clusev

Commit Graph

Author	SHA1	Message	Date
boban	b7fe66406c	fix(live): poll-driven metrics (chart + gauges), bigger donuts, drop fake fleet Addresses "chart/gauges don't update" and "design": the visible live layer no longer depends on the Reverb WS path (which was unreliable through the dev NAT). - Poller is now the single SSH metrics source: FleetService::applyMetrics writes the latest reading + a rolling cpu/mem history into the cache (and the DB). - Dashboard reads latest + history from cache (no SSH on web render); the big chart and KPI sparklines render real history; wire:poll.10s refreshes them. - Server-Details gauges read the poller-updated row via wire:poll.10s; the donut rings get a size="lg" variant (h-24) so they read clearly + animate. - FleetSeeder no longer seeds a fake fleet (those servers had no credentials and showed no data). It seeds one real server from CLUSEV_DEMO_SSH_* env vars, or an empty fleet otherwise. Existing fake servers removed from the demo DB. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-12 22:38:51 +02:00
boban	16655eb537	feat(deploy): install.sh + Caddy auto-TLS + prod hardening One-command, idempotent production install per docs/install-update-design.md (the "JETZT" phase). Onboarding (forced password change + 2FA) already ships via EnsureSecurityOnboarded; the in-dashboard self-updater stays deferred to v1.x. - install.sh: preflight -> idempotent secrets (set_kv never regenerates) -> derive SITE_ADDRESS/APP_URL/REVERB_* from the single APP_DOMAIN knob -> build -> up -> wait DB -> migrate + cache -> clusev:install. One-time admin password is printed only on the terminal, never stored. Bare-IP and private-IP warnings. - app/Console/Commands/Install.php: idempotent first admin (Str::password(20), must_change_password); hard no-op once a user exists (INSTALL_LOCK idiom). - docker/caddy/Caddyfile: one template, both modes; Reverb wss over /app/* and /apps/* on the same address; admin-API-free, security headers. Validated for bare-IP (:80) and domain (https) modes. - docker-compose.prod.yml: Caddy is the only host-published service (80/443 + HTTP/3); app/reverb/queue/mariadb lose host ports (internal net only); CLUSEV_IMAGE indirection (locally-built tag, GHCR digest later); Redis requires a password; caddy-data/caddy-config volumes persist ACME certs. - .env.example: APP_DOMAIN/APP_SCHEME/ACME_EMAIL/SITE_ADDRESS/CLUSEV_IMAGE/ UPDATE_HMAC_KEY documented. - README: real Clusev install/deploy guide (replaces Laravel boilerplate). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-12 15:17:32 +02:00
boban	53f7309c0b	feat: scaffold — Dockerized Laravel 13 + Livewire 3 + Tailwind 4 + Reverb Working dev stack on :80 (Freigabe step 5: app boots, page renders, Vite HMR runs): - Multi-stage Dockerfile (php8.3-fpm + nginx + supervisor + node). Dev runs php-fpm + nginx + vite in ONE app container; prod target bakes vendor + assets. - docker-compose.yml (dev, bind-mount) + docker-compose.prod.yml (GHCR image). Env-driven ports/UID (APP_PORT, VITE_PORT, REVERB_HOST_PORT, DB_PORT, HOST_UID/HOST_GID) — nothing hardcoded. MariaDB only on 127.0.0.1:3306. - Laravel 13, Livewire 3.8 (class-based, no Volt), wire-elements/modal 2, phpseclib 3, laravel/reverb 1. composer platform pinned to php 8.3. - Tailwind v4 @theme tokens ("Tactical Terminal") in app.css; Vite remote HMR (host 0.0.0.0, hmr.host 10.10.90.136). - Dashboard as a full-page Livewire route (/) in layouts/app; §5 folder skeleton. - Docs: rules.md R1-R11 (incl. R11 UUID-in-URLs) + CLAUDE.md updated for Laravel 13, clusev/ root, port 80, vite-in-app, env-driven config. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-12 00:31:50 +02:00

Author

SHA1

Message

Date

boban

b7fe66406c

fix(live): poll-driven metrics (chart + gauges), bigger donuts, drop fake fleet

Addresses "chart/gauges don't update" and "design": the visible live layer no
longer depends on the Reverb WS path (which was unreliable through the dev NAT).

