0 Fork 0

Files

T

gates / gates (push) Successful in 2m3s

Details

Golden 0.349.0 baked and published on the operator's word (sha 9d97e7c5ec3e); waits for the vouch

The Sunday 2026-11-01 bake was missed and golden_currency_gate.py was red at 8 days. Baked at the floor
(0.349.0, MinAgent 0.158.1) with the hub's newest approved Docker release, os-docker-20261026-190351.
Registry round trip matches. Token scan 0, control 1. The drill VM is back on virgin.
It carries Traefik v3.7.16 until controller 0.350.0 reaches the box (R-1354). No fresh install was run.

2026-11-03 07:31:05 +01:00

7.6 KiB

Raw Blame History

STATUS — what works, what's broken, what's next

Ready for Tester 2? Yes — tell the friend go (documentation/pilot/TESTER2-handover.md).

Updated 2026-11-03 (morning). On your word, golden 0.349.0 is baked; the code-push gate is green again. It needs your vouch (first line of the release list). It carries Traefik v3.7.16 until controller 0.350.0 (R-1354).

What works

The Plex attack did not reach Felhom's secrets (R-1241).
A box installs from nothing with the public installer, links to the hub, and moves to the floor by itself (map A1, A3, A4).
65 catalog apps install, update one tested step at a time, and a failed update undoes itself (map B1, B3, B4, B6).
Backups: database dumps, a second-drive copy, an off-site copy and whole-box copies; restore tests run by themselves (map C1–C4, A17, A18).
A restore brings an app back with its data; a failed or cut restore puts it back as it was; one that does not start says so (map C5, D6, D7, D16).
After a power cut the box starts by itself and cleans up a half-written backup (map C10, F12).
A second drive is offered as the backup target; media apps see every drive (map D1, D13, D15).
The three test boxes answer only over https; the hub's key opens nothing on a box (map E12, E13, E17).
A hacked app that uploads or computes more than it explains alarms only you (map F13).
An urgent security fix reaches the boxes at night after one test on the test box; the box backs up first and undoes a failed update (map B23).
The hub mails alarms and recoveries and keeps a weekly whole-box copy on ep0 (map F1, F11, G15).

What is broken

P1: any hacked app on DooPlex can read the hub's nightly backups, and maybe the signing keys (R-1241, homelab session); about 12 homelab logins still use a password that was public, and the public Gitea repo is not decided (R-925, yours).
Tester 2 off since 10-04: old emergency password, no off-site check, no bootstrap (R-1139, R-1104, R-862). Scratch box: no agent features (R-1083).
DooPlex: something sets the shared checkout to „bare" (R-935).
A box's event is lost if the hub is away for 9 seconds; a DooPlex restart can swallow a mail (R-1361).

What we work on

HTTP2Shell waiters: cal.com, Calibre-Web, RomM have no fix; Paperless, SparkyFitness have one on a new main version (R-1331; R-785, behind R-784).
Dated checks, run by CC. 2026-11-06: ask you to retire DooPlex's old copy of the website (R-1228).

Waiting on you — decide

Newest first. CC's pick is in the „Pick" column. Each row also has its full text in the register.

#	Row	Question	Pick (why)	The other option costs	If you do nothing	Blocked
D66	R-1365	Should a security-watch source that stays down mail again every 7 days, as an open notice does? Today it mails once, then only the Monday summary lists it.	Yes (a real outage then cannot be forgotten; the seven pins that can never be read no longer count, so it stays quiet when all is well)	no: one line in a long Monday mail stays the only reminder	a source that stays down mails once; the Monday list still shows it	—
D38	R-1235	Put the newest golden (637 MB) into the nightly release copy on ep0 too?	Yes (a new install after a DooPlex loss needs it; it fits under the 3 GB cap)	leave it out: after a loss, no new install until a golden is rebuilt and vouched	the same	—
D37	R-1236	Raise Gitea's memory limit from 1 GiB to 2 GiB? It was killed for memory 4 times in 17 days, once during today's release.	Yes (DooPlex has the RAM; a DooPlex change, so yours)	keep 1 GiB: a restart in release hours fails box updates and CI for a minute	the same	—
D9	R-1062	Split the N100's USB drive in two, for multi-drive tests?	No — keep one drive (the lived-in box keeps its nightly whole-box backup)	Split: the box loses its local whole-box backup, or you buy a second drive first	it stays one drive; multi-drive tests stay on Tester 1	—
D7	R-990, R-989	Rule on the forum ideas and the selfh.st ideas now, or park them?	Park them (P4; nothing waits on them)	Rule now: about one hour of reading	nothing changes; the research gets old	—

Waiting on you — do

Still needed? (yes/no) — answer per line.

