admin
a6a9f0b245
gates / gates (push) Successful in 26s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
58 lines
3.6 KiB
Markdown
58 lines
3.6 KiB
Markdown
# STATUS — what works, what's broken, what's next
|
|
|
|
**Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**
|
|
|
|
**Updated 2026-10-01. Both demo boxes run controller 0.285.0 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.285.0 with agent 0.138.0.**
|
|
|
|
**Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet.
|
|
|
|
## A decision I took myself (you may reverse it)
|
|
|
|
- **mealie: a stranger can now lock the household out for 1 to 2 hours, not a whole day.** mealie locks the account after
|
|
five wrong passwords, and its login name is public. I set the lock to mealie's shortest time (1 hour; its hourly
|
|
clean-up makes it up to 2). Tested on the scratch box: locked for 2 hours, then the right password worked. The guard
|
|
against password guessing stays. **What it does not fix:** a stranger can lock it again every hour. The other way would
|
|
be a secret login name, but that changes what the household types — so I did not do it.
|
|
|
|
## Your three decisions of today — built
|
|
|
|
- **The monthly security re-test covers every tested app (your 2A).** First full run today: **nextcloud and sonarr** had
|
|
a new build under the same name. Both passed on the test bench and on the scratch box, and are now in the catalog. Boxes
|
|
take them at night. It took about 17 minutes per app.
|
|
- **You start the monthly run (your 1A).** Give the standing brief `MONTHLY-security-retest.md` to CC once a month. The
|
|
runbook now says so.
|
|
- **A box keeps only two controller versions (your 3A).** The new controller 0.285.0 deletes the older ones. The HP demo
|
|
box went from 84 versions to 2 (Docker images 15.2 → 11.7 GB). The N100 went from 76 to 2 (6.1 → 1.1 GB). All apps kept
|
|
running. I checked first: if an update fails, the box goes back to the version it was running, and that one is always kept.
|
|
|
|
## What else I did, and it worked
|
|
|
|
- **A crash fixed.** The image clean-up after an app update could crash the controller if the app was removed right
|
|
after. The test suite found it. Fixed in 0.285.0.
|
|
- **Two test-tool fixes:** the digest check now refuses an image build that is gone, and the outline test works with
|
|
outline's newest version.
|
|
- **New controller 0.285.0** is on both demo boxes, and **a new golden 0.285.0** is baked and vouched. The golden check is
|
|
green.
|
|
|
|
## What broke, and what I did
|
|
|
|
- **The monthly re-test could not start on a fresh test bench.** It checked for its own files before it copied them. Fixed.
|
|
- **Four more apps can be locked by strangers like mealie:** calibre-web (up to a day), wger (30 minutes, and everyone at
|
|
once), Grafana (5 minutes), BookStack (1 minute). I read this in their code; not tested on a box yet. Written down.
|
|
- **Very old controller versions are gone from our own registry** (everything before mid-August). Nothing needs them
|
|
today. I do not know what removed them. Written down.
|
|
|
|
**Rows.** Today: 6 closed, 1 narrowed, 4 opened. The list went from 383 to 387 rows.
|
|
|
|
## What needs you
|
|
|
|
1. **Nothing urgent.** If you want the household to be safe from the hourly re-lock in mealie, say so: then I give it a
|
|
secret login name, and the app page shows it. If you do nothing, a stranger who keeps trying can keep mealie locked.
|
|
2. **Do you know what removed the old controller versions from the registry?** If you do nothing, I look at the Gitea
|
|
settings next time (read only).
|
|
|
|
## Standing steps
|
|
|
|
- **Monthly security re-test: last run 2026-10-01, next due ~2026-11-01.** (You start it with the standing brief.)
|
|
- **Weekly:** the golden bake (around 8 October).
|