- Added required field validation for name, type, and host in node configuration
- Added duplicate node prevention by name (returns 409 Conflict)
- Added IP address format validation to reject invalid IPs
- Added port range validation (1-65535)
- Added validation for negative polling intervals in system settings
- Added HEAD request support for health and version endpoints
- Reduced node addition timeout from 10s to 3s to prevent UI hanging
These validation improvements were discovered through comprehensive testing
and prevent invalid data from being accepted by the API.
The discovery functionality was broken because the router was using a
simple GET-only handler instead of the complete HandleDiscoverServers
function that supports both GET (cached results) and POST (manual scans
with subnet parameters).
Changes:
- Updated router to use configHandlers.HandleDiscoverServers instead of r.handleDiscovery
- Removed the redundant handleDiscovery function
- Discovery endpoint now supports both GET and POST methods as expected by frontend
- Added proper authentication requirement for discovery endpoint
This addresses the discovery being broken in the latest RC releases.
The SecurityHeaders middleware was not being applied to the router,
causing the "Allow iframe embedding" setting to not take effect.
This fix properly applies the middleware with the saved settings,
allowing iframe embedding to work when enabled.
addresses #351
Addresses #222 - Allow Pulse to be embedded in iframes (e.g., Homepage dashboard)
- Add AllowEmbedding and AllowedEmbedOrigins settings to SystemSettings
- Update security headers to respect embedding configuration
- When disabled: X-Frame-Options: DENY, frame-ancestors 'none'
- When enabled (same-origin): X-Frame-Options: SAMEORIGIN, frame-ancestors 'self'
- When enabled with origins: Adds specified origins to frame-ancestors
- Add UI controls in Settings → System → Network Settings
- Properly handle CSP frame-ancestors directive for cross-origin embedding
Users can now enable iframe embedding and specify allowed origins for embedding Pulse in Homepage or other dashboard applications.
The temporary auth tokens generated by authenticated users are now properly
validated even when Pulse has authentication enabled. This fixes the issue
where fresh installs (which are secured by default) couldn't use the
auto-registration feature.
- Setup script no longer requires authentication (uses setup codes instead)
- Fixed discovery service not starting when toggled via settings
- Addresses #347 and discussion #344
- Theme changes now broadcast instantly via WebSocket to all connected browsers
- No page refresh needed - theme updates in real-time across all devices
- Theme preference is persisted server-side and loaded on new sessions
- Added WebSocket message type 'settingsUpdate' for broadcasting settings changes
- Updated SystemSettingsHandler to broadcast theme changes to all clients
- Added frontend event listener to handle incoming theme change messages
- Fixed API endpoint routing to use the new handler with broadcast support
- Added proper DISABLE_AUTH check in CheckAuth for auth-disabled environments
This creates a seamless experience where toggling dark/light mode on one device
instantly updates all other connected devices (phones, tablets, browsers).
Implements header-based proxy authentication for SSO integration with
Authentik, Authelia, and other authentication proxies.
- Add CheckProxyAuth function to validate proxy headers
- Support for username and role-based access control
- Frontend integration with logout URL support
- Comprehensive documentation with examples
- Backwards compatible - no breaking changes
Addresses #327
Configuration via environment variables:
- PROXY_AUTH_SECRET: Shared secret for validation
- PROXY_AUTH_USER_HEADER: Header containing username
- PROXY_AUTH_ROLE_HEADER: Header containing roles/groups
- PROXY_AUTH_LOGOUT_URL: SSO logout endpoint
- API tokens now work even when DISABLE_AUTH is set
- Added API token section back to Security tab in settings
- API tokens can protect API access for automation while keeping UI open
- Invalid tokens are rejected even with auth disabled
- Export/import endpoints still require valid API token
- Added DISABLE_AUTH env var to completely bypass authentication
- Useful for reverse proxy setups (Authentik, Authelia, etc.)
- Updated documentation in CONFIGURATION.md and REVERSE_PROXY.md
- Fixed security tests to handle auth disabled state
Frontend (TypeScript):
- Eliminated all 'any' types (7 → 0)
- Added proper types for event system with generics
- Fixed event data interfaces with specific types
- Replaced any with unknown where appropriate
Backend (Go):
- Created central types.go with 30+ typed API structures
- Eliminated all interface{} in /internal/api package (158 → 0)
- Replaced map[string]interface{} with typed structs:
- ChartResponse, VMChartData, NodeChartData, StorageChartData
- DiagnosticsInfo with NodeDetails, ClusterInfo, PBSDetails
- StorageChartsResponse with StorageMetrics
- Improved compile-time type safety for all API responses
Benefits:
- Better IDE support and autocomplete
- Compile-time error detection
- Clearer API contracts
- Improved maintainability
All tests passing, service running successfully with typed code.
