Gmer4Lfe
fb49eb20e8
chmod authorized_keys after every rewrite, so revoking a key does not disable the file
...
grep -v > tmp && mv keeps the temp file's umask mode, so an offboard left authorized_keys 0666 and sshd StrictModes silently refused every key in it — including the one the next onboard installs.
2026-08-17 11:06:56 -04:00
Gmer4Lfe
60e87ba518
Clear the mirror from the blocklist before the provisioning sync, not after it
...
A previous offboard blocklists the mirror and rsync.sh refuses blocklisted hosts, so on a re-onboard Step 1e was being refused and the auth stack would have deployed against empty directories.
2026-08-17 11:04:36 -04:00
Gmer4Lfe
ff94ccb343
Make the setup-state push report whether it worked
...
It was documented 'Always returns 0', so the offboard's new 'Phase flags pushed' check was testing a constant and ticking regardless.
2026-08-17 10:57:56 -04:00
Gmer4Lfe
42711ff9ac
Bring the seed docs in line with Phase 3
2026-08-17 10:24:41 -04:00
Gmer4Lfe
7c957d96be
Make seeding Phase 3 — its own operator-triggered phase, not the tail of an onboard
...
Onboard now ends at Phase 2: connected, running, and saying so. Phase 3 sets the seeding gate posture and dispatches the seed. With MEDIA_SEED_ENABLED false there is no Phase 3 and the model is two phases.
2026-08-17 10:23:03 -04:00
Gmer4Lfe
427a31cdff
Sync the auth stack's appdata to the mirror before the containers that read it are created
...
Deploying first meant Authelia, Lldap, NPM and both databases initialised themselves against empty directories. The gate arming moves to Step 1d for the same reason: the provisioning sync is an rsync, and Tier 1 stops every rsync. Tier 2 now ends the onboard off rather than as-found.
2026-08-17 10:12:10 -04:00
Gmer4Lfe
51125fa05a
Fix the offboard calling rsync_stop.sh at a path that has never existed, and stop the summary contradicting its own steps
...
Step 1 printed 'Rsync stopped' over a file-not-found, and the closing block asserted a clean separation and a synced auth config regardless of what happened.
2026-08-17 10:04:08 -04:00
Gmer4Lfe
24e347bb2d
Ship MEDIA_SEED_ENABLED off by default so a fresh node never inherits a multi-week transfer
...
Onboard arms the other Tier 2 gates but not this one — free space on a just-onboarded partner is the thing nobody has checked yet.
2026-08-17 09:55:40 -04:00
Gmer4Lfe
1a47f864f9
Put the media seed behind MEDIA_SEED_ENABLED so a partner filled by other means never starts a multi-week transfer
...
Tier 2 beside the per-orchestrator gates. Unset reads as on — the toggle postdates the seed.
2026-08-17 07:46:51 -04:00
Gmer4Lfe
ad623353bc
Stop the media seed from holding the onboard, and therefore the partnership, open for weeks
...
A first seed is ~28 TB behind a 12.5 MB/s bwlimit, and it ran inline as Step 9d, so the
phase-2 flag every status reader depends on was written only after it finished.
2026-08-17 07:40:00 -04:00
Gmer4Lfe
9d2610a911
Stop the host card claiming it is waiting for a partner after the onboard was cancelled
2026-08-17 07:23:48 -04:00
Gmer4Lfe
bc9692f521
Tighten authorized_keys after installing a key, since sshd ignores a world-writable one and says nothing to the installer
2026-08-17 07:19:46 -04:00
Gmer4Lfe
d8e3c09b57
Skip the key step when SSH already works, and read the install path live on both sides
2026-08-17 07:04:46 -04:00
Gmer4Lfe
7e7d845f61
Read the scripts dir live for the paste command, because choosing appdata moves it mid-wizard
2026-08-17 06:51:51 -04:00
Gmer4Lfe
b83c118c7f
Keep the SSH step visible until the partnership exists, not until the owner says its own phase 1 finished
2026-08-17 06:42:21 -04:00
Gmer4Lfe
069815790b
Put the join inside the wizard, send a partner to Partnership when it finishes, and say what is left
2026-08-17 06:16:36 -04:00
Gmer4Lfe
366e2a269f
Exclude the Redis AOF and MariaDB binlog from the dirty auth sync, which delivered their index without the file it names
2026-08-17 05:53:37 -04:00
Gmer4Lfe
bdc2cdbadb
Clear the onboard phase flags on offboard, and let the mirror signal the owner before revoking the key it signals with
2026-08-17 05:44:35 -04:00
Gmer4Lfe
fe58fb7826
File the owner's containers on the mirror during onboard, with the icon resolved where the Emby key is
2026-08-17 05:33:52 -04:00
Gmer4Lfe
6dbb076a1e
Name the partner fallback folder from master.conf and give it the closest Emby user's avatar
2026-08-17 05:27:25 -04:00
Gmer4Lfe
3676526daf
Remove the Docker tab and stop overwriting folder.view3's file, which destroyed folders made in its own UI
2026-08-17 05:11:00 -04:00
Gmer4Lfe
6a15a9d99a
Push INACTIVE to the mirror before revoking the key that push needs, and stop two steps reporting success they did not have
