felhom.eu/STATUS.md

STATUS — what works, what's broken, what's next

Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).

Updated 2026-10-01. Both demo boxes run controller 0.285.0 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.285.0 with agent 0.138.0.

Tester-2 — read only, from the hub. The customer record exists. Tester-2's box has not registered yet.

A decision I took myself (you may reverse it)

• mealie: a stranger can now lock the household out for 1 to 2 hours, not a whole day. mealie locks the account after five wrong passwords, and its login name is public. I set the lock to mealie's shortest time (1 hour; its hourly clean-up makes it up to 2). Tested on the scratch box: locked for 2 hours, then the right password worked. The guard against password guessing stays. What it does not fix: a stranger can lock it again every hour. The other way would be a secret login name, but that changes what the household types — so I did not do it.

Your three decisions of today — built

• The monthly security re-test covers every tested app (your 2A). First full run today: nextcloud and sonarr had a new build under the same name. Both passed on the test bench and on the scratch box, and are now in the catalog. Boxes take them at night. It took about 17 minutes per app.
• You start the monthly run (your 1A). Give the standing brief MONTHLY-security-retest.md to CC once a month. The runbook now says so.
• A box keeps only two controller versions (your 3A). The new controller 0.285.0 deletes the older ones. The HP demo box went from 84 versions to 2 (Docker images 15.2 → 11.7 GB). The N100 went from 76 to 2 (6.1 → 1.1 GB). All apps kept running. I checked first: if an update fails, the box goes back to the version it was running, and that one is always kept.

What else I did, and it worked

• A crash fixed. The image clean-up after an app update could crash the controller if the app was removed right after. The test suite found it. Fixed in 0.285.0.
• Two test-tool fixes: the digest check now refuses an image build that is gone, and the outline test works with outline's newest version.
• New controller 0.285.0 is on both demo boxes, and a new golden 0.285.0 is baked and vouched. The golden check is green.

What broke, and what I did

• The monthly re-test could not start on a fresh test bench. It checked for its own files before it copied them. Fixed.
• Four more apps can be locked by strangers like mealie: calibre-web (up to a day), wger (30 minutes, and everyone at once), Grafana (5 minutes), BookStack (1 minute). I read this in their code; not tested on a box yet. Written down.
• Very old controller versions are gone from our own registry (everything before mid-August). Nothing needs them today. I do not know what removed them. Written down.

Rows. Today: 6 closed, 1 narrowed, 4 opened. The list went from 383 to 387 rows.

What needs you

1. Nothing urgent. If you want the household to be safe from the hourly re-lock in mealie, say so: then I give it a secret login name, and the app page shows it. If you do nothing, a stranger who keeps trying can keep mealie locked.
2. Do you know what removed the old controller versions from the registry? If you do nothing, I look at the Gitea settings next time (read only).

Standing steps

• Monthly security re-test: last run 2026-10-01, next due ~2026-11-01. (You start it with the standing brief.)
• Weekly: the golden bake (around 8 October).