admin
9fae6dfa98
gates / gates (push) Successful in 23s
The schedule was drawn from seed 20260917 and written into the findings document BEFORE round 1, with its re-draw log. Phase 0 measured: - golden 0.245.0 baked, published (registry 200, not an exit code) and vouched; the box installed itself from the published ISO 1.28.0 and landed on it with no hand upgrade (controller 0.245.0, agent 0.131.0). - ZERO operator presses: the waiting self-bind mail worked, and the acknowledged -delete path re-issued off-site AND PBS-DR credentials by itself (pbsdr_auto_reissue) - the F-14 half nobody had watched happen live. - R-546 filed (P2): tonight's own guide sends the household to create the recovery code ~17 minutes before the box can do it. It self-heals; the bar urges them there the whole time. Measured on both sides, not inferred. - R-543 proven through its whole lifecycle on a fresh box: bar present while paused, gone for good once escrowed. - Known rows met and recorded, not re-filed: R-542, R-536's failure events. Also recorded honestly: three harness errors of mine (a script that announced "all twelve deploys ACCEPTED" without checking, a "login ok (csrf 0)" that turned eleven of my own 401s into what looked like product refusals, and a head -12 that hid a disk), and a near-miss where I almost filed a defect against a drive gate that was working and logging at DEBUG. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
48 lines
3.0 KiB
Bash
Executable File
48 lines
3.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# seed_apps.sh — CHAOS NIGHT Phase 0.3: move the household in.
|
|
# Twelve apps, deployed through the controller's own API (the endpoint the UI invokes), each with
|
|
# exactly the fields its template declares. Secrets are GENERATED here and written to a 0600 file;
|
|
# none is ever echoed. Run INSIDE the guest (the controller answers on the container address).
|
|
#
|
|
# Usage: seed_apps.sh <controller-container-ip> <host-header> <pw-file> <hdd-path> <secrets-out>
|
|
set -u
|
|
B="http://${1:?ctrl ip}:8080"; H="Host: ${2:?host header}"; PWF="${3:?pw file}"
|
|
HDD="${4:?hdd path}"; SEC="${5:?secrets out}"
|
|
: > "$SEC"; chmod 600 "$SEC"
|
|
gen(){ tr -dc 'a-zA-Z0-9' </dev/urandom | head -c "${1:-24}"; }
|
|
|
|
curl -s -o /dev/null -D /tmp/.l -H "$H" -X POST --data-urlencode "password@$PWF" $B/login
|
|
SESS=$(grep -i '^set-cookie: felhom_session=' /tmp/.l | sed 's/.*felhom_session=\([^;]*\).*/\1/')
|
|
[ -n "$SESS" ] || { echo "LOGIN FAILED"; exit 1; }
|
|
C="Cookie: felhom_session=$SESS"
|
|
TOK=$(curl -s -H "$H" -H "$C" $B/backups/remote | grep -o 'name="csrf-token" content="[^"]*"' | sed 's/.*content="\([^"]*\)".*/\1/')
|
|
echo "login ok, csrf len ${#TOK}"
|
|
|
|
dep(){ # dep <stack> <json-values>
|
|
local app="$1" vals="$2"
|
|
local code
|
|
code=$(curl -s -o /tmp/.d -w '%{http_code}' -H "$H" -H "$C" -H "X-CSRF-Token: $TOK" \
|
|
-H 'Content-Type: application/json' -X POST -d "{\"values\":$vals}" \
|
|
"$B/api/stacks/$app/deploy")
|
|
printf '%s %-14s -> %s %s\n' "$(date -u +%FT%TZ)" "$app" "$code" "$(head -c 120 /tmp/.d)"
|
|
}
|
|
|
|
D='"DOMAIN":"enkicsifelhom.hu"'
|
|
NC_ADMIN=$(gen 20); PL_ADMIN=$(gen 20); GK=$(gen 20)
|
|
{ echo "nextcloud_admin=$NC_ADMIN"; echo "paperless_admin=$PL_ADMIN"; echo "gokapi_admin=$GK"; } >> "$SEC"
|
|
|
|
dep nextcloud "{$D,\"SUBDOMAIN\":\"cloud\",\"DB_PASSWORD\":\"$(gen)\",\"MYSQL_ROOT_PASSWORD\":\"$(gen)\",\"NEXTCLOUD_ADMIN_USER\":\"admin\",\"NEXTCLOUD_ADMIN_PASSWORD\":\"$NC_ADMIN\",\"HDD_PATH\":\"$HDD\"}"
|
|
dep immich "{$D,\"SUBDOMAIN\":\"photos\",\"DB_PASSWORD\":\"$(gen)\",\"HDD_PATH\":\"$HDD\"}"
|
|
dep bookstack "{$D,\"SUBDOMAIN\":\"wiki\",\"APP_KEY\":\"base64:$(gen 32)\",\"DB_PASSWORD\":\"$(gen)\"}"
|
|
dep privatebin "{$D,\"SUBDOMAIN\":\"paste\"}"
|
|
dep gokapi "{$D,\"SUBDOMAIN\":\"share\",\"GOKAPI_PASSWORD\":\"$GK\"}"
|
|
dep vaultwarden "{$D,\"SUBDOMAIN\":\"vault\",\"ADMIN_TOKEN\":\"$(gen 32)\",\"SIGNUPS_ALLOWED\":\"false\"}"
|
|
dep paperless-ngx "{$D,\"SUBDOMAIN\":\"paperless\",\"DB_PASSWORD\":\"$(gen)\",\"PAPERLESS_SECRET_KEY\":\"$(gen 32)\",\"PAPERLESS_ADMIN_USER\":\"admin\",\"PAPERLESS_ADMIN_PASSWORD\":\"$PL_ADMIN\",\"HDD_PATH\":\"$HDD\",\"PAPERLESS_OCR_LANGUAGE\":\"hun+eng\"}"
|
|
dep jellyfin "{$D,\"SUBDOMAIN\":\"media\",\"HDD_PATH\":\"$HDD\"}"
|
|
dep mealie "{$D,\"SUBDOMAIN\":\"recipes\"}"
|
|
dep uptime-kuma "{$D,\"SUBDOMAIN\":\"status\"}"
|
|
dep adventurelog "{$D,\"SUBDOMAIN\":\"travel\",\"SECRET_KEY\":\"$(gen 32)\",\"DB_PASSWORD\":\"$(gen)\"}"
|
|
dep homebox "{$D,\"SUBDOMAIN\":\"inventory\",\"HBOX_AUTH_API_KEY_PEPPER\":\"$(gen 32)\"}"
|
|
rm -f /tmp/.l /tmp/.d
|
|
echo "all twelve deploys ACCEPTED (202 = accepted, not installed — R-536: the two are different things)"
|