ci: update actions for Node.js 24 compatibility

Cargo.toml

@@ -12,7 +12,7 @@ members = [
 ]
 
 [workspace.package]
-version = "1.1.11"
+version = "1.1.8"
 edition = "2021"
 authors = ["Echo <echo@moon-dragon.us>"]
 license = "MIT"

config/config.example.toml

@@ -49,8 +49,7 @@ health_check_poll_interval_secs = 300
 # Maximum concurrent mTLS agent calls (Tokio Semaphore)
 max_concurrent_agent_calls = 64
 
-# Worker heartbeat write interval (seconds). Default: 300 = 5 minutes
-heartbeat_interval_secs = 300
+# Worker heartbeat write interval (seconds)
 
 # WS relay HTTP polling fallback interval (seconds). When WebSocket connection to
 # an agent fails, the relay falls back to polling the agent's HTTP API at this

crates/pm-core/src/config.rs

@@ -101,8 +101,7 @@ pub struct WorkerConfig {
     pub health_check_poll_interval_secs: u64,
     /// Maximum concurrent agent calls
     pub max_concurrent_agent_calls: usize,
-    /// Worker heartbeat interval in seconds (default: 300 = 5 min)
-    #[serde(default = "default_heartbeat_interval")]
+    /// Worker heartbeat interval in seconds
     pub heartbeat_interval_secs: u64,
     /// WS relay HTTP polling fallback interval in seconds (default: 10)
     pub ws_relay_poll_interval_secs: u64,
@@ -256,10 +255,6 @@ fn default_health_check_poll_interval() -> u64 {
     300
 }
 
-fn default_heartbeat_interval() -> u64 {
-    300
-}
-
 fn default_sso_callback_url() -> String {
     "http://localhost:5173/auth/sso/callback".to_string()
 }

debian/changelog

@@ -1,21 +1,3 @@
-linux-patch-manager (1.1.11-1) unstable; urgency=low
-
-  * Release v1.1.11
-
- -- git-echo <git-echo@moon-dragon.us>  Tue, 09 Jun 2026 15:57:10 -0500
-
-linux-patch-manager (1.1.10-1) unstable; urgency=low
-
-  * Release v1.1.10
-
- -- git-echo <git-echo@moon-dragon.us>  Tue, 09 Jun 2026 14:11:31 -0500
-
-linux-patch-manager (1.1.9-1) unstable; urgency=low
-
-  * Release v1.1.9
-
- -- git-echo <git-echo@moon-dragon.us>  Tue, 09 Jun 2026 13:05:59 -0500
-
 linux-patch-manager (1.1.8-1) unstable; urgency=low
 
   * Release v1.1.8

debian/control

@@ -1,5 +1,5 @@
 Package: linux-patch-manager
-Version: 1.1.11-1
+Version: 1.1.8-1
 Architecture: amd64
 Maintainer: Moon Dragon <echo@moon-dragon.us>
 Installed-Size: 45000

debian/postinst

@@ -34,16 +34,10 @@ psql_run() {
 }
 
 psql_run_db() {
-    # Run SQL against the patch_manager database as postgres superuser
+    # Run SQL against the patch_manager database
     sudo -u postgres psql -v ON_ERROR_STOP=1 -d "${DB_NAME}" "$@" 2>/dev/null
 }
 
-psql_run_as_pm() {
-    # Run SQL against the patch_manager database as patch_manager user
-    # Requires PGPASSWORD to be set in the calling environment
-    PGPASSWORD="${PGPASSWORD}" psql -v ON_ERROR_STOP=1 -U "${DB_USER}" -h localhost -d "${DB_NAME}" "$@" 2>/dev/null
-}
-
 # ---------------------------------------------------------------------------
 # 1. Create service user (idempotent)
 # ---------------------------------------------------------------------------
@@ -146,47 +140,23 @@ setup_database() {
         info "Database '${DB_NAME}' already exists, skipping creation."
     fi
 
