feat: Settings hub, automation API, bundled docs, npm migration#5630
Open
salexson wants to merge 69 commits into
Open
feat: Settings hub, automation API, bundled docs, npm migration#5630salexson wants to merge 69 commits into
salexson wants to merge 69 commits into
Conversation
Store encrypted DNS credentials on /data with optional Vault/AWS/Azure/ Infisical/HTTP providers via OIDC. Add API keys, async certificate jobs, signed webhooks, certificate PUT, UI, docs, and Cypress coverage. Co-authored-by: Cursor <cursoragent@cursor.com>
Link the automation API in docs, harden /data/credentials permissions, add Cypress coverage for jobs, webhooks, API keys, and vault-based DNS certs, and retry webhook delivery up to three times. Co-authored-by: Cursor <cursoragent@cursor.com>
Replace pending.enc placeholders for Snyk, merge vault/automation strings into all locales, add optional Vault compose profile and Cypress tests, and document certificate.failed webhooks. Co-authored-by: Cursor <cursoragent@cursor.com>
Replace English fallbacks with proper translations in 21 locale files and add locale-translate-vault.cjs for maintaining vault-related keys. Co-authored-by: Cursor <cursoragent@cursor.com>
Second-pass wording aligned with existing NPM terminology, plus a review guide for native-speaker sign-off. Co-authored-by: Cursor <cursoragent@cursor.com>
Enable local and CI builds of docker.io/salexson/nginx-proxy-manager with Infisical OIDC for Hub credentials at /Docker. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Private general-alexson/.github-private cannot be resolved as a cross-repo action without explicit sharing. Co-authored-by: Cursor <cursoragent@cursor.com>
Remove vendored copy now that private action access is enabled for org repos. Co-authored-by: Cursor <cursoragent@cursor.com>
GitHub only allows private org repos to call general-alexson/.github-private actions. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
GitHub forbids private forks of public upstream; org private actions require private repos. Co-authored-by: Cursor <cursoragent@cursor.com>
GitHub-hosted runners cannot reach the internal vault URL. Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid docker run newuidmap failures; drop buildx multi-arch on self-hosted. Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid nested docker run on rootless runners; image build via docker/build-push-action. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Align Button variants and TableLayout with existing Tabler patterns. Co-authored-by: Cursor <cursoragent@cursor.com>
Buildx and build-push-action spawn nested rootless containers that fail newuidmap. Co-authored-by: Cursor <cursoragent@cursor.com>
In-runner docker shim hits rootless newuidmap; remote matches working infra workflows. Co-authored-by: Cursor <cursoragent@cursor.com>
…connectivity check). Co-authored-by: Cursor <cursoragent@cursor.com>
… PATH. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
…d systemd. Co-authored-by: Cursor <cursoragent@cursor.com>
…atest. Co-authored-by: Cursor <cursoragent@cursor.com>
…six. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Deploy workflow loads private/public keys from Infisical and drops the signing project and short-lived cert step. Co-authored-by: Cursor <cursoragent@cursor.com>
Use an isolated known_hosts file populated by ssh-keyscan so stale runner keys do not block Ansible. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid npm deprecation/CWE-502 warning from transitive 1.2.0 via mdast-util-to-hast; add package-lock for reproducible CI installs. Co-authored-by: Cursor <cursoragent@cursor.com>
…er fixes. Describe all 91 path operations for Vacuum/Redoc, regenerate openapi.json, document :3082 live schema vs :3081/documentation, and add nginx example for proxying /api when docs are on a separate hostname. Co-authored-by: Cursor <cursoragent@cursor.com>
Show a full-width VitePress iframe only; keep ?path= deep links from Help modals. Co-authored-by: Cursor <cursoragent@cursor.com>
Replace the standalone Credentials page with a Settings tab above external credential stores, redirect /credentials, and preserve access for credentials-only users. Co-authored-by: Cursor <cursoragent@cursor.com>
Remove Yarn Classic and Berry usage from CI, Docker builds, and dev overlays to eliminate Node DEP0169/DEP0040 warnings from the frozen Yarn CLI. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Address Snyk findings with API JSON responses, upload limits, path validation in CI scripts, allowlisted documentation iframe sections, and test dependency overrides. Add SECURITY.md and .snyk policy, move OpenAPI descriptions to JSON, and update README/VitePress/help for Settings tabs and npm workflow. Co-authored-by: Cursor <cursoragent@cursor.com>
Validate JWT_FILE under RUNNER_TEMP as github-oidc.jwt instead of a hosted-only .json regex, and require GITHUB_ENV under the same temp tree. Co-authored-by: Cursor <cursoragent@cursor.com>
Point sync-version, CI workflows, and publish scripts at .version; set fork release to 3.0.0 and remove VERSION. Co-authored-by: Cursor <cursoragent@cursor.com>
Restore upstream .version and package versions, drop v* workflow triggers and Hub semver tags, disable publish-semver and CLI version bumps, and document upstream-owned releases. Co-authored-by: Cursor <cursoragent@cursor.com>
