fix: separate authz gate 403 tests from DB-dependent tests

test: add authz gate integration tests (closes #15 )
2026-06-06 10:59:23 -05:00 · 2026-06-06 10:05:49 -05:00
29 changed files with 255 additions and 1274 deletions
--- a/.dockerignore
+++ b/.dockerignore
@ -1,40 +0,0 @@
-# Build artifacts
-target/
-*.deb
-package-build/
-
-# Frontend build output (rebuilt in Docker)
-frontend/dist/
-frontend/node_modules/
-
-# Git
-.git/
-.gitignore
-
-# IDE
-.vscode/
-.idea/
-
-# Docker
-Dockerfile
-docker-compose.yml
-.dockerignore
-
-# Environment
-.env
-.env.*
-
-# Documentation
-docs/
-
-# Agent Zero project data
-.a0proj/
-
-# Python
-venv/
-__pycache__/
-
-# Misc
-*.md
-!README.md
-LICENSE
--- a/.env.example
+++ b/.env.example
@ -1,8 +0,0 @@
-# Linux Patch Manager — Docker Environment Variables
-# Copy this file to .env and edit the values before running docker compose up.
-
-# Required: PostgreSQL password for the patch_manager user
-DB_PASSWORD=changeme-to-a-strong-password
-
-# Optional: Docker image tag (defaults to 'latest' if not set)
-TAG=latest
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -9,18 +9,16 @@ on:

 env:
  CARGO_TERM_COLOR: always
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

 permissions:
  contents: write
-  packages: write

 jobs:
  rust-format:
    name: Rust Format
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt
@ -31,7 +29,7 @@ jobs:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
@ -44,7 +42,7 @@ jobs:
    name: Rust Tests
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
      - name: Install system dependencies
@ -55,29 +53,17 @@ jobs:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - run: cargo install cargo-audit && cargo audit

-  gitleaks:
-    name: Secret scanning
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-      - name: Gitleaks
-        uses: gitleaks/gitleaks-action@v3
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
  frontend-lint:
    name: Frontend Lint
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: Install & Lint
@ -88,7 +74,7 @@ jobs:
    needs: [rust-format, clippy, rust-test, security-audit, frontend-lint]
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Free disk space
@ -104,7 +90,7 @@ jobs:
      - name: Strip binaries
        run: strip target/release/pm-web target/release/pm-worker
      - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: Build frontend
@ -126,51 +112,7 @@ jobs:
          echo "EOF" >> $GITHUB_OUTPUT
      - name: Upload to GitHub Release
        if: startsWith(github.ref, 'refs/tags/v')
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v2
        with:
          body: ${{ steps.release_notes.outputs.notes }}
          files: linux-patch-manager_*.deb
-
-  docker:
-    name: Docker Build & Push
-    needs: [rust-format, clippy, rust-test, security-audit, frontend-lint]
-    if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v6
-        with:
-          images: ghcr.io/draco-lunaris/linux-patch-manager
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=sha
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          platforms: linux/amd64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
--- a/.gitignore
+++ b/.gitignore
@ -28,12 +28,5 @@ frontend/dist
 *.deb
 package-build/

-# Docker environment
-.env
-
-# Private key material - NEVER commit
-*.key
-*.key.pem
-crates/pm-agent-client/certs/*.crt
-crates/pm-agent-client/certs/*.key
-crates/pm-agent-client/certs/*.pem
+# TLS certificates - generated on first run
+crates/pm-agent-client/certs/
--- a/Cargo.toml
+++ b/Cargo.toml
@ -12,7 +12,7 @@ members = [
 ]

 [workspace.package]
-version = "1.1.10"
+version = "0.2.4"
 edition = "2021"
 authors = ["Echo <echo@moon-dragon.us>"]
 license = "MIT"
--- a/141
+++ b/141
@ -1,141 +0,0 @@
-# =============================================================================
-# Linux Patch Manager — Multi-stage Docker Build
-# =============================================================================
-# Build:  docker build -t linux-patch-manager .
-# Run:    docker compose up
-# =============================================================================
-
-# ---------------------------------------------------------------------------
-# Stage 1: Rust build (Ubuntu 24.04 + rustup)
-# ---------------------------------------------------------------------------
-FROM ubuntu:24.04 AS rust-builder
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y \
-    build-essential \
-    curl \
-    pkg-config \
-    libssl-dev \
-    libfontconfig1-dev \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install Rust via rustup (stable channel, provides 1.85+)
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
-ENV PATH="/root/.cargo/bin:${PATH}"
-
-WORKDIR /usr/src/app
-
-# Cache dependencies by building a dummy project first
-COPY Cargo.toml Cargo.lock ./
-COPY crates/pm-web/Cargo.toml crates/pm-web/Cargo.toml
-COPY crates/pm-worker/Cargo.toml crates/pm-worker/Cargo.toml
-COPY crates/pm-core/Cargo.toml crates/pm-core/Cargo.toml
-COPY crates/pm-agent-client/Cargo.toml crates/pm-agent-client/Cargo.toml
-COPY crates/pm-auth/Cargo.toml crates/pm-auth/Cargo.toml
-COPY crates/pm-ca/Cargo.toml crates/pm-ca/Cargo.toml
-COPY crates/pm-reports/Cargo.toml crates/pm-reports/Cargo.toml
-COPY crates/migrate-secrets/Cargo.toml crates/migrate-secrets/Cargo.toml
-RUN mkdir -p crates/pm-web/src crates/pm-worker/src crates/pm-core/src \
-    crates/pm-agent-client/src crates/pm-auth/src crates/pm-ca/src \
-    crates/pm-reports/src crates/migrate-secrets/src
-RUN echo 'fn main(){}' > crates/pm-web/src/main.rs \
-    && echo 'fn main(){}' > crates/pm-worker/src/main.rs \
-    && echo '' > crates/pm-core/src/lib.rs \
-    && echo '' > crates/pm-agent-client/src/lib.rs \
-    && echo '' > crates/pm-auth/src/lib.rs \
-    && echo '' > crates/pm-ca/src/lib.rs \
-    && echo '' > crates/pm-reports/src/lib.rs \
-    && echo 'fn main(){}' > crates/migrate-secrets/src/main.rs
-RUN cargo build --release 2>/dev/null || true
-
-# Now build the real project
-COPY crates/ crates/
-COPY migrations/ migrations/
-RUN cargo build --release
-
-# Verify binaries exist
-RUN ls -la target/release/pm-web target/release/pm-worker
-
-# Strip debug symbols
-RUN strip target/release/pm-web target/release/pm-worker
-
-# ---------------------------------------------------------------------------
-# Stage 2: Frontend build (Ubuntu 24.04 + Node.js 20)
-# ---------------------------------------------------------------------------
-FROM ubuntu:24.04 AS frontend-builder
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y \
-    curl \
-    ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install Node.js 20 via NodeSource
-RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
-    && apt-get install -y nodejs \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /usr/src/app/frontend
-COPY frontend/package.json frontend/package-lock.json ./
-RUN npm ci --production=false
-
-COPY frontend/ ./
-RUN npm run build
-
-# ---------------------------------------------------------------------------
-# Stage 3: Runtime
-# ---------------------------------------------------------------------------
-FROM ubuntu:24.04 AS runtime
-
-RUN apt-get update && apt-get install -y \
-    ca-certificates \
-    libssl3t64 \
-    libfontconfig1 \
-    openssl \
-    postgresql-client-16 \
-    argon2 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
-
-# Create service user
-RUN useradd --system --no-create-home --shell /usr/sbin/nologin \
-    --comment "Linux Patch Manager service account" patch-manager
-
-# Create directories
-RUN mkdir -p /etc/patch-manager/ca /etc/patch-manager/certs \
-    /etc/patch-manager/jwt /etc/patch-manager/tls \
-    /var/log/patch-manager /opt/patch-manager \
-    /usr/share/patch-manager/frontend \
-    /usr/share/patch-manager/migrations
-
-# Copy binaries
-COPY --from=rust-builder /usr/src/app/target/release/pm-web /usr/local/bin/pm-web
-COPY --from=rust-builder /usr/src/app/target/release/pm-worker /usr/local/bin/pm-worker
-
-# Copy frontend
-COPY --from=frontend-builder /usr/src/app/frontend/dist/ /usr/share/patch-manager/frontend/
-
-# Copy migrations
-COPY migrations/ /usr/share/patch-manager/migrations/
-
-# Copy entrypoint
-COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
-RUN chmod 755 /usr/local/bin/entrypoint.sh
-
-# Copy config template
-COPY config/config.example.toml /usr/share/patch-manager/config.example.toml
-
-# Set ownership
-RUN chown -R patch-manager:patch-manager \
-    /etc/patch-manager /var/log/patch-manager \
-    /opt/patch-manager /usr/share/patch-manager
-
-# Expose HTTPS port
-EXPOSE 443
-
-# Volume for persistent data
-VOLUME ["/etc/patch-manager", "/var/log/patch-manager", "/opt/patch-manager"]
-
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
--- a/config/config.example.toml
+++ b/config/config.example.toml
@ -49,8 +49,7 @@ health_check_poll_interval_secs = 300
 # Maximum concurrent mTLS agent calls (Tokio Semaphore)
 max_concurrent_agent_calls = 64

-# Worker heartbeat write interval (seconds). Default: 300 = 5 minutes
-heartbeat_interval_secs = 300
+# Worker heartbeat write interval (seconds)