-    # Grant full permissions so patch_manager owns and manages all objects
-    psql_run_db -c "GRANT ALL PRIVILEGES ON SCHEMA public TO ${DB_USER};" 2>/dev/null || true
+    # Grant permissions (idempotent)
+    psql_run_db -c "GRANT USAGE ON SCHEMA public TO ${DB_USER};" 2>/dev/null || true
+    psql_run_db -c "GRANT CREATE ON SCHEMA public TO ${DB_USER};" 2>/dev/null || true
     psql_run_db -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};" 2>/dev/null || true
-    # If any future migration runs as postgres, ensure objects are still accessible by patch_manager
-    psql_run_db -c "ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO ${DB_USER};" 2>/dev/null || true
-    psql_run_db -c "ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO ${DB_USER};" 2>/dev/null || true
-    psql_run_db -c "ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON FUNCTIONS TO ${DB_USER};" 2>/dev/null || true
 }
 
 # ---------------------------------------------------------------------------
 # 5. Apply database migrations (idempotent)
-# Migrations run as patch_manager so all created objects are owned by
-# patch_manager — this avoids the ownership conflicts that occur when
-# postgres-owned objects need ALTER TABLE by a non-superuser.
 # ---------------------------------------------------------------------------
 apply_migrations() {
     info "Applying database migrations..."
 
-    # Get the DB password for patch_manager authentication
-    local db_password=""
-    if [[ -f /tmp/.pm-db-password-new ]]; then
-        db_password=$(cat /tmp/.pm-db-password-new)
-    else
-        # Fallback: extract from config
-        local config_file="${CONFIG_DIR}/config.toml"
-        if [[ -f "${config_file}" ]]; then
-            db_password=$(sed -n 's|^url = "postgres://[^:]*:\(.*\)@localhost.*"|\1|p' "${config_file}" | head -1)
-        fi
-        if [[ -z "${db_password}" || "${db_password}" == "CHANGEME" ]]; then
-            error "Cannot determine DB password for migrations."
-            return 1
-        fi
-    fi
-
-    export PGPASSWORD="${db_password}"
-
-    # Ensure pgcrypto extension is available (requires superuser)
+    # Ensure pgcrypto extension is available
     psql_run_db -c "CREATE EXTENSION IF NOT EXISTS pgcrypto;" 2>/dev/null || true
 
-    # Create migration tracking table if not exists (run as patch_manager)
-    psql_run_as_pm <<'MIGSQL'
+    # Create migration tracking table if not exists
+    psql_run_db <<'MIGSQL'
 CREATE TABLE IF NOT EXISTS _migrations (
     id          SERIAL PRIMARY KEY,
     filename    TEXT    NOT NULL UNIQUE,
@@ -197,11 +167,11 @@ MIGSQL
     # Handle upgrade from pre-migration-tracking versions:
     # If tables exist but _migrations is empty, mark all existing migrations as applied.
     local migration_count
-    migration_count=$(psql_run_as_pm -t -A -c "SELECT COUNT(*) FROM _migrations;" 2>/dev/null || echo "0")
+    migration_count=$(psql_run_db -t -A -c "SELECT COUNT(*) FROM _migrations;" 2>/dev/null || echo "0")
     migration_count="${migration_count// /}"
 
     local tables_exist
-    tables_exist=$(psql_run_as_pm -t -A -c "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='public' AND table_name='users';" 2>/dev/null || echo "0")
+    tables_exist=$(psql_run_db -t -A -c "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='public' AND table_name='users';" 2>/dev/null || echo "0")
     tables_exist="${tables_exist// /}"
 
     if [[ "${migration_count}" == "0" && "${tables_exist}" -gt 0 ]]; then
@@ -209,7 +179,7 @@ MIGSQL
         for sql_file in $(ls "${MIGRATION_DIR}"/*.sql 2>/dev/null | sort); do
             local fname
             fname=$(basename "${sql_file}")
-            psql_run_as_pm -c "INSERT INTO _migrations (filename) VALUES ('${fname}') ON CONFLICT (filename) DO NOTHING;" 2>/dev/null || true
+            psql_run_db -c "INSERT INTO _migrations (filename) VALUES ('${fname}') ON CONFLICT (filename) DO NOTHING;" 2>/dev/null || true
         done
     fi
 
