OpenWrt RMM Server 0.12.1

Web interface polish and agent-update status hotfix.

Changed

• Router backups now use a compact, responsive list with consistent actions and a concise safety notice that explains identity preservation and automatic recovery.
• Completed agent updates and rollbacks are reported through one-time toast notifications instead of remaining as a persistent status banner above the device tabs.
• Docker Compose defaults and deployment documentation now target the 0.12.1 server and tunnel images.

Fixed

• Backup recovery guidance no longer collapses into a narrow column or forces horizontal overflow on laptop and mobile viewports.
• Historical completed agent operations no longer generate stale notifications when a router is opened, while newly completed operations still notify the operator once.

OpenWrt RMM Server 0.12.0

Security and encrypted recovery release.

Added

• Commands are signed with a persistent Ed25519 server key and include device binding, an expiry time, and a random nonce for agent-side replay protection.
• Device credentials support a two-phase, interruption-safe rotation and an administrator-only emergency revoke; the tunnel sidecar terminates already-established reverse listeners after revoke, close, or expiry.
• Webhook secrets, Telegram identifiers, verification destinations, pending device credentials, and sensitive notification delivery payloads are encrypted at rest with context-bound AES-256-GCM.
• Managed router backups use sysupgrade -b, encrypted SQLite storage, SHA-256 verification, target compatibility checks, retention, archive manifests, and a guarded restore workflow with a local emergency backup.
• Administrators can download a consistent SQLite snapshot created with VACUUM INTO from the maintenance interface.

Changed

• Docker Compose defaults and deployment documentation now target the 0.12.0 server/tunnel pair and advertise agent 0.8.0.
• Existing plaintext notification secrets are encrypted automatically after the persistent data-encryption key is initialized.
• The database pins the command-signing and data-encryption key identifiers and refuses startup with unrelated recovery keys.
• Consistent SQLite snapshots stream from a temporary VACUUM INTO file instead of loading the complete database into server memory.

Fixed

• Heartbeat command claiming no longer returns the same queued operation repeatedly before its result is received.
• The Playwright server wrapper uses a graceful test teardown signal before the bounded Windows child-process fallback.

OpenWrt RMM Agent 0.8.0

Signed commands and managed recovery.

Added

• The agent pins the server command-signing public key and verifies every command signature, device ID, nonce, creation time, and expiry before execution.
• Persistent result and pending markers prevent a command from running twice after a crash or lost response.
• Two-phase device-token rotation is stored atomically without interrupting normal heartbeat delivery.
• Managed encrypted cloud backup upload and guarded restore verify size, target, and SHA-256, preserve the current agent identity, and automatically roll back if a later heartbeat does not confirm cloud connectivity.

Security

• A changed server command-signing key is rejected until explicit re-enrollment.
• Explicit re-enrollment clears the old command-key pin and creates a new per-device tunnel identity.
• Interrupted state-changing commands fail closed instead of being replayed automatically.

OpenWrt RMM Server 0.11.2

Interface consistency and login layout hotfix.

Changed

• LuCI remote-access error pages now match the current OpenWrt RMM design system while remaining self-contained in the Go HTTP template.
• LuCI access errors use the same compact infrastructure-console styling, typography, spacing, controls, and semantic status presentation as the redesigned web interface.

Fixed

• Login-page authentication capability labels no longer overlap their descriptions when using longer monospace labels such as SESSION.
• LuCI error pages no longer render duplicate “Вернуться в RMM” actions when the primary action already points back to the control panel.

OpenWrt RMM Server 0.11.1

Application icon refresh.

Changed

• Updated favicon, PWA, and Apple touch icon assets to match the redesigned OpenWrt RMM interface.
• Removed the unintended opaque background around the application icon.

OpenWrt RMM Server 0.11.0

Complete UI/UX redesign and responsive interface overhaul for the OpenWrt RMM web console.