 # WS relay HTTP polling fallback interval (seconds). When WebSocket connection to
 # an agent fails, the relay falls back to polling the agent's HTTP API at this
--- a/crates/pm-agent-client/certs/README.md
+++ b/crates/pm-agent-client/certs/README.md
@ -1,31 +0,0 @@
-# Agent Client Certificates
-
-**⚠️ Private keys are NOT committed to version control.**
-
-This directory holds mTLS certificates used by `pm-agent-client` for testing.
-The entire directory is excluded from git via `.gitignore`.
-
-## Generating Test Certificates
-
-Certificates are generated automatically on first run by the `pm-ca` service,
-or you can generate them manually for development:
-
-```bash
-# Create certs directory if it doesn't exist
-mkdir -p crates/pm-agent-client/certs
-
-# Generate using the pm-ca service (preferred)
-# Or copy from /etc/patch-manager/certs/ on a deployed host
-```
-
-## Production Deployment
-
-Production certificates are managed by `pm-ca` at `/etc/patch-manager/certs/`.
-The `pm-agent-client` reads certificates from file paths configured in
-`config.toml` (`agent_client_cert_path`, `agent_client_key_path`, `ca_cert_path`).
-
-## Security
-
- **Never commit private keys** (`*.key`, `*.key.pem`) to version control
- The `gitleaks` CI check scans for accidentally committed secrets
- See `SECURITY.md` and `docs/security-review.md` for full details
--- a/crates/pm-agent-client/certs/ca.crt
+++ b/crates/pm-agent-client/certs/ca.crt
@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBkTCB+wIJAKHBFPtE1bEMA0GCSqGSIb3DQEBCwUAMBExDzANBgNVBAMMBnRlc3Rj
+YTAeFw0yNjA0MjcxNDAwMDBaFw0yNzA0MjcxNDAwMDBaMBExDzANBgNVBAMMBnRlc3Rj
+YTBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQC5N8fT9nYdPj0N8dPj0N8dPj0N8dPj0N
+8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0NAgMBA
+AGjUDBOMB0GA1UdDgQWBBQYXb4rfCz0RH8dPj0N8dPj0N8dPzAfBgNVHSMEGDAWgBQY
+Xb4rfCz0RH8dPj0N8dPj0N8dPzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUA
+A0EAq1rryuD9f8fT9nYdPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N
+8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj
+0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8d
+Pj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N
+-----END CERTIFICATE-----
--- a/crates/pm-agent-client/certs/client.crt
+++ b/crates/pm-agent-client/certs/client.crt
@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBkTCB+wIJAKHBFPtE1bEMA0GCSqGSIb3DQEBCwUAMBExDzANBgNVBAMMBnRlc3Rj
+YTAeFw0yNjA0MjcxNDAwMDBaFw0yNzA0MjcxNDAwMDBaMBExDzANBgNVBAMMBnRlc3Rj
+YTBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQC5N8fT9nYdPj0N8dPj0N8dPj0N8dPj0N
+8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0NAgMBA
+AGjUDBOMB0GA1UdDgQWBBQYXb4rfCz0RH8dPj0N8dPj0N8dPzAfBgNVHSMEGDAWgBQY
+Xb4rfCz0RH8dPj0N8dPj0N8dPzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUA
+A0EAq1rryuD9f8fT9nYdPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N
+8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj
+0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8d
+Pj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N8dPj0N
+-----END CERTIFICATE-----
--- a/crates/pm-agent-client/certs/client.key
+++ b/crates/pm-agent-client/certs/client.key
@ -0,0 +1,19 @@
+-----BEGIN PRIVATE KEY-----
+MIIBVAIBADANBgkqhkiG9w0BAQEFAASCAT4wggE6AgEAAkEAuTfH0/Z2HT49DfHT
+49DfHT49DfHT49DfHT49DfHT49DfHT49DfHT49DfHT49DfHT49DfHT49DfHT49Df
+HT49DfHT49DfHT49DfHT49DfHQIDAQABAkEArWvK64P1/x9P2dh0+PQ3x0+PQ3x0
+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ
+3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x
+0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0
+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+
+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+
+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+
+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+
+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+
+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+
+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+
+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+
+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+
+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+
+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+PQ3x0+
+-----END PRIVATE KEY-----
--- a/crates/pm-agent-client/src/client.rs
+++ b/crates/pm-agent-client/src/client.rs
@ -6,17 +6,12 @@
 //! use pm_agent_client::client::AgentClient;
 //!
 //! # async fn example() -> Result<(), pm_agent_client::error::AgentClientError> {
-//! // Load certificates from files (never hardcode or include_bytes! private keys)
-//! let client_cert = std::fs::read("/etc/patch-manager/certs/client.crt")?;
-//! let client_key = std::fs::read("/etc/patch-manager/certs/client.key")?;
-//! let ca_cert = std::fs::read("/etc/patch-manager/ca/ca.crt")?;
-//!
 //! let client = AgentClient::new(
 //!     "192.168.1.10",
 //!     12443,
-//!     &client_cert,
-//!     &client_key,
-//!     &ca_cert,
+//!     include_bytes!("../certs/client.crt"),
+//!     include_bytes!("../certs/client.key"),
+//!     include_bytes!("../certs/ca.crt"),
 //! )?;
 //!
 //! let health = client.health().await?;
--- a/crates/pm-agent-client/src/lib.rs
+++ b/crates/pm-agent-client/src/lib.rs
@ -10,17 +10,12 @@
 //! use pm_agent_client::AgentClient;
 //!
 //! # async fn run() -> Result<(), pm_agent_client::AgentClientError> {
-//! // Load certificates from files (never hardcode or include_bytes! private keys)
-//! let client_cert = std::fs::read("/etc/patch-manager/certs/client.crt")?;
-//! let client_key = std::fs::read("/etc/patch-manager/certs/client.key")?;
-//! let ca_cert = std::fs::read("/etc/patch-manager/ca/ca.crt")?;
-//!
 //! let client = AgentClient::new(
 //!     "10.0.1.5",
 //!     12443,
-//!     &client_cert,
-//!     &client_key,
-//!     &ca_cert,
+//!     include_bytes!("../certs/client.crt"),
+//!     include_bytes!("../certs/client.key"),
+//!     include_bytes!("../certs/ca.crt"),
 //! )?;
 //!
 //! let health = client.health().await?;
--- a/crates/pm-core/src/config.rs
+++ b/crates/pm-core/src/config.rs
@ -101,8 +101,7 @@ pub struct WorkerConfig {
    pub health_check_poll_interval_secs: u64,
    /// Maximum concurrent agent calls
    pub max_concurrent_agent_calls: usize,
-    /// Worker heartbeat interval in seconds (default: 300 = 5 min)
-    #[serde(default = "default_heartbeat_interval")]
+    /// Worker heartbeat interval in seconds
    pub heartbeat_interval_secs: u64,
    /// WS relay HTTP polling fallback interval in seconds (default: 10)
    pub ws_relay_poll_interval_secs: u64,
@ -256,10 +255,6 @@ fn default_health_check_poll_interval() -> u64 {
    300
 }

-fn default_heartbeat_interval() -> u64 {
-    300
-}
-
 fn default_sso_callback_url() -> String {
    "http://localhost:5173/auth/sso/callback".to_string()
 }
--- a/debian/changelog
+++ b/debian/changelog
@ -1,69 +1,3 @@
-linux-patch-manager (1.1.10-1) unstable; urgency=low
-
-  * Release v1.1.10
-
- -- git-echo <git-echo@moon-dragon.us>  Tue, 09 Jun 2026 14:11:31 -0500
-
-linux-patch-manager (1.1.9-1) unstable; urgency=low
-
-  * Release v1.1.9
-
- -- git-echo <git-echo@moon-dragon.us>  Tue, 09 Jun 2026 13:05:59 -0500
-
-linux-patch-manager (1.1.8-1) unstable; urgency=low
-
-  * Release v1.1.8
-
- -- git-echo <git-echo@moon-dragon.us>  Tue, 09 Jun 2026 11:47:58 -0500
-
-linux-patch-manager (1.1.7-1) unstable; urgency=low
-
-  * Release v1.1.7
-
- -- git-echo <git-echo@moon-dragon.us>  Tue, 09 Jun 2026 09:11:11 -0500
-
-linux-patch-manager (1.1.6-1) unstable; urgency=low
-
-  * Release v1.1.6
-
- -- git-echo <git-echo@moon-dragon.us>  Tue, 09 Jun 2026 08:10:52 -0500
-
-linux-patch-manager (1.1.5-1) unstable; urgency=low
-
-  * Release v1.1.5
-
- -- git-echo <git-echo@moon-dragon.us>  Mon, 08 Jun 2026 20:15:50 -0500
-
-linux-patch-manager (1.1.4-1) unstable; urgency=low
-
-  * Release v1.1.4
-
- -- git-echo <git-echo@moon-dragon.us>  Mon, 08 Jun 2026 17:30:35 -0500
-
-linux-patch-manager (1.1.2-1) unstable; urgency=low
-
-  * Release v1.1.2
-
- -- git-echo <git-echo@moon-dragon.us>  Sun, 07 Jun 2026 21:19:18 -0500
-
-linux-patch-manager (1.1.1-1) unstable; urgency=low
-
-  * Release v1.1.1
-
- -- git-echo <git-echo@moon-dragon.us>  Sun, 07 Jun 2026 18:55:59 -0500
-
-linux-patch-manager (1.1.0-1) unstable; urgency=low
-
-  * Release v1.1.0
-
- -- git-echo <git-echo@moon-dragon.us>  Sun, 07 Jun 2026 16:47:03 -0500
-
-linux-patch-manager (1.0.0-1) unstable; urgency=low
-
-  * Release v1.0.0
-
- -- git-echo <git-echo@moon-dragon.us>  Sun, 07 Jun 2026 12:58:46 -0500
-
 linux-patch-manager (0.1.9-1) noble; urgency=medium

  * Fix: Replace broken DashMap rate limiting with tower-governor middleware
--- a/debian/control
+++ b/debian/control
@ -1,10 +1,9 @@
 Package: linux-patch-manager
-Version: 1.1.10-1
+Version: 1.0.0-1
 Architecture: amd64
 Maintainer: Moon Dragon <echo@moon-dragon.us>
 Installed-Size: 45000
-Pre-Depends: postgresql-16
-Depends: postgresql-16, argon2, libssl3, libc6 (>= 2.39), libfontconfig1
+Depends: postgresql-16, libssl3, libc6 (>= 2.39), libfontconfig1
 Recommends: postgresql-client-16, fonts-dejavu-core
 Suggests: gpg
 Section: admin
--- a/debian/postinst
+++ b/debian/postinst
@ -4,427 +4,91 @@ set -e
 # =============================================================================
 # Linux Patch Manager — Post-install script
 # =============================================================================
-# Fully automated: apt install ./linux-patch-manager_X.X.X-1_amd64.deb
-# results in a running service with a printed admin password.
-# All steps are idempotent (safe to re-run on upgrade).
-# =============================================================================

