felhom.eu/REPORT-security-review-2026-10-12.md

REPORT — security review 2026-10-12, parts 1 and 2

Written as REPORT-<topic>.md, not REPORT.md: other sessions worked in this repository at the same time (CLAUDE.md, „two sessions clobber each other").

In plain language

• Is the hub closed now? Yes. The old master key is dead (rotated with your yes). The open customer page needs the master key since hub 0.148.0, which is live and checked.
• Did anyone use the holes? Cannot tell. The logs cover only 2026-10-12 from about 09:54, and one day in June. The holes were open since February 2026 — about 238 days that no log shows.
• You must decide four things (STATUS.md, D1–D4): change every box's root password (my pick: yes); a box-side check on catalog changes (my pick: yes); the zero-knowledge wording (my pick: change it now); root password SSH from the LAN (my pick: key only).
• Next tasks, in order: R-954 (your decision) → R-970 (remove the box's settings-file route) → R-972 (patched Go and base images) → R-971 (catalog check) → R-952 (hub route guard test) → R-953 (ArgoCD prune danger) → the medium rows.

What did not go as written

• The safety filter stopped this session three times — while writing the first findings table, the hub route-guard test (Scenario D), and the Part 2 log search. As the operator ruled, each became short register rows: R-952 (route guard), R-954 (the log question). The detailed working notes are off-git: /mnt/5_hdd/felhom.eu/evidence/security-review-2026-10-12-PRIVATE/.
• The live cross-box GETs (Part 3) were not run. The source and unit tests answer the question; the live check is in R-955.
• One red-proof, not five, for the new cross-box tests (R-955).
• A gate test wrote into the shared repository when this session pushed from a git worktree: four test commits in the worktree and user.name d in the shared .git/config (two other-session commits carry that author). The session removed the [user] section, stopped pushing from the worktree, and pushed from a normal clone instead. Noted on R-935 (the core.bare flips another session filed).
• Register ids R-934/R-935 collided with another session; this session's rows moved to R-950–R-955 and R-970–R-987.

Baselines

felhom.eu 0d463a85 at the start of part 2 (hub 0.147.0 live, no unreleased hub code after its release commit 655f5f66); controller dcd89364a4; agent 86adbcaf8a. ArgoCD: the hub was Synced; three Secrets and Deployment/umami OutOfSync (R-953).

Release — hub v0.148.0

• Commits: b67b8cea (code), 8d34d607 (manifest). Built from a clean clone at b67b8cea (the shared clone held another session's unpushed commit, so the build script's own pull could not run; the script was used unchanged except for the source folder).
• ArgoCD: a sync of Deployment/hub only, no prune; operation Succeeded at 8d34d607. Image gitea.dooplex.hu/admin/felhom-hub:0.148.0, pod Ready. The three Secrets are still present.
• Live check (audits/security-review-2026-10-12/evidence/hub-0.148.0-live-check.txt): no credential → 403 on all three routes, no customer in the body; the master key → 200.
• All three boxes reported after the restart (controller and agent reports), 0 auth failures in the hub log.

Tests

• TestCustomersRoutes_NoCredentialIsRefused, …_BoxKeysAreRefused, …_GlobalKeyUnchanged — pass. Red-proof: with the check removed from handleCustomer, the first failed (GET /customers/c1 answered 200).
• Five cross-box tests (crossbox_refusal_test.go) — pass. Red-proof on the restore-directive test: with its host check disabled it failed (another box's key got 200). The first try was masked by a later check; the test now arms recovery mode so only the host check can refuse.
• Hub test functions: 1079 before → 1087 after. Green gate: go build, go vet, go test ./... in hub/ pass.

Part 2 — logs

log	oldest line it holds
ingress-nginx controller, rotated files on DooPlex	one file 2026-06-10 08:08–16:44; then 2026-10-12 09:54 onward
hub pod log	only the current pod (2026-10-12 ~16:57 onward); older pods' logs are gone
central log store	none exists on DooPlex
Cloudflare	none: hub.felhom.eu is not proxied by Cloudflare

The search for strange addresses was not completed (see above). Blind window: from 2026-02-16 (the key's first commit) to 2026-10-12 09:54 — about 238 days. FILED: R-954.

Register

Rows before this part: 97. After: 119. Opened: 22 open (R-952–R-955, R-970–R-987) plus 2 born closed (R-950, R-951, in CLOSED-ITEMS.md). Closed: 2. Noted: R-935, R-132, R-908. (Other sessions also changed the register today; these numbers count this session's rows.)

Observations

• Hub key exposure — FILED: R-950 (closed, rotated).
• Open customer routes — FILED: R-951 (closed, hub 0.148.0).
• Route guard missing — FILED: R-952.
• ArgoCD would prune live Secrets — FILED: R-953.
• Exposure window not visible — FILED: R-954.
• Cross-box check not fully proven — FILED: R-955.
• Part 1 findings — FILED: R-970 to R-987 (see FINDINGS.md).
• Gate test writes into the real repo from a worktree — NOT-A-FINDING here: a note on R-935, which owns it.
• Hub login hash in the public manifest — NOT-A-FINDING here: a note on R-132.
• gitleaks misses R-908's key — NOT-A-FINDING here: a note on R-908 and input to R-986.
• Old registry token and old Resend key in history — NOT-A-FINDING: both rotated (checked by hash / last eight characters).
• System poster: no fact in felhom-system-poster.facts.md changed.

Teardown

Machines: nothing provisioned; demo-hp was only read. Host: none. Hub: one release (0.148.0) and the key rotation; no other change. DooPlex files: the private evidence folder, the scanner tools under /mnt/5_hdd/felhom.eu/tools/security/, the git worktree and clone under /mnt/5_hdd/felhom.eu/wt/, and a copy of the build script (build/felhom-hub/build-0.148.0-from-clean-clone.sh).