77 lines
4.9 KiB
Markdown
77 lines
4.9 KiB
Markdown
# REPORT — cloudflared 2026.10.3 on every box (R-1300), 2026-10-26 evening, attended
|
||
|
||
> A sibling of `REPORT.md`: the night session (`TASK-night-burndown-and-tuesday-2026-10-26.md`) owns `REPORT.md`
|
||
> tonight.
|
||
|
||
## In plain words
|
||
|
||
1. **We run 3 cloudflared, one in each box's guest** (Tester 1, demo-hp, demo-felhom). None on DooPlex. Tester4 has no
|
||
tunnel; Tester 2 has no box.
|
||
2. **The https-origin trap does not apply.** Each tunnel sends to `https://traefik` with „No TLS Verify" on, and traefik
|
||
shows its own self-signed certificate — not an eMudhra one.
|
||
3. **0.345.1 is on every box: 4 of 4 reporting controllers** (the three above + Tester4); none left behind.
|
||
4. **Longest tunnel gap: about 11 seconds** (demo-hp). Tester 1 about 2 s, demo-felhom about 4 s.
|
||
|
||
Decisions: the operator said yes to the build-gate exception (build from a pushed tag) and to the global floor.
|
||
|
||
## Versions, digests, CI
|
||
|
||
| What | Value |
|
||
|---|---|
|
||
| controller tag `v0.345.1` | commit `f3204024` = v0.345.0 `6bfb784` + one commit; CI job 2393 success (attempt 1) |
|
||
| controller `main` | `a1c65b3d` (same bump + `build.sh` tag path); CI job 2392 success (attempt 1) |
|
||
| controller image `0.345.1` / `:latest` | `sha256:7cfdf7e1f835628de9c7d536e0a60c06bad5bbe19e8133765cc0a6bb732dbff6` |
|
||
| cloudflared | `cloudflare/cloudflared:2026.10.3`, index `sha256:faa8e0a1475f137c910be6025f43c8e4092fdd35461b31e19fd1390657a1ff39` |
|
||
| MinAgent | 0.158.1 (unchanged, declared with the floor) |
|
||
| global floor | 0.345.1 at 20:08:39Z (`303 floor_set`; read back from the running hub: „Effective floor: v0.345.1 — source: DB") |
|
||
| per-box floors | set 20:05:08Z (Tester 1), 20:06:04Z (demo-hp, demo-felhom); cleared 20:39:54Z |
|
||
|
||
Tests and gates: controller gates `--fast` green on both commits; `go test ./...` green on the tag commit; the new
|
||
reconcile test and the four build-gate cases red-proved. felhom.eu gates green on push. **Methods:** box state by
|
||
`docker ps`/`docker logs` in each guest; tunnel state by the hub's Hosts page and by a public name with no app
|
||
(`cfprobe.<domain>`: 404 = tunnel up, 530 = down), probed every 0.5–1 s from DooPlex.
|
||
|
||
## Register
|
||
|
||
Rows before **213**, after **214**, opened **2** (R-1300, R-1301), closed **1** (R-1300).
|
||
|
||
## Observations
|
||
|
||
- The N100 host's clock is 14 s slow; chrony fails at every boot — **FILED: R-1301** (and `lived-in/n100.md`).
|
||
- I put a test run and a commit in one command on the detached tag clone (standing rule 1). The commit was local; the
|
||
test result was then read on its own (green) before anything was pushed — **NOT-A-FINDING: my slip, caught before
|
||
push, recorded here.**
|
||
- `noTLSVerify` on every tunnel route (R-510) — **NOT-A-FINDING: a leg that never leaves the guest** (cloudflared and
|
||
traefik alone on the /29 tunnel network); now written in `01` as a recorded exception, with the rule „never turn off
|
||
a certificate check to make an update work".
|
||
- cloudflared 2026.10.4 (today, VULN-176088: metrics debug endpoints allowlist) — **NOT-A-FINDING: our metrics bind to
|
||
the container's own loopback**; not taken because it is under a day old and the notice names 2026.10.3.
|
||
- 0.345.1 is built with 0.345.0's Go builder; `main` moved to Go 1.27.3 tonight (R-972) — **NOT-A-FINDING: R-972 owns
|
||
it; the next release from `main` carries it.**
|
||
- Single-sample `000` answers at 20:13:37 (both Tester 1 probes at once) and 20:17:13 (demo-hp) — **NOT-A-FINDING: a
|
||
client-side timeout, no 530; the hub and the boxes showed the tunnel up throughout.**
|
||
- `internal/stacks` tests took 450 s under the night session's load (each R-442 remove test 26 s) — **NOT-A-FINDING: CI
|
||
green; slow only under load.**
|
||
- Tester4's agent reads `0.167.0-night1 floor held` on the Hosts page — the night session's agent; not touched.
|
||
|
||
## What changed in documents
|
||
|
||
- `architecture/01-topology-and-trust.md` „Tunnel placement": the version, the rule, the recorded exception.
|
||
- `architecture/11-os-updates.md` C8: the new pin.
|
||
- `STATUS.md`: one line (released; `main` and Sunday's golden carry it). The golden 0.344.0 still has 2026.9.3; a new
|
||
box moves to the floor in its first minutes. No extra bake (operator did not ask).
|
||
- System poster: none of the three needed — no fact on the poster changed (cloudflared still runs in the guest).
|
||
- Controller: `build.sh` may push from the pushed tag `v<VERSION>` (operator's yes). Controller report:
|
||
`felhom-controller/REPORT-cloudflared-0.345.1.md`.
|
||
|
||
## For the operator
|
||
|
||
- **Nothing to do.** If you want a second look: Cloudflare dashboard → Networking → Tunnels shows each connector's
|
||
version (CC holds no Cloudflare token).
|
||
|
||
## Teardown
|
||
|
||
Machine: the image pulled on scratch guest 9202 for the version check was removed. Host: nothing. Hub: the three
|
||
per-box floors cleared; the global floor stays at 0.345.1 by design. Clones `felhom-controller-sec`,
|
||
`felhom-controller-mainsec` and `felhom.eu-cfsec` on DooPlex are my work copies (all pushed); removed at the end.
|