- Modified the CI workflow in `quality.yaml` to use `pnpm exec turbo` for running tests and builds, improving efficiency for the @evofw/api package.
- Added a new export for development in `package.json` of the db package, allowing direct access to the source TypeScript file.
These changes enhance the CI process and improve the development experience for the db package.
- Added .release-version, CHANGELOG.md, and deploy/docker/docker-bake.override.hcl to .gitignore.
- Removed Dockerfile as part of the cleanup.
- Updated AGENTS.md and README.md to include new documentation on CI/Docker processes and deployment instructions.
- Enhanced package.json with new devDependencies for commit linting and semantic release.
- Updated pnpm-lock.yaml to reflect new dependencies and versions.
These changes streamline the project structure and improve documentation clarity.
- Updated the `evofw-firewall.sh` script to clarify the handling of incoming traffic for port ACLs, ensuring accurate rule application for Docker NAT and local addresses.
- Enhanced the UI description for port ACLs to specify that only incoming traffic is affected, improving user understanding of the firewall behavior.
- Revised documentation to reflect the updated logic for port ACLs, emphasizing the distinction between incoming and outgoing traffic and the implications for service accessibility.
These changes improve the clarity and functionality of port ACL management, enhancing user experience and system reliability.
- Refined the `collect_nft_stats` function in `evofw-firewall.sh` to iterate over multiple chains, improving packet counting accuracy for dropped and accepted packets.
- Updated the port ACL handling to include new chains in the firewall rules, ensuring comprehensive coverage for input, forward, and prerouting.
- Enhanced the UI to clarify the behavior of port ACLs, emphasizing the distinction between EvoFW and system rules, and the implications of open ports.
- Improved documentation to reflect the updated port ACL logic and its interaction with Docker NAT, ensuring users understand the new behavior.
These changes enhance the functionality and clarity of port ACL management, improving user experience and system reliability.
- Updated the `evofw-firewall.sh` script to refine the port ACL logic, ensuring the correct order of operations for deny and allow rules.
- Introduced a new structure for port ACL rows in the UI, allowing for better management of system and EvoFW rules.
- Enhanced the documentation to clarify the new port ACL behavior, including implicit drops for open ports and the distinction between EvoFW and system rules.
- Improved the handling of port ranges and source addresses in the UI, ensuring accurate representation of firewall rules.
These changes improve the functionality and clarity of port ACL management, enhancing user experience and system reliability.
- Added a `maybe_self_update` function in `evofw-firewall.sh` to allow agents to pull the latest version of the sync script from the server, enhancing the agent's ability to stay updated.
- Updated the `/v1/agent/sync-script` endpoint to return ETag and script SHA256 headers, enabling efficient caching and conditional requests.
- Modified the agent policy response to include `script_sha256`, providing visibility into the current version of the sync script.
- Enhanced tests to verify the self-update functionality and ensure correct behavior of the sync script endpoint.
These changes improve the maintainability and reliability of Linux agents by enabling automatic updates of critical scripts.
- Introduced a new `sanitizeHostFirewall` function to filter and validate host firewall rules and listeners, ensuring only valid entries are processed.
- Updated the `apply-report` endpoint to prevent overwriting existing host firewall snapshots with empty payloads, improving data integrity.
- Enhanced the `applyReportHostFirewallSchema` to define the expected structure for host firewall data, allowing for better validation and error handling.
- Added tests to verify the behavior of the new sanitization logic and the preservation of existing snapshots, ensuring robustness in the API's handling of firewall data.
These changes improve the reliability and accuracy of host firewall data management within the API, enhancing overall monitoring capabilities.
- Improved the `collect_host_firewall` function in `evofw-firewall.sh` to utilize temporary files for better handling of large rule sets, avoiding ARG_MAX limitations.
- Updated the JSON output structure to omit null/empty optional fields, ensuring compatibility with historical data formats.
- Enhanced error handling and logging for the firewall collection process, providing clearer diagnostics in case of failures.
- Adjusted related tests to accommodate changes in the expected output format, ensuring robust validation of the host firewall snapshot functionality.
These changes enhance the reliability and clarity of the host firewall data collection process, improving overall monitoring capabilities.
