- promote.sh: add a leak guard that refuses to publish a tree still carrying a
private identifier (git.bave.dev / boban/clusev / clusev-staging) or an internal
doc (CLAUDE.md, rules.md, handoff.md, kickoff-prompt.md, docs/). This makes
promotion safe even for a tag cut BEFORE the export-ignore fixes — such a tree is
refused instead of leaking the dev/staging repos. Negative test added.
- .gitattributes: export-ignore kickoff-prompt.md (internal bootstrap doc; leaked
the VM IP + infra topology).
- README: move the banner/architecture SVGs out of the export-ignored docs/ into
art/ so the public README images are actually published.
- .env.example: comment out CLUSEV_REPOSITORY — a present-but-empty value defeats
the config default (env() returns ''), which would silently disable the public
update check. Left unset, the public-repo default applies.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The release-pipeline + one-time-wiring section named the private staging runner
label and described internal setup — not public-facing. Move it to
docs/release-pipeline.md (export-ignore, never published) so the public README
stays clean and no private repo name leaks via the published tree.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Capture the maintainer's release workflow: dev-dashboard buttons drive the
pipeline (Deploy to Staging / Deploy to Public / Promote to Stable). Beta =
vX.Y.Z-betaN on staging, Stable = vX.Y.Z on public; public serves both channels.
Public promotion triggered via the GitHub API with a deploy token in the
encrypted vault. Decomposed: Phase A = git/CI/CD + config-URL infra (buildable
now, URL-agnostic); Phase B = the dashboard release-control UI (own spec, after
A + the repos exist).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Per the maintainer: dev/staging may hold any URL (in their gitignored .env);
the public repo's tracked files carry only the public URL. So config/clusev.php
defaults to the public URL, private (Gitea/GitHub-private) URLs live solely in
gitignored .env, and install.sh derives CLUSEV_REPOSITORY from the clone origin.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Design for promoting Clusev dev → staging → public across three repos with
GitHub Actions CI, a manual gate before public, and a clean public history.
Core: no repository URL in tracked files — derived from the clone origin, kept
in gitignored .env per environment, so the public repo never exposes the
private/Gitea URLs and the URLs plug in later when the GitHub repos exist.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Rebuild the README around the product's "Tactical Terminal" design system
(dark graphite, signal-orange, cyan, mono type) so it reads as a professional,
self-hosted enterprise product instead of a plain text file:
- docs/assets/clusev-banner.svg — hero banner with the Clusev wordmark, tagline,
brand chips, and a live "fleet" node-graph (control-plane hub → server cards
with the online/warning/offline status triad + CPU bars and animated data
pulses). Self-contained: the real product fonts (Chakra Petch + JetBrains Mono)
are embedded base64 so Gitea's <img>-rendered SVG shows pixel-correct type.
- docs/assets/clusev-architecture.svg — Operator → Control plane → Fleet diagram
(HTTPS/WS · Reverb in, SSH+SFTP · phpseclib out), same brand language.
- README.md — centered hero, brand-matched shields badges, anchor nav, a
"why" three-up, a Features table, the architecture diagram + a tech-stack
table, and the existing install / domain-TLS / updating / security-recovery
content kept verbatim (now with a WireGuard feature row). All graphics are
external SVG files (Gitea strips inline <svg>); relative paths resolve on the
default branch.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Optional host-level WireGuard gate for the Clusev panel: install.sh installs
wireguard-tools (off), a 'clusev wg setup/up/down/status/add-peer/remove-peer'
host CLI sets up wg0 + gates TCP 80/443 to the WG subnet via a dedicated
CLUSEV-WG-GATE iptables chain off DOCKER-USER, with 'clusev wg down' as the
escape hatch and SSH/WG-UDP never gated. Hardened after an adversarial review:
exact ordered firewall rules, persistence skips if wg0 is down (no reboot
brick), down isolates Clusev's chain, setup idempotency, precise install
wiring (CLUSEV_DIR exec + install_host_watchers). SP1 of 2; dashboard
status/traffic is SP2.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
App-level persistent IP ban for Clusev's own login (distinct from the remote-fleet
Fail2banService): BannedIp model, BruteforceGuard service, guests-only BlockBannedIp
middleware, Login/2FA hooks + audit, a new Anmeldeschutz settings tab, clusev:unban CLI.
