felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

TASK — PBS DR tier SLICE 1: ep0 tenantsync surface + hub provisioning (hub v0.44.0) — 2026-07-10

LIVE on k3s (Synced/Healthy, image 0.44.0, startup logs WG peer-sync enabled + PBS DR tenantsync enabled). NOT live-provisioned — no real customer was provisioned from this task; slice 2 (the agent apply-bridge) + the supervised Peti enable are pending. Builds on SPIKE-pbs-tier-provisioning (00afadc). Commits: ce6a566 (code) + 32ca1f6 (live fix + image bump).

What shipped

• ep0 surface (🛑 Viktor-approved, installed + smoked live): scripts/felhom-tenantsync.sh v1.0.0 as a SECOND forced-command key for felhom-peersync (own sudoers drop-in; peersync script + sudoers sha256 asserted byte-identical before/after). Ops: provision (existing token → typed token_exists; own-ns self-check with one regen retry then rollback), reissue (delete→recreate→ re-grant — delete purges token ACLs, the spike fact), fingerprint. Secret hygiene: the token secret rides stdout ONLY (all tool stdout → stderr; hub error paths never embed stdout). Smoke (throwaway spike-smoke, torn down): all ops green; live fix caught by the smoke — proxmox-backup-client --output-format json wraps as {"data":[…]} → ns-exists check fixed to (.data // .) and reinstalled before the hub ever used the surface. Orphan cleanup (spike flag #1): root@pam!spike token + /datastore/scratch DatastoreAdmin ACL removed; ep0 now holds exactly the real demo-felhom-01 tenancy.
• Hub internal/tenantsync: wgsync-twin SSH client (pinned host key, constrained HostKeyAlgorithms, per-op JSON exec, typed ErrTokenExists). Contract test TestErrors_NeverEmbedStdout pins the no-stdout-in-errors rule.
• Provisioning flow (web/pbsdr.go): config-form section "PBS DR tier (ep0)" → on enable+save (detached-ctx atom): WG peer existence check (the agent self-registers its key; absence fail-closes with "has not reported a WG key yet") → tenantsync provision → secret stored consume-once HOST-scoped (host_pbs_secrets, the one_time_secrets twin) → non-secret pbs_dr descriptor (enabled, storage_id, pbs_tunnel_ip, datastore, namespace, token_id, fingerprint) merged into the HOST desired_json + SetHostDesired generation bump. Already-provisioned re-save = success-no-op; disable = enabled:false descriptor, tenancy kept; Re-issue PBS credentials button = the F4 precedent (fresh consume-once secret + bump).
• Consume endpoint: POST /api/v1/hosts/{id}/pbs/consume-token — per-host key self-scoped (global = operator recovery); 200 exactly once → 404; a foreign key's 403 does NOT burn the secret. (Deviation: task spec wrote /host/{id}/…; implemented under /hosts/ matching every other agent-facing route — slice 2 must use the /hosts/ form.)
• Deploy: TENANTSYNC_SSH_KEY_FILE env + optional Secret/tenantsync mount (key generated on 180, moved into the Secret, local copy shredded); same endpoint addr + pinned host key as peersync.

Tests + red-proofs (all run, mutations reverted, gate green)

• Happy path: descriptor lands in desired_json + gen bump exactly 1; secret consumable once and absent from ConfigJSON/desired-state/captured logs (grep-asserts).
• Red-proof consume-once: dropping the consumed_at UPDATE → store test re-served "secret-1", API test returned 200 with the secret again → both FAIL as designed.
• Red-proof fail-closed: swallowing the applyPBSDR error in handleConfigUpdate → all four fail-closed subtests FAIL with 303 (half-enabled save).
• Red-proof idempotency: dropping the already-provisioned short-circuit → re-save re-keyed the token (2 provision calls), staged a fresh secret, bumped spuriously → FAIL.
• Also covered: foreign-host 403 non-burning, reissue rotation (old secret dead), disable no-op on second save, storage-id edit updates descriptor without re-provision, tenantsync client round-trip against an in-process SSH server incl. wrong-host-key refusal.
• UI leg: render tests (TestPBSDR_FormRendersState + suite) — the hub UI is password-gated, so render tests are the verification method per repo convention.

Operator follow-ups

• Slice 2 (agent apply-bridge) then the supervised Peti enable (floor + agent update first).
• The demo host's missing §4b step-3 storage ACL grants (spike flag #2) — re-assert before slice 2 codifies the self-grant.