Found by the readiness assessment on #381. Deploying rproxy from next needs an image of next; the registry has none.
What the registry holds:git.eeqj.de/sneak/smallwebwaf has one image, pushed on 6 November from commit c402926 (the publish-image branch), under the tags 2026-11-07, c402926, publish-image and latest. It pulls anonymously, so an upaas build can name it in a FROM line.
What is wrong: that binary reads the setting names of 6 November, SWRP_WAF_BACKEND among them. next renamed them on 12 November (SWW_RPROXY_WAF_BACKEND and the rest, #234). A container configured from next's documents against that image stops at start for a missing SWRP_WAF_BACKEND, and its health check never passes. The image also predates the WebDAV methods (#278) and the removal of an untrusted peer's forwarded headers (#325, #334). A real build and push from next has not been tried (#223).
Definition of done:
make publish has run from a clean checkout at the head of next, or of main once #223 is merged. It builds on the Docker host DOCKER_HOST names (ssh://root@fsn1app1 unless set), runs the tests and the linter first, and pushes the date, the short hash, the branch and latest.
The registry's latest is that build, and the digest the push prints is what the app Dockerfiles' FROM lines name.
This needs the owner's Docker host. A session without access to it says so here and stops; it does not retry.
Model: fable-5-1
Found by the readiness assessment on https://git.eeqj.de/sneak/smallwebwaf/issues/381. Deploying `rproxy` from `next` needs an image of `next`; the registry has none.
**What the registry holds:** `git.eeqj.de/sneak/smallwebwaf` has one image, pushed on 6 November from commit `c402926` (the `publish-image` branch), under the tags `2026-11-07`, `c402926`, `publish-image` and `latest`. It pulls anonymously, so an upaas build can name it in a `FROM` line.
**What is wrong:** that binary reads the setting names of 6 November, `SWRP_WAF_BACKEND` among them. `next` renamed them on 12 November (`SWW_RPROXY_WAF_BACKEND` and the rest, https://git.eeqj.de/sneak/smallwebwaf/issues/234). A container configured from `next`'s documents against that image stops at start for a missing `SWRP_WAF_BACKEND`, and its health check never passes. The image also predates the WebDAV methods (https://git.eeqj.de/sneak/smallwebwaf/issues/278) and the removal of an untrusted peer's forwarded headers (https://git.eeqj.de/sneak/smallwebwaf/issues/325, https://git.eeqj.de/sneak/smallwebwaf/issues/334). A real build and push from `next` has not been tried (https://git.eeqj.de/sneak/smallwebwaf/pulls/223).
**Definition of done:**
- `make publish` has run from a clean checkout at the head of `next`, or of `main` once https://git.eeqj.de/sneak/smallwebwaf/pulls/223 is merged. It builds on the Docker host `DOCKER_HOST` names (`ssh://root@fsn1app1` unless set), runs the tests and the linter first, and pushes the date, the short hash, the branch and `latest`.
- The registry's `latest` is that build, and the digest the push prints is what the app Dockerfiles' `FROM` lines name.
This needs the owner's Docker host. A session without access to it says so here and stops; it does not retry.
Model: fable-5-1
Stopped without a PR: this session has no access to the Docker host. SSH to root@fsn1app1 was refused (publickey) at 19:22 UTC on 2026-11-13. No retry was made. The publish needs sneak to run make publish from next, or to give clawbot access to that host.
Model: opus-5-5
Stopped without a PR: this session has no access to the Docker host. SSH to `root@fsn1app1` was refused (publickey) at 19:22 UTC on 2026-11-13. No retry was made. The publish needs sneak to run `make publish` from `next`, or to give `clawbot` access to that host.
Model: opus-5-5
Assigned to sneak: only he can do this. Either run make publish from a checkout of next on the Docker host, or give clawbot SSH access to root@fsn1app1 so a worker can. Recommendation: run it once by hand now; access for the fleet can be decided separately.
Model: opus-5-5
Assigned to sneak: only he can do this. Either run `make publish` from a checkout of `next` on the Docker host, or give `clawbot` SSH access to `root@fsn1app1` so a worker can. Recommendation: run it once by hand now; access for the fleet can be decided separately.
Model: opus-5-5
sneak
was assigned by clawbot2026-11-13 20:23:34 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Found by the readiness assessment on #381. Deploying
rproxyfromnextneeds an image ofnext; the registry has none.What the registry holds:
git.eeqj.de/sneak/smallwebwafhas one image, pushed on 6 November from commitc402926(thepublish-imagebranch), under the tags2026-11-07,c402926,publish-imageandlatest. It pulls anonymously, so an upaas build can name it in aFROMline.What is wrong: that binary reads the setting names of 6 November,
SWRP_WAF_BACKENDamong them.nextrenamed them on 12 November (SWW_RPROXY_WAF_BACKENDand the rest, #234). A container configured fromnext's documents against that image stops at start for a missingSWRP_WAF_BACKEND, and its health check never passes. The image also predates the WebDAV methods (#278) and the removal of an untrusted peer's forwarded headers (#325, #334). A real build and push fromnexthas not been tried (#223).Definition of done:
make publishhas run from a clean checkout at the head ofnext, or ofmainonce #223 is merged. It builds on the Docker hostDOCKER_HOSTnames (ssh://root@fsn1app1unless set), runs the tests and the linter first, and pushes the date, the short hash, the branch andlatest.latestis that build, and the digest the push prints is what the app Dockerfiles'FROMlines name.This needs the owner's Docker host. A session without access to it says so here and stops; it does not retry.
Model: fable-5-1
Stopped without a PR: this session has no access to the Docker host. SSH to
root@fsn1app1was refused (publickey) at 19:22 UTC on 2026-11-13. No retry was made. The publish needs sneak to runmake publishfromnext, or to giveclawbotaccess to that host.Model: opus-5-5
Assigned to sneak: only he can do this. Either run
make publishfrom a checkout ofnexton the Docker host, or giveclawbotSSH access toroot@fsn1app1so a worker can. Recommendation: run it once by hand now; access for the fleet can be decided separately.Model: opus-5-5