boban

boban pushed to feat/portal-design at boban/CluPilotCloud

53d305340f fix(vpn): a late revocation must not disconnect whoever holds the key now
4f9ca27732 fix(vpn): a replaced key must not stall the reconciliation
556a560506 feat(vpn): explain a missing download, and offer a way out
e5aea84539 docs(ci): wire the runner up to the point where only the token is missing
419a1a8552 fix(ci): keep the workflow and runner compatible with Gitea 1.20
Compare 5 commits »

2026-07-26 01:26:06 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

8117630a65 feat(ops): update page, automatic 419 recovery, CI workflow

2026-07-26 00:58:29 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

ac86efd9c3 feat(deploy): unattended install from a single answers file

2026-07-26 00:40:34 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

062d337dd0 fix(portal): move notices into the header, so the page stops scrolling twice

2026-07-26 00:13:20 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

3fad319053 fix(hosts): re-read the host before deciding there is no DNS record
7b57ab21cb fix(hosts): retry a failed DNS registration before advancing without a name
952e8e5d2f fix(hosts): number DNS names by the normalised label, not the raw code
e96f4c1c1a fix(datacenters): a code becomes a DNS label, so validate it as one
69043f9ffc fix(dns): deleting a record that is already gone is success
Compare 8 commits »

2026-07-26 00:04:07 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

7941935f57 fix(traffic): a sample without counters is not zero traffic
2415dde288 fix(deploy,traffic): clear caches before restarts, hide the token, widen the lock
0135f114d3 fix(traffic): keep retrying the throttle release after a Proxmox blip
25c4c5df5a fix(deploy): restart the worker after the hub key, diff against what was deployed
2b70c9226a fix(traffic): release the throttle at month end; close the Livewire bypass
Compare 12 commits »

2026-07-25 23:45:35 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

7ef1b3e5c8 docs(wireguard): document the ownership model and config storage
17d7dc2ad9 fix(vpn): store the config inside the creation transaction
4ffdafc614 fix(vpn): losing the operator roles closes the owner doors by itself
e5f19f8db3 fix(vpn): count downloads in the database; repair the race test
02750a7c9a fix(vpn): lock the owner row while issuing an access
Compare 13 commits »

2026-07-25 22:55:15 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

cad245c5df docs(wireguard): document the VPN console and the invariants behind it
d1302e17bc fix(vpn): purging a host no longer leaves a phantom access behind
c54b718566 fix(vpn): never let an access hijack a host key; name adopted peers correctly
28e681b9df fix(vpn): lock every hub mutation; resolve duplicate keys inside the lock
8eb9d7ad30 fix(vpn): serialize hub reads against hub mutations
Compare 12 commits »

2026-07-25 22:02:47 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

8edb2a69e5 docs(wireguard): bring the management hub up and prove it end-to-end
7247edf9d8 feat(security): keep the operator console off the public hostnames
ba861ad579 fix(security): match ADMIN_HOSTS case-insensitively; share test helpers
f5f4d2a8cd fix(security): close the Livewire bypass of the admin host restriction
1f42c05648 feat(security): admin console can be pinned to non-public hostnames
Compare 5 commits »

2026-07-25 21:06:27 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

db3ef1642b chore: drop stray vim swap file

2026-07-25 20:25:41 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

46d821a047 fix(monitoring): cap monitoring retries at the run budget; dependency-free liveness probe
d1db23398d fix(kuma-bridge): a rejected login is not-ready (was falsely 'up'); clearer connect vs login errors
353df9f054 fix(kuma-bridge): detect Kuma outages and never trust the cached monitor list
82916167cf fix(monitoring): MONITORING_ATTEMPTS is now exact (off-by-one); accept int or dict monitor id
5301ce4309 feat(monitoring): Uptime Kuma support via a REST bridge + resilient monitoring policy
Compare 5 commits »

