59 lines
3.2 KiB
Markdown
59 lines
3.2 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
|
|
|
---
|
|
|
|
# REPORT — Impl-1 Part B: install the guarded-mkfs wrapper (host-install v1.8.0)
|
|
|
|
**Date:** 2026-07-01 · **Repo:** `felhom.eu` (`scripts/` only) · **Class:** Risky/supervised (paired with
|
|
the destructive-path change in felhom-agent v0.54.0).
|
|
|
|
Companion to felhom-agent v0.54.0 (the format-safety foundation). Script-only change: host-install now
|
|
installs the guarded-mkfs wrapper during agent install so every fresh box gets the safe format path.
|
|
|
|
## 1. Baseline → target
|
|
|
|
script `v1.7.0` @ `9e5bbc1` → **v1.8.0**. Paired with agent v0.54.0 (separate repo, `5209830`).
|
|
|
|
## 2. What changed
|
|
|
|
- `scripts/felhom-host-install.sh` `step_agent_install`: new step (before the sudoers install) that
|
|
`fetch_raw`s `configs/felhom-mkfs-guarded.sh` from Gitea, `bash -n`-validates it, and
|
|
`install -m0755 -o root -g root` → `/usr/local/sbin/felhom-mkfs-guarded`. Wrapper-before-sudoers so
|
|
the sudoers (which allowlists only the wrapper) is never installed ahead of the file it names.
|
|
- The agent v0.54.0 sudoers (fetched by the same step) drops raw `mkfs.*` (allowlists only the wrapper)
|
|
and adds read-only `pvs`/`zpool status -P` for the agent's unclaimed-disk guard.
|
|
- `scripts/CHANGELOG.md`, version banner. Commit **`7ea36bc`** on `main`.
|
|
- `bash -n` + `shellcheck` clean (0 new warnings; the 2 pre-existing SC2015 in `step_verify` unchanged).
|
|
|
|
## 3. Served-copy version
|
|
|
|
`curl -fsSL https://felhom.eu/scripts/felhom-host-install.sh | grep SCRIPT_VERSION` → **`1.8.0`**.
|
|
|
|
## 4. Live validation (felhom-pve, agent v0.54.0 deploy)
|
|
|
|
The two-layer format guard (agent unclaimed-filter + this wrapper) validated on the demo — details in
|
|
`felhom-agent/REPORT.md` §5:
|
|
- wrapper REFUSES the OS disk `/dev/sda` and the LVM-PV partition `/dev/sda3`;
|
|
- raw `sudo mkfs.ext4 /dev/sda` is DENIED (Part B — wildcard removed);
|
|
- an unclaimed throwaway `/dev/sdd` FORMATS (the only real format);
|
|
- the agent guard's sudo reads (`pvs`/`lsblk`/`zpool`) all work as the felhom-agent user.
|
|
|
|
**Deploy note:** installing the sudoers via a manual scp of the Windows working-copy failed `visudo`
|
|
(CRLF line endings); fixed live by CR-stripping. The committed repo file is LF, and the host-install
|
|
`fetch_raw`-from-Gitea path serves LF — so the shipped path is unaffected. (Lesson recorded.)
|
|
|
|
## 5. NOT yet live-validated / deferred
|
|
|
|
- A **fresh install** exercising the new `step_agent_install` wrapper-install step end-to-end (the demo
|
|
was repaired in place; a clean box will exercise the fetch+install path — the code is dry-run-safe and
|
|
mirrors the existing sudoers/unit install).
|
|
- **Impl-2** (raw-device discovery + registry enrollment + wizard rewiring) and **Impl-3** (shared-box
|
|
operator gate for self-serve format) are the separate follow-up specs.
|
|
|
|
## 6. Observations
|
|
|
|
- The guarded-mkfs wrapper is `configs/felhom-mkfs-guarded.sh` in the **felhom-agent** repo (co-located
|
|
with the sudoers it pairs with); host-install fetches it the same way it fetches the unit/sudoers.
|