chore: release v1.34.4 (update sso-manager-node submodule for vault fix) (#138)

chore: release v1.34.3

CHANGELOG.md

@@ -1546,3 +1546,7 @@ First tagged release. Establishes the `vX.Y.Z` tag convention going forward.
 [1.1.2]: https://github.com/theta42/theta-suite/compare/v1.1.1...v1.1.2
 [1.1.1]: https://github.com/theta42/theta-suite/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/theta42/theta-suite/releases/tag/v1.1.0
+
+## [1.34.4] - 2026-08-02
+### Changed
+- Updated `sso-manager-node` submodule to `v1.19.6` to pull in a fix for the Vault API 403 error on the Secrets List.

bootstrap/bootstrap.js

@@ -426,12 +426,16 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		macAddress: HOST_FACTS.mac,
 		os: HOST_FACTS.os,
 		kernel: HOST_FACTS.kernel,
+		sshPort: 22,
 	}, ['stack-host']);
 	await ensure('service', 'SSO Manager', 'sso-manager', host.id, {
 		address: `https://${SSO_HOST}`,
 		port: 3001,
 		gitRepo: 'https://github.com/theta42/sso-manager-node',
 		subType: 'web',
+		icon: 'mdi:shield-account',
+		tagline: 'Home-lab identity and access management.',
+		requestable: false,
 	});
 	// Proxy = the node management UI; OpenResty = the data plane every hostname
 	// in the stack actually flows through (80/443). Two faces, two entries.
@@ -440,6 +444,9 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		port: 3000,
 		gitRepo: 'https://github.com/theta42/proxy',
 		subType: 'web',
+		icon: 'mdi:server-network',
+		tagline: 'Reverse proxy and API gateway.',
+		requestable: false,
 	});
 	// OpenLDAP is independently consumed — Linux hosts authenticate against it
 	// (PAM/SSSD, sudoRole, sshPublicKey) and LDAP-native apps bind directly
@@ -451,8 +458,12 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		address: `ldaps://${LDAPS_HOST}:636`,
 		port: 389,
 		externalPort: 636,
+		portMappings: [{ proto: 'tcp', external: 636, internal: 389, comment: 'LDAPS' }],
 		gitRepo: 'https://github.com/theta42/sso-manager-node',
 		subType: 'openldap',
+		icon: 'mdi:book-open-outline',
+		tagline: 'LDAP directory for identity.',
+		requestable: false,
 	});
 	// Wildcard address: OpenResty fronts every host under the domain (same
 	// */** wildcard convention the proxy's Host records use). Its config lives
@@ -462,6 +473,9 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		port: 443,
 		gitRepo: 'https://github.com/theta42/proxy',
 		subType: 'openresty',
+		icon: 'mdi:router-network',
+		tagline: 'Data plane.',
+		requestable: false,
 	});
 
 	// SSH jump host service (core component — always registered).
@@ -473,6 +487,9 @@ async function seedDirectory(token, clientId, jumpClientId) {
 			port: 3002,
 			gitRepo: 'https://github.com/theta42/jump-host',
 			subType: 'ssh',
+			icon: 'mdi:ssh',
+			tagline: 'Secure SSH jump host.',
+			requestable: false,
 		});
 	}
 

docs/quickstart.md

@@ -140,6 +140,13 @@ then converges the stack to your `./config/` values (LDAP service account + admi
 passwords are reset to the config; the OAuth client is kept if `proxy-secrets.js`
 already holds its creds).
 
+> **Troubleshooting: "A newer version is available" after running setup.sh?**
+> If the UI shows this warning immediately after you ran `./setup.sh`, the latest
+> GitHub release tag might not yet be merged into the default tracking branch for
+> the submodules, or Docker may have cached the `COPY` step if the `package.json`
+> didn't change. You can force a clean rebuild by running
+> `docker compose build --no-cache` and then re-running `./setup.sh`.
+
 ---
 
 ## Direct LDAP for LDAP-native clients and Linux hosts

setup.sh

@@ -61,6 +61,7 @@ set -euo pipefail
 
 cd "$(dirname "$0")"
 
+CFG_ADMIN_PASS="${CFG_ADMIN_PASS:-}"
 CONFIG_DIR=./config
 BACKUP_DIR=./backups
 BACKUP_KEEP="${BACKUP_KEEP:-5}"
@@ -1045,7 +1046,7 @@ echo "$JUMP_HOSTS_OUT" | sed 's/^/[setup] /'
 
 # ── 8. Summary ───────────────────────────────────────────────────────────────
 echo
-echo -e "\033[1;34m[setup]\033[0m \033[1;32mDone. Your SSO + proxy stack is up.\033[0m"
+printf '\033[1;34m[setup]\033[0m \033[1;32mDone. Your SSO + proxy stack is up.\033[0m\n'
 echo
 echo "  SSO Manager UI:    https://${SSO_HOST}   (fronted by the proxy under TLS)"
 echo "                      first-run fallback: http://127.0.0.1:${SSO_PORT:-3001}"