Veleis 1.8.8

Veleis 1.8.8

Highlights

• Added Advanced DNS Monitoring with A, AAAA, CNAME, MX, NS, TXT, SRV, CAA,
  and PTR records; typed expectations; resolver and optional authoritative
  comparison; resolver-dependent DNSSEC state; semantic change history; and
  shared incident/alert integration.
• Added revisioned Notification Escalation Policies with ordered absolute-delay
  steps, multiple channels, immutable incident snapshots, stop-on-acknowledge,
  exactly-once scheduling, cancellation, delivery provenance, active progress,
  and a responsive timeline editor.
• Added in-place notification-channel editing and safe optional credential
  rotation while preserving channel identity, history, type, encryption, and
  write-only secret behavior. Channel management is now a compact responsive
  list.
• Unified Profile, Security, Preferences, Data Retention, and Access below
  canonical /settings/* routes with responsive top navigation. The sidebar
  account footer now provides a direct neutral Sign Out action and Settings is
  the sole general configuration entry.

Database and performance

• Schema advances from 37 to 40. Agent metrics use one-day chunks, drop a
  redundant large index, and enter Timescale columnstore after one day while
  preserving the existing 14-day agent-metric lifecycle.
• Fresh installations size PostgreSQL and TimescaleDB from the minimum of host,
  current cgroup-v2/cgroup-v1 ancestors, and a validated optional override.
  Profiles bound buffers, per-operation memory, connections, and workers. A
  32 GiB host constrained to 2 GiB now receives the 2 GiB profile rather than
  host-sized settings.

Upgrade notes

• Run sudo veleis backup before upgrading, then sudo veleis upgrade 1.8.8.
  The lifecycle creates and verifies another mandatory pre-upgrade backup,
  validates the immutable image digest, applies migrations 38–40, and waits for
  schema 40 and HTTPS readiness.

• Fresh 1.8.8 installations use cgroup-aware managed PostgreSQL tuning.
  Historical and administrator-customized settings are never silently
  overwritten during upgrade.

• Existing installations should first refresh the current lifecycle tooling as
  documented in Upgrading, then run:

  sudo veleis postgres-memory status

  HEALTHY, WARNING, or UNSAFE is reported with effective memory,
  ownership, and live PostgreSQL settings. An unsafe historical installation
  can explicitly adopt the Veleis-managed profile with:

  sudo veleis postgres-memory adopt-managed

  Adoption backs up both .env and compose.yaml, atomically installs the
  managed profile/topology, recreates and health-checks the stack, and restores
  both files if validation fails. It restarts PostgreSQL and the application;
  schedule a maintenance window. No database data is deleted. Operators who
  intentionally maintain custom PostgreSQL configuration remain in control and
  may leave it unchanged after reviewing the warning.

• Never use swapoff or hand-edit PostgreSQL files as the Veleis remediation
  procedure.

Compatibility and known limitations

• Supported upgrade sources: Veleis 1.7.1 and 1.8.0 through 1.8.7. Backup
  format remains 1. Recommended Ravyr remains signed 1.8.2; minimum Ravyr is
  1.7.0 and lifecycle protocol remains 1.
• The supported image remains linux/amd64. Default HTTPS remains self-signed.
  Image signing, a published SBOM, and provenance attestation are not currently
  part of the Veleis release pipeline.
• PostgreSQL memory profiles bound the primary allocation risks but do not
  guarantee that every third-party workload fits the minimum 1 GiB profile;
  2 GiB is the practical small-install recommendation.
• Docker image: docker.io/nyxmael/veleis:1.8.8
• Manifest digest: sha256:4f082699b5bec6261f119ea6f620decbf9bcfc72c06523b1e8ae1c8e00a98f8a

Veleis v1.8.7

Improved

• Added scalable server-side pagination and filtering to Notifications History,
  with channel context, deterministic ordering, bounded error presentation, and
  distinct loading, empty, and failure states.
• Unified notification health across Overview and Notifications: retrying work
  is the canonical active issue, terminal outcomes remain history, and channel
  health follows its latest delivery result.
• Refined Overview Operational Attention and responsive accessibility across
  desktop and mobile layouts.
• Replaced native destructive prompts with consistent accessible Veleis dialogs
  that guard duplicate submission, preserve focus, and keep secrets out of copy.

Fixed

• Deleting a probe or its asset now retires associated alert instances,
  incidents, dependency interpretations, and undelivered notification work in
  one transaction while preserving delivered and audit history.

