v1.3.0

Highlights

This release takes in a full read-through of the code by the Pulsed Media / PMSS maintainers (MagnaCapax, #72), merged with their commits intact via #73, plus the follow-ups they suggested. Thank you.

Behaviour change: Host-header check on wildcard binds. A dashboard bound to 0.0.0.0 or :: (every container) used to accept any Host header when -allowed-hosts was unset, which left a no-auth install open to DNS rebinding. It now serves localhost and any IP address, and refuses other names with a 421 until they are listed in -allowed-hosts / PMSS_ALLOWED_HOSTS. If you reach a container by hostname, add that name. This is why the version is 1.3.0 and not 1.2.5. (#72)

Autostart keeps your crontab. "Set up autostart" replaced every live crontab line that mentioned ~/bin/qbt-start, so a line like backup.sh && ~/bin/qbt-start was lost. It now replaces only lines whose whole command is the helper (redirections allowed), runs byte-wise so a line with odd bytes cannot turn grep's output into "Binary file matches" inside your crontab, and saves the previous crontab to ~/.config/pmss-fleet-manager/crontab.bak first. (#72, #73)

qBittorrent enabled in the Pulsed Media panel is respected. PMSS's own watchdog runs and configures qBittorrent on such accounts. The dashboard now detects the panel's flag, shows "panel-managed", keeps monitoring, and declines to install or autostart a second build that would fight it. (#72, #73)

Installer verifies downloads. For any GitHub release asset URL (the default userdocs build included) the dashboard fetches the asset's sha256 from GitHub's API and the box checks the download against it before the existing ELF and --version checks. Other URLs install unverified and the output says so. curl is preferred over wget, whose --https-only only applies to recursive downloads. (#72, #73)

No third-party requests from the page. The JetBrains Mono web font is embedded in the binary (SIL Open Font License 1.1, listed in the third-party notices) instead of loaded from Google Fonts, so viewers' addresses stay with your dashboard and offline installs look right. (#73)

Also from the review. Fractional cpu_hours in the Pulsed Media feed no longer reject the whole billing feed; suspended services count towards costs and renewal alerts; an acknowledged alert that escalates comes back; the throttle meter is shown only while throttled; a qBittorrent response over the size cap is an explicit error; -auth requires both user and password; the wizard shows the detected WebUI port as a hint rather than pinning it; the "localhost bypass" suggestion is gone (it would open the WebUI to other tenants); forgetting a pinned host key asks for confirmation; mutating requests need an http or https Origin; an SSH key the container cannot read is named in the error and HOME is fixed inside the image. (#72, #73)

Container image: ghcr.io/alteredparadox/pmss-fleet-manager:1.3.0 (linux/amd64, linux/arm64). Container users reaching the dashboard by hostname: set PMSS_ALLOWED_HOSTS.

Container image: ghcr.io/alteredparadox/pmss-fleet-manager:1.3.0 (linux/amd64, linux/arm64).

What's Changed

• Review fixes from the PMSS maintainers (#72) plus the follow-ups they suggested by @AlteredParadox in #73
• Fix fractional cpu_hours, keep the Host check on wildcard binds, and other fixes from a full read-through by @MagnaCapax in #72
• README: 1.3.0 is the current release by @AlteredParadox in #74

New Contributors

• @MagnaCapax made their first contribution in #72

Full Changelog: v1.2.4...v1.3.0