Added

• A unified design system now defines the application's colors, typography, spacing, control sizes,
  borders, status presentation, responsive behavior, technical output, dialogs, and accessibility
  conventions.
• Reusable application-native confirmation dialogs replace browser-native confirmation flows for
  destructive and security-sensitive actions.
• Shared technical-output and configuration-diff patterns provide consistent presentation for
  command results, diagnostics, package operations, UCI previews, and backend error details.
• Dedicated system-state presentation now covers unavailable services, access errors, empty data,
  stale telemetry, offline devices, reconnecting states, and other exceptional conditions.
• Responsive mobile representations were added for dense operational data instead of relying on
  compressed desktop tables.
• A unified Tabler Icons-based icon system provides consistent outline icons across navigation,
  dialogs, statuses, actions, and dynamically rendered interface elements.

Changed

• The authenticated application was redesigned around a compact dark infrastructure-console
  aesthetic with rectangular controls, reduced corner radii, muted semantic colors, and higher
  information density.
• Fleet, device overview, clients, network interfaces, problems, operations, diagnostics, remote
  access, Expert mode, UCI configuration, packages, audit, and maintenance now share the same
  visual and interaction system.
• Profile, account security, notification settings, notification history, user management, router
  enrollment, login, landing, legal, and public system states were brought into the same design
  language as the main RMM console.
• Desktop navigation, mobile navigation, tabs, dialogs, forms, tables, filters, statuses, and
  action hierarchies were standardized across the application.
• Device and fleet views prioritize operational status, stale/offline state, WAN health, problems,
  telemetry, and primary actions without oversized dashboard cards.
• Client and interface tables use structured compact records on narrow screens so IPv4, IPv6,
  MAC addresses, signal data, traffic counters, and long hostnames remain readable.
• Expert and UCI workflows now visually separate read-only, primary, recovery, and destructive
  operations while preserving the existing backend behavior.
• Notification settings are grouped by channels, event types, thresholds, quiet hours, device
  overrides, delivery state, and history instead of presenting one flat configuration form.
• Landing and login pages were restyled to match the infrastructure-console interface instead of
  using a separate bright SaaS-oriented visual language.
• Technical identifiers, addresses, command output, package names, UCI values, and similar data
  now use a consistent monospace presentation while normal interface copy remains sans-serif.

Fixed

• Responsive layouts no longer depend on overlapping mobile overrides for the same components and
  now use a more consistent breakpoint strategy.
• Dense tables and technical values no longer introduce page-level horizontal scrolling on narrow
  viewports.
• Long IPv6 addresses, hostnames, tags, command output, audit context, webhook URLs, and backend
  messages are constrained without breaking their surrounding layouts.
• Mobile dialogs and forms remain within the dynamic viewport and keep their actions accessible
  on small screens.
• Offline, stale, loading, empty, filtered-empty, and error states are now visually distinguished
  instead of falling back to inconsistent component-specific presentation.
• Destructive operations no longer rely on generic browser confirm, alert, or prompt
  interactions where an application-native workflow is available.
• Legacy Unicode and emoji glyphs used as interface icons were replaced with consistent SVG
  iconography.
• Dialog close controls, navigation actions, notification controls, and other icon-only buttons
  now use consistent sizing and interaction states.

Accessibility

• Icon-only controls now expose accessible names while decorative SVG icons are excluded from the
  accessibility tree.
• Status presentation combines text, iconography, and semantic color instead of relying on color
  alone.
• Dialog focus handling, keyboard interaction, focus-visible states, form labels, validation
  feedback, and destructive-action confirmations were standardized across the redesigned UI.
• Mobile controls and navigation use consistent touch targets and respect viewport and safe-area
  constraints.

Documentation

• DESIGN.md documents the permanent OpenWrt RMM design system and acts as the source of truth for
  future frontend changes.
• The design guide defines visual principles, design tokens, responsive conventions, technical
  typography, status patterns, dialogs, forms, tables, destructive actions, and iconography.
• Tabler Icons are documented as the project's single supported production icon set, including
  sizing, stroke, color inheritance, accessibility, and vendoring conventions.

Validation

• Frontend and browser coverage exercises the redesigned navigation, Fleet, device views, clients,
  network interfaces, operations, Expert workflows, dialogs, profile, notifications, user
  management, login, and public states.
• Responsive checks cover phone, tablet, desktop, and wide-desktop layouts, including narrow
  320–430 px viewports and dense technical content.
• Regression coverage verifies application-native confirmations, dynamic icon rendering, dialog
  behavior, filtering, navigation, command output, and representative error and offline states.

