admin
ecf9185605
Full hub->Hetzner->controller loop validated on demo-felhom against the new dedicated-project pool box; 2 snapshots on the new box, key-only. F1/F3 fixed mid-run (hub v0.38.1, controller v0.106.1); F2/F4/F5/F6 recorded open. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
2.6 KiB
felhom.eu — task reports
Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.
RUNBOOK — offsite provisioning LIVE end-to-end (supervised) — 2026-07-09 — PASS
Full record: documentation/audits/VALIDATION-offsite-provisioning-e2e-2026-07-09.md.
Shipped this run (felhom.eu): manifest wiring 0a65f2b (HETZNER_* env from Secret/storagebox),
hub v0.38.1 7c70c54 + bump 6d5b3c1 (LIVE: Synced/Healthy, Offsite provisioning enabled (pool_box=611714, location=fsn1)). Pairs with controller v0.106.1 (that repo's REPORT).
The first live run of the SLICE 1+2 loop on demo-felhom against the new dedicated-project pool box:
hub UI save → sub-account provisioned (269008, u629488-sub1) → non-secret descriptor + one-time password →
controller config-refresh → apply-bridge (verify-pin, consume-once, pinned ssh-copy-id, offbox configured,
EscrowState=pending) → fork-4 run-gate refusal proven → escrow confirm (Option A — the repo password was
already escrowed under Viktor's R) → first run: restic repo initialized, 2 apps, 2 snapshots on the new box,
key-only (independently verified by SFTP-listing the repo with the bridge-installed key + pinned host key).
Live bugs found + fixed mid-run:
- F1 (hub v0.38.1): a re-click canceled
r.Context()betweenCreateSubaccountandSaveOneTimeSecret→ sub-account stranded with its password lost.applyOffsitenow provisions oncontext.WithoutCancel+ 3-min timeout. TestTestApplyOffsite_ClientDisconnectMidProvision+ red-proof (raw-ctx shape reproduces the exact live error). - F3 (controller v0.106.1):
ssh-copy-id -smktemp's under~/.ssh, absent from the container image — install died locally AFTER consuming the password (fail-safe held; password never transmitted).
Open findings: F2 fresh-subaccount DNS lag → first-save scan 502 (retry-with-backoff wanted); F4 no hub password-reset path (recovery = delete sub-account + re-save); F5 no save spinner (the re-click bait); F6 Hetzner box-level 423 action lock on concurrent saves (fail-closed, correct).
Standing state: demo offsite now targets the NEW box, escrowed, un-paused; the old-box offsite
(u629193-sub1) is a frozen archive until a NEW-box restore round-trip is verified.
NEXT: SLICE 3 (escrow auto-confirm), SLICE 4 (soft-quota), F2/F4/F5, Peti/pilot onboarding runbook.