mosona-labs/mosona-manager v0.1.12

on GitHub

Please refer to the Quickstart (Docs) for detailed instructions on installation and configuration.

Full Changelog: v0.1.10...v0.1.12

⚠️

1. This release re-encrypts stored SSH credentials at startup (legacy AES-CBC → versioned AES-GCM). Read the upgrade notes before applying to auto-updating or unattended instances.
2. Do not roll back the image afterwards — builds prior to v0.1.11 cannot read the new credential format and may crash.

Security

1. End-to-end credential encryption — versioned AES-GCM envelopes bound to record context, with automatic migration of legacy CBC ciphertexts.
2. Hardened master key handling — fail-closed (no silent regeneration when credentials exist), enforced file permissions/ownership, symlinks rejected.
3. SSH host key pinning — new/edited servers record and enforce host keys; existing servers keep connecting (trust_legacy_host_key) and can be pinned by confirming on edit.
4. Stronger auth & sessions — team sessions revoked on member removal; revoked team access is rejected instead of silently downgrading to viewer; admin self-deletion / self-demotion / last-admin removal rejected with re-authentication required.
5. OIDC support with discovery, plus validation of OAuth identity subjects (rejects empty/0/whitespace subjects).
6. Resource bounds everywhere — per-IP / per-team / global SSE limits for public preview streams; request/response size limits; upload limits; HTTP timeouts on the active-agent server.
7. Scoped data access — server categories, alert upserts, and notification delivery are now scoped to the owning team; category deletion is atomic.
8. Secret redaction — smtp_password and captcha_secret are redacted in admin settings responses.

New

1. Readiness / liveness health endpoints — /health/ready probes Postgres, Redis, and InfluxDB.
2. Notification target pre-validation — POST /api/team/notification/validate validates targets before saving.
3. OIDC protocol selection for OAuth providers.
4. Generic webhook notifications with template allowlist and redirect policy.

Fix

1. Audit log writes are now queued & drained (bounded queue, graceful shutdown drain) instead of unbounded fire-and-forget goroutines.
2. Cleaner server connection lifecycle — duplicate monitoring connections replaced, old connections awaited on edit/delete/reinstall, agent connections closed on access revocation.
3. Passive-agent WebSocket shutdown is now permanent instead of silently reconnecting after server-initiated close.
4. Database transactions now roll back on every exit path.
5. Auto-renewals catch up — long-expired auto-renew servers advance to the next future period instead of one period per hour.
6. Unified Redis password config (REDIS_PASSWORD / REDIS_PASS).
7. Preserved legacy SSH connectivity during host-key pinning rollout.
8. Alert configuration bounds enforced on both write paths and existing data.
9. Consistent email sending and base-host / trust-proxy handling.

Web

1. Validate notification targets before saving (dedicated validation endpoint).
2. Password re-authentication dialogs for privileged changes and protected user deletion.
3. Team owner role / removal controls disabled in the member editor.
4. SSH host key confirmation when adding or editing servers.
5. Graceful handling of revoked team sessions (redirect instead of broken state).
6. OAuth identity protocol configuration (OAuth 2.0 / OIDC).
7. Edit & delete actions on dashboard server cards, exposed via a shared context menu with a touch-friendly kebab trigger. (web#5)
8. Avatar source switched from gravatar.webp.se → www.gravatar.com. (web#2)