docs: English ISSUES and Nym public listing locations
Document harbourmaster/explorer URLs and identity key; translate ISSUES to English.
This commit is contained in:
Hernâni Marques
parent
9c1c8f2249
commit
1aa4d1bab8
5 changed files with 106 additions and 39 deletions
77
ISSUES.md
77
ISSUES.md
|
|
@ -1,24 +1,24 @@
|
|||
# Offene Issues (sichtbar)
|
||||
# Open issues
|
||||
|
||||
Stand: **2026-07-16** (koopa live scan). Keine Secrets.
|
||||
As of **2026-07-16** (live scan on koopa). No secrets.
|
||||
|
||||
---
|
||||
|
||||
## I-2026-07-16-01 — firewalld: Nym-Ports auf koopa unbestätigt
|
||||
## I-2026-07-16-01 — firewalld: Nym ports on koopa unverified
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **Severity** | high (für öffentliche Nym-Erreichbarkeit) |
|
||||
| **Severity** | high (for public Nym reachability) |
|
||||
| **Host** | koopa |
|
||||
| **Status** | open |
|
||||
|
||||
VeciGate DNATed **1789/tcp+udp**, **1790/tcp**, **51822/udp** → koopa.
|
||||
Ohne passende **firewalld**-Freigabe auf koopa bleibt der Traffic am Host stecken.
|
||||
VeciGate DNATs **1789/tcp+udp**, **1790/tcp**, **51822/udp** → koopa.
|
||||
Without matching **firewalld** allow rules on koopa, traffic dies on the host.
|
||||
|
||||
Agent konnte `firewall-cmd` nicht prüfen/ändern (**sudo Passwort nötig**).
|
||||
Agent could not run `firewall-cmd` (**sudo password required**).
|
||||
|
||||
```bash
|
||||
# auf koopa (mit sudo)
|
||||
# on koopa (with sudo)
|
||||
sudo firewall-cmd --permanent --add-port=1789/tcp
|
||||
sudo firewall-cmd --permanent --add-port=1789/udp
|
||||
sudo firewall-cmd --permanent --add-port=1790/tcp
|
||||
|
|
@ -29,33 +29,37 @@ sudo firewall-cmd --list-ports
|
|||
|
||||
---
|
||||
|
||||
## I-2026-07-16-02 — Nym-Node nicht gebondet / nicht im Explorer
|
||||
## I-2026-07-16-02 — Nym node not bonded / not in public explorers
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **Severity** | medium (ops / Sichtbarkeit im Nym-Netz) |
|
||||
| **Severity** | medium (visibility on the Nym network) |
|
||||
| **Host** | koopa (`koopa-nym`) |
|
||||
| **Status** | open |
|
||||
|
||||
Container **läuft** (mixnode), API `9080` antwortet.
|
||||
Ohne **Bond** in der Nym-Wallet erscheint die Node typischerweise **nicht** in Harbour Master / Explorer (anders als Tor nach ORPort-Publish).
|
||||
Container **is running** (mixnode); API on **9080** answers.
|
||||
Without a **bond** in the Nym wallet the node typically does **not** show up in Harbour Master / network explorers (unlike Tor after ORPort publish).
|
||||
|
||||
Logs: WARN `validator.nymtech.net/api/.../refresh-described` → **404** (API-Pfad/Version; Node mischt trotzdem).
|
||||
See also: `configs/nym/PUBLIC-LISTING.md`.
|
||||
|
||||
Logs: WARN `validator.nymtech.net/api/.../refresh-described` → **404** (API path/version; node still runs mixmode).
|
||||
|
||||
**Identity key (public):** `55gPqeyHHj4CwpVZXLEQy9MjSvVTVXM8t2pMmNCH2MsW`
|
||||
|
||||
---
|
||||
|
||||
## I-2026-07-16-03 — `podman-restart.service` enabled, session noch inactive
|
||||
## I-2026-07-16-03 — `podman-restart.service` enabled, inactive this session
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **Severity** | low (bis Reboot getestet) |
|
||||
| **Severity** | low (until reboot is tested) |
|
||||
| **Host** | koopa (user hernani) |
|
||||
| **Status** | open / expected until reboot |
|
||||
|
||||
`systemctl --user is-enabled podman-restart` = **enabled**,
|
||||
`is-active` = **inactive** (oneshot, diese Boot-Session noch nicht gelaufen).
