The previous commit accidentally bumped the toolchain to Go 1.25 via
`go get`. Downgrade golang.org/x/term and golang.org/x/sys to versions
that work on Go 1.23 and update the agent-release workflow to match.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Implements a RustDesk-style short-code pairing feature across agent, backend, frontend and docs.
Key changes:
- Agent CLI: adds `serverkit-agent pair` command (agent/cmd/agent/pair.go) that generates/loads an Ed25519 keypair, enrolls with the panel, shows a rotating pair code, and saves credentials on claim. Adds passphrase marker handling and interactive/headless modes.
- Agent internals: new pairing package with client and keypair (agent/internal/pairing/*.go). Keypair files are encrypted using new exported config EncryptBytes/DecryptBytes utilities and MachineID() helper in agent/internal/config/config.go. go.mod/go.sum updated (Go version and x/term, x/sys bumps).
- Backend API: new pairing blueprint exposing endpoints for enroll, poll, code refresh/freeze, lookup and claim (backend/app/api/pairing.py). Adds PendingAgent model (backend/app/models/pending_agent.py) to track enrollments and their lifecycle.
- Backend service: pairing_service (backend/app/services/pairing_service.py) implements enrollment, rotation, long-polling, claim handling, credential minting and one-shot delivery. Adds a background pairing pruner thread to remove expired pending enrollments (registered in backend/app/__init__.py).
- Frontend: add API client support and page changes to integrate pairing flow (frontend/src/services/api/pairing.js, modifications to Servers.jsx and api index).
- Docs: adds pairing.md explaining the pairing flow.
Why: provide a secure, user-friendly mechanism for operators to claim new agents via short rotating codes and a passphrase, simplifying server onboarding while protecting credentials and preventing brute-force attempts.
Add ngrok 'tunnel' mode to dev scripts and documentation, plus a large UI overhaul for the Servers pages.
- Add .gitattributes and new scripts/setup-wsl.sh helper.
- Extend dev.ps1 and dev.sh with a new 'tunnel' mode that starts backend+frontend and launches an ngrok tunnel (supports NGROK_DOMAIN, NGROK_AUTHTOKEN, and sets sensible CORS_ORIGINS). Includes polling of ngrok API, process cleanup, and helpful error messages.
- Update docs/LOCAL_DEVELOPMENT.md with an "Exposing Your Local Control Plane (ngrok)" guide and WSL setup notes.
- Revamp frontend pages: ServerDetail.jsx and Servers.jsx refactored with new header layouts, status/avatars, status pills, telemetry rows, selectable table rows, bulk actions, confirm dialogs, improved add-server modal, new icons (FolderTinyIcon, MoreIcon), utilities (formatLastSeen, clamp), and accessibility/interaction improvements (menus, selection, copy install command).
- Update servers SCSS to support the new layouts and loading states.
These changes add a developer-friendly tunnel mode for remote testing and significantly improve the server management UX in the frontend.
Introduce a centralized Deployments page that lists all deployment jobs across local and remote agents with real-time status, step progress, and live log tail. Adds route /deployments, sidebar link under Services, and command palette entry. Fixes undefined $primary variable in _templates.scss by switching to $accent-primary, restoring the frontend build.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Introduce a deployment jobs system to support cross-server template installations and remote execution. Adds DeploymentJob and DeploymentJobLog models, DeploymentJobService for job lifecycle, and DeploymentPlanRunner to execute plans locally or via agents. TemplateService gains build_install_plan and related helpers to produce executable plans; Template installs can run async (202) or synchronously. Backend API/CLI updated: new deployment-jobs endpoints, apps API uses RemoteDockerService for remote compose actions, and CLI commands (deploy-template, deployment-status, list-servers) were added. Agent and config changes: file access validation with allowed_paths, file write create_dirs option, default allowed paths, and install script/systemd read-write paths updated to permit /var/lib/serverkit and /var/serverkit. Migration file for deployment_jobs schema included.
