felhom.eu/STATUS.md

STATUS — what works, what's broken, what's next

Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).

Updated 2026-10-01 (late night). Both demo boxes run controller 0.286.1 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.286.1 with agent 0.138.0.

Tester-2 — read only, from the hub. The customer record exists. Tester-2's box has not registered yet.

Tonight: the box tells visitors apart

• Before: through the internet every visitor looked like the same address. A stranger's 5 wrong passwords locked the whole family out of the box's own dashboard for a minute, and out of some apps.
• Now: the box sees each visitor's real address, and a stranger cannot fake it. Measured on demo-hp through the real internet path: a stranger's wrong passwords locked only that stranger.
• Apps: 19 apps would have believed a faked address. They are protected, in the same update. BookStack now locks only the stranger, measured. Home Assistant no longer treats every internet visitor as "at home".
• Not measured: a second outside address on the real internet path. The test machine abroad was refused by Cloudflare before it reached the box. A 2-minute test from your phone would close it.

The permanent family gate: tested, NOT built

• A gate with a login for each family member, in front of Grimmory and MeTube, passed every test on the scratch box.
• Strangers: they reached nothing, and their wrong guesses locked only themselves.
• Family: members stayed signed in for 30 days, logout worked, and the family login does not open the dashboard.
• E-readers: Kobo, KOReader and OPDS readers kept working with Grimmory's own login.
• Cost: under 1 ms per page. If the box's controller is down, the gated apps refuse — they never open.

Also tonight

• SparkyFitness passed most of the checklist. One problem: its licence forbids commercial use without the author's written permission (below).
• Two box fixes:
  • The health check now says "not checked" instead of "healthy" when it could not look.
  • A removed and restored app keeps its sign-up lock.
• A new golden. Fresh installs get today's version.

Rows. 4 closed, 12 opened. The list went from 410 to 422 rows.

What needs you

1. The permanent family gate: build it or not?
   • Go: 2 work sessions — the box first, then Grimmory and MeTube published behind it.
   • No-go: Grimmory stays unpublished, and MeTube is not built.
   • If you say nothing: nothing is built, and the next sessions do other work.
   • I would choose go. It also answers Grimmory and MeTube.
2. SparkyFitness's licence says "non-commercial use only".
   • A: hide it from new installs and ask the author for permission.
   • B: keep it offered while asking.
   • I would choose A.
   • If you say nothing: it stays offered.
3. Grimmory: publish behind the family gate (if go), or as it is now. Its lock is per visitor since tonight; read in its code, not yet measured.
4. One phone test (2 minutes): sign in to demo-hp's dashboard from your phone off wifi, while I lock out my own address. If you skip it, the second-address proof stays the simulated one.
5. Still open from before: Invidious and moonlight-web — I advise no to both. MeTube and Pinchflat are stopped.

Standing steps

• Monthly security re-test: last run 2026-10-01, next due ~2026-11-01. (You start it with the standing brief.)
• Weekly: the golden bake (around 8 October; tonight's bake was 0.286.1).
• Registry clean-up: only when the registry disk fills; "show me" mode first, then a person decides.