Changelog

Fixed

• One-click update: the host updater's sandbox made root's home folder read-only, so docker compose --build could not write its build state and the update stopped before anything changed (0.8.0 kept running). The updater may now write /root/.docker, and a failed build that left the old version running is reported as "rolled back, running again" instead of "did not come up".

Security

• The console viewer no longer has the Docker socket: a new docker-proxy service is the only container with it and lets through exactly what the viewer needs (create, start, stop, inspect, logs and remove of TrixOS viewer containers with the kvm-viewer image on the viewers network, no privileges, no mounts); everything else gets 403. The viewer runs as uid 1000 without capabilities.
• Outgoing URLs are checked when connecting (webhooks, custom ISO downloads, PXE boot files from OS profiles): the address is resolved once, refused if internal, and exactly that address is used — DNS rebinding no longer gets around the check. Redirects are checked hop by hop. NAT64, IPv4-compatible and 6to4 IPv6 addresses of internal IPv4 addresses are refused too.
• 2FA codes work once: a code (or an older one) can't be used again — login, enabling and disabling 2FA.
• zod 4 (fixes GHSA-mrhx-c7xc-m3w5); PATCH requests no longer reset fields that weren't sent.
• /api/docs only for signed-in admins (TRIXOS_API_DOCS=admin|public|off); the public reference stays on api.trixos.sh. The web build ships no source maps.
• The API believes a forwarded client address only from the web container (TRUST_PROXY: web), the license server only from its local proxy.
• The installer (curl … | bash) verifies the signed release record before unpacking; unsigned, altered or downgraded releases are refused.
• Images contain no test files, seed scripts or development keys.

Added

• Built-in HTTPS for installations: install.sh --domain panel.example.com [--email …] sets up Caddy with a Let's Encrypt certificate, HTTP → HTTPS and HSTS; TRIXOS_REAL_IP_FROM (none, local, addresses) says which proxy may pass the client address to nginx. Without a domain the installer warns that the panel is plain HTTP.

Changed

• Tooltips also open on disabled buttons; the overview's Advanced switch sits in the Monitoring header.
• Website and docs screenshots show the 0.8 pages; docs text colour matches the logo.

Added

• One-click updates: admins see a new release under the version in the sidebar and update with one click (changelog shown first, progress and log, automatic rollback when the new version does not come up). Releases are signed with Ed25519 (trixos-X.Y.Z.tar.gz.sig, binding version, package hash and git commit); the panel and the host updater (/usr/local/sbin/trixos-update, systemd path unit, no Docker socket in the containers) only accept packages signed by a pinned key (trx-rel-1), never a downgrade. GET / POST /system/update.
• Owner console for licenses at license.trixos.sh/admin: every license with its installation, servers in use, term and state; issue, edit, extend, suspend, revoke, replace key, release installation; audit log, CSV export. Owner accounts only from the CLI, mandatory TOTP, lockout, CSRF tokens, strict headers, optional IP allowlist.
• System → Agents: manage site agents (status, update, install command, usage, remove agent, delete site).
• Settings → QR labels: logo (Trivox, TrixOS or your own), position, size, logo inside the QR code; live preview.
• Server page: tooltips with HTML content; IPMI device Features (power usage, web console, noVNC, serial console per server); reveal the stored BMC password (admins, audited); netmask in the IP addresses tab.
• /firmware: overview per BIOS / BMC (up to date, update available, not in catalogue), view per hardware model with "Update N" for all outdated servers, separate catalogue and history tabs. /inventory: servers without hardware data with "Read from BMC" for all, view per model.

Changed

• Server overview shows traffic, temperatures and fans; an Advanced switch adds every other sensor, the traffic table and power usage. The Graphs tab is gone.
• Reinstall and Rescue are two tabs, each one page without steps.
• IPMI device: "Via agent" is required, the iPXE BIOS/EFI file is always automatic, the command dialog runs changes as a job without typing the hostname.
• License moved into Settings (one compact card); My profile only in the profile menu; the mode box left the sidebar; dashboard: control server, agents and watchdog in one card, more compact.
• Server list: hostname and owner are styled as links. IPAM: an Edit button instead of row clicks. OS catalogue: profiles and scripts are edited on their own pages.
• Website: calmer landing page with one palette from the logo, navbar with Home and an active state that follows the page.

Security

• Client IP can no longer be spoofed with X-Forwarded-For on customer installs (login throttling, console link binding, PXE source check, audit log).
• Content-Security-Policy without inline scripts, Permissions-Policy, COOP; cross-origin changes and websocket upgrades with the session cookie are refused.
• 2FA: wrong codes count towards the login throttle; login takes the same time for unknown users; changing your own password needs the current one.
• Request bodies with huge lists or deep nesting are refused before validation; GET /settings no longer returns license ciphertext; Redfish paths can't redirect credentials to another host; containers run with no-new-privileges and without Linux capabilities.

