From 94110fa0243e885e5e7aa45339c8bd7fa5f299e8 Mon Sep 17 00:00:00 2001 From: badbread Date: Sun, 9 Aug 2026 10:01:10 -0700 Subject: [PATCH] fix(install): close the four fresh-install-audit findings From an outside-in fresh install of the repo on a clean host: - setup-env.sh 'NEXT:' hint now says 'docker compose pull && docker compose up -d', matching the README's two-command sequence instead of skipping pull. - setup-env.sh gains a middle 'advisory' free-space band: below 50 GiB (but above the 10 GiB hard floor) it now warns that the disk is small for continuous recording, so an 11-GiB path no longer passes silently. The doc (AI-INSTALL 1) promised this warning; the script now actually emits it. - AI-INSTALL: note that GET /auth/setup-status echoes 'localhost' for a host-local request, so a headless installer sets server_address to the real LAN address, not the suggestion. - README install section: note that HTTPS on :8443 uses an internal self-signed cert (browser warns on first visit); plain http on :8080 on a trusted LAN is fine. Points at docs/TLS.md. Validated: bash -n clean; the advisory band fires for 11 GiB and not for 60 GiB. Signed-off-by: badbread --- README.md | 4 ++++ docs/AI-INSTALL.md | 5 ++++- scripts/setup-env.sh | 11 +++++++++-- 3 files changed, 17 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 768ae8a7..5f459f24 100644 --- a/README.md +++ b/README.md @@ -357,6 +357,10 @@ That is the whole install. A few options if you want them: to Docker? This is the hands-off path. - **Use native apps** instead of the browser (Windows/macOS desktop, Android). See the [client install guide](docs/CLIENTS.md). +- **Prefer HTTPS?** Caddy also serves the console at `https://:8443/admin`, but + with an internal self-signed certificate, so your browser warns on the first visit until you + trust the CA. Plain `http://:8080` on a trusted LAN is fine; for real TLS see + [docs/TLS.md](docs/TLS.md). - **Build from source** instead of pulling images (you are developing Crumb, running air-gapped, or on a fork that has not published images): `docker compose -f docker-compose.yml -f docker-compose.build.yml up -d --build` diff --git a/docs/AI-INSTALL.md b/docs/AI-INSTALL.md index cab63300..d16f6389 100644 --- a/docs/AI-INSTALL.md +++ b/docs/AI-INSTALL.md @@ -541,7 +541,10 @@ All wizard steps have API equivalents. Do them in order: with empty strings for fields you are not changing.) (`GET /auth/setup-status` returns a suggested address derived from the request, plus `suggested_scan_range`, the server's own `/24`, a good default for the - discovery scan below. It's `null` when the console was reached by hostname.) + discovery scan below. It's `null` when the console was reached by hostname, and + it echoes back `localhost` when you call it from the host itself, so on a + headless install set `server_address` to the LAN IP or hostname your phone and + desktop apps will actually reach, not whatever this suggests.) 3. **Storage + retention.** Confirm/adjust the disk via `GET`/`POST /config/storages`, optionally preflight the path first with `POST /config/fs/check` `{path}` → `{status: "ok"|"warn"|"error", writable, free_bytes, total_bytes, message}`. diff --git a/scripts/setup-env.sh b/scripts/setup-env.sh index 9f2928cd..4345af07 100755 --- a/scripts/setup-env.sh +++ b/scripts/setup-env.sh @@ -424,7 +424,8 @@ fi # instead of assuming, and fail the run when the answer is definitely no. # Platform-by-platform notes: docs-site/docs/getting-started/platform-notes.md. STORAGE_PREFLIGHT_FAILED=0 -FREE_SPACE_FLOOR_KIB=10485760 # 10 GiB +FREE_SPACE_FLOOR_KIB=10485760 # 10 GiB (below this: a strong warning) +ADVISORY_SPACE_KIB=52428800 # 50 GiB (below this but above the floor: a gentle "small for an NVR" note) # Filesystem type of the mount holding $1. Empty = could not determine (that is # a "skip the check", never a failure). GNU stat first, then df -T, then mount. @@ -563,6 +564,12 @@ if [[ -d "${MEDIA_DIR_HOST}" ]]; then log " Cameras eat terabytes. Point MEDIA_HOST_PATH at a real disk, or set" log " retention low enough that this fills predictably rather than by surprise:" log " MEDIA_HOST_PATH=/mnt//crumb scripts/setup-env.sh --force" + elif [[ "${MEDIA_FREE_KIB}" -lt "${ADVISORY_SPACE_KIB}" ]]; then + log "storage preflight: $(( MEDIA_FREE_KIB / 1048576 )) GiB free at ${MEDIA_DIR_HOST}, which is on" + log " the small side for continuous recording. A single HD camera can use tens of GiB" + log " per day; Crumb evicts oldest footage to stay above its free-space floor, but" + log " plan retention (or point MEDIA_HOST_PATH at a larger disk) so it fills" + log " predictably rather than by surprise." else log "storage preflight: $(( MEDIA_FREE_KIB / 1048576 )) GiB free at ${MEDIA_DIR_HOST}" fi @@ -655,4 +662,4 @@ if [[ "${STORAGE_PREFLIGHT_FAILED}" -eq 1 ]]; then exit 1 fi -log "NEXT: 'docker compose up -d', then open http://:8080/admin and sign in with the above." +log "NEXT: 'docker compose pull && docker compose up -d', then open http://:8080/admin and sign in with the above."