Commit graph

5115 commits

Author SHA1 Message Date
rcourtman
9c4bb4a90e Fail closed on auth env hashing and TLS floors 2026-04-22 05:53:02 +01:00
rcourtman
583471b5ee Harden API request and bootstrap state handling 2026-04-22 05:42:45 +01:00
rcourtman
178c073830 Keep bootstrap setup tokens out of logs 2026-04-22 05:30:40 +01:00
rcourtman
160d8126f2 Restrict Ollama provider outbound transport 2026-04-22 05:25:57 +01:00
rcourtman
70b91759d2 Harden secure local key file handling 2026-04-22 05:13:01 +01:00
rcourtman
ccb2edc3b8 Require explicit websocket origin continuity 2026-04-22 04:46:13 +01:00
rcourtman
14fc2bd4f0 Fail closed on wildcard trusted proxy configuration 2026-04-22 04:23:23 +01:00
rcourtman
d64f5b2917 Canonicalize loopback-only Pulse transport validation 2026-04-22 04:11:18 +01:00
rcourtman
4720807ae5 Require signed installer downloads and local release sidecars 2026-04-22 03:51:46 +01:00
rcourtman
96034f5e10 Attest release artifacts and harden image provenance 2026-04-22 03:22:29 +01:00
rcourtman
f7c1d9b629 Require accepted org invitations and stable runtime capabilities 2026-04-22 03:06:22 +01:00
rcourtman
7be844f23a Require signed unified agent release assets 2026-04-22 02:00:29 +01:00
rcourtman
7b1520b760 Add fingerprint-pinned TLS mode for unified agent 2026-04-22 01:36:46 +01:00
rcourtman
a8d9051b15 Restrict default workflow token permissions 2026-04-22 01:21:24 +01:00
rcourtman
43922161e4 Harden connection probe and simple stats rendering 2026-04-22 01:18:33 +01:00
rcourtman
70acd663bd Strengthen export and license persistence encryption 2026-04-22 01:03:10 +01:00
rcourtman
513399b004 Harden hosted signup and audit webhook trust paths 2026-04-22 00:54:49 +01:00
rcourtman
586473ee31 Bind recovery and bootstrap auth to direct loopback 2026-04-22 00:39:53 +01:00
rcourtman
360d08104e Compile out release env guardrail bypasses 2026-04-22 00:05:57 +01:00
rcourtman
c49176d700 Require TLS for non-loopback agent transport 2026-04-21 23:56:07 +01:00
rcourtman
3ec2c0779e Harden agent command and deploy trust boundaries 2026-04-21 23:50:34 +01:00
rcourtman
02e9107ac4 Harden cloud handoff membership authorization 2026-04-21 23:18:35 +01:00
rcourtman
22687e9301 Clear expired status work claim 2026-04-21 22:48:11 +01:00
rcourtman
62ec34ef02 Route hostname lookups through canonical equivalence 2026-04-21 22:47:23 +01:00
rcourtman
68c1e9564d Refine quick tour copy and guide labels 2026-04-21 22:35:58 +01:00
rcourtman
3c93694c5f Tighten provider-neutral host install wording 2026-04-21 22:34:51 +01:00
rcourtman
074b04eb76 Prove offline Proxmox node visibility in v6
Refs #1433
2026-04-21 22:23:53 +01:00
rcourtman
f796efceac Fix QNAP host/docker monitored-system split
Refs #1421
2026-04-21 22:11:13 +01:00
rcourtman
e1c852350e fix: rebuild unified-seed source mappings for dashboard trends 2026-04-21 18:30:49 +01:00
rcourtman
669908acd4 Normalize workloads and recovery page headers 2026-04-21 17:51:33 +01:00
rcourtman
4f0c8b3e42 Keep unified agent add-flow copy provider-neutral 2026-04-21 17:34:15 +01:00
rcourtman
1cad23fd4c Drive infrastructure catalog grouping from platform manifest 2026-04-21 17:24:22 +01:00
rcourtman
8b4a81be36 Fix guest row style typing 2026-04-21 17:21:14 +01:00
rcourtman
55df0041ec Neutralize infrastructure add catalog posture 2026-04-21 16:56:14 +01:00
rcourtman
0d5bec8a81 Add Proxmox workload refresh regression proof
Refs #1427
2026-04-21 16:45:00 +01:00
rcourtman
a170692683 Align AI discovery lifecycle with discovery settings
Refs #1425
2026-04-21 16:06:49 +01:00
rcourtman
fd5c14b049 Close RC-era issue gaps blocking v6 GA
Refs #1430

