Merge pull request #114 from theta42/release/1.20.0

Release 1.20.0: bump submodules for cross-app super admin; persist GIT_COMMIT to .env
2026-07-30 12:08:25 -04:00 · 2026-07-30 12:07:12 -04:00
7 changed files with 72 additions and 6 deletions
@@ -5,8 +5,12 @@
 config/
 backups/

-# Legacy .env / proxy.env (no longer used — config is in ./config/). Still
-# ignored in case a migrated deployment hasn't deleted them yet.
+# .env: NOT app config (that's ./config/, generated by setup.sh) — this is
+# docker compose's own auto-loaded env file, which setup.sh uses only to
+# persist *_GIT_COMMIT build args so an ad-hoc rebuild of a single service
+# still bakes the right commit hash. Generated; never commit.
+# proxy.env: legacy, no longer used — still ignored in case an old
+# deployment hasn't deleted it yet.
 .env
 proxy.env

@@ -10,6 +10,48 @@ for what changed inside the apps it composes.

 ## [Unreleased]

+## [1.20.0] - 2026-07-30
+
+### Added
+- **`setup.sh` persists `SSO_GIT_COMMIT`/`PROXY_GIT_COMMIT`/`JUMP_GIT_COMMIT` into `./.env`** (new `env_upsert` helper), which `docker compose` auto-loads on every future invocation in this directory. Previously these were only `export`ed for the current shell, so an ad-hoc `docker compose up --build <service>` run later (outside a full `setup.sh` run) would build with an empty `GIT_COMMIT` arg — and since each submodule's checked-out `.git` is a pointer file, not a real repo, the in-container git fallback can't resolve it either, so the image silently baked "unknown" as its commit hash. `.gitignore`'s `.env` comment updated to describe this (it was previously labeled "legacy, no longer used").
+
+### Submodules bumped
+- jump-host `v1.10.2` -> [`v1.11.0`](https://github.com/theta42/jump-host/releases/tag/v1.11.0)
+- ldap-client `v1.0.0` -> [`v1.1.0`](https://github.com/theta42/ldap-client/releases/tag/v1.1.0)
+- proxy `v1.8.0` -> [`v1.9.0`](https://github.com/theta42/proxy/releases/tag/v1.9.0)
+- sso-manager-node `v1.9.0` -> [`v1.10.0`](https://github.com/theta42/sso-manager-node/releases/tag/v1.10.0)
+
+#### sso-manager-node — [v1.10.0](https://github.com/theta42/sso-manager-node/releases/tag/v1.10.0)
+
+##### Added
+- `app_super_admin` cross-app group: members are full admins here regardless of `app_sso_admin` membership. The same group is now also recognized by proxy and jump-host, and by `ldap-client`'s SSSD access filter (SSH login on every host).
+
+##### Changed
+- Renamed the Executive page to Overview (route, view, `/api/metrics/overview`, nav label, docs). `/executive` kept as a 301 redirect.
+
+#### proxy — [v1.9.0](https://github.com/theta42/proxy/releases/tag/v1.9.0)
+
+##### Added
+- `app_super_admin` cross-app group recognized as a global admin (`conf.auth.adminGroups`).
+
+##### Changed
+- Users and Permissions pages: the always-visible sidebar "Add" forms are now an "Add User"/"Add Permission" button that opens an `app.modal` dialog, matching the hosts.ejs convention.
+- Let's Encrypt ACME account key now defaults to the already-persisted `/data` volume instead of a CWD-relative path (`./le_key.cert` -> `/app/le_key.cert` in the container), which was lost on every image rebuild.
+
+#### jump-host — [v1.11.0](https://github.com/theta42/jump-host/releases/tag/v1.11.0)
+
+##### Added
+- `app_super_admin` (cross-app) and `app_jump_admin` groups: super admins are full admins here same as `app_sso_admin`; jump admins get audit page/data access without other admin rights. The Audit page/API is now actually admin-gated server-side (previously the page shell rendered for any logged-in user, only its data was gated).
+- Host list adds Last connection/Last failed connection columns and highlights rows green (a session is live right now) or yellow (the most recent attempt failed), backed by new per-host last-success/last-fail timestamps.
+
+##### Changed
+- Dashboard's stat boxes and Top hosts/Top users cards moved to the Audit page. "All hosts" renamed to "My hosts".
+
+#### ldap-client — [v1.1.0](https://github.com/theta42/ldap-client/releases/tag/v1.1.0)
+
+##### Added
+- `app_super_admin` cross-app group now grants SSH login access to every host (`ldap_access_filter` + `ldap_access_groups`), matching the same group's admin rights in sso-manager-node, proxy, and jump-host. Sudo is not yet extended to super admins (`ldap_sudo_search_filter` remains non-functional on this SSSD version — pre-existing, documented gap).
+
 ## [1.19.0] - 2026-07-30

