90 lines
6.4 KiB
Markdown
90 lines
6.4 KiB
Markdown
# REPORT — attended release run 2026-10-24: the hub's tokens locked, the hub out of the open backup, the iperf3 line test, the watch released
|
||
|
||
Brief: „the hub's tokens locked, the hub out of the open backup, an iperf3 line test via ep0, then the upload watch
|
||
released" (operator rulings 07:22 / 07:26, `CONTEXT.md`). Read first: `05` §16.2, `06` §4.5 / §5, `07`, `08` §9, the
|
||
spike `audits/SPIKE-upload-watch-2026-10-23.md`, the felhom-build-deploy skill. Evidence: `audits/line-test-2026-10-24/`.
|
||
|
||
## Five lines
|
||
|
||
1. **Hub tokens:** sealed in hub 0.168.0 and still working (demo-hp is served the same tunnel and API tokens it runs; the
|
||
template fetch works; the next ep0 copy holds 0 of 8 token values). The live file keeps old bytes in free space — your
|
||
call: accepted, written down, with the rule „copy hub.db only with VACUUM INTO".
|
||
2. **The hub is out of the open backup:** the hub volume reads `default: disabled`; the folder holds no copy of it (your
|
||
two deletions worked; nothing else is left). Tonight's job is the last proof (dated check 2026-10-25).
|
||
3. **The line test:** demo-hp measured **94.4 Mbit/s** (Tester 1 94.3, demo-felhom 92.6) — the night backup said „at
|
||
least 10".
|
||
4. **Live where:** hub 0.169.0 and controller 0.342.0 run on all three boxes (the global floor); agent 0.164.0 on all
|
||
three (vouched); demo-felhom's qBittorrent is limited to 46 Mbit/s. Only these three boxes report to the hub.
|
||
5. **You still do:** nothing for this run. Two rows wait for a design (below).
|
||
|
||
## What I asked you, and what you said
|
||
|
||
- Deploy hub 0.168.0 → yes. Deploy hub 0.169.0 → yes. Global floor 0.342.0 → yes. Agent vouch → done.
|
||
- The live file's old bytes → accept and write down (my first estimate of „2 minutes" was wrong; the disk writes ~1.3
|
||
MB/s, so a clean-up means an 8–20 minute hub stop).
|
||
- No host has the iperf3 program → the agent speaks iperf3 itself (nothing installed on hosts).
|
||
|
||
## Versions, digests, CI (by commit)
|
||
|
||
| Repo | Commit | What | CI |
|
||
|---|---|---|---|
|
||
| felhom.eu | `00031150` | hub 0.168.0 manifest + rulings | 2275 success |
|
||
| felhom.eu | `3363ffa8` | D40: the PVC label | 2276 success |
|
||
| felhom-agent | `f7e1dcb` | the line test | 2277 success |
|
||
| felhom-controller | `ed1011b` | the tested line in the watch | 2278 success |
|
||
| felhom.eu | `1a788f33` | docs, register, ep0 unit, hub `line_test` model | 2279 success |
|
||
| felhom-controller | `42cda07` | the start-line wording | 2283 success |
|
||
| felhom-agent | `08ca678` | CHANGELOG released, REPORT | (docs) |
|
||
| felhom.eu | `01bf4e83` | hub 0.169.0 manifest | (see the final push) |
|
||
| felhom-controller | `bddc477` | CHANGELOG released, REPORT | (docs) |
|
||
|
||
- **Hub 0.168.0** `sha256:3bfdecaa…` (from `5277d859`), deployed 05:39Z. **Hub 0.169.0** `sha256:fb9b2489…` (from
|
||
`1a788f33`), deployed 07:51Z; 30-minute watch: only info events, 0 errors.
|
||
- **Agent 0.164.0**: binary `1b803d8b70f8afbe1546f6989f35b6b0e29c9ed63f6acb3843d3c04ef0d24b2b`, bundle
|
||
`1d7b54d39d0c1aff682ba0c0a7f91aea0f9407a10d2f5a8bbfdc858d32c13341`, tag `v0.164.0`; signed `agent_update` to the three
|
||
boxes, self-check 76/76; vouched (hub page + `Artifact manifest set` line).
