Files
felhom.eu/documentation/audits/update-night-2026-09-21/apps/vikunja/app-logs-after.txt
T
admin 9c69b3ff07
gates / gates (push) Successful in 27s
Update night: Phases 2-4 evidence — both engines, the unattended HOLD, and five new findings
Evidence off the machine at the end of the phases that produced it (R-320). Teardown follows.

PHASE 2 — the two database engines, through the REAL Update button:
- MariaDB 11.6 -> 12.3 on nextcloud: PROVEN, and pressed through the button for the first time.
  All four SPIKE-r459 observables: the datadir's own record moved 11.6.2 -> 12.3.3; the engine
  itself says "already upgraded ... no need to run mariadb-upgrade again"; the entrypoint says
  "Major version upgrade detected ... Check required!" and then STARTED and FINISHED it (not the
  `skipped due to $MARIADB_AUTO_UPGRADE` line R-459 feared); and the engine took its own
  pre-upgrade backup, 631 905 B. The seeded Nextcloud account read back.
- PostgreSQL 16 -> 17 on docmost: FAILED exactly as R-463 predicted and nobody had measured.
  5.1 s to held; the pin named 17 while nothing ran; the restore brought it back in 29.1 s.
  The engine's REFUSAL LINE was destroyed by failAndHold before any probe could read it, so it
  was REPRODUCED INDEPENDENTLY with a control on every step (R-320).

PHASE 3 — the bad days. B1 produced THE UNATTENDED HOLD, which this project has never had: the
caller pressed once with nobody watching, the app held after 312.9 s, and passes 2 and 3 pressed
nothing. B2 put the pin back on a pull failure in 1.0 s. B3 refused `busy` six times. B4 showed
there is NO single-flight — 5 of 5 updates ran at once and all ended honest. B5 cut the power in
`backing-up` and the box recovered itself and said so. B7 refused under the 2 GB floor. B9 found
R-458's risk narrower than the row states.

PHASE 4 — every badge on the box is TRUE, and the held app answers all four of Q4's questions.

FINDINGS, five new and three corrections to existing rows. The one that matters: R-618 is P1 —
two templates name a health probe the app does not answer, and because the guarded update waits
on that same probe, a SUCCESSFUL update ends by STOPPING a working app. Measured: tandoor served
HTTP 200 on the new version at four samples across five minutes and was then stopped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-21 22:13:57 +02:00

18 lines
2.3 KiB
Plaintext

vikunja | time=2026-09-21T21:26:24.321+02:00 level=INFO msg="No config file found, using default or config from environment variables."
vikunja | time=2026-09-21T21:26:24.322+02:00 level=WARN msg="config: service.jwtsecret is deprecated and will be removed in a future release. Please use service.secret instead."
vikunja | time=2026-09-21T21:26:24.322+02:00 level=INFO msg="Running migrations…"
vikunja | time=2026-09-21T21:26:24.322+02:00 level=INFO msg="Using SQLite database at: /db/vikunja.db"
vikunja | time=2026-09-21T21:26:24.356+02:00 level=INFO msg="Ran all migrations successfully."
vikunja | time=2026-09-21T21:26:24.356+02:00 level=WARN msg="No license key configured. Pro features have been disabled."
vikunja | time=2026-09-21T21:26:24.361+02:00 level=INFO msg="Mailer is disabled, not sending reminders per mail"
vikunja | time=2026-09-21T21:26:24.361+02:00 level=INFO msg="Mailer is disabled, not sending overdue reminders per mail"
vikunja | time=2026-09-21T21:26:24.361+02:00 level=INFO msg="Vikunja version v2.6.0"
vikunja | time=2026-09-21T21:26:24.361+02:00 level=INFO msg="CORS enabled with origins: http://127.0.0.1:*, http://localhost:*, https://tasks.enkisfelhom.hu"
vikunja | time=2026-09-21T21:26:24.389+02:00 level=INFO msg="HTTP server listening on :3456"
vikunja | time=2026-09-21T21:26:43.306+02:00 level=INFO component=http remote_ip=172.18.0.7 method=GET uri=/api/v1/info status=200 latency=506.135µs user_agent=Go-http-client/1.1
vikunja | time=2026-09-21T21:26:44.453+02:00 level=INFO component=http remote_ip=172.18.0.7 method=GET uri=/api/v1/info status=200 latency=241.036µs user_agent=Go-http-client/1.1
vikunja | time=2026-09-21T21:26:44.840+02:00 level=INFO component=http remote_ip=172.18.0.8 method=GET uri=/api/v1/info status=200 latency=231.067µs user_agent=curl/8.14.1
vikunja | time=2026-09-21T21:26:44.998+02:00 level=ERROR component=http remote_ip=172.18.0.8 method=POST uri=/api/v1/login status=403 latency=134.42926ms user_agent=curl/8.14.1 err="Wrong username or password"
vikunja | time=2026-09-21T21:26:45.160+02:00 level=INFO component=http remote_ip=172.18.0.8 method=POST uri=/api/v1/login status=200 latency=138.351197ms user_agent=curl/8.14.1
vikunja | time=2026-09-21T21:26:45.188+02:00 level=INFO component=http remote_ip=172.18.0.8 method=GET uri=/api/v1/projects/3 status=200 latency=3.350797ms user_agent=curl/8.14.1