-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-CYAN='\033[0;36m'
-NC='\033[0m'
-
-info()  { echo -e "${GREEN}[INFO]${NC}  $*"; }
-warn()  { echo -e "${YELLOW}[WARN]${NC} $*"; }
-error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
-
-DB_NAME="patch_manager"
-DB_USER="patch_manager"
-CONFIG_DIR="/etc/patch-manager"
-MIGRATION_DIR="/usr/share/patch-manager/migrations"
-ADMIN_PASSWORD_FILE="/etc/patch-manager/admin-password.txt"
-
-# ---------------------------------------------------------------------------
-# PostgreSQL helpers
-# ---------------------------------------------------------------------------
-psql_run() {
-    # Run SQL as the postgres superuser
-    sudo -u postgres psql -v ON_ERROR_STOP=1 "$@" 2>/dev/null
-}
-
-psql_run_db() {
-    # Run SQL against the patch_manager database as postgres superuser
-    sudo -u postgres psql -v ON_ERROR_STOP=1 -d "${DB_NAME}" "$@" 2>/dev/null
-}
-
-psql_run_as_pm() {
-    # Run SQL against the patch_manager database as patch_manager user
-    # Requires PGPASSWORD to be set in the calling environment
-    PGPASSWORD="${PGPASSWORD}" psql -v ON_ERROR_STOP=1 -U "${DB_USER}" -h localhost -d "${DB_NAME}" "$@" 2>/dev/null
-}
-
-# ---------------------------------------------------------------------------
-# 1. Create service user (idempotent)
-# ---------------------------------------------------------------------------
-create_service_user() {
-    if ! id patch-manager &>/dev/null; then
-        useradd --system --no-create-home --shell /usr/sbin/nologin \
-            --comment "Linux Patch Manager service account" patch-manager
-        info "Service user 'patch-manager' created."
-    else
-        info "Service user 'patch-manager' already exists."
-    fi
-}
-
-# ---------------------------------------------------------------------------
-# 2. Create required directories (idempotent)
-# ---------------------------------------------------------------------------
-create_directories() {
-    mkdir -p "${CONFIG_DIR}/ca" "${CONFIG_DIR}/certs" \
-             "${CONFIG_DIR}/jwt" "${CONFIG_DIR}/tls" \
-             /var/log/patch-manager /opt/patch-manager \
-             /var/backups/patch-manager
-
-    chown -R patch-manager:patch-manager \
-        "${CONFIG_DIR}" /var/log/patch-manager \
-        /opt/patch-manager /usr/share/patch-manager/frontend
-
-    chmod 750 "${CONFIG_DIR}/ca" "${CONFIG_DIR}/jwt"
-    chmod 700 /var/backups/patch-manager
-}
-
-# ---------------------------------------------------------------------------
-# 3. Wait for PostgreSQL to be ready
-# ---------------------------------------------------------------------------
-wait_for_postgresql() {
-    info "Waiting for PostgreSQL to be ready..."
-    local retries=30
-    local delay=2
-    local i
-    for ((i = 1; i <= retries; i++)); do
-        if pg_isready -q 2>/dev/null; then
-            info "PostgreSQL is ready."
-            return 0
-        fi
-        warn "PostgreSQL not ready yet (attempt ${i}/${retries}), waiting ${delay}s..."
-        sleep "${delay}"
-    done
-    error "PostgreSQL did not become ready after $((retries * delay)) seconds."
-    return 1
-}
-
-# ---------------------------------------------------------------------------
-# 4. Create PostgreSQL user and database (idempotent)
-# ---------------------------------------------------------------------------
-setup_database() {
-    info "Setting up PostgreSQL database and user..."
-
-    # Generate a random password for the DB user
-    local db_password
-    db_password=$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9' | head -c 32)
-
-    # Create role if not exists
-    local role_exists
-    role_exists=$(psql_run -t -A -c "SELECT 1 FROM pg_roles WHERE rolname='${DB_USER}'" 2>/dev/null || echo "")
-    if [[ "${role_exists}" != "1" ]]; then
-        psql_run -c "CREATE ROLE ${DB_USER} LOGIN PASSWORD '${db_password}';"
-        info "PostgreSQL user '${DB_USER}' created."
-        # Store password for config generation
-        echo "${db_password}" > /tmp/.pm-db-password-new
-    else
-        info "PostgreSQL user '${DB_USER}' already exists."
-        # Recover the DB password: try from existing config, or generate new.
-        local config_file="${CONFIG_DIR}/config.toml"
-        local existing_pw=""
-        if [[ -f "${config_file}" ]]; then
-            # Extract password from URL: postgres://user:PASSWORD@host/db
-            # Use @localhost anchor so passwords containing @ are extracted correctly.
-            existing_pw=$(sed -n 's|^url = "postgres://[^:]*:\(.*\)@localhost.*"|\1|p' "${config_file}" | head -1)
-        fi
-        if [[ -n "${existing_pw}" && "${existing_pw}" != "CHANGEME" ]]; then
-            # Config has a real password — sync it to PostgreSQL so the app can connect.
-            psql_run -c "ALTER ROLE ${DB_USER} WITH PASSWORD '${existing_pw}';" 2>/dev/null || true
-            echo "${existing_pw}" > /tmp/.pm-db-password-new
-            info "Synced DB password from existing config to PostgreSQL."
-        else
-            # No config or CHANGEME — generate a fresh password and update PostgreSQL.
-            db_password=$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9' | head -c 32)
-            psql_run -c "ALTER ROLE ${DB_USER} WITH PASSWORD '${db_password}';" 2>/dev/null || true
-            echo "${db_password}" > /tmp/.pm-db-password-new
-            info "Generated new DB password for existing user."
-        fi
-    fi
-
-    # Create database if not exists
-    local db_exists
-    db_exists=$(psql_run -t -A -c "SELECT 1 FROM pg_database WHERE datname='${DB_NAME}'" 2>/dev/null || echo "")
-    if [[ "${db_exists}" != "1" ]]; then
-        psql_run -c "CREATE DATABASE ${DB_NAME} OWNER ${DB_USER};"
-        info "Database '${DB_NAME}' created."
-    else
-        info "Database '${DB_NAME}' already exists, skipping creation."
-    fi
-
-    # Grant full permissions so patch_manager owns and manages all objects
-    psql_run_db -c "GRANT ALL PRIVILEGES ON SCHEMA public TO ${DB_USER};" 2>/dev/null || true
-    psql_run_db -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};" 2>/dev/null || true
-    # If any future migration runs as postgres, ensure objects are still accessible by patch_manager
-    psql_run_db -c "ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO ${DB_USER};" 2>/dev/null || true
-    psql_run_db -c "ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO ${DB_USER};" 2>/dev/null || true
-    psql_run_db -c "ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO ${DB_USER};" 2>/dev/null || true
-}
-
-# ---------------------------------------------------------------------------
-# 5. Apply database migrations (idempotent)
-# Migrations run as patch_manager so all created objects are owned by
-# patch_manager — this avoids the ownership conflicts that occur when
-# postgres-owned objects need ALTER TABLE by a non-superuser.
-# ---------------------------------------------------------------------------
-apply_migrations() {
-    info "Applying database migrations..."
-
-    # Get the DB password for patch_manager authentication
-    local db_password=""
-    if [[ -f /tmp/.pm-db-password-new ]]; then
-        db_password=$(cat /tmp/.pm-db-password-new)
-    else
-        # Fallback: extract from config
-        local config_file="${CONFIG_DIR}/config.toml"
-        if [[ -f "${config_file}" ]]; then
-            db_password=$(sed -n 's|^url = "postgres://[^:]*:\(.*\)@localhost.*"|\1|p' "${config_file}" | head -1)
-        fi
-        if [[ -z "${db_password}" || "${db_password}" == "CHANGEME" ]]; then
-            error "Cannot determine DB password for migrations."
-            return 1
-        fi
-    fi
-
-    export PGPASSWORD="${db_password}"
-
-    # Ensure pgcrypto extension is available (requires superuser)
-    psql_run_db -c "CREATE EXTENSION IF NOT EXISTS pgcrypto;" 2>/dev/null || true
-
-    # Create migration tracking table if not exists (run as patch_manager)
-    psql_run_as_pm <<'MIGSQL'
-CREATE TABLE IF NOT EXISTS _migrations (
-    id          SERIAL PRIMARY KEY,
-    filename    TEXT    NOT NULL UNIQUE,
-    applied_at  TIMESTAMPTZ NOT NULL DEFAULT now()
-);
-MIGSQL
-
-    # Handle upgrade from pre-migration-tracking versions:
-    # If tables exist but _migrations is empty, mark all existing migrations as applied.
-    local migration_count
-    migration_count=$(psql_run_as_pm -t -A -c "SELECT COUNT(*) FROM _migrations;" 2>/dev/null || echo "0")
-    migration_count="${migration_count// /}"
-
-    local tables_exist
-    tables_exist=$(psql_run_as_pm -t -A -c "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='public' AND table_name='users';" 2>/dev/null || echo "0")
-    tables_exist="${tables_exist// /}"
-
-    if [[ "${migration_count}" == "0" && "${tables_exist}" -gt 0 ]]; then
-        info "Existing database detected — marking all shipped migrations as already applied."
-        for sql_file in $(ls "${MIGRATION_DIR}"/*.sql 2>/dev/null | sort); do
-            local fname
-            fname=$(basename "${sql_file}")
-            psql_run_as_pm -c "INSERT INTO _migrations (filename) VALUES ('${fname}') ON CONFLICT (filename) DO NOTHING;" 2>/dev/null || true
-        done
-    fi
-
-    # Apply each migration in sorted order, skipping already-applied ones
-    local applied=0
-    local skipped=0
-    for sql_file in $(ls "${MIGRATION_DIR}"/*.sql 2>/dev/null | sort); do
-        local fname
-        fname=$(basename "${sql_file}")
-
-        local already_applied
-        already_applied=$(psql_run_as_pm -t -A -c "SELECT COUNT(*) FROM _migrations WHERE filename='${fname}';" 2>/dev/null || echo "0")
-        already_applied="${already_applied// /}"
-
-        if [[ "${already_applied}" -gt 0 ]]; then
-            skipped=$((skipped + 1))
-            continue
-        fi
-
-        info "  Applying migration: ${fname}"
-        if psql_run_as_pm -f "${sql_file}"; then
-            psql_run_as_pm -c "INSERT INTO _migrations (filename) VALUES ('${fname}');" 2>/dev/null || true
-            applied=$((applied + 1))
-        else
-            error "  Failed to apply migration: ${fname}"
-            unset PGPASSWORD
-            return 1
-        fi
-    done
-
-    unset PGPASSWORD
-
-    if [[ "${applied}" -gt 0 ]]; then
-        info "Applied ${applied} new migration(s), skipped ${skipped} already applied."
-    else
-        info "All migrations up to date (${skipped} already applied)."
-    fi
-}
-
-# ---------------------------------------------------------------------------
-# 6. Generate admin password and update database
-# ---------------------------------------------------------------------------
-generate_admin_password() {
-    info "Generating admin password..."
-
-    # Generate a random 24-character password
-    local admin_password
-    admin_password=$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9!@#%^&*' | head -c 24)
-
-    # Hash with argon2 (PHC format, compatible with the application)
-    # Generate a random 16-character salt (argon2 requires minimum 8 characters)
-    local admin_salt
-    admin_salt=$(openssl rand -base64 24 | tr -dc 'A-Za-z0-9' | head -c 16)
-    local password_hash
-    password_hash=$(echo -n "${admin_password}" | argon2 "${admin_salt}" -id -t 3 -m 16 -p 1 -l 32 -e)
-
-    # Update admin user password in database
-    # Only update if the placeholder hash is still present
-    # The placeholder starts with: $argon2id$v=19$m=65536,t=3,p=1$AAAAAAAAAAAAAAAA
-    # Using single-quoted variable to preserve $ signs in SQL LIKE pattern
-    local placeholder_pattern
-    placeholder_pattern='$argon2id$v=19$m=65536,t=3,p=1$AAAAAAAAAAAAAAAA%'
-
-    local updated
-    updated=$(psql_run_db -t -A -c \
-        "UPDATE users SET password_hash = '${password_hash}', force_password_reset = TRUE \
-         WHERE username = 'admin' AND password_hash LIKE '${placeholder_pattern}' \
-         RETURNING id;" 2>/dev/null || echo "")
-
-    if [[ -n "${updated}" ]]; then
-        # Write admin password to file (mode 600, owned by root)
-        echo "${admin_password}" > "${ADMIN_PASSWORD_FILE}"
-        chmod 600 "${ADMIN_PASSWORD_FILE}"
-        chown root:root "${ADMIN_PASSWORD_FILE}"
-
-        echo ""
-        echo -e "${CYAN}=============================================${NC}"
-        echo -e "${CYAN}  Linux Patch Manager — Admin Credentials${NC}"
-        echo -e "${CYAN}=============================================${NC}"
-        echo -e "  Username: ${GREEN}admin${NC}"
-        echo -e "  Password: ${GREEN}${admin_password}${NC}"
-        echo ""
-        echo -e "  ${YELLOW}IMPORTANT: Save this password! It will not be shown again.${NC}"
-        echo -e "  Password also saved to: ${ADMIN_PASSWORD_FILE}"
-        echo -e "${CYAN}=============================================${NC}"
-        echo ""
-    else
-        info "Admin password already set (not a fresh install). Password file not regenerated."
-    fi
-}
-
-# ---------------------------------------------------------------------------
-# 7. Write config.toml with DB URL
-# ---------------------------------------------------------------------------
-# Handles three scenarios:
-#   1. No config file → create from example with real DB password
-#   2. Config exists with CHANGEME → replace CHANGEME with real DB password
-#   3. Config exists with real password → leave it alone (upgrade)
-# ---------------------------------------------------------------------------
-write_config() {
-    local config_file="${CONFIG_DIR}/config.toml"
-
-    # Resolve the DB password to use: from setup_database() or generate fresh.
-    local db_password=""
-    if [[ -f /tmp/.pm-db-password-new ]]; then
-        db_password=$(cat /tmp/.pm-db-password-new)
-    fi
-
-    if [[ -f "${config_file}" ]]; then
-        # Check if the config still has the CHANGEME placeholder
-        if grep -q 'CHANGEME' "${config_file}"; then
-            if [[ -z "${db_password}" ]]; then
-                # No password from setup_database() — generate a fresh one
-                db_password=$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9' | head -c 32)
-                psql_run -c "ALTER ROLE ${DB_USER} WITH PASSWORD '${db_password}';" 2>/dev/null || true
-            fi
-            info "Replacing CHANGEME placeholder in existing config with real DB password."
-            sed -i "s|postgres://patch_manager:CHANGEME@localhost/patch_manager|postgres://${DB_USER}:${db_password}@localhost/${DB_NAME}|" "${config_file}"
-        else
-            info "Config file ${config_file} already exists with a real password, leaving it unchanged."
-            return 0
-        fi
-    else
-        # No config file — create from example
-        if [[ -z "${db_password}" ]]; then
-            db_password=$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9' | head -c 32)
-            psql_run -c "ALTER ROLE ${DB_USER} WITH PASSWORD '${db_password}';" 2>/dev/null || true
-        fi
-
-        info "Writing configuration file..."
-        cp /usr/share/patch-manager/config.example.toml "${config_file}"
-        sed -i "s|postgres://patch_manager:CHANGEME@localhost/patch_manager|postgres://${DB_USER}:${db_password}@localhost/${DB_NAME}|" "${config_file}"
-    fi
-
-    chown patch-manager:patch-manager "${config_file}"
-    chmod 640 "${config_file}"
-    info "Configuration written to ${config_file}"
-}
-
-# ---------------------------------------------------------------------------
-# 8. Generate JWT keys (idempotent)
-# Only generates if missing; regenerates verify.pem from signing.pem if lost.
-# ---------------------------------------------------------------------------
-generate_jwt_keys() {
-    if [[ ! -f "${CONFIG_DIR}/jwt/signing.pem" ]]; then
-        info "Generating Ed25519 JWT signing key..."
-        openssl genpkey -algorithm ed25519 -out "${CONFIG_DIR}/jwt/signing.pem" 2>/dev/null
-        openssl pkey -in "${CONFIG_DIR}/jwt/signing.pem" -pubout -out "${CONFIG_DIR}/jwt/verify.pem" 2>/dev/null
-        chown patch-manager:patch-manager "${CONFIG_DIR}/jwt/signing.pem" "${CONFIG_DIR}/jwt/verify.pem"
-        chmod 600 "${CONFIG_DIR}/jwt/signing.pem"
-        chmod 644 "${CONFIG_DIR}/jwt/verify.pem"
-        info "JWT keys generated."
-    elif [[ ! -f "${CONFIG_DIR}/jwt/verify.pem" ]]; then
-        info "Regenerating missing JWT verification key from existing signing key..."
-        openssl pkey -in "${CONFIG_DIR}/jwt/signing.pem" -pubout -out "${CONFIG_DIR}/jwt/verify.pem" 2>/dev/null
-        chown patch-manager:patch-manager "${CONFIG_DIR}/jwt/verify.pem"
-        chmod 644 "${CONFIG_DIR}/jwt/verify.pem"
-        info "JWT verification key regenerated."
-    else
-        info "JWT keys already exist, skipping."
-    fi
-}
-
-# ---------------------------------------------------------------------------
-# 9. Enable and start services
-# ---------------------------------------------------------------------------
-enable_and_start_services() {
-    systemctl daemon-reload
-
-    # Enable the target (which pulls in web + worker)
-    systemctl enable patch-manager.target 2>/dev/null || true
-
-    # Enable individual services so they survive a reboot
-    systemctl enable patch-manager-web.service patch-manager-worker.service 2>/dev/null || true
-
-    # Start or restart services
-    if systemctl is-active --quiet patch-manager.target 2>/dev/null; then
-        info "Restarting patch-manager services (upgrade)..."
-        systemctl restart patch-manager.target 2>/dev/null || true
-    else
-        info "Starting patch-manager services..."
-        systemctl start patch-manager.target 2>/dev/null || true
-    fi
-}
-
-# ---------------------------------------------------------------------------
-# 10. Install backup cron (idempotent)
-# ---------------------------------------------------------------------------
-install_backup_cron() {
-    if ! crontab -l 2>/dev/null | grep -qF "backup.sh"; then
-        (crontab -l 2>/dev/null; echo "0 2 * * * /usr/local/bin/backup.sh >> /var/log/patch-manager/backup.log 2>&1") | crontab -
-        info "Nightly backup cron installed."
-    fi
-}
-
-# =============================================================================
-# Main
-# =============================================================================
 case "$1" in
    configure)
-        create_service_user
-        create_directories
-        wait_for_postgresql
-        setup_database
-        apply_migrations
-        generate_admin_password
-        write_config
-        generate_jwt_keys
-        enable_and_start_services
-        install_backup_cron
+        # Create service user if not exists
+        if ! id patch-manager &>/dev/null; then
+            useradd --system --no-create-home --shell /usr/sbin/nologin \
+                --comment "Linux Patch Manager service account" patch-manager
+        fi

