Requires 3 consecutive offline polls (~15 seconds) before triggering connectivity alerts to prevent false positives from transient cluster communication issues
addresses #329 - VMs were being displayed as LXC containers because the Type field wasn't being set when using the efficient cluster/resources polling method
The edit state was being lost when WebSocket updates triggered component
re-renders every 5 seconds. Fixed by:
1. Only resetting edit values when editing starts, not on every update
2. Checking if overrides actually changed before updating state
3. Preserving the editing state across WebSocket data refreshes
Non-clustered Proxmox nodes were getting certificate verification errors
when Pulse tried to use the cluster/resources endpoint. Now checks if
the node is actually in a cluster before attempting efficient polling.
When both GetVersion and GetDatastores fail for PBS, properly set the
Status field to 'offline' and ConnectionHealth to 'error'. This prevents
the red dot from appearing when the instance state is undefined.
- Add clear ProxmoxVE LXC update instructions (just type 'update')
- Fix incorrect FAQ about UI updates (no longer possible)
- Explain why Pulse cannot self-update for security reasons
- Make it clear that most users run in LXC containers
- Detect when running behind a proxy/tunnel (X-Forwarded-*, CF-Ray headers)
- Use SameSite=None for cookies when proxied to allow cross-origin access
- Properly detect HTTPS when behind proxy using X-Forwarded-Proto
- Fixes authentication not working through Cloudflare tunnels
The issue was that SameSite=Strict/Lax cookies don't work when the origin
changes (which happens with tunnels/proxies). Now we detect proxy headers
and relax the cookie policy to SameSite=None when needed.
- Mark deprecated poll functions that cause duplicate GetNodes() calls
- Add warnings when deprecated functions are called directly
- Previous fix only created WithNodes versions but didn't prevent the originals from being called
- This completes the fix started in commit fcd782370
- Reduces API calls and prevents certificate verification spam in syslog
The deprecated functions (pollVMs, pollContainers, pollStorage, pollStorageBackups)
still exist for backward compatibility but log warnings if called.
- Document --rc, --stable, and --version flags
- Show how to update to RC releases
- Include both script and Docker update methods
- Make it clear how users can test pre-releases
The install script now accepts arguments that work with piped execution:
- --rc or --pre: Install latest RC/pre-release
- --stable: Force stable version (default)
- --version VERSION: Install specific version
- --help: Show usage
This allows users to update to RC versions with:
curl -fsSL .../install.sh | bash -s -- --rc
- Check system.json for configured update channel
- Fetch pre-releases when RC channel is configured
- Support PULSE_UPDATE_CHANNEL env var to force RC updates
- Users can now update to RC versions with:
PULSE_UPDATE_CHANNEL=rc curl -fsSL ... | bash
- Add clear First-Time Setup section explaining the wizard
- Reorganize to show basic setup first (recommended)
- Move pre-configured auth to Advanced section
- Add troubleshooting for common Docker-specific issues
- Include examples for generating credentials
- Clarify the 206728 escaping requirement in docker-compose.yml
- Add security best practices section
- Remove outdated v3 to v4 migration guide
- Update README with mandatory security setup steps
- Clarify that authentication is now required, not optional
- Update Docker, Security, and Troubleshooting docs
- Remove references to optional authentication
- Discord embeds don't support newlines in description field
- Use comma-separated list format for Discord grouped alerts
- Keep escaped newlines for other webhook providers (Telegram, Slack, Teams)
- Prevents JSON parsing errors with Discord webhook API
Discord now shows: "Alert | 🔔 5 alerts: • item1: 25.4%, • item2: 11.6%, ..."
Other providers show multi-line format with proper escaping.
- Show full list of grouped alerts for Discord, Slack, Teams, etc (not just Telegram)
- Properly escape newlines in grouped alert messages to prevent JSON parsing errors
- Ensure consistent formatting across all webhook providers
- Address issue where only custom templates showed complete alert lists
All webhook providers now display the same detailed grouped alert format with bullet points showing each alert's resource and value.
- Fixed double CPU percentage multiplication for containers/VMs
- Added CheckGuest calls to efficient polling path
- Fixed newline escaping in grouped webhook notifications
- Guest alerts now properly trigger for containers and VMs
These changes address issues where guest alerts weren't being triggered
at all due to the efficient polling path not calling CheckGuest, and
webhook notifications were failing due to unescaped newlines in grouped
alert messages breaking JSON templates.
