105 lines
6.4 KiB
Markdown
105 lines
6.4 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md).
|
|
|
|
---
|
|
|
|
# REPORT — Configuration-tab move + online setup command + vmid auto-detect (hub v0.28.0 / host-install v1.2.0)
|
|
|
|
**Date:** 2026-07-01 · **Repo:** `felhom.eu` (`hub/` + `scripts/` + `manifests/`)
|
|
|
|
Three operator-requested improvements.
|
|
|
|
## Baselines
|
|
|
|
hub `v0.27.0` @ `54daaf9` → **`v0.28.0`**; `scripts/felhom-host-install.sh` `v1.1.0` → **`v1.2.0`**.
|
|
Trunk-based `main`. Commits: `562c0df` (Parts A/B/C code), `629196c` (hub image manifest), `b77df3c`
|
|
(script header version).
|
|
|
|
## Part A — global settings moved to the Configuration tab
|
|
|
|
The two **global** cards ("Managed updates — global floor", "Day-0 artifacts — agent & golden") were on
|
|
the Customers page; they now live on Configuration.
|
|
|
|
- `internal/web/server.go` — `handleConfiguration` supplies `GlobalFloor` + `Artifacts` + `CSRFField`;
|
|
the two POST routes moved to `/configuration/global-floor` + `/configuration/artifacts`.
|
|
- `internal/web/configs.go` — `handleSetGlobalFloor`/`handleSetArtifacts` redirects `/configs?flash=…`
|
|
→ `/configuration?flash=…` (5 redirects); `handleConfigList` data trimmed to `{Customers, ActiveNav,
|
|
Flash}` (dropped the now-unused `GlobalFloor`/`Artifacts`/`CSRFField`; `globalFloor` still computed for
|
|
per-customer effective-floor).
|
|
- `templates/configuration.html` — the two cards + their 5 flash banners added. `templates/configs.html`
|
|
— cards + flashes removed; back to customer list + "Add Customer".
|
|
- `internal/web/render_test.go` — updated: asserts the global cards are **gone** from configs.html and
|
|
**present** (with `/configuration/*` actions + a flash) on configuration.html.
|
|
|
|
## Part B — online setup command + serving fix + passphrase hardening
|
|
|
|
- **B1 (`scripts/…`):** `read_passphrase` now reads `read -rsp … < /dev/tty` — the no-echo prompt works
|
|
whether the script is a local file or piped to bash. `--passphrase-file` unchanged; passphrase still
|
|
never on argv/logs/state.
|
|
- **B2 (serving):** `https://felhom.eu/scripts/felhom-host-install.sh` was **404** — the webpage nginx
|
|
doc-root is `.../current/website` and git-sync only synced `/website/`. Fixed in
|
|
`manifests/webpage.yaml`: added `/scripts/` to the git-sync sparse-checkout + an nginx
|
|
`location /scripts/ { root .../current; default_type text/plain; }`. Single source of truth (the repo's
|
|
`/scripts`), no duplicated copy. **Now 200** (verified live, serves `SCRIPT_VERSION="1.2.0"`).
|
|
- **B3 (`customer_unified.html`):** new **"Option 1: Online install (recommended)"** — download-then-run
|
|
(`curl -fsSL … -o … && sudo bash … --customer-id {{.CustomerID}}`) with a copy button; the passphrase is
|
|
**not** templated (entered at the prompt). Former local-file command demoted to Option 2, debug curl to
|
|
Option 3. Rationale note: fetched over TLS, inspect-before-run — not `curl | sudo bash`.
|
|
|
|
## Part C — vmid auto-detect (`scripts/…`)
|
|
|
|
- New `VMID_EXPLICIT` flag (set by `--vmid`). The pre-flight guard now determines "in use" against the
|
|
**`pct list` + `qm list`** id-set (LXC + VMs share the space) via new helpers `used_vmids` /
|
|
`_vmid_in_use` / `next_free_vmid`.
|
|
- **explicit `--vmid` + in use** → deterministic: die unless `--force`.
|
|
- **default 9201 + in use + no `--force`** → auto-pick the next free id (scan upward) + **confirm** from
|
|
`/dev/tty` (`[y/N]`); `die "no free vmid confirmed"` on decline. Never silent.
|
|
- **default 9201 + `--force`** → destructive over-provision, no prompt.
|
|
- `--vmid` help + `usage()` range updated (and usage now reaches `-h, --help`).
|
|
|
|
## Green gates
|
|
|
|
- Hub: `go build ./... && go vet ./... && go test ./...` — all `ok` (incl. the updated
|
|
`TestTemplates_FloorRender`).
|
|
- Script: `bash -n` clean. `shellcheck` (koalaman container on the build server): my additions clean;
|
|
the only output is **2 pre-existing** SC2015 *info* notices (lines 833/843, unrelated verify
|
|
functions — present in HEAD, not touched). Local unit test of `next_free_vmid` (3 cases) passes.
|
|
|
|
## Deploy
|
|
|
|
hub image `:0.28.0` built+pushed on 180; `manifests/hub.yaml` bumped; ArgoCD `felhom` synced →
|
|
**Synced/Healthy**; `deploy/hub` on `:0.28.0`. `felhom-webpage` rollout-restarted so it re-clones with
|
|
the new sparse-checkout (`/scripts/`) + new nginx config.
|
|
|
|
## Live proofs
|
|
|
|
- **Part A (claude-in-chrome, operator-authed):** Configuration tab shows both cards with current values
|
|
(global floor v0.87.0; agent 0.43.0 / golden 0.85.1); "Save global floor" → `/configuration?flash=floor_set`
|
|
with the green "Controller-version floor saved." banner (persist + flash on Configuration). The Customers
|
|
page shows only the customer list + "Add Customer" (cards gone; footer `0.28.0`).
|
|
- **Part B (curl + browser):** `curl https://felhom.eu/scripts/felhom-host-install.sh` → **HTTP 200**,
|
|
serves `SCRIPT_VERSION="1.2.0"`. The customer page (`demo-felhom`) shows Option 1 online install with the
|
|
id filled + copy button, Option 2 local, Option 3 debug — passphrase not in Option 1.
|
|
- **Part C (SSH, felhom-pve):** the deployed script's own vmid functions against real `pct`+`qm`:
|
|
used-set `{9000,9001,9100,9201,9999}`, 9201 in use → `next_free_vmid`=**9202** (verified genuinely free).
|
|
The actual guard block (extracted from the served script): explicit+no-force → deterministic die;
|
|
default+no-force → logs "next free vmid is 9202" + prompts on `/dev/tty` → clean `die "no free vmid
|
|
confirmed"` on no-confirm; default+`--force` → destructive-over-provision warning, no prompt. (A fully
|
|
interactive real run isn't automatable now that both prompts read `/dev/tty`; the guard was proven with
|
|
real host state + the real code path.)
|
|
|
|
## Observations
|
|
|
|
- The `/dev/tty` reads make the script prompts unattended-proof by design — so an automated run past the
|
|
prompts isn't possible; Part C was proven via the real functions/guard against live `pct`+`qm`.
|
|
- shellcheck shows 2 pre-existing SC2015 *info* notices unrelated to this change (left untouched — fixing
|
|
them would alter unrelated verify logic).
|
|
- The customer page still renders the retrieval passphrase in the debug Option 3 + the credential box
|
|
(pre-existing); the new Option 1 deliberately does not.
|
|
|
|
## Remaining audit follow-ups (unchanged)
|
|
|
|
Controller-side geo intent sync; a read-only reported-vs-desired "Show Diff"; the cosmetic `controllerURL`
|
|
cleanup in `configs.go`.
|