Files
felhom.eu/documentation/audits/website-dashboard-2026-10-08/README.md
T

54 lines
3.4 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# Dashboard pictures for the website — evidence (2026-10-08)
## The scene, and why it moved
1. **9202 updated to the fleet's controller** (operator's word, 2026-10-08): `/etc/felhom-controller-image`
`…:0.301.0` → `…:0.303.0` (old line kept as `/etc/felhom-controller-image.bak-0.301.0` in the guest), bootstrap
restarted; `felhom-controller … 0.303.0 Up 13 seconds (healthy)`.
2. **On 9202:** Vaultwarden, Jellyfin, Nextcloud and Immich installed through the product (Immich's first pull was
refused by ghcr.io „toomanyrequests"; the second try deployed). One whole-box backup press and one Tier-2 run:
`db_dump success, count 3`; „Tier 2 run complete: 6 app(s)".
3. **The 9202 pictures were not used.** Every page carried a banner „+ 5 további figyelmeztetés" — nine
`disk-not-separate` warnings (9202's „second drive" is a folder on the host's NVMe, plus earlier sessions' leftover
app folders) and the hub-off warning. True for a scratch guest, not a household's normal state. The banner itself
showed none of the five warnings it counted on those pages: **R-906**.
4. **Pictures taken on demo-hp's household guest 9201** (operator: the physical boxes are test boxes too): controller
0.303.0, 10 standing apps, hub connected, **no alerts** (`/api/debug/dump` → `alerts: []`), last night's app backup
`success` at 04:16. Read only; the household language was switched to English for the English pictures and back to
Hungarian right after (both POSTs 302; read back `lang="hu"`). Headless Chrome ran on 9202, reaching 9201's traefik
at `192.168.0.155`; nothing ran on 9201.
## The pictures (`website/assets/`, 1440 × 900, WebP q82)
| File | Bytes |
|---|---|
| dashboard-start-hu.webp / -en | 34,024 / 31,948 |
| dashboard-apps-hu.webp / -en | 59,018 / 54,156 |
| dashboard-app-hu.webp / -en (Paperless-ngx) | 83,124 / 78,992 |
| dashboard-backups-hu.webp / -en (Backup → Apps) | 52,638 / 45,292 |
Taken but not published: the backups overview, the System page, the phone view (`captions-claims.md` says why).
The full-size PNGs stay out of the repository.
## Privacy
`privacy-scan.txt` — every published picture's page text: 0 e-mails, 0 IPv4 addresses, 0 serials, no domain except the
test domain `enkisfelhom.hu` and `felhom.eu`; the one long hex value is the hidden CSRF field (not visible). Positive
control: an app name known to be on each page, found 8 of 8. By eye: the pictures show the test domain, app names and
backup sizes/times; no person's name (the household is „Demo HP", shown only on the unpublished System page).
## Clean-up (three layers)
- **9202:** Vaultwarden, Jellyfin, Nextcloud, Immich removed through the product (stop + remove with drive data and
backups; volumes gone, stack folders back to their template files). Paperless-ngx (running) and PrivateBin
(stopped) — there before this task — left as found; the whole-box backup restarted Paperless and it came back healthy.
`/root/dash` removed; the session cookie file shredded on both sides. The `userdata/{immich,jellyfin,nextcloud}`
folders on the scratch drive hold earlier sessions' content (`kept/`, `backups/`) and were left. **9202 stays on
0.303.0** (operator-approved).
- **9201:** nothing changed except the language round trip (ends Hungarian, as found).
- **demo-hp host:** only `pct exec 9202/9201 -- …` and `pct list`. **Hub:** nothing touched.
## Decoy
`decoy.txt` — gate 19, mutation and failure line.