- Poller is now the single SSH metrics source: FleetService::applyMetrics writes
  the latest reading + a rolling cpu/mem history into the cache (and the DB).
- Dashboard reads latest + history from cache (no SSH on web render); the big
  chart and KPI sparklines render real history; wire:poll.10s refreshes them.
- Server-Details gauges read the poller-updated row via wire:poll.10s; the donut
  rings get a size="lg" variant (h-24) so they read clearly + animate.
- FleetSeeder no longer seeds a fake fleet (those servers had no credentials and
  showed no data). It seeds one real server from CLUSEV_DEMO_SSH_* env vars, or
  an empty fleet otherwise. Existing fake servers removed from the demo DB.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-12 22:38:51 +02:00

boban

16655eb537

feat(deploy): install.sh + Caddy auto-TLS + prod hardening

One-command, idempotent production install per docs/install-update-design.md
(the "JETZT" phase). Onboarding (forced password change + 2FA) already ships
via EnsureSecurityOnboarded; the in-dashboard self-updater stays deferred to v1.x.

- install.sh: preflight -> idempotent secrets (set_kv never regenerates) ->
  derive SITE_ADDRESS/APP_URL/REVERB_* from the single APP_DOMAIN knob -> build ->
  up -> wait DB -> migrate + cache -> clusev:install. One-time admin password is
  printed only on the terminal, never stored. Bare-IP and private-IP warnings.
- app/Console/Commands/Install.php: idempotent first admin (Str::password(20),
  must_change_password); hard no-op once a user exists (INSTALL_LOCK idiom).
- docker/caddy/Caddyfile: one template, both modes; Reverb wss over /app/* and
  /apps/* on the same address; admin-API-free, security headers. Validated for
  bare-IP (:80) and domain (https) modes.
- docker-compose.prod.yml: Caddy is the only host-published service (80/443 +
  HTTP/3); app/reverb/queue/mariadb lose host ports (internal net only);
  CLUSEV_IMAGE indirection (locally-built tag, GHCR digest later); Redis requires
  a password; caddy-data/caddy-config volumes persist ACME certs.
- .env.example: APP_DOMAIN/APP_SCHEME/ACME_EMAIL/SITE_ADDRESS/CLUSEV_IMAGE/
  UPDATE_HMAC_KEY documented.
- README: real Clusev install/deploy guide (replaces Laravel boilerplate).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-12 15:17:32 +02:00

boban

53f7309c0b

feat: scaffold — Dockerized Laravel 13 + Livewire 3 + Tailwind 4 + Reverb

Working dev stack on :80 (Freigabe step 5: app boots, page renders, Vite HMR runs):
- Multi-stage Dockerfile (php8.3-fpm + nginx + supervisor + node). Dev runs
  php-fpm + nginx + vite in ONE app container; prod target bakes vendor + assets.
- docker-compose.yml (dev, bind-mount) + docker-compose.prod.yml (GHCR image).
  Env-driven ports/UID (APP_PORT, VITE_PORT, REVERB_HOST_PORT, DB_PORT,
  HOST_UID/HOST_GID) — nothing hardcoded. MariaDB only on 127.0.0.1:3306.
- Laravel 13, Livewire 3.8 (class-based, no Volt), wire-elements/modal 2,
  phpseclib 3, laravel/reverb 1. composer platform pinned to php 8.3.
- Tailwind v4 @theme tokens ("Tactical Terminal") in app.css; Vite remote HMR
  (host 0.0.0.0, hmr.host 10.10.90.136).
- Dashboard as a full-page Livewire route (/) in layouts/app; §5 folder skeleton.
- Docs: rules.md R1-R11 (incl. R11 UUID-in-URLs) + CLAUDE.md updated for
  Laravel 13, clusev/ root, port 80, vite-in-app, env-driven config.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-12 00:31:50 +02:00

3 Commits (4bfa367ccfb67e841f7b9c2a53200db3e99e16fa)