diff options
| -rw-r--r-- | todo.org | 72 |
1 files changed, 72 insertions, 0 deletions
@@ -1,6 +1,7 @@ #+TITLE: ArchSetup Tasks #+AUTHOR: Craig Jennings #+DATE: 2026-02-14 +#+PRIORITIES: A D D * Archsetup Priority Scheme @@ -45,6 +46,52 @@ below): input-side-spec.org (DRAFT, four decisions open). * Archsetup Open Work +** TODO [#C] maint backup_freshness probe blind to backup_run remedy runs :bug:maint:dotfiles:solo: +:PROPERTIES: +:CREATED: [2026-09-12 Sat] +:LAST_REVIEWED: 2026-09-12 +:END: +From home's 2026-09-12 velox health check. The backup_freshness probe +(dotfiles =maint/src/maint/probes/services.py=) parses the tail of +=/var/log/rsyncshot.log=, which only the root crontab lines append to. The +=backup_run= remedy (=remedies.py=) runs rsyncshot without that redirect, so +right after a successful =maint fix backup_run= (DAILY.0 rotated on truenas +at 21:29) the probe still said "daily 272h ago" and stayed CRITICAL until +the next cron daily landed. + +Fix: make the remedy log the way the cron lines do (append the run to +=/var/log/rsyncshot.log=), so the probe and the remedy read and write the +same record. Reading the snapshot directories instead is the other route, +but they live on truenas, so the probe can't see them without a network +call on the status path. + +Grading: Minor (a false CRITICAL that hides nothing, but persists for days) +x some users sometimes (only after a by-hand remedy) = P3 = [#C]. Solo: the +remedy-logs fix is mechanical and the maint suite covers remedies. Dotfiles +work, which this project carries end to end. + +** TODO [#B] Loopback-only binds in maint's unexpected-listener set :bug:maint:dotfiles: +:PROPERTIES: +:CREATED: [2026-09-12 Sat] +:LAST_REVIEWED: 2026-09-12 +:END: +From home's 2026-09-12 velox health check. The slack-mcp-deepsat container's +=docker-proxy= on =127.0.0.1:13080= is a persistent unexpected-listener warn +on velox (ratio runs the same container). A loopback bind is not a LAN +exposure, and the firewall digest already distinguishes wildcard-bound +listeners from the rest. + +Two routes: treat loopback-only listeners as informational (drop them from +the unexpected set, keep them in the rows view), or curate =docker-proxy= as +expected per machine from the panel's MARK EXPECTED. The first is the durable +fix; the second is the workaround that works today. + +Not solo: whether a loopback port belongs in the signal at all is my call +(a local port is still reachable from a browser), so the design question +comes first. Grading: Minor (a permanent warn that trains me to skim past +the listeners row) x every user every time (both daily drivers run the +container, and the warn never clears) = P2 = [#B]. + ** TODO [#B] Speedtest button cancels an in-flight run :feature:dotfiles:network: :PROPERTIES: :CREATED: [2026-09-01 Tue] @@ -130,6 +177,24 @@ Then: flip the decisions DONE, run spec-review (DRAFT → READY), run spec-response to decompose the four phases into build tasks here, file the vNext =[#D]= kernel-reboot item, and commit the spec. +*** 2026-09-12 Sat @ 23:26:50 -0500 Containers step and initramfs-read findings from the 2026-09-12 velox run +home's velox health check hit another route to the unreachable exit 0 this +spec is about: topgrade exited 1 only because its containers step tried to +=docker pull= locally built images (=cj/telega-server=, =telega-server-glycin=; +ratio has the same shape with its own local images) and got "pull access +denied", so the stamp was applied by hand with =maint stamp topgrade=. Two +fixes: add =containers= to the =--disable= list in the guarded-upgrade's +topgrade invocation, or list the local images under =[containers] +ignored_containers= in topgrade.toml. I lean to disabling the step: pulling +newer images underneath running containers isn't an upgrade path I use, and +an enumerated ignore list rots as images come and go. + +Also for the =kernel-modules-check= gate: reading the initramfs needs root. +The images are 0600, so an unprivileged =lsinitcpio= exits 1 with "Unable +to read file" on stderr and nothing on stdout; piped into =grep -c=, that +empty stdout reads as 0 and looks like a missing module. The gate has to +run as root and check the exit status, not just the count. + ** TODO [#A] Lock-screen clock stale after a real sleep :bug:hyprland:dotfiles:velox: SCHEDULED: <2026-08-25 Tue> :PROPERTIES: @@ -3302,6 +3367,13 @@ wg-US-CA-144, wg-US-TX-714 and wg-NL-781 (all on wgpvpn) complete a WireGuard ha The net doctor now names these as a dead tunnel and brings them down (dotfiles f56fd1a), which gets the machine back online but doesn't restore the tunnels. Two ways out: re-download the WireGuard configs from the Proton dashboard and re-import them (nmcli connection import type wireguard file ...), or drop the static profiles and use the Proton CLI only. Needs the Proton account, so not solo. +*** 2026-09-12 Sat @ 23:26:50 -0500 The NM tunnel DoT drop-in already covers wgpvpn +=/etc/NetworkManager/conf.d/tunnel-dns-over-tls.conf= (live on both daily +drivers since 2026-09-10/12, and now written by the installer) matches +=interface-name:wgpvpn= as well as =proton0=, so a re-imported static profile +gets per-link DNS over TLS turned off automatically. Their dead-forwarding +problem is separate and unchanged. + ** TODO [#C] Declined dot-link-restore branch untested :test:network:dotfiles:solo:quick: :PROPERTIES: :LAST_REVIEWED: 2026-09-09 |