Compatibility

• Supported upgrade sources: Veleis 1.7.1, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4,
  1.8.5, and 1.8.6. Schema advances from 36 to 37; backup format remains 1.
• Recommended Ravyr remains the unchanged signed 1.8.2 release; minimum
  supported Ravyr remains 1.7.0 and lifecycle protocol remains 1.
• Docker image: docker.io/nyxmael/veleis:1.8.7
• Manifest digest: sha256:894b469f8c1a210f59b2981ea15c473055c56ae77a4c865bbdccecd2d87a8568

Veleis 1.8.6

Added

• Added Certificate Intelligence to TLS Certificate probes: current and
  previous identities, SHA-256 fingerprint, subject/issuer/serial, validity,
  DNS/IP SANs, signature and public-key metadata, chain/verification/hostname
  state, first/last seen timestamps, and observation counts.
• Added bounded certificate identity history and edge-triggered change events.
  An A→B rotation creates one event; repeated observation of B updates its
  counters without duplicating the event.

Improved

• Added responsive Certificate Intelligence presentation to probe details with
  bounded current, history, and change views across desktop and mobile widths.
• Preserved the accepted compact Status Pages, Asset Details action hierarchy,
  dialog behavior, and application-wide responsive density corrections made
  after 1.8.5.

Security and safety

• Certificate Intelligence is observational only. It performs the same bounded
  TLS handshake as the existing probe and cannot issue, renew, replace, install,
  or reconfigure certificates or monitored infrastructure.
• Certificate history APIs require normal Veleis authentication and probe-read
  permission. They return a typed 404 for non-TLS probes, cap identities and
  changes at 50 each, and never expose private keys or configured secrets.
• The release image runs as nonroot:nonroot; final-image vulnerability and
  secret scanning found no policy-violating HIGH/CRITICAL findings.

Compatibility

• Supported upgrade sources: Veleis 1.7.1, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4,
  and 1.8.5. Schema advances from 35 to 36; backup format remains 1.
• Recommended Ravyr remains the unchanged signed 1.8.2 release; minimum
  supported Ravyr remains 1.7.0 and lifecycle protocol remains 1.
• Docker image: docker.io/nyxmael/veleis:1.8.6
• Manifest digest: sha256:1c51cd1f41644e72fc734aaa0132a2b6c69d9723c2ea6af9c0c4bf690e4df813

Veleis v1.8.5

Veleis 1.8.5 adds secure, read-only SNMP scalar monitoring and completes a unified UI density and layout consistency pass.

Highlights:

• SNMPv2c and SNMPv3 (noAuthNoPriv, authNoPriv, and authPriv) scalar-OID monitoring.
• Encrypted, write-only SNMP credentials with redacted API responses and logs.
• One bounded SNMP GET per attempt; no SET, WALK, GETBULK, traps, discovery, or MIB-name resolution.
• Corrected Asset Details action hierarchy and accessible exact-once delete confirmation.
• Responsive density validation from 360 px through 1920 px.
• Schema 35 with validated upgrades through Veleis 1.8.4.

Docker image: docker.io/nyxmael/veleis:1.8.5

Manifest digest: sha256:cab41f4a7f63a2ac39295cac1940ff8c524ddf220f6083d2934d977210feb621

See CHANGELOG.md, docs/SNMP.md, and docs/UPGRADING.md for complete details.

Veleis v1.8.4

Veleis 1.8.4 is the Ravyr fleet-lifecycle correctness and operability patch release on schema 34.

Fixed

• Replaced time-percentage Ravyr rollout admission with serialized five-minute leases, canary-first admission, stale-lease reconciliation, and a strict maximum-concurrent limit.
• Made installed Ravyr version authoritative for lifecycle state and fleet summaries, including safe malformed/newer-version handling and no offline double-counting.
• Added live lifecycle events and concise reasons for waiting, paused, pinned, failed, updating, and current states.
• Published an idempotent, narrowly scoped repair for historical Ravyr 1.8.0 installations missing /usr/local/lib/veleis-ravyr and failing with 226/NAMESPACE.
• Refined the Automatic Update Policy editor into one aligned responsive form with coherent timing controls and attached actions.

