141 lines
11 KiB
Markdown
141 lines
11 KiB
Markdown
# Tester 2 — the hand-over list: a NEW INSTALL (rewritten 2026-10-22, operator ruling 14:11)
|
||
|
||
**The ruling:** Tester 2's friend reinstalls the laptop from the public download (installer 1.30.0 or newer) when he
|
||
puts the new drive in, with the drive in before the install. The old box's data is not needed („he barely used the
|
||
laptop, no useful data on it"). So nothing is upgraded and nothing is restored. (The earlier upgrade list is in git:
|
||
`git log -- documentation/pilot/TESTER2-handover.md`.)
|
||
|
||
## What the hub held for Tester 2 before the RESET (read only, 2026-10-22 morning)
|
||
|
||
- Host `Tester-2-be8404`, agent 0.142.0, last report **2026-10-04 18:05 UTC** (offline since). A 16 GB machine, guest
|
||
9201 with 12 GB.
|
||
- **No sealed key package** (`host_escrow`: none; retained packages: none). The hub mailed `offsite_escrow_pending` on
|
||
10-11 and 10-18: the box never deposited its off-site key.
|
||
- **Off-site was set up**: tier `shared` (the Storage Box), its descriptor provisioned on 2026-10-04 (`offsite_key_installed`
|
||
16:16 UTC). Whether the repository holds any snapshot is not known from the hub; without a key package it can never
|
||
be opened by anyone.
|
||
- **PBS whole-box tier (ep0)**: namespace provisioned (its secret used 2026-10-04 16:28 UTC); the box reported **one
|
||
whole-box copy**, 2026-10-04 16:31 UTC; its prune job `prune-Tester-2` was added by hand on 2026-10-19.
|
||
- DR recipe (2026-10-04), claim (claimed 2026-10-04 16:30 UTC), mail list (written at the claim, never saved by the
|
||
household — `household_saved` false).
|
||
- **The customer's mail language is English** (`language = en`). The box's first screen, the link mail and the
|
||
set-up mail follow it. If the friend reads Hungarian, change it on the customer page before step 1.
|
||
|
||
## Host delete or customer RESET? — for a fresh start with nothing to keep
|
||
|
||
A new install for the same customer needs the old host gone first (D19): the passphrase works only while the customer
|
||
has no host, and an install over a kept host skips the claim and off-site re-issues (R-1154). Both paths begin with the
|
||
host delete; RESET is a second press after it (RESET refuses while any host exists).
|
||
|
||
**Host delete alone** (Hosts → `Tester-2-be8404` → Delete; allowed because the box is offline; no key-package tick is
|
||
needed — there is none):
|
||
- removes the host record, its keys and its WireGuard peer; records the deletion; mails the friend a new link;
|
||
- **keeps** the off-site descriptor and whatever the Storage Box repository holds, the ep0 namespace with the
|
||
2026-10-04 whole-box copy and its prune job, the DR recipe, the claim;
|
||
- the new box gets new off-site credentials and mints a **new** off-site key; with no package to carry, it never asks
|
||
for an old recovery code. If the old repository holds snapshots, the new box sets them aside on its first night and
|
||
they stay on the Storage Box, unreadable, until the abandonment clean-up (R-1182) removes them. The ep0 copy stays
|
||
until its prune job ages it out.
|
||
|
||
**Customer RESET** (Configs → `Tester-2` → Reset, after the host delete; type the customer id; no key-package tick —
|
||
there is none). From the code (`hub/internal/web/customer_reset.go`, `store/customer_reset.go`) and A20:
|
||
- **destroys on the Storage Box:** Tester-2's off-site folder — the repository and any set-aside copy — through its own
|
||
sub-account login, then the sub-account (the Hetzner leg — only because off-site is on). This purge is hub 0.142.0's
|
||
(R-32) and **has never run live**: Tester 2's RESET is its first. If the purge fails, the sub-account is kept and the
|
||
leg reads `failed` — press Reset again; CC reads the journal after;
|
||
- **destroys on ep0:** the `Tester-2` PBS namespace **with the 2026-10-04 whole-box copy**, its token and its prune job
|
||
(`felhom-tenantsync` deprovision);
|
||
- **destroys on the hub:** the claim (a fresh setup code at the next install), the provisioned off-site descriptor (the tier stays
|
||
„on" but unprovisioned until the operator presses Save on the customer page — section 3), the DR recipe, the one-time secret, log bundles; pending operator actions are
|
||
cancelled;
|
||
- **keeps:** the customer, its address, domain, language, Cloudflare settings, the off-site tier CHOICE and its mail
|
||
list; every event (the audit trail);
|
||
- at the end it mails the friend a new link itself.