- Added support for managing desired L4 port ACL rules for Linux agents, allowing for open/close actions on specified ports.
- Introduced a new endpoint for CRUD operations on port rules, enhancing the API's capabilities for agent management.
- Implemented functionality to collect and report host firewall snapshots, capturing observed rules and listeners for better monitoring.
- Updated the agent detail view to include tabs for managing port ACLs and viewing host firewall data, improving user experience.
- Enhanced documentation to reflect the new features and API changes, ensuring clarity for users and developers.
These changes significantly improve the management and visibility of firewall rules and port access control for agents.
- Implemented a reset mechanism for per-IP baselines in the agent routes, ensuring accurate tracking after policy application.
- Updated tests to simulate traffic flush scenarios, verifying that IP hit statistics reset correctly and accumulate as expected.
- Modified the UI to reflect changes in terminology from "Sync windows" to "Hits" for better clarity in agent details.
- Enhanced documentation to explain the new behavior of IP hit tracking and baseline resets, improving user understanding.
These changes improve the accuracy and usability of IP hit tracking for agents, particularly in scenarios involving policy changes.
- Updated the `client_version` in the `mikrotik-install.rsc` script from `rsc/5` to `rsc/6` to reflect the latest changes.
- Enhanced the firewall filter rule management by ensuring that new rules are added at the top of the `input` and `forward` chains using `place-before`, improving the order of execution and efficiency.
- Updated documentation in `agents.md` to clarify the new behavior of filter rules being placed at the beginning of the chains.
These changes enhance the functionality and clarity of the MikroTik installation process, improving overall firewall management.
- Updated the `evofw-firewall.sh` script to improve the handling of NFT sets, ensuring compatibility with kernel limitations on counters and enhancing logging for better diagnostics.
- Introduced a new presence mode for MikroTik, allowing for real-time tracking of IP hits with updated last seen timestamps and packet counts.
- Enhanced the API to support the new presence mode, updating the database interactions to reflect the changes in how IP hits are recorded.
- Updated the agent detail view to display sync windows for MikroTik, providing clearer insights into blocked IPs and their activity.
- Improved documentation to reflect the new features and changes in the MikroTik handling process, ensuring clarity for users and developers.
These changes significantly enhance the monitoring capabilities and user experience for agents, particularly those using MikroTik devices.
- Added functionality to report per-IP drop counters in the `evofw-firewall.sh` script, capturing the top 200 IPs with packet counts.
- Introduced new API endpoints to retrieve blocked IP statistics and reset these stats for agents, enhancing monitoring capabilities.
- Updated the agent detail view to display blocked IPs, improving user visibility into agent performance.
- Enhanced database schema and repositories to support the storage and management of IP block statistics.
These changes provide a comprehensive view of blocked IPs, improving the overall management and monitoring of agents.
- Expanded the ReUI documentation to reflect the addition of 20 free building blocks, including new components like `icon-tile`.
- Updated descriptions and usage guidelines across various rules and components to ensure clarity and accuracy.
- Enhanced the API references and examples to align with the latest changes in the ReUI framework, including updates to the `data-grid` component.
- Improved the registry setup instructions and free vs premium component distinctions for better user guidance.
These changes enhance the overall usability and understanding of the ReUI framework, providing users with comprehensive resources for effective implementation.
- Added a new linting command for OpenAPI specifications in the package.json, improving code quality checks.
- Updated frontend documentation to clarify component usage and structure, including detailed descriptions for `SettingsShell` and `Auth callback`.
- Refactored agent-related API routes to streamline control-plane functionalities, consolidating multiple routes for better organization.
- Improved error handling in the API to provide more informative responses for validation errors, enhancing user feedback during interactions.
These changes enhance the overall development experience and improve the management of agents within the application.
- Introduced delete functionality across multiple agent components, including AgentCard, AgentCardsGrid, AgentDetailSheet, and AgentDetailView, allowing users to remove agents directly from the UI.
- Integrated a confirmation dialog to prevent accidental deletions, enhancing user experience and safety.
- Updated relevant props and handlers to manage delete actions consistently across components.
These changes improve the overall management of agents, providing users with the ability to easily delete agents while ensuring confirmation for critical actions.
