Skip to content

Nodeglow 2.0.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 17:09
· 53 commits to main since this release
v2.0.0
46f3dc6

Added

  • Multi-tenancy foundation (single tenant for now, nothing to configure):
    tenants, providers and sites; tenant_id on every tenant-owned table and
    every ClickHouse row; a fail-closed tenant filter on all database access;
    tenant memberships as the source of roles; per-tenant settings, caches,
    WebSocket/SSE fan-out and notifications; per-tenant fair scheduling of the
    check jobs. See docs/specs/2026-10-10-multi-tenancy-design.md.
  • A gating tenant-isolation test suite that walks every API route and every
    tenant job with two tenants (SQLite and PostgreSQL with RLS on); new routes
    must be classified there.
  • linux/arm64 release images are back: every image is a multi-arch manifest
    list (linux/amd64 + linux/arm64), built per platform on native GitHub
    runners instead of QEMU. Signatures and attestations cover the manifest
    list. The attached offline bundle stays amd64; build an arm64 one with
    scripts/make-offline-bundle.sh --platform linux/arm64.
  • PostgreSQL row-level security as the second tenant-isolation layer
    (NODEGLOW_RLS), with a separate app database user (POSTGRES_APP_USER,
    POSTGRES_APP_PASSWORD). New installs from install.sh get both; existing
    installs are unchanged until switched (docs/OPERATIONS.md, "Row-level
    security"). Migrations run on the owner connection (DATABASE_OWNER_URL,
    alias MIGRATION_DATABASE_URL, default DATABASE_URL).

Changed

  • Ping history retention now takes effect. "Ping history (days)" was
    stored but ignored: ClickHouse kept every ping result for its fixed 30-day
    TTL. The nightly cleanup now deletes a tenant's ping results older than the
    configured value. Installs that set a value below 30 lose the older ping
    history at the first cleanup after the upgrade; the default (30) changes
    nothing. Values above 30 cannot be honoured (the table keeps 30 days) and
    the setting is now limited to 1-30.
  • ClickHouse tables carry a tenant id (multi-tenancy). Existing rows belong to
    the default tenant; a background job rebuilds each table once so the tenant
    leads its sort key (needs free disk of about twice the table's size; the
    old copy is kept for 24 h).
  • Frontend build tooling moved to Tailwind CSS 4 (CSS-first @theme in
    frontend/src/app/globals.css instead of tailwind.config.ts, PostCSS via
    @tailwindcss/postcss). The UI looks the same (pixel-compared in dark and
    light at desktop and phone width). This clears the remaining npm audit
    findings of the dev toolchain (braces, micromatch, postcss-selector-parser
    via Tailwind 3; braces via @next/eslint-plugin-next's fast-glob, now
    overridden with tinyglobby), and CI now fails on high findings in build
    tooling too.
  • If you override DATABASE_URL (e.g. in docker-compose.override.yml) and
    enable a separate app user, also set DATABASE_OWNER_URL; otherwise the
    migrations would target the bundled db. The backend logs an error when
    the two URLs name different databases.

Fixed

  • Syslog lost its host mapping and allowlist after the tenancy schema
    upgrade (2026-10-11 hotfix).
  • Backup/restore routes are installation-operator only; previously any tenant
    admin could export or replace the whole installation.
  • System status listed expiring certificates of other tenants; host parents,
    alert-rule sources and SNMP credentials could reference another tenant's
    objects; twelve routes accepted foreign ids.
  • Backup restore on PostgreSQL (sequence reset and timestamp handling).
  • PostgreSQL: backup export skipped every table after the dropped legacy
    table ping_results, a restore of such an export failed, and
    /api/system/status lost its later sections for the same reason.

Install

curl -fsSLO https://github.com/jubacCH/Nodeglow/releases/download/v2.0.0/install.sh
sudo sh install.sh --version 2.0.0

Images (linux/amd64 + linux/arm64, cosign-signed, SBOM + provenance):

  • ghcr.io/jubacch/nodeglow-backend:2.0.0
  • ghcr.io/jubacch/nodeglow-backend-community:2.0.0
  • ghcr.io/jubacch/nodeglow-frontend:2.0.0
  • ghcr.io/jubacch/nodeglow-updater:2.0.0

Air-gapped: nodeglow-2.0.0-offline-amd64.tar.gz → sh install.sh --offline <bundle>; for arm64 build it with scripts/make-offline-bundle.sh --version 2.0.0 --platform linux/arm64.
Verify downloads and images: docs/INSTALL.md.

Assets 10
Loading