felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

TASK H1 — OOB operator access (hub + installer + endpoint half) — hub v0.35.0 (2026-07-05)

Baseline: felhom.eu @ a3ee93e → pushed. Hub 0.34.1 → 0.35.0 (live via ArgoCD). Agent half = felhom-agent v0.72.0. The merged E1+H1 operator-SSH-access feature. Provenance: both SPIKE-{felhom-sshd,oob-wg-operator-peer}-2026-07-05.

Shipped

• Operator OOB peer (store/wg_operator.go): the fleet operator peer as an UNBOUND wg_peers row (host_id '', note operator-oob) at an EXPLICIT /32; validated; last-write-wins rotation; rides ListWGPeers → peersync pushes it to the endpoint. PUT/GET /admin/wg/operator-peer (global key); PUT also takes ssh_pubkey (hub_settings) + bumps every host's generation.
• Desired-state (api/wg.go mergeWireguard): the served wireguard block gains oob_peer_ip (rendered into the box's AllowedIPs — survives self-heal [OF-1]) + oob_operator_ssh_key (agent writes felhom-sshd's authorized_keys). Absent operator peer → byte-identical pass-through.
• OOB health (monitor/host_oob.go): ingests the agent oob heartbeat stanza; transition-based oob_degraded/oob_recovered warning (felhom-sshd down while the operator peer is configured, OR config invalid). Unconfigured OOB never alerts.
• host-install (scripts): --enable-oob + install_oob install the static felhom-sshd + belt + felhom-op user (RuntimeDirectory-guarded); uninstall removes them.
• Doc 06 §4.5/§4.6 amended: forwarding ON but per-pair allow-listed, box↔box drop now explicit; the oob health stanza + oob_degraded alert. Endpoint runbook §9 added (forward chain + operator peer registration).

Tests + red-proofs (all green: go build/vet/test ./...)

• store: operator-peer round-trip/rotate/unbound + validation (reserved/taken/out-of-subnet); merge includes oob_peer_ip when configured (absent = byte-identical).
• api: operator-peer PUT self-scoped-global-only; ssh_pubkey validation.
• monitor: degraded/recovered transitions; config-invalid alerts; unconfigured-never-alerts; no-stanza-ignored. Red-proof: neuter the emit → the alert test fails.

Live validation (felhom-pve + dev endpoint)

Endpoint set up first (ip_forward=1 + per-pair forward chain + operator peer registered → pushed to wg0). Both spikes' key probes re-run as acceptance — all pass: operator→box SSH as felhom-op with scoped sudo; the OF-1 self-heal /32 survival; coexistence (stock :22 PID 922 unchanged, distinct host keys, felhom-op denied on :22); the belt (LAN→port dropped, :22 untouched); box↔box drop (counter) + peersync survival; PBS unaffected throughout; the healthy oob stanza reaches the hub + oob_degraded/oob_recovered fired around a real felhom-sshd downtime. Full detail + the 5 live-found-and-fixed agent bugs: felhom-agent REPORT.md.

Notes

• CGNAT still unproven; IPv6/AAAA out of scope; operator-key auto-rotation is a manual re-PUT; the "customer network fully down" case is explicitly OUT OF SCOPE / accepted risk. Operator (global) key = hub report_api_key. felhom-pve's operator peer + felhom-sshd + endpoint forwarding stay live.