|
||
|
||
**Recommendation (taken 2026-10-22): host delete, then RESET.** „Fresh start, nothing to keep" is exactly what RESET is for: the new box
|
||
starts with an empty Storage Box path and an empty ep0 namespace, instead of carrying a set-aside history nobody can
|
||
open and a stale whole-box copy. **RESET deletes data on ep0 and on the Storage Box — that is the operator's press,
|
||
never CC's** (both are Tier 2). It is proven live twice (A20, 2026-07-18), each leg idempotent: a failed leg is
|
||
re-run from the top, and nothing on the hub is purged until both external legs are ok.
|
||
|
||
## 1. The operator, before the friend starts — **DONE 2026-10-22** (checked by CC, read only)
|
||
|
||
**Status: steps 1–4 done on 2026-10-22; next: step 5 — give the passphrase and tell the friend „go".**
|
||
- Step 1: the mail language is now **Magyar** (`hu`).
|
||
- Step 2: host `Tester-2-be8404` deleted 12:54:47 UTC.
|
||
- Step 3: RESET 12:55:56–12:56:04 UTC, every leg `ok`. The off-site folder held no repository (nothing to delete) and
|
||
its sub-account is gone; ep0's `Tester-2` namespace, its 2026-10-04 copy, its prune job and its token are gone; no
|
||
other customer's data changed (Storage Box and ep0 counts before = after). The friend got the newest link mail at
|
||
12:56:05 UTC (the one sent at 12:54:48 no longer works).
|
||
- Step 4, seen from outside: `felhom.sajatfelhom.hu` and `files.sajatfelhom.hu` answer Cloudflare 530 — the route to his
|
||
tunnel exists and waits for a box. Evidence `audits/tester2-reset-2026-10-22/`.
|
||
|
||
|
||
| # | What | Where | Done when |
|
||
|---|---|---|---|
|
||
| 1 | (If the friend reads Hungarian) set the mail language to Magyar | Configs → `Tester-2` | the page shows Magyar |
|
||
| 2 | **Delete the old host.** Tick the box-off confirmation if the page asks; type the host id | Hosts → `Tester-2-be8404` → Delete | the host is gone from the Hosts page. A `409` means the hub still sees the box online — it is not (last report 2026-10-04), so a 409 here is worth telling CC |
|
||
| 3 | **RESET the customer.** Read the preview: host count 0, off-site on (shared), no key-package line | Configs → `Tester-2` → Reset → type `Tester-2` | every leg reads `ok` (hetzner, pbs, claim, descriptor, db_purge); a failed leg: press Reset again (it resumes) |
|
||
| 4 | Check the Cloudflare tunnel still routes `*.<his domain>` (R-494) — RESET does not touch it | Cloudflare | the tunnel exists; its token is on the customer page |
|
||
| 5 | Give the friend the 5-word **owner passphrase** in person or by message (never by the link mail) and the page in section 2. Tell him „go". | — | — |
|
||
|
||
## 2. The friend — one page, Hungarian (send it as it is)
|
||
|
||
> **Szia! Így telepítsd újra a Felhom dobozodat.** Kb. egy óra. A gépen minden adat törlődik — a régi rendszerre nincs
|
||
> szükség.
|
||
>
|
||
> **Előtte:** építsd be az új meghajtót. Kell egy legalább 4 GB-os USB-kulcs, hálózati kábel a routerhez, a Felhomtól
|
||
> kapott **Tulajdonosi jelmondat** (5 szó) és az e-mail fiókod.
|
||
>
|
||
> 1. **Letöltés:** nyisd meg a https://felhom.eu/letoltes oldalt, és nyomd meg a **„Letöltés (1,6 GB)"** gombot.
|
||
> 2. **Ellenőrzés:** az oldal kiírja a fájl ellenőrző összegét (SHA-256), és azt is, hogyan számold ki a gépeden.
|
||
> A két érték legyen pontosan ugyanaz. Ha nem az, ne telepítsd — szólj.
|
||
> 3. **USB-kulcs:** írd ki a fájlt a kulcsra balenaEtcherrel (vagy Windows-on Rufusszal, „DD" módban).
|
||
> 4. **Telepítés:** indítsd a gépet a kulcsról. A képernyők angolul vannak — ez rendben van.
