113 lines
8.6 KiB
Markdown
113 lines
8.6 KiB
Markdown
# REPORT — night 2026-10-16 → 17: restore after a reinstall · restic 0.19.1 · small fixes · dashboard hardening
|
||
|
||
Written in ASD-STE100 Simplified Technical English. Brief: the night task of 2026-10-16 (operator decisions 1A and 2A,
|
||
21:57). Design read first: `architecture/07-backup-architecture.md` §7.4 (now carries the rule), §6.8, the restore table;
|
||
`_recovery-inventory-2026-07-28.md`; `02-controller-module-map.md`. Evidence: `documentation/audits/night-restore-2026-10-17/`.
|
||
|
||
## 0. Readings I took without asking
|
||
|
||
1. **The rule „the backup's database password wins" applies only when the restore puts back the database's DATA
|
||
VOLUME.** A backup that holds only a dump goes into the current data folder, which only the current password opens.
|
||
2. **„Not on the box" means: the current install is not older than the data.** A unit without the password over an
|
||
install that existed when the backup was taken uses the install's value; over a newer install it is refused.
|
||
3. **Grimmory's on-box restore after its books were removed refused by design** (R-479: a unit holds settings and
|
||
database, not the household's files). Its on-box route is „use my kept data", which I proved instead.
|
||
4. **Part 6: researched, not changed.** Changing five apps' Redis settings on every box needs answers I do not have
|
||
tonight (the ladder step files, the old volumes left behind, keeping data across the change). R-1096 holds the plan.
|
||
5. **The prune with 0.19.1 on demo-hp's real store cannot run tonight:** its clean-up window opens after 2026-10-18 14:16
|
||
UTC and only the operator can grant one sooner. Proven on a scratch store instead.
|
||
|
||
## 1. The restore fix (R-1106, R-127 b, R-926)
|
||
|
||
| Route | Where the database password came from before | Now |
|
||
|---|---|---|
|
||
| On-box restore („Visszaállítás"), update rollback, „use my kept data", off-site at the snapshot's version | the unit (unit wins); O4 GENERATED it when missing | the unit; missing → install older than the data → kept, else **refused before any change**; never generated |
|
||
| Off-site full restore, same version (the reinstall case) | the current install (**the bug**) | the snapshot's, written before the database starts, when the snapshot replays the DB volume |
|
||
| `.fab` import | the bundle's app.yaml | unchanged |
|
||
|
||
**Drill on demo-hp 9201 (rc.1, the dashboard's own posts), Rallly = Postgres, Grimmory = MariaDB:**
|
||
|
||
| Path | Rallly | Grimmory |
|
||
|---|---|---|
|
||
| Off-site full restore after remove + reinstall | marker row back, healthy, 0 auth errors, app's DB login works | marker row + books file (sha256) back, healthy, root and app logins work |
|
||
| On-box restore after remove (backups kept) + reinstall | both marker rows back, healthy, logins work | refused by design (books removed — R-479) |
|
||
| Refusal: unit without the password over a newer install | refused before any change; the app kept running, data untouched | — |
|
||
| „Use my kept data" | — | both passwords from the backup; marker row back; kept file unchanged |
|
||
|
||
Last night the same off-site steps left Rallly crash-looping and Grimmory held. **R-926's answer:** after a unit restore
|
||
the page hides a login it had to invent and says to use the old password — correct. On the reinstall path the page
|
||
would have shown the reinstall's admin login; now it records it as not the app's login. Tests `TestR1106_*` (8),
|
||
red-proved by six mutations; catalog gate `db-credentials` (17 apps, 20 fields, all `type: secret`).
|
||
|
||
## 2. restic 0.19.1 (R-1107)
|
||
|
||
- **Notes read** 0.18.1 → 0.19.1. One change touches the table: a missing top-level backup path now exits 3 (was 0).
|
||
The box removes such paths before the call, so only a race reaches it — now a loud failure instead of a silent partial
|
||
copy. No repository format change.
|
||
- **Pinned** like 0.18.1 (official file, signed sums, our two pinned sums). A wrong sum fails the build (proved).
|
||
- **Fixtures** for 0.14.0, 0.18.1, 0.19.1 from one store; `TestR1105_*` runs each against 0.14.0 — all pass.
|
||
- **Both directions on demo-hp's REAL store:** copies made by 0.14.0, 0.18.1 and 0.19.1, each restored by all three —
|
||
byte-identical every time; all three list the same 234 copies. **After a 0.19.1 prune:** scratch store only (reading 5) —
|
||
0.14.0 lists, checks and restores.
|
||
- **Scanner** (trivy 0.74.0): critical 3 (2 fixable) → **1 (0)**; high 122 (52) → **93 (23)**. restic's own part 50 → 19.
|
||
|
||
## 3. Small fixes (Part 3)
|
||
|
||
- **R-1108** done — a share added before the first password is served (test red-proved; live `smbclient` from DooPlex).
|
||
- **R-1065** done — a Plex claim schedules the wiring (test red-proved; no live claim tonight).
