danvics/Pulse
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix Docker agent removal and improve security

Browse source 
This commit addresses multiple issues in the Docker/host agent removal flow:

Agent Stop Fix:
- Add systemctl stop command after agent acknowledgement to prevent systemd restart
- Previous behavior: agent disabled but systemd immediately restarted it (Restart=always)
- New behavior: agent disables itself, sends ack, then stops systemd service completely

UX Improvements:
- Add real-time elapsed time counter during removal wait
- Show progress indicators prominently (no longer hidden in dropdown)
- Display expected time range (30-60 seconds) and last heartbeat
- Auto-show timeout warning after 2 minutes with actionable "Force remove" button
- Add contextual help explaining what's happening at each stage

Security Enhancement:
- Automatically revoke API tokens when removing Docker/host agents
- Previous behavior: tokens remained valid after agent removal
- New behavior: tokens are revoked and persisted immediately on removal
- Prevents removed agents from re-authenticating with old credentials
This commit is contained in:
rcourtman 2025-10-29 12:27:36 +00:00
parent 32392d1212
commit 730c6bf864
3 changed files with 212 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

140
frontend-modern/src/components/Settings/DockerAgents.tsx
View file

@ -42,6 +42,8 @@ export const DockerAgents: Component = () => {
const [currentToken, setCurrentToken] = createSignal<string | null>(null);
const [latestRecord, setLatestRecord] = createSignal<APITokenRecord | null>(null);
const [tokenName, setTokenName] = createSignal('');
const [commandQueuedTime, setCommandQueuedTime] = createSignal<Date | null>(null);
const [elapsedSeconds, setElapsedSeconds] = createSignal(0);
const pulseUrl = () => {
if (typeof window !== 'undefined') {
@ -120,6 +122,24 @@ const modalCommandProgress = createMemo(() => {
});
});
const modalCommandTimedOut = createMemo(() => {
return modalCommandInProgress() && elapsedSeconds() > 120; // 2 minutes
});
const modalLastHeartbeat = createMemo(() => {
const host = hostToRemove();
return host?.lastReportTime ? formatRelativeTime(new Date(host.lastReportTime)) : null;
});
const formatElapsedTime = (seconds: number) => {
if (seconds < 60) {
return `${seconds}s`;
}
const mins = Math.floor(seconds / 60);
const secs = seconds % 60;
return `${mins}m ${secs}s`;
};
createEffect(() => {
if (!showRemoveModal()) return;
const id = hostToRemoveId();
@ -129,6 +149,35 @@ const modalCommandProgress = createMemo(() => {
}
});
// Track elapsed time for command execution
createEffect(() => {
const cmd = modalCommand();
if (!cmd) {
setCommandQueuedTime(null);
setElapsedSeconds(0);
return;
}
// Set queued time when command first appears
if (cmd.createdAt && !commandQueuedTime()) {
setCommandQueuedTime(new Date(cmd.createdAt));
}
// Update elapsed time every second while command is in progress
if (modalCommandInProgress()) {
const interval = setInterval(() => {
const queuedTime = commandQueuedTime();
if (queuedTime) {
const now = new Date();
const elapsed = Math.floor((now.getTime() - queuedTime.getTime()) / 1000);
setElapsedSeconds(elapsed);
}
}, 1000);
return () => clearInterval(interval);
}
});
onMount(() => {
if (typeof window === 'undefined') {
return;
@ -598,7 +647,69 @@ WantedBy=multi-user.target`;
})()}
</button>
<Show when={modalCommandInProgress()}>
<p class="text-xs text-blue-700 dark:text-blue-300">Hang tight—Pulse is waiting for the agent to acknowledge the stop command.</p>
<div class="space-y-3">
{/* Progress steps */}
<div class="rounded border border-blue-200 bg-white p-3 dark:border-blue-700 dark:bg-blue-800/20">