Add end-to-end support for removing remote Docker networks and volumes and normalize remote API responses. Server: new Flask endpoints to DELETE remote networks/volumes and helpers to compute external base/ws URLs and v1 API paths. Agent: register new handler docker:network:remove and Client.RemoveNetwork implementation. Backend service: RemoteDockerService.remove_network uses agent registry for remote servers and falls back to local DockerService. Models: expand Server permission logic to map agent actions to profile/legacy scopes (DOCKER_READ_ACTIONS, scope expansion and wildcard matching) and add unit tests covering permission mappings. Frontend: handle agent-backed response shapes (unwrapRemoteData, normalizeListResponse), call new removeRemoteNetwork/removeRemoteVolume API methods, update download/install URLs to /api/v1, and tweak several UI texts. Install scripts: change config/log directories, pass --config when registering/starting agent, and update systemd/service/unit and Windows service install paths. README: small wording updates about fleet/remote deployment and monitoring.
Add loading and size props to EmptyState (imports Spinner, shows spinner when loading, adjusts icon sizes) and add a large variant styling. Update StyleGuide to demonstrate loading, large/not-installed/unavailable states, and card contexts. Refactor SCSS across pages/components to use Sass theme variables ($bg-card, $border-subtle, $text-secondary, $accent-primary, etc.) replacing many var(...) usages and tweak related spacing/typography styles.
Introduce a comprehensive Style Guide (frontend/src/pages/StyleGuide.jsx) as a developer-only design system reference, plus new SCSS modules (_style-guide.scss, _alerts.scss, _tables.scss) and updates to existing component styles. Register the page route and title in App.jsx and add a DEV-only sidebar link (import.meta.env.DEV) in Sidebar.jsx; also import SIDEBAR_ITEMS from sidebarItems. These changes centralize UI patterns, components and utilities for easier visual QA and consistent styling without exposing the guide in production builds.
Introduce a plugin installation and management system.
Backend: add InstalledPlugin model, plugin_service with download/install/enable/disable/uninstall, dynamic blueprint registration and frontend manifest generation, and plugins API endpoints (list/get/install/enable/disable/uninstall). Register plugins blueprint and attempt to hot-load installed plugin blueprints at app startup.
Frontend: add PluginLoader component (Vite import.meta.glob) to render plugin widgets, extend Marketplace UI to install/manage plugins, add API client methods for plugins, and update styles for the marketplace plugin UI. This enables installing plugins from GitHub/repos/zips and managing them from the app.
Generate private URL configs as location-only snippets in /etc/nginx/serverkit-locations instead of full server blocks. nginx_service.py: write location snippets (.conf) to LOCATIONS_DIR, ensure the locations directory, remove legacy separate server blocks, and add get_location_config to read these snippets (used for private URLs, Gitea, WordPress). install.sh & serverkit: only remove conflicting catch-all (server_name _) configs that are not ServerKit-managed (skip serverkit.conf and serverkit-*), strengthen the server_name regex, and create the serverkit-locations dir. cmd_doctor: add docker presence checks and avoid frontend checks when docker is missing; require root in --fix mode. Misc cleanup and minor refactors around enabling/disabling configs and reload handling.
Switch Gitea/WordPress to location-only snippets included into serverkit.conf and introduce /etc/nginx/serverkit-locations. NginxService now writes snippets to LOCATIONS_DIR, ensures the directory exists and removes legacy full-server configs to avoid server_name _ conflicts; validation blocks use of the reserved catch-all name. install.sh and the update path create the locations dir and remove any conflicting catch-all site configs. serverkit.conf proxy port updated (8080 -> 3847) and now includes the snippets directory. Add a new serverkit doctor command (with --fix) and help entries to run diagnostics and auto-fix common issues (nginx, docker, service health, ports, disk, DB, etc.).
Enhance install.sh Python installation logic: for Debian-family systems, use the deadsnakes PPA on Ubuntu, and for other apt-based systems build Python 3.12 from source (installing required dev packages, downloading Python-3.12.8, configure/make/make altinstall). For Fedora, attempt dnf install first and fall back to building from source if unavailable (installing required dev packages similarly). After install, verify python3.12 is present and print success or a helpful error message on failure.
