Delete and recreate the PulseMonitor role each time instead of trying to modify it. This ensures a clean, predictable state with exactly the permissions needed.
Also fixes incorrect pveum command syntax - should be 'role add' not 'role create'.
Addresses issue reported by NameLessJedi in #340
- Theme changes now broadcast instantly via WebSocket to all connected browsers
- No page refresh needed - theme updates in real-time across all devices
- Theme preference is persisted server-side and loaded on new sessions
- Added WebSocket message type 'settingsUpdate' for broadcasting settings changes
- Updated SystemSettingsHandler to broadcast theme changes to all clients
- Added frontend event listener to handle incoming theme change messages
- Fixed API endpoint routing to use the new handler with broadcast support
- Added proper DISABLE_AUTH check in CheckAuth for auth-disabled environments
This creates a seamless experience where toggling dark/light mode on one device
instantly updates all other connected devices (phones, tablets, browsers).
When a webhook has an empty template string, don't try to use it - fall through to the service-specific template instead. This was causing Discord webhooks to send empty payloads resulting in errors.
PBS was incorrectly appending default port :8007 even when custom ports were specified, resulting in malformed URLs like domain:443:8007. Now properly detects existing ports after the protocol prefix.
Webhooks now stored encrypted (webhooks.enc) instead of plain text:
- Automatic migration from webhooks.json to webhooks.enc
- Uses same AES-256-GCM encryption as nodes and email configs
- Original file backed up as webhooks.json.backup
- Protects sensitive webhook URLs and authentication headers
This addresses the security concern where webhook URLs containing API tokens
(like Telegram bot tokens) were stored in plain text.
Implements header-based proxy authentication for SSO integration with
Authentik, Authelia, and other authentication proxies.
- Add CheckProxyAuth function to validate proxy headers
- Support for username and role-based access control
- Frontend integration with logout URL support
- Comprehensive documentation with examples
- Backwards compatible - no breaking changes
Addresses #327
Configuration via environment variables:
- PROXY_AUTH_SECRET: Shared secret for validation
- PROXY_AUTH_USER_HEADER: Header containing username
- PROXY_AUTH_ROLE_HEADER: Header containing roles/groups
- PROXY_AUTH_LOGOUT_URL: SSO logout endpoint
Storage devices with alerts disabled in the Thresholds tab were still
triggering alerts. Added proper checking of the disabled override flag
in CheckStorage() to match the behavior of guest alerts.
- Add GetVMFSInfo method to fetch filesystem data from guest agent
- Integrate guest agent disk stats for VMs in both polling modes
- Aggregate real disk usage from all filesystems (skip special mounts)
- Fall back gracefully to allocated size when agent unavailable
- Add VM.Monitor permission to auto-negotiation script via PulseMonitor role
- Update frontend NodeModal with new permission instructions
VMs with QEMU guest agent now show actual disk usage like LXCs do.
Addresses #344
Addresses #342 - Gotify webhooks now include the required 'message' field
that was missing when using generic webhook payloads. The template also
includes proper priority mapping and markdown support.
Addresses #343 - users can now disable Proxmox/PBS server discovery through:
- UI toggle in Settings > System > Network Settings
- Environment variable DISCOVERY_ENABLED=false
- system.json configuration
Discovery runs by default but can be completely disabled for environments where automatic scanning causes issues (e.g., shared hosting networks).
- Auto-detects Proxmox VE hosts and creates LXC containers
- Quick mode with sensible defaults (1GB RAM, 4GB disk)
- Advanced mode for full customization
- Automatic cleanup on failure
- Simple 'update' command in containers
- Improved error handling and network detection
- Professional, clean output without verbose noise
- Docker detection to prevent container-in-container
- Removed all references to community scripts
This is now the primary recommended installation method.
addresses #340 - more secure authentication for Quick Token Setup
Major security improvement:
- Replaced URL-embedded tokens with 6-character one-time setup codes
- Setup codes are entered interactively, never transmitted in URLs
- Codes are hashed for storage and expire after 5 minutes
- Each code can only be used once
How it works:
1. User clicks "copy command" in Pulse UI
2. A unique setup code is generated and shown to the user
3. User runs the curl command on their Proxmox server
4. Script prompts for the setup code
5. Code is validated and node is auto-registered
This approach is much more secure as no authentication tokens travel over the network in URLs, and the codes are short-lived and single-use.
addresses #340 - Quick Token Setup improvements
Changed:
- Auto-registration now uses temporary setup tokens instead of API tokens (API tokens are hashed and can't be passed directly)
- Setup script shows token value for manual configuration when auto-registration fails
- Improved error messages to explain why auto-registration might fail
- Auto-register endpoint now accepts either API tokens or temporary setup tokens
This ensures the Quick Token Setup feature works as intended - automatically registering nodes without manual token copying when possible, while providing clear fallback instructions when authentication is required.