|
||
- **R-1017** done — the guard exists and found one more bare drive path (the remove dialog's kept-folders list), fixed.
|
||
|
||
## 4. Dashboard hardening (Part 4)
|
||
|
||
All six R-983 items and both R-976 items done, one red-proved test each. 135 i18n fixtures re-captured (the sign-out
|
||
control became a form; one minimum-length change), 22 unchanged. **Headless Chrome through demo-hp's public address:**
|
||
sign in → `/launcher`; `X-Frame-Options: DENY`; sign-out is a POST with CSRF → `/login`; sign in again; the
|
||
family-gated Grimmory and the setup-gated Rallly open their own pages.
|
||
|
||
## 5. Part 6 — Redis (R-1096)
|
||
|
||
Seven Redis services: five append-only (romm, docmost, paperless-ngx, immich, nextcloud), two snapshot-only (outline,
|
||
dawarich). Table and proposed lines: `P6/redis-persistence.md`. Not changed (reading 4). Also: RomM's file WAS repaired on
|
||
2026-09-24 — the row's history was wrong, corrected.
|
||
|
||
## 6. Release
|
||
|
||
**0.324.0** built from `b695857` (code identical to rc.1 `f75b3aa`, the README differs), MinAgent 0.158.1 (the hub's
|
||
declared value — not lowered). Per-box floors at 21:51:39 UTC (`303` → `floor_set`, all three); **Tester 1, demo-hp and
|
||
demo-felhom on 0.324.0 at 21:52 UTC**, each through the normal update path. Box walk: no container unhealthy, restarting,
|
||
exited or created (28 / 9 / 17); restic 0.19.1 in each; dashboards 200; https-only 37 names OK (`release/`).
|
||
|
||
**Tonight's off-site runs on 0.324.0:** demo-hp `backup OK` 02:18:07 UTC (14 apps, 296 snapshots, 2m59s), demo-felhom
|
||
02:15:36 (5 apps, 25), Tester 1 02:17:16 (10 apps, 60) — read at 02:45 UTC on each box and in each log
|
||
(`release/night-offsite-*.txt`). **Global floor 0.324.0 / MinAgent 0.158.1 at 02:46:24 UTC** (`303` → `flash=floor_set`;
|
||
the brief allowed it tonight); per-box floors cleared. Read back on two channels: one `tar` of `hub.db` + `-wal` + `-shm`
|
||
(integrity ok: `0.324.0`, `0.324.0=0.158.1`, no per-box floor) and the hub's own `/configuration` page.
|
||
|
||
## 7. Rows
|
||
|
||
**Before 177. Opened 7** (R-1109 … R-1115). **Closed 8** (R-1106, R-127, R-926, R-1108, R-1065, R-1017, R-983, R-976).
|
||
**Closed 2 more with the floor** (R-1105, R-1107). **After: 174** (177 + 7 − 10). R-1096 corrected and READY. `unproven.py`: NOT WALKED 35 of 55, unchanged.
|
||
|
||
## 8. Observations
|
||
|
||
1. A reinstalled database app restored from the off-site copy came back unusable. NOT-A-FINDING: it is R-1106, closed tonight.
|
||
2. A share renamed at the same path is never applied to a running samba. FILED: R-1109
|
||
3. Two sibling path helpers are called with drive-named arguments, unguarded. FILED: R-1110
|
||
4. The share-password and escrow limiters count a try after the password check. FILED: R-1111
|
||
5. Family sessions are stored raw, not as a fingerprint. FILED: R-1112
|
||
6. Each `/__family/start` pass with a household session creates a new family session. FILED: R-1113
|
||
7. `controller_gates.py` cannot pass in a worktree outside `git/`. FILED: R-1114
|
||
8. A catalog decoy („a credential token rewritten in translation") no longer convicts. FILED: R-1115
|
||
9. Grimmory's on-box restore after its books were removed refused. NOT-A-FINDING: by design (R-479), its route is „use my kept data", proven.
|
||
10. The launcher logs 404s for SVG app logos. NOT-A-FINDING: the page asks for the SVG first and falls back to the PNG; the same 263 assets were in 0.322.0.
|
||
11. Two catalog-wide stacks tests take about 26 s each. NOT-A-FINDING: test duration, no defect.
|
||
12. R-1096's history said RomM's Redis file was not repaired on 2026-09-24. NOT-A-FINDING: the row text is corrected tonight (the file was repaired; the 2026-10-16 cause is unproven).
|
||
|
||
## 9. Teardown (three layers)
|
||
|
||
- **Machine (demo-hp 9201):** Rallly and Grimmory removed through the product (no container, volume, unit, copy or hold
|
||
left); my marker files and the cover file removed; sharing off, the test share and its folders removed. 9201 runs
|
||
0.324.0. The old Kimai hold is not mine and stays.
|
||
- **Host:** nothing.
|
||
- **Hub:** per-box floors set and cleared; the global floor raised to 0.324.0 / MinAgent 0.158.1 (the release, §6).
|