Repository navigation

fix: harden agents, alerting, status page and deployment; align the docs with the code - #129

Merged

btouchard merged 54 commits into

mainfrom

039-audit-fixes

Oct 1, 2026

Commits on Sep 30, 2026

fix(install): restart on update, keep the env file, offline install, custom data paths
btouchard
committed
52828f8
fix(updates): check official images, real rollbacks, apply update labels
btouchard
committed
e2bc989
fix(http): refuse cross-origin API writes, unbuffer SSE, explain TLS refusals
btouchard
committed
6b4492c
fix(deploy): make the image, entrypoint and Kubernetes manifests work as shipped
btouchard
committed
924eefd
fix(mcp): serve /mcp behind a reverse proxy on the same host
btouchard
committed
3c28564
fix(status): send status page emails through the environment SMTP server
btouchard
committed
b41ab8f
fix(alerts): escalation timing and ack fan-out, drop inert alert fields
btouchard
committed
61a1260
fix(agent): keep replays out of live state, re-enroll refused agents, trust MAINTENANT_CA_CERT everywhere
btouchard
committed
378cf84
fix(kubernetes): live events, loss detection and a Docker fallback for stale kubeconfigs
btouchard
committed
0c498e5
fix(status): answer subscriptions alike and encode mail subjects
btouchard
committed
85d72e3
fix: persist daily uptime, honour ignore and Swarm service labels, add Kubernetes service insights
btouchard
committed
9374614
fix(alerts): keep trigger state and policy scopes on update, show toggle errors
btouchard
committed
863557e
fix(kubernetes): swap the API clients atomically on reconnect
btouchard
committed
4798dde
fix(kubernetes): list Services through the connection's client accessor
btouchard
committed
f785c23
docs: align status page, MCP, escalation and security pages with the code
btouchard
committed
fc8ca37
docs: bring the security policy and security guide in line with the code
btouchard
committed
7268182
docs: rewrite the API reference and architecture pages from the code, fix false Pro comments
btouchard
committed
b9f52e8
fix(updates): track digest updates against the running image, apply update labels to agents and Kubernetes
btouchard
committed
eed3c7e
docs: bring install, configuration and index pages in line with the code
btouchard
committed
04301c9
docs: align monitors, multi-host, agent and PostgreSQL pages with the audited code
btouchard
committed
0e3f6dc
docs: rewrite troubleshooting and correct the cloud provider guides
btouchard
committed
b05a95c
fix(alerts): raise Kubernetes alerts, honour ignore on Swarm services, fill container Swarm fields
btouchard
committed
20291fa
fix(swarm): node alert ids, update alert recovery, resumed tracking, race-free activation
btouchard
committed
00ec78c
fix(swarm): resolve the quorum alert once the managers are back
btouchard
committed
036c98e
fix(monitoring): resolve every certificate and resource alert, carry agent container exits, weigh heartbeat uptime by time
btouchard
committed
ad9e341
fix: status page, escalation, posture, SMTP, SSE and config hardening
btouchard
committed
eeac376
fix(status): keep a maintenance window's components when editing it
btouchard
committed
1c06f6d
docs: align Swarm, Kubernetes and label guides with the audited code
btouchard
committed
423f572
fix(api): wire endpoint events, track webhook deliveries, apply live quotas
btouchard
committed
fe86947
fix(mcp): check component ids before writing an incident or a window
btouchard
committed
fc280bb
fix(alerts): keep each notification stream in order, announce status component changes
btouchard
committed
09e88b7
fix(status): update the public page in place from status events
btouchard
committed
eb01876
fix(swarm): one replica alert path, cluster-wide crash loops, filled cluster counts
btouchard
committed
d1699e0
style: gofmt the files that had drifted
btouchard
committed
738b2ec
docs: align the alert engine, update intelligence and README with the audited code
btouchard
committed
03cbedc
fix(updates): keep unscanned updates, analyse every container, update Swarm services
btouchard
committed
6a1b4b0
docs: align the API reference, security, install, troubleshooting and guides with the audited code
btouchard
committed
5f61cb3
docs: align the feature pages, index and README with the audited code
btouchard
committed
11a2911
fix(agent): start without a container runtime, and close the last config gaps
btouchard
committed
60f1f58
fix(store): stop the SQLite writer without racing in-flight writes
btouchard
committed
2d8011f
fix(status): keep hidden components off the public stream and harden the public routes
btouchard
committed
ba059ac
feat(agent): report the detected runtime after enrollment
btouchard
committed
4669b45
fix(runtime): degrade on Docker loss and stop the Swarm manager when Swarm leaves
btouchard
committed
d918fd7
test(app): name the sentinel PostgreSQL role after the whole UUID
btouchard
committed
8f19880
fix(alerts): share one acknowledgment path and keep acknowledged alerts quiet
btouchard
committed
dc96023
fix(status): never name a hidden component on a public surface
btouchard
committed
436b1a7
fix: resolve audit findings on updates, certificates, resources, heartbeats and endpoints
btouchard
committed
bf67158
docs: align documentation with the audit fixes on runtime, alerts, status page, updates, resources, heartbeats and endpoints
btouchard
committed
62c5b1f
fix(status): refuse a maintenance window that ends when it starts
btouchard
committed
0b923f8
fix(logs): stream lines up to 1 MiB and report a broken stream as such
btouchard
committed
23062dc

Commits on Oct 1, 2026

fix(store): read the clock once per uptime, ranking and retention operation
btouchard
committed
be704bd
fix(deps): update undici, brace-expansion and fast-uri for the latest advisories
btouchard
committed
efb5362
fix(editions): drop per-entity alert routing, which was never implemented
btouchard
committed
af1b0e4
fix(security): rebuild OAuth redirects from trusted parts, bound the uptime window, patch base packages
btouchard
committed
751bd2d