Hardened after an adversarial multi-lens review: documented IP trust model (Caddy sole
proxy, prod-only trustProxies), guests-only enforcement so an authed operator is never
locked out and can self-unban, current-IP self-whitelist, concrete cache strategy,
inet_pton CIDR matching, R5 confirm modals, errors.php for the 403 strings.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- backup field: autocomplete=off -> one-time-code (backup codes ARE one-time codes;
matches the main challenge field, the rest of the app, and the spec; restores
password-manager OTP autofill that the earlier polish broke)
- both verify() use the trait's memoised $this->pendingUser() instead of a fresh
User::find(), saving a redundant query on the failed-attempt re-render (Pint dropped
the now-unused User import in TwoFactorBackup)
- spec: align trait backing-state visibility note to the implemented 'private'
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Task-by-task TDD plan for Spec 1: shared CompletesTwoFactorChallenge trait,
new TwoFactorBackup component + guest route + view, main-view redesign
(form gated to TOTP users, backup button, mount->backup redirect for
key-only-no-secure-context), i18n keys, and full R12/R15 verification.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Spec 1 of 2 for the 2FA challenge rework. Moves the backup (recovery) code
off the combined challenge screen into a dedicated /two-factor-challenge/backup
route + view, behind a 'Backup-Code verwenden' button; the main screen shows
only the primary factor. A key-only user without secure context (http + bare IP)
is redirected straight to the backup view. Shared rate-limit/login logic is
extracted into a CompletesTwoFactorChallenge trait so both views hit one bucket
set. IP-vs-domain factor routing is already correct (WebauthnService::available)
and unchanged. Spec 2 (auth-failure -> fail2ban hard IP ban) is out of scope here.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Spec for a bilingual /help page (left topic nav like Settings) covering all
settings, a generic reverse-proxy setup guide, and the 2FA access-path note
(security key only over the HTTPS domain; backup code on the bare-IP/HTTP path;
TOTP works everywhere). Also generalize the external-TLS hint copy (no product
name).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
DNS pre-check + internal SNI handshake to caddy to trigger on-demand issuance, with a
persisted status (no page-load ACME side effects), per-user throttle, external-TLS-mode
gating, and the control-plane-never-locked constraint.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Deferred runbook for the final beta-prep step: purge CLAUDE.md, rules.md,
handoff.md, docs/session-handoff.md and docs/superpowers from all history,
strip Co-Authored-By trailers, keep the files locally + gitignored, then a
gated force-push. Execute at beta-cut time only, behind explicit confirmation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The 2fa.codes_fresh reveal flag is now a timestamp (set at enrollment) and
RecoveryCodes::mount() only reveals within [now-600s, now], symmetric to the
download-grant window. A reveal flag whose modal never opened can no longer
re-reveal the codes later in the session. FirstFactorCodesTest asserts the
flag is an int.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Two hardening features completed in parallel (each with its own spec + tests),
sharing call sites (TwoFactorSetup, WebauthnKeys, routes) so committed together:
- ConfirmAction token hardening: destructive confirm flows now carry a server-issued,
single-use, signed token (App\Support\Confirm\ConfirmToken) instead of trusting a
client-mutable event/params/auditTarget. Every #[On] apply handler consumes + validates
the token (forged/replayed/direct-bypass calls no-op). Server-scoped per action; closes
the codebase-wide confirm-bypass + audit-forgery vector across Security, Sessions, Users,
WebauthnKeys, Servers\Show, Services, System, Files.
- Backup-code airtight reveal: codes are revealed via a transient channel, not a persisted
Livewire property, so a captured/replayed snapshot can't re-render them; the recovery
download is grant-gated.
Full suite green (162).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2FA becomes optional + pluggable: TOTP, a security key, or both, fully
deactivatable, recommended not forced. hasTwoFactorEnabled = either factor;
onboarding drops the forced-2FA redirect; recovery codes become a modal (drop the
dedicated page/route); challenge adapts to whichever factor(s) exist; last-factor
removal clears codes. WebAuthn E2E stays domain-deferred.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
WebAuthn/YubiKey as an optional login 2nd factor (web-auth/webauthn-lib), gated
on domain+HTTPS. TOTP + backup codes stay the required 2FA. Register/use/remove
keys in Settings + at the challenge; 2FA reset (UI + CLI) clears keys. Real
YubiKey end-to-end is browser-verified on a domain host. See CHANGELOG.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Optional security-key 2nd factor via web-auth/webauthn-lib, gated on domain +
HTTPS (rpId = active domain). TOTP + backup codes stay the required 2FA and the
only recovery. Build now with unit/feature tests (mocked ceremony) + R12 gating;
real YubiKey end-to-end deferred to a domain+HTTPS host.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Account recovery: 2FA backup codes (show-once/download/regenerate, usable at the
login challenge), forgot-password via 2FA or backup code (email link gated on a
configured mailer), and a clusev:reset-admin CLI lockout fallback. Resets rotate
remember_token; codes consumed atomically. WebAuthn/YubiKey remains a Phase-2
spec. See CHANGELOG.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Phase 1: 2FA recovery codes (encrypted, show-once + downloadable, usable at the
challenge), a forgot-password flow (2FA-code proof primary, email link only when
SMTP is configured), and a clusev:reset-admin CLI lockout fallback. WebAuthn is
deferred to a Phase-2 spec.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Branding + custom error pages: full favicon/PWA icon set wired into both
layouts, and branded bilingual error pages (403/404/419/429/500/503) replacing
Laravel's defaults with APP_DEBUG pinned off in prod — no raw status text or
stack traces. See CHANGELOG.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Stop iOS zoom-on-focus: an unlayered @media (pointer: coarse) rule forces 16px
on input/textarea/select for touch devices (phone + tablet of any size), keeping
the dense desktop sizing for mouse pointers. See CHANGELOG.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Responsive audit (R7) over all views at 375/768: hardened mobile overflow from
long panel domains (break-all/min-w-0) and banned IPv6 addresses in the fail2ban
list. Live pages were already overflow-free; only data-dependent edge cases
fixed. See CHANGELOG.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Note the seven fixes (buttons, panel grid, auto-updates reframe, create-verify,
pending status, SSH hint) as completed on the branch, with the verification
trail, and flag the pre-existing stock ExampleTest failure.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Eight-task TDD plan covering the seven fixes: button kit, pending status,
auto-updates reframe, FleetService::testConnection, create-verify, panel grid,
SSH hint, and a final R12+Codex gate.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Design for seven reported fixes: unified bordered button kit (retire
ghost/ghost-danger, add danger-soft), firewall+fail2ban panels in an
installed-only responsive grid, auto-updates reframed as a neutral operator
preference (never an insecure verdict), create-server SSH verification with
atomic rollback, a new "Initialisierung" (pending) server status, and an
SSH key-only hint on the checklist. Includes file map, TDD + R12 plan.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
boban