 ### Added
@@ -88,6 +88,23 @@ rand_hex() {
 	fi
 }

+# Upsert KEY=VALUE into ./.env, which `docker compose` auto-loads for every
+# future invocation in this directory. Used to persist the *_GIT_COMMIT build
+# args (see SSO_GIT_COMMIT/PROXY_GIT_COMMIT/JUMP_GIT_COMMIT below) so that an
+# ad-hoc `docker compose up --build <service>` run later, OUTSIDE this script,
+# still resolves the right commit instead of silently baking "unknown" (the
+# submodule .git pointer file can't be resolved from inside the build
+# context, so the value must come from the host via this file or the export).
+env_upsert() {
+	local key="$1" val="$2" file=./.env
+	touch "$file"
+	if grep -q "^${key}=" "$file" 2>/dev/null; then
+		sed -i "s|^${key}=.*|${key}=${val}|" "$file"
+	else
+		printf '%s=%s\n' "$key" "$val" >> "$file"
+	fi
+}
+
 # Detect docker compose (v2 plugin `docker compose` or v1 standalone `docker-compose`).
 if docker compose version >/dev/null 2>&1; then
 	COMPOSE=(docker compose)
@@ -637,6 +654,7 @@ backup_before_rebuild
 # docker-compose.yml and sso-manager-node's Dockerfile.openldap.
 SSO_GIT_COMMIT="$(git -C sso-manager-node rev-parse --short HEAD 2>/dev/null || echo unknown)"
 export SSO_GIT_COMMIT
+env_upsert SSO_GIT_COMMIT "$SSO_GIT_COMMIT"
 info "Building + starting sso-manager (first run builds the image; this takes a while)..."
 "${COMPOSE[@]}" up -d --build sso-manager

@@ -722,6 +740,7 @@ fi
 # PROXY_GIT_COMMIT: same reasoning as SSO_GIT_COMMIT above.
 PROXY_GIT_COMMIT="$(git -C proxy rev-parse --short HEAD 2>/dev/null || echo unknown)"
 export PROXY_GIT_COMMIT
+env_upsert PROXY_GIT_COMMIT "$PROXY_GIT_COMMIT"
 info "Building + starting proxy (first run builds the image; this takes a while)..."
 "${COMPOSE[@]}" up -d --build proxy

@@ -788,6 +807,7 @@ if [[ "$JUMP_ENABLED" == "1" ]]; then
 	JUMP_HOST="${CFG_JUMP_HOST:-jump.${SSO_HOST#sso.}}"
 	JUMP_GIT_COMMIT="$(git -C jump-host rev-parse --short HEAD 2>/dev/null || echo unknown)"
 	export JUMP_GIT_COMMIT
+	env_upsert JUMP_GIT_COMMIT "$JUMP_GIT_COMMIT"
 	info "Building + starting jump-host (optional; enabled via CFG_JUMP_HOST_ENABLED)..."
 	"${COMPOSE[@]}" up -d --build jump-host