shcizo/package-updater
1
0
Fork 0
Code Issues 8 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat: master/agent phase 1 — live inventory (#6) #19

Merged
shcizo merged 19 commits from feat/master-agent-inventory-6 into main 2026-10-12 13:50:13 +00:00
Conversation 0 Commits 19 Files Changed 60
+5532 -8
19 Commits
Author SHA1 Message Date
shcizo 2fe9b5ba0d fix(master): block inventory writes from revoked agents (#6) 
ApplySnapshot and UpsertService now take a FOR SHARE lock on the agent's
row and refuse with model.ErrRevoked when it is revoked. RevokeAgent's
UPDATE waits on that lock, so an in-flight snapshot or upsert can no
longer bring a revoked agent's services back after the revoke cleanup.
 2026-10-12 15:18:51 +02:00
shcizo 0e9e34db06 fix: address final review findings for master/agent phase 1 (#6) 
- inventory: resolve the image reference via ContainerInspect when a moved
  tag makes ContainerList report the image ID
- store: allow reusing a revoked agent's name (partial unique index) and
  mark the revoked agent's compose/container services removed
- web: publish a services event on revoke; no-store on the one-time token page
- webauth: reject empty OIDC state; accept the CSRF form token from the body only
- agent conn: bound the WebSocket handshake to 30s
- hub: log agent_replaced when a connection replaces an older one
 2026-10-12 15:16:29 +02:00
shcizo 4f092eaf79 docs: document master/agent phase 1 and add master stack example 2026-10-12 15:04:43 +02:00
shcizo 05610391e3 test: agent to master inventory over pinned TLS end to end 2026-10-12 15:02:50 +02:00
shcizo e8f7cb3378 feat(master): add updater-master binary wiring store, hub, auth and UI 2026-10-12 15:01:11 +02:00
shcizo a596d67728 feat(master): htmx UI with live service overview and agent management 
Vendored static assets (sha256):
e209dda5c8235479f3166defc7750e1dbcd5a5c1808b7792fc2e6733768fb447  htmx.min.js (htmx.org@2.0.4)
83eca6fa0611fe2b0bf1700b424b88b5eced38ef448ef9760a2ea08fbc875611  htmx-ext-sse.js (htmx-ext-sse@2.2.2)
 2026-10-12 14:57:23 +02:00
shcizo b4894db6d7 feat(master): OIDC login with group check, sessions and CSRF protection 2026-10-12 14:54:11 +02:00
shcizo 049324b2f4 fix(master): recheck revocation after register, reject duplicate hello 2026-10-12 14:52:24 +02:00
shcizo 75e28262f8 feat(master): agent hub that authenticates agents and stores their inventory 2026-10-12 14:50:22 +02:00
shcizo 5d75f9a7da feat(master): in-process broker for live UI change signals 2026-10-12 14:48:03 +02:00
shcizo 8a1fb45971 feat(master): store service inventory snapshots and web sessions 2026-10-12 14:45:46 +02:00
shcizo 99c553b7c6 feat(master): postgres store with migrations, master identity and agents 2026-10-12 14:43:34 +02:00
shcizo 9b74286c9b feat(agent): add updater-agent binary and ship it in the image 2026-10-12 14:41:05 +02:00
shcizo ad6ff1e066 feat(agent): connect to master over pinned TLS and stream inventory 2026-10-12 14:38:14 +02:00
shcizo 3edaf4e602 feat(agent): diff inventories and debounce docker events 2026-10-12 14:36:11 +02:00
shcizo abee9abb1b feat(agent): collect compose, swarm and container inventory from docker 2026-10-12 14:34:13 +02:00
shcizo 61e738e39d feat: pinned master key TLS and per-agent tokens 2026-10-12 14:32:40 +02:00
shcizo b482c2e29c feat(protocol): define agent-to-master wire messages 2026-10-12 14:31:18 +02:00
shcizo adeddf0254 feat(imageref): parse image references into repo, tag and digest 2026-10-12 14:29:52 +02:00