Skip to content

SNI Certs / Docker socket proxy / Bugs fixies

Latest
Latest

Choose a tag to compare

View all tags
@btouchard btouchard released this 20 Jul 12:57
v1.3.5
78864af

SNI support for certificate checks, plus fixes for empty webhook payloads and the REST logs endpoint, and clearer Docker-socket security guidance.

New features

Certificates - SNI server name

Certificate monitors gain an optional server_name field. When set, it is sent as SNI during the TLS handshake and the certificate is validated against it instead of the hostname ? so you can check which cert a reverse proxy would serve for a given vhost (keepalived/failover setups). Several monitors can target the same host:port with different SNIs. (#34)

Bug fixes

  • Webhook payloads were empty. Webhook subscriptions dispatched every event as a near-empty synthetic alert (entity_id:"", id:"", zero timestamps), and the HMAC signature didn't match the body. Deliveries now carry the real event as {type, timestamp, data}, signed correctly. (#35)
  • REST logs endpoint always failed. GET /api/v1/containers/{id}/logs returned RUNTIME_UNAVAILABLE even with a healthy runtime (the log fetcher was never wired). This is the fallback the UI uses when SSE streaming hiccups.
  • Wrong previous_state on reconcile. State changes detected after a restart emitted previous_state equal to the new state; the real prior state is now reported.

Security & docs

  • Docker socket proxy is now the recommended setup. A :ro socket mount is not a security boundary ? the flag protects the file, not the API. maintenant's Docker usage is fully read-only and honours DOCKER_HOST, so it runs behind a docker-socket-proxy that rejects writes with 403. The security guide, reference compose, and DOCKER_HOST env var are documented.
  • Bind-address guidance. Clarified why 0.0.0.0 is required inside containers, that the published port is what actually exposes it (and triggers maintenant's own "port exposed" finding), and how to acknowledge it. (#32)

Upgrade notes

  • Automatic DB migration (migration 25 + a one-time cert_monitors rebuild) adds the SNI column and identity. No manual steps; back up the .db first as usual.
  • Webhook consumers: the delivery body changed from {event, alert:{?}} to {type, timestamp, data:{?}} ? matches what the "Send test payload" button already sent. Verify the HMAC over the raw body.

No API breaking changes beyond the webhook body shape. Rebuild the image to upgrade.

Assets 2
Loading