Refactored Login component to use nested Show components for proper reactivity in SolidJS. This ensures the component re-renders correctly when auth status changes, fixing the issue where UI stayed stuck on "Checking authentication...".
Added proper Suspense wrapper around the lazy-loaded FirstRunSetup component to ensure it loads correctly in production builds. Also added debug logging to help diagnose auth flow issues during development.
The FirstRunSetup component wasn't being included in the production build due to Vite's tree-shaking optimization. Fixed by using lazy loading to ensure the component is always bundled as a separate chunk, allowing it to display properly when no authentication is configured.
- Modified Login component to check security status
- Shows FirstRunSetup when no authentication is configured
- Shows login form when authentication exists
- Fixed App.tsx to properly detect when auth setup is needed
Docker improvements:
- Fixed entrypoint script to properly handle UID/GID changes
- Simplified user/group recreation logic to avoid conflicts
- Properly handles switching between different UID/GID values
Cleanup:
- Removed temporary test scripts and files
- Removed PROXMOX_ENDPOINTS.md documentation
- Cleaned up various test Python and shell scripts
Docker testing confirmed:
- Data persistence working across restarts
- UID/GID configuration working correctly
- Volume backup/restore functioning properly
- Fixed copy button not working in Quick Token Setup modal
- Button was conditionally rendered only when host was populated
- Now always visible and shows error if host is empty
- Updated placeholder text to be clearer
- Fixed toast notifications appearing behind modals
- Increased z-index from z-50 to z-[9999] to ensure visibility
- Fixed Generate API Token section intermittently not showing
- Added proper loading state for security status
- Prevents race condition where component renders before data loads
- Added loadSecurityStatus() function for reusability
- Refresh security status after password change
- Skip CSRF validation for /api/setup-script-url endpoint
- Endpoint generates temporary tokens, not a state change
- Fixes 403 Forbidden error when generating setup scripts
All API token functionality confirmed working with token rotation
- Cache nodes list in pollPVEInstance and pass to sub-functions
- Prevents multiple GetNodes() calls per polling cycle
- Reduces API calls from ~5 per cycle to 1 per cycle
- Fixes syslog spam on standalone PVE nodes trying to find cluster certificates
- Fixes PBS 'Transport endpoint not connected' errors from excessive polling
Previously we were calling GetNodes() in:
- pollPVEInstance (main)
- pollVMs
- pollContainers
- pollStorage
- pollStorageBackups
Now we call it once and pass the list to avoid duplicate API calls that trigger
certificate checks on non-clustered nodes.
- Fix alternating zero I/O metrics by implementing rate caching for stale data from Proxmox
- Hardcode polling interval to 10 seconds (matching Proxmox cluster/resources update cycle)
- Remove polling interval settings from UI (no longer user-configurable)
- Implement efficient VM/container polling using single cluster/resources API call
- Remove 'Remove Password' feature (auth is now mandatory)
- Fix CSRF validation for Basic Auth (exempt from CSRF checks)
- Fix Generate API Token modal and authentication
- Remove redundant 'Active' status from Authentication section
- Remove Connection Timeout setting from frontend (backend-only)
- Clean up frontend console logging (reduce verbosity)
- Remove PBS polling interval setting (fixed at 10s)
- Add frontend rebuild detection to backend-watch script
- Improve first-run setup flow and error handling
- Remove old /api/system/api-token endpoints
- Remove APIToken field from SystemSettings struct
- Remove token handling from system_settings.go
- Clean up config.Load() to not read token from system.json
- Remove unused frontend API token functions
- Remove unused APITokenManager and CurrentAPIToken components
API tokens are now managed exclusively via .env file with the new
/api/security/regenerate-token endpoint. This eliminates confusion
between the two systems and ensures consistency.
- Add backend endpoint to regenerate API tokens without resetting auth
- Updates .env file with new token while preserving other settings
- Frontend component with clear UX for token generation
- Shows new token once with copy functionality
- Indicates restart required to activate new token
- Works across all deployment types (Docker, LXC, native)
Much better UX than telling users to 'reconfigure security' just for a new token
- Show API Token Active status
- Add security notice about one-time visibility
- Include usage example with curl
- Replaces empty section that was confusing users
- Remove CurrentAPIToken component entirely
- API tokens now only shown once during initial setup
- Add clear warning that token won't be shown again
- Remove sessionStorage caching of tokens
- Follows security best practices (like GitHub/AWS)
This prevents showing cached/wrong tokens from sessionStorage that don't match the actual configured token
- Add pending restart detection when .env exists but not loaded
- Update frontend to show pending state instead of re-showing setup
- Fix QuickSecuritySetup to refresh security status after configuration
- Remove auto-restart attempts from security setup
- Show deployment-appropriate restart instructions
- Update documentation to reflect new update mechanism
Related to security setup issues after removing sudo/auto-restart capabilities
- Add critical docker-compose bcrypt escaping documentation
- Create comprehensive TROUBLESHOOTING.md guide
- Create dedicated DOCKER.md deployment guide
- Update CONFIGURATION.md with service name variations
- Document that .env file is not created when using env vars
- Add warnings about dollar sign escaping in docker-compose.yml
These docs address the main confusion points from recent issues,
especially the docker-compose bcrypt hash problem affecting many users.