- Add helpful "No Proxmox VE nodes configured" message to Storage and Backup tabs
- Include "Go to Settings" button for easy navigation when no nodes exist
- Enhance network discovery for Docker environments with smart subnet detection
- Auto-detect Docker network configuration and scan appropriate subnets
- Add support for common Docker network ranges (172.16.0.0/12, 10.0.0.0/8)
- Improve discovery logging to show subnet being scanned
- Fix discovery API endpoint to properly return discovered servers
- Automatically hash plain text API tokens (SHA3-256) and passwords (bcrypt) when loaded from env vars
- Remove unnecessary PULSE_SETUP_TOKEN feature in favor of simpler env var approach
- Remove HandleInitialSetup endpoint - not needed with env var configuration
- Update authentication to always use hashed comparisons (no plain text warnings)
- Update documentation to clearly explain auto-hashing capability
- Maintain backward compatibility with pre-hashed credentials
This makes Pulse secure by default while keeping deployment simple - users can
provide plain text credentials via environment variables and Pulse automatically
hashes them for security.
- Grant enhanced Audit permissions to PBS tokens for system stats access
- Create PBSCard component to display CPU, memory, disk, uptime metrics
- Detect Docker PBS instances and show appropriate info without stats
- Add adaptive node layout on dashboard for better scalability
- Move PBS status card to Backups tab above frequency chart
- Create CompactNodeCard for handling many nodes efficiently
- Update PBS setup script to grant Audit role to both user and token
This addresses the request in issue #259 to show PBS system stats on the dashboard.
The implementation uses read-only Audit permissions to access the /nodes endpoint
while maintaining security. Docker PBS instances are detected and handled gracefully
since they cannot provide host system statistics.
- Login component now handles 429 rate limit responses correctly
- When rate limited, assume auth is configured and show login form
- /api/security/status endpoint excluded from strict auth rate limiting
- Status checks now use general API rate limit (500/min) instead of auth limit (10/min)
- Fixes issue where rapid logout/login could trigger rate limiting
- Fixes setup screen appearing incorrectly when rate limited
- Fixed copy button not working in Quick Token Setup modal
- Button was conditionally rendered only when host was populated
- Now always visible and shows error if host is empty
- Updated placeholder text to be clearer
- Fixed toast notifications appearing behind modals
- Increased z-index from z-50 to z-[9999] to ensure visibility
- Fixed Generate API Token section intermittently not showing
- Added proper loading state for security status
- Prevents race condition where component renders before data loads
- Added loadSecurityStatus() function for reusability
- Refresh security status after password change
- Skip CSRF validation for /api/setup-script-url endpoint
- Endpoint generates temporary tokens, not a state change
- Fixes 403 Forbidden error when generating setup scripts
All API token functionality confirmed working with token rotation
- Fix alternating zero I/O metrics by implementing rate caching for stale data from Proxmox
- Hardcode polling interval to 10 seconds (matching Proxmox cluster/resources update cycle)
- Remove polling interval settings from UI (no longer user-configurable)
- Implement efficient VM/container polling using single cluster/resources API call
- Remove 'Remove Password' feature (auth is now mandatory)
- Fix CSRF validation for Basic Auth (exempt from CSRF checks)
- Fix Generate API Token modal and authentication
- Remove redundant 'Active' status from Authentication section
- Remove Connection Timeout setting from frontend (backend-only)
- Clean up frontend console logging (reduce verbosity)
- Remove PBS polling interval setting (fixed at 10s)
- Add frontend rebuild detection to backend-watch script
- Improve first-run setup flow and error handling
- Remove old /api/system/api-token endpoints
- Remove APIToken field from SystemSettings struct
- Remove token handling from system_settings.go
- Clean up config.Load() to not read token from system.json
- Remove unused frontend API token functions
- Remove unused APITokenManager and CurrentAPIToken components
API tokens are now managed exclusively via .env file with the new
/api/security/regenerate-token endpoint. This eliminates confusion
between the two systems and ensures consistency.
- Add backend endpoint to regenerate API tokens without resetting auth
- Updates .env file with new token while preserving other settings
- Frontend component with clear UX for token generation
- Shows new token once with copy functionality
- Indicates restart required to activate new token
- Works across all deployment types (Docker, LXC, native)
Much better UX than telling users to 'reconfigure security' just for a new token
- Add pending restart detection when .env exists but not loaded
- Update frontend to show pending state instead of re-showing setup
- Fix QuickSecuritySetup to refresh security status after configuration
- Remove auto-restart attempts from security setup
- Show deployment-appropriate restart instructions
- Update documentation to reflect new update mechanism
Related to security setup issues after removing sudo/auto-restart capabilities
Emergency release to fix critical issues in v4.3.7:
- Install script now correctly installs binary to /opt/pulse/bin/pulse
- Password changes no longer require sudo (addresses #317)
These fixes restore basic functionality for new installations
and Docker deployments.
