Skip to content

Release v0.3.0 - RBAC, VM Portability & App Store Expansion 🔐

Choose a tag to compare

View all tags
@m-schwarzinger m-schwarzinger released this 13 Mar 17:29
· 199 commits to development since this release
0.3.0
6c39aa5

🎉 What's New in UpservX v0.3.0

This release is the biggest security and feature update since the initial launch. The authentication layer has been fully rewritten around HttpOnly session cookies and Linux-group-based access control, VMs can now be exported and imported as industry-standard OVA/OVF packages, the App Store grows by 19 new one-click templates, and the UI receives a full customization system together with a polished light/dark/system theme toggle.

✨ New Features

🔐 Group-based Access Control (RBAC)

Every API request is now checked against the authenticated user's Linux groups. Users only see and can access what their groups explicitly permit — no more all-or-nothing admin access.

Linux Group Access granted
sudo / wheel Full administrator (all endpoints)
docker Container management, Docker images, App Store
lxd / lxc LXC container management, LXC images
libvirt / kvm Virtual machine management, ISO management
disk / storage Physical storage management
tty System shell access
adm / log Log viewer access
  • API keys and cluster tokens retain implicit full-admin rights
  • The sidebar dynamically hides items the current user has no permission for
  • New GET /auth/me endpoint returns username, Linux groups and a structured permissions object
  • New GET /info endpoint exposes the server hostname without requiring admin access

🍪 Session-Cookie Authentication

The auth token has been moved out of localStorage and into an HttpOnly SameSite=Lax cookie, eliminating the entire class of XSS token-theft attacks.

  • POST /auth/login issues the session cookie; POST /auth/logout deletes it server-side
  • All frontend fetch calls use credentials: "include" — no more manual Authorization headers
  • Session is validated on page load via /auth/me; sidebar does not render until permissions are resolved (no flash of wrong content)
  • Removed hardcoded admin:admin Basic-auth fallback from api.ts

📦 VM OVA/OVF Export

Virtual machines can now be exported as portable, standards-compliant OVA or OVF packages and imported into any compatible hypervisor (VMware, VirtualBox, Proxmox, etc.).

Export (POST /vms/{name}/export):

  • Accepts { "format": "ova" | "ovf" }
  • Converts disks from qcow2 to VMDK (streamOptimized) via qemu-img
  • Builds a standards-compliant OVF 1.0 descriptor with CPU, RAM, network and disk mappings
  • SHA-256 manifest file (.mf) generated and included automatically
  • OVA → single TAR archive; OVF → named directory under /etc/upservx/exports/
  • VM must be stopped before export — running VMs are rejected with a clear error

Import (POST /vms/import):

  • Accepts multipart upload (.ova / .ovf) plus name, network_mode, bridge_interface, autostart, storage_path
  • OVA archives extracted with path-traversal protection; OVF directories read directly
  • VMDK disks converted to qcow2 via qemu-img convert with auto-detected source format
  • VM registered with libvirt via virt-install --import and added to the UpservX registry
  • Export ↓ and Import buttons added to the Virtual Machines UI (Grid + List views)

🛒 App Store — 19 New Templates

The App Store now ships with 19 additional pre-configured one-click applications:

Networking

  • RustDesk – Self-hosted remote desktop relay and ID server (hbbs + hbbr)
  • Apache Guacamole – Clientless browser-based RDP/VNC/SSH gateway
  • Traefik – Modern reverse proxy with automatic Docker service discovery and Let's Encrypt SSL

Development

  • Harbor – Enterprise container image registry with RBAC and Trivy vulnerability scanning
  • GitLab – Complete DevSecOps platform with CI/CD pipelines and container registry
  • Docker Registry – Lightweight private registry with web UI

Security

  • Keycloak – Identity and Access Management; SSO, OIDC/OAuth 2.0/SAML 2.0
  • OpenLDAP – Centralised LDAP directory with phpLDAPadmin web UI

