v0.0.14

What's new in v0.0.14

The pfSense agent now carries the pfCentral name everywhere it is visible: the process is pfcentral-agent and the service is pfcentral_agent. The overview also stops reporting the running agent as stopped, and Download & Restart updates the agent card in place when the new process reconnects.

Agent rename

• The agent binary moved to /usr/local/bin/pfcentral-agent, the rc service is pfcentral_agent, and the package is pfSense-pkg-pfcentral-agent.
• Runtime files follow the same name: /usr/local/etc/pfcentral-agent/, /var/run/pfcentral_agent.pid, /var/log/pfcentral_agent.log and /var/run/pfcentral-agent.status.json.
• The Services page now lists pfcentral_agent read-only, with its real running state instead of a false Stopped.
• Release assets are now pfcentral-agent-freebsd-amd64 and pfSense-pkg-pfcentral-agent.pkg. If you mirror the release files, publish them under the new names.

Agent upgrades

• Download & Restart now waits for the restarted agent, then refreshes the version on the card without a page reload and confirms Agent updated — Now running X.
• If the agent does not report back within about a minute, the card says the upgrade could not be confirmed instead of continuing to show the old version.

Security

• Service names are validated before they reach PHP, and controlling the pfCentral agent is refused at the agent, API and UI layers. This closes a command-injection path in service status and control.

Upgrading

Run install.sh once on every firewall that still has pfSense-pkg-nats-agent. It removes the old package and service, keeps the enrolled credentials and settings, rewrites the configuration for the new paths, and starts pfcentral_agent. A package-only upgrade does not migrate the old service.

Update the server and the agent on each firewall together to get the rename and the service-control fix.

Install on pfSense:

fetch -o - https://github.com/danielmichaels/pf-central-artifacts/releases/latest/download/install.sh | sh

v0.0.13

What's new in v0.0.13

Diagnose firewall connectivity with packet captures, traceroute and DNS lookups directly from pfCentral. You can also download the saved active firewall configuration before making a change.

Diagnostics

• Start, stop and download packet captures as PCAP files. Captures run one at a time per firewall, with limits of 30 seconds and 200 packets. Results expire 10 minutes after completion and are replaced by the next capture.
• Run dedicated IPv4 traceroute and DNS lookups without using the command prompt. Choose a DNS record type and, optionally, a resolver IP address. Commands have a 35-second execution limit and return up to 64 KiB of output. PTR lookups require a reverse DNS name; live output and cancellation are not available.
• Browse Config History, download an older XML backup, or confirm its deletion from the web UI. Configuration restore is not implemented.

Configuration backups

• Select More → General Setup → Backup Config to download the complete saved active configuration as config-active.xml. This copies the saved file without applying settings, changing the firewall, or creating a history entry. Running services may still use older settings until you apply changes or reboot.
• Downloads preserve the original file bytes and bypass shared caching. The XML is unencrypted and unredacted: protect it because it can contain passwords, VPN secrets and private keys. Successful exports are not recorded in the audit log. The file must fit in one NATS reply; chunked export is not supported.

Fixes and guidance

• Requests that receive no device data now return an error instead of an empty success response. Shared data-error panels retry the original request URL.
• The guides now follow setup, onboarding and day-to-day operations, with task walkthroughs, screenshots and separate API references.

Upgrading

Upgrade the server and the agent on each firewall to use the new diagnostics and active-config export. Packet capture, traceroute, DNS lookup and active-config export require an admin or owner account with normal authorization enforcement enabled. Existing Config History API permissions are unchanged; deleting backups in the web UI requires admin or owner.

New device operations were checked with local tools and fixtures and cross-built for FreeBSD; they have not been validated on a live pfSense firewall.

Install on pfSense:

fetch -o - https://github.com/danielmichaels/pf-central-artifacts/releases/latest/download/install.sh | sh

v0.0.12

What's new in v0.0.12

pf-central can now manage certificates, packages, console settings and nested traffic-shaper queues on your firewalls, and inspect the live state table. This release also fixes a security issue in the web UI. Update the agent on each device to use the new pages.

System

• Certificate manager. Create internal, intermediate and imported certificate authorities, and issue or import certificates signed by them. Delete is refused while a VPN, the web GUI or a package still uses the certificate, and private keys are never shown or returned. Adding a CA to the device's OS trust store needs the admin or owner role.
• Package Manager. See installed packages and available updates, search the repository, and install or remove packages. One install or removal runs at a time; a second request is refused straight away instead of queueing. Installing and removing need the admin or owner role.
• Console settings. Password-protect the console menu and set the serial console, its speed and the primary console, as on pfSense's Admin Access page.

Firewall

• State table. Diagnostics › States lists the live state table with the same interface, rule and text filters as pfSense, and removes the states between a source and destination address pair. pfSense cannot remove a single state by ID.
• Traffic shaper child queues. Manage the queues nested under ALTQ root queues and limiters, including HFSC service curves and limiter AQM settings, from the Traffic Shaper page.

Services

• DNS Forwarder host overrides. Create, edit and delete DNS Forwarder host overrides with their aliases, then apply them.

