felhom.eu/documentation/audits/app-page-tuning-2026-10-16/P0

Part 0 — why demo-hp's Calibre-Web has no stored password (2026-10-16, read only, no value printed)

Method: SSH to demo-hp (ssh hp) → pct exec 9201; the controller's own reveal endpoint (POST /stacks/calibre-web/auto-field/reveal, the one the eye button calls) through traefik inside the guest; Calibre-Web's own user table (docker exec calibre-web sqlite3 /config/app.db 'select name from user'), compared inside the guest. The hub's per-app page (/apps/calibre-web) with the CC token; then the box itself (demo-felhom, ssh felhom-pve) as the second channel.

1. Keys in calibre-web's app.yaml (9201), names only

env: ADMIN_USER DOMAIN HDD_PATH SUBDOMAIN        <- no ADMIN_PASSWORD key at all
locked_fields: DOMAIN SUBDOMAIN HDD_PATH ADMIN_USER
deployed_at: 2026-08-21T16:27:08Z
default_login: changed_at 2026-09-29T07:21:06Z by household
app.yaml mtime: 2026-10-01 11:26:10Z            <- InjectMissingFields wrote ADMIN_USER here
reveal ADMIN_PASSWORD -> 404, ok false, no value
reveal ADMIN_USER     -> 200, value present

2. Install date vs the template

what	when
calibre-web installed on 9201	2026-08-21 16:27Z
ADMIN_PASSWORD (type: password) enters the template	catalog d0e7e2e, 2026-09-29 07:19Z
ADMIN_USER (type: secret, generate: hex:5) enters the template	catalog e9f50b5, 2026-10-01 11:19Z
the box injects ADMIN_USER into app.yaml	2026-10-01 11:26:10Z (app.yaml mtime; A3 of audits/calibre-name-and-prune-2026-10-01)
R-757 guard (no invented after_install-only secret)	controller 1991c74, v0.298.0, 2026-10-06

InjectMissingFields (internal/stacks/deploy.go) fills only secret, domain and subdomain; a new type: password field falls to the default: branch (requires manual configuration) and is never stored. So the hypothesis holds for the password: installed before the field existed, never filled, and after_install (which sets it in the app) never ran for this install.

3. Is the stored ADMIN_USER invented?

calibre users count 2  admin present False
equal (stored ADMIN_USER is a Calibre-Web user): True

No — on demo-hp the name is NOT invented any more. On 2026-10-01 11:27Z a session renamed Calibre-Web's admin user by hand to the name the box had just recorded (audits/calibre-name-and-prune-2026-10-01/A/A2-demo-hp-rename.txt, second block). The name the page shows is the real login name. So the task's "remove the invented value from app.yaml on 9201" does not apply: removing it would hide a TRUE login name. Nothing was removed. The password that goes with it was set by hand in the app; the operator holds it out-of-band.

4. Other boxes (hub, then the box)

The hub's /apps/calibre-web says „Deployments 2", affected customers demo-felhom and demo-hp (telemetry). Tester 1 and Tester 2 are not listed. The second channel — the box: demo-felhom guest 9201 has /opt/docker/stacks/calibre-web/ with only .felhom.yml + docker-compose.yml (catalog mirror), no app.yaml, no calibre-web container — it is not installed there now. No customer box has this state. No register row for customer boxes.

(The hub's „Deployments 2" counts telemetry history, not what is installed today — a presence-not-success reading; the box is the truth. NOT-A-FINDING for this task: the hub page labels it telemetry.)