2026-07-25 20:20:35 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

f06f00c428 chore(config): documented env placeholders + SSH keys from file paths

2026-07-25 19:37:25 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

32fa1028cc fix(portal): cloud status labels for all instance states; scale storage curve into the quota
d05932105d feat(portal): bind the cloud card to the real instance (plan/seats/domain/quota) so the maintenance badge matches it
ac3b3a4e11 fix(portal): scope the per-instance maintenance badge to that instance's host
a321d963d7 fix(portal): no silent no-ops without a customer; maintenance visible per instance; maintenance form redesign
Compare 4 commits »

2026-07-25 19:18:56 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

0b2d762b88 fix(auth): scope registration throttle to its own route (per-IP), not all Fortify endpoints
35a86c413c fix(auth): throttle Fortify endpoints (registration had no limiter — signup-spam guard)
406f753311 fix(admin): remove is_admin self-heal — RBAC is the only console boundary (no revocation bypass)
22cbe9ac39 fix(auth/admin): atomic user+customer signup; Rule::in for country validation (comma-safe)
6ca1e3fba5 fix(auth): create + link a Customer on public signup so the portal works pre-purchase
Compare 14 commits »

2026-07-25 18:43:28 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

87a81f5f40 fix(admin): read-only send-time guard (never drop mail on retry); document exactly-once residual for real-mail outbox
e09965f918 fix(admin): in-flight claim (claimed_at) for exactly-once maintenance send; scope permission rollback
28221549d1 fix(admin): defer maintenance sent_at to real delivery; read-only send-time dedup (no lost mail)
0cc5be5479 fix(admin): atomic send-time delivery claim so backlog duplicates ship exactly once
5b85806605 fix(admin): catch racing ledger insert and re-fetch (idempotent under concurrency)
Compare 21 commits »

2026-07-25 16:41:40 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

99081284a4 fix(portal): delete old logo only after the branding update commits
f6efa4f200 fix(portal): allow closure after failed provisioning; serialize last-owner guard
8bcb5ec268 fix(admin): enforce hosts.datacenter FK (restrictOnDelete) — no deactivation side-effect
249efa0553 fix: serialize datacenter delete (lock+deactivate+recheck); store logo before deleting old
01383e7e5e fix(portal): race-safe owner-seat initialization (firstOrCreate + catch)
Compare 17 commits »

2026-07-25 15:06:23 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

80348d6a3f fix: unique customer↔user link + reject inactive datacenters on host create
b44e224bee fix: backfill datacenters on migrate; resolve billing customer by user link
4e86e135a6 fix(admin): harden impersonation + datacenter code per Codex review
879697c6ea feat(admin): impersonate customer portal — session login + return banner
515f26234e feat(portal): billing page — current plan, upgrades, extra storage, add-ons
Compare 9 commits »

2026-07-25 13:58:19 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

d7c2edb1df fix(engine-b): idempotent local DNS record (firstOrCreate on record_id)
96aceeeaa1 fix(engine-b): stop customer dashboard polling once provisioning failed
66e8a4bbf6 fix(engine-b): clean re-clone on lost task ref; idempotent firewall rules
9162446b1f fix(engine-b): acceptance gate verifies real health, not just breadcrumbs
491800e09c fix(engine-b): grant VM.Backup to the Proxmox automation role
Compare 31 commits »

2026-07-25 13:11:29 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

5e6d6b11b6 docs: engine customer-pipeline spec (the missing Section 3, aligned to the built core)

2026-07-25 11:27:30 +02:00

boban pushed to feat/portal-design at boban/CluPilotCloud

c7fb1ce56d fix(engine): dispatch run continuation after releasing the lock
294c9aef2f fix(engine): store wg_pubkey right after addPeer so failed peers are cleanable
9e664654a2 fix(engine): record wg peer only after verified handshake; async host purge
a6a41719bb fix(engine): long SSH command timeout; wg peer removal on privileged worker
5979470dda fix(engine): install wireguard-tools + bring up wg0; lock-coordinate host removal
Compare 26 commits »

2026-07-25 11:13:40 +02:00