9.5 KiB
REPORT — burndown 2: Data tab leftovers, plain http closed, the hub-key door removed, Go 1.27.2, the dead install-form branches (2026-10-16)
Written in ASD-STE100 Simplified Technical English. Operator brief „burndown 2", operator present.
Design read first: architecture/01-topology-and-trust.md §4 and §10 (now records R-970), 04-control-plane-authorization.md,
09-update-architecture.md §0 and the release rule. Evidence: documentation/audits/burndown2-2026-10-16/.
0. A decision I took (inside the brief; reversible)
The controller runtime stays on Debian 12 (12.13, all fixes) — not Debian 13. The brief said „the current Debian stable". Debian 13 changes restic, the off-site backup engine, from 0.14.0 to 0.18.0. The off-site code relies on measured 0.14.0 behaviour (a missing source path is only a warning, the progress output, the clean-up windows, restore without a lock). Changing it silently changes how customer backups behave. The Go toolchain and every fixable OS package are updated; the Debian 13 move is its own row with the re-proof (R-1105).
1. Each part
| Part | Result |
|---|---|
| 1 — Data tab leftovers | Done (controller 0.322.0). The export password field: autocomplete="new-password", name fab_encryption_key. The 2nd copy's status rows are gone; the form is the one place (its no-target reason moved into it); the warning stays. Browser (headless Chrome through the public address): the field renders with the attribute and stays empty; no status rows; one target label. Headless Chrome has no saved passwords, so the autofill itself is not proven — the attribute is. P1/ |
| 2 — plain http (R-1033, P1) | Closed. The hub's newest reports: demo-hp, Tester 1, demo-felhom on ≥ 0.321.0. https_only_check.py: 35 public names → 301 on all three. Tester 2 (sajatfelhom.hu, 0.292.0, off since 2026-10-04) is not checked: both http and https answer Cloudflare 530 (tunnel down). R-1104 checks it when it returns. P2/ |
| 3 — the box settings route (R-970, P2) | Closed. See §3. |
| 4 — Go and base images (R-972, P2) | Controller released, hub deployed on your yes, agent committed (no release). See §4. |
| 5 — dead install-form branches (R-1103, P4) | Closed. The installed-only branches of app_fields.html removed. Retired tests and where their rule is now: TestDeployPage_DeployedApp_DoesNotCarryTheSecret → TestAppPage_LoginPairPanel + TestR255_NoPlantedSecretReachesAnyPage; TestR709_AnInstalledAppsPasswordIsNotInThePage → the same two (its install-form half stays as TestR709_TheInstallFormKeepsItsGenerator); TestR694_TheDeployPageDoesNotOfferAGeneratedLogin → TestR694_TheSettingsTabDoesNotOfferAGeneratedLogin (new, red-proved); the parity cases deploy_installed and deploy_installed_restored. |
2. https check per box (P2/https-only.txt)
tester-1 13 names, demo-hp 14, demo-felhom 8 — each http:// → 301 to the same https:// address; the negative
control convicted. Tester 2: not checked (530, off).
3. The removed route (R-970)
- What: the routes that read and replaced the box's settings file, and the hub-key access to the self-update and geo routes (the dashboard keeps using those with a session). The matching CSRF exemption for the hub key is gone.
- Nothing called them: no caller in the hub (it never connects into a box; its geo switch goes to Cloudflare
directly), the agent, the controller's own pages, or any script in the five repos. The hub README listed „Push/Pull
Config", „Show Diff" and „Trigger Update" — no code exists for them; the four rows are removed.
02-controller-module-map.mdmarked config-apply as needing rework, not as a planned use. - Proof: the route table is now one function (
buildMux), andTestR970_HubKeyOpensNoDoordrives that real table with real servers: every method on every former door, with the box's key and no session, is refused, and a planted settings file is neither served nor changed. PlusTestR970_ConfigRoutesAreGoneandTestR970_HubKeyIsNoCSRFExemption. Each red-proved (redproof/). Live on demo-hp: every former door answers 401 with the box's own key (read inside the box, never printed);/api/health200 (P3/live-door-check.txt).
4. Go and base images (R-972)
| before | after | |
|---|---|---|
| controller binary | Go 1.24.13, x/crypto v0.31.0 | Go 1.27.2, x/crypto v0.58.0 |
| controller runtime | debian:bookworm-slim |
debian:12.13-slim@sha256:67b3… + apt-get upgrade (restic stays 0.14.0) |
| controller builder | golang:1.24-bookworm |
golang:1.27.2-trixie@sha256:4766… |
| hub | Go 1.24.13, x/crypto v0.31.0, alpine:3.21 |
Go 1.27.2, x/crypto v0.58.0, alpine:3.24.2@sha256:294b… (builder golang:1.27.2-alpine3.24@sha256:f92b…) |
| agent | Go 1.26.0 (binary 0.158.1), x/crypto v0.52.0 | go.mod Go 1.27.2, x/crypto v0.58.0 — committed, not released |
Scanners (the review's own tools: trivy 0.74.0, govulncheck v1.1.4):
| image | critical (fixable) | high (fixable) | govulncheck on the binary |
|---|---|---|---|
| controller 0.321.0 (before) | 16 (12) | 200 (64) | 62 |
| controller 0.322.0-rc.3 = the release's commit | 4 (0) | 140 (4) | 1 |
| hub 0.155.0 (before) | 0 (0) | 36 (36) | 62 |
| hub 0.156.0 | 0 (0) | 0 (0) | 1 |
The 4 remaining fixable highs are in Docker's own docker-compose plugin (its Go), not ours. The one govulncheck note
is x/crypto/openpgp, a package neither program links (go mod why), reported at module level. Full suites green on
Go 1.27.2 in all three repos (the i18n parity suite included).