|
||
- **Controller 0.342.0** `sha256:d002d3b7…` (from `42cda07`); rc.2 on 9202; per-box floors → healthy on all three, box
|
||
checks and https-only green; global floor 08:29:19Z, MinAgent 0.158.1, read back on the hub log and page.
|
||
- **ep0:** `felhom-iperf3.service` (iperf3 3.18-2+deb13u2, already installed since 2026-07-03), one nftables line;
|
||
no answer on the internet (`:22` as the control), an answer in the tunnel. CVEs: four fixed in this build; two open
|
||
„minor" server DoS issues bounded by tunnel-only, TCP-only and systemd caps (`scripts/ep0-iperf3/README.md`).
|
||
|
||
## Rows
|
||
|
||
**Before 194, after 191; opened 2 (R-1249, R-1250), closed 5 (R-975, R-1244, R-1245, R-1246, R-1247).** R-1243 →
|
||
VERIFY (dated check 2026-10-25); R-1241 keeps only the homelab half.
|
||
|
||
## Observations
|
||
|
||
- The start-up VACUUM after a legacy seal cannot finish on the Longhorn disk; its comment said 2.8 s — FILED: R-1249.
|
||
- A qBittorrent that seeds all day keeps the uplink busy, so that box is never tested and gets no limit — FILED: R-1250.
|
||
- The live hub file's old token bytes — NOT-A-FINDING: accepted by the operator 2026-10-24 (`05` §16.2), every copy that
|
||
leaves is clean.
|
||
- Two pre-deploy hub snapshots in `/data/snapshots` held plain tokens — NOT-A-FINDING: they roll off (one already pruned
|
||
at 06:06Z; the other at the 12:00Z snapshot); same volume, same reader as above.
|
||
- The cross-repo wire gate refused the agent's new `line_test` field until the hub modelled it — fixed in the session
|
||
(hub 0.169.0 `sysfacts.LineTest`, the System page cell).
|
||
- My first ArgoCD sync used a wrong commit id — NOT-A-FINDING: it failed to fetch and changed nothing; redone.
|
||
- 9202 has no agent local API, so its controller cannot read a line test — NOT-A-FINDING: by design (scratch guest);
|
||
the qBittorrent proof moved to demo-felhom, where the product path runs.
|
||
- demo-hp's first watch minute could not resolve `plex` — NOT-A-FINDING: the known start-up race (2026-10-23).
|
||
- The family's line on demo-felhom's qBittorrent page was not seen live — NOT-A-FINDING: the household's password is not
|
||
CC's; the render is pinned by a test, and the text with the live value is in the evidence.
|
||
- Old rc controller images (other sessions) sit on 9202 — NOT-A-FINDING: a scratch guest; mine (rc.2) is removed.
|
||
- The hub's database is 530 MB, mostly report history (`host_reports` 305 MB, `reports` 128 MB) — NOT-A-FINDING here:
|
||
it is why a VACUUM is slow, recorded in R-1249.
|
||
|
||
## Teardown, three layers
|
||
|
||
- **Machine:** 9202 — the throwaway qBittorrent removed through the product (0 containers, 0 volumes), back on the
|
||
0.342.0 release, my rc.2 image removed. demo-hp's host — the probe binary deleted, nothing running.
|
||
- **Host / DooPlex:** the database copies I restored for the checks shredded; the 9202 password copy, the signed job
|
||
envelopes and the release clone shredded / removed. ep0 — the one planned change stays (`felhom-iperf3`); the backup
|
||
of the firewall file is `/etc/nftables.conf.bak-20261024-iperf3`.
|
||
- **Hub:** the three per-box floors cleared; the global floor 0.342.0 stays (the release).
|
||
|
||
## Instruction files, poster
|
||
|
||
No instruction file edited. System poster: a text-only change (ep0 also runs the tunnel-only line-test server) — the
|
||
facts file and the matching poster text edited in the same commit.
|