|
||||
`is-active` = **inactive** (oneshot; has not run this boot session).
|
||||
|
||||
Nach Reboot prüfen:
|
||||
After reboot:
|
||||
|
||||
```bash
|
||||
systemctl --user is-active podman-restart.service
|
||||
|
|
@ -64,18 +68,17 @@ podman ps -a --filter should-start-on-boot=true --format '{{.Names}} {{.Status}}
|
|||
|
||||
---
|
||||
|
||||
## I-2026-07-16-04 — Streucontainer `kind_taussig`
|
||||
## I-2026-07-16-04 — Stray container `kind_taussig`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **Severity** | low (Hygiene) |
|
||||
| **Severity** | low (hygiene) |
|
||||
| **Host** | koopa |
|
||||
| **Status** | open |
|
||||
|
||||
Container **Up** seit ~5 Tagen: `kind_taussig` (`debian:bookworm-slim`),
|
||||
einmaliges Wallet-/DEB-Testskript, **`restart=no`**, kein Prod-Name.
|
||||
Container **Up** ~5 days: `kind_taussig` (`debian:bookworm-slim`), one-off wallet/DEB test script, **`restart=no`**, not a production name.
|
||||
|
||||
Kandidat zum **Stoppen/Entfernen**, sobald Logs nicht mehr gebraucht werden:
|
||||
Candidate to stop/remove when logs are no longer needed:
|
||||
|
||||
```bash
|
||||
podman stop kind_taussig
|
||||
|
|
@ -84,40 +87,40 @@ podman rm kind_taussig
|
|||
|
||||
---
|
||||
|
||||
## I-2026-07-16-05 — Alte exited Podman-Container (Müll)
|
||||
## I-2026-07-16-05 — Old exited Podman containers (clutter)
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **Severity** | low (Hygiene) |
|
||||
| **Severity** | low (hygiene) |
|
||||
| **Host** | koopa |
|
||||
| **Status** | open |
|
||||
|
||||
Mehrere **Exited**-Container (Monate/Jahre alt), u. a. `pensive_dubinsky`,
|
||||
Several **Exited** containers (months/years old), e.g. `pensive_dubinsky`,
|
||||
`hardcore_edison`, `taler-exchange-no-network`, `debian00`, …
|
||||
Kein Autostart; belasten nur `podman ps -a`.
|
||||
No autostart; only clutter `podman ps -a`.
|
||||
|
||||
Optional aufräumen: `podman container prune` (nur exited, nach Sichtprüfung).
|
||||
Optional cleanup: `podman container prune` (exited only, after review).
|
||||
|
||||
---
|
||||
|
||||
## I-2026-07-16-06 — Nym HTTP-API `*:9080` lauscht host-weit
|
||||
## I-2026-07-16-06 — Nym HTTP API listens on `*:9080`
|
||||
|
||||
| | |
|
||||
|--|--|
|
||||
| **Severity** | low–medium (Angriffsfläche) |
|
||||
| **Severity** | low–medium (attack surface) |
|
||||
| **Host** | koopa |
|
||||
| **Status** | open (bewusst so im compose) |
|
||||
| **Status** | open (as configured in compose) |
|
||||
|
||||
`ss` zeigt **\*:9080** (rootlessport). **Kein** VeciGate-DNAT auf 9080.
|
||||
Von WAN ohne NAT i. d. R. nicht erreichbar; von LAN erreichbar.
|
||||
`ss` shows **\*:9080** (rootlessport). **No** VeciGate DNAT for 9080.
|
||||
Usually not reachable from WAN without NAT; reachable from LAN.
|
||||
|
||||
Härten optional: Publish nur `127.0.0.1:9080:8080` in compose.
|
||||
Optional harden: publish only `127.0.0.1:9080:8080` in compose.
|
||||
|
||||
---
|
||||
|
||||
## Erledigt / kein Issue (Scan)
|
||||
## Not an issue (scan)
|
||||
|
||||
- Alle `should-start-on-boot` Prod-Container **Up**
|
||||
- Keine failed user units
|
||||
- Taler 9010–9015 antworten (401/302 ok)
|
||||
- All production `should-start-on-boot` containers **Up**
|
||||
- No failed user units
|
||||
- Taler ports 9010–9015 respond (401/302 OK)
|
||||
- Linger=yes, container-* units enabled
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue