diff --git a/internal/api/config_handlers.go b/internal/api/config_handlers.go index 0bcb2b5..f575f42 100644 --- a/internal/api/config_handlers.go +++ b/internal/api/config_handlers.go @@ -3579,15 +3579,15 @@ if command -v pct >/dev/null 2>&1 && [ "$TEMPERATURE_ENABLED" = true ]; then if [ -n "$PULSE_CTID" ]; then echo "" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" - echo "📦 Container Detection" + echo "🔒 Enhanced Security" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" echo "" - echo "Detected Pulse running in LXC container $PULSE_CTID" + echo "Detected: Pulse running in container $PULSE_CTID" echo "" - echo "For enhanced security, install pulse-sensor-proxy on this host." - echo "This keeps SSH keys outside the container for better isolation." + echo "Recommended: Install secure proxy for temperature monitoring" + echo "This keeps credentials isolated outside the container." echo "" - echo "Install pulse-sensor-proxy for container $PULSE_CTID? [Y/n]" + echo "Enable secure proxy? [Y/n]" echo -n "> " INSTALL_PROXY="y" @@ -3605,21 +3605,14 @@ if command -v pct >/dev/null 2>&1 && [ "$TEMPERATURE_ENABLED" = true ]; then echo "" if [[ $INSTALL_PROXY =~ ^[Yy]$|^$ ]]; then - echo "Installing pulse-sensor-proxy..." - # Download installer script PROXY_INSTALLER="/tmp/install-sensor-proxy-$$.sh" if curl -fsSL "https://github.com/rcourtman/Pulse/releases/latest/download/install-sensor-proxy.sh" -o "$PROXY_INSTALLER" 2>/dev/null; then chmod +x "$PROXY_INSTALLER" - # Run installer - if "$PROXY_INSTALLER" --ctid "$PULSE_CTID" 2>&1; then - echo "" - echo "✓ pulse-sensor-proxy installed successfully" - echo "" - - # Clean up old container-based SSH keys from nodes - echo "Cleaning up legacy SSH keys from cluster nodes..." + # Run installer (suppress verbose output) + if "$PROXY_INSTALLER" --ctid "$PULSE_CTID" --quiet 2>&1 | grep -E "✓|⚠️|ERROR" || "$PROXY_INSTALLER" --ctid "$PULSE_CTID" 2>&1 | grep -E "✓|⚠️|ERROR"; then + # Clean up old container-based SSH keys from nodes (silent) CLEANUP_NODES="" if [ "$TEMPERATURE_ENABLED" = true ]; then CLEANUP_NODES="$(hostname)" @@ -3630,41 +3623,29 @@ if command -v pct >/dev/null 2>&1 && [ "$TEMPERATURE_ENABLED" = true ]; then for NODE in $CLEANUP_NODES; do if [ -n "$NODE" ] && [ -n "$SSH_PUBLIC_KEY" ]; then - # Remove the old pulse@ keys (but not pulse-sensor-proxy keys) ssh -o BatchMode=yes -o StrictHostKeyChecking=no -o ConnectTimeout=5 -o LogLevel=ERROR \ root@"$NODE" \ "sed -i '/$SSH_PUBLIC_KEY/d' /root/.ssh/authorized_keys 2>/dev/null || true" \ - >/dev/null 2>&1 && echo " ✓ Cleaned up legacy key on $NODE" || true + >/dev/null 2>&1 fi done echo "" - echo "Temperature monitoring will now use the secure proxy architecture." - echo "SSH keys are stored on the host, not inside the container." + echo "✓ Secure proxy architecture enabled" + echo " SSH keys are managed on the host for enhanced security" else echo "" - echo "⚠️ Proxy installation failed. Temperature monitoring will use direct SSH." - echo "" - echo "To install manually later:" - echo " curl -fsSL https://github.com/rcourtman/Pulse/releases/latest/download/install-sensor-proxy.sh | bash -s -- --ctid $PULSE_CTID" + echo "⚠️ Installation incomplete - using standard configuration" fi - # Cleanup rm -f "$PROXY_INSTALLER" else echo "" - echo "⚠️ Could not download proxy installer. Temperature monitoring will use direct SSH." - echo "" - echo "To install manually later:" - echo " curl -fsSL