felhom.eu/documentation/audits/website-dashboard-2026-10-08

Dashboard pictures for the website — evidence (2026-10-08)

The scene, and why it moved

1. 9202 updated to the fleet's controller (operator's word, 2026-10-08): /etc/felhom-controller-image …:0.301.0 → …:0.303.0 (old line kept as /etc/felhom-controller-image.bak-0.301.0 in the guest), bootstrap restarted; felhom-controller … 0.303.0 Up 13 seconds (healthy).
2. On 9202: Vaultwarden, Jellyfin, Nextcloud and Immich installed through the product (Immich's first pull was refused by ghcr.io „toomanyrequests"; the second try deployed). One whole-box backup press and one Tier-2 run: db_dump success, count 3; „Tier 2 run complete: 6 app(s)".
3. The 9202 pictures were not used. Every page carried a banner „+ 5 további figyelmeztetés" — nine disk-not-separate warnings (9202's „second drive" is a folder on the host's NVMe, plus earlier sessions' leftover app folders) and the hub-off warning. True for a scratch guest, not a household's normal state. The banner itself showed none of the five warnings it counted on those pages: R-906.
4. Pictures taken on demo-hp's household guest 9201 (operator: the physical boxes are test boxes too): controller 0.303.0, 10 standing apps, hub connected, no alerts (/api/debug/dump → alerts: []), last night's app backup success at 04:16. Read only; the household language was switched to English for the English pictures and back to Hungarian right after (both POSTs 302; read back lang="hu"). Headless Chrome ran on 9202, reaching 9201's traefik at 192.168.0.155; nothing ran on 9201.

The pictures (website/assets/, 1440 × 900, WebP q82)

File	Bytes
dashboard-start-hu.webp / -en	34,024 / 31,948
dashboard-apps-hu.webp / -en	59,018 / 54,156
dashboard-app-hu.webp / -en (Paperless-ngx)	83,124 / 78,992
dashboard-backups-hu.webp / -en (Backup → Apps)	52,638 / 45,292

Taken but not published: the backups overview, the System page, the phone view (captions-claims.md says why). The full-size PNGs stay out of the repository.

Privacy

privacy-scan.txt — every published picture's page text: 0 e-mails, 0 IPv4 addresses, 0 serials, no domain except the test domain enkisfelhom.hu and felhom.eu; the one long hex value is the hidden CSRF field (not visible). Positive control: an app name known to be on each page, found 8 of 8. By eye: the pictures show the test domain, app names and backup sizes/times; no person's name (the household is „Demo HP", shown only on the unpublished System page).

Clean-up (three layers)

• 9202: Vaultwarden, Jellyfin, Nextcloud, Immich removed through the product (stop + remove with drive data and backups; volumes gone, stack folders back to their template files). Paperless-ngx (running) and PrivateBin (stopped) — there before this task — left as found; the whole-box backup restarted Paperless and it came back healthy. /root/dash removed; the session cookie file shredded on both sides. The userdata/{immich,jellyfin,nextcloud} folders on the scratch drive hold earlier sessions' content (kept/, backups/) and were left. 9202 stays on 0.303.0 (operator-approved).
• 9201: nothing changed except the language round trip (ends Hungarian, as found).
• demo-hp host: only pct exec 9202/9201 -- … and pct list. Hub: nothing touched.

Decoy

decoy.txt — gate 19, mutation and failure line.