Added

• Watchdog: jobs, steps, queued jobs, poller tasks and long-running API loops have time limits (per job type and step, overridable under Settings → watchdog or TRIXOS_WATCHDOG_LIMITS). A job over its limit, without a worker heartbeat or stuck in a resume loop is stopped through the normal cancel path (PXE disarmed, power never touched) and fails with the reason, e.g. "Stopped by the watchdog: step wait:installer-started ran 47 min (limit 40 min). Last: No DHCP request from … — the server probably did not PXE boot". Every ipmitool, Redfish and SNMP call has a hard deadline naming command and host. Shown in the job drawer, job lists and on the dashboard; event and audit entry job.watchdog; GET /system/watchdog.
• Hardware from the BMC: CPUs, memory modules, Smart Array / RAID controllers with their disks, NIC ports, power supplies and system model are read over Redfish (HPE iLO 4/5, Dell iDRAC, Lenovo XCC, Supermicro) or IPMI FRU — without booting the server. "Read from BMC" on the inventory tab; automatic for servers without hardware data (after saving the BMC, the TenantOS import and in the daily firmware poll). OS-scan data always wins over BMC data. The header badges (CPU, RAM, storage, port speed) now show as soon as any source knows the value.

Removed

• The ping monitor: no "no ping" hint, no server.down / server.up events (removed from webhook subscriptions), no reachable field, no POLLER_PING_INTERVAL_S; table ping_status dropped (migration 0016_drop_ping_status). The status comes from the BMC alone. The dashboard shows "Powered off" instead.

Changed

• license.trixos.sh is HTTPS only (Cloudflare "Full (strict)"; Caddy no longer serves it over HTTP).

Changed

• Remote console like TenantOS (compared on the TenantOS installation, see docs/TENANTOS_CONSOLE.md): every console opens in its own popup window (with a link dialog when the browser blocks popups) with a top bar — server, connection and power state, Ctrl+Alt+Del and F-keys, clipboard and "type text" for BIOS/installers, noVNC settings (scaling, view only, quality, compression; remembered), BMC login when allowed, fullscreen and end session. The session ends with "End session", when the window closes, or when the console ends on the server side (closing the Java window stops its container); the window shows why.

Added

• Temporary BMC user for customers (IPMI): created with the configured web user privilege when the console connects, deleted at the end, leftovers cleaned up after an API restart; guarded like every destructive action (never on protected servers, live mode only). With it (or the client IPMI account) customers also get the BMC web interface.
• IPMI device: Java version (8, 11, 17, auto = 8; the JNLP launcher is fetched and started without security prompts), console browser (Chromium, or Chromium with a legacy-TLS bridge for BMCs that only speak TLS 1.0/1.1) and web user privilege.

Added

• Server page like TenantOS: badges for CPU (cores @ clock), memory, storage and port speed above the tabs; Power and Console menus next to QR label (the Console tab and the power card are gone).
• Configuration tab in the TenantOS layout: Assigned connections is a list of what the server has plus Add connection (only types that apply: PDU only when the datacenter has one, PoE only on a PoE port); every connection card (DHCP, PXE, SNMP switch, PDU, power usage) can be deleted, Main details and the IPMI device stay; label-left rows with info tooltips, Update / Delete in the card footer.
• Execute IPMI Command dialog (gear icon on the IPMI device card) with the TenantOS command set: read-only commands run directly, power / boot device / identify need the hostname and run as a job, everything else is refused (no options, no shell characters, nothing that changes BMC users or network). Client IPMI account in its own dialog (users icon).
• Website: redesigned landing page with a screenshot slideshow (tabs, autoplay that pauses, swipe, keyboard), Discord (dc.trivox.sh) in the header and footer of all three sites.

Changed

• Server status is the BMC's power state, like TenantOS; "no ping" is a separate hint next to it.
• Reachability check: two ICMP echoes, and a host that drops ICMP counts as reachable when it answers (or refuses) on TCP 22, 3389, 443 or 80.

Fixed

• Long-waiting jobs (shell discovery, installs) no longer get stuck after a deploy: when the old worker stops, the queue gives such a job up as "stalled" while it is still running in the database. The worker now looks for these jobs every 2 minutes (before: only on start) and resumes them at their step.