Webhooks weren't being sent because the grouped alert message contained actual
newlines which broke JSON parsing in custom templates. Changed to use escaped
newlines (\n) which work properly in JSON strings.
- Fixed duplicate 'usage' text in storage alerts (Storage usage usage → Storage at X%)
- Improved grouped alerts to show details of other alerts instead of just count
- Added severity indicators (🔴 critical, 🟡 warning, 🟢 info)
- Better formatting with current value, threshold, type, duration, and timestamp
- Cleaner message structure with proper Markdown formatting
- Shows up to 3 additional alerts in grouped notifications with their values
- Fixed same template overwriting bug in sendGroupedWebhook function
- Grouped alerts now properly use custom templates
- Telegram webhooks now work for both individual and grouped alerts
- Successfully tested Telegram webhook delivery
- Login component now handles 429 rate limit responses correctly
- When rate limited, assume auth is configured and show login form
- /api/security/status endpoint excluded from strict auth rate limiting
- Status checks now use general API rate limit (500/min) instead of auth limit (10/min)
- Fixes issue where rapid logout/login could trigger rate limiting
- Fixes setup screen appearing incorrectly when rate limited
- Only use system color scheme preference if user has never set a theme
- Once user sets a theme preference, always respect it
- Properly remove dark class when in light mode on App initialization
- Fixes theme changing unexpectedly after login
- Login component now applies saved theme preference on mount
- Theme preference correctly persists across logout/login in all modes
- Fixes issue where login page would revert to default theme after logout
- Fixed bug where theme was not being preserved using correct storage key
- Now properly uses STORAGE_KEYS.DARK_MODE instead of 'theme'
- Theme preference now correctly persists across logout/login cycles
- Theme now persists when user logs out and logs back in
- Added documentation for BACKEND_HOST environment variable (addresses #321)
- Users can now bind to localhost only for reverse proxy setups
- Improved documentation for network configuration options
- Removed test scripts created during debugging sessions
- Removed telegram setup scripts and configs
- Removed test binaries and build artifacts
- Cleaned up repository structure
- Fixed bug where custom webhook templates were being overwritten with generic payload
- The issue occurred when a webhook had a custom template but empty service field
- Now properly preserves custom template payloads regardless of service field value
- Telegram webhooks and other custom template webhooks now work correctly
- Addresses user reports of webhook delivery issues
- Use realistic test values (85.5% CPU, 80% threshold) instead of zeros
- Set alert level to 'warning' instead of 'info' for better visibility
- Add 5-minute duration to test alerts for realistic testing
- Improve test message to be more descriptive
- Fix empty message text issue in Telegram webhooks
The webhook system now sends proper test notifications that accurately
simulate real alerts, making it easier to verify webhook configurations.
- Re-enable JSON validation that was accidentally commented out
- Fix Telegram chat_id handling with proper validation
- Add smart retry logic that distinguishes retryable from permanent errors
- Enhance error logging to include response bodies for debugging
- Add webhook URL validation for security (prevent SSRF)
- Fix deprecated strings.Title function usage
- Add webhook delivery history tracking
- Improve template variable substitution
- Add exponential backoff for retries (max 30 seconds)
- Validate numeric chat IDs for Telegram webhooks
- Add comprehensive error handling and logging
Tested with Telegram, Discord, and Slack - all working correctly now
The copy button in NodeModal was using plain fetch() instead of apiFetch() for the /api/setup-script-url endpoint, causing 401 errors when authentication is configured. Updated both PVE and PBS setup script generation to use authenticated requests.
Removed outdated DISCOVERY_SUBNET environment variable references and documented the correct way to configure discovery subnet in Docker containers via system.json. Docker containers detect their internal network by default, so manual configuration is needed for LAN discovery.
The /api/discover endpoint requires authentication when auth is configured. Updated Settings and DiscoveryModal components to use apiFetch which includes proper authentication headers (session cookies, API tokens, etc).
Refactored Login component to use nested Show components for proper reactivity in SolidJS. This ensures the component re-renders correctly when auth status changes, fixing the issue where UI stayed stuck on "Checking authentication...".