@@ -221,7 +191,7 @@ MIGSQL
         fname=$(basename "${sql_file}")
 
         local already_applied
-        already_applied=$(psql_run_as_pm -t -A -c "SELECT COUNT(*) FROM _migrations WHERE filename='${fname}';" 2>/dev/null || echo "0")
+        already_applied=$(psql_run_db -t -A -c "SELECT COUNT(*) FROM _migrations WHERE filename='${fname}';" 2>/dev/null || echo "0")
         already_applied="${already_applied// /}"
 
         if [[ "${already_applied}" -gt 0 ]]; then
@@ -230,18 +200,15 @@ MIGSQL
         fi
 
         info "  Applying migration: ${fname}"
-        if psql_run_as_pm -f "${sql_file}"; then
-            psql_run_as_pm -c "INSERT INTO _migrations (filename) VALUES ('${fname}');" 2>/dev/null || true
+        if psql_run_db -f "${sql_file}"; then
+            psql_run_db -c "INSERT INTO _migrations (filename) VALUES ('${fname}');" 2>/dev/null || true
             applied=$((applied + 1))
         else
             error "  Failed to apply migration: ${fname}"
-            unset PGPASSWORD
             return 1
         fi
     done
 
-    unset PGPASSWORD
-
     if [[ "${applied}" -gt 0 ]]; then
         info "Applied ${applied} new migration(s), skipped ${skipped} already applied."
     else
@@ -382,9 +349,6 @@ enable_and_start_services() {
     # Enable the target (which pulls in web + worker)
     systemctl enable patch-manager.target 2>/dev/null || true
 
-    # Enable individual services so they survive a reboot
-    systemctl enable patch-manager-web.service patch-manager-worker.service 2>/dev/null || true
-
     # Start or restart services
     if systemctl is-active --quiet patch-manager.target 2>/dev/null; then
         info "Restarting patch-manager services (upgrade)..."

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "patch-manager-ui",
   "private": true,
-  "version": "1.1.11",
+  "version": "1.1.8",
   "type": "module",
   "scripts": {
     "dev": "vite",

migrations/001_initial_schema.sql

@@ -12,63 +12,31 @@ CREATE EXTENSION IF NOT EXISTS "pg_trgm";    -- fuzzy text search on host names
 -- Enumerations
 -- ============================================================
 
