felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md.

---

REPORT — Configuration-tab move + online setup command + vmid auto-detect (hub v0.28.0 / host-install v1.2.0)

Date: 2026-07-01 · Repo: felhom.eu (hub/ + scripts/ + manifests/)

Three operator-requested improvements.

Baselines

hub v0.27.0 @ 54daaf9 → v0.28.0; scripts/felhom-host-install.sh v1.1.0 → v1.2.0. Trunk-based main. Commits: 562c0df (Parts A/B/C code), 629196c (hub image manifest), b77df3c (script header version).

Part A — global settings moved to the Configuration tab

The two global cards ("Managed updates — global floor", "Day-0 artifacts — agent & golden") were on the Customers page; they now live on Configuration.

• internal/web/server.go — handleConfiguration supplies GlobalFloor + Artifacts + CSRFField; the two POST routes moved to /configuration/global-floor + /configuration/artifacts.
• internal/web/configs.go — handleSetGlobalFloor/handleSetArtifacts redirects /configs?flash=… → /configuration?flash=… (5 redirects); handleConfigList data trimmed to {Customers, ActiveNav, Flash} (dropped the now-unused GlobalFloor/Artifacts/CSRFField; globalFloor still computed for per-customer effective-floor).
• templates/configuration.html — the two cards + their 5 flash banners added. templates/configs.html — cards + flashes removed; back to customer list + "Add Customer".
• internal/web/render_test.go — updated: asserts the global cards are gone from configs.html and present (with /configuration/* actions + a flash) on configuration.html.

Part B — online setup command + serving fix + passphrase hardening

• B1 (scripts/…): read_passphrase now reads read -rsp … < /dev/tty — the no-echo prompt works whether the script is a local file or piped to bash. --passphrase-file unchanged; passphrase still never on argv/logs/state.
• B2 (serving): https://felhom.eu/scripts/felhom-host-install.sh was 404 — the webpage nginx doc-root is .../current/website and git-sync only synced /website/. Fixed in manifests/webpage.yaml: added /scripts/ to the git-sync sparse-checkout + an nginx location /scripts/ { root .../current; default_type text/plain; }. Single source of truth (the repo's /scripts), no duplicated copy. Now 200 (verified live, serves SCRIPT_VERSION="1.2.0").
• B3 (customer_unified.html): new "Option 1: Online install (recommended)" — download-then-run (curl -fsSL … -o … && sudo bash … --customer-id {{.CustomerID}}) with a copy button; the passphrase is not templated (entered at the prompt). Former local-file command demoted to Option 2, debug curl to Option 3. Rationale note: fetched over TLS, inspect-before-run — not curl | sudo bash.

Part C — vmid auto-detect (scripts/…)

• New VMID_EXPLICIT flag (set by --vmid). The pre-flight guard now determines "in use" against the pct list + qm list id-set (LXC + VMs share the space) via new helpers used_vmids / _vmid_in_use / next_free_vmid.
• explicit --vmid + in use → deterministic: die unless --force.
• default 9201 + in use + no --force → auto-pick the next free id (scan upward) + confirm from /dev/tty ([y/N]); die "no free vmid confirmed" on decline. Never silent.
• default 9201 + --force → destructive over-provision, no prompt.
• --vmid help + usage() range updated (and usage now reaches -h, --help).

Green gates

• Hub: go build ./... && go vet ./... && go test ./... — all ok (incl. the updated TestTemplates_FloorRender).
• Script: bash -n clean. shellcheck (koalaman container on the build server): my additions clean; the only output is 2 pre-existing SC2015 info notices (lines 833/843, unrelated verify functions — present in HEAD, not touched). Local unit test of next_free_vmid (3 cases) passes.

Deploy

hub image :0.28.0 built+pushed on 180; manifests/hub.yaml bumped; ArgoCD felhom synced → Synced/Healthy; deploy/hub on :0.28.0. felhom-webpage rollout-restarted so it re-clones with the new sparse-checkout (/scripts/) + new nginx config.

Live proofs

• Part A (claude-in-chrome, operator-authed): Configuration tab shows both cards with current values (global floor v0.87.0; agent 0.43.0 / golden 0.85.1); "Save global floor" → /configuration?flash=floor_set with the green "Controller-version floor saved." banner (persist + flash on Configuration). The Customers page shows only the customer list + "Add Customer" (cards gone; footer 0.28.0).
• Part B (curl + browser): curl https://felhom.eu/scripts/felhom-host-install.sh → HTTP 200, serves SCRIPT_VERSION="1.2.0". The customer page (demo-felhom) shows Option 1 online install with the id filled + copy button, Option 2 local, Option 3 debug — passphrase not in Option 1.
• Part C (SSH, felhom-pve): the deployed script's own vmid functions against real pct+qm: used-set {9000,9001,9100,9201,9999}, 9201 in use → next_free_vmid=9202 (verified genuinely free). The actual guard block (extracted from the served script): explicit+no-force → deterministic die; default+no-force → logs "next free vmid is 9202" + prompts on /dev/tty → clean die "no free vmid confirmed" on no-confirm; default+--force → destructive-over-provision warning, no prompt. (A fully interactive real run isn't automatable now that both prompts read /dev/tty; the guard was proven with real host state + the real code path.)

Observations

• The /dev/tty reads make the script prompts unattended-proof by design — so an automated run past the prompts isn't possible; Part C was proven via the real functions/guard against live pct+qm.
• shellcheck shows 2 pre-existing SC2015 info notices unrelated to this change (left untouched — fixing them would alter unrelated verify logic).
• The customer page still renders the retrieval passphrase in the debug Option 3 + the credential box (pre-existing); the new Option 1 deliberately does not.

Remaining audit follow-ups (unchanged)

Controller-side geo intent sync; a read-only reported-vs-desired "Show Diff"; the cosmetic controllerURL cleanup in configs.go.