Restic, measured on demo-hp: an off-site backup with restic 0.18.0 (rc.1, Debian 13) — „backup OK", 172 snapshots; then with 0.14.0 (rc.2) on the same store — „backup OK", 186 snapshots. The store stays readable both ways; the other 0.14.0 assumptions are not measured on 0.18 → R-1105.
5. Versions, commits, fixtures, rows
- felhom-controller
8fe46a1→f037be7(R-970, Data tab, R-1103) →fc77fcb(Go 1.27.2) →52619e8(Debian 12.13) →e9d0d72(CHANGELOG,apt-get upgrade) → docs. Test images rc.1 (Debian 13), rc.2, rc.3 (demo-hp only); release 0.322.0, MinAgent 0.158.1. - felhom.eu
836d64ef→9d6f3b46(hub 0.156.0) → this commit. Hub 0.156.0 deployed on the operator's yes (6999c15f, manifest tag only): see §5a. - felhom-agent
dd8b2ac→37b99d7(Go 1.27.2, not released). - Fixtures re-captured (8):
app_data_deployed,app_data_export,app_data_notarget_disabled,app_data_target_auto,app_data_target_ssd,deploy_new,deploy_new_blocked,deploy_new_memory_blocked(the last three: whitespace only, plus one test-data option production never renders). Removed (2):deploy_installed,deploy_installed_restored. Every other fixture byte-identical. - Rows: before 175, after 174. Closed 3 (R-1033, R-970, R-1103). Opened 2 (R-1104, R-1105). R-972 NARROWED.
The release (release/): Tester 1, demo-hp and demo-felhom took 0.322.0 through per-box floors (all three on it at
19:01). Nothing unhealthy, restarting, exited or created; the three dashboards 200; https-only 35 names OK; restic 0.14.0
in each controller. Global floor 0.322.0 / MinAgent 0.158.1 at 19:04:50 (303 → flash=floor_set); the three
per-box floors cleared. Read back on two channels: the hub's own /configuration page, and one tar of hub.db +
-wal + -shm (integrity ok, newest report 12 min old): min_controller_version 0.322.0, …declared_min_agent
0.322.0=0.158.1, the three per-box floors empty.
5a. The hub deploy (operator's yes, 2026-10-16)
manifests/hub.yaml tag 0.155.0 → 0.156.0 (6999c15f). ArgoCD hard refresh: only Deployment/hub out of sync; only it
was synced. Synced/Healthy at the pushed revision; the pod runs felhom-hub:0.156.0, 0 restarts; its log says
felhom-hub 0.156.0 starting, no error line. Positive observables: reports from demo-felhom, demo-hp and Tester 1 at
19:27 and 19:31 (the hub's log); the hub's /configuration page (HTTP 200) shows 0.322.0 and 0.158.1
(release/hub-page-floor.txt); a database copy with its WAL after the start (release/hub-0.156.0-after-deploy.txt).
CI: every commit of this task green by job. The controller docs commit failed first (job 1959): its CI read the
register before the felhom.eu push that added R-1105; re-run after that push, green.
6. Observations
- Tester 2 is not checked for plain http while it is off. FILED: R-1104
- Debian 13 would move the off-site engine to restic 0.18.0 with assumptions measured on 0.14.0. FILED: R-1105
- govulncheck names
x/crypto/openpgpin both new binaries. NOT-A-FINDING: neither program links it (go mod why: not needed); the report is module-level because the binaries are stripped. - The parity case
deploy_new_memory_blockedset „the current drive is missing" on a NOT-installed app, which the handler never does. NOT-A-FINDING: test data only; the re-captured fixture now shows what production renders. - The Samba image (48 fixable high in the review) was not rebuilt in this task. NOT-A-FINDING: it is already named in R-972, which stays NARROWED for it.
7. Teardown (three layers)
- Machine: demo-hp 9201 ran rc.1, rc.2, rc.3, then the release by the floor; two by-day backup runs (off-site included). The door-check script ran inside the controller container and was removed; the key never left the box.
- Host: nothing.
- Hub: per-box floors set and cleared; the global floor raised (the release). Hub 0.156.0 deployed (only
Deployment/hubsynced).