|
||
> - Felhom logó, két sor: **„Felhom telepítés"**. Utána: **I agree**.
|
||
> - **Target harddisk — ez a legfontosabb lépés.** A telepítő felsorolja a lemezeket méretükkel. Válaszd azt, amelyre
|
||
> a rendszer kerüljön (a gép belső rendszerlemeze). **Az új meghajtót ne válaszd** — azt a doboz később, a
|
||
> Tárhely oldalon kapja meg. Ha nem tudod, melyik melyik, állj meg és szólj.
|
||
> - Country / Timezone / Keyboard: hagyd így. Root password: adj meg bármilyen legalább 8 karakteres jelszót kétszer
|
||
> (a Felhom később lecseréli). Administrator email: a saját címed. Hostname: `felhom.<a-te-domained>`.
|
||
> - Summary: a jobbra nyíllal lépj az **Install** gombra, és nyomd meg. A gép a végén magától újraindul — a másolás
|
||
> alatt húzd ki az USB-kulcsot.
|
||
> 5. **Párosító kód:** a doboz képernyőjén 2–4 perc múlva megjelenik: „Párosító kód: XXX-XXX". Írd fel.
|
||
> 6. **Összekötés:** nyisd meg a **„Kösd össze a Felhom dobozodat"** e-mailt (ha kettő jött, a frissebbet), kattints a
|
||
> hivatkozásra, és add meg a Párosító kódot és a Tulajdonosi jelmondatot.
|
||
> 7. **Vezérlőpult jelszó:** kb. 3 perc múlva jön a **beállító kódos** e-mail. Kattints a benne lévő címre, add meg a
|
||
> Beállító kódot (3 szó), és válassz legalább 12 karakteres jelszót. Ez a vezérlőpult jelszava.
|
||
> 8. **Helyreállítási kód:** a vezérlőpult kéri, hogy hozd létre. Írd le **papírra**, és tartsd a gépen kívül. Amíg
|
||
> nincs meg, a távoli mentés nem indul el.
|
||
> 9. **Első két alkalmazás:** Alkalmazások → például **BookStack** és **PrivateBin** → Telepítés. Ha valamelyik
|
||
> jelszót kér, nyomd meg a „Generálás" gombot.
|
||
>
|
||
> **Ha valami nem működik:** írd le röviden, mit csináltál, mit vártál, és mi történt helyette, és ha tudsz, küldj
|
||
> képernyőképet. Küldd el a Felhom üzemeltetőjének azon a címen, ahol eddig is levelezettetek.
|
||
>
|
||
> **Amit ne csinálj:** visszaállítás közben ne húzd ki a gépet a konnektorból, és ne kapcsold ki. A helyreállítási
|
||
> kódot ne a gépen vagy a laptopon tárold.
|
||
|
||
## 3. The operator, after the install
|
||
|
||
- **Off-site, if the friend wants it:** Configs → `Tester-2` → Edit → **Save** (off-site stays ticked). After the RESET
|
||
the tier is on but unprovisioned — the page says so — and the hub provisions a fresh Storage Box account only on
|
||
Save (about 25 s; do not click twice). Then the box's off-site starts once the friend has made the recovery code.
|
||
If he does not want it: untick off-site, Save. Nothing else.
|
||
|
||
## 4. CC, after (tell CC „Tester 2 installed")
|
||
|
||
1. **A read-only box walk:** `scripts/https_only_check.py` with Tester 2 in it (R-1104); containers, unhealthy and
|
||
restarting counts; the controller's error lines; the agent's capability self-check and the config bundle (a fresh
|
||
install has both).
|
||
2. **The host swap (D28):** from the host report — our installer gives this 16 GB machine 8 GB; the new rule says
|
||
short only below 90 % of min(the guest's swap, 8 GB). No `host_swap_short` expected.
|
||
3. **The first night chain, the next morning:** database dump, second-drive copy (if the new drive was set up as the
|
||
backup target), off-site copy (if switched on), the whole-box copy to ep0 (CC confirms the new host's PBS namespace
|
||
was made again after the RESET), the integrity check — each ran.
|
||
4. **The hub alarms for 24 hours** after the install, read from the hub.
|
||
5. **The mail list:** the hub's row was never saved by a household, so the new box pushes its default list once and
|
||
keeps it; the hub and the box page must agree.
|
||
|
||
Rows: R-862 and R-1139 close when Tester 2 is reinstalled; R-1104 is checked by step 4.1.
|