- Updated the `mikrotik-install.rsc` script to include cumulative packet tracking for dropped and accepted packets, improving visibility into firewall performance.
- Adjusted the JSON report structure to reflect the new packet statistics, ensuring accurate data is sent during synchronization.
- Enhanced logging to provide detailed insights into the synchronization process, including packet counts for better monitoring.
These changes improve the overall functionality and monitoring capabilities of the agent installation and synchronization process.
- Consolidated the `mikrotik-install.rsc` script to utilize a single `evofw-sync` script for improved clarity and efficiency in synchronization processes.
- Removed the legacy `evofw-env` script, simplifying the token management and ensuring a more reliable update mechanism.
- Updated the token generation logic to enhance security and reliability, while ensuring compatibility with RouterOS 7+.
- Adjusted test assertions in `install-links.test.ts` to verify the presence of new script components and ensure accurate testing of the installation logic.
These changes improve the overall robustness and maintainability of the agent installation and synchronization process.
- Refactored the `mikrotik-install.rsc` script to fetch and process the agent policy as JSON instead of using the previous `.rsc` format, improving reliability and performance during policy synchronization.
- Introduced a new global variable `EvofwLastHash` to track the hash of the fetched policy, enabling efficient updates and preventing unnecessary changes.
- Updated the logging and error handling to provide clearer insights during the synchronization process.
- Adjusted related test assertions in `install-links.test.ts` to reflect the new policy endpoint and ensure accurate testing of the installation logic.
- Enhanced documentation in `agents.md` to clarify the new synchronization method and its implications for agent configuration.
These changes enhance the robustness and clarity of the agent installation and synchronization process, ensuring better performance and user experience.
- Modified comments in the `mikrotik-install.rsc` script to clarify the naming convention for filter rules, ensuring consistency with `policy.rsc`.
- Updated the test assertions in `install-links.test.ts` to reflect the new comment names in the firewall filter rules, enhancing test accuracy.
These changes improve the clarity and reliability of the firewall configuration and associated tests.
- Updated the token generation logic in `mikrotik-install.rsc` to use a portable random string method, ensuring compatibility with RouterOS 7+.
- Enhanced the token format to include a random number for better uniqueness, improving security and reliability during agent installation.
These changes enhance the robustness of the installation process for agents, ensuring more reliable token generation.
- Modified the logging statement in `evofw-firewall.sh` to include `default_action` instead of `mode`, ensuring accurate reporting of the applied action during firewall configuration.
- This change enhances clarity in the logs, providing better insights into the firewall's operational state.
- Improved the collection and reporting of agent traffic statistics, including total packets dropped and accepted, to provide a more comprehensive view of agent performance.
- Updated the `evofw-firewall.sh` script to capture and report traffic statistics before chain recreation, ensuring accurate data retention.
- Enhanced the installation script to support updates on already-installed agents, allowing for script and timer refresh without re-enrollment, while preserving existing credentials.
- Refactored UI components to utilize new traffic statistics, improving clarity and user experience in displaying agent performance metrics.
These changes enhance the overall functionality and usability of the agent management system, providing better insights and easier updates for users.
- Implemented a new API endpoint to reset agent statistics, allowing for better management of agent performance data.
- Updated the AgentCard component to display traffic statistics in a consolidated format, improving clarity for users.
- Enhanced the AgentDetailView to include a button for resetting agent stats, providing a direct action for users.
- Refactored the AgentFleetDataGrid to show combined traffic metrics, streamlining data presentation.
- Added a utility function to delete stats samples for agents in the database, ensuring data integrity.
These changes improve the user experience by providing more intuitive controls and clearer data representation for agent statistics.
- Updated the AgentDetailSheet component to enhance layout and integrate a new detail view for agents, improving user experience.
- Refactored the agents page to support a toggle between card and table views, allowing for better organization and accessibility of agent information.
- Adjusted routing for agent links to utilize search parameters, streamlining navigation to specific agent details.
- Removed unused imports and optimized component structure for better maintainability.
These changes contribute to a more intuitive and user-friendly interface across the application.
- Enhanced vertical rhythm in the frame component by adjusting padding values for header, content, and footer, ensuring consistent alignment and improved readability.
