REPORT — security night 2026-11-02/03 (unattended): the watch, the new notices, six small fixes, unproven claims

Read first: 08-alarm-ladder.md §11, 09-update-architecture.md decision 255, 07-backup-architecture.md, 03-host-agent.md, 05-hub-architecture.md, 00-capability-map.md.

Decisions taken by CC (operator may reverse)

Uptime Kuma's step crosses 2.5.8, which the 10-27 batch refused: 2.5.8 turns a TCP-port monitor with TLS into a plain TCP one (upstream: „never worked as expected"). The fix (admin-only code execution; unauthenticated RSS cache poisoning) outweighs it, and no box runs Kuma.
R-1339's written fix was not built: a sub-folder „not skipped" would write a userdata/ inside the app's folder. The behaviour stays; only the false line goes.
A brief's expectation that turned out false, said here: the watch was not blind to Docker Hub, and R-1334's fix had held. Traefik's line was no false alarm.

Six lines

The watch was not blind; it could not be heard. A streak is per source, so seven pins that can never be read (six private images, minio/minio) held registry:docker.io and runtime open for a week: no real outage could have mailed. 0 Docker Hub 429 on five nights. Fixed: those seven are a stated GAP, timeouts are retried. Proven: run 2550 (runner), dry 2555 (runner-2), night 2565 (runner-2): FAILED-SOURCES 0, memory failures {}.
The notices: Vaultwarden, Uptime Kuma, n8n, PrivateBin and Gitea are real; Traefik is real too, high, on every box (GHSA-xv5x, hidden behind a word-only line). Live: gitea 28.3.0, uptime-kuma 2.5.9, grafana 13.2.5, actualbudget 26.11.0, n8n 2.46.4, vaultwarden 1.37.5-alpine. PrivateBin has no 2.1.1 image.
The six waiters: ActualBudget fixed (live). Paperless and SparkyFitness have a fixed release on a new main version (proven on the drill). cal.com, Calibre-Web, RomM: none.
The small fixes: 7 done with red first. Live-proven 3 (R-1347, R-1348, R-1339); R-1351 test only (the race fired on neither image in six boots); R-1323, R-1352, R-1302 test only, by the brief.
RomM's night leg: done, 2026-10-28 03:22, 88 s (closed; demo-hp's library is small).
Claims: 8 walked (31 → 23 not walked); 2 walked and failed in part: the hub down loses events (R-1361), the LAN name has gaps (R-1364).

The morning release list, and the one decision

STATUS has both. First the golden (R-468). Controller v0.350.0: Traefik v3.7.17 first, R-1347, R-1348, R-1339, R-1351, R-1323. Agent v0.172.0 + vouch: R-1302. Hub v0.179.0: R-1352. Catalog, drill only: Paperless 3.4.1 and n8n 3.0.1 (bench, box, undo), SparkyFitness v1.11.0 (the same, behind the licence R-784), Mealie v3.30.0 and Termix 26.11.0 (bench, box). Decision D66 (R-1365): should a source that stays down mail again every 7 days? Pick: yes.

Commits and CI (by head_sha, the jobs endpoint)

Repo	Commit	CI job	What
felhom.eu	`4afa8c3c`	2548 green	the watch: stated GAP, retries, R-1310's rules
felhom.eu	`2f7e836f`	2553 green	hub R-1352, commit only
felhom.eu	`d02c0c2c`, `17820abb`	2557, 2561 green	evidence
controller	`c4b6844`, `3764445`, `13e34d4`	2551, 2560, 2562 green	Traefik pin, five fixes, commit only
agent	`50eeccc`, `ecbb0cc`	2552, 2563 green	R-1302, commit only
catalog	`c760fca`, the one live push	2559 green	six `security_fix` steps; negative control first (`walks/_negative-control/`: `failed`)

Rows

Before 228, after 235. Closed (5): R-1303, R-1310, R-1324, R-1334, R-1336. Opened (12): R-1354 Traefik, R-1355 DooPlex's notices, R-1356 n8n 3, R-1357 PrivateBin, R-1358 cloudflared, R-1359 Mealie + Termix, R-1360 Meilisearch, R-1361 events lost, R-1362 Backups page, R-1363 raw JSON in a mail, R-1364 LAN DNS, R-1365 D66.

Observations

FILED: R-1361, R-1362, R-1363, R-1364 (the walks); R-1354–R-1360 (the triage).
Noted in R-468: the golden gate went red at midnight: the Sunday bake of 11-01 was missed (in no brief), golden 0.344.0 is 8 days old. Baking is not this night's work; no waiver written. A code push to felhom.eu is refused until a bake and the vouch. First on the list.
NOT-A-FINDING: the watch's 03:20 run is gates, not the watch.
NOT-A-FINDING: 9202's „Tárhely (…)" sources with no mount, and its refused removal of a per-app HDD_PATH: legacy of its own old installs (R-839 refuses that shape); no other box holds one.
NOT-A-FINDING: CT990000 stopped create on Tester 1: the restore test at that moment; it passed at 22:45.
NOT-A-FINDING: DooPlex restarted 2026-11-01 16:11 CET: two boots, read only; its only effect here is that R-1353's log covers 31 h.
NOT-A-FINDING: the watch's „0 new, 63 reminders" mail of 11-03: the 7-day reminder, as designed.
Fixed without a row (the size rule): the Vaultwarden fixture (1.37's register route), the n8n fixture (/healthz before the routes), the box-admin guard (the drill mirror), the Actual fixture's log, the undo tool (tools/undo_proof3.py: a probe with a container: line, services read by label).
A mistake, said plainly: one dead session token of a throwaway Actual reached the evidence in d02c0c2c; redacted in 03a71b68; the app was already removed; it stays in git history. Dead, and the fixture no longer logs it.

Teardown

Machine: 9202 back on its image, its yaml byte-identical, on the live catalog; bench 9401 stopped; Tester 1's routes and firewall as found, address empty. Host: the drill reset to live; local test images removed; nothing else provisioned. Hub: untouched. Left, on purpose: a restore_mixed hold for radicale in 9202's settings (the fence forbids CC to clear one; the command is in part3/README.md); email_cleared: true in Tester 1's settings; 9202's Paperless is a fresh install, the throwaway of 09-22 went with the walks. No VM was installed, so no hub host to delete.

Poster: no fact on it changed. Instruction files: none edited. Evidence: documentation/audits/security-2026-11-02/.

6.0 KiB Raw Blame History Unescape Escape