admin
61f4898d30
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
48 lines
3.4 KiB
Markdown
48 lines
3.4 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
|
|
|
## TASK H1 — OOB operator access (hub + installer + endpoint half) — hub v0.35.0 (2026-07-05)
|
|
|
|
**Baseline:** felhom.eu @ `a3ee93e` → pushed. Hub `0.34.1` → **`0.35.0`** (live via ArgoCD). Agent half
|
|
= felhom-agent v0.72.0. The merged E1+H1 operator-SSH-access feature. Provenance: both
|
|
`SPIKE-{felhom-sshd,oob-wg-operator-peer}-2026-07-05`.
|
|
|
|
### Shipped
|
|
- **Operator OOB peer** (`store/wg_operator.go`): the fleet operator peer as an UNBOUND `wg_peers` row
|
|
(host_id '', note operator-oob) at an EXPLICIT /32; validated; last-write-wins rotation; rides
|
|
ListWGPeers → peersync pushes it to the endpoint. `PUT/GET /admin/wg/operator-peer` (global key);
|
|
PUT also takes `ssh_pubkey` (hub_settings) + bumps every host's generation.
|
|
- **Desired-state** (`api/wg.go` mergeWireguard): the served wireguard block gains `oob_peer_ip`
|
|
(rendered into the box's AllowedIPs — survives self-heal [OF-1]) + `oob_operator_ssh_key` (agent
|
|
writes felhom-sshd's authorized_keys). Absent operator peer → byte-identical pass-through.
|
|
- **OOB health** (`monitor/host_oob.go`): ingests the agent `oob` heartbeat stanza; transition-based
|
|
`oob_degraded`/`oob_recovered` warning (felhom-sshd down while the operator peer is configured, OR
|
|
config invalid). Unconfigured OOB never alerts.
|
|
- **host-install** (`scripts`): `--enable-oob` + `install_oob` install the static felhom-sshd + belt +
|
|
`felhom-op` user (RuntimeDirectory-guarded); uninstall removes them.
|
|
- **Doc 06 §4.5/§4.6 amended**: forwarding ON but per-pair allow-listed, box↔box drop now explicit;
|
|
the `oob` health stanza + `oob_degraded` alert. Endpoint runbook §9 added (forward chain + operator
|
|
peer registration).
|
|
|
|
### Tests + red-proofs (all green: `go build/vet/test ./...`)
|
|
- store: operator-peer round-trip/rotate/unbound + validation (reserved/taken/out-of-subnet); merge
|
|
includes oob_peer_ip when configured (absent = byte-identical).
|
|
- api: operator-peer PUT self-scoped-global-only; ssh_pubkey validation.
|
|
- monitor: degraded/recovered transitions; config-invalid alerts; unconfigured-never-alerts;
|
|
no-stanza-ignored. Red-proof: neuter the emit → the alert test fails.
|
|
|
|
### Live validation (felhom-pve + dev endpoint)
|
|
Endpoint set up first (ip_forward=1 + per-pair forward chain + operator peer registered → pushed to
|
|
wg0). Both spikes' key probes re-run as acceptance — all pass: operator→box SSH as felhom-op with
|
|
scoped sudo; the OF-1 self-heal /32 survival; coexistence (stock :22 PID 922 unchanged, distinct host
|
|
keys, felhom-op denied on :22); the belt (LAN→port dropped, :22 untouched); box↔box drop (counter) +
|
|
peersync survival; PBS unaffected throughout; the healthy `oob` stanza reaches the hub +
|
|
`oob_degraded`/`oob_recovered` fired around a real felhom-sshd downtime. Full detail + the 5
|
|
live-found-and-fixed agent bugs: felhom-agent `REPORT.md`.
|
|
|
|
### Notes
|
|
- CGNAT still unproven; IPv6/AAAA out of scope; operator-key auto-rotation is a manual re-PUT; the
|
|
"customer network fully down" case is explicitly OUT OF SCOPE / accepted risk. Operator (global) key
|
|
= hub `report_api_key`. felhom-pve's operator peer + felhom-sshd + endpoint forwarding stay live.
|