<div class="mb-2 flex items-center justify-between">
<span class="text-xs font-semibold uppercase tracking-wide text-blue-700 dark:text-blue-300">Progress</span>
<span class="text-xs text-blue-600 dark:text-blue-400">{formatElapsedTime(elapsedSeconds())} elapsed</span>
</div>
<ul class="space-y-1.5">
<For each={modalCommandProgress()}>
{(step) => (
<li
class={`${step.done || step.active ? 'text-blue-700 dark:text-blue-200' : 'text-gray-500 dark:text-gray-400'} flex items-center gap-2 text-xs`}
>
<span
class={`h-2 w-2 flex-shrink-0 rounded-full ${
step.done
? 'bg-blue-500'
: step.active
? 'bg-blue-400 animate-pulse'
: 'bg-gray-300 dark:bg-gray-600'
}`}
/>
{step.label}
</li>
)}
</For>
</ul>
</div>
{/* Expected time and last heartbeat */}
<div class="flex items-start gap-2 text-xs text-blue-700 dark:text-blue-300">
<svg class="w-4 h-4 mt-0.5 flex-shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor">
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
</svg>
<div>
<p>
<Show when={!modalCommandTimedOut()} fallback="This is taking longer than expected.">
This usually takes 30-60 seconds.
</Show>
<Show when={modalLastHeartbeat()}>
{' '}Last heartbeat: {modalLastHeartbeat()}.
</Show>
</p>
</div>
</div>
{/* Timeout warning */}
<Show when={modalCommandTimedOut()}>
<div class="rounded border border-yellow-200 bg-yellow-50 p-3 dark:border-yellow-700 dark:bg-yellow-900/20">
<div class="flex items-start gap-2">
<svg class="w-4 h-4 mt-0.5 flex-shrink-0 text-yellow-600 dark:text-yellow-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
</svg>
<div class="flex-1 text-xs">
<p class="font-semibold text-yellow-900 dark:text-yellow-100">Command taking longer than expected</p>
<p class="mt-1 text-yellow-800 dark:text-yellow-200">
The agent may be offline or experiencing issues. Consider using "Force remove now" below to skip the agent stop and remove the host immediately.
</p>
</div>
</div>
</div>
</Show>
</div>
</Show>
<Show when={modalCommandCompleted()}>
<div class="rounded border border-emerald-200 bg-white p-3 text-xs text-emerald-800 dark:border-emerald-700 dark:bg-emerald-900/20 dark:text-emerald-100">
@ -661,6 +772,33 @@ WantedBy=multi-user.target`;
</div>
</div>
{/* Force remove option when command times out */}
<Show when={modalCommandTimedOut()}>
<div class="rounded-lg border border-orange-200 bg-orange-50 p-4 dark:border-orange-800 dark:bg-orange-900/20">
<div class="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
<div class="flex items-start gap-3">
<svg class="w-5 h-5 text-orange-600 dark:text-orange-400 mt-0.5 flex-shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor">
<path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 10V3L4 14h7v7l9-11h-7z" />
</svg>
<div>
<h4 class="text-sm font-semibold text-orange-900 dark:text-orange-100">Skip waiting and remove now</h4>
<p class="text-sm text-orange-800 dark:text-orange-200">
Still waiting after {formatElapsedTime(elapsedSeconds())}. Remove the host entry immediately without waiting for the agent.
</p>
</div>
</div>
<button
type="button"
onClick={handleRemoveHostNow}
disabled={removeActionLoading() !== null}
class="self-start rounded bg-orange-600 px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-orange-700 disabled:cursor-not-allowed disabled:opacity-60 dark:bg-orange-500 dark:hover:bg-orange-400 whitespace-nowrap"
>
{removeActionLoading() === 'force' ? 'Removing…' : 'Force remove now'}
</button>
</div>
</div>
</Show>
<Show when={!modalHostIsOnline()}>
<div class="rounded-lg border border-emerald-200 bg-emerald-50 p-4 dark:border-emerald-800 dark:bg-emerald-900/20">
<div class="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">

