Pulse

danvics/Pulse

Fork 0

Commit graph

Author	SHA1	Message	Date
rcourtman	ca8cc0844a	Fix temperature monitoring on standalone Proxmox nodes (addresses #571 ) Root cause: The systemd service hardening blocked AF_NETLINK sockets, preventing IP address discovery on standalone nodes. The proxy could only discover hostnames, causing node_not_cluster_member rejections when users configured Pulse with IP addresses. Changes: 1. Add AF_NETLINK to RestrictAddressFamilies in all systemd services - pulse-sensor-proxy.service - install-sensor-proxy.sh (both modes) - pulse-sensor-cleanup.service 2. Replace shell-based 'ip addr' with Go native net.Interfaces() API - More reliable and doesn't require external commands - Works even with strict systemd restrictions - Properly filters loopback, link-local, and down interfaces 3. Improve error logging and user guidance - Warn when no IP addresses can be discovered - Provide clear instructions about allowed_nodes workaround - Include address counts in logs for debugging This fix ensures standalone Proxmox nodes can properly validate temperature requests by IP address without requiring manual allowed_nodes configuration.	2025-11-13 13:02:15 +00:00
rcourtman	97f9de6c95	feat(security): Enhance systemd hardening directives Adds additional systemd security directives for defense in depth: - MemoryDenyWriteExecute=true (prevents RWX memory) - RestrictRealtime=true (denies realtime scheduling) - ProtectHostname=true (hostname protection) - ProtectKernelLogs=true (kernel log protection) - SystemCallArchitectures=native (native syscalls only) These directives provide additional layers to slow/prevent post-compromise exploitation of the proxy process. Related to security audit 2025-11-07.	2025-11-07 17:09:47 +00:00
rcourtman	b952444837	refactor: Rename pulse-temp-proxy to pulse-sensor-proxy The name "temp-proxy" implied a temporary or incomplete implementation. The new name better reflects its purpose as a secure sensor data bridge for containerized Pulse deployments. Changes: - Renamed cmd/pulse-temp-proxy/ to cmd/pulse-sensor-proxy/ - Updated all path constants and binary references - Renamed environment variables: PULSE_TEMP_PROXY_* to PULSE_SENSOR_PROXY_* - Updated systemd service and service account name - Updated installation, rotation, and build scripts - Renamed hardening documentation - Maintained backward compatibility for key removal during upgrades	2025-10-13 13:17:05 +00:00

Author

SHA1

Message

Date

rcourtman

ca8cc0844a

Fix temperature monitoring on standalone Proxmox nodes (addresses #571 )

Root cause: The systemd service hardening blocked AF_NETLINK sockets,
preventing IP address discovery on standalone nodes. The proxy could
only discover hostnames, causing node_not_cluster_member rejections
when users configured Pulse with IP addresses.

Changes:
1. Add AF_NETLINK to RestrictAddressFamilies in all systemd services
   - pulse-sensor-proxy.service
   - install-sensor-proxy.sh (both modes)
   - pulse-sensor-cleanup.service

2. Replace shell-based 'ip addr' with Go native net.Interfaces() API
   - More reliable and doesn't require external commands
   - Works even with strict systemd restrictions
   - Properly filters loopback, link-local, and down interfaces

3. Improve error logging and user guidance
   - Warn when no IP addresses can be discovered
   - Provide clear instructions about allowed_nodes workaround
   - Include address counts in logs for debugging

This fix ensures standalone Proxmox nodes can properly validate
temperature requests by IP address without requiring manual
allowed_nodes configuration.

2025-11-13 13:02:15 +00:00

rcourtman

97f9de6c95

feat(security): Enhance systemd hardening directives

Adds additional systemd security directives for defense in depth:
- MemoryDenyWriteExecute=true (prevents RWX memory)
- RestrictRealtime=true (denies realtime scheduling)
- ProtectHostname=true (hostname protection)
- ProtectKernelLogs=true (kernel log protection)
- SystemCallArchitectures=native (native syscalls only)

These directives provide additional layers to slow/prevent
post-compromise exploitation of the proxy process.

Related to security audit 2025-11-07.

2025-11-07 17:09:47 +00:00

rcourtman

b952444837

refactor: Rename pulse-temp-proxy to pulse-sensor-proxy

The name "temp-proxy" implied a temporary or incomplete implementation. The new name better reflects its purpose as a secure sensor data bridge for containerized Pulse deployments.

Changes:
- Renamed cmd/pulse-temp-proxy/ to cmd/pulse-sensor-proxy/
- Updated all path constants and binary references
- Renamed environment variables: PULSE_TEMP_PROXY_* to PULSE_SENSOR_PROXY_*
- Updated systemd service and service account name
- Updated installation, rotation, and build scripts
- Renamed hardening documentation
- Maintained backward compatibility for key removal during upgrades

2025-10-13 13:17:05 +00:00

3 commits