Unraid already enforces CSRF on every POST via auto_prepend, but its
injector is jQuery-only — the plugin's native fetch() calls carried no
token and were being terminated before the endpoint ran, silently,
because csrf_terminate exits with an empty body that r.json() swallows.
Documents each tab's purpose, what it renders, and which endpoints it polls.
Pages that start with markup get the header in a <?php ?> block so it never
reaches the browser.
Also corrects the layer diagram in README-unraid.md: eight of eleven pages hold
no PHP logic and poll api/ for everything — only auth, monitor and scheduler
require an include/ file directly.
Same root cause as the tab-navigation fix (a6fe820): the "Open Terminal"
link builds its href from window.location.hostname (the same server the
plugin is already running on) but Unraid's global external-link guard
still flags it, since it's a fully-qualified URL the guard hasn't seen
allowed before. Added class="localURL", the same escape hatch used for
the tab bar and dynamix's own pages.
- Move SCRIPTS_DIR/DATA_DIR/STATE_DIR from appdata to /boot/config/plugins/varaverk
- All state files now in STATE_DIR (no more /tmp or /boot/config root writes)
- Bootstrap: Gitea-first clone with GitHub fallback, no array dependency
- varaverk.cfg seeded with Gitea connection settings
- .gitignore: add State_Files/, varaverk.cfg, varaverk-*.txz
- Partnership/transcode/fallback scripts use STATE_DIR variables
- PHP config.php: DATA_DIR/STATE_DIR constants, VV_SETUP_STATE_FILE dynamic
- deploy.sh PROD_ROOT updated to plugin flash dir
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Single '▶ Onboard' button per unprovisioned remote → expands that card
to show Step 1 (terminal link + click-to-copy command) and Step 2 (Push Conf)
- Onboard state persists across 10s poll re-renders via top-level _vvOnboarding map
and _vvPtReload hook set by the IIFE
- Phase 1 complete: amber 'SSH ready' pill + Tailscale IP + Phase 2 manual button
- Phase 2 complete: green 'Active' pill + date + IP + uptime + unRAID version + state
- Compact compact '○ Not provisioned' + Reset button when not in onboard mode
- Removed vvPtPhase1 (replaced by vvPtStartOnboard toggle)
- vvPtStartOnboard / vvPtEndOnboard are top-level functions
At phase 0, show below the buttons:
- 'Open Terminal' link using HOST1's Tailscale IP (/webterminal/ttyd/)
- Clickable command code block (click to copy) with the Phase 1 script path
- Note that tab auto-updates on next poll when the script completes
Tailscale IP comes from selfNode.ts_ip already in the API response.
partnership_onboard.sh (--phase1-only):
- Test if SSH already works first (BatchMode) — skip ssh-copy-id if yes
- If ssh-copy-id fails (no TTY in background): soft-fail, generate key locally,
print pubkey for manual install, write HOST2_KEY_READY=true, run local setup
- Only skip conf push if SSH truly unavailable; otherwise proceeds normally
- Exit 0 with clear manual-step instructions instead of hard failure
include/partnership.php:
- Read HOST2_KEY_READY from setup.db; expose as key_ready on remote nodes
pages/partnership.php:
- Node card: amber "Key generated · install on HOST2 then Push Conf" badge
when key_ready=true and phase=0
- "Push Conf (key installed)" button appears when key_ready=true — runs
--phase1-only --skip-ssh (assumes user manually did ssh-copy-id)
- vvPtPushConf() top-level function
partnership_manager.sh:
- --local-only flag for --onboard: skips remote pre-flight, WebUI reconfig,
state push; runs FolderView3 folder creation + writes HOST1_LOCAL_DONE=true
to setup.db + pushes it; exits without writing ACTIVE (partnership not yet
established until Phase 2)
partnership_onboard.sh:
- Phase 1 exit now runs partnership_manager.sh --onboard --local-only after
SSH + conf push, so HOST1 is fully configured on its own side before Phase 2
include/partnership.php:
- vv_pt_nodes() reads HOST1_LOCAL_DONE from setup.db; exposes as local_done
on the self node (null for remote nodes)
pages/partnership.php:
- Self node card shows green "Local setup complete · waiting for partner"
badge when local_done=true
- Actions: "Complete HOST1 Setup" button appears when HOST1 hasn't run local
setup yet but HOST2 is already at phase 1 — lets user trigger it manually
- vvPtLocalSetup() top-level function calls partnership_manager.sh via run.php
If run.php returns an empty body (transient nginx/PHP-FPM issue), the script
still runs via nohup. Treat empty response as ok instead of throwing a
JSON parse error that misleads the user into thinking the action failed.
onboard_cancel.sh:
- SSHes HOST2 while key still valid: removes HOST1 pubkey from authorized_keys
and clears HOST2_PHASE* from setup.db on the remote side
- Deletes local private + public key pair
- Clears HOST2_PHASE* from local setup.db
- Graceful if HOST2 unreachable (local side still cleaned up)
partnership.php:
- Cancel button (warn style, slightly dimmed) at phase 0 and phase 1
- vvPtCancel() top-level function, calls onboard_cancel.sh via run.php
window.fn = inside an IIFE is not reliable in all script-loading contexts.
Move vvPtPhase1/2, vvPtOnboard, vvPtOffboard and their _vvPtRun helper
above the IIFE as plain top-level function declarations — unconditionally
global and reachable from onclick= attributes.
Tab pages use full page reloads (not AJAX) — function declarations inside
the IIFE are not in global scope, so onclick= attributes fail silently.
Fix: assign all onclick-callable functions to window.*
Replace vvRunById() calls with direct fetch (vvRunById is also IIFE-scoped
in scheduler.php, unavailable in the partnership tab context).
Add .catch() handlers so network/parse errors surface as alerts.
Fix 1 — Monitor partner card (common.php + monitor.php):
vv_remote_hosts_stats() no longer skips hosts with no API key.
Returns no_api_key:true entry instead. Monitor JS renders
"API key not configured — complete Onboard to enable" instead
of a blank space.
Fix 2 — rawconf push not alarming pre-onboard (config.php + scheduler.php):
Probe failures (Tailscale not found, plugin not installed) now carry
ready:false. JS treats ready:false results silently — button shows
"✓ Saved" not "push failed: HOST2" before SSH is set up.
Only genuine post-onboard failures (ready not false) show as errors.
Fix 3 — Partnership Onboard button (partnership.php):
Disabled with tooltip when no partner hostname is in master.conf.
When partner configured but not onboarded, adds explanation note:
"Onboard will generate your SSH key, exchange it with the partner..."
No partner configured: "Edit master.conf and set HOST2."
scheduler.php: after host1.conf save in setup mode, redirect to
?tab=partnership&vv_onboard=1 instead of Monitor.
HOST2+ still redirects to Monitor (they don't manage the partnership).
partnership.php: detects vv_onboard=1 URL param after actions render.
Adds pulse animation + box-shadow to the Onboard button and scrolls
it into view. One-shot — gone when user navigates away.
Gmer4Lfe