felhom.eu/STATUS.md

STATUS — what works, what's broken, what's next

Updated 2026-09-29 afternoon. Both demo boxes run controller 0.281.0 and host agent 0.137.0. Hub 0.125.0. New installs get golden 0.276.0 with agent 0.137.0.

Decisions today. Yours: after an app's first admin exists, strangers can no longer sign up. Mine (you may reverse it): most apps have no switch the box can flip to close sign-up. So the box blocks just the app's sign-up address after the setup. The household can open it for 15 minutes from the app page, so a family member can join.

What I did, and it worked.

• The gate is on 32 of the 34 apps where the first visitor would become the admin. On a new install a stranger gets only the gate page. You, signed in to the dashboard, go straight to the setup. I tested every one on the scratch box.
• 9 apps open the gate by themselves when their setup is done. The rest open with the "Done" button.
• The "Done" button now asks the app first. If the app says "not done", the button refuses. I tested it on zipline before its setup.
• Strangers can no longer sign up after the setup. 11 apps let anyone make an account; the box now blocks that. 11 more refuse strangers by themselves. The 15-minute window works and closes again by itself.
• claper's password step is safe for passwords with unusual characters. I tested one with a quote mark in it.
• Apps already installed were not closed. I checked this first, and again on both demo boxes after the update.

What is not done.

• wanderer is not closed. Its web part calls its own database through the public address, and a gate would block that call. So a stranger can still create its admin and sign up. It needs a small design change.
• seerr, outline and rallly are closed to strangers. I could not test the opening, because it needs a media server or e-mail.
• 3 apps have a "setup done" signal the box cannot read yet (ghost, home-assistant, gramps-web). They use the button for now.

Rows. 3 opened, 3 closed, plus 1 for you. The list went from 350 to 353 rows.

What needs you.

1. wanderer: (A) keep it in the catalog until I fix it; its page now says plainly that anyone who finds the address can make an account (I recommend A; the fix is small). (B) Hide it from new installs until fixed. If you do nothing: A.
2. Apps installed before today on the demo boxes (adventurelog, opengist) still allow open sign-up. (A) Add a one-time "close sign-up now" button for installed apps. (B) Leave them; only the demo boxes have such installs. If you do nothing: B.
3. D4, the image copies, the Peti leftovers: unchanged. If you do nothing, nothing changes.