39
internal/dockeragent/agent.go
View file

@ -702,6 +702,19 @@ func (a *Agent) handleStopCommand(ctx context.Context, target TargetConfig, comm
}
a.logger.Info().Msg("Stop command acknowledged; terminating agent")
// After sending the acknowledgement, stop the systemd service to prevent restart.
// This is done after the ack to ensure the acknowledgement is sent before the
// process is terminated by systemctl stop.
go func() {
// Small delay to ensure the ack response completes
time.Sleep(1 * time.Second)
stopServiceCtx := context.Background()
if err := stopSystemdService(stopServiceCtx, "pulse-docker-agent"); err != nil {
a.logger.Warn().Err(err).Msg("Failed to stop systemd service, agent will exit normally")
}
}()
return ErrStopRequested
}
@ -743,6 +756,32 @@ func disableSystemdService(ctx context.Context, service string) error {
return nil
}
func stopSystemdService(ctx context.Context, service string) error {
if _, err := exec.LookPath("systemctl"); err != nil {
// Not a systemd environment; nothing to do.
return nil
}
// Stop the service to terminate the current running instance.
// This prevents systemd from restarting the service (services stopped via
// systemctl stop are not restarted even with Restart=always).
cmd := exec.CommandContext(ctx, "systemctl", "stop", service)
output, err := cmd.CombinedOutput()
if err != nil {
if exitErr, ok := err.(*exec.ExitError); ok {
exitCode := exitErr.ExitCode()
lowerOutput := strings.ToLower(string(output))
// Ignore "not found" errors since the service might already be stopped
if exitCode == 5 || strings.Contains(lowerOutput, "could not be found") || strings.Contains(lowerOutput, "not-found") {
return nil
}
}
return fmt.Errorf("systemctl stop %s: %w (%s)", service, err, strings.TrimSpace(string(output)))
}
return nil
}
func removeFileIfExists(path string) error {
if err := os.Remove(path); err != nil {
if errors.Is(err, os.ErrNotExist) {

34
internal/monitoring/monitor.go
View file

@ -834,6 +834,23 @@ func (m *Monitor) RemoveDockerHost(hostID string) (models.DockerHost, error) {
}
}
// Revoke the API token associated with this Docker host
if host.TokenID != "" {
tokenRemoved := m.config.RemoveAPIToken(host.TokenID)
if tokenRemoved {
m.config.SortAPITokens()
m.config.APITokenEnabled = m.config.HasAPITokens()
if m.persistence != nil {
if err := m.persistence.SaveAPITokens(m.config.APITokens); err != nil {
log.Warn().Err(err).Str("tokenID", host.TokenID).Msg("Failed to persist API token revocation after Docker host removal")
} else {
log.Info().Str("tokenID", host.TokenID).Str("tokenName", host.TokenName).Msg("API token revoked for removed Docker host")
}
}
}
}
// Track removal to prevent resurrection from cached reports
m.mu.Lock()
m.removedDockerHosts[hostID] = time.Now()
@ -876,6 +893,23 @@ func (m *Monitor) RemoveHostAgent(hostID string) (models.Host, error) {
}
}
// Revoke the API token associated with this host agent
if host.TokenID != "" {
tokenRemoved := m.config.RemoveAPIToken(host.TokenID)
if tokenRemoved {
m.config.SortAPITokens()
m.config.APITokenEnabled = m.config.HasAPITokens()
if m.persistence != nil {
if err := m.persistence.SaveAPITokens(m.config.APITokens); err != nil {
log.Warn().Err(err).Str("tokenID", host.TokenID).Msg("Failed to persist API token revocation after host agent removal")
} else {
log.Info().Str("tokenID", host.TokenID).Str("tokenName", host.TokenName).Msg("API token revoked for removed host agent")
}
}
}
}
m.state.RemoveConnectionHealth(hostConnectionPrefix + hostID)
log.Info().