removed incorrect 'temporary override' framing - users want permanent control for VMs with special needs (TrueNAS, Samba, Frigate, etc). tags are now presented as direct per-VM control that can be used for both permanent configuration and temporary needs
key insight: tags let users say 'this specific VM is special' vs custom rules for patterns
- updated documentation to clearly distinguish between:
- Custom Rules: permanent alert policies configured in UI
- Tags: temporary operational overrides applied in Proxmox
- improved log messages to indicate tags are temporary overrides
- added clear use cases and best practices for each approach
- emphasized that tags complement (not replace) custom rules
changed pulse-relaxed behavior to override with fixed values (95% CPU/RAM, 98% disk) rather than adding to existing thresholds. this avoids confusing interactions with custom alert rules and provides more predictable behavior
also updated docs to clarify the priority order of tags vs custom rules
addresses #336 - diskRead/diskWrite/networkIn/networkOut metrics are measured in MB/s not percentages, so alert messages now correctly show "X MB/s" instead of "X%"
- pulse-no-alerts: suppress all alerts for VM/CT
- pulse-monitor-only: show alerts in UI but skip email notifications
- pulse-relaxed: use relaxed thresholds (+15% for CPU/memory, +10% for disk)
Tags are read from Proxmox VM/CT configuration and applied during alert checks.
This provides a simple way to manage alert behavior without adding UI complexity.
- Added DISABLE_AUTH env var to completely bypass authentication
- Useful for reverse proxy setups (Authentik, Authelia, etc.)
- Updated documentation in CONFIGURATION.md and REVERSE_PROXY.md
- Fixed security tests to handle auth disabled state
Frontend (TypeScript):
- Eliminated all 'any' types (7 → 0)
- Added proper types for event system with generics
- Fixed event data interfaces with specific types
- Replaced any with unknown where appropriate
Backend (Go):
- Created central types.go with 30+ typed API structures
- Eliminated all interface{} in /internal/api package (158 → 0)
- Replaced map[string]interface{} with typed structs:
- ChartResponse, VMChartData, NodeChartData, StorageChartData
- DiagnosticsInfo with NodeDetails, ClusterInfo, PBSDetails
- StorageChartsResponse with StorageMetrics
- Improved compile-time type safety for all API responses
Benefits:
- Better IDE support and autocomplete
- Compile-time error detection
- Clearer API contracts
- Improved maintainability
All tests passing, service running successfully with typed code.
- Handle X-Forwarded-Proto and X-Forwarded-Host headers in origin check
- Fixes WebSocket connections failing when accessed via reverse proxy
- Addresses #333 where connections broke after v4.3
- Add helpful "No Proxmox VE nodes configured" message to Storage and Backup tabs
- Include "Go to Settings" button for easy navigation when no nodes exist
- Enhance network discovery for Docker environments with smart subnet detection
- Auto-detect Docker network configuration and scan appropriate subnets
- Add support for common Docker network ranges (172.16.0.0/12, 10.0.0.0/8)
- Improve discovery logging to show subnet being scanned
- Fix discovery API endpoint to properly return discovered servers
- Automatically hash plain text API tokens (SHA3-256) and passwords (bcrypt) when loaded from env vars
- Remove unnecessary PULSE_SETUP_TOKEN feature in favor of simpler env var approach
- Remove HandleInitialSetup endpoint - not needed with env var configuration
- Update authentication to always use hashed comparisons (no plain text warnings)
- Update documentation to clearly explain auto-hashing capability
- Maintain backward compatibility with pre-hashed credentials
This makes Pulse secure by default while keeping deployment simple - users can
provide plain text credentials via environment variables and Pulse automatically
hashes them for security.
- Track which settings are overridden by env vars in backend
- Expose env override information in system settings API
- Show clear warnings in UI when settings are controlled by env vars
- Disable input fields when overridden by environment variables
- Add helpful instructions for users to remove env vars if needed
This improves UX by making it clear why UI changes don't take effect
when environment variables are set. Follows container best practices
where env vars have highest precedence, while clearly communicating
this behavior to users.
Addresses user confusion when UI settings don't work due to env var overrides.