Changed

• Panel polish (Emil Kowalski's design-engineering rules): custom ease-out curves and durations under 300 ms, press feedback on buttons, tabs and icon buttons, modals scale from the centre (bottom sheet on phones), drawers and menus open from their edge / trigger, toasts use interruptible transitions and pause while hovered or hidden, no animation on constantly hovered rows and links, instant sidebar collapse, reduced-motion fallbacks; long hostnames, names and e-mails wrap or show in full on hover, stable number widths.
• Website: new trixos.sh landing page (hero with install command, migration from TenantOS, setup steps, feature sections incl. configuration, hardware/RAID, power/PDU kWh and system health, pricing, FAQ), the TrixOS logo SVG on trixos.sh, docs.trixos.sh and api.trixos.sh (favicons: the mark), Outfit as display font, panel blue as accent, admin docs for the 0.7.0 features.

Added

• Configuration tab on the server page: main details, assigned connections (power management via BMC, PDU outlets, PoE or none; reinstallation provider; remote console), IPMI device (via agent, credentials, BMC port, validated ipmitool flags, install power action, console mode, web BMC login provider, fake date for old Java consoles, client IPMI account shown to the customer), DHCP/PXE (MAC, boot mode with the detected mode, iPXE BIOS/EFI file per server), SNMP switch port with PoE (status/control over POWER-ETHERNET-MIB) and the power usage source. Every setting takes effect; site agent 1.4.0 serves the per-server iPXE files.
• Rediscover hardware with three ways: via PXE (reboot, powered off afterwards), via a shell command (now with the agent's hostname instead of its IP, and the agent opens its HTTP port for that server) or inside a running TrixOS rescue system without a reboot.
• Inventory collects RAID/HBA controllers (incl. ssacli/storcli details), the physical disks behind HP Smart Array and MegaRAID/PERC, NIC model/driver/firmware/slot, DIMM details, GPUs, PSUs, chassis and the BMC address.
• Traffic table under the bandwidth graph (direction, volume, current rate, average rate, 95th percentile).
• Power usage in kWh (per hour / 6 hours / day), switchable to watts, with energy, current, average and peak draw.
• The TrixOS logo as SVG (brand/), used for the panel sidebar, login page and favicon.

Fixed

• Server list status said "On" for servers that are powered on but do not answer ping (the server page said "On · no ping"); the list now shows "On · no ping" too, and a power state older than 10 minutes is faded.
• Shell discovery could not download its script: the site agent only let PXE clients reach its HTTP port.
• Network interfaces are part of the hardware inventory card.
• Sensor graphs draw a straight line across times without readings (the grey areas still mark them).
• Saving a BMC no longer drops its other options.

Added

• PDUs under Network: APC (rPDU2 and older rPDU/sPDU) and Raritan (PDU2-MIB) over SNMP v2c/v3, plus a simulator. Total draw, current and voltage per inlet, outlet state and per-outlet power where the PDU meters it, read every 5 minutes (history 400 days), power graph and kWh per PDU. Outlets are mapped to servers (several for dual PSUs); admins switch mapped outlets on, off or cycle them (job outlet_power, protected servers refused, dry-run aware). The site agent forwards SNMP to the PDUs of its site.
• Server power usage: draw of the mapped outlets (or the BMC power sensor) on the server page and as a graph with kWh on the Graphs tab.
• Dashboard: control server and site agents: CPU, memory, disk and load with 24 h history, state of API, worker, poller, PXE, Postgres, Redis, job queue and license; below it one card per site agent (online, version, usage, WireGuard handshake, PXE state) with clear reasons for warnings. Agent 1.3.0 reports its host usage.
• Boot mode "auto" shows the detected firmware mode on the server page.

Fixed

• PXE on servers in UEFI mode with boot mode "auto" (g9test, HPE DL380 Gen9): TrixOS sent the legacy PXE flag over IPMI, which UEFI firmware takes and ignores, so the server never asked for DHCP. Auto now reads the firmware mode from the BMC (Redfish, also for HPE/Dell/Lenovo/Supermicro BMCs entered as IPMI), else uses the mode of the server's last PXE request, else tries legacy and retries once with UEFI PXE after 7 minutes without a DHCP request. When the BMC said UEFI and still nothing arrives, the override is set once more over Redfish.
• Graphs while a server is off: the charts no longer go empty. They keep the full time axis, grey out the time without readings (most BMCs report no sensors while the server is off) and offer the last readings.
• Jobs resumed after an update continue at the step they stopped at, also when the update added a step.
• Job list: firmware updates are labelled "Firmware update".

Changed

• Server list: only the hostname opens the server; a click elsewhere in the row does nothing (text can be selected and copied). Admins and resellers open the owner's user page from the Owner column.

