felhom.eu/documentation/audits/lockouts-2026-10-01

Strangers and lockouts (R-752), the one address behind the tunnel (R-753), the registry (R-750) — 2026-10-01 afternoon

Report and Part table: felhom.eu/REPORT-lockouts-2026-10-01.md.

folder	what
A/A1-client-address.txt	demo-hp through its real tunnel (traefik + BookStack logs), 9202 echo container (tunnel hop simulated, LAN with forged headers), the answer table, why no box-wide fix
B/B1	BookStack, Grafana (+ trickle), calibre-web (+ OPDS, + the daily limit, + restart) with the LIVE templates
B/B2a, B/B2	wger control (B2a: a wrong login URL — 404 — kept as a record; B2: the real control)
B/B3	the drill commits and 9202 pointed at the drill
B/B4, B/B5	wger fix at 15 min (retries kept it closed 40+ min) and at 5 min (in at 7.5 min)
B/B6	what an installed app gets: the stack file at sync, the running env only at Restart
C/C1-registry-read.txt	Gitea read only: no cleanup rule, the database's first versions, the manual prune (HM-024), nothing scheduled
T/	9202 back on live, the drill reset
tools/	lk.py (login probes), b_three.py, b_wger.py, b_installed.py, echo.sh, walk.py, repoint.py