Christoph Emsenhuber 52a8ac462c TP49 angelegt: CF-Access-Wildcard oeffnet alle internen Dienste fuer jeden GitHub/Google-User ...

Fund vom 2026-07-10, seither unbehoben — stand nur in der Memory project_cf_tunnel_1033,
in keiner TP-Liste. Beim Sichern der Memories wiederentdeckt.

login_method:<idp> als include matcht JEDEN via diesen IdP, nicht den Owner. Betroffen
sind alle Dienste hinter *.emsenhuber.net (hass/grafana/portainer/pve). Gitea #76.

Co-Authored-By: Claude Code <noreply@anthropic.com>

2026-10-06 06:47:03 +02:00

..

cf-backup

Stand der Parallelsession eingesammelt (TP39 archiviert, TP41-Backup, TP25 ap2-Verdacht)

2026-09-01 09:20:03 +02:00

messdaten

TP25: Transaktion-State committed + Messrunden 2026-09-04

2026-09-04 19:43:28 +02:00

nas-vlan20

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

portainer-upgrade-20260828

Plaintext-Secrets entfernt: Portainer-State-Dump gelöscht, n8n-Bearer + AdGuard-Token redaktieren

2026-09-14 15:14:57 +02:00

research

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-marker

TP25: Klick-Konsole auf N Clients + Pin-UI

2026-09-04 14:18:07 +02:00

transaktionen

Redaktionsschaden beheben: private_networks in beiden AGH-YAMLs

2026-09-21 23:06:30 +02:00

allnet-ge8-trunk-klickanleitung.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

announcements.md

SSoT: Status-Marker aus den TP-Headern entfernt, Sync-Werkzeug auf Anlege-Richtung festgelegt

2026-10-03 13:12:26 +02:00

call-quality-diagnosis.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

call-quality-handout.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

cf-tunnel-mapping.md

TP45 Schicht A: Nautobot .30/.31/.32/.34 -> .154/.155/.156/.158

2026-09-21 13:14:35 +02:00

core-switch-prep.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

doku-cleanup-session.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

firmware-flash-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

gotchas.md

docs: CLAUDE.md ausgedünnt (61→28 KB) + Diagnose-Fallen nach gotchas.md

2026-09-22 13:05:56 +02:00

handoff-20260822-naechste-schritte.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-20260823-session.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-20260824-session.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-20260825-agh-dns-cutover.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-20260826-agh-dns-cutover.md

handoff: 2026-08-26 — AdGuard DNS-Cutover fortsetzen (TP23/TP31)

2026-08-26 17:51:07 +02:00

handoff-20260826-tp31-suffix-sweep.md

handoff: 2026-08-26 — TP31 Schritt 4 fortsetzen + Suffix-Sweep

2026-08-26 20:58:51 +02:00

handoff-20260827-hubert-und-altlasten.md

aufräumen: Inventar-Pipeline stillgelegt, Root-handoff ins docs/, README präzisiert

2026-08-27 21:34:58 +02:00

handoff-20260827-inventur-und-architektur.md

Korrektur: bf-infra HAT ein Gitea-Remote (Inventur-Aussage vom 08-27 ueberholt)

2026-08-30 11:43:24 +02:00

handoff-20260828-mcp-bestand-und-performance.md

MCP-Bestand korrigiert + Mac-mini-Performance-Restriktion

2026-08-28 18:40:05 +02:00

handoff-20260828-mcp-cleanup-und-shelly-tote.md

Plaintext-Secrets entfernt: Portainer-State-Dump gelöscht, n8n-Bearer + AdGuard-Token redaktieren

2026-09-14 15:14:57 +02:00

handoff-20260828-portainer-bump-und-mcp.md

Portainer 2.40 → 2.42.0 Bump + portainer-mcp projektspezifisch

2026-08-28 21:17:52 +02:00

handoff-20260828-pre-opencode-migration.md

handoff: pre-opencode-migration, backups done, plan open, mid-action correction received

2026-08-28 15:18:06 +02:00

handoff-20260828-session-a-projektstatus.md

TP35 Schicht 6: /projektstatus-Skill in opencode aktiviert + Doku

2026-08-28 19:15:02 +02:00

handoff-20260828-terpene-mcp-migration-cf-tokens.md

Handoff 2026-08-28 (Abends): terpene W1-W7 + globale MCP-Migration + CF-Token-Diagnose

2026-08-28 23:51:46 +02:00

handoff-20260830-ap3.md

TP28: ap3 (cAP ax) live als CAP, ap1 funkstill, Compliance 130/130 ueber 5 Geraete

2026-08-30 17:54:07 +02:00

handoff-20260831-fund-e-hebel1-gezogen.md

sshpass -p repo-weit weg + vier TP15-Cutover-Skripte archiviert

2026-08-31 08:34:08 +02:00

handoff-20260831-tp16.3-paragraph2-3-durch.md

Merge main + nervous-williams; Drift-Zuschreibung korrigiert

2026-08-31 19:34:40 +02:00

handoff-20260831-tp16.3-vorort-session.md

Merge remote-tracking branch 'origin/claude/nervous-williams-acf000' into claude/stoic-khayyam-09b644

