ExecStart no longer relies on shebang when CRLF slips into deploy scripts.
sac-deploy strips CR from all deploy/*.sh and waits for active before health check.
Defer notify_lifecycle and notify_auth_login after commit; SAC_UVICORN_WORKERS via sac-api-start.sh; nginx /api/v1/events timeout; mass-update confirm in Hosts UI.
Preflight pydantic parse catches inline comments in env values; alembic
and stale remote_action reset use SAC_CONFIG_FILE. Document env format
and ssh_known_hosts in runbook.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.
Move zip download and extract to user TEMP to avoid ProgramData access denied on DCs. Improve WinRM ERROR line parsing and add optional SAC_AGENT_BUNDLE_BASE_URL for LAN clients.
Co-authored-by: Cursor <cursoragent@cursor.com>
FCM/каналы для report.daily.* после commit ingest (BackgroundTasks);
SAC_DB_POOL_SIZE=15, SAC_DB_MAX_OVERFLOW=25 для штурма 09:00.
Co-authored-by: Cursor <cursoragent@cursor.com>
Treat acknowledged as active, dedupe by hostname, add PostgreSQL advisory lock and a unique index. Migration closes existing duplicate open problems.
Co-authored-by: Cursor <cursoragent@cursor.com>
Admin settings for web login whitelist, blocked IP list with unblock,
and optional fail2ban ignoreip sync for SSH jail.
Co-authored-by: Cursor <cursoragent@cursor.com>
Show RDS access via RDG-Comp or Haproxy-RDG-Comp, enable qwinsta/logoff on any RDG event with internal_ip.
Co-authored-by: Cursor <cursoragent@cursor.com>
Replace git.kalinamall.ru links with github.com/PTah in public docs.
Add Rewrite-GitHostUrls.ps1 and Push-Mirror.ps1 for kalinamall mirror pushes.
Add .cursor/ to .gitignore.
Co-authored-by: Cursor <cursoragent@cursor.com>
Только sac.kalinamall.ru; ext.kalinamall.ru и прочие имена на IP SAC не отдают UI. ssl_reject_handshake на :443.
Co-authored-by: Cursor <cursoragent@cursor.com>
Adds mobile device registration by admin codes, refresh tokens, push channel
in notification policy, and Settings section for managing Seaca clients.
Co-authored-by: Cursor <cursoragent@cursor.com>
Background scan every 5 min opens rule:host_silence and notifies without
waiting for the next ingest event. CLI job + optional systemd timer.
Co-authored-by: Cursor <cursoragent@cursor.com>
Path traversal fix in SPA fallback, admin-only host delete, login rate limit
with 3 attempts and Telegram alert, JWT validated against active users in DB,
and DOMPurify for agent report HTML.
Co-authored-by: Cursor <cursoragent@cursor.com>
Store last notify time by dedup_key/fingerprint, gate dispatch before
channels; config SAC_NOTIFY_*_COOLDOWN_SEC, migration 008.
Co-authored-by: Cursor <cursoragent@cursor.com>
PTah