felhom.eu/documentation/audits/day-2026-10-08/design-R-717.md

# R-717 — opengist's sign-up switch: its container has no tool to write it: a one-page design (2026-10-08)

**Status:** design only. Read today: controller `main` a0370b4ed8ef, catalog `main` 32d134639c0c, opengist upstream
`master` (fetched 2026-10-08). Architecture: `09-update-architecture.md` §3 decisions 46-47 (setup gate, sign-up block),
`01-topology-and-trust.md` §5 (the gate).

## Where it stands

- Wishlist is done (controller v0.301.0 `open_command`, proven on 9202 2026-10-06). The row is narrowed to opengist.
- Opengist (`templates/opengist/docker-compose.yml`, image `ghcr.io/thomiceli/opengist:1.15`) is closed by the address
  block alone: `signup_block: "PathRegexp(`(?i)^/+-/+register`)"` (`.felhom.yml:42`). Measured 2026-09-29: every trick
  shape — trailing slash, upper/mixed case, percent-encoded, double slash, query string — answers 403
  (`audits/signup-lock-2026-09-29/B/B6-tricks-all-regex.txt`). The app publishes no port; traefik is its only door.
- **Upstream, read today:** the switch is row `disable-signup` in opengist's admin-settings table; startup seeds it to
  `"0"` from a hard-coded map — no config key and no env feeds it (`internal/db/db.go`; `config.yml` has no
  signup/register key). **The settings are read from the database on every request** (`dataInit` middleware →
  `loadSettings` → `db.GetSettings()`, `internal/web/server/middlewares.go`). So a row written while the app runs takes
  effect at the next request — the row's „needs its sqlite with the app stopped" is not needed.
- The controller already embeds a pure-Go SQLite (`modernc.org/sqlite`, `go.mod:11`) and already runs short helper
  containers on app volumes (`docker run --rm -v vol:…`, `internal/stacks/undo.go:205-235`, image `alpine`, which has
  no sqlite).

## Options

| | What | Costs | Risk |
|---|---|---|---|
| **A — the box writes the row with its own image** | New `after_setup` form `sqlite: {volume, file, close_sql, open_sql, check_sql}`; the controller runs `docker run --rm -v opengist_data:/v <its own image> <subcommand>` that opens the file with modernc sqlite (busy timeout), runs the statement, reads it back and prints the marker. Feeds the existing close/open/loop machinery unchanged. | ~1 session controller + catalog line + a 9202 proof. No new external image. | A second writer on a live SQLite (normal locking; same kernel). A schema rename upstream → the read-back fails → the existing failure record, never silent. |
| **B — a sidecar with a sqlite tool** | Add a small sqlite image as a second service in the template. | ~½ session. | **A new external dependency** (fenced — operator only), RAM and an image to keep current on every box. |
| **C — keep the address block alone** | Accept the measured block as the lock for opengist; close the row as decided. | Nothing. | The switch stays „open" inside the app; only a path traefik does not see could reach it, and the app has no such path today. |

**Pick: C, with A ready.** The block is measured against every trick shape and the app has no door but traefik, so A
buys defence in depth for a P3-LOW. A is the right build if the operator wants the app's own switch closed too: it adds
no dependency and serves any later app whose switch lives only in its database.

**First slice of A (only on the operator's yes), with its red test:** `after_setup.go` accepts the `sqlite` form; a test
with a temp SQLite file runs close → the read-back prints the marker and the row reads `1`; open → `0`; a missing table
→ an error and no marker (red today: the form is unknown and the spec is refused). Then the opengist template line and a
9202 proof in wishlist's shape (stranger 403/refused after setup, a family member signs up inside the window, closed again
after it).

**Small, for the parent now (comments only, no decision):** `internal/stacks/after_setup.go:33` names opengist among the
apps „closed by `command`" — today only wishlist is; `internal/stacks/signup_block.go:22` shows opengist's block as
``PathPrefix(`/-/register`)`` while the template uses the case-insensitive `PathRegexp` above.

## One question for the operator

**Is the measured address block enough for opengist, or should the box also close opengist's own sign-up switch (about
one working session)?** *If you do nothing:* opengist stays closed by the address block alone, and the row closes as
decided.