2026-08-31 19:33:14 +02:00

handoff-20260831-tp27-upgrade-und-hebel1-befund.md

TP25 Fund E: Hebel 1 gescheitert, TP27 durchgezogen, Fund B entwarnt

2026-08-31 15:27:57 +02:00

handoff-20260831-wlan-fund-e.md

TP25 Fund E: Befund nach einer Nacht Logging -- Reauth-Schleife haengt an ft=yes, Hebelreihenfolge korrigiert

2026-08-31 07:57:36 +02:00

handoff-20260901-fund-e-hebel1-zurueckgebaut.md

TP25 Fund E: Hebel 1 widerlegt und zurueckgebaut -- Ringpuffer-Messfehler korrigiert

2026-09-01 09:21:46 +02:00

handoff-20260901-n8n-mcp-ssrf.md

n8n-mcp SSRF-Fix: permissive + in Portainer-Stack 174 gefaltet

2026-09-01 21:04:11 +02:00

handoff-20260901-tp16.3-paragraph5-flip-durch.md

TP16.3 §6 Abbau durch, TP GESCHLOSSEN (User zog §6 vor)

2026-09-01 01:08:34 +02:00

handoff-20260901-tp25-ap2-verdacht.md

Stand der Parallelsession eingesammelt (TP39 archiviert, TP41-Backup, TP25 ap2-Verdacht)

2026-09-01 09:20:03 +02:00

handoff-20260901-tp41-followup.md

TP41 abschließen: Google/GitHub ✅, FB abgesagt; Geli CF-seitig fertig (zt-humans-Enrollment + geli-Policy live geprüft)

2026-09-01 20:42:41 +02:00

handoff-20260901-tp41.md

TP41: T5-Anleitung (IdP-Callbacks) + TP30 Posten #7 (Terpene-Keystore-PW-Leak)

2026-09-01 19:20:52 +02:00

handoff-20260901-tp42-naming.md

TP41: T4/T3/T2 durch (zt-svc, WARP-intern .36/.37, vw/admin 404 origin); Token-Altlast geklärt; TP42 angelegt

2026-09-01 19:19:52 +02:00

handoff-20260902-cf-estate-nautobot-ssot.md

TP44: Überholt-Zeiger auf falsche CF_API_TOKEN-Gotcha (Handoff 09-02)

2026-09-11 10:58:18 +02:00

handoff-20260902-tp25-fund-e-messung.md

TP25 Fund E geschlossen: 7.24.1 war die Ursache, nicht ft-over-ds

2026-09-02 08:44:32 +02:00

handoff-20260903-tp25-tp28-kanalplan-messung.md

Handoff 2026-09-03: TP25/TP28 Kanalplan live, In-situ-Messung in naechster Session

2026-09-03 21:38:44 +02:00

handoff-20260904-tp25-konsole-n-clients.md

TP25: Klick-Konsole auf N Clients + Pin-UI

2026-09-04 14:18:07 +02:00

handoff-20260906-tp37-34-36-plan.md

TP44 nachgezogen + TP37/34/36-Plan (native Modelle, erst planen)

2026-09-06 22:32:20 +02:00

handoff-20260910-tp44-teilb-sync-live.md

TP44 Teil B durch: Prosa auf ✅ + Handoff (Sync live, täglicher Job)

2026-09-10 11:15:13 +02:00

handoff-20260913-cf-api-token-rolled.md

Handoff: CF_API_TOKEN gerollt + Verify-Endpoint-Gotcha (Gitea #69 closed)

2026-09-13 15:13:23 +02:00

handoff-20260914-tp25-ap2-insitu-terrassse.md

TP25: ap2-In-situ widerlegt (Terrasse), Hebel-A-Machbarkeitspruefung negativ; TP30 #9 GITEA_ACCESS_TOKEN

2026-09-14 20:16:20 +02:00

handoff-20260915-tp25-steering-threshold-und-terrasse.md

TP25: Handoff Steering-Threshold + Terrasse-Verifikation

2026-09-15 18:40:22 +02:00

handoff-20260915-tp25-tausch-und-zuordnung.md

TP25: AP-Zuordnung per Kabel-Test geklärt, Messrunde Vorher, Tausch ap1↔ap3 begonnen

2026-09-15 17:11:17 +02:00

handoff-20260915-tp25-zuordnung-und-redundanz.md

TP25: AP-Zuordnung definitiv geklärt, ap1-Redundanz gemessen

2026-09-15 18:06:15 +02:00

handoff-20260922-claude-md-ausduennen.md

docs: Handoff für CLAUDE.md-Ausdünnen (strukturelle Hygiene)

2026-09-22 12:48:11 +02:00

handoff-20260922-doku-umbau-vorschlag.md

docs: Handoff — Umbau-Vorschlag für Doku-/TP-Verwaltung (Analyse-Basis)

