New Feature:
- Add "Remove Password" button in Settings → Security tab
- Allows users to disable password authentication completely
- Returns Pulse to open access mode (no auth required)
- Requires current password confirmation for security
Implementation:
- New API endpoint: POST /api/security/remove-password
- New modal component: RemovePasswordModal.tsx
- Removes password from systemd override files
- Clears auth configuration from running instance
- Invalidates all sessions after removal
This addresses the issue where users couldn't disable authentication
once it was enabled. Now they can easily toggle between secured and
open modes as needed for their use case.
Security Fixes:
- Fix path traversal vulnerability in tar extraction (HIGH)
- Validate and sanitize paths from tar archives
- Prevent directory traversal attacks via ../
- Ensure extracted files stay within destination directory
- Remove weak SHA-256 password hashing code (MEDIUM)
- Removed unused SHA-256 hash function from crypto package
- All password hashing now uses bcrypt (cost 12) exclusively
- Added warning comment about proper password hashing
- Fix error information leakage (MEDIUM)
- Add sanitizeErrorMessage helper function
- Log detailed errors internally while returning generic messages
- Prevent exposure of system internals in error responses
- Change default CORS from * to restrictive (MEDIUM)
- Default to no CORS headers (same-origin only)
- Allow localhost origins only in development mode
- Require explicit configuration for production CORS
These fixes address all critical and medium severity issues found
in the security audit while maintaining backward compatibility.
- Remove registration tokens feature in favor of simpler API token auth
- Add password authentication with change password functionality
- Centralize API client logic with proper auth handling
- Add development scripts for better DX (hot-reload, proxy setup)
- Refactor auth middleware and handlers for cleaner separation
- Update frontend to use new centralized API client
- Exit cleanly with os.Exit(0) instead of trying systemctl restart
- Let systemd's Restart=always bring service back up
- New environment variables loaded automatically on restart
- Same proven approach used by update system
- Try automatic setup first (if sudo available)
- Fall back to generating a simple apply script
- Show single command to run: sudo bash /etc/pulse/apply-security.sh
- Script handles all systemd configuration steps
- Clear UI shows when manual step is needed
- Add build.sh script that ensures frontend is copied before Go build
- Update backend-watch.sh to sync frontend on every restart
- Remove duplicate frontend files from internal/api/
- Frontend embed directory already in .gitignore
- No more manual copying needed - just run ./build.sh
- Detect public vs private network access
- Show stronger warnings for public access without auth
- Red banner when accessed from internet without authentication
- Support for trusted networks configuration via PULSE_TRUSTED_NETWORKS
- Automatic RFC1918 private IP detection
- Enhanced security status API with network context
- Added debug logging for encryption key loading
- Created QuickSecuritySetup component with password/token generation
- Added /api/security/quick-setup endpoint to generate config
- Shows credentials once with copy/download functionality
- Generates systemd environment configuration file
- Only shows when authentication is not already enabled
- guest URLs are now backed up with config export
- restored on import to preserve custom URLs across migrations
- stored in plain text (not encrypted) as they're just service URLs, not credentials
- import failures for guest metadata are non-fatal (logged as warnings)
- guests can now have custom URLs that make their names clickable
- added metadata store for persisting guest metadata to JSON files
- added API endpoints for managing guest metadata
- integrated edit button in dashboard to set/edit custom URLs
- guest names become clickable links when custom URL is set
- Node names in the summary cards at the top now link to Proxmox web interface
- Matches the behavior of node names in the table rows below
- Uses same hover effect (blue color) for consistency
- Add interactive API token management in Settings > Security tab
- Users can now generate, view, regenerate, and delete API tokens from the UI
- Tokens are persisted in system.json and survive restarts
- Environment variable API_TOKEN still takes precedence for backward compatibility
- Proper authentication enforcement when tokens are configured
- Secure token generation using crypto/rand (32 bytes, hex encoded)
- Clean UI with copy-to-clipboard functionality for newly generated tokens
The Pulse logo now displays an orange "RC" badge when running a release
candidate version. This helps users identify when they're testing pre-release
versions.
- Backend now detects RC versions and sets channel field accordingly
- Frontend displays RC badge next to Pulse logo when channel is "rc"
- Works for both git-based and VERSION file-based builds
addresses #306 - The dashboard and storage views were hardcoding port 8006 for node links,
but now they properly use the host URLs from the node configuration. This ensures users
are redirected to the correct URL when clicking on node names, respecting custom ports
and protocols configured in the settings.
- Added host field to Node struct in Go models
- Updated monitor.go to populate host field from instance config
- Added host field to TypeScript Node interface
- Modified Dashboard and Storage components to use nodeHostMap for correct URLs
- Falls back to old behavior if host field is not available
- Add custom JSON payload template support for generic webhooks
- Users can now define custom webhook formats with Go template syntax
- Fix Telegram webhook issue where chat_id in URL caused 400 errors
- Automatically strip chat_id from URL and place in JSON body for Telegram
- Add comprehensive webhook documentation with examples
- Update API documentation with webhook endpoints
Addresses #305
- Fix Discord webhook templates to use logo.svg instead of non-existent favicon.svg
- Add comprehensive release notes for v4.3.0 about embedded frontend breaking change
- Document migration path and benefits of embedded frontend
The embedded frontend is a significant architectural improvement that eliminates
path-related issues but requires clear communication to users about the change.
- Fix auto-updater to handle single-binary structure
- Fix Docker build to copy frontend before Go compilation
- Add development script for frontend rebuilds
- Remove unnecessary frontend directory copying in updater
The embedded frontend change simplifies deployment but required
updates to various build and update systems.