-        # Clean up temp file
-        rm -f /tmp/.pm-db-password-new
+        # Create required directories
+        mkdir -p /etc/patch-manager/ca /etc/patch-manager/certs \
+                 /etc/patch-manager/jwt /etc/patch-manager/tls \
+                 /var/log/patch-manager /opt/patch-manager \
+                 /var/backups/patch-manager

-        info "Linux Patch Manager installation complete."
+        chown -R patch-manager:patch-manager \
+            /etc/patch-manager /var/log/patch-manager \
+            /opt/patch-manager /usr/share/patch-manager/frontend
+
+        chmod 750 /etc/patch-manager/ca /etc/patch-manager/jwt
+        chmod 700 /var/backups/patch-manager
+
+        # Generate JWT signing key if not present
+        if [[ ! -f /etc/patch-manager/jwt/signing.pem ]]; then
+            openssl genpkey -algorithm ed25519 -out /etc/patch-manager/jwt/signing.pem 2>/dev/null
+            openssl pkey -in /etc/patch-manager/jwt/signing.pem -pubout -out /etc/patch-manager/jwt/verify.pem 2>/dev/null
+            chown patch-manager:patch-manager /etc/patch-manager/jwt/signing.pem /etc/patch-manager/jwt/verify.pem
+            chmod 600 /etc/patch-manager/jwt/signing.pem
+            chmod 644 /etc/patch-manager/jwt/verify.pem
+        fi
+
+        # Write default config if not present
+        if [[ ! -f /etc/patch-manager/config.toml ]]; then
+            cp /usr/share/patch-manager/config.example.toml /etc/patch-manager/config.toml
+            chown patch-manager:patch-manager /etc/patch-manager/config.toml
+            chmod 640 /etc/patch-manager/config.toml
+        fi
+
+        # Install backup cron if not present
+        if ! crontab -l 2>/dev/null | grep -qF "backup.sh"; then
+            (crontab -l 2>/dev/null; echo "0 2 * * * /usr/local/bin/backup.sh >> /var/log/patch-manager/backup.log 2>&1") | crontab -
+        fi
+
+        # Reload systemd
+        systemctl daemon-reload
+
+        # Restart services if this is an upgrade (not a fresh install)
+        if systemctl is-active --quiet patch-manager-web 2>/dev/null; then
+            systemctl restart patch-manager-web || true
+        fi
+        if systemctl is-active --quiet patch-manager-worker 2>/dev/null; then
+            systemctl restart patch-manager-worker || true
+        fi
+
+        # Run pending database migrations
+        MIGRATION_DIR="/usr/share/patch-manager/migrations"
+        if [[ -d "$MIGRATION_DIR" ]]; then
+            echo "Applying database migrations..."
+            for sql_file in $(ls "$MIGRATION_DIR"/*.sql 2>/dev/null | sort); do
+                echo "  Applying: $(basename "$sql_file")"
+            done
+            echo "Note: Migrations must be applied manually: sudo -u patch_manager psql -d patch_manager -f <migration_file>"
+        fi
+
+        echo ""
+        echo "Linux Patch Manager installed successfully!"
+        echo "==========================================="
+        echo ""
+        echo "Next steps:"
+        echo "  1. Install and configure PostgreSQL:"
+        echo "       apt install postgresql-16"
+        echo "  2. Create the database:"
+        echo "       sudo -u postgres createdb -O patch_manager patch_manager"
+        echo "  3. Edit /etc/patch-manager/config.toml with your database URL"
+        echo "  4. Enable and start services:"
+        echo "       systemctl enable --now patch-manager.target"
+        echo "  5. Access the web UI at https://localhost"
+        echo "     Default admin credentials are set via the seed migration."
+        echo ""
+        echo "IMPORTANT: Change the default admin password immediately after first login!"
+        echo ""
+        echo "If this is an upgrade, services have been restarted automatically."
+        echo "Apply any new database migrations:"
+        echo "  sudo -u patch_manager psql -d patch_manager -f /usr/share/patch-manager/migrations/<NNN_migration>.sql"
+        echo ""
        ;;

