felhom.eu/STATUS.md

STATUS — what works, what's broken, what's next

Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).

Updated 2026-10-02. Both demo boxes run controller 0.287.0 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.287.0 with agent 0.138.0.

Tester-2 — read only, from the hub. The customer record exists. Tester-2's box has not registered yet.

Today: the family gate is built

• What it is: a door in front of chosen apps. Only the family gets in. Each family member has their own name and password. You add, reset and remove them on the dashboard: Settings → Security → Család card.
• Grimmory (e-books) is published behind it. Strangers cannot reach its login any more, so they cannot lock you out. E-readers (Kobo, KOReader, OPDS apps) still work with Grimmory's own login.
• MeTube (video downloads) is published behind it. It has no login of its own, so the gate is its only door. The page says: download only what you have the right to.
• Measured on the scratch box and on demo-hp: a stranger reached nothing; a stranger's wrong guesses locked only that stranger; a removed family member was out at the next click; backup, remove and restore kept the gate.
• Phone test: skipped — you were not here. A 2-minute test from your phone off wifi would prove the real-internet family sign-in by a person, not by me.

Licences: all 58 apps read

Most are open source. These need your word (nothing was hidden or changed):

App	The licence says	Choose: keep / hide / ask	I would
Tandoor	You may not sell a service whose value comes mostly from it (paid hosting and support named).		ask the authors; keep meanwhile
Emby	Personal, non-commercial use only. Jellyfin does the same job.		hide for new installs
SparkyFitness	Commercial use needs the author's written permission. (Decided: keep, ask.)	—	send the e-mail draft
n8n	Own or personal use is fine; giving it to others only free of charge.		keep
Plex	Your household is the licensee with its own Plex account.		keep
recipe-importer	Our own app — it has no licence file.		pick one

Four apps carry paid "enterprise" parts that stay switched off (Cal.com, Docmost, Outline, search in Wanderer), and seven apps use Redis 7.4 as a private cache. Both are fine as they run; I watch them.

SparkyFitness e-mail: drafted, NOT sent. The author has no public e-mail; the draft suggests their Discord. If no written permission arrives before the first paying customer, SparkyFitness gets hidden from new installs.

Also today

• A new golden (0.287.0). Baked early, because a box from the old golden would have shown the two apps without the gate until its first update. The catalog check now refuses that case.
• A bug in one catalog check, fixed: the check "does the app keep its data where we back it up" never actually talked to any app. Fixed and proven; all apps must be checked again (my next work).
• Rows. 3 closed, 14 opened (most are your licence choices). The list went from 422 to 436 rows.

What needs you

1. The licence table above: keep, hide or ask, per row. If you say nothing: everything stays offered.
2. Send the SparkyFitness request (the draft is ready). If you do nothing: it gets hidden before the first paying customer.
3. Removing an app "with data" keeps its files (Grimmory's books, MeTube's videos) in the household folder, and the dialog does not say so. Choose: keep them and say so on the dialog (I would), or delete the app's own folder too. If you say nothing: files stay, the dialog stays silent.
4. Demo box apps: I installed Grimmory and MeTube on demo-hp for the test and removed them after. Want them kept there for showing? If you say nothing: they stay removed.
5. One phone test (2 minutes), only if you want it: say so, and I put MeTube back on demo-hp and give you a family login; you open video.enkisfelhom.hu on your phone off wifi. If you say nothing: the proof stays my real-internet test from here.
6. Still open: Invidious and moonlight-web — I advise no to both. Pinchflat stays stopped (upstream paused).

Standing steps

• Monthly security re-test: last run 2026-10-01, next due ~2026-11-01. (You start it with the standing brief.)
• Weekly: the golden bake (next around 9 October; today's bake was 0.287.0).
• SparkyFitness: written permission from the author before the first paying customer, or lifecycle: hidden.
• Registry clean-up: only when the registry disk fills; "show me" mode first, then a person decides.