2026-09-22 14:22:31 +02:00

handoff-cf-tunnel-1033.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-doku-session-20260818.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-tp6-session.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

handoff-tp25-session-20260821.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

hw-refresh-requirements.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

ip-plan.md

TP45 Schicht A: Nautobot .30/.31/.32/.34 -> .154/.155/.156/.158

2026-09-21 13:14:35 +02:00

manual-flash-howto.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

matter-pairing-infra-ssid-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

mcp-host-policy.md

MCP-Bestand korrigiert + Mac-mini-Performance-Restriktion

2026-08-28 18:40:05 +02:00

routerboot-firmware-klickanleitung.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

session-20260828-decisions.md

drift-korrektur: Auth-Sanierung (Bearer) gehört in TP16.3, nicht als Vorab-Notiz

2026-08-28 17:18:16 +02:00

session-briefing-20260828.md

session-briefing-20260828.md: TL;DR + Lese-Reihenfolge für neue Sessions

2026-08-28 17:33:23 +02:00

sonos-inventar.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

teilprojekte-archiv.md

TP47 (Gitea #74) abgeschlossen: Egress-Weg verifiziert, Prosa ins Archiv

2026-10-05 21:37:34 +02:00

teilprojekte.md

TP49 angelegt: CF-Access-Wildcard oeffnet alle internen Dienste fuer jeden GitHub/Google-User

2026-10-06 06:47:03 +02:00

tp2.1-omada-switch-standalone-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp5-deny-by-default-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-auswertung.py

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-bufferbloat-messung.sh

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-call-run.sh

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-messung-tutorial.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-monitor-core.sh

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp6-praemisse-messrunbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp7-mdns.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp10-context-digest.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp10-vpn-migration.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp13-botschafts-wlan-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp14.4-cf-access-token-runbook.md

TP30 #4: "faellig" -> "Anlass" — kein Vorgezogen-Signal mehr

2026-09-21 17:43:37 +02:00

tp15-ap-reset-handoff-20260808.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp15-core-swap-session-handoff-prompt.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp15-core-swap-session-handover.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp15-crs326-session-handoff-prompt.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp15-session-summary-20260808.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp16.1-session-handoff-prompt.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp16.1-warp-mesh-native-crs326.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp16.3-bf-public-ap-connector-runbook.md

TP16.3 §6 Abbau durch, TP GESCHLOSSEN (User zog §6 vor)

2026-09-01 01:08:34 +02:00

tp16.3-nautobot-mesh-only-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp16.3-paragraph5-session-handoff-prompt.md

Uebergabeprompt §5: Repo-Stand, verifizierter Live-Stand, TP30 vertagt

2026-08-31 19:43:24 +02:00

tp17-shelly-go-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp17.1-shelly-gen4-funkmigration-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp19-vlan1-cudy-teardown-runbook.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp23-stufe6-bypass-sperre-runbook.md

TP23: Stufe-6-Runbook (DNS-Bypass-Sperre) mit hartem Vor-Ort-Gate

2026-09-06 17:20:11 +02:00

tp25-gehweg-auswertung.py

TP25/TP28: Walk-Harness auf N Geräte, Analyzer generalisiert, AP-Map-Fix

2026-09-04 12:42:30 +02:00

tp25-pin-multi.sh

TP25: Multi-Pin-Tool tp25-pin-multi.sh (band-genaues Pinnen, N Clients je 1 AP)

2026-09-04 13:56:55 +02:00

tp25-pin-s22.sh

TP25/TP28: Walk-Harness auf N Geräte, Analyzer generalisiert, AP-Map-Fix

2026-09-04 12:42:30 +02:00

tp25-runde-20260822-2330-auswertung.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp25-runde-20260822-auswertung.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp25-runde.sh

TP25: Klick-Konsole auf N Clients + Pin-UI

2026-09-04 14:18:07 +02:00

tp25-walk-messung.sh

TP25: Klick-Konsole auf N Clients + Pin-UI

2026-09-04 14:18:07 +02:00

tp25-wlan-roaming-messung-20260820.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

tp31-schritt5-runbook.md

TP16.3/TP31 Schritt 5: Vor-Ort-Runbook fuer bf-public-Connector (ap1/ap2/ap3)

2026-08-30 21:07:17 +02:00

tp41-t5-idp-callback-anleitung.md

TP41: T5-Anleitung (IdP-Callbacks) + TP30 Posten #7 (Terpene-Keystore-PW-Leak)

2026-09-01 19:20:52 +02:00

vlan1-rueckbau-howto-manuelle-schritte.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

vlan-plan.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

warp-egress-native-crs326.md

TP47: Core egress via cf-mesh und WARP-Exit-Validierung

2026-09-27 16:10:17 +02:00

wifi-access-list-erklaert.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00

wifi-p750w-coverage-and-map.md

Initial import from bf-network-r6.opencode — opencode migration

2026-08-26 12:44:21 +02:00