    abort-upgrade|abort-remove|abort-deconfigure)
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -1,58 +0,0 @@
-# =============================================================================
-# Linux Patch Manager — Docker Compose Deployment
-# =============================================================================
-# Usage:
-#   cp .env.example .env   # Edit DB_PASSWORD
-#   docker compose up -d
-# =============================================================================
-
-services:
-  db:
-    image: postgres:16
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: patch_manager
-      POSTGRES_PASSWORD: ${DB_PASSWORD}
-      POSTGRES_DB: patch_manager
-    volumes:
-      - pgdata:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U patch_manager -d patch_manager"]
-      interval: 5s
-      timeout: 5s
-      retries: 10
-      start_period: 10s
-    networks:
-      - patch-manager-net
-
-  app:
-    image: ghcr.io/draco-lunaris/linux-patch-manager:${TAG:-latest}
-    restart: unless-stopped
-    depends_on:
-      db:
-        condition: service_healthy
-    ports:
-      - "443:443"
-    environment:
-      DATABASE_URL: postgres://patch_manager:${DB_PASSWORD}@db:5432/patch_manager
-      PATCH_MANAGER_CONFIG: /etc/patch-manager/config.toml
-    volumes:
-      - pm-config:/etc/patch-manager
-      - pm-logs:/var/log/patch-manager
-      - pm-data:/opt/patch-manager
-    networks:
-      - patch-manager-net
-
-volumes:
-  pgdata:
-    driver: local
-  pm-config:
-    driver: local
-  pm-logs:
-    driver: local
-  pm-data:
-    driver: local
-
-networks:
-  patch-manager-net:
-    driver: bridge
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@ -1,232 +0,0 @@
-#!/bin/bash
-set -e
-
-# =============================================================================
-# Linux Patch Manager — Docker Entrypoint
-# =============================================================================
-# Handles first-run: wait for DB, run migrations, generate admin password,
-# start pm-web and pm-worker services.
-# =============================================================================
-
-MIGRATION_DIR="/usr/share/patch-manager/migrations"
-CONFIG_DIR="/etc/patch-manager"
-ADMIN_PASSWORD_FILE="/etc/patch-manager/admin-password.txt"
-
-# ---------------------------------------------------------------------------
-# Parse DATABASE_URL into PG* env vars for psql compatibility
-# ---------------------------------------------------------------------------
-parse_database_url() {
-    # DATABASE_URL format: postgres://user:password@host:port/dbname
-    local url="${DATABASE_URL}"
-
-    # Extract components
-    DB_PASS=$(echo "$url" | sed -n 's|postgres://[^:]*:\([^@]*\)@.*|\1|p')
-    DB_HOST=$(echo "$url" | sed -n 's|.*@\([^:/]*\).*|\1|p')
-    DB_PORT=$(echo "$url" | sed -n 's|.*:\([0-9]*\)/.*|\1|p')
-    DB_USER=$(echo "$url" | sed -n 's|postgres://\([^:]*\):.*|\1|p')
-    DB_NAME=$(echo "$url" | sed -n 's|.*/\([^?]*\).*|\1|p')
-
-    # Default port
-    DB_PORT="${DB_PORT:-5432}"
-
-    export PGHOST="${DB_HOST}"
-    export PGPORT="${DB_PORT}"
-    export PGUSER="${DB_USER}"
-    export PGPASSWORD="${DB_PASS}"
-    export PGDATABASE="${DB_NAME}"
-}
-
-# ---------------------------------------------------------------------------
-# Wait for PostgreSQL to be ready
-# ---------------------------------------------------------------------------
-wait_for_db() {
-    echo "[entrypoint] Waiting for PostgreSQL at ${PGHOST}:${DB_PORT}..."
-    local retries=60
-    local delay=2
-    local i
-    for ((i = 1; i <= retries; i++)); do
-        if pg_isready -q -h "${PGHOST}" -p "${DB_PORT}" -U "${DB_USER}" 2>/dev/null; then
-            echo "[entrypoint] PostgreSQL is ready."
-            return 0
-        fi
-        echo "[entrypoint] PostgreSQL not ready (attempt ${i}/${retries}), waiting ${delay}s..."
-        sleep "${delay}"
-    done
-    echo "[entrypoint] ERROR: PostgreSQL did not become ready after $((retries * delay)) seconds." >&2
-    return 1
-}
-
-# ---------------------------------------------------------------------------
-# Run database migrations (idempotent)
-# ---------------------------------------------------------------------------
-run_migrations() {
-    echo "[entrypoint] Applying database migrations..."
-
-    # Ensure pgcrypto extension
-    psql -v ON_ERROR_STOP=1 -c "CREATE EXTENSION IF NOT EXISTS pgcrypto;" 2>/dev/null || true
-
-    # Create migration tracking table
-    psql -v ON_ERROR_STOP=1 <<'EOSQL'
-CREATE TABLE IF NOT EXISTS _migrations (
-    id          SERIAL PRIMARY KEY,
-    filename    TEXT    NOT NULL UNIQUE,
-    applied_at  TIMESTAMPTZ NOT NULL DEFAULT now()
-);
-EOSQL
-
-    # Handle upgrade from pre-migration-tracking versions
-    local migration_count
-    migration_count=$(psql -t -A -c "SELECT COUNT(*) FROM _migrations;" 2>/dev/null || echo "0")
-    migration_count="${migration_count// /}"
-
-    local tables_exist
-    tables_exist=$(psql -t -A -c "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='public' AND table_name='users';" 2>/dev/null || echo "0")
-    tables_exist="${tables_exist// /}"
-
-    if [[ "${migration_count}" == "0" && "${tables_exist}" -gt 0 ]]; then
-        echo "[entrypoint] Existing database detected — marking all shipped migrations as already applied."
-        for sql_file in $(ls "${MIGRATION_DIR}"/*.sql 2>/dev/null | sort); do
-            local fname
-            fname=$(basename "${sql_file}")
-            psql -v ON_ERROR_STOP=1 -c "INSERT INTO _migrations (filename) VALUES ('${fname}') ON CONFLICT (filename) DO NOTHING;" 2>/dev/null || true
-        done
-    fi
-
-    # Apply each migration in sorted order
-    local applied=0
-    local skipped=0
-    for sql_file in $(ls "${MIGRATION_DIR}"/*.sql 2>/dev/null | sort); do
-        local fname
-        fname=$(basename "${sql_file}")
-
-        local already_applied
-        already_applied=$(psql -t -A -c "SELECT COUNT(*) FROM _migrations WHERE filename='${fname}';" 2>/dev/null || echo "0")
-        already_applied="${already_applied// /}"
-
-        if [[ "${already_applied}" -gt 0 ]]; then
-            skipped=$((skipped + 1))
-            continue
-        fi
-
-        echo "[entrypoint]   Applying migration: ${fname}"
-        if psql -v ON_ERROR_STOP=1 -f "${sql_file}"; then
-            psql -v ON_ERROR_STOP=1 -c "INSERT INTO _migrations (filename) VALUES ('${fname}');" 2>/dev/null || true
-            applied=$((applied + 1))
-        else
-            echo "[entrypoint] ERROR: Failed to apply migration: ${fname}" >&2
-            return 1
-        fi
-    done
-
-    if [[ "${applied}" -gt 0 ]]; then
-        echo "[entrypoint] Applied ${applied} new migration(s), skipped ${skipped}."
-    else
-        echo "[entrypoint] All migrations up to date (${skipped} already applied)."
-    fi
-}
-
-# ---------------------------------------------------------------------------
-# Generate admin password on first run
-# ---------------------------------------------------------------------------
-generate_admin_password() {
-    echo "[entrypoint] Checking admin password status..."
-
-    # Generate a random 24-character password
-    local admin_password
-    admin_password=$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9!@#%^&*' | head -c 24)
-
-    # Hash with argon2 (PHC format)
-    local password_hash
-    password_hash=$(echo -n "${admin_password}" | argon2 salt -id -t 3 -m 65536 -p 1 -l 32 -e)
-
-    # Update admin user — only if placeholder hash is still present
-    # The placeholder starts with: $argon2id$v=19$m=65536,t=3,p=1$AAAAAAAAAAAAAAAA
-    # Using single-quoted variable to preserve $ signs in the SQL LIKE pattern
-    local placeholder_pattern
-    placeholder_pattern='$argon2id$v=19$m=65536,t=3,p=1$AAAAAAAAAAAAAAAA%'
-
-    local updated
-    updated=$(psql -t -A -c \
-        "UPDATE users SET password_hash = '${password_hash}', force_password_reset = TRUE \
-         WHERE username = 'admin' AND password_hash LIKE '${placeholder_pattern}' \
-         RETURNING id;" 2>/dev/null || echo "")
-
-    if [[ -n "${updated}" ]]; then
-        echo "${admin_password}" > "${ADMIN_PASSWORD_FILE}"
-        chmod 600 "${ADMIN_PASSWORD_FILE}"
-        chown root:root "${ADMIN_PASSWORD_FILE}"
-
-        echo ""
-        echo "============================================="
-        echo "  Linux Patch Manager — Admin Credentials"
-        echo "============================================="
-        echo "  Username: admin"
-        echo "  Password: ${admin_password}"
-        echo ""
-        echo "  IMPORTANT: Save this password! It will not be shown again."
-        echo "  Password also saved to: ${ADMIN_PASSWORD_FILE}"
-        echo "============================================="
-        echo ""
-    else
-        echo "[entrypoint] Admin password already set (not a fresh install)."
-    fi
-}
-
-# ---------------------------------------------------------------------------
-# Generate JWT keys if not present
-# ---------------------------------------------------------------------------
-generate_jwt_keys() {
-    if [[ ! -f "${CONFIG_DIR}/jwt/signing.pem" ]]; then
-        echo "[entrypoint] Generating Ed25519 JWT signing key..."
-        openssl genpkey -algorithm ed25519 -out "${CONFIG_DIR}/jwt/signing.pem" 2>/dev/null
-        openssl pkey -in "${CONFIG_DIR}/jwt/signing.pem" -pubout -out "${CONFIG_DIR}/jwt/verify.pem" 2>/dev/null
-        chown patch-manager:patch-manager "${CONFIG_DIR}/jwt/signing.pem" "${CONFIG_DIR}/jwt/verify.pem"
-        chmod 600 "${CONFIG_DIR}/jwt/signing.pem"
-        chmod 644 "${CONFIG_DIR}/jwt/verify.pem"
-        echo "[entrypoint] JWT keys generated."
-    else
-        echo "[entrypoint] JWT signing key already exists."
-    fi
-}
-
-# ---------------------------------------------------------------------------
-# Write config.toml if not present
-# ---------------------------------------------------------------------------
-write_config() {
-    local config_file="${CONFIG_DIR}/config.toml"
-
-    if [[ -f "${config_file}" ]]; then
-        echo "[entrypoint] Config file already exists, not overwriting."
-        return 0
-    fi
-
-    echo "[entrypoint] Writing configuration file..."
-    cp /usr/share/patch-manager/config.example.toml "${config_file}"
-    sed -i "s|postgres://patch_manager:CHANGEME@localhost/patch_manager|${DATABASE_URL}|" "${config_file}"
-    chown patch-manager:patch-manager "${config_file}"
-    chmod 640 "${config_file}"
-    echo "[entrypoint] Configuration written."
-}
-
-# ---------------------------------------------------------------------------
-# Main
-# ---------------------------------------------------------------------------
-echo "[entrypoint] Linux Patch Manager Docker entrypoint starting..."
-
-parse_database_url
-wait_for_db
-run_migrations
-generate_admin_password
-generate_jwt_keys
-write_config
-
-echo "[entrypoint] Starting pm-web and pm-worker..."
-
-# Start pm-worker in background
-pm-worker &
-WORKER_PID=$!
-
-# Start pm-web in foreground (main process)
-export PATCH_MANAGER_CONFIG="${CONFIG_DIR}/config.toml"
-
-exec pm-web
--- a/docs/security-review.md
+++ b/docs/security-review.md
@ -160,30 +160,9 @@ verifying that all mandated security controls are implemented and operational.

