feat: install theta-agent on host and add CFG_CREATE_ALL_HTTP option (#139)

* feat: install theta-agent on host and add CFG_CREATE_ALL_HTTP option

* docs: update changelog for 1.34.5

CHANGELOG.md

@@ -1546,3 +1546,12 @@ First tagged release. Establishes the `vX.Y.Z` tag convention going forward.
 [1.1.2]: https://github.com/theta42/theta-suite/compare/v1.1.1...v1.1.2
 [1.1.1]: https://github.com/theta42/theta-suite/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/theta42/theta-suite/releases/tag/v1.1.0
+
+## [1.34.4] - 2026-08-02
+### Changed
+- Updated `sso-manager-node` submodule to `v1.19.6` to pull in a fix for the Vault API 403 error on the Secrets List.
+
+## [1.34.5] - 2026-08-02
+### Added
+- Automatically build and install `theta-agent` on the host system as a systemd service during `setup.sh`.
+- Added `CFG_CREATE_ALL_HTTP` option to `setup.env` to create all default proxy host entries with `forcessl=false`.

README.md

@@ -140,8 +140,7 @@ Optional extra ports (only if you need them):
 
 ### 4. Docker + Docker Compose
 
-Any recent Docker with Compose — the v2 plugin (`docker compose`) or the v1
-standalone (`docker-compose`) both work.
+You must use the modern Docker Compose v2 plugin (`docker compose`). The older v1 standalone (`docker-compose`) is not compatible with the BuildKit images generated by this suite and will fail with a `ContainerConfig` KeyError during deployment.
 
 ---
 

bootstrap/bootstrap.js

@@ -426,12 +426,16 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		macAddress: HOST_FACTS.mac,
 		os: HOST_FACTS.os,
 		kernel: HOST_FACTS.kernel,
+		sshPort: 22,
 	}, ['stack-host']);
 	await ensure('service', 'SSO Manager', 'sso-manager', host.id, {
 		address: `https://${SSO_HOST}`,
 		port: 3001,
 		gitRepo: 'https://github.com/theta42/sso-manager-node',
 		subType: 'web',
+		icon: 'mdi:shield-account',
+		tagline: 'Home-lab identity and access management.',
+		requestable: false,
 	});
 	// Proxy = the node management UI; OpenResty = the data plane every hostname
 	// in the stack actually flows through (80/443). Two faces, two entries.
@@ -440,6 +444,9 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		port: 3000,
 		gitRepo: 'https://github.com/theta42/proxy',
 		subType: 'web',
+		icon: 'mdi:server-network',
+		tagline: 'Reverse proxy and API gateway.',
+		requestable: false,
 	});
 	// OpenLDAP is independently consumed — Linux hosts authenticate against it
 	// (PAM/SSSD, sudoRole, sshPublicKey) and LDAP-native apps bind directly
@@ -451,8 +458,12 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		address: `ldaps://${LDAPS_HOST}:636`,
 		port: 389,
 		externalPort: 636,
+		portMappings: [{ proto: 'tcp', external: 636, internal: 389, comment: 'LDAPS' }],
 		gitRepo: 'https://github.com/theta42/sso-manager-node',
 		subType: 'openldap',
+		icon: 'mdi:book-open-outline',
+		tagline: 'LDAP directory for identity.',
+		requestable: false,
 	});
 	// Wildcard address: OpenResty fronts every host under the domain (same
 	// */** wildcard convention the proxy's Host records use). Its config lives
@@ -462,6 +473,9 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		port: 443,
 		gitRepo: 'https://github.com/theta42/proxy',
 		subType: 'openresty',
+		icon: 'mdi:router-network',
+		tagline: 'Data plane.',
+		requestable: false,
 	});
 
 	// SSH jump host service (core component — always registered).
@@ -473,6 +487,9 @@ async function seedDirectory(token, clientId, jumpClientId) {
 			port: 3002,
 			gitRepo: 'https://github.com/theta42/jump-host',
 			subType: 'ssh',
+			icon: 'mdi:ssh',
+			tagline: 'Secure SSH jump host.',
+			requestable: false,
 		});
 	}
 