Look at roms/roms/ on the N100's drive in the file manager (R-1099). (since 10-16)
The N100 sheet, about 30 minutes: Plex, the admins in Prowlarr, Sonarr and Radarr, your download sources (documentation/audits/n100-lived-in-2026-10-15/SHEET.md). (since 10-15)
Look at these demo-hp pages when you have time: Calibre-Web, the file manager, AdventureLog, Plex, the app page, the Plex and Sonarr guides. (since 10-16)
Remove the test server „plex-k6" from your Plex account (plex.tv → Settings → Authorized Devices). (since 10-15)
Ask Google to index https://felhom.eu/sajat-felho-tarhely in Search Console (R-1035). (since 10-14)
BIOS: on the N100, read „After Power Loss"; on the HP, set „Bypass F1 Prompt on Configuration Changes" to Enable. (since 10-14)
Pin the first Facebook post (R-917), and look at the new cover in the Facebook phone app (R-919). (since 10-12) 2026-11-03 release list (your word). 0. Vouch golden 0.349.0 (agent 0.171.0, min_agent 0.158.1), sha 9d97e7c5ec3e…, in full in documentation/tests/golden-0.349.0-2026-11-03/README.md. If not: a new install keeps getting 0.344.0, and the floor stays above the vouched golden. 1. Controller v0.350.0 (3764445): Traefik v3.7.17 (R-1354), R-1347, R-1348, R-1339, R-1351, R-1323. If not: every box keeps the hole. 2. Agent v0.172.0 + vouch: R-1302. 3. Hub v0.179.0: R-1352. 4. Catalog, proven on the drill: Paperless 3.4.1 (R-1331), n8n 3.0.1 (R-1356), Mealie, Termix (R-1359). 5. To the homelab session: R-1355. 2026-10-30. On the hub's Hosts page: Discard the appliance of 10:44:59 (uuid d3529d2d…) and appliance 49 (CC's proof VMs). If not: dead entries alarm. 2026-10-29 (release run). 1. (since 10-28) Give the homelab session audits/http2shell-2026-10-27/HOMELAB-LIST.md (19 images, R-1328). If not: DooPlex keeps the bad runtimes. 2026-10-23 do list.
Print the break-glass sheet (documentation/runbooks/break-glass-sheet.md, the part from „The sheet”, one A4), fill it by hand, keep it outside the home (D32; R-923, R-924). If not: after a DooPlex loss no off-site copy opens.
Give the homelab session R-1241, R-1242, the lists at the end of documentation/audits/plex2shell-felhom-impact-2026-10-23/README.md and documentation/audits/dooplex-alarms-2026-10-24/README.md, and an upload alarm on DooPlex's eno1 (~100 Mbit/s line; the flood peaked at 905). If not: the next hacked app on DooPlex can read the hub's backups. The rest

System poster needs a refresh: the new 01:40 „release copy” arrow from DooPlex to ep0 (D33); the website now on Cloudflare, only its mail form on DooPlex (D35). If not: the drawing is out of date.
Rotate the reused homelab logins and decide the Gitea repo's visibility (R-925, P1). (since 10-09)
Two DooPlex leftovers: leftovers/2026-10-14/first-post/ (keep or delete); the deny-list edit in homelab-manifests' .claude/settings.json (commit or drop). (since 10-14)
Before the first paying customer: Tandoor's permission (R-789); a lawyer for the licence list and the terms (R-802, R-813); SparkyFitness by e-mail (R-784).
Later (yours, not urgent): R-1248 (a hard upload cap per app), R-1229 (ArgoCD's sync settings into git), R-862 (Tester 2's bootstrap, when it is back), R-504, R-1071, R-1073, R-1077, R-1042, R-132, R-908, R-779, R-904, R-232, R-433, R-933, R-213, R-832, R-388, R-882, R-883, R-814, R-1056, R-1164, R-930, R-920, R-902.

7.6 KiB Raw Blame History Unescape Escape