- Updated the agents page to incorporate a new tab structure for better organization of agent statuses, along with a refined search and filter functionality to enhance user experience.
- Removed unused imports and streamlined the code for better maintainability and performance.
These changes contribute to a more cohesive and user-friendly interface across the application.
- Updated the `sourceMeta` function to accept a database parameter, allowing for dynamic retrieval of list names based on list IDs.
- Modified the `ruleTarget` and `ruleSubtitle` functions to utilize the new list name mapping, improving the readability of policy rules in the UI.
- Introduced memoization for list names in the `PolicySetDetailPage`, optimizing performance and ensuring accurate display of list names in the policy rules sortable component.
These changes enhance the user experience by providing clearer and more informative labels for policy rules, facilitating better understanding and management of policies.
- Introduced a new function to resolve EvoBGP community IDs, allowing for better handling of legacy labels and UUIDs.
- Updated `fetchEvobgpCommunity` to return both resolved community IDs and CIDRs, improving data retrieval.
- Enhanced the ListsPage component to manage community IDs separately from user input, ensuring accurate configuration during list creation.
- Updated documentation to reflect changes in community ID resolution and integration with the UI.
This update improves the user experience by ensuring that community IDs are correctly resolved and stored, facilitating smoother interactions with the EvoBGP API.
- Updated `evofw-firewall.sh` and related scripts to replace `policy_mode` with `default_action`, enhancing clarity and consistency in policy management.
- Adjusted agent routes and evaluation logic to accommodate the new default action structure, ensuring backward compatibility with legacy modes.
- Enhanced tests to validate the new default action behavior and its integration within the agent policy framework.
- Refactored related components in the web interface to align with the updated policy handling, improving user experience and reducing confusion around policy modes.
- Updated ResourcePage to support customizable table layout and column pinning, improving data presentation and user interaction.
- Introduced a new `formatAgentSeen` function in AgentsPage for better date formatting of agent last seen timestamps.
- Adjusted column sizes and added min/max size constraints for various columns in AgentsPage to enhance layout consistency.
- Enhanced the tooltip functionality for displaying agent last seen timestamps, improving user experience.
- Updated `evofw-firewall.sh` to correctly handle exit codes from the `curl_policy` function, ensuring proper script termination based on policy retrieval status.
- Enhanced `install.sh` to always use single quotes for configuration values, improving safety for names with spaces, and refined the logic for updating the `KERNEL_BACKEND` in the configuration file.
- Updated documentation to reflect the changes in quoting and exit behavior during installation and synchronization processes.
- Introduced an uninstall script for agents, allowing users to easily remove the agent with a single command.
- Updated `install.sh` to quote configuration values for safety, ensuring compatibility with names containing spaces.
- Enhanced the installation process to include a warning if the uninstall script cannot be downloaded.
- Updated documentation to reflect the new uninstall functionality and changes in configuration file handling.
- Refactored `install.sh` to improve package installation logic, supporting multiple package managers (apt, dnf, yum, apk).
- Added functions to ensure required packages (`curl`, `jq`, `python3`, `nftables`, `iptables`, `ipset`, `cron`) are installed only if missing.
- Implemented systemd timer support for scheduling, with fallback to cron if systemd is unavailable.
- Updated documentation to reflect changes in dependency installation and scheduling mechanisms.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Updated `evofw-firewall.sh` to handle empty deny/allow rule sets, allowing agents without rules to function correctly.
- Improved `install.sh` to ensure the sync script is downloaded before enrollment, with added validation for the script's content.
- Modified agent route to record `lastSeenAt` and `lastSeenIp` during enrollment and policy fetching, ensuring accurate tracking of agent status.
- Added tests to verify that approved agents can fetch an empty policy without rule sets.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Removed the use of `dirname` and `fileURLToPath` for determining the agent scripts directory.
- Introduced `resolveAgentScriptsDir` function to simplify and centralize the path resolution logic in both `agent.ts` and `install-links.ts`.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Removed the Stepper component from AddAgentSheet, transitioning to a single form layout for agent creation.
- Updated the component's description and adjusted the UI elements for improved clarity and user experience.