Compatibility

• Supported upgrade sources: Veleis 1.7.1, 1.8.0, 1.8.1, 1.8.2, and 1.8.3.
• Schema advances from 33 to 34; backup format remains 1.
• Recommended Ravyr remains the unchanged signed 1.8.2 release; minimum supported Ravyr remains 1.7.0 and lifecycle protocol remains 1.
• Docker: docker.io/nyxmael/veleis:1.8.4
• Digest: sha256:40e5927272fc2fc415cea2b50d1d3d5bf63de6876094335b855ab26395415cd3

See CHANGELOG.md for the canonical release history. Verify downloaded release assets with SHA256SUMS before use.

Veleis v1.8.3

Veleis 1.8.3 is the final production UX-correctness, live-stability, and regression-verification patch release on schema 33.

Fixed

• Rebuilt the expanded Automatic Update Policy editor around one responsive form grid with aligned fields, compact timing controls, coherent actions, meaningful dirty-state saving, non-mutating cancellation, and visible validation/API failures.
• Hardened the shortened Ravyr HTTPS bootstrap so it retrieves the server certificate first, verifies its authenticated fingerprint, and downloads the checksum and installer through normal CA-validated TLS without an insecure bypass.

Compatibility

• Supported upgrade sources: Veleis 1.7.1, 1.8.0, 1.8.1, and 1.8.2.
• Schema remains 33; backup format remains 1.
• Recommended Ravyr remains the signed 1.8.2 release; minimum supported Ravyr remains 1.7.0 and protocol remains 1.
• Docker: docker.io/nyxmael/veleis:1.8.3
• Digest: sha256:b8f0f01242371128a3ad8f559d535781f99b7c3ee9bc035781116a8644cf8901

See CHANGELOG.md for the canonical release history.

Veleis v1.8.2

Veleis 1.8.2 is a stable fleet-scale usability and Ravyr lifecycle release.

Highlights:

• A clearer Agents Fleet experience with a compact summary, distinct connectivity/compatibility/update facts, and collapsed fleet-policy setup.
• Bounded, server-side Managed Hosts filtering and deterministic ordering validated with 1,001 agents and 2,000 discovered services.
• Stable live-widget ordering and scroll position across telemetry refreshes.
• A compact Status Page publication workflow with explicit publication state and actions.
• Short, authenticated Ravyr enrollment with certificate-fingerprint bootstrap and signed 1.8.2 agent/updater artifacts.
• Explicit clipboard success feedback with a manual-selection fallback.
• Direct NyxCloud Community integration for public product discussion and clearer support routing.
• Deduplication of semantically identical Linux socket observations, including the qBittorrent wildcard-UDP case.
• Hardened Ravyr updater installation paths and permissions on real systemd Ubuntu 24.04 and Debian 13 hosts.

Upgrade:

sudo veleis upgrade

To request this exact release:

sudo veleis upgrade 1.8.2

The upgrade creates a mandatory backup first. Supported sources are 1.7.1, 1.8.0, and 1.8.1. Schema remains 33 and backup format remains 1.

Docker image: docker.io/nyxmael/veleis:1.8.2

Immutable manifest digest: sha256:074c9a6584873e07a793fdb0eaff24f32e292aa387a57314109380f6d1efbda4

Platform and limitations: linux/amd64. Clean installs and upgrades were validated on Ubuntu 24.04 and Debian 13 with the default self-signed TLS deployment. Veleis remains monitoring-only: it does not provide remote shell, workload-control, or remediation actions.

Veleis v1.8.1

Veleis 1.8.1 is a production-feedback hardening release for notification presentation, Ravyr update-policy UX, and Status Page runtime stability.

Highlights

• Human-readable semantic Discord embeds for critical, warning, recovery, and test events.
• Professional UTF-8 SMTP messages and stable schema-v1 generic webhook payloads.
• Bounded retry with Discord/webhook Retry-After handling and write-only secret safety.
• Explicit Any time or recurring Maintenance window update timing with searchable IANA timezones, browser suggestion, DST/overnight semantics, and clearer fleet lifecycle states.
• Separate Save policy and confirmed Resume rollout actions.
• Corrected empty Status Page incident-update collections and defensive client boundaries, eliminating the intermittent null/map crash.

Compatibility

• Supported upgrade sources: Veleis 1.7.1 and 1.8.0.
• Schema: 33 (unchanged from 1.8.0).
• Backup format: 1.
• Recommended Ravyr: signed 1.8.0 (unchanged; no re-enrollment or credential rotation).
• Platform: linux/amd64.

Docker image: docker.io/nyxmael/veleis:1.8.1

Manifest digest: sha256:5afeb90ec365282990a080c0cc26e84d2fffe69986a87c48612abb9a3260fcfe

Upgrade:

sudo veleis upgrade

Exact target:

sudo veleis upgrade 1.8.1

The lifecycle command creates and verifies a mandatory backup before mutation. See CHANGELOG.md and docs/UPGRADING.md for details.