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'user_role') THEN
-        CREATE TYPE user_role AS ENUM ('admin', 'operator');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'auth_provider') THEN
-        CREATE TYPE auth_provider AS ENUM ('local', 'azure_sso');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'host_health_status') THEN
-        CREATE TYPE host_health_status AS ENUM ('pending', 'healthy', 'degraded', 'unreachable');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'job_status') THEN
-        CREATE TYPE job_status AS ENUM ('queued', 'pending', 'running', 'succeeded', 'failed', 'cancelled');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'job_kind') THEN
-        CREATE TYPE job_kind AS ENUM ('patch_apply', 'patch_remove', 'reboot', 'rollback');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'window_recurrence') THEN
-        CREATE TYPE window_recurrence AS ENUM ('once', 'daily', 'weekly', 'monthly');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'cert_status') THEN
-        CREATE TYPE cert_status AS ENUM ('active', 'revoked', 'expired');
-    END IF;
-END $$;
-DO $$ BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'audit_action') THEN
-        CREATE TYPE audit_action AS ENUM (
-            'user_login', 'user_logout', 'user_login_failed',
-            'user_created', 'user_deleted', 'user_updated',
-            'host_registered', 'host_removed',
-            'group_created', 'group_deleted',
-            'group_membership_changed',
-            'patch_job_created', 'patch_job_cancelled', 'patch_job_rollback',
-            'maintenance_window_created', 'maintenance_window_updated', 'maintenance_window_deleted',
-            'certificate_issued', 'certificate_renewed', 'certificate_revoked', 'certificate_downloaded',
-            'config_changed',
-            'discovery_scan_started'
-        );
-    END IF;
-END $$;
+CREATE TYPE user_role AS ENUM ('admin', 'operator');
+CREATE TYPE auth_provider AS ENUM ('local', 'azure_sso');
+CREATE TYPE host_health_status AS ENUM ('pending', 'healthy', 'degraded', 'unreachable');
+CREATE TYPE job_status AS ENUM ('queued', 'pending', 'running', 'succeeded', 'failed', 'cancelled');
+CREATE TYPE job_kind AS ENUM ('patch_apply', 'patch_remove', 'reboot', 'rollback');
+CREATE TYPE window_recurrence AS ENUM ('once', 'daily', 'weekly', 'monthly');
+CREATE TYPE cert_status AS ENUM ('active', 'revoked', 'expired');
+CREATE TYPE audit_action AS ENUM (
+    'user_login', 'user_logout', 'user_login_failed',
+    'user_created', 'user_deleted', 'user_updated',
+    'host_registered', 'host_removed',
+    'group_created', 'group_deleted',
+    'group_membership_changed',
+    'patch_job_created', 'patch_job_cancelled', 'patch_job_rollback',
+    'maintenance_window_created', 'maintenance_window_updated', 'maintenance_window_deleted',
+    'certificate_issued', 'certificate_renewed', 'certificate_revoked', 'certificate_downloaded',
+    'config_changed',
+    'discovery_scan_started'
+);
 
 -- ============================================================
 -- Groups (defined before users/hosts for FK ordering)
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS groups (
+CREATE TABLE groups (
     id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     name        TEXT NOT NULL UNIQUE,
     description TEXT NOT NULL DEFAULT '',
@@ -76,13 +44,13 @@ CREATE TABLE IF NOT EXISTS groups (
     updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
 
-CREATE INDEX IF NOT EXISTS idx_groups_name ON groups (name);
+CREATE INDEX idx_groups_name ON groups (name);
 
 -- ============================================================
 -- Users
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS users (
+CREATE TABLE users (
     id                  UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     username            TEXT NOT NULL UNIQUE,
     display_name        TEXT NOT NULL DEFAULT '',
@@ -105,28 +73,28 @@ CREATE TABLE IF NOT EXISTS users (
     updated_at          TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
 
-CREATE INDEX IF NOT EXISTS idx_users_email ON users (email);
-CREATE INDEX IF NOT EXISTS idx_users_azure_oid ON users (azure_oid) WHERE azure_oid IS NOT NULL;
-CREATE INDEX IF NOT EXISTS idx_users_role ON users (role);
+CREATE INDEX idx_users_email ON users (email);
+CREATE INDEX idx_users_azure_oid ON users (azure_oid) WHERE azure_oid IS NOT NULL;
+CREATE INDEX idx_users_role ON users (role);
 
 -- ============================================================
 -- User <-> Group membership
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS user_groups (
+CREATE TABLE user_groups (
     user_id    UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
     group_id   UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
     assigned_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
     PRIMARY KEY (user_id, group_id)
 );
 
-CREATE INDEX IF NOT EXISTS idx_user_groups_group ON user_groups (group_id);
+CREATE INDEX idx_user_groups_group ON user_groups (group_id);
 
 -- ============================================================
 -- Refresh Tokens
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS refresh_tokens (
+CREATE TABLE refresh_tokens (
     id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     user_id         UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
     -- Stored as Argon2id hash of the opaque token bytes
@@ -141,14 +109,14 @@ CREATE TABLE IF NOT EXISTS refresh_tokens (
     ip_address      INET
 );
 