- ProxmoxVE script can now check if auth is already set without credentials
- Quick-setup endpoint is now public but handler checks if setup should be skipped
- Prevents duplicate auth configuration attempts
- Critical for automated setup scripts
- Remove old buggy Quick Security Setup handler
- New handler in security_setup_fix.go handles all cases properly
- Tested and working with Docker, systemd, and manual installations
- adds logout button next to connection status indicator
- implements /api/logout endpoint to clear sessions
- button only shows when authentication is configured
- clears session cookie and invalidates server-side session
implements #315
addresses #314 - bcrypt hashes with $ signs were being interpreted as shell variables
by godotenv, causing authentication to fail after Docker container restarts
Script outputs from change-password and remove-password operations could
potentially contain sensitive information. Removed output logging while
keeping error logging for debugging.
The export/import handlers were using direct string comparison for API tokens
instead of proper hash comparison. This caused auth to fail when tokens were
stored as hashes (which is what the security wizard does).
addresses #314
- Docker containers were not saving credentials to persistent storage
- Non-Docker setups were saving plain text instead of hashed credentials
- After container restart, saved credentials would not work
This fixes issue #314 where users couldn't login after setting up security
in Docker containers. The Quick Security Setup now:
1. Properly hashes passwords and tokens before saving
2. Saves to /etc/pulse/.env for persistence in Docker volumes
3. Correctly loads credentials after container restart
- Homelab users on private networks (192.168.x.x, 10.x.x.x, 172.16.x.x) can now export/import without any configuration
- No need to set ALLOW_UNPROTECTED_EXPORT=true for typical homelab setups
- Public network access still requires authentication for security
- Simplifies backup/restore for users who don't need authentication
- Guest metadata handler now reloads from disk after import
- Custom console URLs are immediately available after import
- No longer requires service restart to see imported guest URLs
- Allow export/import with session auth when logged in with password
- No longer require API token when user is already authenticated
- Backend now accepts either session cookies OR API token
- Frontend only prompts for API token if no password auth exists
- Improved UX by eliminating redundant authentication requests
New Feature:
- Add "Remove Password" button in Settings → Security tab
- Allows users to disable password authentication completely
- Returns Pulse to open access mode (no auth required)
- Requires current password confirmation for security
Implementation:
- New API endpoint: POST /api/security/remove-password
- New modal component: RemovePasswordModal.tsx
- Removes password from systemd override files
- Clears auth configuration from running instance
- Invalidates all sessions after removal
This addresses the issue where users couldn't disable authentication
once it was enabled. Now they can easily toggle between secured and
open modes as needed for their use case.
- Remove registration tokens feature in favor of simpler API token auth
- Add password authentication with change password functionality
- Centralize API client logic with proper auth handling
- Add development scripts for better DX (hot-reload, proxy setup)
- Refactor auth middleware and handlers for cleaner separation
- Update frontend to use new centralized API client
- Exit cleanly with os.Exit(0) instead of trying systemctl restart
- Let systemd's Restart=always bring service back up
- New environment variables loaded automatically on restart
- Same proven approach used by update system
- Try automatic setup first (if sudo available)
- Fall back to generating a simple apply script
- Show single command to run: sudo bash /etc/pulse/apply-security.sh
- Script handles all systemd configuration steps
- Clear UI shows when manual step is needed
- Detect public vs private network access
- Show stronger warnings for public access without auth
- Red banner when accessed from internet without authentication
- Support for trusted networks configuration via PULSE_TRUSTED_NETWORKS
- Automatic RFC1918 private IP detection
- Enhanced security status API with network context
- Added debug logging for encryption key loading
- Created QuickSecuritySetup component with password/token generation
- Added /api/security/quick-setup endpoint to generate config
- Shows credentials once with copy/download functionality
- Generates systemd environment configuration file
- Only shows when authentication is not already enabled
- guests can now have custom URLs that make their names clickable
- added metadata store for persisting guest metadata to JSON files
- added API endpoints for managing guest metadata
- integrated edit button in dashboard to set/edit custom URLs
- guest names become clickable links when custom URL is set
- Add interactive API token management in Settings > Security tab
- Users can now generate, view, regenerate, and delete API tokens from the UI
- Tokens are persisted in system.json and survive restarts
- Environment variable API_TOKEN still takes precedence for backward compatibility
- Proper authentication enforcement when tokens are configured
- Secure token generation using crypto/rand (32 bytes, hex encoded)
- Clean UI with copy-to-clipboard functionality for newly generated tokens
Addresses #304 - Eliminates redirect loops and path issues by embedding
the frontend directly in the Go binary using go:embed
- Frontend is now embedded at compile time, no separate files needed
- Simplified tarball structure - just the binary and config files
- No more path searching or frontend directory issues
- Works consistently across all installation methods
- Smaller deployment footprint and simpler installation
This change makes Pulse a true single-binary deployment, eliminating
the complexity of managing separate frontend files and the issues that
arose from different installation structures.
Pulse Monitor