chore(main): release 0.2.3

[CodeMaster4711]

🤖 I have created a release beep boop

0.2.3 (2026-07-22)

Features

• add animated custom icons for all sidebar navigation items (8a331f4)
• add auto-generated self-signed TLS to api-gateway (cdebae4)
• add binary self-update for csf-agent and csf-updater via github releases (847dfe5)
• add centralized log viewer with per-service tracing capture and admin retention settings (509f7a8)
• add container status detail, log streaming, and exec shell for workloads (3de5fab)
• add container stop, restart, and performance insights UI with backend lifecycle support (1a03c1c)
• add docker compose stack deployment with service discovery and smart workload icons (4fef60f)
• add firecracker microvm runtime alongside docker via runtime trait (91cf259)
• add node reboot, power off, and drain actions (c606fea)
• add patroni user, config template and entrypoint script (ec78a2e)
• add resource picker with docker compose stacks and dynamic service icons (caf3acb)
• add RG port mapping with dedicated container/RG/node port UI (e8f6ad5)
• add workload self-healing with real capacity scheduling and working failover (fbb344e)
• addded ground setup for scheduler (2cca6f1)
• added admin page and update page for cluster (ca13d40)
• added agend volume mount (8549880)
• added all frontend auth pages (3ace818)
• added container placement in agent and scheduler (f84c304)
• added endpoints in api gateway (c9a3563)
• added frontend for one mono repo (924865b)
• added gh token for image pulling without rate limiting (b62b2d1)
• added graph with histroy (4e73dc5)
• added ha with patroni on postgres (e6f6037)
• added heartbeat logic to agent (a54df53)
• added heartbeat logic to agent (04d3716)
• added logo in header for svelte (48190b7)
• added migrations for workloads (964c20a)
• added mtls encryption (9692379)
• added new alpha github run (40b7af5)
• added new alpha github run (1ec1a76)
• added nix config for nix os master node (8c3a866)
• added OpenTelemetry Tracing (2d11250)
• added own patroni image (f4b1938)
• added pki for agent (73fd3ad)
• added Prometheus Metrics and Rate Limiting (fbf9a48)
• added rbac for all things (76faa2a)
• added rbac for all things (3b1be5b)
• added renovate (5d0b547)
• added renovate via github actions (18de04d)
• added ressource groups (e818f2f)
• added ressource modell and workload specs (50aac08)
• added sdn controller for network (59ace74)
• added sdn controller for network (49b5ed9)
• added update mech (0a33b2b)
• added update stop and resume (fd01b36)
• added user name in sidebar and added nodes page demo for testing (60f7e41)
• added volume manager mount (f0e3313)
• agent: log update signal when desired flake rev changes (0cfbcb6)
• agents with mtls (bceb6e0)
• animated login button and fail modal (fcf45a2)
• api-gateway: restrict system update endpoint to admin-only via RBAC (988342b)
• bring up per-resource-group wireguard mesh with persistent agent identity (72cb91f)
• build csf-updater locally via nix and publish alpha binaries to github releases (eb3df31)
• build csf-updater locally via nix and publish alpha binaries to… (3d759e1)
• cluster-wide bootstrap tokens (b479ec6)
• cp: wire csfx-updater as systemd service and rename units (5bd062e)
• csf-updater: implement secure rust-based updater daemon with nixos integration (eb065a0)
• csf-updater: verify image digests against GHCR before applying update (f791f42)
• csfx-updater: add observability logs across update pipeline (fcd2495)
• docker compose prod (d5ebd58)
• enforce resource group network isolation with per-rg bridges and nftables (7dd3533)
• entry point for schedueler in etcd cluster (080225c)
• etcd (5c0720a)
• etcd: enable authentication and restrict access to csf service user (ba2a887)
• expose agent and updater binary versions in update-status (08030a9)
• ground setup ceph storage (1ad3e67)
• ground setup failover controler (806149f)
• ground setup failover controler (47ea8b6)
• ground setup registry for agents (9ed2f4a)
• impl communcitaion and hearbeat (d51fb91)
• implement gitops poller, git mirror, and nix build pipeline in csf-updater (d08736e)
• implement watchdog heartbeat counter in registry and csf-updater (3024db4)
• inject CSF_BUILD_VERSION into binaries at compile time via build.rs (8d18efb)
• login flow (9f18045)
• new connection to db and refactor (063bc84)
• new nix config (26ea9cc)
• nix deployment for auto docker deploy (fb3c2da)
• nix os config deploy on test server (b8b5aff)
• pre reg agent for zero trust (85bd67a)
• propagate agent version on every heartbeat and add live node metrics tunnel (72c46e3)
• propagate desired_flake_rev via heartbeat response to agent update trigger (97914a6)
• propagate post_update_heartbeats counter to agent for watchdog health check (88c0051)
• push workload assignments to agents instead of relying on poll interval (993e29b)
• renam csf to csfx (6888431)
• replace flake-rev API with version-based update scheduling (64dfe62)
• resource-groups: add container deploy, volume management, and detail view (7b32db8)
• serve frontend statically from api-gateway on port 8000 (69f0ad8)
• setup ceph storage (a8c2dc5)
• setup for etcd cluster (af2db8d)
• setup ground struc agent (eeb12eb)
• ssh: add ephemeral key-based SSH access to cluster nodes (e4940e7)
• ui,agent,registry: add WireGuard P2S VPN, modal forms, and NodePort expose model (d8c098b)
• use mutable binary paths for csf-agent and csf-updater to enable self-update (64e4326)

