Issues

• [KI-89] Dev-only Headscale control-plane private key left in public history must be regenerated

  known-issue
  Verryx-02/RAM-USB#88 · Filter by author Verryx-02 opened on Aug 3, 2026

• [KI-88] The KI-40 hashed-key migration destroys existing rows

  known-issue
  Verryx-02/RAM-USB#87 · Filter by author Verryx-02 opened on Aug 3, 2026

• [KI-87] Residual race window between Handler.Grant and the sweep, deferred

  known-issue
  Verryx-02/RAM-USB#86 · Filter by author Verryx-02 opened on Aug 3, 2026

• [KI-86] Thirteen leftover refinements: tests, s6 conventions, and two guarantees claimed but not delivered

  known-issue
  Verryx-02/RAM-USB#85 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-85] A CreateMeshUser failure leaves the account permanently locked, with no retry path

  known-issue
  Verryx-02/RAM-USB#84 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-84] Seven minor refinements to nginx, the Mosquitto ACL, mounts and dev-only scripts

  known-issue
  Verryx-02/RAM-USB#83 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-83] Bootstrap token passed on the docker run command line

  known-issue
  Verryx-02/RAM-USB#82 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-82] deployments/docker/user-client/Dockerfile is a zero-byte file that contradicts RISK-03

  known-issue
  Verryx-02/RAM-USB#81 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-81] Stale documentation: MANUAL known issue #7, proxmox/storage-service.md, VERIFICATION.md

  known-issue
  Verryx-02/RAM-USB#80 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-80] Five identical trust-mesh-ca.sh and five 87%-identical tailscale-up.sh: ~112 duplicated lines

  known-issue
  Verryx-02/RAM-USB#79 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-79] postgres-ready.sh and timescaledb-ready.sh hardcode the role and database that compose passes as variables

  known-issue
  Verryx-02/RAM-USB#78 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-78] e2e-test.sh writes an SSH private key to a predictable path and never deletes it

  known-issue
  Verryx-02/RAM-USB#77 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-77] export VAR=$(...) defeats set -e in nine startup scripts

  known-issue
  Verryx-02/RAM-USB#76 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-76] nginx trusts the CA root with no revocation checking

  known-issue
  Verryx-02/RAM-USB#75 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-75] Base images on moving tags, including smallstep/step-ca:latest on the trust anchor

  known-issue
  Verryx-02/RAM-USB#74 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-74] s6-overlay and Tailscale downloaded without checksum or signature verification

  known-issue
  Verryx-02/RAM-USB#73 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-73] Only Storage-Service does cap_drop: five containers run with the full default capability set

  known-issue
  Verryx-02/RAM-USB#72 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-72] No --platform anywhere: a build on Apple Silicon produces images unusable on Proxmox

  known-issue
  Verryx-02/RAM-USB#71 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-71] pg_hba-mtls.sh without set -eu and without a write check: fail-open onto host all all all

  known-issue
  Verryx-02/RAM-USB#70 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-70] ListenAddress injected by an unverified sed: fail-open onto 0.0.0.0

  known-issue
  Verryx-02/RAM-USB#69 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-69] sshd without KEX/cipher/MAC selection, and KbdInteractiveAuthentication left at the default yes

  known-issue
  Verryx-02/RAM-USB#68 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-68] sshd without MaxAuthTries, LoginGraceTime, MaxSessions, MaxStartups

  known-issue
  Verryx-02/RAM-USB#67 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-67] AuthorizedKeysFile is not disabled: the ST-F-11 lookup against Database-Vault can be bypassed

  known-issue
  Verryx-02/RAM-USB#66 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-66] Every ST-F-04 hardening directive sits inside Match User user*, and AllowUsers is missing

  known-issue
  Verryx-02/RAM-USB#65 · Filter by author Verryx-02 opened on Aug 2, 2026

• [KI-65] No restart policy on any long-lived container in the stack

  known-issue
  Verryx-02/RAM-USB#64 · Filter by author Verryx-02 opened on Aug 2, 2026