Discord and other webhook notifications were failing with template parse
errors due to backslashes incorrectly escaping quotes in Go raw string
literals. Raw strings preserve backslashes literally, causing the Go
template parser to fail.
Fixes#341
- Allow WebSocket connections from private networks when no origins configured
- Fixes "connection lost" errors for Docker users accessing from LAN IPs
- Maintains security by only allowing RFC1918 private IPs and local domains
- Users can still explicitly set ALLOWED_ORIGINS for stricter control
- Addresses issue #214 where Docker users couldn't connect via WebSocket
- API tokens now work even when DISABLE_AUTH is set
- Added API token section back to Security tab in settings
- API tokens can protect API access for automation while keeping UI open
- Invalid tokens are rejected even with auth disabled
- Export/import endpoints still require valid API token
- Added migration logic to set I/O thresholds to 0 when loading saved configs
- Only migrates if values match old defaults (150 MB/s disk, 200 MB/s network)
- Ensures existing users get the new "Off by default" behavior
- Prevents saved configs from overriding the new defaults
- Changed default thresholds for diskRead/diskWrite/networkIn/networkOut to 0 (Off)
- UI now shows "Off" instead of "0 MB/s" for disabled I/O metrics
- Reduces alert noise for users who don't need I/O monitoring
- Advanced users can still enable them by setting custom thresholds
- Prevents common false positives like hourly pihole database writes
This makes Pulse focus on the core metrics (CPU, memory, disk space) by default
while keeping I/O monitoring available for those who need it.
- Fixed alert units display (MB/s vs %) in notifications and UI
- Added missing threshold controls for disk I/O and network metrics
- Redesigned threshold table with active alert indicators
- Added ability to disable node connectivity alerts
- Improved visual distinction between defaults and overrides
- Added keyboard shortcuts for search (type to search, ESC to clear)
- Better threshold management with automatic cleanup of empty overrides
- Enhanced UI with proper units display for all metrics
addresses #336
- redesigned global defaults section with compact table layout
- fixed bug where editing without changes created unnecessary overrides
- improved visual consistency across the alerts interface
- Add ability to completely disable alerts for specific guests in Custom Overrides
- Refactor override editing to use single form instead of inline editing
- Add dashboard indicators for guests with custom overrides (blue cog for custom thresholds, grey bell-slash for disabled)
- Remove complex Proxmox tag-based alert control system in favor of simpler UI controls
- Improve layout and UX for alert override management
- ProxmoxVE community script uses pulse-backend.service
- Our install script now detects and preserves existing service name
- Removed pulse-backend.service from pre-v4 detection (it's used by v4 too)
- Install script stops the correct service during upgrades
- New installs use 'pulse', existing use whatever they have
This ensures compatibility with all deployment methods without breaking changes.
removed incorrect 'temporary override' framing - users want permanent control for VMs with special needs (TrueNAS, Samba, Frigate, etc). tags are now presented as direct per-VM control that can be used for both permanent configuration and temporary needs
key insight: tags let users say 'this specific VM is special' vs custom rules for patterns
- updated documentation to clearly distinguish between:
- Custom Rules: permanent alert policies configured in UI
- Tags: temporary operational overrides applied in Proxmox
- improved log messages to indicate tags are temporary overrides
- added clear use cases and best practices for each approach
- emphasized that tags complement (not replace) custom rules
changed pulse-relaxed behavior to override with fixed values (95% CPU/RAM, 98% disk) rather than adding to existing thresholds. this avoids confusing interactions with custom alert rules and provides more predictable behavior
also updated docs to clarify the priority order of tags vs custom rules
addresses #336 - diskRead/diskWrite/networkIn/networkOut metrics are measured in MB/s not percentages, so alert messages now correctly show "X MB/s" instead of "X%"
- pulse-no-alerts: suppress all alerts for VM/CT
- pulse-monitor-only: show alerts in UI but skip email notifications
- pulse-relaxed: use relaxed thresholds (+15% for CPU/memory, +10% for disk)
Tags are read from Proxmox VM/CT configuration and applied during alert checks.