Addresses #304 - Eliminates redirect loops and path issues by embedding
the frontend directly in the Go binary using go:embed
- Frontend is now embedded at compile time, no separate files needed
- Simplified tarball structure - just the binary and config files
- No more path searching or frontend directory issues
- Works consistently across all installation methods
- Smaller deployment footprint and simpler installation
This change makes Pulse a true single-binary deployment, eliminating
the complexity of managing separate frontend files and the issues that
arose from different installation structures.
- Add multiple search paths for frontend files
- Check parent directories when binary is in bin/ subdirectory
- Support both tarball extraction and installed structures
- Fixes issue #304 where manual tarball extraction caused redirect loops
- Maintains compatibility with community scripts
- Test email button now works without re-entering password
- Backend uses saved password if test request has empty password
- Fixes authentication error when testing email notifications
Updated logging to exclude request bodies that may contain passwords
or other sensitive information. Now only logs metadata about requests
without exposing actual credentials.
Fixed two critical issues with email notifications:
1. Test email API now returns errors properly instead of always showing success
2. Added timeouts to SMTP connections to prevent hanging (10s dial, 30s overall)
The root cause of users not receiving emails was that errors were being
silently logged instead of returned to the API, making it appear successful
when it wasn't. SMTP connections could also hang indefinitely on unreachable
servers.
Note: API uses "server" and "port" JSON fields, not "smtpHost"/"smtpPort"
Frontend fixes:
- Fixed VM thresholds incorrectly showing as 'CT' in alerts UI (issue #295)
- Fixed threshold slider not reaching 0% and 100% edges (issue #295)
- Fixed PBS form auto-filling with PVE settings (issue #296)
- Fixed email config property mapping (server/port instead of smtpHost/smtpPort)
Backend fixes:
- Updated EmailConfig struct to use 'server' and 'port' JSON tags for consistency
- Added 'provider' and 'startTLS' fields to EmailConfig
- Fixed PORT env var to correctly set FrontendPort instead of BackendPort
- Changed default log level from Debug to Info
All changes tested and verified working correctly.
- filter out vztmpl (container templates) from backup list
- filter out iso files from backup list
- only show actual vm/container backups in the backup tab
- remove unnecessary checks for template/iso content types
- check if vm/container status is "running" before using cpu value
- set cpu to 0 for stopped, paused, suspended states
- prevents false high cpu alerts for offline vms
- handles all non-running states, not just "stopped"
- extend webhook template support to all services (slack, teams, pagerduty)
- properly detect service type and apply correct template
- add pagerduty routing_key support from headers
- fallback to generic json only when no template exists
- handle both individual and grouped alerts for all services
- add proper telegram bot api support with chat_id and text fields
- fix frontend pbs red dot display (was checking 'error' instead of 'unhealthy')
- fix qemu guest agent memory reporting (fallback to mem when freemem is 0)
- extract chat_id from telegram webhook urls when present
- Fall back to vmStatus.Mem when guest agent doesn't report FreeMem
- Fixes issue where VMs with guest agent showed 0% memory usage
- Addresses issue #294
- Import was saving configs to disk but not updating in-memory state
- Added explicit reloading of alert thresholds after import
- Added explicit reloading of webhooks after import
- Added explicit reloading of email config after import
- Settings now show immediately in UI without requiring restart
Fixes#291 where imported alert thresholds and webhooks weren't
visible until after service restart
- Use consistent utils.GetDataDir() helper instead of duplicating logic
- Handle migration failures gracefully - log warnings but continue using old key
- Add detailed logging for migration with source and destination paths
- Prevent unnecessary migration when paths are identical
- Improve error messages for debugging
Addresses review feedback on the Docker persistence fix
- Move encryption key from /etc/pulse to PULSE_DATA_DIR (/data in Docker)
- Add automatic migration for existing installations
- Key now persists across container restarts when using volume mount
- Maintains backward compatibility for non-Docker installations
Fixes#290 reported by da99Beast where Docker containers lost
configuration on restart due to encryption key being regenerated
- Support both old (root) and new (bin/) tarball structures
- Use writable directories for temp and backup files (data dir instead of /tmp)
- Fixes update failures for users on v4.1.5 and earlier
- Fixed hardcoded version fallback showing 4.1.1 instead of current version
- Fixed install script syntax error that prevented fresh installations
- Identified root cause of Docker persistence issue (notification UI not saving)
- Identified missing save functionality in frontend notification settings
Issues addressed: #277, #278, #282
- Fixed incorrect RAM usage display for VMs without guest agent (issue #280)
- VMs without guest agent now show 0% usage instead of 100%
- Only show actual usage when guest agent provides FreeMem data
- Containers continue to show accurate usage as before
- Fixed webhook test functionality (issue #279)
- Added proper webhook ID handling in test notification endpoint
- Created SendTestWebhook method to test specific webhooks
- Frontend can now successfully trigger webhook tests
Replaced sudo-based updater with a cleaner directory-based approach:
- Pulse binary now installs to /opt/pulse/bin/pulse (owned by pulse user)
- Symlink created at /usr/local/bin/pulse for PATH convenience
- Pulse user has full write access to /opt/pulse, enabling self-updates
- Removed sudo dependency and security risks
- Simplified update logic - no special scripts or permissions needed
This is more secure, simpler, and works in all environments (containers, VMs, bare metal)
Token names now include both Pulse server IP and Unix timestamp (e.g. pulse-192-168-0-176-1754816525) ensuring each script run creates a unique token. This completely eliminates 'token already exists' errors when running setup scripts multiple times.
When running the setup script multiple times from different Pulse servers, tokens now include the Pulse server's IP address in the name (e.g. pulse-192-168-0-176) to avoid conflicts. This prevents 'token already exists' errors when managing multiple Pulse instances.
Pulse Monitor