-CREATE INDEX IF NOT EXISTS idx_refresh_tokens_user ON refresh_tokens (user_id);
-CREATE INDEX IF NOT EXISTS idx_refresh_tokens_expires ON refresh_tokens (expires_at) WHERE revoked = FALSE;
+CREATE INDEX idx_refresh_tokens_user ON refresh_tokens (user_id);
+CREATE INDEX idx_refresh_tokens_expires ON refresh_tokens (expires_at) WHERE revoked = FALSE;
 
 -- ============================================================
 -- Hosts
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS hosts (
+CREATE TABLE hosts (
     id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     fqdn            TEXT NOT NULL,
     ip_address      INET NOT NULL,
@@ -168,28 +136,28 @@ CREATE TABLE IF NOT EXISTS hosts (
     CONSTRAINT hosts_fqdn_ip_unique UNIQUE (fqdn, ip_address)
 );
 
-CREATE INDEX IF NOT EXISTS idx_hosts_health_status ON hosts (health_status);
-CREATE INDEX IF NOT EXISTS idx_hosts_fqdn ON hosts USING gin (fqdn gin_trgm_ops);
-CREATE INDEX IF NOT EXISTS idx_hosts_ip ON hosts (ip_address);
+CREATE INDEX idx_hosts_health_status ON hosts (health_status);
+CREATE INDEX idx_hosts_fqdn ON hosts USING gin (fqdn gin_trgm_ops);
+CREATE INDEX idx_hosts_ip ON hosts (ip_address);
 
 -- ============================================================
 -- Host <-> Group membership
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS host_groups (
+CREATE TABLE host_groups (
     host_id     UUID NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
     group_id    UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
     assigned_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
     PRIMARY KEY (host_id, group_id)
 );
 
-CREATE INDEX IF NOT EXISTS idx_host_groups_group ON host_groups (group_id);
+CREATE INDEX idx_host_groups_group ON host_groups (group_id);
 
 -- ============================================================
 -- Host Health Data (cached results from 5-min polls)
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS host_health_data (
+CREATE TABLE host_health_data (
     id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     host_id     UUID NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
     polled_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),
@@ -198,14 +166,14 @@ CREATE TABLE IF NOT EXISTS host_health_data (
     payload     JSONB NOT NULL DEFAULT '{}'
 );
 
-CREATE INDEX IF NOT EXISTS idx_host_health_host ON host_health_data (host_id, polled_at DESC);
+CREATE INDEX idx_host_health_host ON host_health_data (host_id, polled_at DESC);
 -- Retained for 30 days (pruned by worker)
 
 -- ============================================================
 -- Host Patch Data (cached results from 30-min polls)
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS host_patch_data (
+CREATE TABLE host_patch_data (
     id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     host_id         UUID NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
     polled_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
@@ -216,14 +184,14 @@ CREATE TABLE IF NOT EXISTS host_patch_data (
     cve_count       INTEGER NOT NULL DEFAULT 0
 );
 
-CREATE INDEX IF NOT EXISTS idx_host_patch_host ON host_patch_data (host_id, polled_at DESC);
+CREATE INDEX idx_host_patch_host ON host_patch_data (host_id, polled_at DESC);
 -- Retained for 30 days (pruned by worker)
 
 -- ============================================================
 -- Maintenance Windows
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS maintenance_windows (
+CREATE TABLE maintenance_windows (
     id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     host_id         UUID NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
     label           TEXT NOT NULL DEFAULT '',
@@ -239,14 +207,14 @@ CREATE TABLE IF NOT EXISTS maintenance_windows (
     updated_at      TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
 
-CREATE INDEX IF NOT EXISTS idx_mw_host ON maintenance_windows (host_id);
-CREATE INDEX IF NOT EXISTS idx_mw_start ON maintenance_windows (start_at) WHERE enabled = TRUE;
+CREATE INDEX idx_mw_host ON maintenance_windows (host_id);
+CREATE INDEX idx_mw_start ON maintenance_windows (start_at) WHERE enabled = TRUE;
 