Docs and deploy guides now describe local scripts and Ansible only, suitable for changes intended to merge upstream without fork workflow details. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Align SECURITY.md and VERSIONING.md with official project tone, generalize deploy docs and inventory example, and use NginxProxyManager links and jc21 image names. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Product-only contribution for upstream (no .github workflows/actions, no deploy/ansible). - Settings with DNS credentials, external stores, API keys, webhooks; /credentials redirect - Automation API: API keys, webhooks, async jobs, expanded OpenAPI - VitePress docs at /docs/, in-app documentation, Swagger/Redoc - Credential providers (Vault, AWS, Azure, Infisical, HTTP OIDC); credential_ref on certs - Security: res.json(), upload limits, setup roles, SECURITY.md, .snyk for express-fileupload - Yarn to npm; example nginx proxy at docker/docs-api-proxy.conf.example Co-authored-by: Cursor <cursoragent@cursor.com>
The parallel Docs stage runs yarn install on the host while frontend-build was writing root-owned node_modules into docs/, causing EACCES failures. Co-authored-by: Cursor <cursoragent@cursor.com>
Document version.string in the OpenAPI health schema so swagger validation passes, and use cy.env() for optional Vault integration tests. Co-authored-by: Cursor <cursoragent@cursor.com>
The Jenkins certbot-node image rejects npm ci when peer deps differ from the lockfile. Use npm install in the temp docs copy and chain build steps so a docs failure cannot continue to frontend packaging. Co-authored-by: Cursor <cursoragent@cursor.com>
Isolated docs builds copy only docs/ into /tmp, so generate-openapi.mjs was resolving backend/schema relative to /tmp. Support NPM_REPO_ROOT and set it to /app in the CI frontend-build script. Co-authored-by: Cursor <cursoragent@cursor.com>
Cypress with allowCypressEnv disabled requires cy.env([key]) rather than cy.env(key). Default VAULT_INTEGRATION to 0 in CI config so the suite skips. Co-authored-by: Cursor <cursoragent@cursor.com>
Re-register credentials, credential-providers, api-keys, jobs, and webhooks in swagger.json with component schemas and examples so Cypress swagger validation and vacuum lint pass in CI. Co-authored-by: Cursor <cursoragent@cursor.com>
Assert API error messages via error.message, use CI-provisioned domain for async cert jobs, and document async certificate and provider test responses in OpenAPI. Co-authored-by: Cursor <cursoragent@cursor.com>
Job GET responses include error: null while running; typeof null is object so _handleResponse crashed reading .message before the spec could validate the payload. Co-authored-by: Cursor <cursoragent@cursor.com>
salexson
changed the title
Utils.test imported the locale barrel, which pulled in IntlProvider and gitignored lang/*.json files. On CI that could fail vitest with an empty JSON parse error before locale-compile output was usable. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Docker Image for build 10 is available on DockerHub: Note Ensure you backup your NPM instance before testing this image! Especially if there are database changes. Warning Changes and additions to DNS Providers require verification by at least 2 members of the community! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR contributes product and documentation changes only. It does not include GitHub Actions/workflows, custom
.github/actions, or any Ansible /deploy/automation (those remain on my fork for personal CI and test-server deploy).Admin UI and credentials
/credentialsredirects to/settings?tab=dns-credentials/data; certificates supportcredential_ref; legacy credential migration API and UIAutomation API and jobs
npmak_…), webhooks with HMAC verification, async certificate jobs (GET /api/jobs/{id})operation-descriptions.json, Vacuum-friendly operation descriptionsDocumentation
/docs/; in-app/documentationwith allowlisted?section=iframe links/docs/api-reference/; dev Swagger on port 3082docker/docs-api-proxy.conf.examplerehype-sanitizeon HelpModal markdownSecurity hardening
res.json()on API routes; upload size limits andsafeFileNamesonexpress-fileuploadapiValidator)SECURITY.mdand.snykpolicy forexpress-fileupload(no upstream patch available; mitigations documented)Tooling and build
package-lock.jsonacross frontend, backend, test, and docs (Yarn removed)scripts/frontend-build,scripts/docs-build, Dockernpm ciscripts/sync-version.pyanddocs/VERSIONING.mdaligned with upstream versioning (.versionfile)Bug fixes and polish
setup.jspromise chainsecretPath/ secret key resolution fixManual testing status
External credential store support includes Vault, AWS Secrets Manager, Azure Key Vault, Infisical (Universal Auth), and HTTP OIDC. Only Infisical has been manually tested end-to-end so far. The other providers are implemented but not yet verified against live backends.
Out of scope (intentionally excluded)
.github/workflowsand.github/actions(fork CI, Docker publish, Infisical OIDC action, OpenAPI CI, etc.)deploy/tree (Ansible playbooks, inventory, test-server roles)build-push.ps1,publish-semver,docker-compose.hub.yml)Test plan
npm ciandnpm run buildinfrontend/,backend/,docs/,test/credential_refand external providerGET /api/jobs/{id}for cert job/documentationand bundled/docs/; Swagger “Try it out” withdocker/docs-api-proxy.conf.examplepattern/credentialsto Settings DNS tab