Introduce a CommandPalette component (with styles) that opens via Ctrl/Cmd+K and fuzzy-searches static pages plus dynamic containers/servers fetched from the API. Add a persistent LogsDrawer and LogsDrawerContext with provider to manage collapsed/expanded/closed states; the drawer supports real-time log subscription, auto-scroll, clear, resize handle, and collapsed preview. Wire up DashboardLayout to include the LogsDrawerProvider, CommandPalette and keyboard shortcut. Update service LogsTab to pin a service to the drawer. Add a Show All / Hide All toggle to EnvironmentVariables and related state handling. Also import the new component styles in main.scss.
Introduce a full OverviewTab component (service info, resource metrics, recent deployments) and make it the default tab in ServiceDetail. Rework LogsTab: add search, level filtering, line-count selection, auto-scroll, live refresh, copy/download, line highlighting and memoized filtering; switch to rawLogs and wire lineCount through API calls. Enhance Services page with sorting options, summary cards, bulk select/actions, list header and per-row checkboxes, improved filtering/sorting logic and richer stats. Large SCSS updates to support the new overview, logs (v2) and services UI. These changes improve observability, filtering and bulk management of services.
Introduce unified provider integration helpers and provider-specific implementations. Adds _auth_headers, VULTR_OS_MAP and implements provider API calls for create/destroy/resize/snapshot/delete_snapshot for DigitalOcean, Hetzner, Vultr and Linode (using requests). Update snapshot deletion flow to call provider delete first and log failures before removing DB record. Implement _install_agent to SSH into a server and run the agent install script. Includes basic error handling, timeouts and mapping for Vultr OS IDs.
Register file handlers under the FileAccess feature flag and implement handlers for file read, write and directory listing. handleFileRead validates params, reads a file and returns base64-encoded content, path and size. handleFileWrite accepts base64-encoded content and optional mode, decodes and writes the file, and returns success/path/size. handleFileList lists directory entries and returns name, is_dir, size and modified timestamp (ms). Basic param validation and error wrapping are included; feature flag check updated from Features.Files to Features.FileAccess.
Add is_admin to User serialization so frontend can check admin privileges. Standardize frontend BEM modifiers to simpler utility classes across multiple pages (btn-primary, btn-sm, btn-danger, modal-header/modal-body/modal-footer/modal-close, etc.) and update various modals/buttons to use the new classes. Enhance DNSZones by introducing PROVIDER_CONFIG to provide provider-specific labels, placeholders, help text and extra fields (Route53 AWS keys/region), and adjust the zones page header UI. Add .text-muted utility to SCSS. These changes unify styling and improve DNS provider configuration UX.
Enforce admin and workspace permissions, improve logging, and add DNS frontend/API support.
- Backend: added admin checks to cloud_provisioning and marketplace endpoints; added require_workspace_access helper and applied to multiple workspace endpoints to enforce membership/admin access; persist push subscription data in mobile API (commit to DB); replaced print() debugging with structured logger calls across agent_registry and added logging/exception handling in monitoring_service.
- Frontend: added a DNS API client (frontend/src/services/api/dns.js) and registered it in the API index; extended DNSZones UI to collect provider zone ID and API token, updated create payload and form reset; added optional modal footer prop to Modal component; moved rollup native binding to optionalDependencies in package.json.
- Misc: added '*.png' to .gitignore and a minor spacing change in install.sh.
These changes improve security checks, observability, and add DNS management features in the UI/API.
Frontend and backend updates to improve activity visibility and multi-server support.
Backend: extend activity summary window to 90 days and add per-day series for the top user (top_user_daily) to the activity summary API.
Frontend:
- Activity tab refactor: rename feed→logs, add pagination, server-side audit log fetching, richer filters, icons, action formatting, details rendering, and improved loading/empty states.
- New ContributionGraph component + styles to visualize daily activity and per-user contributions; graphs injected into ActivityTab.
- Sidebar: separate manual vs auto-expanded state, auto-expand active parent, and persist preset switch locally while persisting to API in background.
- Dashboard: add server selector and remote-server metrics fetching, use remote metrics when a non-local server is selected, adjust polling and refresh semantics, and various UI/icon tweaks.
