admin
59834feadf
gates / gates (push) Successful in 6m54s
Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb
58 lines
3.3 KiB
Markdown
58 lines
3.3 KiB
Markdown
# Part 0 — why demo-hp's Calibre-Web has no stored password (2026-10-16, read only, no value printed)
|
|
|
|
Method: SSH to demo-hp (`ssh hp`) → `pct exec 9201`; the controller's own reveal endpoint
|
|
(`POST /stacks/calibre-web/auto-field/reveal`, the one the eye button calls) through traefik inside the guest;
|
|
Calibre-Web's own user table (`docker exec calibre-web sqlite3 /config/app.db 'select name from user'`), compared
|
|
inside the guest. The hub's per-app page (`/apps/calibre-web`) with the CC token; then the box itself
|
|
(demo-felhom, `ssh felhom-pve`) as the second channel.
|
|
|
|
## 1. Keys in calibre-web's app.yaml (9201), names only
|
|
|
|
```
|
|
env: ADMIN_USER DOMAIN HDD_PATH SUBDOMAIN <- no ADMIN_PASSWORD key at all
|
|
locked_fields: DOMAIN SUBDOMAIN HDD_PATH ADMIN_USER
|
|
deployed_at: 2026-08-21T16:27:08Z
|
|
default_login: changed_at 2026-09-29T07:21:06Z by household
|
|
app.yaml mtime: 2026-10-01 11:26:10Z <- InjectMissingFields wrote ADMIN_USER here
|
|
reveal ADMIN_PASSWORD -> 404, ok false, no value
|
|
reveal ADMIN_USER -> 200, value present
|
|
```
|
|
|
|
## 2. Install date vs the template
|
|
|
|
| what | when |
|
|
|---|---|
|
|
| calibre-web installed on 9201 | 2026-08-21 16:27Z |
|
|
| `ADMIN_PASSWORD` (`type: password`) enters the template | catalog `d0e7e2e`, 2026-09-29 07:19Z |
|
|
| `ADMIN_USER` (`type: secret`, `generate: hex:5`) enters the template | catalog `e9f50b5`, 2026-10-01 11:19Z |
|
|
| the box injects `ADMIN_USER` into app.yaml | 2026-10-01 11:26:10Z (app.yaml mtime; A3 of `audits/calibre-name-and-prune-2026-10-01`) |
|
|
| R-757 guard (no invented after_install-only secret) | controller `1991c74`, v0.298.0, 2026-10-06 |
|
|
|
|
`InjectMissingFields` (`internal/stacks/deploy.go`) fills only `secret`, `domain` and `subdomain`; a new
|
|
`type: password` field falls to the `default:` branch (`requires manual configuration`) and is never stored. So the
|
|
**hypothesis holds for the password**: installed before the field existed, never filled, and after_install (which sets
|
|
it in the app) never ran for this install.
|
|
|
|
## 3. Is the stored ADMIN_USER invented?
|
|
|
|
```
|
|
calibre users count 2 admin present False
|
|
equal (stored ADMIN_USER is a Calibre-Web user): True
|
|
```
|
|
|
|
**No — on demo-hp the name is NOT invented any more.** On 2026-10-01 11:27Z a session renamed Calibre-Web's admin
|
|
user by hand to the name the box had just recorded (`audits/calibre-name-and-prune-2026-10-01/A/A2-demo-hp-rename.txt`,
|
|
second block). The name the page shows is the real login name. **So the task's "remove the invented value from
|
|
app.yaml on 9201" does not apply: removing it would hide a TRUE login name.** Nothing was removed.
|
|
The password that goes with it was set by hand in the app; the operator holds it out-of-band.
|
|
|
|
## 4. Other boxes (hub, then the box)
|
|
|
|
The hub's `/apps/calibre-web` says „Deployments 2", affected customers demo-felhom and demo-hp (telemetry). Tester 1
|
|
and Tester 2 are not listed. The second channel — the box: demo-felhom guest 9201 has `/opt/docker/stacks/calibre-web/`
|
|
with only `.felhom.yml` + `docker-compose.yml` (catalog mirror), **no app.yaml, no calibre-web container** — it is not
|
|
installed there now. **No customer box has this state. No register row for customer boxes.**
|
|
|
|
(The hub's „Deployments 2" counts telemetry history, not what is installed today — a presence-not-success reading;
|
|
the box is the truth. NOT-A-FINDING for this task: the hub page labels it telemetry.)
|