- Frontend checks for disabled: true in security status
- When auth is disabled, goes straight to dashboard
- Fixes issue where login screen showed even with DISABLE_AUTH=true
- Added DISABLE_AUTH env var to completely bypass authentication
- Useful for reverse proxy setups (Authentik, Authelia, etc.)
- Updated documentation in CONFIGURATION.md and REVERSE_PROXY.md
- Fixed security tests to handle auth disabled state
Frontend (TypeScript):
- Eliminated all 'any' types (7 → 0)
- Added proper types for event system with generics
- Fixed event data interfaces with specific types
- Replaced any with unknown where appropriate
Backend (Go):
- Created central types.go with 30+ typed API structures
- Eliminated all interface{} in /internal/api package (158 → 0)
- Replaced map[string]interface{} with typed structs:
- ChartResponse, VMChartData, NodeChartData, StorageChartData
- DiagnosticsInfo with NodeDetails, ClusterInfo, PBSDetails
- StorageChartsResponse with StorageMetrics
- Improved compile-time type safety for all API responses
Benefits:
- Better IDE support and autocomplete
- Compile-time error detection
- Clearer API contracts
- Improved maintainability
All tests passing, service running successfully with typed code.
- Added test-release.sh for core functionality testing
- Added test-edge-cases.sh for URL and header edge cases
- Added test-proxy-scenarios.sh for reverse proxy testing
- Added test-security.sh for security vulnerability testing
- Added test-installation-methods.sh for deployment validation
- Added test-all.sh master script to run all tests
- These tests would have caught issue #334 and prevent similar issues
- Storage tab now shows PBS storage even without PVE nodes
- Backups tab now shows PBS backups even without PVE nodes
- Empty state message only shows when truly no nodes are configured
- Both tabs remain functional for PBS-only deployments
- Handle X-Forwarded-Proto and X-Forwarded-Host headers in origin check
- Fixes WebSocket connections failing when accessed via reverse proxy
- Addresses #333 where connections broke after v4.3
- Add helpful "No Proxmox VE nodes configured" message to Storage and Backup tabs
- Include "Go to Settings" button for easy navigation when no nodes exist
- Enhance network discovery for Docker environments with smart subnet detection
- Auto-detect Docker network configuration and scan appropriate subnets
- Add support for common Docker network ranges (172.16.0.0/12, 10.0.0.0/8)
- Improve discovery logging to show subnet being scanned
- Fix discovery API endpoint to properly return discovered servers
- Auto-detect Docker environment and scan common home/office subnets
- Scans 192.168.1.0/24, 192.168.0.0/24, 10.0.0.0/24, 192.168.88.0/24, 172.16.0.0/24
- Removes friction - nodes are discovered automatically without configuration
- DISCOVERY_SUBNET env var now optional (only for non-standard networks)
- Update documentation to reflect automatic discovery
This makes the first-run experience much smoother - users see their
Proxmox nodes immediately without having to figure out subnet configuration.
- Automatically hash plain text API tokens (SHA3-256) and passwords (bcrypt) when loaded from env vars
- Remove unnecessary PULSE_SETUP_TOKEN feature in favor of simpler env var approach
- Remove HandleInitialSetup endpoint - not needed with env var configuration
- Update authentication to always use hashed comparisons (no plain text warnings)
- Update documentation to clearly explain auto-hashing capability
- Maintain backward compatibility with pre-hashed credentials
This makes Pulse secure by default while keeping deployment simple - users can
provide plain text credentials via environment variables and Pulse automatically
hashes them for security.
- Clarify that env vars have highest priority and override system.json
- Document UI warning behavior when env vars override settings
- Add FAQ entry for disabled UI fields
- Fix incorrect priority order in CONFIGURATION.md
- Add clear warnings about env var override behavior
This ensures users understand why UI changes might not work when
environment variables are set, and how to resolve the issue.
- Track which settings are overridden by env vars in backend
- Expose env override information in system settings API
- Show clear warnings in UI when settings are controlled by env vars
- Disable input fields when overridden by environment variables
- Add helpful instructions for users to remove env vars if needed
This improves UX by making it clear why UI changes don't take effect
when environment variables are set. Follows container best practices
where env vars have highest precedence, while clearly communicating
this behavior to users.
Addresses user confusion when UI settings don't work due to env var overrides.
- Add clear warnings that env vars override UI/system.json settings
- Update log messages to indicate when env vars are overriding values
- Document standard container practice: env vars have highest precedence
- Users must remove env vars to allow UI configuration to take effect
This prevents confusion when UI changes don't work due to env var overrides.
- Re-enable DISCOVERY_SUBNET env var for Docker network configuration
- Re-enable LOG_LEVEL env var for runtime logging control
- Re-enable CONNECTION_TIMEOUT env var for timeout configuration
- Re-enable ALLOWED_ORIGINS env var for CORS configuration
- Update documentation to reflect working env vars
These env vars were accidentally disabled but are useful for Docker deployments.
Env vars override system.json settings when present.