 ## 6. Findings & Recommendations

-### 🔴 CRITICAL: Committed Private Key Material (Issue #12) — RESOLVED
+### No Critical or High Findings

-**Description:**
-Private key file `client.key` and public certificates (`client.crt`, `ca.crt`) were committed
-to version control in `crates/pm-agent-client/certs/`. Committed private keys are a critical
-security risk: anyone with repository access can impersonate agents or decrypt captured TLS traffic.
-
-**Status:** ✅ RESOLVED
-
-**Remediation Applied:**
-1. Removed all cert files from git tracking (`git rm --cached`)
-2. Added `*.key`, `*.key.pem` and `crates/pm-agent-client/certs/` to `.gitignore`
-3. Updated `pm-agent-client` doc examples to use `std::fs::read()` instead of `include_bytes!`
-4. Added `gitleaks` secret scanning to CI pipeline
-5. Added README to `crates/pm-agent-client/certs/` explaining runtime cert generation
-6. Git history will be purged with `git filter-repo` after PR merge
-
-**Key Rotation:**
-These keys were dev/test only. No production key rotation is needed. All committed keys
-should be considered compromised and must not be used in production.
-
-### No Other Critical or High Findings
-
-All other security controls are implemented as specified in the system requirements.
+All security controls are implemented as specified in the system requirements.

 ### Recommendations (Low Priority)

@ -213,4 +192,3 @@ All other security controls are implemented as specified in the system requireme
 - [x] Backup encryption supported (GPG)
 - [x] Azure SSO with PKCE flow
 - [x] No plaintext credential storage
- [x] Committed private key material removed from repository (Issue #12)
--- a/frontend/package.json
+++ b/frontend/package.json
@ -1,7 +1,7 @@
 {
  "name": "patch-manager-ui",
  "private": true,
-  "version": "1.1.10",
+  "version": "0.1.7",
  "type": "module",
  "scripts": {
    "dev": "vite",
--- a/migrations/001_initial_schema.sql
+++ b/migrations/001_initial_schema.sql
@ -12,63 +12,31 @@ CREATE EXTENSION IF NOT EXISTS "pg_trgm";    -- fuzzy text search on host names
 -- Enumerations
 -- ============================================================

-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'user_role') THEN
-        CREATE TYPE user_role AS ENUM ('admin', 'operator');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'auth_provider') THEN
-        CREATE TYPE auth_provider AS ENUM ('local', 'azure_sso');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'host_health_status') THEN
-        CREATE TYPE host_health_status AS ENUM ('pending', 'healthy', 'degraded', 'unreachable');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'job_status') THEN
-        CREATE TYPE job_status AS ENUM ('queued', 'pending', 'running', 'succeeded', 'failed', 'cancelled');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'job_kind') THEN
-        CREATE TYPE job_kind AS ENUM ('patch_apply', 'patch_remove', 'reboot', 'rollback');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'window_recurrence') THEN
-        CREATE TYPE window_recurrence AS ENUM ('once', 'daily', 'weekly', 'monthly');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'cert_status') THEN
-        CREATE TYPE cert_status AS ENUM ('active', 'revoked', 'expired');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'audit_action') THEN
-        CREATE TYPE audit_action AS ENUM (
-            'user_login', 'user_logout', 'user_login_failed',
-            'user_created', 'user_deleted', 'user_updated',
-            'host_registered', 'host_removed',
-            'group_created', 'group_deleted',
-            'group_membership_changed',
-            'patch_job_created', 'patch_job_cancelled', 'patch_job_rollback',
-            'maintenance_window_created', 'maintenance_window_updated', 'maintenance_window_deleted',
-            'certificate_issued', 'certificate_renewed', 'certificate_revoked', 'certificate_downloaded',
-            'config_changed',
-            'discovery_scan_started'
-        );
-    END IF;
-END $$;
+CREATE TYPE user_role AS ENUM ('admin', 'operator');
+CREATE TYPE auth_provider AS ENUM ('local', 'azure_sso');
+CREATE TYPE host_health_status AS ENUM ('pending', 'healthy', 'degraded', 'unreachable');
+CREATE TYPE job_status AS ENUM ('queued', 'pending', 'running', 'succeeded', 'failed', 'cancelled');
+CREATE TYPE job_kind AS ENUM ('patch_apply', 'patch_remove', 'reboot', 'rollback');
+CREATE TYPE window_recurrence AS ENUM ('once', 'daily', 'weekly', 'monthly');
+CREATE TYPE cert_status AS ENUM ('active', 'revoked', 'expired');
+CREATE TYPE audit_action AS ENUM (
+    'user_login', 'user_logout', 'user_login_failed',
+    'user_created', 'user_deleted', 'user_updated',
+    'host_registered', 'host_removed',
+    'group_created', 'group_deleted',
+    'group_membership_changed',
+    'patch_job_created', 'patch_job_cancelled', 'patch_job_rollback',
+    'maintenance_window_created', 'maintenance_window_updated', 'maintenance_window_deleted',
+    'certificate_issued', 'certificate_renewed', 'certificate_revoked', 'certificate_downloaded',
+    'config_changed',
+    'discovery_scan_started'
+);

 -- ============================================================
 -- Groups (defined before users/hosts for FK ordering)
 -- ============================================================

-CREATE TABLE IF NOT EXISTS groups (
+CREATE TABLE groups (
    id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    name        TEXT NOT NULL UNIQUE,
    description TEXT NOT NULL DEFAULT '',
@ -76,13 +44,13 @@ CREATE TABLE IF NOT EXISTS groups (
    updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );

-CREATE INDEX IF NOT EXISTS idx_groups_name ON groups (name);
+CREATE INDEX idx_groups_name ON groups (name);

 -- ============================================================
 -- Users
 -- ============================================================

-CREATE TABLE IF NOT EXISTS users (
+CREATE TABLE users (
    id                  UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    username            TEXT NOT NULL UNIQUE,
    display_name        TEXT NOT NULL DEFAULT '',
@ -105,28 +73,28 @@ CREATE TABLE IF NOT EXISTS users (
    updated_at          TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );

-CREATE INDEX IF NOT EXISTS idx_users_email ON users (email);
-CREATE INDEX IF NOT EXISTS idx_users_azure_oid ON users (azure_oid) WHERE azure_oid IS NOT NULL;
-CREATE INDEX IF NOT EXISTS idx_users_role ON users (role);
+CREATE INDEX idx_users_email ON users (email);
+CREATE INDEX idx_users_azure_oid ON users (azure_oid) WHERE azure_oid IS NOT NULL;
+CREATE INDEX idx_users_role ON users (role);

 -- ============================================================
 -- User <-> Group membership
 -- ============================================================

-CREATE TABLE IF NOT EXISTS user_groups (
+CREATE TABLE user_groups (
    user_id    UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    group_id   UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
    assigned_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    PRIMARY KEY (user_id, group_id)
 );

-CREATE INDEX IF NOT EXISTS idx_user_groups_group ON user_groups (group_id);
+CREATE INDEX idx_user_groups_group ON user_groups (group_id);

 -- ============================================================
 -- Refresh Tokens
 -- ============================================================

-CREATE TABLE IF NOT EXISTS refresh_tokens (
+CREATE TABLE refresh_tokens (
    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    user_id         UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
    -- Stored as Argon2id hash of the opaque token bytes
@ -141,14 +109,14 @@ CREATE TABLE IF NOT EXISTS refresh_tokens (
    ip_address      INET
 );

-CREATE INDEX IF NOT EXISTS idx_refresh_tokens_user ON refresh_tokens (user_id);
-CREATE INDEX IF NOT EXISTS idx_refresh_tokens_expires ON refresh_tokens (expires_at) WHERE revoked = FALSE;
+CREATE INDEX idx_refresh_tokens_user ON refresh_tokens (user_id);
+CREATE INDEX idx_refresh_tokens_expires ON refresh_tokens (expires_at) WHERE revoked = FALSE;

 -- ============================================================
 -- Hosts
 -- ============================================================

-CREATE TABLE IF NOT EXISTS hosts (
+CREATE TABLE hosts (
    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    fqdn            TEXT NOT NULL,
    ip_address      INET NOT NULL,
@ -168,28 +136,28 @@ CREATE TABLE IF NOT EXISTS hosts (
    CONSTRAINT hosts_fqdn_ip_unique UNIQUE (fqdn, ip_address)
 );

-CREATE INDEX IF NOT EXISTS idx_hosts_health_status ON hosts (health_status);
-CREATE INDEX IF NOT EXISTS idx_hosts_fqdn ON hosts USING gin (fqdn gin_trgm_ops);
-CREATE INDEX IF NOT EXISTS idx_hosts_ip ON hosts (ip_address);
+CREATE INDEX idx_hosts_health_status ON hosts (health_status);
+CREATE INDEX idx_hosts_fqdn ON hosts USING gin (fqdn gin_trgm_ops);
+CREATE INDEX idx_hosts_ip ON hosts (ip_address);

 -- ============================================================
 -- Host <-> Group membership
 -- ============================================================

-CREATE TABLE IF NOT EXISTS host_groups (
+CREATE TABLE host_groups (
    host_id     UUID NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
    group_id    UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
    assigned_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    PRIMARY KEY (host_id, group_id)
 );

-CREATE INDEX IF NOT EXISTS idx_host_groups_group ON host_groups (group_id);
+CREATE INDEX idx_host_groups_group ON host_groups (group_id);

 -- ============================================================
 -- Host Health Data (cached results from 5-min polls)
 -- ============================================================

-CREATE TABLE IF NOT EXISTS host_health_data (
+CREATE TABLE host_health_data (
    id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    host_id     UUID NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
    polled_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
@ -198,14 +166,14 @@ CREATE TABLE IF NOT EXISTS host_health_data (
    payload     JSONB NOT NULL DEFAULT '{}'
 );