OpenWrt RMM Server 0.10.2

Secure tunnel authorization compatibility hotfix.

Fixed

• The SSH sidecar now materializes its internal authorization token and endpoint in protected
  runtime files because OpenSSH intentionally sanitizes the AuthorizedKeysCommand environment.
• Per-device tunnel authentication no longer fails before contacting the server with
  Permission denied (publickey) after secure mode is enabled.

Security

• Runtime authorization files remain root-owned, are group-readable only by the unprivileged
  command user, and use mode 0440 inside a 0750 directory.
• The token and authorization URL are removed from the long-running sshd process environment.
• The legacy shared-key file remains empty whenever secure per-device authorization is enabled.

Validation

• A regression test invokes the authorization helper with a sanitized environment and verifies
  the exact bearer-token and key-fingerprint request without making a network call.

OpenWrt RMM Server 0.10.1

Single-file GitOps deployment and visible server version.

Added

• The authenticated dashboard displays the running server build version next to API health.
• compose.dev.yaml preserves explicit source builds while production GitOps uses published images.

Changed

• The base compose.yaml now pulls matching versioned server and tunnel images without requiring
  a release overlay.
• Database and tunnel volumes have configurable explicit names so a GitOps project rename can
  reattach existing state instead of silently creating empty project-scoped volumes.

Documentation

• The deployment guide includes a non-destructive Arcane migration procedure with database and
  tunnel-key backups, exact-volume discovery, recreation and verification steps.

Validation

• Compose configuration is validated in production and development-image modes.
• Browser coverage verifies that release metadata is rendered in the authenticated sidebar.

OpenWrt RMM Server 0.10.0

Secure cloud tunnels and responsive LAN inventory.

Added

• The control plane stores a unique Ed25519 public-key fingerprint and rotation epoch for
  every router while the private key remains on the device.
• The SSH sidecar resolves authorized keys through a token-protected internal endpoint and
  limits each credential to the ports of its active, non-expired remote session.
• Remote session creation reserves ports transactionally and enforces per-device concurrent
  session and creation-rate limits.
• Device transfers revoke the previous tunnel credential and advance its key epoch so the
  router rotates its identity on the next heartbeat.

Changed

• Secure tunnel commands include the persistent SSH host public key and require strict host-key
  verification from compatible agents.
• The stable agent advertised by server images is now 0.7.0.
• The LAN client table uses flexible columns at 1366×768, keeps status markers aligned, and
  truncates long values without introducing horizontal scrolling.

Fixed

• WAN neighbours are no longer presented as LAN clients.
• Duplicate tunnel-port reservations are rejected instead of allowing ambiguous forwarding.

Deployment

• Deploy server and agent 0.7.0 first with RMM_TUNNEL_AUTH_TOKEN empty, wait for router
  heartbeats to register per-device keys, then configure the shared internal auth token and
  persistent RMM_TUNNEL_HOST_PUBLIC_KEY during a maintenance window.

Validation

• Go tests cover credential registration, epoch rotation, transfer revocation, authenticated
  key lookup, port collisions and session limits.
• Browser tests cover the LAN client table at Full HD and 1366×768 without page or list overflow.

OpenWrt RMM Agent 0.7.0

Per-device tunnel identity and strict server authentication.

Added

• Routers generate a unique Ed25519 tunnel identity and register only the public key with
  the control plane.
• The heartbeat reports the public credential and key epoch needed for server-side authorization.

Security

• Secure tunnel commands pin the persistent server host key, enable strict host-key checking,
  use only the device identity and bind reverse forwards explicitly.
• Secure mode requires OpenSSH and fails closed when its host key or per-device identity is
  missing; the legacy client remains available only during the staged migration.
• A server epoch change stops existing tunnel processes and rotates the router identity before
  the next session is accepted.

Packaging

• Production UCI synchronization preserves device identity state, migrates the previous default
  key path and exposes the tunnel credential epoch without storing private material in UCI.

Validation

• Go tests cover key generation, epoch mismatch handling, host-key pinning, strict SSH arguments
  and explicit reverse-forward binds.