- Add clear warnings that env vars override UI/system.json settings
- Update log messages to indicate when env vars are overriding values
- Document standard container practice: env vars have highest precedence
- Users must remove env vars to allow UI configuration to take effect
This prevents confusion when UI changes don't work due to env var overrides.
- Re-enable DISCOVERY_SUBNET env var for Docker network configuration
- Re-enable LOG_LEVEL env var for runtime logging control
- Re-enable CONNECTION_TIMEOUT env var for timeout configuration
- Re-enable ALLOWED_ORIGINS env var for CORS configuration
- Update documentation to reflect working env vars
These env vars were accidentally disabled but are useful for Docker deployments.
Env vars override system.json settings when present.
Addresses #214 - user requested DISCOVERY_SUBNET env var support
- API tokens now hashed before storage (never stored in plain text)
- Raw token shown only once during generation
- Backward compatible with existing plain text tokens
- Added migration warnings for users with plain tokens
- Updated documentation to reflect security improvements
- Move development scripts to scripts/ directory (dev.sh, hot-dev.sh, build.sh, etc.)
- Move UPGRADE_NOTICE to docs/ directory
- Remove empty 2025-08-14 file
- Update all references to moved scripts in documentation
- Add HTTPS_ENABLED, TLS_CERT_FILE, TLS_KEY_FILE environment variables
- Server automatically starts in HTTPS mode when configured
- Falls back to HTTP with warning if certs missing
- WebSocket origins automatically adjust for HTTPS
- Fully backward compatible - defaults to HTTP
- Documented in README and CONFIGURATION.md
Addresses kenrmayfield's request for HTTPS support
- Grant enhanced Audit permissions to PBS tokens for system stats access
- Create PBSCard component to display CPU, memory, disk, uptime metrics
- Detect Docker PBS instances and show appropriate info without stats
- Add adaptive node layout on dashboard for better scalability
- Move PBS status card to Backups tab above frequency chart
- Create CompactNodeCard for handling many nodes efficiently
- Update PBS setup script to grant Audit role to both user and token
This addresses the request in issue #259 to show PBS system stats on the dashboard.
The implementation uses read-only Audit permissions to access the /nodes endpoint
while maintaining security. Docker PBS instances are detected and handled gracefully
since they cannot provide host system statistics.
- Only check cluster status during initial configuration, not during polling
- Cache cluster membership in config to avoid repeated API calls
- Skip cluster/resources endpoint entirely for standalone nodes
- Change cluster detection failure from WARN to DEBUG (expected for standalone)
This addresses #322 where standalone PVE nodes were causing certificate
lookup errors in syslog every minute during polling.
Requires 3 consecutive offline polls (~15 seconds) before triggering connectivity alerts to prevent false positives from transient cluster communication issues
addresses #329 - VMs were being displayed as LXC containers because the Type field wasn't being set when using the efficient cluster/resources polling method
Non-clustered Proxmox nodes were getting certificate verification errors
when Pulse tried to use the cluster/resources endpoint. Now checks if
the node is actually in a cluster before attempting efficient polling.
When both GetVersion and GetDatastores fail for PBS, properly set the
Status field to 'offline' and ConnectionHealth to 'error'. This prevents
the red dot from appearing when the instance state is undefined.
- Detect when running behind a proxy/tunnel (X-Forwarded-*, CF-Ray headers)
- Use SameSite=None for cookies when proxied to allow cross-origin access
- Properly detect HTTPS when behind proxy using X-Forwarded-Proto
- Fixes authentication not working through Cloudflare tunnels
The issue was that SameSite=Strict/Lax cookies don't work when the origin
changes (which happens with tunnels/proxies). Now we detect proxy headers
and relax the cookie policy to SameSite=None when needed.
- Mark deprecated poll functions that cause duplicate GetNodes() calls
- Add warnings when deprecated functions are called directly
- Previous fix only created WithNodes versions but didn't prevent the originals from being called
- This completes the fix started in commit fcd782370
- Reduces API calls and prevents certificate verification spam in syslog
The deprecated functions (pollVMs, pollContainers, pollStorage, pollStorageBackups)
still exist for backward compatibility but log warnings if called.
