84 lines
4.9 KiB
Markdown
84 lines
4.9 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
|
|
|
---
|
|
|
|
# REPORT — Day-0 artifact manifest: version dropdowns + auto-derived sha (hub v0.29.0)
|
|
|
|
**Date:** 2026-07-01 · **Repo:** `felhom.eu` (`hub/` + `manifests/`)
|
|
|
|
Removes the hand-copied sha256 from the Day-0 artifact manifest UI. The operator now **picks a version**
|
|
from a dropdown of what's actually in Gitea, and the hub **reads that version's sha256 from Gitea itself**
|
|
— no transcription, no stale checksums — while keeping the deliberate human "which version is approved"
|
|
gate (never auto-promotes "latest") and the hub as the checksum trust root.
|
|
|
|
## 1. Baseline → target
|
|
|
|
hub `v0.28.0` @ `ce26c9d` → **`v0.29.0`**. (Follow-up to the colleague-safety batch; motivated by the
|
|
manual manifest-bump toil flagged in the prior task.)
|
|
|
|
## 2. Feasibility verified against live Gitea (before coding)
|
|
|
|
- **List versions:** `GET /api/v1/packages/admin?type=generic&q=<pkg>` returns name+version — reflects
|
|
what's actually present (pruned olders gone). Live: felhom-agent `[0.52.0, 0.43.0]`, felhom-golden `[0.85.1]`.
|
|
- **sha without downloading:** `GET /api/v1/packages/admin/generic/<pkg>/<ver>/files` returns `sha256`
|
|
in metadata (agent `5bfc690c…`, golden file `golden.tar.zst` `f87031cc…`) — so the ~GB golden is
|
|
never fetched just to hash it.
|
|
|
|
## 3. Files changed + commits (on `main`)
|
|
|
|
- `hub/internal/gitea/gitea.go` (new) — read-only Gitea packages client: `ListVersions` (semver-desc),
|
|
`FileSHA256` (metadata, no download). `hub/internal/gitea/gitea_test.go` — httptest unit tests.
|
|
- `hub/internal/web/server.go` — `gitea` field + `SetGiteaClient`; `artifactChoices` helper; pkg/file
|
|
consts; `handleConfiguration` passes `AgentChoices`/`GoldenChoices`.
|
|
- `hub/internal/web/configs.go` — `handleSetArtifacts` reworked to derive the sha from Gitea
|
|
authoritatively (`resolveArtifactSHA`); refuses the save on a lookup failure.
|
|
- `hub/internal/web/templates/configuration.html` — version `<select>` dropdowns + read-only sha display
|
|
+ inline sync script; broadened the sha-failure flash.
|
|
- `hub/cmd/hub/main.go` — wires `SetGiteaClient` when registry creds are present.
|
|
- `manifests/hub.yaml` — image `0.28.0`→`0.29.0`.
|
|
- Commits: **`079a2cd`** (code + CHANGELOG), **`585f12e`** (manifest tag).
|
|
|
|
## 4. Green gate
|
|
|
|
`go build ./...`, `go vet ./...`, `go test ./...` — all clean (new `internal/gitea` tests pass:
|
|
filter+semver-sort, preferred-file match + fallback, non-200 → error).
|
|
|
|
## 5. Behaviour
|
|
|
|
- Operator picks a version → the read-only sha field mirrors that version's Gitea sha (inline JS). On
|
|
save the hub **re-derives the sha from Gitea** (a client-submitted sha is ignored) and stores it. A
|
|
Gitea lookup failure REFUSES the save (never stores a version with a wrong/blank checksum).
|
|
- "— none —" clears an artifact.
|
|
- **Graceful degradation:** without registry creds the form falls back to the previous manual text
|
|
inputs (keeps `render_test` + any credential-less deploy working).
|
|
- Trust model unchanged: the operator still deliberately chooses the version; the hub stays the checksum
|
|
trust root; "latest" is never auto-promoted (rationale in the design discussion — auto-latest would
|
|
move the trust root back to Gitea and could promote an RC/broken build).
|
|
|
|
## 6. Deploy + validation
|
|
|
|
- Image `gitea.dooplex.hu/admin/felhom-hub:0.29.0` built + pushed on 192.168.0.180; `manifests/hub.yaml`
|
|
bumped; ArgoCD `felhom` app hard-refreshed + synced → **Synced / Healthy**; `deploy/hub` rolled out to
|
|
`0.29.0`.
|
|
- Startup log confirms **`[INFO] Gitea artifact browser enabled (Day-0 version dropdowns)`** (registry
|
|
creds present → the client initialized).
|
|
- **Prior follow-up RESOLVED:** the served manifest is now **agent 0.52.0** / sha `5bfc690c…` (saved via
|
|
the operator UI earlier this session; `GET /api/v1/artifacts/demo-felhom` confirms). Fresh
|
|
`--cores`/`--memory` installs now fetch the cap-capable agent.
|
|
|
|
## 7. NOT yet visually confirmed — awaiting operator login
|
|
|
|
The hub pod restart cleared the in-memory session, logging the browser out; entering the operator
|
|
password is the operator's action (CC must not type credentials). **Please log in at
|
|
`https://hub.felhom.eu/configuration`** so the version fields can be visually confirmed as dropdowns
|
|
(agent `0.52.0`/`0.43.0`, golden `0.85.1`) with a read-only sha. All server-side signals (deploy healthy,
|
|
gitea client enabled, live API returns versions+sha, unit tests) are green.
|
|
|
|
## 8. Observations
|
|
|
|
- Registry creds + the `ARTIFACT_*` env survived the ArgoCD sync (present on the live deploy).
|
|
- The `ARTIFACT_*` env remains a seed-only fallback (fills an empty DB field); the DB value (set via the
|
|
now-dropdown UI) is authoritative.
|