@@ -573,7 +590,6 @@ function writeJumpSecrets(apiToken, oidc, localAdminPass) {
 // sshPublicKey attribute (key injection); for a hardened deployment use a
 // scoped account with an sshPublicKey write-ACL instead (see jump-host README).
 module.exports = {
-\tname: ${JSON.stringify(sso.name || 'SSO Manager')},
 \tldap: {
 \t\t// ldaps:// (636), not ldap:// (389): @simpleworkjs/ldap's client always
 \t\t// sets tlsOptions (see jump-host's models/user_ldap.js), and ldapts

docs/quickstart.md

@@ -12,8 +12,7 @@ description: Step-by-step first run for theta-suite — prerequisites, setup.env
 
 ## Prerequisites
 
-- A Linux host with **Docker** + **Docker Compose** (the v2 plugin `docker
-  compose` or the v1 standalone `docker-compose` both work).
+- A Linux host with **Docker + Docker Compose** (you must use the modern `docker compose` v2 plugin; the older `docker-compose` v1 standalone will fail on BuildKit images).
 - Two hostnames that resolve to the host: one for the SSO UI (your `stack.ssoHost`),
   one for the proxy mgmt UI (your `stack.proxyHost`). On a real network add DNS
   records; for a local try, add them to `/etc/hosts`.
@@ -141,6 +140,13 @@ then converges the stack to your `./config/` values (LDAP service account + admi
 passwords are reset to the config; the OAuth client is kept if `proxy-secrets.js`
 already holds its creds).
 
+> **Troubleshooting: "A newer version is available" after running setup.sh?**
+> If the UI shows this warning immediately after you ran `./setup.sh`, the latest
+> GitHub release tag might not yet be merged into the default tracking branch for
+> the submodules, or Docker may have cached the `COPY` step if the `package.json`
+> didn't change. You can force a clean rebuild by running
+> `docker compose build --no-cache` and then re-running `./setup.sh`.
+
 ---
 
 ## Direct LDAP for LDAP-native clients and Linux hosts

setup.env.example

@@ -100,4 +100,10 @@ CFG_DOMAIN=example.com
 # LDAP_REPLICATION_HOSTS is a space-separated list of the other sites' LDAP URLs.
 # Example for Site 1:
 #LDAP_SERVER_ID=1
-#LDAP_REPLICATION_HOSTS="ldaps://sso.site2.com:636 ldaps://sso.site3.com:636"
+#LDAP_REPLICATION_HOSTS="ldaps://sso.site2.com:636 ldaps://sso.site3.com:636"
+# ── Proxy HTTP/HTTPS Defaults ────────────────────────────────────────────────
+# If you are running the stack behind an external reverse proxy (like Cloudflare
+# or another ingress) that handles TLS termination, you may want the internal
+# proxy to serve everything over plain HTTP without forcing redirects to HTTPS.
+# Set this to 1 to create all default proxy host entries with forcessl=false.
+#CFG_CREATE_ALL_HTTP=1

setup.sh

@@ -61,6 +61,7 @@ set -euo pipefail
 
 cd "$(dirname "$0")"
 
+CFG_ADMIN_PASS="${CFG_ADMIN_PASS:-}"
 CONFIG_DIR=./config
 BACKUP_DIR=./backups
 BACKUP_KEEP="${BACKUP_KEEP:-5}"
@@ -442,6 +443,7 @@ BAOEOF
 	CFG_ADMIN_PASS="${CFG_ADMIN_PASS:-}"
 	CFG_SVC_PASS="${CFG_SVC_PASS:-}"
 	CFG_PROXY_ADMIN_PASS="${CFG_PROXY_ADMIN_PASS:-}"
+	CFG_CREATE_ALL_HTTP="${CFG_CREATE_ALL_HTTP:-0}"
 