Emergency release to fix critical issues in v4.3.7:
- Install script now correctly installs binary to /opt/pulse/bin/pulse
- Password changes no longer require sudo (addresses #317)
These fixes restore basic functionality for new installations
and Docker deployments.
- ProxmoxVE script can now check if auth is already set without credentials
- Quick-setup endpoint is now public but handler checks if setup should be skipped
- Prevents duplicate auth configuration attempts
- Critical for automated setup scripts
- Remove old buggy Quick Security Setup handler
- New handler in security_setup_fix.go handles all cases properly
- Tested and working with Docker, systemd, and manual installations
- Enhanced logging to diagnose chat_id extraction problems
- Log payload being sent to Telegram for debugging
- Better error messages when chat_id is missing or invalid
- Add clear error message for truncated bcrypt hashes (addresses #316)
- Detect hashes between 55-59 chars and warn they're invalid
- Only accept exactly 60 character bcrypt hashes as valid
- Treat truncated hashes as plaintext to force users to fix them
- Cluster now handles offline nodes gracefully without marking endpoints unhealthy
- Fixed error 595 (node unreachable) not being treated as node-specific failure
- Added parallel health checks with shorter timeouts for better performance
- Fixed inconsistent border width on offline node cards (removed conflicting border-l-4)
- Switched to ring utility for consistent outline on offline/alert nodes
- Improved logout functionality with proper CSRF token handling
addresses #312, #315
- alerts now trigger when nodes go offline or lose connectivity
- alerts automatically resolve when nodes come back online
- offline status is checked before resource thresholds
- logs critical events when nodes lose connectivity
This was a major oversight - nodes going offline should always trigger alerts
- adds logout button next to connection status indicator
- implements /api/logout endpoint to clear sessions
- button only shows when authentication is configured
- clears session cookie and invalidates server-side session
implements #315
- tracks online/offline status for individual cluster nodes
- updates ClusterEndpoint.Online field during node polling
- fixes issue where all cluster nodes showed green indicator regardless of status
fixes#312
- explains purpose of each file type
- clarifies that .env is only for auth, not a regression
- documents the technical reasoning behind the architecture
- addresses confusion raised in #314
- clarified .env file usage for Docker (it's acceptable for Docker volumes)
- emphasized need for quotes around bcrypt hashes to prevent shell expansion
- removed incorrect SHA3-256 'cost factor' reference (only bcrypt has cost factor)
- added notes about proper quoting in Docker examples
addresses #314 - bcrypt hashes with $ signs were being interpreted as shell variables
by godotenv, causing authentication to fail after Docker container restarts
Updated security documentation to explicitly mention that Docker uses
the Quick Security Setup wizard and persists credentials via /data/.env
file in the volume, making it clear how auth works in Docker deployments.
Script outputs from change-password and remove-password operations could
potentially contain sensitive information. Removed output logging while
keeping error logging for debugging.
Docker now supports .env files in /data for auth credentials created
by the security wizard. This was added to fix the credential persistence
issue in Docker containers.
The export/import handlers were using direct string comparison for API tokens
instead of proper hash comparison. This caused auth to fail when tokens were
stored as hashes (which is what the security wizard does).
addresses #314
The security wizard was failing to detect Docker environments because PULSE_DOCKER
env var was never set in the Dockerfile. This caused credentials to not persist
correctly after container restarts.
addresses #314
- Docker containers were not saving credentials to persistent storage
- Non-Docker setups were saving plain text instead of hashed credentials
- After container restart, saved credentials would not work
This fixes issue #314 where users couldn't login after setting up security
in Docker containers. The Quick Security Setup now:
1. Properly hashes passwords and tokens before saving
2. Saves to /etc/pulse/.env for persistence in Docker volumes
3. Correctly loads credentials after container restart
- Add clear documentation that auth settings are intentionally excluded from exports
- Update API docs to explicitly state what is/isn't included in exports
- Enhance migration guide with security notes about auth exclusion
- Add UI warning in export dialog about auth settings not transferring
- Each Pulse instance should configure its own authentication for security
Related to user feedback about auth settings not transferring between instances
- No longer shows 'Use your login password' option when no auth is configured
- Defaults to passphrase-only mode for auth-less instances
- Shows 'Encryption Passphrase' instead of confusing login password references
- Always enforces 12-character minimum for auth-less users
- Clearer messaging throughout for different auth states
- Homelab users on private networks (192.168.x.x, 10.x.x.x, 172.16.x.x) can now export/import without any configuration
- No need to set ALLOW_UNPROTECTED_EXPORT=true for typical homelab setups
- Public network access still requires authentication for security
- Simplifies backup/restore for users who don't need authentication
- Clarify that session auth (password login) is sufficient for export/import
- Document that guest metadata and custom console URLs are included
- Update FAQ with clearer backup instructions
- Add UI-first approach to README backup section
Pulse Monitor