 -- ============================================================
 -- Patch Jobs
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS patch_jobs (
+CREATE TABLE patch_jobs (
     id                  UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     kind                job_kind NOT NULL DEFAULT 'patch_apply',
     status              job_status NOT NULL DEFAULT 'queued',
@@ -265,15 +233,15 @@ CREATE TABLE IF NOT EXISTS patch_jobs (
     completed_at        TIMESTAMPTZ
 );
 
-CREATE INDEX IF NOT EXISTS idx_patch_jobs_status ON patch_jobs (status);
-CREATE INDEX IF NOT EXISTS idx_patch_jobs_created ON patch_jobs (created_at DESC);
-CREATE INDEX IF NOT EXISTS idx_patch_jobs_user ON patch_jobs (created_by_user_id);
+CREATE INDEX idx_patch_jobs_status ON patch_jobs (status);
+CREATE INDEX idx_patch_jobs_created ON patch_jobs (created_at DESC);
+CREATE INDEX idx_patch_jobs_user ON patch_jobs (created_by_user_id);
 
 -- ============================================================
 -- Patch Job Hosts (per-host status within a batch job)
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS patch_job_hosts (
+CREATE TABLE patch_job_hosts (
     id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     job_id          UUID NOT NULL REFERENCES patch_jobs(id) ON DELETE CASCADE,
     host_id         UUID NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
@@ -289,15 +257,15 @@ CREATE TABLE IF NOT EXISTS patch_job_hosts (
     UNIQUE (job_id, host_id)
 );
 
-CREATE INDEX IF NOT EXISTS idx_pjh_job ON patch_job_hosts (job_id);
-CREATE INDEX IF NOT EXISTS idx_pjh_host ON patch_job_hosts (host_id);
-CREATE INDEX IF NOT EXISTS idx_pjh_status ON patch_job_hosts (status);
+CREATE INDEX idx_pjh_job ON patch_job_hosts (job_id);
+CREATE INDEX idx_pjh_host ON patch_job_hosts (host_id);
+CREATE INDEX idx_pjh_status ON patch_job_hosts (status);
 
 -- ============================================================
 -- Certificates
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS certificates (
+CREATE TABLE certificates (
     id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     -- NULL = root CA cert
     host_id         UUID REFERENCES hosts(id) ON DELETE CASCADE,
@@ -311,15 +279,15 @@ CREATE TABLE IF NOT EXISTS certificates (
     cert_pem        TEXT NOT NULL
 );
 
-CREATE INDEX IF NOT EXISTS idx_certs_host ON certificates (host_id);
-CREATE INDEX IF NOT EXISTS idx_certs_status ON certificates (status);
-CREATE INDEX IF NOT EXISTS idx_certs_expires ON certificates (expires_at);
+CREATE INDEX idx_certs_host ON certificates (host_id);
+CREATE INDEX idx_certs_status ON certificates (status);
+CREATE INDEX idx_certs_expires ON certificates (expires_at);
 
 -- ============================================================
 -- Audit Log (tamper-evident, hash-chained)
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS audit_log (
+CREATE TABLE audit_log (
     id              BIGSERIAL PRIMARY KEY,
     action          audit_action NOT NULL,
     actor_user_id   UUID REFERENCES users(id) ON DELETE SET NULL,
@@ -334,17 +302,17 @@ CREATE TABLE IF NOT EXISTS audit_log (
     row_hash        TEXT NOT NULL DEFAULT ''
 );
 
-CREATE INDEX IF NOT EXISTS idx_audit_created ON audit_log (created_at DESC);
-CREATE INDEX IF NOT EXISTS idx_audit_actor ON audit_log (actor_user_id);
-CREATE INDEX IF NOT EXISTS idx_audit_action ON audit_log (action);
-CREATE INDEX IF NOT EXISTS idx_audit_target ON audit_log (target_type, target_id);
+CREATE INDEX idx_audit_created ON audit_log (created_at DESC);
+CREATE INDEX idx_audit_actor ON audit_log (actor_user_id);
+CREATE INDEX idx_audit_action ON audit_log (action);
+CREATE INDEX idx_audit_target ON audit_log (target_type, target_id);
 -- Retained for 6 months (pruned by worker)
 
