16 Commits

Author	SHA1	Message	Date
Echo	9a129170f8	feat: add self-enrollment workflow for automated PKI provisioning ... - Phase 1: CLI args (--enroll flag), enroll module skeleton, config support - Phase 2: Registration request, polling loop (24h timeout), main.rs integration - Phase 3: PKI extraction, atomic cert writing, whitelist auto-append, mTLS transition - Phase 4: E2E test suite, README/DEPLOYMENT docs, CI pipeline - Phase 5: SPEC.md, API_DOCUMENTATION.md, CHANGELOG.md, ROADMAP.md sync Security review: APPROVED (0 critical, 0 high findings) Cross-distro compatible: Debian/Ubuntu, RHEL/CentOS/Fedora, Alpine, Arch Linux	2026-05-17 05:30:42 +00:00
Echo	d297c8d3b1	docs: add self-enrollment client workflow to API documentation	2026-05-16 19:18:25 +00:00
Echo	8b6d9ed861	Add GET /api/v1/system/services/{name} endpoint for service health checks ... - Add ServiceStatus struct with name, display_name, active_state, sub_state, load_state, enabled_state, main_pid, healthy fields - Add get_service_status() to PackageManagerBackend trait - Implement get_service_status() in AptBackend with systemd and OpenRC support - Add get_service_status HTTP handler in system.rs - Add /system/services/{name} route - Add E2E test for service status endpoint - Bump version to 0.3.6	2026-05-04 23:44:26 +00:00
Echo	c44045db38	feat: implement proper WebSocket handler with actix-web-actors ... - Replace stub websocket_handler with proper actix_web_actors::ws::start() - Add WsJobActor that subscribes to JobManager broadcast channel - Add broadcast::Sender/Receiver to JobManager for real-time status updates - Emit JobStatusEvent on job state changes (create, update, complete, fail) - Handle subscribe/unsubscribe client messages for per-job filtering - Add 5-second heartbeat ping/pong for connection keepalive - Properly compute Sec-WebSocket-Accept header per RFC 6455	2026-05-04 15:19:44 +00:00
Echo	6ba708abb1	fix: remove all systemd capability restrictions blocking package management ... - Remove CapabilityBoundingSet and AmbientCapabilities (apt needs full root capabilities) - Remove ReadWritePaths (unnecessary without ProtectSystem=strict) - Fix E2E test: properly FAIL on status=failed package operations - Fix E2E test: require status=completed for install/update/remove lifecycle - Update dpkg packaging service file to match configs/ - Bump version to 0.3.5	2026-05-03 04:13:50 +00:00
Echo	508037d656	chore: bump version to 0.3.4 for clean CI build	2026-05-03 03:11:41 +00:00
Echo	56de1d73e1	fix(ci): prevent recursive tag triggers and u2204 release duplication ... - Change tag trigger from v* to v*.*.* to prevent recursive CI runs - Upload u2204 deb to same release tag (not creating -u2204 suffix) - Rename u2204 deb filename to include u2204 for differentiation	2026-05-03 02:49:18 +00:00
Echo	9e42f32270	fix: remove sudo from apt commands and RestrictSUIDSGID from service ... - Remove sudo from apt command execution (service runs as root) - Remove RestrictSUIDSGID from systemd service (blocks setuid for apt/dpkg) - Remove NoNewPrivileges from systemd service (blocks sudo PERM_SUDOERS) - Bump version to 0.3.2	2026-05-03 02:24:52 +00:00
Echo	2b35a143da	fix: implement actual system reboot via shutdown/systemctl commands ... - Fix reboot_system() to use shutdown -r +N for delayed reboots - Fix patches handler to call reboot_system() instead of just logging - Add CAP_SYS_BOOT capability to systemd service for LXC reboot support - Remove unused warn import from packages/mod.rs - Bump version to 0.3.1	2026-05-03 01:37:22 +00:00
Echo	6f75ec4865	chore: bump version to 0.3.0 for beta release	2026-05-03 00:55:27 +00:00
Echo	de9638e1b0	fix: resolve clippy errors for rustls 0.23 API and unnecessary_map_or lint ... - Fix ServerConfig::builder() to builder_with_provider() for TLS 1.3 enforcement - Add aws_lc_rs feature to rustls in Cargo.toml - Fix clippy unnecessary_map_or -> is_some_and in packages/mod.rs	2026-05-03 00:36:32 +00:00
Echo	6d177c81a4	fix(ci): add apt-get -f install to resolve broken runner dependencies ... Runners may have broken apt state from partial upgrades (e.g., openssh-client version mismatch). Adding apt-get -f install before build deps ensures CI works regardless of runner package state.	2026-05-03 00:31:13 +00:00
Echo	36890f65b1	style: fix cargo fmt compliance for mtls.rs closure and packages matches!	2026-05-02 21:52:39 +00:00
Echo	2ec8de961a	style: fix mtls.rs indentation for cargo fmt compliance	2026-05-02 21:30:12 +00:00
Echo	03786d1798	v0.2.0: Fix List Jobs bug, TLS 1.3 enforcement, client_disconnect_timeout, RwLock contention ... Bug fixes: - Fix List Jobs connection reset: Add client_disconnect_timeout (5s) to prevent TLS write truncation - Enforce TLS 1.3 only: Add with_protocol_versions(&[&TLS13]) to rustls ServerConfig - Fix RwLock contention: Release read lock before sorting in list_jobs() - Fix systemd service: Remove ProtectSystem=strict (blocks package management) - Fix systemd service: Change Type=notify to Type=simple (fixes restart hangs) - Fix systemd service: Add DEBIAN_FRONTEND=noninteractive - Fix systemd service: Add ReadWritePaths for apt/dpkg paths CI/CD: - Add Ubuntu 22.04 build job to CI workflow E2E Testing: - Add comprehensive E2E test suite (test_e2e.py) - Tests cover health, packages, patches, jobs, security, and reboot endpoints Other: - Bump version to 0.2.0 - Add lessons learned documentation	2026-05-02 20:59:02 +00:00
Echo	bda8d5c10c	BUG-17: Strip release suffixes from package names in list_patches() ... BUG-18: Add sudo prefix for apt install/upgrade/remove operations - list_patches() now strips /noble-updates,noble-security suffixes - run_apt() uses sudo for modifying operations (install, upgrade, etc.) - Requires sudoers config for linux-patch-api user on agents	2026-04-30 22:55:02 +00:00