Veleis 1.8.0

Added

• Added signed, same-origin Ravyr artifacts and a separate constrained updater
  service/timer for zero-touch supported agent upgrades.
• Added explicit recommended/minimum agent compatibility, deterministic staged
  cohorts, concurrency and maintenance controls, offline catch-up, fleet UI,
  per-agent policy overrides, rollback events, and failed-release fleet pause.
• Added paginated Status Page component and incident administration with search,
  filters, sorting, scalable ordering, overview counts, and safe bulk actions.
• Added Active Alert acknowledgement, active-only summary counts, explicit Normal
  filtering, compact pagination, and overlapping-rule guidance.

Changed

• Active Alerts now defaults to operational attention states; healthy Normal
  evaluations remain available only when explicitly requested.
• Public Status Page health still aggregates all enabled components while each
  response and browser render remains bounded.
• Stable Docker channels 1.8 and latest now resolve to 1.8.0. The 1.7
  channel remains on the accepted 1.7.1 image.

Security and safety

• Ravyr update manifests bind version, protocol, server compatibility, platform,
  exact path, size, SHA-256, Ed25519 signature, and trusted key ID.
• The updater exposes no arbitrary command, service, URL, package, or filesystem
  surface; it changes only Ravyr-owned binaries/state and restarts only
  ravyr.service.
• Activation is disk-preflighted and atomic, requires a resumed heartbeat plus
  telemetry, and restores the previous binary on failure.

Compatibility

• Supported upgrade: 1.7.1 to 1.8.0 through the mandatory backup workflow.
• Schema advances from 32 to 33; backup format remains 1.
• Accepted upgrade testing preserved users, assets, probes, dashboards,
  incidents, provider configuration/inventory, and TLS identity.
• DEV Ubuntu and Debian Ravyr hosts upgraded from 1.7.0 to 1.8.0 without
  re-enrollment; a signed faulty canary proved rollback, local release blocking,
  and server fleet pause.
• Docker image: docker.io/nyxmael/veleis:1.8.0
• Manifest digest: sha256:b1a3b106599d8b297f48a4573051c3dc646e12bd69c35cfbdae4d49edafff85b

Veleis v1.7.1

Veleis v1.7.1

Veleis 1.7.1 makes Discovery and Proxmox first-class Custom Dashboard data
sources while preserving Veleis's observational, read-only infrastructure
boundary.

Highlights

• New Proxmox overview, workloads, and storage widgets.
• New Discovery summary and recent activity widgets.
• Deterministic all-provider or selected-provider configuration, with bounded
  rows and explicit disabled, deleted, issue, and stale states.
• Infrastructure summary now includes providers, discovered infrastructure,
  and Proxmox workloads alongside incidents, agents, and Docker state.
• A new public Proxmox guide documents privilege-separated tokens,
  PVEAuditor on / with Propagate, TLS choices, and common 401/403/config
  failures.
• Viewer asset-creation controls are now correctly hidden.

Upgrade

Veleis 1.7.0 to 1.7.1 is supported. The lifecycle tool creates a mandatory
pre-upgrade backup, verifies the immutable image digest, applies migrations,
and waits for HTTPS readiness.

sudo veleis upgrade

Exact-version alternative:

sudo veleis upgrade 1.7.1

Schema remains 32 and backup format remains 1. Existing dashboards,
assets, probes, users, incidents, Discovery provider configuration/inventory,
TLS identity, and login state are preserved.

Distribution

• Image: docker.io/nyxmael/veleis:1.7.1
• linux/amd64 manifest:
  sha256:5fe5948c818a58cda38ded206c594669f6edbbb647703e6cd0055ebf3720c73a
• Floating tags 1.7 and latest resolve to the same accepted digest.
• Immutable 1.7.0 remains unchanged at
  sha256:5905637213977e8fd5d9f159b65c507a74defe25bac0b0a1b1d66d2602e279fe.

Known limitations

• linux/amd64 only; tested public installer hosts remain Ubuntu 24.04.4 LTS and
  Debian 13.6.
• Proxmox widgets use normalized inventory/state. Historical Proxmox CPU and
  memory timeseries are not persisted in this release.
• Default HTTPS uses an installation-specific self-signed certificate.
• Automated uninstall, image signing, a public SBOM, and provenance
  attestations are not yet published.