felhom.eu/STATUS.md

STATUS — what works, what's broken, what's next

Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).

Updated 2026-10-01 (afternoon). Both demo boxes run controller 0.285.0 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.285.0 with agent 0.138.0.

Tester-2 — read only, from the hub. The customer record exists. Tester-2's box has not registered yet.

Decisions I took myself (you may reverse them)

• wger: a stranger now locks only the name they try, for 5 minutes. Before, ten wrong tries locked out every household member for 30 minutes. Tested: the other member could still log in; the targeted one was back in after 7.5 minutes. Short on purpose: in wger, every try during a lock restarts it, also the household's own.
• BookStack and Grafana: no change. Their locks are already short: 1 minute and 5 minutes, measured.
• mealie stays on the 1-hour lock, as you said.

What I measured

• Behind the tunnel, every visitor looks like the same address to an app. So an app that locks "by address" locks out everyone at once (that was wger). Apps cannot see who is who. I did not change this box-wide: the easy way would let a stranger fake an address. Written down.
• Old controller versions in the registry: no automatic rule removed them. Someone ran a clean-up script by hand on 22–23 August, when the registry disk was full. Nothing runs it on a schedule.
• An installed app takes a new setting at its next restart, update or night backup — not by itself.

What else I found

• wger runs a development web server, not a production one. Written down.
• The design document says the tunnel runs on the host. It runs inside the box. One of the two is wrong. Written down.

Rows. Today (afternoon): 0 closed, 2 narrowed or answered, 3 opened. The list went from 387 to 390 rows.

What needs you

1. calibre-web: a stranger can lock the household out for a day (40 wrong tries in 14 minutes). There is no setting for a shorter lock. Two ways:
   • A — a secret login name (recommended): the box makes one at install and shows it on the app page next to the password. Strangers cannot aim at it. Cost: the household types a strange name.
   • B — switch the login limit off: no lock at all. Cost: no limit on password guessing in the login form. If you do nothing: a stranger who knows the name admin can keep the household out for a day.
2. The registry clean-up script: today it keeps only the newest 7 versions, about one day of controller releases, and it does not protect the versions in use. Two ways:
   • A — a written rule (recommended): keep the newest 20 releases, plus every version a golden, the floor or the vouched agent names. Change the script to match.
   • B — keep it as it is: run by hand when the disk fills. If you do nothing: the next manual run can delete a version a box or a backup still needs.
3. Smaller: should apps see each visitor's real address (a bigger build), or do we keep fixing per app? And which is right for the tunnel: the design document (on the host) or the build (inside the box)? Nothing breaks if you wait.

Standing steps

• Monthly security re-test: last run 2026-10-01, next due ~2026-11-01. (You start it with the standing brief.)
• Weekly: the golden bake (around 8 October).