intact-20260811

This release replaces the appliance's authentication, closes a broad set of security findings, and rebuilds the upgrade system from the ground up.

Authentication

nginx Basic Auth is gone, replaced by a real session login. The dashboard now has its own login page backed by a proper auth service, with the operator choosing the dashboard password in config.yaml — or setting it on first launch, instead of the appliance inventing one nobody can find. Sessions survive a backend restart, and the "configured but no credential" state that could lock an operator out of their own box now repairs itself at boot.

Security

Multiple hardening passes across the platform:

• Network exposure — Velociraptor and Logstash management ports are no longer published on every interface. The Timesketch data stores and the Portainer agent were taken off the shared network, and the Portainer agent is now authenticated.
• Credentials — Timesketch moved off its shipped default database credential. Secrets no longer reach logs that leave the box, the installer's config summary, built images, or git. World-readable secret files are corrected on both the install and upgrade paths.
• Input handling — closed a host-picker XSS, stopped rendering uploaded filenames as HTML, put a single admission policy on operator-supplied archives, locked the PDF report renderer to embedded resources, and added client-ID validation at the VQL sinks.
• Supply chain — the installer records what it actually ran, packages can be anchored by an operator, and CI is hardened against ever shipping key material.

New upgrade engine

The in-container Python upgrader (~25,900 lines) has been replaced by a host-side engine roughly a fifth the size. It runs from the shell and talks only to Docker and the checkout — so it works when the backend is stopped, crash-looping, or was never installed, which is exactly when upgrades matter.

• Per-module transactions that roll back on failure, with data protected explicitly: Velociraptor's CA is verified unchanged, Timesketch takes a pg_dump and refuses a Postgres major migration if that dump failed.
• A health gate that separates degraded from broken, so a normally-yellow single-node cluster no longer triggers a false rollback.
• Packages are checksum- and tar-slip-verified before anything is applied; downgrades are refused rather than half-attempted.
• Stop/Ctrl-C now unwinds the in-flight module and reclaims its extraction scratch instead of abandoning the run.

The dashboard upgrade cards remain. They launch a detached helper that runs the same engine, so there is one upgrade implementation — not two.