 -- ============================================================
 -- Azure SSO Configuration
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS azure_sso_config (
+CREATE TABLE azure_sso_config (
     id              INTEGER PRIMARY KEY DEFAULT 1,  -- singleton row
     enabled         BOOLEAN NOT NULL DEFAULT FALSE,
     tenant_id       TEXT NOT NULL DEFAULT '',
@@ -361,7 +329,7 @@ CREATE TABLE IF NOT EXISTS azure_sso_config (
 -- System Configuration (key/value runtime settings)
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS system_config (
+CREATE TABLE system_config (
     key         TEXT PRIMARY KEY,
     value       TEXT NOT NULL,
     description TEXT NOT NULL DEFAULT '',
@@ -383,14 +351,13 @@ INSERT INTO system_config (key, value, description) VALUES
     ('smtp_from',                  '',      'From address for notifications'),
     ('smtp_tls_mode',              'starttls', 'SMTP TLS mode: none, starttls, tls'),
     ('web_tls_strategy',           'internal_ca', 'Web UI TLS cert strategy: internal_ca or operator_supplied'),
-    ('ip_whitelist',               '[]',    'JSON array of allowed CIDR/IP strings; empty = allow all')
-ON CONFLICT (key) DO NOTHING;
+    ('ip_whitelist',               '[]',    'JSON array of allowed CIDR/IP strings; empty = allow all');
 
 -- ============================================================
 -- Worker Heartbeat
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS worker_heartbeat (
+CREATE TABLE worker_heartbeat (
     id              INTEGER PRIMARY KEY DEFAULT 1,  -- singleton row
     last_seen       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
     worker_version  TEXT NOT NULL DEFAULT '',
@@ -401,7 +368,7 @@ CREATE TABLE IF NOT EXISTS worker_heartbeat (
 -- Discovery Results (transient; cleared before each scan)
 -- ============================================================
 
-CREATE TABLE IF NOT EXISTS discovery_results (
+CREATE TABLE discovery_results (
     id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     scan_id         UUID NOT NULL,
     ip_address      INET NOT NULL,
@@ -414,5 +381,5 @@ CREATE TABLE IF NOT EXISTS discovery_results (
     registered      BOOLEAN NOT NULL DEFAULT FALSE
 );
 
-CREATE INDEX IF NOT EXISTS idx_discovery_scan ON discovery_results (scan_id);
-CREATE INDEX IF NOT EXISTS idx_discovery_ip ON discovery_results (ip_address);
+CREATE INDEX idx_discovery_scan ON discovery_results (scan_id);
+CREATE INDEX idx_discovery_ip ON discovery_results (ip_address);

migrations/003_jobs_scheduling.sql

@@ -8,11 +8,11 @@
 
 -- When the retry engine should next attempt this host; NULL = not scheduled
 ALTER TABLE patch_job_hosts
-    ADD COLUMN IF NOT EXISTS retry_next_at TIMESTAMPTZ;
+    ADD COLUMN retry_next_at TIMESTAMPTZ;
 
 -- Last failure reason captured by the worker for display in the UI
 ALTER TABLE patch_job_hosts
-    ADD COLUMN IF NOT EXISTS last_error TEXT;
+    ADD COLUMN last_error TEXT;
 
 -- ============================================================
 -- pg_notify trigger: fires when an immediate job is inserted
@@ -30,21 +30,15 @@ BEGIN
 END;
 $$;
 
-DO $$ BEGIN
-    IF NOT EXISTS (
-        SELECT 1 FROM pg_trigger WHERE tgname = 'trg_job_enqueued'
-    ) THEN
-        CREATE TRIGGER trg_job_enqueued
-            AFTER INSERT ON patch_jobs
-            FOR EACH ROW
-            EXECUTE FUNCTION notify_job_enqueued();
-    END IF;
-END $$;
+CREATE TRIGGER trg_job_enqueued
+    AFTER INSERT ON patch_jobs
+    FOR EACH ROW
+    EXECUTE FUNCTION notify_job_enqueued();
 