Productivity

  • ONLYOFFICE Community Edition – Full office suite (DocumentServer, CommunityServer, MailServer)
  • Roundcube – Browser-based IMAP webmail client

Monitoring

  • Loki – Horizontally scalable log aggregation by Grafana Labs
  • MotionEye – Web frontend for the motion daemon; supports USB cameras and IP streams

Other / Data

  • Apache Kafka – Distributed event streaming platform in KRaft mode with Kafka UI
  • Elasticsearch – Search and analytics engine (v8.17.0) with Kibana
  • Mailcow – Complete self-hosted mail server suite (17 containers)
  • Neo4j – Graph database (v5) with APOC plugin and Browser UI
  • RabbitMQ – Message broker with Management UI
  • OctoPrint – Web interface for 3D printers with USB and webcam support
  • Tunarr – Virtual live TV channels from Plex/Jellyfin/Emby libraries

📄 App Store Pagination

  • Configurable page size: 10, 20, 30 or 50 apps per page (default: 20)
  • Numbered page buttons with ... ellipsis, Prev/Next navigation
  • App count ("X Apps gefunden") and page indicator ("Seite X von Y")
  • Automatically resets to page 1 on search, category or page-size change

🎨 Application Customization

Admins can now brand the login screen and dashboard without touching any code.

  • Login Banner Text: configurable title and subtitle on the login page left panel
  • Custom Logo: upload PNG/JPG/SVG/GIF/WebP — replaces the default logo on the login page and in the sidebar
  • Custom Banner Image: upload a background image for the login page left panel
  • Image previews displayed in the Settings UI; files can be removed to revert to defaults
  • Files stored in /etc/upservx/customization/; text config in config.json
  • All GET customization endpoints are public (no auth required) so the login page can load them before a session exists

🖥️ UI Improvements

  • Theme toggle in sidebar: Light/Dark toggle switch + System mode button, placed directly above the user profile row — the top-right header toggle has been removed
  • Header removed: the now-empty top bar has been removed entirely, giving content more vertical space
  • Logout icon: the logout button is now a compact icon to the right of the username
  • Light mode fixes: tabs now have a visible grey background (slate-200); outline and link button variants use text-foreground in light mode instead of hardcoded text-white
  • Active sidebar item: removed the white dot indicator from selected navigation items

⚙️ API Changes

New endpoints:

Method Path Description
GET /auth/me Returns username, groups and permissions
POST /auth/logout Deletes the session cookie server-side
GET /info Returns server hostname (no admin required)
POST /vms/{name}/export Export VM as OVA or OVF
GET /vms/exports/{filename} Download exported VM archive
POST /vms/import Import VM from OVA or OVF upload
GET /settings/customization Get customization config
POST /settings/customization Save banner text config
POST /settings/customization/logo Upload custom logo
DELETE /settings/customization/logo Remove custom logo
GET /settings/customization/logo/file Serve custom logo file
POST /settings/customization/banner Upload custom banner image
DELETE /settings/customization/banner Remove custom banner
GET /settings/customization/banner/file Serve custom banner file

Changed:

  • Auth middleware resolves Linux groups and enforces check_path_permission() on every request
  • System shell WebSocket now uses has_shell_access() instead of is_admin() — tty group members can access the shell
  • getAuthHeaders() / getJsonHeaders() no longer inject Authorization headers; auth is handled via session cookie

Security:

  • HTTP 403 returned for any path the caller's Linux groups do not cover
  • admin:admin Basic-auth fallback permanently removed
  • Session token stored in HttpOnly cookie — not accessible to JavaScript

📦 Upgrade Notes

On first start after updating, the backend will automatically resolve the groups of authenticated users on every request — no database migration or manual step required.

Action required for multi-user setups: Ensure each user that needs access is in the appropriate Linux group (e.g. docker, libvirt, tty) before updating. Users not in any recognised group will receive HTTP 403 on all protected endpoints after the update.

The localStorage-based token is no longer used. Existing sessions will be invalidated on upgrade — users will need to log in once after the update.

Assets 2
Loading