- Discord embeds don't support newlines in description field
- Use comma-separated list format for Discord grouped alerts
- Keep escaped newlines for other webhook providers (Telegram, Slack, Teams)
- Prevents JSON parsing errors with Discord webhook API
Discord now shows: "Alert | 🔔 5 alerts: • item1: 25.4%, • item2: 11.6%, ..."
Other providers show multi-line format with proper escaping.
- Show full list of grouped alerts for Discord, Slack, Teams, etc (not just Telegram)
- Properly escape newlines in grouped alert messages to prevent JSON parsing errors
- Ensure consistent formatting across all webhook providers
- Address issue where only custom templates showed complete alert lists
All webhook providers now display the same detailed grouped alert format with bullet points showing each alert's resource and value.
- Fixed double CPU percentage multiplication for containers/VMs
- Added CheckGuest calls to efficient polling path
- Fixed newline escaping in grouped webhook notifications
- Guest alerts now properly trigger for containers and VMs
These changes address issues where guest alerts weren't being triggered
at all due to the efficient polling path not calling CheckGuest, and
webhook notifications were failing due to unescaped newlines in grouped
alert messages breaking JSON templates.
Webhooks weren't being sent because the grouped alert message contained actual
newlines which broke JSON parsing in custom templates. Changed to use escaped
newlines (\n) which work properly in JSON strings.
- Fixed duplicate 'usage' text in storage alerts (Storage usage usage → Storage at X%)
- Improved grouped alerts to show details of other alerts instead of just count
- Added severity indicators (🔴 critical, 🟡 warning, 🟢 info)
- Better formatting with current value, threshold, type, duration, and timestamp
- Cleaner message structure with proper Markdown formatting
- Shows up to 3 additional alerts in grouped notifications with their values
- Fixed same template overwriting bug in sendGroupedWebhook function
- Grouped alerts now properly use custom templates
- Telegram webhooks now work for both individual and grouped alerts
- Successfully tested Telegram webhook delivery
- Login component now handles 429 rate limit responses correctly
- When rate limited, assume auth is configured and show login form
- /api/security/status endpoint excluded from strict auth rate limiting
- Status checks now use general API rate limit (500/min) instead of auth limit (10/min)
- Fixes issue where rapid logout/login could trigger rate limiting
- Fixes setup screen appearing incorrectly when rate limited
- Fixed bug where custom webhook templates were being overwritten with generic payload
- The issue occurred when a webhook had a custom template but empty service field
- Now properly preserves custom template payloads regardless of service field value
- Telegram webhooks and other custom template webhooks now work correctly
- Addresses user reports of webhook delivery issues
- Use realistic test values (85.5% CPU, 80% threshold) instead of zeros
- Set alert level to 'warning' instead of 'info' for better visibility
- Add 5-minute duration to test alerts for realistic testing
- Improve test message to be more descriptive
- Fix empty message text issue in Telegram webhooks
The webhook system now sends proper test notifications that accurately
simulate real alerts, making it easier to verify webhook configurations.
- Re-enable JSON validation that was accidentally commented out
- Fix Telegram chat_id handling with proper validation
- Add smart retry logic that distinguishes retryable from permanent errors
- Enhance error logging to include response bodies for debugging
- Add webhook URL validation for security (prevent SSRF)
- Fix deprecated strings.Title function usage
- Add webhook delivery history tracking
- Improve template variable substitution
- Add exponential backoff for retries (max 30 seconds)
- Validate numeric chat IDs for Telegram webhooks
- Add comprehensive error handling and logging
Tested with Telegram, Discord, and Slack - all working correctly now
- Fixed copy button not working in Quick Token Setup modal
- Button was conditionally rendered only when host was populated
- Now always visible and shows error if host is empty
- Updated placeholder text to be clearer
- Fixed toast notifications appearing behind modals
- Increased z-index from z-50 to z-[9999] to ensure visibility
- Fixed Generate API Token section intermittently not showing
- Added proper loading state for security status
- Prevents race condition where component renders before data loads
- Added loadSecurityStatus() function for reusability
- Refresh security status after password change
- Skip CSRF validation for /api/setup-script-url endpoint
- Endpoint generates temporary tokens, not a state change
- Fixes 403 Forbidden error when generating setup scripts
All API token functionality confirmed working with token rotation
Pulse Monitor