 -- ============================================================
 -- Index: efficiently find hosts due for retry
 -- ============================================================
 
-CREATE INDEX IF NOT EXISTS idx_pjh_retry
+CREATE INDEX idx_pjh_retry
     ON patch_job_hosts (retry_next_at)
     WHERE retry_next_at IS NOT NULL;

migrations/007_health_checks.sql

@@ -1,7 +1,7 @@
 -- Migration 007: Health check configuration and results
 
 -- Health checks configured per host (1-5 per host)
-CREATE TABLE IF NOT EXISTS host_health_checks (
+CREATE TABLE host_health_checks (
     id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     host_id         UUID NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
     name            VARCHAR(100) NOT NULL,
@@ -27,10 +27,10 @@ CREATE TABLE IF NOT EXISTS host_health_checks (
     )
 );
 
-CREATE INDEX IF NOT EXISTS idx_health_checks_host ON host_health_checks (host_id);
+CREATE INDEX idx_health_checks_host ON host_health_checks (host_id);
 
 -- Health check poll results (4-day retention, pruned by worker)
-CREATE TABLE IF NOT EXISTS host_health_check_results (
+CREATE TABLE host_health_check_results (
     id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     check_id    UUID NOT NULL REFERENCES host_health_checks(id) ON DELETE CASCADE,
     healthy     BOOLEAN NOT NULL,
@@ -39,4 +39,4 @@ CREATE TABLE IF NOT EXISTS host_health_check_results (
     checked_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
 
-CREATE INDEX IF NOT EXISTS idx_health_results_check ON host_health_check_results (check_id, checked_at DESC);
+CREATE INDEX idx_health_results_check ON host_health_check_results (check_id, checked_at DESC);

migrations/011_health_check_target_host.sql

@@ -4,7 +4,7 @@
 -- FK with ON DELETE SET NULL: if target host deleted, revert to default.
 
 ALTER TABLE host_health_checks
-  ADD COLUMN IF NOT EXISTS target_host_id UUID REFERENCES hosts(id) ON DELETE SET NULL;
+  ADD COLUMN target_host_id UUID REFERENCES hosts(id) ON DELETE SET NULL;
 
-CREATE INDEX IF NOT EXISTS idx_health_checks_target_host ON host_health_checks (target_host_id)
+CREATE INDEX idx_health_checks_target_host ON host_health_checks (target_host_id)
   WHERE target_host_id IS NOT NULL;

migrations/016_enrollment_requests.sql

@@ -1,7 +1,7 @@
 -- Migration: 016_enrollment_requests
 -- Description: Create enrollment_requests table for host self-enrollment
 
-CREATE TABLE IF NOT EXISTS enrollment_requests (
+CREATE TABLE enrollment_requests (
     id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     machine_id      TEXT NOT NULL UNIQUE,
     fqdn            TEXT NOT NULL,
@@ -12,5 +12,5 @@ CREATE TABLE IF NOT EXISTS enrollment_requests (
     expires_at      TIMESTAMPTZ NOT NULL DEFAULT NOW() + INTERVAL '24 hours'
 );
 
-CREATE INDEX IF NOT EXISTS idx_enrollment_requests_token ON enrollment_requests (polling_token);
-CREATE INDEX IF NOT EXISTS idx_enrollment_requests_expires ON enrollment_requests (expires_at);
+CREATE INDEX idx_enrollment_requests_token ON enrollment_requests (polling_token);
+CREATE INDEX idx_enrollment_requests_expires ON enrollment_requests (expires_at);

scripts/build-package.sh

@@ -22,7 +22,7 @@ warn()  { echo -e "${YELLOW}[WARN]${NC}  $*"; }
 error() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
 
 PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-VERSION="1.1.11"
+VERSION="1.1.8"
 RELEASE="1"
 PKG_NAME="linux-patch-manager"
 DEB_NAME="${PKG_NAME}_${VERSION}-${RELEASE}_amd64.deb"