- Appearance tab: remove inline white-label UI; introduce a dedicated WhiteLabelTab component for custom branding.
Misc: add component and page SCSS files and small README updates describing new features and priority areas.
Replace many lazy imports/Suspense with direct page imports and expand route mappings (new pages, renamed routes and updated PAGE_TITLES). Simplify loading state to a basic placeholder and adjust Private/Public/Setup route behavior. Revamp Sidebar to support collapsible subItems, auto-expand parents based on location, per-item expand toggles, and updated icon/chevron usage; update sidebarItems data to include subItems for Servers, Domains, Files, Monitoring and Marketplace and simplify preset handling. Introduce a shared ConfigPanel component and migrate Logic/Notification/Script panels to use it (add icon/color, delete footer, improved form controls, hints and examples). Normalize node components (LogicIf, Notification, Script, Trigger) to use consistent icon/styling classes, status handling and layout improvements. Miscellaneous UI/UX tweaks and small refactors across workflow components and styles.
Move Downloads into Marketplace as a lazily-loaded tab and integrate it into the tab navigation (replace local tab state with useTabParam and register 'downloads' in VALID_TABS). Add lazy-loaded StatusPages to Monitoring, extend VALID_TABS and add the Status Pages tab and rendering via Suspense with LoadingState fallback. Also update App.jsx comment to reflect that Downloads was absorbed into Marketplace and adjust Spinner imports to expose LoadingState.
Add a reusable Modal component (handles Escape key, focus trap and consistent markup) and refactor many inline modal implementations across the frontend to use it (EnvironmentVariables, LinkAppModal, QueryRunner, security tabs, GitConnectModal, ApiKeyModal, etc.). Implement React.lazy + Suspense for large pages and replace loading placeholders with a shared LoadingState; add route normalizations/redirects and tab-aware routes. Add new UI primitives (EmptyState, StatusBadge), an About settings tab, sidebar presets/appearance links and related sidebar logic, plus new styles. Also add the @rollup/rollup-win32-x64-msvc dependency to package.json.
Replace the monolithic frontend/src/services/api.js with a new module at frontend/src/services/api/index.js to better organize and modularize the API layer. The previous large api.js file was removed and its functionality has been relocated into the new directory-based module (index.js). Update any imports referencing frontend/src/services/api.js to import from frontend/src/services/api (or the new index path) as needed.
Broad refactor and hardening across backend and frontend:
- Standardize API error responses by removing legacy `success` flags and returning concise error payloads.
- Replace inline admin decorators with centralized middleware import (admin_required) in DB and Docker APIs.
- DatabaseService: add safer MySQL execution helpers and secure user-creation flow (hex-encoding, env-pwd usage) and improve pg drop to validate identifiers.
- Models: add eager-loading (subquery) for relationships and add indexes to frequently queried columns to reduce N+1 and improve performance.
- DockerService: add structured logging and error messages for better observability when Docker commands fail.
- Config: tighten ProductionConfig cookie settings (secure, httponly, samesite).
- Frontend: migrate many .less styles to .scss, add new security UI components and API client modules, update package metadata accordingly.
- Misc: add APP_IMPROVEMENTS.md to .gitignore.
These changes improve security, reliability, observability, and frontend styling consistency.
Update backend/requirements.txt to upgrade PyJWT from 2.8.0 to 2.12.1. This brings the JWT dependency to a newer release for bug fixes and improved compatibility with the authentication stack.
Phase 37: Progressive Web App manifest, service worker for offline caching,
push notification registration, quick actions API, mobile summary endpoint,
and offline data caching for server status.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Phase 36: Redis caching with in-memory fallback, cache decorator for
functions, background job queue with worker pool, job status tracking,
cache stats/flush endpoints, and job cleanup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Phase 35: DigitalOcean, Hetzner, Vultr, Linode integration, server creation
wizard (region/size/OS/SSH), auto agent install, cost tracking, snapshot
management, and destroy with confirmation safeguards.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Phase 34: Public status pages, automated health checks (HTTP/TCP/DNS/ping),
component grouping, incident timeline, maintenance windows, uptime tracking
(24h/7d/30d/90d), status badges, and customizable branding.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
