felhom.eu/REPORT.md

felhom.eu — task reports

Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.

---

REPORT — 3b-fix: Datastore.Audit box-wide (restore drive visibility) (host-install v1.7.0)

Date: 2026-07-01 · Repo: felhom.eu (scripts/ only) · Class: Risky/supervised (low risk — additive-first ACL change, no agent change, no agent stop).

Fixes a regression the v1.6.0 pool-scoped ACL introduced. Script-only; agent v0.53.0 unchanged.

1. Baseline → target

script v1.6.0 @ 1be1e0d → v1.7.0. Agent v0.53.0 unchanged (its observer was always correct).

2. Root cause

The agent enumerates storage via ListStorage/NodeStorage, both gated by Datastore.Audit (felhom-agent/internal/storage/observe.go). v1.6.0 put Datastore.Audit in the Store role, granted only per-storage on local/local-lvm/felhom-pbs — excluding the enrolled removable drives felhom-usb/felhom-flash. So ListStorage returned a filtered list missing the drives → the observer reported them detached (the "Meghajtó leválasztva" alerts) and the agent-view dropped them. Confirmed at source that the fix is Audit-only: the agent creates no PVE storage (no POST /storage / pvesm add / CreateStorage — the only /storage code is host-side NAS mounting); drives are dir-storages it observes (Datastore.Audit) + mounts via host ops + binds into the guest (VM.Config.Disk), never allocates VM disks onto. So drives need only Datastore.Audit (read-only), never Datastore.Allocate. The v1.6.0 swap's "felhom-usb → 403" was a regression, not blast-radius containment (felhom-usb is Felhom's own customer drive).

3. Files changed + commit

• scripts/felhom-host-install.sh: PVE_PRIVS_BASE += Datastore.Audit; PVE_PRIVS_STORE −= Datastore.Audit; apply_scoped_acl reordered Base-before-Store (gap-free re-apply). v1.6.0→v1.7.0.
• scripts/CHANGELOG.md, REPORT.md. Commit 457a5cd on main (parent 1be1e0d).
• bash -n OK; shellcheck clean (0 new; the 2 pre-existing SC2015 in step_verify unchanged).

4. Part 0 diagnosis (live, felhom-pve)

• Regression confirmed: scoped-token --selftest=read showed 3 storages (drives missing).
• Applied pveum role modify FelhomAgentBase -privs "Sys.Audit SDN.Use Datastore.Audit" (additive) → --selftest=read immediately showed 5 storages incl. felhom-usb/felhom-flash. Mechanism proven.
• Write-scope residual gate (S2): settled at source (no Datastore.Allocate in the drive enroll/format/mount path). A physical brand-new-drive UI enrollment (needs a spare USB) was NOT run — flagged as operator-confirmable; the path is host-ops/Audit-only and unchanged from pre-3b.

5. Live role privs after Part 2 (felhom-pve)

FelhomAgentBase  = Datastore.Audit, SDN.Use, Sys.Audit
FelhomAgentStore = Datastore.Allocate, Datastore.AllocateSpace   (Audit removed)
FelhomAgentGuest = Pool.Allocate, VM.Allocate, VM.Audit, VM.Config.*, VM.PowerMgmt, VM.Snapshot(.Rollback), VM.Backup

Applied Base-first then Store (gap-free); no agent restart. Drives remained visible after Store lost Audit (box-wide Base covers them).

6. Storage re-test (S1–S8)

#	Check	Result
S1	drive observation	✅ agent-view 3→5 storages; felhom-usb/felhom-flash back; detach alerts clear
S1b	drive readable under scoped token	✅ GET /storage/felhom-usb/content → 200 (was 403 under v1.6.0)
S2	new-drive enrollment (physical)	⏸ source-confirmed no Datastore.Allocate needed; physical USB test = operator (see §4)
S3	drive format + mount	⏸ host-ops (mkfs/mount via SudoHostOps) — ACL-independent; source-covered
S4	detach + re-attach	⏸ host-ops + observe — ACL-independent; not run on the live demo's data drives
S5	NAS / netstorage add	⏸ host-side mount (localapi/netstorage.go), no PVE Datastore priv — ACL-independent
S6	offsite backup → felhom-pbs + restore	✅ Store grant on /storage/felhom-pbs unchanged by this fix (3b-proven; re-confirmed intact)
S7	write-containment	✅ vzdump→felhom-usb → 403 (Datastore.AllocateSpace still per-storage); out-of-pool guest 9001 → 403
S8	in-guest features	✅ 9201 controller Up (healthy) — bind mounts, no PVE perm; unaffected

Live-proven: S1, S1b, S6, S7, S8. Source-confirmed (host-ops/Audit-only, no write priv needed): S2–S5.

7. Served script version

curl -fsSL https://felhom.eu/scripts/felhom-host-install.sh | grep SCRIPT_VERSION → 1.7.0.

8. 3b regression note (for CONTEXT)

The v1.6.0/3b swap validation logged "felhom-usb → 403" as blast-radius success. That was WRONG — it was the drive-visibility regression fixed here. Corrected understanding: the scoped token SHOULD be able to audit (read) every storage incl. Felhom's drives (via box-wide Datastore.Audit); containment is on write (Allocate/AllocateSpace per-storage) and on guests (VM.* at /pool/felhom). Both re-confirmed.

9. NOT yet live-validated — awaiting supervised run

• A physical brand-new-drive enrollment on the corrected layout (needs a spare USB on felhom-pve).
• The colleague's-box install (uses the corrected v1.7.0 layout from the start).

10. Observations

• Fresh installs get the corrected layout directly (Part 1). Existing installs: --rescope-acl now produces it too (inherits the priv sets); the live demo was repaired with two role modify commands (cheaper than a full re-rescope, which would needlessly recreate grants).
• The hub artifact-manifest bump to agent 0.53.0 (from the 3b REPORT) is still an OPEN operator follow-up for fresh installs — unaffected by this fix.