Echo
83c97aa2b1
Some checks failed
CI Pipeline / Rust Format Check (push) Failing after 36s
CI Pipeline / Clippy Lints (push) Successful in 45s
CI Pipeline / Rust Unit Tests (push) Successful in 1m1s
CI Pipeline / Security Audit (push) Successful in 4s
CI Pipeline / Frontend Lint & Type Check (push) Successful in 11s
CI Pipeline / Build .deb & Release (push) Has been skipped
BUG-6: Add TLS support via axum-server + rustls
- Added axum-server with tls-rustls feature to workspace and pm-web
- pm-web now serves HTTPS when TLS certs exist, falls back to HTTP with warning
- setup.sh generates self-signed ECDSA P-256 TLS cert with SANs
- Config already had web_tls_cert_path/web_tls_key_path fields
BUG-7: Fix audit chain integrity errors
- Migration 005 now TRUNCATEs audit_log after adding prev_hash column
- Existing rows had broken hash chains (inserted before prev_hash existed)
BUG-8: Disable WatchdogSec in patch-manager-web.service
- pm-web does not implement sd_notify, causing systemd to kill the service
BUG-9: Disable WatchdogSec in patch-manager-worker.service
- Same issue as BUG-8, worker does not implement sd_notify
Previous fixes (BUG-1 through BUG-5) also included:
- setup.sh: PostgreSQL 15+ schema GRANTs
- Axum route syntax :param → {param} (19 routes)
- DbUser struct role: String → UserRole enum mapping
- UserRole/AuthProvider Display trait implementations
- Seed admin password hash (Argon2id)
37 lines
933 B
SQL
37 lines
933 B
SQL
-- Migration: 002_seed_admin
|
|
-- Description: Seed the default admin account.
|
|
--
|
|
-- Default credentials (CHANGE BEFORE PRODUCTION USE):
|
|
-- Username: admin
|
|
-- Password: ChangeMe123!
|
|
--
|
|
-- The password hash below is Argon2id of "ChangeMe123!" with
|
|
-- m=65536, t=3, p=1. Replace after first login.
|
|
|
|
INSERT INTO users (
|
|
id,
|
|
username,
|
|
display_name,
|
|
email,
|
|
role,
|
|
auth_provider,
|
|
password_hash,
|
|
mfa_enabled,
|
|
is_active,
|
|
force_password_reset
|
|
)
|
|
VALUES (
|
|
gen_random_uuid(),
|
|
'admin',
|
|
'Administrator',
|
|
'admin@localhost',
|
|
'admin',
|
|
'local',
|
|
-- Argon2id hash of "ChangeMe123!" — REPLACE IN PRODUCTION
|
|
'$argon2id$v=19$m=65536,t=3,p=1$Kv8bkGiE81yIuXARq9fwsw$NrBRFvgL1dVsW7bEK6NxEOzIX2q1p4B0K422idAVIDQ',
|
|
FALSE, -- MFA disabled by default; admin must set up on first login
|
|
TRUE,
|
|
TRUE -- Force password reset on first login
|
|
)
|
|
ON CONFLICT (username) DO NOTHING;
|