Added proper Suspense wrapper around the lazy-loaded FirstRunSetup component to ensure it loads correctly in production builds. Also added debug logging to help diagnose auth flow issues during development.
The FirstRunSetup component wasn't being included in the production build due to Vite's tree-shaking optimization. Fixed by using lazy loading to ensure the component is always bundled as a separate chunk, allowing it to display properly when no authentication is configured.
- Modified Login component to check security status
- Shows FirstRunSetup when no authentication is configured
- Shows login form when authentication exists
- Fixed App.tsx to properly detect when auth setup is needed
Docker improvements:
- Fixed entrypoint script to properly handle UID/GID changes
- Simplified user/group recreation logic to avoid conflicts
- Properly handles switching between different UID/GID values
Cleanup:
- Removed temporary test scripts and files
- Removed PROXMOX_ENDPOINTS.md documentation
- Cleaned up various test Python and shell scripts
Docker testing confirmed:
- Data persistence working across restarts
- UID/GID configuration working correctly
- Volume backup/restore functioning properly
- Fixed copy button not working in Quick Token Setup modal
- Button was conditionally rendered only when host was populated
- Now always visible and shows error if host is empty
- Updated placeholder text to be clearer
- Fixed toast notifications appearing behind modals
- Increased z-index from z-50 to z-[9999] to ensure visibility
- Fixed Generate API Token section intermittently not showing
- Added proper loading state for security status
- Prevents race condition where component renders before data loads
- Added loadSecurityStatus() function for reusability
- Refresh security status after password change
- Skip CSRF validation for /api/setup-script-url endpoint
- Endpoint generates temporary tokens, not a state change
- Fixes 403 Forbidden error when generating setup scripts
All API token functionality confirmed working with token rotation
- Cache nodes list in pollPVEInstance and pass to sub-functions
- Prevents multiple GetNodes() calls per polling cycle
- Reduces API calls from ~5 per cycle to 1 per cycle
- Fixes syslog spam on standalone PVE nodes trying to find cluster certificates
- Fixes PBS 'Transport endpoint not connected' errors from excessive polling
Previously we were calling GetNodes() in:
- pollPVEInstance (main)
- pollVMs
- pollContainers
- pollStorage
- pollStorageBackups
Now we call it once and pass the list to avoid duplicate API calls that trigger
certificate checks on non-clustered nodes.
- Fix alternating zero I/O metrics by implementing rate caching for stale data from Proxmox
- Hardcode polling interval to 10 seconds (matching Proxmox cluster/resources update cycle)
- Remove polling interval settings from UI (no longer user-configurable)
- Implement efficient VM/container polling using single cluster/resources API call
- Remove 'Remove Password' feature (auth is now mandatory)
- Fix CSRF validation for Basic Auth (exempt from CSRF checks)
- Fix Generate API Token modal and authentication
- Remove redundant 'Active' status from Authentication section
- Remove Connection Timeout setting from frontend (backend-only)
- Clean up frontend console logging (reduce verbosity)
- Remove PBS polling interval setting (fixed at 10s)
- Add frontend rebuild detection to backend-watch script
- Improve first-run setup flow and error handling
- Remove old /api/system/api-token endpoints
- Remove APIToken field from SystemSettings struct
- Remove token handling from system_settings.go
- Clean up config.Load() to not read token from system.json
- Remove unused frontend API token functions
- Remove unused APITokenManager and CurrentAPIToken components
API tokens are now managed exclusively via .env file with the new
/api/security/regenerate-token endpoint. This eliminates confusion
between the two systems and ensures consistency.
- Add backend endpoint to regenerate API tokens without resetting auth
- Updates .env file with new token while preserving other settings
- Frontend component with clear UX for token generation
- Shows new token once with copy functionality
- Indicates restart required to activate new token
- Works across all deployment types (Docker, LXC, native)
Much better UX than telling users to 'reconfigure security' just for a new token
- Show API Token Active status
- Add security notice about one-time visibility
- Include usage example with curl
- Replaces empty section that was confusing users
- Remove CurrentAPIToken component entirely
- API tokens now only shown once during initial setup
- Add clear warning that token won't be shown again
- Remove sessionStorage caching of tokens
- Follows security best practices (like GitHub/AWS)
This prevents showing cached/wrong tokens from sessionStorage that don't match the actual configured token
Pulse Monitor