- Enhanced the input fields and layout to streamline the agent installation invite process.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Updated the AddAgentSheet component to replace StepperDescription with paragraph elements for improved styling and consistency.
- Adjusted text classes to enhance visual presentation of agent selection instructions.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Updated QuickActionItem interface to support optional `onSelect` handler and `badgeLabel`.
- Refactored QuickActionGrid to conditionally render links or buttons based on the presence of a `to` property.
- Introduced search functionality in ResourcePage, allowing users to filter items based on a search query.
- Added search input to the ResourcePage toolbar, improving user experience for data management.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Added support for policy modes ('blacklist' and 'whitelist') in agent and policy set management.
- Updated API endpoints to handle policy mode during agent assignment and rule operations.
- Enhanced the web UI to display and manage policy modes for agents and rules, ensuring all assigned sets share a consistent mode.
- Introduced new validation to enforce single policy mode across assigned sets for agents.
- Improved error handling for policy mode conflicts and updated documentation accordingly.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Updated the agent enrollment process to include an 'invited' status, allowing for better tracking of agent states.
- Implemented support for install links that can now include an `install_link_id`, facilitating the transition from invited to pending status upon enrollment.
- Enhanced the MikroTik installation script to include the `EvofwInstallLinkId` for better tracking and management.
- Added new API endpoints for fetching agent policies and serving MikroTik-specific installation scripts.
- Improved the web UI to reflect the new agent statuses and provide copyable installation commands for agents.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Added new API endpoints for creating, retrieving, and revoking install links for agents.
- Enhanced the agent installation process with short links accessible via `/agent-install/:id` and `/:slug`.
- Updated the README and documentation to reflect the new installation method and usage instructions.
- Refactored relevant components in the web application to support the new install link feature.
- Improved error handling and validation for install link operations.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Introduced constants for selection items in both list detail and lists pages to enhance code readability and maintainability.
- Updated the Select components to utilize the new constants, streamlining the rendering of options for 'add mode' and 'create source'.
- Improved user experience by ensuring consistent labeling and structure across selection interfaces.
- Changed label for 'list' to 'Вложенный список' in status badge and list entry management.
- Refactored list entry handling to support new 'plaintext' and 'nested' modes for adding entries.
- Enhanced user experience by auto-detecting entry types and improving placeholder text.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Updated Toaster component to support rich colors and position.
- Added breadcrumb navigation for list detail pages.
- Removed deprecated ListsCatalog component to streamline the codebase.
- Refactored list detail page to improve entry management and user experience.
- Enhanced filtering and navigation features in the lists overview.
Co-authored-by: Cursor <cursoragent@cursor.com>
Тема в NavUser вместо ModeToggle в header; KpiStatGrid/QuickActionGrid по эталону EvoBGP; обновлены rules и contract.
Co-authored-by: Cursor <cursoragent@cursor.com>
Каталог слева — Frame/Item вместо тяжёлого ResourcePage; KPI детали — одна полоса stats-7; Sheet с ScrollArea и sticky footer.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Updated API to support structured list entry inputs, allowing for nested list references.
- Improved error handling for list operations to prevent cyclic references.
- Refactored UI components to ensure consistent labeling and navigation for IP lists.
- Enhanced list detail and catalog pages with better filtering and entry management features.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Added endpoints for adding and deleting entries in IP lists.
- Refactored list creation logic to handle manual list types more effectively.
- Updated refresh logic to rebuild manual list entries.
- Improved error handling for entry operations to ensure data integrity.
- Enhanced response structure for list detail retrieval.
Co-authored-by: Cursor <cursoragent@cursor.com>
Правила живут в policy_sets; evaluate мержит назначенные наборы; источник list|CIDR|hostname с кэшем DNS.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Added new dependencies for drag-and-drop functionality with @dnd-kit packages.
- Updated package versions for @tanstack/react-virtual and date-fns.
- Refactored AppShell component to utilize AppSidebar and SiteHeader for improved layout.
- Enhanced Frame component with new theming capabilities and improved structure.
- Introduced filtering capabilities in Agents and Lists pages with new UI elements.
- Added new utility functions for authentication claims management.
Co-authored-by: Cursor <cursoragent@cursor.com>
