3 commits

Author	SHA1	Message	Date
rcourtman	d856e75018	fix: increase pulse-sensor-proxy rate limits for multi-node support ... - Increase rate limit from 1 req/5sec to 1 req/sec (60/min) - Increase burst from 2 to 5 requests - Fixes temperature collection failures when monitoring 3+ nodes - All requests from containerized Pulse use same UID, causing rate limiting - New limits support 5-10 node deployments comfortably Resolves issue where adding standalone nodes broke temperature monitoring for all nodes due to aggressive rate limiting.	2025-10-21 11:21:12 +00:00
rcourtman	524f42cc28	security: complete Phase 1 sensor proxy hardening ... Implements comprehensive security hardening for pulse-sensor-proxy: - Privilege drop from root to unprivileged user (UID 995) - Hash-chained tamper-evident audit logging with remote forwarding - Per-UID rate limiting (0.2 QPS, burst 2) with concurrency caps - Enhanced command validation with 10+ attack pattern tests - Fuzz testing (7M+ executions, 0 crashes) - SSH hardening, AppArmor/seccomp profiles, operational runbooks All 27 Phase 1 tasks complete. Ready for production deployment.	2025-10-20 15:13:37 +00:00
rcourtman	b952444837	refactor: Rename pulse-temp-proxy to pulse-sensor-proxy ... The name "temp-proxy" implied a temporary or incomplete implementation. The new name better reflects its purpose as a secure sensor data bridge for containerized Pulse deployments. Changes: - Renamed cmd/pulse-temp-proxy/ to cmd/pulse-sensor-proxy/ - Updated all path constants and binary references - Renamed environment variables: PULSE_TEMP_PROXY_* to PULSE_SENSOR_PROXY_* - Updated systemd service and service account name - Updated installation, rotation, and build scripts - Renamed hardening documentation - Maintained backward compatibility for key removal during upgrades	2025-10-13 13:17:05 +00:00