admin
ecf9185605
Full hub->Hetzner->controller loop validated on demo-felhom against the new dedicated-project pool box; 2 snapshots on the new box, key-only. F1/F3 fixed mid-run (hub v0.38.1, controller v0.106.1); F2/F4/F5/F6 recorded open. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
34 lines
2.6 KiB
Markdown
34 lines
2.6 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
|
|
|
## RUNBOOK — offsite provisioning LIVE end-to-end (supervised) — 2026-07-09 — **PASS**
|
|
|
|
**Full record:** `documentation/audits/VALIDATION-offsite-provisioning-e2e-2026-07-09.md`.
|
|
**Shipped this run (felhom.eu):** manifest wiring `0a65f2b` (HETZNER_* env from Secret/storagebox),
|
|
**hub v0.38.1** `7c70c54` + bump `6d5b3c1` (LIVE: Synced/Healthy, `Offsite provisioning enabled
|
|
(pool_box=611714, location=fsn1)`). Pairs with controller v0.106.1 (that repo's REPORT).
|
|
|
|
The first live run of the SLICE 1+2 loop on `demo-felhom` against the new dedicated-project pool box:
|
|
hub UI save → sub-account provisioned (269008, `u629488-sub1`) → non-secret descriptor + one-time password →
|
|
controller config-refresh → apply-bridge (verify-pin, consume-once, pinned `ssh-copy-id`, offbox configured,
|
|
`EscrowState=pending`) → fork-4 run-gate refusal proven → escrow confirm (Option A — the repo password was
|
|
already escrowed under Viktor's R) → **first run: restic repo initialized, 2 apps, 2 snapshots on the new box,
|
|
key-only** (independently verified by SFTP-listing the repo with the bridge-installed key + pinned host key).
|
|
|
|
**Live bugs found + fixed mid-run:**
|
|
- **F1 (hub v0.38.1):** a re-click canceled `r.Context()` between `CreateSubaccount` and
|
|
`SaveOneTimeSecret` → sub-account stranded with its password lost. `applyOffsite` now provisions on
|
|
`context.WithoutCancel` + 3-min timeout. Test `TestApplyOffsite_ClientDisconnectMidProvision` + red-proof
|
|
(raw-ctx shape reproduces the exact live error).
|
|
- **F3 (controller v0.106.1):** `ssh-copy-id -s` mktemp's under `~/.ssh`, absent from the container image —
|
|
install died locally AFTER consuming the password (fail-safe held; password never transmitted).
|
|
|
|
**Open findings:** F2 fresh-subaccount DNS lag → first-save scan 502 (retry-with-backoff wanted);
|
|
F4 no hub password-reset path (recovery = delete sub-account + re-save); F5 no save spinner (the re-click
|
|
bait); F6 Hetzner box-level 423 action lock on concurrent saves (fail-closed, correct).
|
|
|
|
**Standing state:** demo offsite now targets the NEW box, `escrowed`, un-paused; the old-box offsite
|
|
(`u629193-sub1`) is a frozen archive until a NEW-box restore round-trip is verified.
|
|
**NEXT:** SLICE 3 (escrow auto-confirm), SLICE 4 (soft-quota), F2/F4/F5, Peti/pilot onboarding runbook.
|