86 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
justme	f22fdf8b68	feat: first-run claim wizard (no default admin, claim code from the backend log); owner list shows account and passkey; container install first [CI]	2026-10-08 06:47:10 +08:00
justme	2ae63653c4	feat: the node itself requires an owner passkey (shared by agent and probe) and reports it; the panel derives the account and passkey it is bound to [CI]	2026-10-08 06:15:07 +08:00
justme	8c37db1577	feat: every agent and probe must have an owner passkey, enforced by the panel, the installers and fleet-enroll [CI]	2026-10-08 06:04:04 +08:00
justme	0b384a58f5	fix: hash the node binary without the registry auth file that does not exist yet [CI]	2026-10-08 05:43:51 +08:00
justme	4841f7b15b	feat: bind each node to the binary it runs at its first handshake; refuse changes that are not in a CI-signed manifest [CI]	2026-10-08 05:39:13 +08:00
justme	117d34a2af	feat: signed manifests live in the image registry; updaters and first deploys fetch and verify them without the panel [CI]	2026-10-08 05:05:13 +08:00
justme	4106f831dc	feat!: drop the backend-side elevation windows; password and passkey sessions share capabilities, passkeys guard what nodes verify; the trust page lists added and removed passkeys [CI]	2026-10-08 04:57:28 +08:00
justme	f704c66dd9	feat: CI registers release manifests without a token; the panel verifies the CI signature instead [CI]	2026-10-08 04:22:01 +08:00
justme	fbda9487d5	feat: serve the web apps from the Backend (embedded, allow-listed, no filesystem access) so passkeys bind to the panel's own domain [CI]	2026-10-08 04:09:40 +08:00
justme	4a3631f82b	fix: gate password sessions on the login method so data-source sessions also get the passkey-only page [CI SKIP]	2026-10-08 04:09:39 +08:00
justme	3b88a3419d	ci: build the dev images for the genesis-pinned trust model [CI]	2026-10-08 03:28:03 +08:00
justme	a2f88a344b	feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity ... Join codes need no passkey touch and carry only public values (genesis fingerprint, owner credentials, installer hashes). Nodes pin the genesis and owners at enrollment and only follow passkey-signed operator set versions. The panel's server key is listed in the set; pinned nodes require its signature and run the control link under AES-256-GCM. Password sessions carry no capabilities. The updater adopts a next_key from a signed manifest. Bump version to 0.2.0. [CI SKIP] v0.2.0	2026-10-08 03:21:44 +08:00
justme	9bb6841dce	feat: pinned agents and probes only accept peers carrying the operator's proof; the panel ships the signed operator chain with the rosters [CI SKIP]	2026-10-07 23:24:33 +08:00
justme	fc2bbdcc6d	feat: operator trust root: passkey-signed operator set, signed join codes, nodes verify and pin the chain at enrollment [CI SKIP]	2026-10-07 23:19:59 +08:00
justme	321cacac32	feat: operator trust chain library (passkey-signed operator set, grants and code-key bindings) [CI SKIP]	2026-10-07 23:09:09 +08:00
justme	36f9816f40	test: allow the installer manifest paths in the OpenAPI layout check [CI SKIP]	2026-10-07 23:02:50 +08:00
justme	310b2b5b19	feat: the one-line installer verifies the CI-signed release manifest and pulls the image by digest [CI]	2026-10-07 23:01:45 +08:00
justme	a19e6548d3	feat: trust forwarded client addresses only from configured proxies (rate limit, audit, SSE) [CI] ... Docs: access.md covers the missing node-side Backend identity and the hash-first install flow.	2026-10-07 22:51:44 +08:00
justme	ff45ad086e	feat!: sensitive actions need a fresh passkey touch (elevation windows), plus login page hint cleanup [CI]	2026-10-07 22:29:24 +08:00
justme	1379b8c7cb	feat: audit log of admin writes, sign-ins and key creation, with an audit tab [CI]	2026-10-07 22:17:52 +08:00
justme	359313a57b	feat: record who created join codes and who added each node [CI]	2026-10-07 22:12:15 +08:00
justme	6385c1b9a3	feat: sign in with a passkey (WebAuthn, ES256, discoverable credentials) and manage your passkeys [CI]	2026-10-07 21:57:19 +08:00
justme	ddb6608e32	feat!: capabilities replace API token scopes; every admin endpoint declares one, with a picker UI [CI]	2026-10-07 20:56:36 +08:00
justme	55b80f0a97	docs: access control and enrollment trust chain design [CI SKIP]	2026-10-07 20:45:23 +08:00
justme	af2962fc58	feat: one-line install for agents and probes from one shared script (curl | bash, zsh, PowerShell) [CI]	2026-10-07 20:02:38 +08:00