Added

• Server list: choose how many servers a page shows (10, 25, 50, 100, 250 or 500) below the list; the choice is remembered in the browser, and switching keeps the servers you were looking at in view.

Added

• Website in the monorepo (website/): trixos.sh (product page with real panel screenshots, pricing, install one-liner, changelog, feature requests — disabled for now), docs.trixos.sh (admin docs: installation, platform updates, moving the panel or a site agent, guides per feature, configuration reference generated from the code) and api.trixos.sh (every endpoint, generated from the routes the panel uses). Published with website/scripts/deploy.sh together with /install and /releases/.

Fixed

• QR label: a long location (datacenter · rack · units) wraps instead of running off the label.
• Installer: builds the KVM viewer image, links to the right quick-start page.
• trixos user:create / seed / import-tenantos work through the trixos command in the source image as well (before only in release packages); trixos usage lists them.

Added

• Licensing: every installation is activated online. Community Edition (free, up to 10 servers, activated with an email address), Pro and Enterprise keys (License page, TRIXOS_LICENSE_KEY, or trixos license activate). The license server (apps/license, license.trixos.sh) signs 7-day leases with Ed25519; installations verify them with the public key compiled in, check in every 6 hours and are bound to their installation id, so leases cannot be forged, copied or kept alive by turning the clock back. Locked installations (no / revoked / expired license) answer 402 everywhere except sign-in and the License page, and run no jobs, polls or PXE; over the server limit TrixOS is read-only.
• Inventory management: a global Inventory page with every part across servers and stock (spare, defective, RMA, retired), counts per model, search by model / serial / server, CSV export; add, edit, install or take out parts. Rescans replace only the installed parts of that server.
• Discover hardware without a reboot: a one-line command for the running server reads CPU, memory, disks, NICs, BIOS and SMART (curl … | sudo sh, job token, valid 2 hours). Delete single components or clear the inventory. "Rescan via PXE" leaves the server powered off when it is done.
• CPU clock: base and turbo GHz from the kernel (cpufreq) instead of the BIOS' socket maximum; identical CPUs are one line "2 ×". Server list columns "CPU GHz (base / turbo)".
• Firmware updates through the BMC (Redfish UpdateService.SimpleUpdate, also for HPE iLO entered as IPMI): catalogue entries get an image URL, outdated servers an "Update BIOS / BMC" button; the job follows the flash and checks the version afterwards.
• Maintenance mode per server with a reason: shown as status "Maint." in the list (filter "In maintenance"), as a banner on the server and on the dashboard; customers cannot power, open the console or reinstall meanwhile, ping alerts are held back, webhook event server.maintenance.
• PXE diagnosis: the job view shows a PXE timeline (armed, agent, power cycle, DHCP request, lease, TFTP boot loader, iPXE, boot script, installer). A stuck boot names the missing step and what to check (e.g. "No DHCP request from … 4 min after the power cycle", PXE attempts from another NIC of the same server). Site agent 1.2.0 reports what dnsmasq sees.
• Power state poll every minute (POLLER_POWER_INTERVAL_S), "Refresh power" in the server list, trixos power status|refresh on the command line.
• QR labels as a modal on the server, rack and datacenter pages: Trivox logo in the middle of the code (error correction H, scan-tested), hostname, IPMI IP and location, Trivox logo underneath.
• Coloured icons for OS templates, rescue systems and tools.
• Release packages and installer for customer installs: scripts/package-release.sh builds a package of minified bundles only (no sources, no development key), curl -fsSL https://trixos.sh/install | bash installs or updates it on Ubuntu / Debian.
• Websites: trixos.sh (product, pricing, feature requests, changelog), docs.trixos.sh (admin docs), api.trixos.sh (reference of every endpoint, generated from the code; a test fails when an endpoint the panel uses is missing).

Security

• API token scopes are enforced on every route (they were stored but not checked); routes without a mapping need the admin scope.
• Custom ISO downloads and webhooks cannot reach internal addresses (loopback, RFC 1918, link-local / cloud metadata, CGNAT, ULA), redirects are checked hop by hop (TRIXOS_ALLOW_PRIVATE_URLS to allow).
• The PXE MAC is admin-only, validated and unique; one broken entry no longer stops PXE for a site.
• 30 failed API token logins from one address lock it out for 10 minutes.
• Boot scripts looked up by MAC (/pxe/boot) are no longer served on the public site, only through agents.
• Dependency updates: drizzle-orm 0.45, @fastify/swagger-ui 6, nodemailer 10.

Changed

• The /labels page is gone (labels are printed from the modal).
• The license has its own page (menu System → License).