Refs #1436

Refs #1435

Refs #1409

Refs #1429

Refs #1432
2026-04-21 14:46:23 +01:00
rcourtman
ee2537987f Surface active PBS tasks in infrastructure views 2026-04-20 23:54:01 +01:00
rcourtman
770cceae52 Fix self-hosted community entitlements reporting expired state 2026-04-20 23:48:31 +01:00
rcourtman
92f4e2c0a9 Expose shared storage growth deltas on the storage page 2026-04-20 23:22:29 +01:00
rcourtman
4711d11163 Fix fresh Proxmox LXC installs defaulting to RC 2026-04-20 23:11:46 +01:00
rcourtman
4bd023fe1c infra: align agent-led add landing with Proxmox auto-detect 2026-04-20 22:48:34 +01:00
rcourtman
d8d94c48e1 Expose local commercial funnel diagnostics 2026-04-20 22:27:34 +01:00
rcourtman
c20766b7b8 Instrument self-hosted billing conversion stages 2026-04-20 21:46:59 +01:00
rcourtman
61430703b2 Reframe self-hosted paid value around operator outcomes 2026-04-20 17:30:52 +01:00
rcourtman
ed58890471 infra: lead the Add landing with the agent, not the probe
The previous layout put AddressProbeStep at the top with the agent card
below as "Or install the agent on the host." Both sections read as
alternatives to the probe, which made the probe the primary action even
though the probe is inherently a Platform-API-oriented move (figure out
which API to connect to). A user committed to the agent path has no use
for it. The "Recommended" chip on the agent card did not fix this — the
structural lead won.

Move the agent card to the top of the Add landing with no divider above
it (it's the primary, not an alternative). Fold the probe + platform
grid into a single "Or connect a platform API directly" section below,
so the ordering matches the story: agent first, API as fallback for
hosts the agent can't cover.

Architecture pin in settingsArchitecture.test.ts updated to guard the
new ordering: agent card copy indexOf < API section indexOf < probe
indexOf. Explicitly asserts the old "Or install the agent on the host"
divider is gone.
2026-04-20 17:20:05 +01:00
rcourtman
0c47b2ada1 Clear v6 prerelease-to-GA promotion gate 2026-04-20 16:33:03 +01:00
rcourtman
6f60732f92 infra: foreground the agent on the Add landing
Flip the two sections so the agent card sits above the platform grid
and reads "Recommended" with a blue border. The platform grid is now
explicitly framed as "Or connect a platform API directly — for VMware,
TrueNAS, PMG, or a remote Proxmox you can't install the agent on."

The ordering matches what the agent actually delivers: on a Proxmox
host it mints the API token and auto-registers both PVE and PBS with
zero credentials paste (RunAll in internal/hostagent/proxmox_setup.go).
The platform grid is the right path when the target is an appliance
you can't install on or a remote machine. Visual weight now matches
friction.

Architecture pin extended to assert the section ordering so a future
edit doesn't silently swap them back.
2026-04-20 16:16:54 +01:00
rcourtman
85b816c606 infra: surface the agent's Proxmox auto-register shortcut
On a PVE or PBS host, the agent mints its own API token and registers
the node via RunAll (internal/hostagent/proxmox_setup.go + agent.go
:1295–1340). That is the fastest path to a working Proxmox connection
— no address paste, no credentials. Previous copy framed the agent
purely as "host metrics you add on top," which hid the shortcut and
steered Proxmox users into pasting credentials they did not need.

Reframe the two sections:
- "Or connect a remote platform API" — five tiles for when Pulse lives
  elsewhere from the target (PMG / VMware / TrueNAS have no host-side
  agent path, and remote Proxmox reaches the tile from a different box).
- "Or install the agent on the host" — leads with "On a Proxmox host,
  this is the fastest path," then keeps the host-metrics pitch for
  bare-metal Linux / Unraid / FreeBSD / Docker / Kubernetes.

Architecture pins extended to guard the Proxmox auto-register copy.
2026-04-20 15:56:42 +01:00
rcourtman
d39a935f86 infra: teach the agent as a host-level add-on, not a sixth platform tile
The flat catalog put Install Pulse Agent beside Proxmox / VMware /
TrueNAS as a peer. A user arriving to connect Proxmox picks Proxmox
instantly and never learns the agent also adds CPU temperature, disk
SMART, systemd services, and Docker/Kubernetes auto-detect on the host
itself.

Split the landing into two sections:

- "Or pick a platform to connect" — five peer tiles for PVE / PBS /
  PMG / VMware / TrueNAS. These are management-API integrations and
  belong together.
- "Or install a host-level agent" — a distinct full-width card with a
  "Runs on a host" chip. Copy names the telemetry the agent adds and
  says explicitly that it layers *in addition to* a platform connection
  above, not instead of one.

The agent is a different kind of integration from the platform APIs.
Framing it as a peer hid its value; framing it as an adjunct teaches
it.
2026-04-20 15:40:28 +01:00