Fixes

• Security: crafted links could run script in the web UI. Some pages copied a URL parameter, or a value reported by the device, into page actions without escaping. A crafted link could run script in a signed-in operator's session. All such values are now escaped.
• Limiter descriptions. Descriptions set in pfSense now appear in pf-central, and descriptions saved in pf-central now appear in pfSense.
• Safer timeouts. When a long command such as a package install times out, the agent now asks it to stop and gives it time to clean up before killing it.

For API users

• A request that times out on the device now returns 504 Gateway Timeout instead of 500, on every endpoint. A busy package install returns 409 Conflict.

Install on pfSense:

fetch -o - https://github.com/danielmichaels/pf-central-artifacts/releases/latest/download/install.sh | sh

v0.0.11

v0.0.11

Features

• feat(firewall): add schedule active status endpoint and UI indicator (56bc7b3)
• feat(agent): add diagnostics config history list/get/delete (bd56328)
• feat(ipsec): phase 1 encryption proposals (de7bde9)
• feat(dns-resolver): expose host override aliases in transport and UI (654c7bc)
• feat(diagnostics): add pf tables list/get/delete (3f198c7)
• feat(vpn): add OpenVPN client CRUD and apply subject (80bf9c7)
• feat(dns-resolver): add Unbound access list CRUD (1ad150c)

Bug Fixes

• fix(ui): remove the dead Users entry from the avatar menu (c8ebff3)
• fix(ui): submit Datastar forms as urlencoded data (dfd7e3d)
• fix(agent): omit anchored pf tables from the tables list (4cd195a)
• fix(deps): upgrade tailwind-merge-go to v0.2.3 (f4cd1fc)

Documentation

• docs(dns-resolver): reference access list implementation commit (11f20e4)

Testing

• test(ui): drop stale form lint exemption (6587673)

Install on pfSense:

fetch -o - https://github.com/danielmichaels/pf-central-artifacts/releases/latest/download/install.sh | sh

v0.0.10

v0.0.10

Features

• feat(authz): enforce roles and add member management (6fc6663)
• feat(notify): add email delivery for invites and resets (3fdea6e)

Bug Fixes

• fix(notify): warn when emailed links use a localhost base URL (3ec0c37)
• fix(auth): reject invites for addresses that are already members (c4ca304)
• fix(notify): warn when SMTP TLS is not enforced in production (a06c111)

Refactoring

• refactor(authz): consolidate member rules and page chrome (a1c967d)

Documentation

• docs: drop the retired plan-workflow guidance from CLAUDE.md (46f1f21)
• docs: document the role model and member management (e5b99bc)

Chores

• chore: retire the .tasks workflow and its skills (771836e)
• chore: drop the dead .tasks entry from Coastfile exclude_paths (71ffbc4)
• chore: merge origin/main into feat/member-management (09a0d05)

Install on pfSense:

fetch -o - https://github.com/danielmichaels/pf-central-artifacts/releases/latest/download/install.sh | sh

v0.0.9

v0.0.9

Features

• feat(ui): add authenticated API explorer (f79d2a2)
• feat(ui): surface system stats and gateway RTTsd on the overview (06cc8c9)

Bug Fixes

• fix(version): show the tag alone on tagged builds (c63f4a7)
• fix(agent): parse the real dpinger socket status format (bfd89ab)

Refactoring

• refactor(ui): simplify API explorer state (410516b)

Documentation

• docs(website): showcase API explorer (7a6463e)

Install on pfSense:

fetch -o - https://github.com/danielmichaels/pf-central-artifacts/releases/latest/download/install.sh | sh

v0.0.8

v0.0.8

Features

• feat(ui): list every device page in the command palette (c8d091c)

Bug Fixes

• fix(ui): bind Datastar handlers written with a hyphen (d64ff6f)

Install on pfSense:

fetch -o - https://github.com/danielmichaels/pf-central-artifacts/releases/latest/download/install.sh | sh

v0.0.7

v0.0.7

Features

• feat(release): generate release notes and enforce conventional commits (b56eba7)

Bug Fixes

• fix(deploy): strip the leading v from the Docker build version (26e7847)

Refactoring

• refactor: check conventional commits with the hook only (0a54a04)
• refactor: drop the commit-lint script and its test (9895d4d)

Testing

• test: run commit-lint checks in a scratch repository (d1bbac6)

CI

• ci: require git-cliff in the release step instead of downloading it (099ddd6)
• ci: generate release notes with the pinned git-cliff image (0088474)
• ci: base release notes on the last stable tag (6f546b7)

Install on pfSense:

fetch -o - https://github.com/danielmichaels/pf-central-artifacts/releases/latest/download/install.sh | sh

v0.0.7-rc.1

v0.0.7-rc.1

Features

• feat(release): generate release notes and enforce conventional commits (b56eba7)

Refactoring

• refactor: check conventional commits with the hook only (0a54a04)
• refactor: drop the commit-lint script and its test (9895d4d)

Testing

• test: run commit-lint checks in a scratch repository (d1bbac6)

CI

• ci: require git-cliff in the release step instead of downloading it (099ddd6)
• ci: generate release notes with the pinned git-cliff image (0088474)

Install on pfSense:

fetch -o - https://github.com/danielmichaels/pf-central-artifacts/releases/latest/download/install.sh | sh

v0.0.6

pf-central v0.0.6

Install on pfSense:

fetch -o - https://github.com/danielmichaels/pf-central-artifacts/releases/latest/download/install.sh | sh