https://github.com/rcourtman/Pulse/releases/latest/download/install-sensor-proxy.sh | bash -s -- --ctid $PULSE_CTID" + echo "⚠️ Network issue - using standard configuration" + echo " (Proxy can be installed later for enhanced security)" fi else - echo "Proxy installation skipped." - echo "" - echo "Temperature monitoring will use direct SSH (keys stored in container)." - echo "" - echo "To install proxy later for enhanced security:" - echo " curl -fsSL https://github.com/rcourtman/Pulse/releases/latest/download/install-sensor-proxy.sh | bash -s -- --ctid $PULSE_CTID" + echo "Using standard configuration" fi fi fi diff --git a/scripts/install-sensor-proxy.sh b/scripts/install-sensor-proxy.sh index 9f83015..2ed2b32 100755 --- a/scripts/install-sensor-proxy.sh +++ b/scripts/install-sensor-proxy.sh @@ -12,7 +12,9 @@ YELLOW='\033[1;33m' NC='\033[0m' # No Color print_info() { - echo -e "${GREEN}[INFO]${NC} $1" + if [ "$QUIET" != true ]; then + echo -e "${GREEN}[INFO]${NC} $1" + fi } print_warn() { @@ -23,6 +25,10 @@ print_error() { echo -e "${RED}[ERROR]${NC} $1" } +print_success() { + echo -e "${GREEN}✓${NC} $1" +} + # Check if running on Proxmox host if ! command -v pvecm >/dev/null 2>&1; then print_error "This script must be run on a Proxmox VE host" @@ -33,6 +39,7 @@ fi CTID="" VERSION="latest" LOCAL_BINARY="" +QUIET=false while [[ $# -gt 0 ]]; do case $1 in @@ -48,6 +55,10 @@ while [[ $# -gt 0 ]]; do LOCAL_BINARY="$2" shift 2 ;; + --quiet) + QUIET=true + shift + ;; *) print_error "Unknown option: $1" exit 1 @@ -287,32 +298,29 @@ LEGACY_KEYS_FOUND=false for key_type in id_rsa id_dsa id_ecdsa id_ed25519; do if pct exec "$CTID" -- test -f "/root/.ssh/$key_type" 2>/dev/null; then LEGACY_KEYS_FOUND=true - print_warn "Found legacy SSH key: /root/.ssh/$key_type" + if [ "$QUIET" != true ]; then + print_warn "Found legacy SSH key: /root/.ssh/$key_type" + fi pct exec "$CTID" -- rm -f "/root/.ssh/$key_type" "/root/.ssh/${key_type}.pub" - print_info " Removed /root/.ssh/$key_type (proxy will handle SSH)" + print_info " Removed /root/.ssh/$key_type" fi done -if [ "$LEGACY_KEYS_FOUND" = true ]; then +if [ "$LEGACY_KEYS_FOUND" = true ] && [ "$QUIET" != true ]; then print_info "" - print_info "${YELLOW}Legacy SSH keys removed from container${NC}" - print_info "The proxy on the host now handles all SSH connections" - print_info "This improves security by keeping keys outside the container" + print_info "Legacy SSH keys removed from container for security" print_info "" fi -print_info "${GREEN}Installation complete!${NC}" -print_info "" -print_info "Temperature monitoring will now use the secure host-side proxy" -print_info "SSH keys are stored on the Proxmox host, not in the container" -print_info "" -print_info "To configure temperature monitoring for cluster nodes:" -print_info " 1. Access Pulse UI in container $CTID" -print_info " 2. Go to Settings → Enable Temperature Monitoring" -print_info " 3. The proxy will automatically discover and configure cluster nodes" -print_info "" -print_info "To check proxy status:" -print_info " systemctl status pulse-sensor-proxy" -print_info " journalctl -u pulse-sensor-proxy -f" +if [ "$QUIET" = true ]; then + print_success "pulse-sensor-proxy installed and running" +else + print_info "${GREEN}Installation complete!${NC}" + print_info "" + print_info "Temperature monitoring will use the secure host-side proxy" + print_info "" + print_info "To check proxy status:" + print_info " systemctl status pulse-sensor-proxy" +fi exit 0