rcourtman cc3c0187a0 feat: AI features, agent improvements, and host monitoring enhancements

AI Chat Integration:
- Multi-provider support (Anthropic, OpenAI, Ollama)
- Streaming responses with markdown rendering
- Agent command execution for remote troubleshooting
- Context-aware conversations with host/container metadata

Agent Updates:
- Add --enable-proxmox flag for automatic PVE/PBS token setup
- Improve auto-update with semver comparison (prevents downgrades)
- Add updatedFrom tracking to report previous version after update
- Reduce initial update check delay from 30s to 5s
- Add agent version column to Hosts page table

Host Metrics:
- Add DiskIO stats collection (read/write bytes, ops, time)
- Improve disk filtering to exclude Docker overlay mounts
- Add RAID array monitoring via mdadm
- Enhanced temperature sensor parsing

Frontend:
- New Agent Version column on Hosts overview table
- Improved node modal with agent-first installation flow
- Add DiskIO display in host drawer
- Better responsive handling for metric bars

2025-12-05 10:37:02 +00:00

1.4 KiB

Raw Blame History

🛡️ Sensor Proxy Hardening

⚠️ Deprecated: The sensor-proxy is deprecated in favor of the unified Pulse agent. For new installations, use install.sh --enable-proxmox instead. See TEMPERATURE_MONITORING.md.

Secure pulse-sensor-proxy with AppArmor and Seccomp.

🛡️ AppArmor

Profile: security/apparmor/pulse-sensor-proxy.apparmor

Allows: Configs, logs, SSH keys, outbound TCP/SSH.
Blocks: Raw sockets, module loading, ptrace, exec outside allowlist.

Install & Enforce

sudo install -m 0644 security/apparmor/pulse-sensor-proxy.apparmor /etc/apparmor.d/pulse-sensor-proxy
sudo apparmor_parser -r /etc/apparmor.d/pulse-sensor-proxy
sudo aa-enforce pulse-sensor-proxy

🔒 Seccomp

Profile: security/seccomp/pulse-sensor-proxy.json

Allows: Go runtime syscalls, network, file IO.
Blocks: Everything else (returns EPERM).

Systemd (Classic)

Add to service override:

[Service]
AppArmorProfile=pulse-sensor-proxy
SystemCallFilter=@system-service
SystemCallAllow=accept;connect;recvfrom;sendto;recvmsg;sendmsg;sendmmsg;getsockname;getpeername;getsockopt;setsockopt;shutdown

Containers (Docker/Podman)

podman run --seccomp-profile /opt/pulse/security/seccomp/pulse-sensor-proxy.json ...

🔍 Verification

Check status with aa-status or journalctl -t auditbeat.

1.4 KiB Raw Blame History