 	# ── One-time migration from .env / proxy.env (existing deployments) ──
 	# Preserve the operator's existing secrets so the running deployment keeps
@@ -795,6 +797,7 @@ HCL
 ensure_policy sso-admin <<'HCL'
 path "secret/data/*" { capabilities = ["create", "read", "update", "delete", "list"] }
 path "secret/metadata" { capabilities = ["list", "read", "delete"] }
+path "secret/metadata/" { capabilities = ["list", "read", "delete"] }
 path "secret/metadata/*" { capabilities = ["list", "read", "delete"] }
 HCL
 # proxy / jump-host — read only their own boot conf.
@@ -975,7 +978,7 @@ async function ensureHost(host, ip, targetPort) {
 			host: host,
 			ip: ip,
 			targetPort: targetPort,
-			forcessl: true,
+			forcessl: $( [[ "$CFG_CREATE_ALL_HTTP" == "1" ]] && echo false || echo true ),
 			targetssl: false,
 			sso_enabled: false,
 			created_by: 'setup.sh',
@@ -1032,7 +1035,7 @@ const {Host} = require('/app/models').models;
 		try { await Host.get($(js_str "$JUMP_HOST")); console.log('SKIP ${JUMP_HOST} (already exists)'); }
 		catch (e) {
 			if (e.name !== 'EntryNotFound') throw e;
-			await Host.create({ host: $(js_str "$JUMP_HOST"), ip: 'jump-host', targetPort: 3002, forcessl: true, targetssl: false, sso_enabled: false, created_by: 'setup.sh' });
+			await Host.create({ host: $(js_str "$JUMP_HOST"), ip: 'jump-host', targetPort: 3002, forcessl: $( [[ "$CFG_CREATE_ALL_HTTP" == "1" ]] && echo false || echo true ), targetssl: false, sso_enabled: false, created_by: 'setup.sh' });
 			console.log('CREATED ${JUMP_HOST} -> jump-host:3002');
 		}
 		process.exit(0);
@@ -1042,9 +1045,55 @@ NODEEOF
 )
 echo "$JUMP_HOSTS_OUT" | sed 's/^/[setup] /'
 
+# ── 7c. Install theta-agent on the host ──────────────────────────────────────
+info "Setting up theta-agent on the host..."
+(
+	cd theta-agent || exit 0
+	if ! command -v go >/dev/null 2>&1; then
+		warn "Go is not installed. Skipping theta-agent installation."
+	else
+		info "  Building theta-agent..."
+		go build -o theta-agent main.go websocket.go config.go || warn "  Failed to build theta-agent."
+		if [[ -x "theta-agent" ]]; then
+			sudo mkdir -p /etc/theta
+			if [[ ! -f /etc/theta/agent.yml ]]; then
+				sudo cp agent.yml.example /etc/theta/agent.yml
+				AGENT_TOKEN="$(rand_hex 16)"
+				sudo sed -i "s/REPLACE_WITH_AGENT_TOKEN/$AGENT_TOKEN/" /etc/theta/agent.yml
+				# We want to connect to either https or http depending on CFG_CREATE_ALL_HTTP
+				if [[ "$CFG_CREATE_ALL_HTTP" == "1" ]]; then
+					sudo sed -i "s|https://sso.example.com|http://${SSO_HOST}|" /etc/theta/agent.yml
+				else
+					sudo sed -i "s|https://sso.example.com|https://${SSO_HOST}|" /etc/theta/agent.yml
+				fi
+			fi
+			sudo cp theta-agent /usr/local/bin/theta-agent
+			sudo chmod +x /usr/local/bin/theta-agent
+			
+			sudo bash -c "cat <<'EOF' > /etc/systemd/system/theta-agent.service
+[Unit]
+Description=Theta Agent
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/bin/theta-agent
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF"
+			sudo systemctl daemon-reload
+			sudo systemctl enable --now theta-agent.service
+			info "  theta-agent installed and started."
+		fi
+	fi
+)
+
 # ── 8. Summary ───────────────────────────────────────────────────────────────
 echo
-info "\033[1;32mDone. Your SSO + proxy stack is up.\033[0m"
+printf '\033[1;34m[setup]\033[0m \033[1;32mDone. Your SSO + proxy stack is up.\033[0m\n'
 echo
 echo "  SSO Manager UI:    https://${SSO_HOST}   (fronted by the proxy under TLS)"
 echo "                      first-run fallback: http://127.0.0.1:${SSO_PORT:-3001}"
@@ -1056,7 +1105,7 @@ echo "  Jump host (web):    https://${JUMP_HOST:-jump.${SSO_HOST#sso.}}   (audit
 echo
 echo "  First admin login credentials are in ./config/sso-secrets.js:"
 echo "    user: ${ADMIN_UID}"
-echo "    pass: ${CFG_ADMIN_PASS}"
+echo "    pass: ${CFG_ADMIN_PASS:-<see ./config/sso-secrets.js>}"
 echo
 echo "  Proxy local admin (anti-lockout fallback if the SSO is unreachable):"
 echo "    user: proxyadmin2"