-CREATE INDEX IF NOT EXISTS idx_host_health_host ON host_health_data (host_id, polled_at DESC);
+CREATE INDEX idx_host_health_host ON host_health_data (host_id, polled_at DESC);
 -- Retained for 30 days (pruned by worker)

 -- ============================================================
 -- Host Patch Data (cached results from 30-min polls)
 -- ============================================================

-CREATE TABLE IF NOT EXISTS host_patch_data (
+CREATE TABLE host_patch_data (
    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    host_id         UUID NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
    polled_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
@ -216,14 +184,14 @@ CREATE TABLE IF NOT EXISTS host_patch_data (
    cve_count       INTEGER NOT NULL DEFAULT 0
 );

-CREATE INDEX IF NOT EXISTS idx_host_patch_host ON host_patch_data (host_id, polled_at DESC);
+CREATE INDEX idx_host_patch_host ON host_patch_data (host_id, polled_at DESC);
 -- Retained for 30 days (pruned by worker)

 -- ============================================================
 -- Maintenance Windows
 -- ============================================================

-CREATE TABLE IF NOT EXISTS maintenance_windows (
+CREATE TABLE maintenance_windows (
    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    host_id         UUID NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
    label           TEXT NOT NULL DEFAULT '',
@ -239,14 +207,14 @@ CREATE TABLE IF NOT EXISTS maintenance_windows (
    updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );

-CREATE INDEX IF NOT EXISTS idx_mw_host ON maintenance_windows (host_id);
-CREATE INDEX IF NOT EXISTS idx_mw_start ON maintenance_windows (start_at) WHERE enabled = TRUE;
+CREATE INDEX idx_mw_host ON maintenance_windows (host_id);
+CREATE INDEX idx_mw_start ON maintenance_windows (start_at) WHERE enabled = TRUE;

 -- ============================================================
 -- Patch Jobs
 -- ============================================================

-CREATE TABLE IF NOT EXISTS patch_jobs (
+CREATE TABLE patch_jobs (
    id                  UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    kind                job_kind NOT NULL DEFAULT 'patch_apply',
    status              job_status NOT NULL DEFAULT 'queued',
@ -265,15 +233,15 @@ CREATE TABLE IF NOT EXISTS patch_jobs (
    completed_at        TIMESTAMPTZ
 );

-CREATE INDEX IF NOT EXISTS idx_patch_jobs_status ON patch_jobs (status);
-CREATE INDEX IF NOT EXISTS idx_patch_jobs_created ON patch_jobs (created_at DESC);
-CREATE INDEX IF NOT EXISTS idx_patch_jobs_user ON patch_jobs (created_by_user_id);
+CREATE INDEX idx_patch_jobs_status ON patch_jobs (status);
+CREATE INDEX idx_patch_jobs_created ON patch_jobs (created_at DESC);
+CREATE INDEX idx_patch_jobs_user ON patch_jobs (created_by_user_id);

 -- ============================================================
 -- Patch Job Hosts (per-host status within a batch job)
 -- ============================================================

-CREATE TABLE IF NOT EXISTS patch_job_hosts (
+CREATE TABLE patch_job_hosts (
    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    job_id          UUID NOT NULL REFERENCES patch_jobs(id) ON DELETE CASCADE,
    host_id         UUID NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
@ -289,15 +257,15 @@ CREATE TABLE IF NOT EXISTS patch_job_hosts (
    UNIQUE (job_id, host_id)
 );

-CREATE INDEX IF NOT EXISTS idx_pjh_job ON patch_job_hosts (job_id);
-CREATE INDEX IF NOT EXISTS idx_pjh_host ON patch_job_hosts (host_id);
-CREATE INDEX IF NOT EXISTS idx_pjh_status ON patch_job_hosts (status);
+CREATE INDEX idx_pjh_job ON patch_job_hosts (job_id);
+CREATE INDEX idx_pjh_host ON patch_job_hosts (host_id);
+CREATE INDEX idx_pjh_status ON patch_job_hosts (status);

 -- ============================================================
 -- Certificates
 -- ============================================================

-CREATE TABLE IF NOT EXISTS certificates (
+CREATE TABLE certificates (
    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    -- NULL = root CA cert
    host_id         UUID REFERENCES hosts(id) ON DELETE CASCADE,
@ -311,15 +279,15 @@ CREATE TABLE IF NOT EXISTS certificates (
    cert_pem        TEXT NOT NULL
 );

-CREATE INDEX IF NOT EXISTS idx_certs_host ON certificates (host_id);
-CREATE INDEX IF NOT EXISTS idx_certs_status ON certificates (status);
-CREATE INDEX IF NOT EXISTS idx_certs_expires ON certificates (expires_at);
+CREATE INDEX idx_certs_host ON certificates (host_id);
+CREATE INDEX idx_certs_status ON certificates (status);
+CREATE INDEX idx_certs_expires ON certificates (expires_at);

 -- ============================================================
 -- Audit Log (tamper-evident, hash-chained)
 -- ============================================================

-CREATE TABLE IF NOT EXISTS audit_log (
+CREATE TABLE audit_log (
    id              BIGSERIAL PRIMARY KEY,
    action          audit_action NOT NULL,
    actor_user_id   UUID REFERENCES users(id) ON DELETE SET NULL,
@ -334,17 +302,17 @@ CREATE TABLE IF NOT EXISTS audit_log (
    row_hash        TEXT NOT NULL DEFAULT ''
 );

-CREATE INDEX IF NOT EXISTS idx_audit_created ON audit_log (created_at DESC);
-CREATE INDEX IF NOT EXISTS idx_audit_actor ON audit_log (actor_user_id);
-CREATE INDEX IF NOT EXISTS idx_audit_action ON audit_log (action);
-CREATE INDEX IF NOT EXISTS idx_audit_target ON audit_log (target_type, target_id);
+CREATE INDEX idx_audit_created ON audit_log (created_at DESC);
+CREATE INDEX idx_audit_actor ON audit_log (actor_user_id);
+CREATE INDEX idx_audit_action ON audit_log (action);
+CREATE INDEX idx_audit_target ON audit_log (target_type, target_id);
 -- Retained for 6 months (pruned by worker)

 -- ============================================================
 -- Azure SSO Configuration
 -- ============================================================

-CREATE TABLE IF NOT EXISTS azure_sso_config (
+CREATE TABLE azure_sso_config (
    id              INTEGER PRIMARY KEY DEFAULT 1,  -- singleton row
    enabled         BOOLEAN NOT NULL DEFAULT FALSE,
    tenant_id       TEXT NOT NULL DEFAULT '',
@ -361,7 +329,7 @@ CREATE TABLE IF NOT EXISTS azure_sso_config (
 -- System Configuration (key/value runtime settings)
 -- ============================================================

-CREATE TABLE IF NOT EXISTS system_config (
+CREATE TABLE system_config (
    key         TEXT PRIMARY KEY,
    value       TEXT NOT NULL,
    description TEXT NOT NULL DEFAULT '',
@ -383,14 +351,13 @@ INSERT INTO system_config (key, value, description) VALUES
    ('smtp_from',                  '',      'From address for notifications'),
    ('smtp_tls_mode',              'starttls', 'SMTP TLS mode: none, starttls, tls'),
    ('web_tls_strategy',           'internal_ca', 'Web UI TLS cert strategy: internal_ca or operator_supplied'),
-    ('ip_whitelist',               '[]',    'JSON array of allowed CIDR/IP strings; empty = allow all')
-ON CONFLICT (key) DO NOTHING;
+    ('ip_whitelist',               '[]',    'JSON array of allowed CIDR/IP strings; empty = allow all');

 -- ============================================================
 -- Worker Heartbeat
 -- ============================================================

-CREATE TABLE IF NOT EXISTS worker_heartbeat (
+CREATE TABLE worker_heartbeat (
    id              INTEGER PRIMARY KEY DEFAULT 1,  -- singleton row
    last_seen       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    worker_version  TEXT NOT NULL DEFAULT '',
@ -401,7 +368,7 @@ CREATE TABLE IF NOT EXISTS worker_heartbeat (
 -- Discovery Results (transient; cleared before each scan)
 -- ============================================================

-CREATE TABLE IF NOT EXISTS discovery_results (
+CREATE TABLE discovery_results (
    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    scan_id         UUID NOT NULL,
    ip_address      INET NOT NULL,
@ -414,5 +381,5 @@ CREATE TABLE IF NOT EXISTS discovery_results (
    registered      BOOLEAN NOT NULL DEFAULT FALSE
 );

-CREATE INDEX IF NOT EXISTS idx_discovery_scan ON discovery_results (scan_id);
-CREATE INDEX IF NOT EXISTS idx_discovery_ip ON discovery_results (ip_address);
+CREATE INDEX idx_discovery_scan ON discovery_results (scan_id);
+CREATE INDEX idx_discovery_ip ON discovery_results (ip_address);
--- a/migrations/003_jobs_scheduling.sql
+++ b/migrations/003_jobs_scheduling.sql
@ -8,11 +8,11 @@

 -- When the retry engine should next attempt this host; NULL = not scheduled
 ALTER TABLE patch_job_hosts
-    ADD COLUMN IF NOT EXISTS retry_next_at TIMESTAMPTZ;
+    ADD COLUMN retry_next_at TIMESTAMPTZ;

 -- Last failure reason captured by the worker for display in the UI
 ALTER TABLE patch_job_hosts
-    ADD COLUMN IF NOT EXISTS last_error TEXT;
+    ADD COLUMN last_error TEXT;

 -- ============================================================
 -- pg_notify trigger: fires when an immediate job is inserted
@ -30,21 +30,15 @@ BEGIN
 END;
 $$;

-DO $$ BEGIN
-    IF NOT EXISTS (
-        SELECT 1 FROM pg_trigger WHERE tgname = 'trg_job_enqueued'
-    ) THEN
-        CREATE TRIGGER trg_job_enqueued
-            AFTER INSERT ON patch_jobs
-            FOR EACH ROW
-            EXECUTE FUNCTION notify_job_enqueued();
-    END IF;
-END $$;
+CREATE TRIGGER trg_job_enqueued
+    AFTER INSERT ON patch_jobs
+    FOR EACH ROW
+    EXECUTE FUNCTION notify_job_enqueued();

 -- ============================================================
 -- Index: efficiently find hosts due for retry
 -- ============================================================

-CREATE INDEX IF NOT EXISTS idx_pjh_retry
+CREATE INDEX idx_pjh_retry
    ON patch_job_hosts (retry_next_at)
    WHERE retry_next_at IS NOT NULL;
--- a/migrations/007_health_checks.sql
+++ b/migrations/007_health_checks.sql
@ -1,7 +1,7 @@
 -- Migration 007: Health check configuration and results

 -- Health checks configured per host (1-5 per host)
-CREATE TABLE IF NOT EXISTS host_health_checks (
+CREATE TABLE host_health_checks (
    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    host_id         UUID NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
    name            VARCHAR(100) NOT NULL,
@ -27,10 +27,10 @@ CREATE TABLE IF NOT EXISTS host_health_checks (
    )
 );

-CREATE INDEX IF NOT EXISTS idx_health_checks_host ON host_health_checks (host_id);
+CREATE INDEX idx_health_checks_host ON host_health_checks (host_id);

 -- Health check poll results (4-day retention, pruned by worker)
-CREATE TABLE IF NOT EXISTS host_health_check_results (
+CREATE TABLE host_health_check_results (
    id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    check_id    UUID NOT NULL REFERENCES host_health_checks(id) ON DELETE CASCADE,
    healthy     BOOLEAN NOT NULL,
@ -39,4 +39,4 @@ CREATE TABLE IF NOT EXISTS host_health_check_results (
    checked_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );

-CREATE INDEX IF NOT EXISTS idx_health_results_check ON host_health_check_results (check_id, checked_at DESC);
+CREATE INDEX idx_health_results_check ON host_health_check_results (check_id, checked_at DESC);
--- a/migrations/011_health_check_target_host.sql
+++ b/migrations/011_health_check_target_host.sql
@ -4,7 +4,7 @@
 -- FK with ON DELETE SET NULL: if target host deleted, revert to default.