2026-08-17 04:58:15 -04:00
Gmer4Lfe
a46317de18
Make tailscale removal opt-in, since it depends on a key that expires and no-ops silently once it has
2026-08-17 04:49:32 -04:00
Gmer4Lfe
32355e0219
Record the tailscale grace period as a deadline instead of sleeping six hours inside the offboard
2026-08-17 04:46:01 -04:00
Gmer4Lfe
2cbc06a683
Show a launched job's progress, stop a refused rerun from overwriting the live record, and label deployed containers so Unraid owns them
2026-08-17 04:26:32 -04:00
Gmer4Lfe
cce1e25c2b
Let a non-blocking checklist item be dismissed with a recorded decision, and run discovery on the mirror once there is something to discover
2026-08-16 21:56:00 -04:00
Gmer4Lfe
39dba3f8ab
Say that the rsync count file is a cache the live-PID scan overwrites, so a stale value stops reading as a leak
2026-08-16 21:49:58 -04:00
Gmer4Lfe
5bdf3bff60
Report each teardown and setup step from what it did, not from whether it was attempted
2026-08-16 21:46:26 -04:00
Gmer4Lfe
65516ea3ac
Report the Tailscale device as removed only when it was, instead of whenever the toggle was on
2026-08-16 21:38:03 -04:00
Gmer4Lfe
27989d066e
Disarm on offboard every sync gate onboard arms, with the same helper, so the two are one operation in both directions
2026-08-16 21:36:46 -04:00
Gmer4Lfe
3ae6298656
Let a partner adopt the owner's custom networks from the conf phase 1 already cached, instead of asking for a value it cannot know
2026-08-16 21:20:59 -04:00
Gmer4Lfe
662f4f0d53
Create the network and cache partner confs in phase 1, where SSH already works and no plugin is needed on the far side
2026-08-16 21:13:46 -04:00
Gmer4Lfe
a02b918ff9
Make the cancel actually remove the key it says it removed, instead of erroring into a swallowed stderr
2026-08-16 21:03:54 -04:00
Gmer4Lfe
23825a824d
Create the networks our own pushed templates name, instead of trusting a fresh mirror to have uncommented them
2026-08-16 20:50:10 -04:00
Gmer4Lfe
cf67393db6
Read varaverk.cfg the way bash and the PHP side both read it, so a comment on the SCRIPTS_DIR line cannot disable cron suppression
2026-08-16 20:40:23 -04:00
Gmer4Lfe
7ed0f5c23b
Send the webhook setup to the path the partner actually uses, and arm the sync gates before the seed that depends on them
2026-08-16 20:32:14 -04:00
Gmer4Lfe
f363c6cd55
Match the trigger failure patterns before the success one, since the failures echo a path back
2026-08-16 20:26:46 -04:00
Gmer4Lfe
c8a6f58007
Launch owner-side Phase 2 through run_job.sh so it leaves a job record, and only claim it started once one exists
2026-08-16 20:25:54 -04:00
Gmer4Lfe
93cdbaac57
Give the mirror the terminal step its half of phase 1 actually needs, instead of a button that cannot answer a password prompt
2026-08-16 20:16:17 -04:00
Gmer4Lfe
47ad3b3075
Push the API key to the conf path the partner actually uses, and say so when there is no conf there
2026-08-16 19:59:15 -04:00
Gmer4Lfe
1493cf2dcf
Push our conf to partners on the 4-hour cycle too, since the conf-save hook the push half was written for never existed
2026-08-16 19:47:19 -04:00
Gmer4Lfe
35e59d2510
Let the plugin read partner vars from the same RAM cache bash reads, so PHP and bash cannot disagree about a partner
2026-08-16 19:40:49 -04:00
Gmer4Lfe
4f95cc6d13
Deliver master.conf to a node that has no Varaverk on it yet, which is the node that needs it
...
Phase 1 exists to hand the partner its identity before the install, but the push refused any
host without varaverk.cfg — so the conf could only ever reach a node that no longer needed it
to be told who it was. It now resolves the remote's conf directory across both install layouts
and creates the internal one when neither exists.
2026-08-16 16:14:23 -04:00
Gmer4Lfe
f627658567
Read the partner's identity out of master.conf instead of asking for it again
2026-08-16 13:56:09 -04:00
Gmer4Lfe
3c24550b19
Derive the pull target from the install location, so master.conf is safe to share between hosts
2026-08-16 13:54:05 -04:00
Gmer4Lfe
98fab394a1
Resolve the partner through the shared Tailscale resolver, so a shared-tailnet peer is findable
2026-08-16 13:43:02 -04:00
Gmer4Lfe
6fbc2b4125
Stop a missing SSH key making every Tailscale peer look like the Gitea host, and say so when the scripts are absent
2026-08-16 13:31:24 -04:00
Gmer4Lfe
64de77c065
Let the setup checklist create the SSH key it is asking for, instead of linking to a guide
2026-08-16 13:24:26 -04:00
Gmer4Lfe
19ba1e723c
Stop a paused rsync counting as an absent partner and auto-offboarding the partnership
2026-08-16 13:13:25 -04:00
Gmer4Lfe
1d4dc44668
Name HOST2 by the hostname the key derivation actually uses, not its Tailscale spelling
2026-08-16 13:07:10 -04:00
Gmer4Lfe