Host Settings 0.2.0

Each finding is told on its own, a target profile says what a server is expected to check, and an
external watchdog notices when the notifier itself stops.

• Each finding on its own: where an add-on lists single findings (Security Monitor 0.4.0 does
  for every port the internet reaches), the notifier compares them one by one, judged as Status
  Board does. A second dangerous port in an item that is a danger already gets its own message
  ("Danger · Security Monitor · 6379/tcp"). A finding is "OK again" only when a complete list,
  from a check done in full and in time, no longer has it; a check done in part, failed, without
  access or out of date resolves nothing. An accepted finding (accepted_until) stays quiet, the
  end of its acceptance is told once, and a finding back within 30 days is told as "again".
  Add-ons that list no findings are compared per item as before.
• Target profile: /etc/cockpit-host-settings/profile.conf names the server's roles (web,
  database, build, bastion), the add-ons and checks it is expected to have besides, and
  checks left out on purpose, each with a reason and perhaps an end date. It is set up in a new
  section of the Notifications tab (administrative access) or with the helper's profile verbs,
  written line by line with a backup. Host Settings sends it in its status, where Status Board
  0.3.0 reads it for this server.
• Coverage messages: with a profile, one message "Check no longer possible" when an expected
  add-on or one of its checks failed, has no access, is not set up, cannot be read or is not
  installed, and one "Check possible again" once it is checked again. The first run after a
  profile is set up names its gaps once. Without a profile nothing changes.
• Watchdog: optional and off by default. After every run, a signal to Healthchecks or to a
  push monitor of Uptime Kuma: success only once the run is done and its state saved, failure
  when a message did not reach a channel set up (the run still exits 0) or the run could not
  finish. A notifier that hangs, is killed or whose timer is off sends nothing, so the watchdog
  raises the alarm. A failed signal never resets a finding or sends a message again. The address
  is a secret: it goes to the helper on standard input, lives in
  /etc/cockpit-host-settings/heartbeat.conf (root, 0600), reaches the notifier as a systemd
  credential and is never shown. https:// with the usual checks, plain http:// only to a
  private address; no redirects; at most 3 tries within 40 seconds. A watchdog alone is enough to
  switch on the regular check, and the status has an item heartbeat. Tested against Uptime Kuma
  2.5.7; Healthchecks only against a stand-in that gives its documented answers.
• Fix, OK again without a check: an item in state none, exit 77 and an answer that left
  items out were told as "OK again". They now keep what was told. An add-on removed while it had
  told problems gives one "No longer checked" instead of an "OK again" per finding.
• Fix, broken findings data: a findings list that breaks the rules was left out and the item
  compared as a whole, so an open finding was closed and told as "OK again". Now broken or missing
  findings data, also the loss of the whole part or going back to an add-on version without
  findings, keeps the known findings as they are (open or accepted) until a readable list comes.
  An item with broken data can get worse, never better, and the other items of the answer are
  compared as usual.
• Fix, complete lists: a list of findings is complete only when its own total agrees, as on
  Status Board 0.3.0: "complete": true, "total": 1, "list": [] is never complete. The shared
  answers of the board's tests are copied byte for byte.
• last.json keeps format 1. A file of 0.1.0 is read as before: no new summary and no message
  again after the update, and findings no more severe than what was told for their item are taken
  as told.
• Menu: the entry moves to the end of System, in one block with the other Azentrius add-ons.
  Searching the menu for "azentrius" finds them all, and Cockpit's Help menu links the README.
• Systems: the .rpm is installed and checked on Rocky Linux and AlmaLinux 9 and 10, and the
  end-to-end test runs in Rocky Linux 9 and 10 VMs with SELinux enforcing as well.
• Install: the README and the release notes name the package repository first again.
• Tested together: Status Board 0.3.0, Host Settings 0.2.0 and Security Monitor 0.4.0, with
  their real packages in the new end-to-end test of the suite (workflow e2e-suite): a real scan,
  the real notifier and ntfy, and a real Cockpit with a second host, on a throw-away machine.
  Single findings of exposed ports need Security Monitor 0.4.0 or newer, the target profile on the
  board Status Board 0.3.0 or newer.
• Older add-ons: the status contract stays at schema 1 and the new parts are optional. Add-ons
  in older versions still work and are compared per item as before; Status Board shows their items
  as "summary only".

Install

From the Azentrius package repository (Debian, Ubuntu, Fedora, RHEL): set up https://packages.azentrius.com once, then install Host Settings in Cockpit under Applications, or with sudo apt install cockpit-host-settings or sudo dnf install cockpit-host-settings. The repository takes this release within an hour. Install it on every server that should send messages.

From the files of this release: download the package and SHA256SUMS, check that the download is complete and that this repository's release workflow built it, then install it:

sha256sum --ignore-missing -c SHA256SUMS
gh attestation verify cockpit-host-settings_0.2.0-1_all.deb --repo Azentrius/cockpit-host-settings
sudo apt install ./cockpit-host-settings_0.2.0-1_all.deb        # or: sudo dnf install ./cockpit-host-settings-0.2.0-1.noarch.rpm