 ALTER TABLE host_health_checks
-  ADD COLUMN IF NOT EXISTS target_host_id UUID REFERENCES hosts(id) ON DELETE SET NULL;
+  ADD COLUMN target_host_id UUID REFERENCES hosts(id) ON DELETE SET NULL;

-CREATE INDEX IF NOT EXISTS idx_health_checks_target_host ON host_health_checks (target_host_id)
+CREATE INDEX idx_health_checks_target_host ON host_health_checks (target_host_id)
  WHERE target_host_id IS NOT NULL;
--- a/migrations/016_enrollment_requests.sql
+++ b/migrations/016_enrollment_requests.sql
@ -1,7 +1,7 @@
 -- Migration: 016_enrollment_requests
 -- Description: Create enrollment_requests table for host self-enrollment

-CREATE TABLE IF NOT EXISTS enrollment_requests (
+CREATE TABLE enrollment_requests (
    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    machine_id      TEXT NOT NULL UNIQUE,
    fqdn            TEXT NOT NULL,
@ -12,5 +12,5 @@ CREATE TABLE IF NOT EXISTS enrollment_requests (
    expires_at      TIMESTAMPTZ NOT NULL DEFAULT NOW() + INTERVAL '24 hours'
 );

-CREATE INDEX IF NOT EXISTS idx_enrollment_requests_token ON enrollment_requests (polling_token);
-CREATE INDEX IF NOT EXISTS idx_enrollment_requests_expires ON enrollment_requests (expires_at);
+CREATE INDEX idx_enrollment_requests_token ON enrollment_requests (polling_token);
+CREATE INDEX idx_enrollment_requests_expires ON enrollment_requests (expires_at);
--- a/scripts/build-package.sh
+++ b/scripts/build-package.sh
@ -22,7 +22,7 @@ warn()  { echo -e "${YELLOW}[WARN]${NC}  $*"; }
 error() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }

 PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-VERSION="1.1.10"
+VERSION="0.1.9"
 RELEASE="1"
 PKG_NAME="linux-patch-manager"
 DEB_NAME="${PKG_NAME}_${VERSION}-${RELEASE}_amd64.deb"
--- a/scripts/bump-version.sh
+++ b/scripts/bump-version.sh
@ -30,7 +30,7 @@ mv "$TEMP_CHANGELOG" debian/changelog
 echo "[2/5] debian/changelog: Added entry for $NEW_VERSION"

 # 3. debian/control - Update Version field
-if grep -q "^Version:" debian/control 2>/dev/null || true; then
+if grep -q "^Version:" debian/control 2>/dev/null; then
    sed -i "s/^Version: .*/Version: $NEW_VERSION-1/" debian/control
    echo "[3/5] debian/control: -> $NEW_VERSION-1"
 else
@ -71,7 +71,7 @@ fi

 echo ""
 echo "Stale references check:"
-grep -r "$OLD_VERSION" --include='*.toml' --include='*.sh' --include='*.json' --include='control' . 2>/dev/null || true | grep -v 'target/' | grep -v '.git/' | grep -v 'node_modules/' | grep -v 'bump-version.sh' || echo "  No stale references found"
+grep -r "$OLD_VERSION" --include='*.toml' --include='*.sh' --include='*.json' --include='control' . 2>/dev/null | grep -v 'target/' | grep -v '.git/' | grep -v 'node_modules/' | grep -v 'bump-version.sh' || echo "  No stale references found"

 echo ""
 echo "Next steps:"
--- a/scripts/performance-test.sh
+++ b/scripts/performance-test.sh
@ -15,13 +15,6 @@

 set -euo pipefail

-# ---------------------------------------------------------------------------
-# BusyBox-compatible millisecond timing (_now_ms not available)
-# ---------------------------------------------------------------------------
-_now_ms() {
-    python3 -c "import time; print(int(time.time()*1000))"
-}
-
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
@ -79,10 +72,10 @@ api_call() {
 time_api_call() {
    local method="$1" endpoint="$2" shift; shift
    local start end elapsed
-    start=$(_now_ms)
+    start=$(date +%s%N)
    api_call "${method}" "${endpoint}" -o /dev/null "$@" 2>/dev/null || true
-    end=$(_now_ms)
-    elapsed=$(( end - start ))  # milliseconds
+    end=$(date +%s%N)
+    elapsed=$(( (end - start) / 1000000 ))  # milliseconds
    echo "$(echo "scale=3; ${elapsed}/1000" | bc)"
 }

@ -104,10 +97,10 @@ test_dashboard_load() {

    # Also measure frontend static asset load
    info "Measuring frontend index.html load time..."
-    start=$(_now_ms)
+    start=$(date +%s%N)
    curl -sk -o /dev/null "${BASE_URL}/" 2>/dev/null || true
-    end=$(_now_ms)
-    elapsed=$(( end - start ))
+    end=$(date +%s%N)
+    elapsed=$(( (end - start) / 1000000 ))
    FRONTEND_TIME=$(echo "scale=3; ${elapsed}/1000" | bc)
    info "Frontend load time: ${FRONTEND_TIME}s"
    pass "Frontend static load: ${FRONTEND_TIME}s"
@ -176,14 +169,14 @@ test_bulk_host_operations() {

    # 4.2 Sequential host creation (measure throughput)
    info "4.2 Sequential host creation (10 hosts)"
-    local start=$(_now_ms)
+    local start=$(date +%s%N)
    for i in $(seq 1 10); do
        api_call POST /api/v1/hosts \
            -d "{\"fqdn\": \"perf-test-${i}.example.com\", \"ip_address\": \"10.99.0.${i}\"}" \
            -o /dev/null 2>/dev/null || true
    done
-    local end=$(_now_ms)
-    local total_ms=$(( end - start ))
+    local end=$(date +%s%N)
+    local total_ms=$(( (end - start) / 1000000 ))
    local total_s=$(echo "scale=3; ${total_ms}/1000" | bc)
    local per_host=$(echo "scale=3; ${total_s}/10" | bc)
    info "10 hosts created in ${total_s}s (${per_host}s per host)"
@ -206,11 +199,11 @@ test_cidr_scan() {
    # Note: This test initiates a real CIDR scan which may not complete quickly
    # without reachable hosts. We measure the API response time for initiating.
    info "5.1 CIDR scan initiation time"
-    local start=$(_now_ms)
+    local start=$(date +%s%N)
    SCAN_RESP=$(api_call POST /api/v1/discovery/cidr \
        -d '{"cidr": "10.0.0.0/30", "timeout": 1.5}' 2>/dev/null || true)
-    local end=$(_now_ms)
-    local elapsed_ms=$(( end - start ))
+    local end=$(date +%s%N)
+    local elapsed_ms=$(( (end - start) / 1000000 ))
    local elapsed_s=$(echo "scale=3; ${elapsed_ms}/1000" | bc)

    info "CIDR scan initiation: ${elapsed_s}s"
@ -247,13 +240,13 @@ test_concurrent_load() {

    # Fire 20 concurrent requests and measure total time
    info "6.1 20 concurrent fleet status requests"
-    local start=$(_now_ms)
+    local start=$(date +%s%N)
    for i in $(seq 1 20); do
        api_call GET /api/v1/status/fleet -o /dev/null 2>/dev/null &
    done
    wait
-    local end=$(_now_ms)
-    local total_ms=$(( end - start ))
+    local end=$(date +%s%N)
+    local total_ms=$(( (end - start) / 1000000 ))
    local total_s=$(echo "scale=3; ${total_ms}/1000" | bc)
    local per_req=$(echo "scale=3; ${total_s}/20" | bc)

@ -266,7 +259,7 @@ test_concurrent_load() {

    # 6.2 Mixed endpoint concurrent load
    info "6.2 20 concurrent mixed-endpoint requests"
-    start=$(_now_ms)
+    start=$(date +%s%N)
    for i in $(seq 1 5); do
        api_call GET /api/v1/hosts -o /dev/null 2>/dev/null &
        api_call GET /api/v1/groups -o /dev/null 2>/dev/null &
@ -274,8 +267,8 @@ test_concurrent_load() {
        api_call GET /api/v1/status/fleet -o /dev/null 2>/dev/null &
    done
    wait
-    end=$(_now_ms)
-    total_ms=$(( end - start ))
+    end=$(date +%s%N)
+    total_ms=$(( (end - start) / 1000000 ))
    total_s=$(echo "scale=3; ${total_ms}/1000" | bc)
    per_req=$(echo "scale=3; ${total_s}/20" | bc)
    info "Mixed concurrent: ${total_s}s total, ${per_req}s avg"
@ -289,12 +282,12 @@ test_ws_ticket_performance() {
    echo -e "\n${CYAN}=== Test 7: WebSocket Ticket Issuance ===${NC}"

    info "7.1 Sequential ticket creation (10 tickets)"
-    local start=$(_now_ms)
+    local start=$(date +%s%N)
    for i in $(seq 1 10); do
        api_call POST /api/v1/ws/ticket -o /dev/null 2>/dev/null || true
    done
-    local end=$(_now_ms)
-    local total_ms=$(( end - start ))
+    local end=$(date +%s%N)
+    local total_ms=$(( (end - start) / 1000000 ))
    local total_s=$(echo "scale=3; ${total_ms}/1000" | bc)
    local per_ticket=$(echo "scale=3; ${total_s}/10" | bc)
    info "10 tickets in ${total_s}s (${per_ticket}s per ticket)"
Author	SHA1	Message	Date
Draco Lunaris	bc5bfdedd9	fix: separate authz gate 403 tests from DB-dependent tests	2026-06-06 10:59:23 -05:00
Draco Lunaris	53eef4eec4	test: add authz gate integration tests (closes #15 )	2026-06-06 10:05:49 -05:00