justme	5528753d45	feat: deploy-node.sh backend takes extra env settings with --env [CI SKIP]	2026-10-07 19:40:13 +08:00
justme	b99b95c738	feat!: pre-handshake knock on the agent TCP ports; probes get the agent certificate public key [CI]	2026-10-07 18:56:40 +08:00
justme	f03988d68b	feat: detect an agent's public IPv4 and IPv6 addresses automatically, manual values still win [CI]	2026-10-07 18:12:17 +08:00
justme	9966ea5d63	fix: run the enrollment container on the host network [CI SKIP]	2026-10-07 17:20:08 +08:00
justme	b4b50c636f	feat: deploy-node.sh also deploys the Backend and migrates old probe.json [CI SKIP]	2026-10-07 17:12:00 +08:00
justme	a9f562441f	feat!: probes generate their own keys and enroll with a join token; node and peer keys are separate [CI]	2026-10-07 16:57:34 +08:00
justme	1ff847e45a	feat: declare every protocol method's direction and enforce it in the router; add the zero-trust design [CI] ... Methods, roles and binary channels are declared in one table per plane (node and peer). RpcRouter checks direction, kind and role when handlers are registered, when messages arrive (fleet_protocol_violation, disconnect after repeated violations) and before sending. NodeConnection is split by responsibility.	2026-10-07 16:17:02 +08:00
justme	ee22309e65	fix: keep the Backend backup out of the journal [CI SKIP]	2026-10-07 15:07:39 +08:00
justme	9bcef56497	feat: daily node restart controlled from the admin, connect timings as a default line task [CI] ... Agents and Probes exit in order at a configured time (default 04:30 UTC+8, switch and time zone in the admin settings) and the service manager starts them again; a local restart_at or MOSHIRO_RESTART_AT wins. The connect kind (TCP connect and TLS handshake timings) is now a default continuous line template, with a section on the line page.	2026-10-07 14:56:50 +08:00
justme	388619b8b6	feat: add a re-runnable deploy script for container nodes and migrate listen.bind to :: [CI SKIP]	2026-10-07 14:17:50 +08:00
justme	3b73fd7474	fix: pass Backend listener port into container (#18) [CI] ... Pass the host listener URL to the Backend container process.	2026-10-07 05:17:13 +00:00
justme	e423d9b506	fix: pass Backend listener port into container [CI]	2026-10-07 13:13:21 +08:00
justme	3364f7903e	fix: bind Backend host service to its configured port (#17) [CI] ... Keep the Backend host-network container reachable on its configured port.	2026-10-07 05:11:52 +00:00
justme	4e1b372e66	fix: bind Backend host service to its configured port [CI]	2026-10-07 13:08:08 +08:00
justme	1b052dcaef	backend: confirm signed channel updates (#16) [CI] ... Publish signed, channel-matched Backend update offers and host IPv6 diagnostics.	2026-10-07 05:05:08 +00:00
justme	33b9782a1d	ci: tolerate legacy Backend release webhook [CI]	2026-10-07 13:00:35 +08:00
justme	84f9d211bc	backend: require confirmation for signed channel updates [CI]	2026-10-07 12:57:20 +08:00
justme	7160de2a36	shared: merge IPv4 and IPv6 collection (#15) [CI] ... Preserve independent dual-stack measurement paths; PR checks passed.	2026-10-07 03:48:39 +00:00
justme	0eda0600cc	shared: add independent IPv4 and IPv6 collection [CI]	2026-10-07 11:44:01 +08:00
justme	c974a7dddb	docs: merge the Fleet docs into backend/fleet/README.md, add TODO.md, unify the Backend compose, fix stale references [CI SKIP]	2026-10-07 03:36:34 +08:00
justme	a286a453f4	fix: let the update helper write the status volume owned by the app user [CI SKIP] ... The status helper runs as root with all capabilities dropped, so it could not write a volume owned by uid 1654 (mktemp: Permission denied) and the volume updater failed on rootful Podman. Add DAC_OVERRIDE only.	2026-10-07 02:58:34 +08:00
justme	7613f67fed	fix: create the update directory for fresh named volumes [CI] ... ConfigStore.Write only created the config root, so a new volume without update/ made update offers fail with IO_PathNotFound. Create the parent directory on write and ship an empty update/ in the node images.	2026-10-07 02:51:39 +08:00
justme	ef75c9f510	fix: API tokens use the mos_ prefix [CI]	2026-10-07 02:31:32 +08:00
justme	18a6898a27	fix: build the Backend image as glibc so it can load libssl [CI] ... The musl AotAnywhere output is a fully static executable, which cannot dlopen libssl: the Backend exited with 'No usable version of libssl was found' on start. Use linux-x64/arm64 and the Debian runtime-deps base.	2026-10-07 02:21:31 +08:00
geruipu	d3fadc0bf8	fix: support rootless ICMP and verify SELinux deployment [CI]	2026-10-07 02:06:34 +08:00