Skip to content

v1.2.0

Latest
Latest

Choose a tag to compare

View all tags
@zrougamed zrougamed released this 31 Jul 13:10
v1.2.0
44f76ae
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Orion Belt v1.2.0

Highlights

  • curl|bash server installer (scripts/install-server.sh): distro packages, optional local Postgres (reuse / recreate / DSN), public URL + WebAuthn prompts, systemd/OpenRC, osh client.yaml for the installing user.
  • server.public_url / public SSH advertise with gateway-info defaults for Add agent and setup wizard.
  • Docker quickstart: GHCR images or build-from-source.
  • In-app notifications for access-request events; admins also get a notice when WebAuthn is enabled in config but fails to initialize.
  • Hard-delete agents/users no longer blocked by session/permission FKs; schema self-repairs on migrate.

Installer & ops

  • Scheme-based public URL ports (http→80, https→443); API listen port aligned.
  • Postgres already present: reuse, recreate orionbelt, or paste a DSN (--recreate-db for unattended).
  • WebAuthn: dotted domain required; LAN-only names warned; bad lab config soft-fails so the gateway stays up.
  • Writes ~/.orion-belt/client.yaml with a readable admin key (not /root/... for sudo users); best-effort orion-belt-tools install.

Fixes

  • Delete agent after recorded sessions (sessions_machine_id_fkey / related FKs).
  • Delete user with sessions/grants; attribution columns SET NULL where appropriate.
  • API agent delete removes synthetic agent_id user (matches CLI).
  • Startup/CLI migrate repairs drifted FK ON DELETE rules and granted_by nullability only when needed.

Notes / known limitations

  • Revoke/pause/archive can still be cleared when an agent reconnects (IsActive forced true) — follow-up.
  • Public POST /public/register/client still accepts is_admin (lab bootstrap); lock down or disable in production.
  • OpenFGA (if enabled): grant sync/TTL drift vs Postgres is not fully closed in this release.
  • Archiving an agent keeps the name reserved (UNIQUE); re-use the same name only after hard-delete.
  • Recording retention still targets cast files by mtime and may leave .enc / DB session rows.

Upgrade

  1. Install/restart v1.2.0 (migrate runs on start and repairs FKs).
  2. Re-run or refresh installer script if you rely on curl|bash / osh client.yaml improvements.
  3. After upgrade, revoke → delete for agents with history should succeed.
Assets 46
Loading