CyberMind-FR 29989e16d5 fix(picobrew): final branch-review fixes (C2-C5, I1-I8, mineurs) ... C2: fix IP collision — picobrew's 10.100.0.140 is already used by secubox-frigate on br-lxc (verified /data/lxc/frigate/config); reassign to 10.100.0.150 everywhere (ctl, unbound drop-in, tests, specs/plans docs). C3: postinst no longer aborts under set -e when the unit is masked (unmask before enable, tolerate failure like the start line already does). C4: drop ReadWritePaths=/sys/bus/w1 from the unit — the path doesn't exist on the board and phase 1 ships no sensor controller (preserved untouched in lib/stillwatch/); no other sensor paths were present to remove. C5: run the API as User=secubox/Group=secubox instead of root, matching the sudoers grant (secubox -> picobrewctl) and the repo's single-privileged- surface rule; drop the now-pointless ExecStartPost socket chown/chmod; NoNewPrivileges=no kept and documented (required for sudo to work). No shared parent (/run/secubox, /etc/secubox, /var/log/secubox) is touched. I1: prerm no longer removes the nginx conffile on upgrade (only remove/purge), so an upgrade keeps the API/panel route alive. I2: /status, /start, /stop become plain `def` handlers — they call the synchronous, blocking `_ctl` (subprocess.run, 20s timeout) and must not run on the async event loop. I3: add python3-fastapi | python3-pip to Depends (api/main.py imports fastapi directly). I4: drop ConditionArchitecture=arm64 and the stale 1-Wire/I2C sensor comment — phase 1 is a sensor-less LXC appliance, nothing arch-specific. I5/I6: rewrite debian/control's Description and README.md to describe what phase 1 actually ships (LXC-hosted picobrew_pico server + DNS rewrite + panel), moving fermentation/sensor tracking to "later phase, not shipped". I7: panel now links to the real PicoBrew interface (https://<lxc-ip>/), shown only while the container is running. I8: document in the plan's manual verification recipe that LAN -> br-lxc forwarding (default-DROP nftables) must be checked before the first real device test, since that test is also the first test of that network path. Mineurs: panel act()/load() gain try/catch and response.ok checks with visible error feedback (previously implemented alongside C1, already committed: argv fix + guard test, _wait_running polling loop replacing the fixed `sleep 3` in cmd_install, cmd_status validating the pinned SHA before emitting it, and a comment documenting PICOBREW_SESSION_FILE as test-only).		2026-07-23 19:23:50 +02:00
..
integration-tests
plans	fix(picobrew): final branch-review fixes (C2-C5, I1-I8, mineurs)	2026-07-23 19:23:50 +02:00
runs
specs	fix(picobrew): final branch-review fixes (C2-C5, I1-I8, mineurs)	2026-07-23 19:23:50 +02:00