felhom.eu/documentation/audits/morning-after-2026-10-06/live-9202

Scratch 9202 — the four held catalog fixes proven (2026-10-06 morning)

Venue: scratch guest 9202 on demo-hp, controller set BY HAND to 0.299.0 (was 0.296.0; allowed only there), pointed at the drill catalog admin/app-catalog-drill = live catalog d955df1 + the five held commits (c5674ce), by tools/repoint.py (09 §6.5: saved copy controller.yaml.pre-morning1006, cache removed, restart). Controls: demo-hp's 9201 cache and the live catalog's main both stayed d955df1. Every request went through the SIMULATED tunnel: a curl container at 172.16.253.2 (cloudflared's address, the only one traefik trusts for forwarded headers) sending X-Forwarded-For: <forged>, <visitor> — the stranger changed the forged leftmost entry on every try.

App (row)	With the fix	Control: the line removed from the stack's compose, restart through the product
nextcloud (R-776)	6 wrong WebDAV logins → occ security:bruteforce:attempts: visitor 6, every forged address 0, the tunnel 0, traefik 0	visitor 0 (traefik 0 too: this nextcloud keeps its throttle in Redis, so where the control's tries were counted was not found)
nextcloud (R-613)	status.php = {"installed":true,"maintenance":false,…}; the controller's state running with the new probe	—
vikunja (R-776)	stranger: 10 × 403 then 429; household 200	stranger the same; household 429
zipline (R-776)	stranger: 7 × 400 then 429; household 200	stranger the same; household 429
kimai (R-776)	stranger: 5 × wrong then THROTTLED; household ok	stranger the same; household THROTTLED

So with the fix each app throttles the VISITOR, a stranger cannot escape by forging the leftmost address, and the household is not locked out by a stranger; without it the household is.

Teardown: each app removed through the product (keep drive data, drop backups), its own folders under the scratch drive removed by name (teardown.txt); controller.yaml restored byte-identical (cmp); the tools and password files deleted in the guest. 9202's controller stays on 0.299.0 (newer than before; /etc/felhom-controller-image.pre-morning1006 holds the old line). The drill repo keeps the tested branch. Host demo-hp and the hub: nothing changed.

Said plainly: a log filter used during this work drops lines containing „perl" (locale noise) — it also dropped the paperless-* containers from one docker ps, which made it look as if paperless started during the work. It did not: it has run since 2026-10-06 00:30:09Z (docker inspect StartedAt), before any of this.