ms | "/api/office/callback?auth=[redacted]&path=%2Fr1018%2Fteszt.docx&source=SCRATCH+HDD"
|
||||
@@ -0,0 +1,4 @@
|
||||
text: R1018 NC BEFORE
|
||||
18:45:21
|
||||
text: EDITED-NC-1847R1018 NC BEFORE EDITED-NC-1844
|
||||
18:47:25
|
||||
@@ -0,0 +1,14 @@
|
||||
18:48:16 files /login 502
|
||||
18:48:31 files /login 502
|
||||
18:48:46 files /login 502
|
||||
18:49:01 files /login 502
|
||||
18:49:16 files /login 502
|
||||
18:49:31 files /login 502
|
||||
18:49:46 files /login 502
|
||||
18:50:01 files /login 502
|
||||
18:50:16 files /login 502
|
||||
18:50:31 files /login 502
|
||||
18:50:46 files /login 502
|
||||
18:51:01 files /login 502
|
||||
18:51:16 files /login 502
|
||||
18:51:31 files /login 200
|
||||
@@ -0,0 +1,7 @@
|
||||
18:51:56 goto https://files.enkisfelhom.hu/files/SCRATCH%20HDD/r1018/teszt.docx -> https://files.enkisfelhom.hu/files/SCRATCH%20HDD/r1018/teszt.docx
|
||||
18:52:11 shot 11-fb-after-stop
|
||||
18:52:11 eval -> []
|
||||
18:52:11 goto https://cloud.enkisfelhom.hu/apps/onlyoffice/78 -> https://cloud.enkisfelhom.hu/apps/onlyoffice/78
|
||||
18:52:27 shot 12-nc-after-stop
|
||||
18:52:27 eval -> ["Nextcloud", [], "Nextcloud\nPage not found\n\nThe page could not be found on the server or you may not be allowed to view it.\n\nBack to Nextcloud\n\nNextcloud – a safe home for all your data"]
|
||||
LOG ('http', 404, 'https://cloud.enkisfelhom.hu/apps/onlyoffice/78')
|
||||
@@ -0,0 +1,6 @@
|
||||
## rc.1 walk 19:12:09
|
||||
FileBrowser file text: R1018 BEFORE EDITED-FB-1849
|
||||
Nextcloud file text: EDITED-NC-1847R1018 NC BEFORE EDITED-N RC1-NC-OKC-1844
|
||||
## rc.1 FileBrowser walk, second try 19:14:39
|
||||
mtime 2026-10-18 19:13:58.691684571 +0000
|
||||
FileBrowser file text: R1018 BEFORE EDITED-FB-1849 RC1-FB-OK
|
||||
@@ -0,0 +1,10 @@
|
||||
stop pressed 19:14:54
|
||||
{"ok": true, "message": "Stack onlyoffice stop completed"}
|
||||
1 19:15:06 files 200
|
||||
1 19:15:08 files 502
|
||||
43 19:15:10 files 200
|
||||
2026/10/18 19:15:06 manager.go:1463: [INFO] [stacks] Restarting stack: filebrowser
|
||||
2026/10/18 19:15:07 manager.go:1493: [INFO] [stacks] Stack filebrowser restarted successfully (took 1.1s)
|
||||
2026/10/18 19:15:07 lifecycle.go:61: [INFO] [integrations] Integration onlyoffice:filebrowser suspended (stack onlyoffice stopped)
|
||||
2026/10/18 19:15:07 lifecycle.go:61: [INFO] [integrations] Integration onlyoffice:nextcloud suspended (stack onlyoffice stopped)
|
||||
2026/10/18 19:15:09 filebrowser_gate.go:94: [INFO] [infra] filebrowser: default login refused for this run — joined traefik-public, files.<domain> served (R-1126)
|
||||
@@ -0,0 +1,31 @@
|
||||
# R-1018 — the OnlyOffice links, live (2026-10-18 evening)
|
||||
|
||||
Scratch 9202 (demo-hp, Tier 0), controller 0.330.0 then 0.331.0-rc.1. OnlyOffice 9.4.0 and Nextcloud 34.0.4 installed
|
||||
through the dashboard API (`POST /api/stacks/<n>/deploy`), each link switched on through `POST /api/integrations/
|
||||
onlyoffice/<target>` — the calls the app page makes. The browser: Playwright's headless Chrome shell on DooPlex, the box's
|
||||
public names (`files.`, `office.`, `cloud.` `enkisfelhom.hu`) mapped to 9202's LAN address (`--host-resolver-rules`), as
|
||||
in `audits/filebrowser-memory-ci-2026-10-17/tools/cdp_shot.py`; the driver is in the session scratchpad (`cdp.py`). The
|
||||
FileBrowser and Nextcloud passwords came from the dashboard's own reveal buttons into 0600 files, typed by CDP, never
|
||||
printed. Test documents: `r1018/teszt.docx` on the scratch drive, `r1018-nc.docx` in Nextcloud (WebDAV).
