Files
felhom.eu/documentation/audits/new-apps-2026-10-01/box/dawarich/checks.txt
T

20 lines
1.5 KiB
Plaintext

3.2/3.9 the browser form through traefik over https (Origin + CSRF), as the household:
default demo@dawarich.app / safepassword -> 422 (locked text)
the box's generated password -> 303 (303 = signed in)
a wrong password -> 422 (locked text)
3.4 sign-up as a stranger: GET /users/sign_up -> 302 | POST /users -> 422 | users in the app: 1
3.6 lock-out: 11 wrong passwords for the public name as a stranger, then the household's right one:
11 wrong -> ['429', '429', '429'] | right password now -> 429 | locked_at: nil
the phone app's API key while the account is locked -> 200
(unlocked again with the app's own CLI for the rest of the walk) right password -> 429
0.4 outbound connections held by the app at rest: 020014AC:18EB 030014AC:1538 060012AC:94E8 060012AC:966E
2.2/2.7 data and size: dawarich_dawarich_db_data=124M dawarich_dawarich_public=33M dawarich_dawarich_redis=4.0K dawarich_dawarich_storage=4.0K dawarich_dawarich_watched=4.0K
1.8 unknown page: http=404 debug-page=False
1.5 process in dawarich-sidekiq: sidekiq 8.1.7 app [0 of 3 busy]
1.5 process in dawarich: puma 8.0.2 (tcp://0.0.0.0:3000) [app]
1.5 process in dawarich-db: postgres
1.5 process in dawarich-redis: redis-server *:6379
4.4 negative control: docker STOP dawarich (sidecars keep running; pause is not used — Docker counts a paused container as running) — state before: running
states while stopped (s, state): [(5, 'running'), (10, 'degraded')]; the front door: 404
running again 25 s after docker start