felhom.eu/REPORT-cloudflared-2026-10-26.md

REPORT — cloudflared 2026.10.3 on every box (R-1300), 2026-10-26 evening, attended

A sibling of REPORT.md: the night session (TASK-night-burndown-and-tuesday-2026-10-26.md) owns REPORT.md tonight.

In plain words

1. We run 3 cloudflared, one in each box's guest (Tester 1, demo-hp, demo-felhom). None on DooPlex. Tester4 has no tunnel; Tester 2 has no box.
2. The https-origin trap does not apply. Each tunnel sends to https://traefik with „No TLS Verify" on, and traefik shows its own self-signed certificate — not an eMudhra one.
3. 0.345.1 is on every box: 4 of 4 reporting controllers (the three above + Tester4); none left behind.
4. Longest tunnel gap: about 11 seconds (demo-hp). Tester 1 about 2 s, demo-felhom about 4 s.

Decisions: the operator said yes to the build-gate exception (build from a pushed tag) and to the global floor.

Versions, digests, CI

What	Value
controller tag v0.345.1	commit f3204024 = v0.345.0 6bfb784 + one commit; CI job 2393 success (attempt 1)
controller main	a1c65b3d (same bump + build.sh tag path); CI job 2392 success (attempt 1)
controller image 0.345.1 / :latest	sha256:7cfdf7e1f835628de9c7d536e0a60c06bad5bbe19e8133765cc0a6bb732dbff6
cloudflared	cloudflare/cloudflared:2026.10.3, index sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39
MinAgent	0.158.1 (unchanged, declared with the floor)
global floor	0.345.1 at 20:08:39Z (303 floor_set; read back from the running hub: „Effective floor: v0.345.1 — source: DB")
per-box floors	set 20:05:08Z (Tester 1), 20:06:04Z (demo-hp, demo-felhom); cleared 20:39:54Z

Tests and gates: controller gates --fast green on both commits; go test ./... green on the tag commit; the new reconcile test and the four build-gate cases red-proved. felhom.eu gates green on push. Methods: box state by docker ps/docker logs in each guest; tunnel state by the hub's Hosts page and by a public name with no app (cfprobe.<domain>: 404 = tunnel up, 530 = down), probed every 0.5–1 s from DooPlex.

Register

Rows before 213, after 214, opened 2 (R-1300, R-1301), closed 1 (R-1300).

Observations

• The N100 host's clock is 14 s slow; chrony fails at every boot — FILED: R-1301 (and lived-in/n100.md).
• I put a test run and a commit in one command on the detached tag clone (standing rule 1). The commit was local; the test result was then read on its own (green) before anything was pushed — NOT-A-FINDING: my slip, caught before push, recorded here.
• noTLSVerify on every tunnel route (R-510) — NOT-A-FINDING: a leg that never leaves the guest (cloudflared and traefik alone on the /29 tunnel network); now written in 01 as a recorded exception, with the rule „never turn off a certificate check to make an update work".
• cloudflared 2026.10.4 (today, VULN-176088: metrics debug endpoints allowlist) — NOT-A-FINDING: our metrics bind to the container's own loopback; not taken because it is under a day old and the notice names 2026.10.3.
• 0.345.1 is built with 0.345.0's Go builder; main moved to Go 1.27.3 tonight (R-972) — NOT-A-FINDING: R-972 owns it; the next release from main carries it.
• Single-sample 000 answers at 20:13:37 (both Tester 1 probes at once) and 20:17:13 (demo-hp) — NOT-A-FINDING: a client-side timeout, no 530; the hub and the boxes showed the tunnel up throughout.
• internal/stacks tests took 450 s under the night session's load (each R-442 remove test 26 s) — NOT-A-FINDING: CI green; slow only under load.
• Tester4's agent reads 0.167.0-night1 floor held on the Hosts page — the night session's agent; not touched.

What changed in documents

• architecture/01-topology-and-trust.md „Tunnel placement": the version, the rule, the recorded exception.
• architecture/11-os-updates.md C8: the new pin.
• STATUS.md: one line (released; main and Sunday's golden carry it). The golden 0.344.0 still has 2026.9.3; a new box moves to the floor in its first minutes. No extra bake (operator did not ask).
• System poster: none of the three needed — no fact on the poster changed (cloudflared still runs in the guest).
• Controller: build.sh may push from the pushed tag v<VERSION> (operator's yes). Controller report: felhom-controller/REPORT-cloudflared-0.345.1.md.

For the operator

• Nothing to do. If you want a second look: Cloudflare dashboard → Networking → Tunnels shows each connector's version (CC holds no Cloudflare token).

Teardown

Machine: the image pulled on scratch guest 9202 for the version check was removed. Host: nothing. Hub: the three per-box floors cleared; the global floor stays at 0.345.1 by design. Clones felhom-controller-sec, felhom-controller-mainsec and felhom.eu-cfsec on DooPlex are my work copies (all pushed); removed at the end.