admin
e0d1733b85
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
34 lines
2.5 KiB
Markdown
34 lines
2.5 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
|
|
|
## TASK — offsite provisioning hardening (F2/F4/F5 + key-auth-first + staged-secret wipe) — 2026-07-09 — DEPLOYED
|
|
|
|
**Shipped (felhom.eu):** hub **v0.39.0** `17cc67f` + bump `17d9af5` — LIVE (Synced/Healthy, provisioner
|
|
enabled). Bundle pairs: controller **v0.107.0** (key-auth-first bridge + wipe-on-escrowed; live on 9201) +
|
|
agent **v0.78.0** (`DELETE /escrow/stage-secret`; live on felhom-pve, 56/56). All three green-gated with
|
|
companion red-proofs.
|
|
|
|
**Hub changes:**
|
|
- **F4 (pilot-gating) — "Re-issue offsite credentials":** `Provisioner.ReissueCredentials` + UI button
|
|
(confirm-gated, shown only when provisioned) + `POST /configs/{id}/offsite-reissue`. Resets the
|
|
sub-account password (or dedicated-box password via the new `hetznerapi.ResetBoxPassword`), stores a
|
|
FRESH one-time secret, re-saves the config unchanged → `ConfigVersion` bump → the stuck guest's next
|
|
refresh re-runs the bridge. **Hard-scoped:** refuses unless the `felhom-customer=<id>` label lookup finds
|
|
exactly 1 resource (red-proofed). Explicit action only — never implicit rotation. Password never logged.
|
|
- **F2:** `scanWithRetry` — the host-key scan retries through fresh-subaccount DNS lag (2/4/8/16/30s ≈ 60s,
|
|
inside the F1 3-min detached ctx; fail-closed past budget; red-proofed).
|
|
- **F5:** the config form disables its submit buttons + shows an in-flight notice on submit (the re-click
|
|
bait that caused live F1).
|
|
|
|
**One-off cleanup (executed):** the staged secret lingering on felhom-pve from the e2e's Option-A confirm
|
|
was wiped through the NEW agent endpoint (controller container → pinned local API → `{"removed":true}`),
|
|
verified gone; idempotent re-wipe returned `{"removed":false}`. No secret printed.
|
|
|
|
**Deliberately NOT exercised live:** the F4 reset itself (it would rotate the demo's working credential —
|
|
touching it is forbidden; a live exercise needs a throwaway customer under supervision). Unit red-proofs
|
|
cover the guards. F5 is template JS — verified on the next operator save.
|
|
|
|
**NEXT:** SLICE 3 (escrow auto-confirm — inherits wipe-on-escrowed), SLICE 4 (soft-quota on `quota_gb`),
|
|
NEW-box restore round-trip → retire the old-box archive, Peti onboarding runbook.
|