cc3c0187a0
AI Chat Integration: - Multi-provider support (Anthropic, OpenAI, Ollama) - Streaming responses with markdown rendering - Agent command execution for remote troubleshooting - Context-aware conversations with host/container metadata Agent Updates: - Add --enable-proxmox flag for automatic PVE/PBS token setup - Improve auto-update with semver comparison (prevents downgrades) - Add updatedFrom tracking to report previous version after update - Reduce initial update check delay from 30s to 5s - Add agent version column to Hosts page table Host Metrics: - Add DiskIO stats collection (read/write bytes, ops, time) - Improve disk filtering to exclude Docker overlay mounts - Add RAID array monitoring via mdadm - Enhanced temperature sensor parsing Frontend: - New Agent Version column on Hosts overview table - Improved node modal with agent-first installation flow - Add DiskIO display in host drawer - Better responsive handling for metric bars
43 lines
1.4 KiB
Markdown
43 lines
1.4 KiB
Markdown
# 🛡️ Sensor Proxy Hardening
|
|
|
|
> **⚠️ Deprecated:** The sensor-proxy is deprecated in favor of the unified Pulse agent.
|
|
> For new installations, use `install.sh --enable-proxmox` instead.
|
|
> See [TEMPERATURE_MONITORING.md](/docs/security/TEMPERATURE_MONITORING.md).
|
|
|
|
Secure `pulse-sensor-proxy` with AppArmor and Seccomp.
|
|
|
|
## 🛡️ AppArmor
|
|
|
|
Profile: `security/apparmor/pulse-sensor-proxy.apparmor`
|
|
* **Allows**: Configs, logs, SSH keys, outbound TCP/SSH.
|
|
* **Blocks**: Raw sockets, module loading, ptrace, exec outside allowlist.
|
|
|
|
### Install & Enforce
|
|
```bash
|
|
sudo install -m 0644 security/apparmor/pulse-sensor-proxy.apparmor /etc/apparmor.d/pulse-sensor-proxy
|
|
sudo apparmor_parser -r /etc/apparmor.d/pulse-sensor-proxy
|
|
sudo aa-enforce pulse-sensor-proxy
|
|
```
|
|
|
|
## 🔒 Seccomp
|
|
|
|
Profile: `security/seccomp/pulse-sensor-proxy.json`
|
|
* **Allows**: Go runtime syscalls, network, file IO.
|
|
* **Blocks**: Everything else (returns `EPERM`).
|
|
|
|
### Systemd (Classic)
|
|
Add to service override:
|
|
```ini
|
|
[Service]
|
|
AppArmorProfile=pulse-sensor-proxy
|
|
SystemCallFilter=@system-service
|
|
SystemCallAllow=accept;connect;recvfrom;sendto;recvmsg;sendmsg;sendmmsg;getsockname;getpeername;getsockopt;setsockopt;shutdown
|
|
```
|
|
|
|
### Containers (Docker/Podman)
|
|
```bash
|
|
podman run --seccomp-profile /opt/pulse/security/seccomp/pulse-sensor-proxy.json ...
|
|
```
|
|
|
|
## 🔍 Verification
|
|
Check status with `aa-status` or `journalctl -t auditbeat`.
|