Security: Trivy is a baseline not a gate, and the backend image ships no pip
The Trivy jobs run with --exit-code 0, so a green Trivy check is not evidence of
a clean image -- the findings go to the Security tab instead. Read it after the
final push, not before.
The backend image now uninstalls pip after the application is installed: pip is
not needed at runtime and its vendored msgpack/setuptools were the only source
of HIGH findings against the image. python -m ensurepip restores it in a running
container.
135dff8
Development/Security: dependency ceilings, the real merge guarantee, and the CodeQL suite name
Development: document the two dependencies deliberately held below their newest
release -- the redis Python client at 5.x because arq pins redis<6, and
typescript below 6.1 because no published typescript-eslint declares support for
TypeScript >=6.1. Both produce a red CI rather than a working upgrade.
Development: the CI & contribution section claimed a pull request must be
up-to-date with main before merging. The ruleset does not require that. Replace
it with what actually holds: a pull_request run tests head merged into the base
tip at the time it runs, so a green check can be stale by the time the merge
happens; and on Dependabot pull requests the three required CodeQL Analyze
contexts never run, so those merges pass through the admin ruleset bypass.
Security: the scan table named the CodeQL query suite "security-and-quality".
Default setup does not offer that suite -- this repository is on "extended",
which resolves to security-extended, confirmed in the config API and in every
analysis's SARIF codeqlConfigSummary.
2cac15c
Security: correct the CodeQL claim; document outbound device TLS
Security.md asserted there is no CodeQL workflow in the repository. CodeQL is
in fact active through GitHub default setup (security-and-quality suite over
Python, JS/TS and Actions), which is precisely why no codeql.yml exists — the
absent file had been read as an absent scanner. Add it to the scan table and
record the Dependabot-PR consequence.
Also document outbound TLS to managed firewalls, which the Transport security
section did not cover: the three per-device trust modes, the fingerprint pin as
the compensating control when verification is off, and the honest gap that an
already-onboarded device cannot have those settings changed from the console.
Troubleshooting now points at the actual field instead of naming the option.
c0a9e86
Reporting: experimental SMTP OAuth Connect button (v0.22.0)
a071fdc
Security: document remember-this-device (trusted devices), v0.21.0
cbe9058
docs(wiki): make Screenshots gallery thumbnails clickable (link to full-size image)
eae3e8a
docs(wiki): WebAuthn passkeys as a second MFA factor (v0.20.0)
18c2153
docs(wiki): OAuth2 (XOAUTH2) SMTP auth for Gmail + Microsoft 365 (v0.19.0)
5729914
docs(wiki): sub-project 4 — per-sub-version Business->Community base map from opnsense/changelog
64edd48
docs(wiki): v0.17.0 — management-IP config-audit attribution (opngms / api_external) + config-changes screenshot
5b61ce9
Architecture + Reporting: document the config_audit source + Config changes report section (v0.16.0); backfill the Reliability section row
81fe241
Architecture: document the service/reliability events source (v0.15.0)
1fcdacb
Troubleshooting: revert now covers all live-applied kinds except ids_rulesets (v0.14.0)
2dffd45
Configuration-Editor: document the ids_policy curated template kind (v0.13.0)
bbab6a9
Log-Lake: CRL hard-revocation (receiver-enforced) + verified HA node-loss; Security: least-privilege syslog CA key
6dee000
docs(config): explain that in-app settings persist across a compose restart
Runtime overrides (global app_setting.runtime_config + per-tenant tenant_retention)
live in the opngms_pg volume, so a restart / down+up / image upgrade does NOT reset
them to defaults; only 'down -v' (destroying the volume) does.
9da95d3
docs: audit log viewer (v0.10.0) + per-tenant retention (v0.11.0)
Audit section in Security (viewer + CI guard + non-RLS code-gate); retention knobs
in Configuration; per-tenant indices + worker-owned retention in Log-Lake; the
report<->retention guard in Reporting; Home capability rows.
93b08ff
docs: Security/Perimeter feature + tunables + refreshed screenshots; perimeter report sections toggled with the others (not per-device)
c9b9d4d
docs: note OPNGMS is bounded by the OPNsense API + public plugins
Architecture gains a 'Scope & limitations' section; Configuration-Editor
gains a 'Coverage limits' subsection under The catalog — both stating that
OPNGMS is a client of the OPNsense API (can't do what the API doesn't
expose; non-MVC settings read-only) and that the catalog/plugin coverage is
built from public opnsense/core + opnsense/plugins, so Business-only plugins
are not covered.
3279d96
docs: add Screenshots page; accurate MASTER_KEY rotation (all 5 encrypted columns); mark editor 3c shipped
df83e2e
docs: add OPNsense trademark & non-affiliation disclaimer to the wiki home
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ed288a5
docs: add UI screenshots to key wiki pages
Embed product screenshots (referenced from the main repo's docs/ui via raw
GitHub URLs) on Home, Architecture, Configuration-Editor, Reporting, Log-Lake,
and Security.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
6105b65
docs: comprehensive OPNGMS wiki (install, architecture, config, editor, log lake, security, reporting, ops)
Add the full operator + contributor manual as 12 wiki pages, every claim
grounded in the repository:
- Home / _Sidebar — overview and persistent navigation
- Installation — prerequisites, four TLS models, pull & start, first run
- Architecture — component diagram, services, data flows, RLS multi-tenancy
- Configuration — complete environment-variable reference
- Upgrading — pull+up flow, version pinning, backups, MASTER_KEY rotation
- Configuration-Editor — the version-aware editor & catalog pipeline (3a/3b
built; 3c diff/config.xml-map fenced as planned/not-built)
- Log-Lake — the optional mTLS syslog to OpenSearch lake
- Reporting — SMTP delivery, per-tenant settings, schedules
- Security — RLS, encrypted-at-rest secrets, MFA, CI scans, hardening
- Troubleshooting — grouped symptom to cause to fix
- Development — local dev, tests, CI, contribution flow
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
59ef432