This provides a simple way to manage alert behavior without adding UI complexity.
- Added DISABLE_AUTH env var to completely bypass authentication
- Useful for reverse proxy setups (Authentik, Authelia, etc.)
- Updated documentation in CONFIGURATION.md and REVERSE_PROXY.md
- Fixed security tests to handle auth disabled state
Frontend (TypeScript):
- Eliminated all 'any' types (7 → 0)
- Added proper types for event system with generics
- Fixed event data interfaces with specific types
- Replaced any with unknown where appropriate
Backend (Go):
- Created central types.go with 30+ typed API structures
- Eliminated all interface{} in /internal/api package (158 → 0)
- Replaced map[string]interface{} with typed structs:
- ChartResponse, VMChartData, NodeChartData, StorageChartData
- DiagnosticsInfo with NodeDetails, ClusterInfo, PBSDetails
- StorageChartsResponse with StorageMetrics
- Improved compile-time type safety for all API responses
Benefits:
- Better IDE support and autocomplete
- Compile-time error detection
- Clearer API contracts
- Improved maintainability
All tests passing, service running successfully with typed code.
- Handle X-Forwarded-Proto and X-Forwarded-Host headers in origin check
- Fixes WebSocket connections failing when accessed via reverse proxy
- Addresses #333 where connections broke after v4.3
- Add helpful "No Proxmox VE nodes configured" message to Storage and Backup tabs
- Include "Go to Settings" button for easy navigation when no nodes exist
- Enhance network discovery for Docker environments with smart subnet detection
- Auto-detect Docker network configuration and scan appropriate subnets
- Add support for common Docker network ranges (172.16.0.0/12, 10.0.0.0/8)
- Improve discovery logging to show subnet being scanned
- Fix discovery API endpoint to properly return discovered servers
- Automatically hash plain text API tokens (SHA3-256) and passwords (bcrypt) when loaded from env vars
- Remove unnecessary PULSE_SETUP_TOKEN feature in favor of simpler env var approach
- Remove HandleInitialSetup endpoint - not needed with env var configuration
- Update authentication to always use hashed comparisons (no plain text warnings)
- Update documentation to clearly explain auto-hashing capability
- Maintain backward compatibility with pre-hashed credentials
This makes Pulse secure by default while keeping deployment simple - users can
provide plain text credentials via environment variables and Pulse automatically
hashes them for security.
- Track which settings are overridden by env vars in backend
- Expose env override information in system settings API
- Show clear warnings in UI when settings are controlled by env vars
- Disable input fields when overridden by environment variables
- Add helpful instructions for users to remove env vars if needed
This improves UX by making it clear why UI changes don't take effect
when environment variables are set. Follows container best practices
where env vars have highest precedence, while clearly communicating
this behavior to users.
Addresses user confusion when UI settings don't work due to env var overrides.
- Add clear warnings that env vars override UI/system.json settings
- Update log messages to indicate when env vars are overriding values
- Document standard container practice: env vars have highest precedence
- Users must remove env vars to allow UI configuration to take effect
This prevents confusion when UI changes don't work due to env var overrides.
- Re-enable DISCOVERY_SUBNET env var for Docker network configuration
- Re-enable LOG_LEVEL env var for runtime logging control
- Re-enable CONNECTION_TIMEOUT env var for timeout configuration
- Re-enable ALLOWED_ORIGINS env var for CORS configuration
- Update documentation to reflect working env vars
These env vars were accidentally disabled but are useful for Docker deployments.
Env vars override system.json settings when present.
Addresses #214 - user requested DISCOVERY_SUBNET env var support
- API tokens now hashed before storage (never stored in plain text)
- Raw token shown only once during generation
- Backward compatible with existing plain text tokens
- Added migration warnings for users with plain tokens
- Updated documentation to reflect security improvements
- Move development scripts to scripts/ directory (dev.sh, hot-dev.sh, build.sh, etc.)
- Move UPGRADE_NOTICE to docs/ directory
- Remove empty 2025-08-14 file
- Update all references to moved scripts in documentation
- Add HTTPS_ENABLED, TLS_CERT_FILE, TLS_KEY_FILE environment variables
- Server automatically starts in HTTPS mode when configured
- Falls back to HTTP with warning if certs missing
- WebSocket origins automatically adjust for HTTPS
- Fully backward compatible - defaults to HTTP
- Documented in README and CONFIGURATION.md
Addresses kenrmayfield's request for HTTPS support
Pulse Monitor