Addresses #214 - user requested DISCOVERY_SUBNET env var support
- Remove all PBS-AGENT.md references (hallucinated feature)
- Fix DISCOVERY_SUBNET env var name in Docker docs (was incorrectly PULSE_DISCOVERY_SUBNET)
- Add DISCOVERY_SUBNET examples to README for Docker users
- Update FAQ to clarify PBS push mode is not supported
Addresses #214 - user reported 404 on PBS-AGENT.md link
- API tokens now hashed before storage (never stored in plain text)
- Raw token shown only once during generation
- Backward compatible with existing plain text tokens
- Added migration warnings for users with plain tokens
- Updated documentation to reflect security improvements
The PBS push mode/agent feature was never actually implemented in v4.
This was documentation for a planned feature that doesn't exist.
Removed PBS-AGENT.md correctly as the feature isn't present in the codebase.
- Move development scripts to scripts/ directory (dev.sh, hot-dev.sh, build.sh, etc.)
- Move UPGRADE_NOTICE to docs/ directory
- Remove empty 2025-08-14 file
- Update all references to moved scripts in documentation
- Apply same advanced filtering logic to chart as table
- Chart now properly filters when PBS instance selected via node: filter
- Remove duplicate PBS instance filtering code (now handled by search)
- Consistent filtering behavior between table and chart
- Add parseFilterStack support to Backups tab for advanced filtering
- Support field-specific filters: vmid:, node:, type:, storage:, datastore:, namespace:
- Support comparison operators: size>1GB for backup size filtering
- Support boolean fields: verified:true, protected:true for PBS backups
- Add search help tooltip with backup-specific filter examples
- Update placeholder text to show relevant backup search examples
- Make searchQuery utils generic to work with any data type, not just VM/Container
- Backups tab now has same powerful search capabilities as Dashboard
- Remove 'Showing guests for node' message in Dashboard
- Remove 'Showing only backups from PBS' message in Backups
- Filter section already shows 'Active' badge when filters applied
- Cleaner UI without duplicate information
- Replace separate selectedNode/selectedPBSInstance state with search-based filtering
- Add node: prefix to search when node/PBS cards clicked
- Lock search field (greyed out) when auto-populated from node selection
- Reuse existing search filter logic instead of duplicating filtering code
- Clear node filter updates search field instead of separate state
- Much cleaner implementation leveraging existing search capabilities
- Make PVE node cards and PBS cards selectable in Dashboard and Backups tabs
- Auto-filter to 'remote' backups when PBS instance selected
- Filter backups by selected PBS instance name
- Disable backup type filter buttons when PBS selected
- Visual feedback with blue ring on selected cards
- Fixed PBS API endpoint to use /nodes/localhost/status directly
- PBS always uses 'localhost' as the node name, not dynamic discovery
- Updated PBSCard to properly detect Docker instances by name
- Improved display for PBS instances without Sys.Audit permission
- PBS instances now correctly show CPU, memory, and uptime when available
- Add HTTPS_ENABLED, TLS_CERT_FILE, TLS_KEY_FILE environment variables
- Server automatically starts in HTTPS mode when configured
- Falls back to HTTP with warning if certs missing
- WebSocket origins automatically adjust for HTTPS
- Fully backward compatible - defaults to HTTP
- Documented in README and CONFIGURATION.md
Addresses kenrmayfield's request for HTTPS support
- Grant enhanced Audit permissions to PBS tokens for system stats access
- Create PBSCard component to display CPU, memory, disk, uptime metrics
- Detect Docker PBS instances and show appropriate info without stats
- Add adaptive node layout on dashboard for better scalability
- Move PBS status card to Backups tab above frequency chart
- Create CompactNodeCard for handling many nodes efficiently
- Update PBS setup script to grant Audit role to both user and token
This addresses the request in issue #259 to show PBS system stats on the dashboard.
The implementation uses read-only Audit permissions to access the /nodes endpoint
while maintaining security. Docker PBS instances are detected and handled gracefully
since they cannot provide host system statistics.
Replace direct fetch() calls with apiFetch() utility which:
- Automatically includes credentials for session cookies
- Adds proper headers to prevent browser auth popups
- Handles CSRF tokens and authentication consistently
- Provides retry logic for CSRF token failures
The universal tarball (pulse-vX.X.X.tar.gz) now places binaries in bin/ subdirectory
to match the structure of architecture-specific tarballs. This fixes manual extraction
issues while maintaining compatibility with all installation methods.
- Only check cluster status during initial configuration, not during polling
- Cache cluster membership in config to avoid repeated API calls
- Skip cluster/resources endpoint entirely for standalone nodes
- Change cluster detection failure from WARN to DEBUG (expected for standalone)
This addresses #322 where standalone PVE nodes were causing certificate
lookup errors in syslog every minute during polling.
- Relocated backup/restore functionality to System tab for better UX
- Updated text from 'Security Notice' to 'Important Notes'
- Maintains all existing functionality
Requires 3 consecutive offline polls (~15 seconds) before triggering connectivity alerts to prevent false positives from transient cluster communication issues
addresses #329 - VMs were being displayed as LXC containers because the Type field wasn't being set when using the efficient cluster/resources polling method
Pulse Monitor