Added

• Firmware versions: a firmware catalogue (newest BIOS / BMC version per model or HPE BIOS family, release date, download link, notes) on the new Firmware page, with one-click entries for hardware that has none yet. Every server shows up to date / update available for BIOS and BMC (Inventory, Firmware page, server list column "Firmware", dashboard), and a version history (first and last time each version was seen). "Read from all BMCs" reads the versions on demand (also daily, as before).
• SMART lifetime: remaining endurance in % (NVMe, SAS, ATA device statistics and vendor attributes such as Samsung 177, Intel 233, Micron 202), an estimate of the remaining lifetime at the wear rate so far, data written / read, available spare, unsafe shutdowns, start/stop and load cycles, spin retries, interface CRC errors, error log entries, last self-test, maximum temperature, interface and form factor. Life-left bars in the disk table, the rack view and a "Disk life left" server list column. Works for reports collected before this release too.
• Collapsible sidebar (icon rail, remembered per browser).
• Switch ports on their own page (/network/switches/<id>) with filters and the current rate per port.
• Dashboard "Hardware health": servers with failing disks, disk warnings and firmware updates.

Changed

• TrixOS runs on its own: servers taken over from TenantOS are no longer protected (migration 0007, audited per server) and all TenantOS / "protected" badges, filters, switches and hints are gone from the UI.
• Commits are authored as Liam (GitHub Liam1337).

Added

• Server list like TenantOS: a coloured status column first (On / Off / N/A, where N/A means no BMC, the BMC does not answer via IPMI, or its credentials are missing) and every TenantOS column to choose from: Servername, Hostname, CPU Model, Memory (Summary/Details/Count), Primary IP, BW Rate In/Out (current), 1/7/14/30 Days BW Usage, 95th In/Out/Total (30d), Tags, OS, Owner, Type, Install Task, CPU Count/Cores/Threads, CPU MHz Regular/Turbo, Short Description, Disk Count, Disks (Summary/Details), Mainboard, ID, plus Datacenter/rack, BMC and Disk health. Defaults: Status, Hostname, CPU Model, Memory, Primary IP, BW Rate Out, BW Rate In, Owner, Short Description. "Reset to defaults" in the column menu.
• GET /api/v1/servers?traffic=true adds the bandwidth figures for all listed servers in one query (same numbers as the TenantOS trafficStatistics / lastBwrate); server views carry power, installTask and detailed hardware.
• Release version shown in the sidebar and in Settings → System; OpenAPI info.version is the release.
• CHANGELOG.md and the release routine (see CLAUDE.md).

Fixed

• The server list showed the BMC address to customers (the detail page already hid it); BMC host and error text are admin-only now.
• Sorting the server list by status put servers with an unknown state first.
• Settings → System showed version 0.1.0 in Docker (no npm_package_version there).
• A Postgres connection killed while idle (database restart, e.g. the weekly image update) raised an unhandled error that could crash the API, worker, poller or PXE service; it is logged and replaced now.

Commit 2b3f240.

Added

• SMART data of every disk read once per PXE boot (rescue, hardware collect, disk wipe, password reset, installs, SystemRescue), including HPE Smart Array physical disks; status ok/warning/failed per disk, history, Inventory → Disk health, badges in the server list and rack view, webhook disk.unhealthy.
• Datacenters page (sites with address, racks, counts) and rack management: front view, mount servers in free units, overlap checks, rack placement in the server edit dialog.
• Printable QR labels per server, rack or datacenter (label printers 62×29 / 89×36 / 102×51 mm, A4 sheets); the code opens the server page.
• Subnet locations: edit with "also for all child subnets", inheritance, IPAM filter, IP assignment refuses another datacenter's subnet unless an admin overrides it.
• Migration 0006_datacenter_racks_smart.

Up to commit 65a0502: the TenantOS replacement in production at Trivox.

Added

• Core platform: data model, IPMI/Redfish/SNMP drivers behind the dry-run guard, job engine, PXE provisioning with own templates (Debian, Ubuntu, Rocky/Alma, CentOS Stream, Proxmox, Windows, GRML tools), software RAID, TenantOS-compatible API, native API, React UI.
• TenantOS import (read-only), IPAM with IPv4/IPv6, bandwidth and sensor graphs, rDNS (PowerDNS), webhooks.
• Consoles in new tabs (KVM, Serial-over-LAN, BMC web UI), console viewer launcher.
• Rescue and tool catalogue like TenantOS, custom ISOs, site agent with PXE through WireGuard.
• Panel deployment with host hardening, firewalls, Caddy behind Cloudflare, backups, image updates.