|
||||
|
||||
| Step | 0.330.0 | 0.331.0-rc.1 |
|
||||
|---|---|---|
|
||||
| link on → files.<domain> | **502 for 4 min 8 s** (FileBrowser re-created off traefik-public, R-1126, until the next 5-min round) | 200 throughout |
|
||||
| FileBrowser → open .docx | editor frame loads, document never does: OnlyOffice fetched `https://files.<domain>/api/resources/download…` → **403** (the public name leads to another box, 9201) — `screens/04` | opens (`screens/15`) |
|
||||
| FileBrowser → edit, close, read the file on the drive | — (by-hand `server.internalUrl` on 0.330.0: „R1018 BEFORE EDITED-FB-1849", `01-filebrowser-save-readback.txt`) | „… RC1-FB-OK", mtime 19:13:58 (`05-rc1-walk.txt`) |
|
||||
| Nextcloud → open .docx | opens, edits, „All changes saved" (`screens/09`) — **but the file keeps the old text**: Nextcloud fetched `http://onlyoffice:80cache/files/…`, „Track: 78 status 2 error" (`02-nextcloud-save-readback.txt`) | the link re-applied the value with its slash at OnlyOffice's start; the file holds „RC1-NC-OK" |
|
||||
| OnlyOffice stopped | FileBrowser: no editor frame; Nextcloud `/apps/onlyoffice/78` **404** — the revoke-on-stop rule (`lifecycle.go:10-13`) holds (`04-after-stop-browser.txt`, `screens/11`, `12`); files.<domain> **502 for 3 min 38 s** (`03-files-outage-after-stop.txt`) | one 502 sample (≈ 2 s), FileBrowser re-published 3 s after its restart (`06-rc1-files-after-stop.txt`) |
|
||||
|
||||
Red-proofs of the three fixes: `redproof-fix1.txt` (FileBrowser `server.internalUrl`), `redproof-fix2.txt` (Nextcloud
|
||||
`DocumentServerInternalUrl` slash), `redproof-fix3.txt` (the gate after `RestartStack("filebrowser")`).
|
||||
|
||||
Also seen, not fixed (outside the links): FileBrowser's `/api/resources/preview` answers 500 for the .docx (an office
|
||||
preview goes through OnlyOffice's converter); Nextcloud's previews log `Request to http://onlyoffice:80converter` on
|
||||
0.330.0 — the same missing slash, fixed with it.
|
||||
|
||||
One first rc.1 FileBrowser attempt showed OnlyOffice's „Connection is lost" after the driver clicked two fixed spots
|
||||
where pop-ups had been the time before (none were there); the next attempt, with no blind clicks, saved. No restart of
|
||||
either container happened in between (both „Up 5–6 minutes").
|
||||
|
||||
Teardown: OnlyOffice removed through the product (`remove_hdd_data`, `remove_backups`: both volumes removed). Nextcloud
|
||||
stays on 9202 for Part 6 of the same brief; the test documents are removed with it.
|
||||
@@ -0,0 +1,9 @@
|
||||
## red-proof 1: the internalUrl line removed
|
||||
=== RUN TestFileBrowserConfig_R1018_InternalURLIsTheContainer
|
||||
infra_test.go:269: server.internalUrl = "" — OnlyOffice would be handed the public files address
|
||||
--- FAIL: TestFileBrowserConfig_R1018_InternalURLIsTheContainer (0.00s)
|
||||
FAIL
|
||||
FAIL gitea.dooplex.hu/admin/felhom-controller/internal/infra 0.008s
|
||||
## restored
|
||||
--- PASS: TestFileBrowserConfig_R1018_InternalURLIsTheContainer (0.00s)
|
||||
ok gitea.dooplex.hu/admin/felhom-controller/internal/infra 0.007s
|
||||
@@ -0,0 +1,10 @@
|
||||
## red-proof 2: the slash removed from ncDocServerInternalURL
|
||||
=== RUN TestNextcloudApply_R1018_InternalAddressesTakeAPath
|
||||
onlyoffice_nextcloud_test.go:34: DocumentServerInternalUrl "http://onlyoffice:80" + "cache/files/data/2153553391_5872/output.docx/output.docx" is not a URL: parse "http://onlyoffice:80cache/files/data/2153553391_5872/output.docx/output.docx": invalid port ":80cache" after host
|
||||
onlyoffice_nextcloud_test.go:34: DocumentServerInternalUrl "http://onlyoffice:80" + "converter?shardkey=thumb_1" is not a URL: parse "http://onlyoffice:80converter?shardkey=thumb_1": invalid port ":80converter" after host
|
||||
--- FAIL: TestNextcloudApply_R1018_InternalAddressesTakeAPath (0.00s)
|
||||
FAIL
|
||||
FAIL gitea.dooplex.hu/admin/felhom-controller/internal/integrations 0.007s
|
||||
## restored
|
||||
--- PASS: TestNextcloudApply_R1018_InternalAddressesTakeAPath (0.00s)
|
||||
ok gitea.dooplex.hu/admin/felhom-controller/internal/integrations (cached)
|
||||
@@ -0,0 +1,9 @@
|
||||
## red-proof 3: the gate call removed from RestartStack
|
||||
=== RUN TestRestartStack_R1018_FileBrowserPublishedAgainAtOnce
|
||||
filebrowser_restart_gate_test.go:129: FileBrowser was not published again after its restart — files.<domain> stays 502 until a base-stack round
|
||||
--- FAIL: TestRestartStack_R1018_FileBrowserPublishedAgainAtOnce (10.31s)
|
||||
FAIL
|
||||
FAIL gitea.dooplex.hu/admin/felhom-controller/internal/stacks 10.318s
|
||||
## restored
|
||||
--- PASS: TestRestartStack_R1018_FileBrowserPublishedAgainAtOnce (0.31s)
|
||||
ok gitea.dooplex.hu/admin/felhom-controller/internal/stacks 0.320s
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 7.9 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 17 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 69 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 46 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 71 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 45 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 89 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 54 KiB |
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user