Block a user
c980f29aad
Harden storage engine: stream checksum validation on PUT/UploadPart/POST (no 5GiB RAM buffering), enforce conditional writes + object-lock retention + bucket quotas atomically at the storage commit (fixes TOCTOU races incl. internal writers), encrypt-before-commit SSE PUT with single-write ciphertext install + chunked streaming decryption for full/range/MPU-SSE-C GETs, fsync data/segments/dirs before ack, bounded replication queue with workers + reconciliation + overflow journaling, hard-link version snapshots, range-windowed segment opens (narrow reads of 10k-part objects open ~2 files), opt-in HDD admission control (HDD_READ/WRITE_CONCURRENCY, 503 SlowDown on queue timeout) with disk-pressure metrics + UI card; docs + 11 e2e hardening tests
3b24108579
Replace aggregate _index.json metadata with per-object sidecar files (METADATA_LAYOUT=sidecar): O(1) metadata writes, sidecar>index>legacy read order forever, fail-closed corruption handling (422 + RMW write guard + listing blanking) replacing the corrupt-index empty-map destruction bug, --migrate-meta one-shot CLI with no-rollback warning and startup notice, integrity scanner sidecar precedence; add S3 IncompleteBody error code with declared-length enforcement across PutObject/UploadPart/SSE-C/checksum paths (short aws-chunked bodies previously stored truncated with 200) incl. transport-error mapping; docs + UI docs synced
18e5f91c76
v1.3.0: Flashcards with spaced repetition, insights dashboard, library folders, smarter web search
2a182a49d2
v1.3.0: Flashcards with spaced repetition, insights dashboard, library folders, smarter web search
v1.3.0: Flashcards with spaced repetition, insights dashboard, library folders, smarter web search
v1.3.0: Flashcards with spaced repetition, insights dashboard, library folders, smarter web search
2a182a49d2
v1.3.0: Flashcards with spaced repetition, insights dashboard, library folders, smarter web search
v1.2.0: Add opt-in AI memory and cross-chat recall
v1.2.0: Add opt-in AI memory and cross-chat recall
15c2ddcf51
Sync all docs to code (rate limits, quota/XML APIs, GC+integrity tables, metrics endpoints, segments layout, peer-cred scope), vendor Bootstrap 5.3.2 for offline deployments, fix uptime epoch to server boot with h/m granularity, compact bucket list view, opaque sticky object-table header, floor metrics interval env vars, and delete dead classify_endpoint
38297fae0e
Fix metrics observability: persist-backed S3 error-code summary (1h/6h/24h) surviving snapshot rollover and restarts, real x-amz-error-code recording, per-bucket error attribution, recent-errors drill-down with request IDs, error-codes-over-time chart with zero-filled gaps, atomic+quarantined metrics persistence, shutdown flush, single startup snapshot, cached storage walk (METRICS_STORAGE_REFRESH_MINUTES), and no idle writes
0375cf98de
Add end-to-end managed restic backups: agents can back up their own host and the server can itself act as the append-only restic endpoint the fleet backs up to, with client-side encryption so neither the endpoint nor the monitoring server ever sees plaintext or the repo password. Agent side: --enable-backup plus --backup-repos (with optional --backup-repo-names/--backup-paths/--backup-time, or the matching SM_* env vars) provisions restic 0.19.0 pinned to a SHA256 checksum and installed as root-owned /usr/local/bin/sm-restic, a root-owned /etc/servermonitor-backup holding backup.toml, a generated backup.key that is never regenerated, and a printed-once recovery kit; systemd sm-backup.service/.timer (oneshot, CAP_DAC_READ_SEARCH confined to backup time and excluded from --enable-all), a weekly sm-backup-check.service/.timer running restic check --read-data-subset 5%, and a no-timer sm-backup-restore@.service template whose in-place restore args come only from the systemd instance name, all execing the root-owned agent copy rather than the self-upgradable one; multiple [[repo]] endpoints are backed up sequentially and independently for corruption isolation, with prune_mode host/external and per-repo env_file S3/B2 credentials allowlisted and kept out of backup.toml, the status file, metrics, logs, and the UI; sm-agent gains backup run/check/restore/snapshots/init subcommands, a restore staging guardrail that refuses any target outside /var/lib/servermonitor/restore (--in-place refused on Windows, where restore is staging plus manual copy under VSS --use-fs-snapshot), a shared backup.lock so run/check/restore never fight the restic cache, and a --drill restore-verification; Windows mirrors this with scheduled tasks and an ACL-locked %ProgramData%\\ServerMonitor\\Backup. Observability: a backup collector reads a host status file into backup_* metrics (last-success age, run/check ok, duration, added/total bytes, snapshot count, check age), surfaced as a host-detail Backups tab and backup stale/failed/repo-check-failing alert presets. Server endpoint: a backupserver speaks the restic REST protocol on /backup/<name>, append-only (refuses every delete and every overwrite except restic lock files) with absolute per-credential namespace isolation, backed by local disk (BACKUP_DIR) or S3 (BACKUP_S3_BUCKET/REGION/ENDPOINT/PREFIX/USE_PATH_STYLE), capped by BACKUP_MAX_BLOB_BYTES, and refusing plaintext unless TLS is terminated natively, by a trusted proxy, or via automatic Let's Encrypt (BACKUP_ACME_DOMAIN); a Backups target admin page and /api/v1/backup-targets API mint a once-shown credential stored only as a SHA-256 hash, rotate it, revoke it (POST /backup-targets/{id}/revoke), and Measure per-repo usage. Guarded target deletion: DELETE /backup-targets/{id} now hard-deletes a target row but only when the backend namespace holds no objects, checked by object existence rather than byte sum so a zero-byte object still blocks it, and creating a target refuses a name whose namespace already holds objects so a fresh credential can never rebind to orphaned blobs; the UI shows Delete only on empty rows while the endpoint stays authoritative and never destroys a blob. Add migrations 0011_backup_status and 0012_backup_targets, and deploy/BACKUPS.md documenting the disaster-recovery runbook, rest-server/S3/B2 endpoint setup, and borg-to-restic migration. Bump to 0.3.0.
55ed2cce04
Store completed multipart objects as immutable segment files with a sparse stub at the key path (MULTIPART_OBJECT_LAYOUT=segments): O(metadata) completes on any filesystem, zero-copy versioned overwrites, layout-aware readers for GET/range/partNumber/copy/replication/select, GC orphan-segment sweep, and x-amz-version-id on CompleteMultipartUpload
0de5f03a45
Fix GC freed-bytes total (emit total_bytes_freed, count quarantine), make scan pollers back off instead of giving up with stale failure counters, recover cluster auto-refresh after outages via shared PollingManager, sweep remaining json_encode|safe XSS patterns, delete dead bucket-detail modules, memoize static ETags with vendor caching, and surface Chart.js load failures
23c174efc3
Fix UI XSS (escapeHtml no-op, JSON-island script breakout) and harden admin pages: offline-peer card recovery, GC freed-bytes undercount, vendored Chart.js, poller guards, connections edit refresh
03b10b195e
Unify object timestamp display across browser UI and sync folder navigation with ?prefix= URL for deep links and back/forward
55ed2cce04
Store completed multipart objects as immutable segment files with a sparse stub at the key path (MULTIPART_OBJECT_LAYOUT=segments): O(metadata) completes on any filesystem, zero-copy versioned overwrites, layout-aware readers for GET/range/partNumber/copy/replication/select, GC orphan-segment sweep, and x-amz-version-id on CompleteMultipartUpload