Bug Fixes

• add patroni bootstrap script to create csf app user and database (0e07850)
• added docker compose and fix build in docker (e24e7b9)
• added log for testing update flow (8aaeef0)
• added log for testing updater (2728d06)
• added logging for testing (920e730)
• added test file for updater (8414f8b)
• added test file for updater (d3cc2f3)
• agent (b09048e)
• agent bootstrap error (013b2c8)
• agent error (a6b0bbe)
• agent: detect OS from /etc/os-release instead of sysinfo (1d86d69)
• agent: rename state dir from csfx-daemon to csfx-agent (0ee1896)
• agent: start docker on demand via systemd instead of at boot (86a2d7c)
• api gateway and regisrty (68a9671)
• api-gateway: exempt update status routes from rate limiting (fd08546)
• api-gateway: make TLS config generation async to avoid block_on panic (ba21420)
• append resource group search domain to vpn client dns config (cd417f7)
• arm runner and manifest error (394f159)
• arm runner and manifest error (a1ad641)
• attach firecracker tap devices to rg bridge and clean up stale rg networks (8591a8e)
• auth probelm (80ef776)
• auto-assign workloads to agents and wire up management wireguard tunnel (e1fa45a)
• backend compile error (5db3510)
• backend compile error (cb476e5)
• backend error (f4c6023)
• backend error (cd69b8c)
• backfill missing management tunnel ip for agents on heartbeat (d644977)
• build error with updater hash (839fd28)
• build errors and added frontend (b1cb885)
• bump nixpkgs to 25.05 for Cargo 1.85/edition2024 support (ddb75f3)
• cargo fmt (93ce25f)
• cert issue (f544e36)
• ci (ceb3486)
• ci (2d5b689)
• ci pipeline new setup with nix (eaffdf5)
• coerce port fields to string before trim in resource group deploy form (49d667a)
• compile errors (6cfe5ae)
• correct pre-release version comparison and let forced updates bypass pause (46266c7)
• create csfx role and database during patroni bootstrap (7d0486c)
• csf-updater: run as dedicated system user with docker group instead of root (22cf1e5)
• csf-updater: validate version string from etcd before executing update (13e9fdf)
• csfx-updater: add --no-out-link to nixos-rebuild build to avoid permission error (0b8e472)
• dep update axum 0.7 -> 0.8 (9be3ff4)
• deps reqwest 0.11 -> 0.13 (864c2db)
• deps: update dependency @icons-pack/svelte-simple-icons to v7 (01dd084)
• deps: update dependency @icons-pack/svelte-simple-icons to v7 (e5cef90)
• deps: update rust dependencies (2fe8332)
• deps: update rust dependencies (b2e32f0)
• dev bootstrap (1547ee8)
• disable rustls default aws-lc-rs feature to fix musl aarch64 link (8c61471)
• docker access in updater error (ce45cba)
• docker compose (8fd8be6)
• docker container on nix (a285a18)
• docker container on nix (2aca464)
• docker long build (2372614)
• docker prod build (581a20d)
• docker start (a247b64)
• docker updater error (d8f7457)
• double vv in version (506c289)
• double vv in version (48065e5)
• eliminate aws-lc-sys from musl build by switching to ring crypto provider across all services (4045fbb)
• erros (15623c3)
• etcd connection error (1a44dc1)
• etcd: block etcd ports from external access via firewall rules in install script (34e1cd2)
• exempt agent heartbeat/workloads/volumes routes from rate limiting (1b4d3c3)
• filter noisy access, sql, heartbeat and performance events from log storage (a6f7510)
• fix rg dns write sandbox failure and reconcile orphaned containers on agent restart (b6f2a5d)
• for local dev env (5decf9b)
• format (73ab945)
• gateway: exempt registry routes from rate limiting (c9f30e9)
• github pipeline (791c518)
• github pipleine time (f88850e)
• github pipleine time (6e8e2cd)
• gitignore (d6c3dca)
• ha for postgres with patroni (078de22)
• handle 429 rate limit in agent registration with retry backoff (31d3c29)
• image version (cd9b47c)
• install rustls aws-lc-rs crypto provider before TLS init (5ccb37d)
• leader election (28871eb)
• leader select (e5d8867)
• load times on svg main (e37e88b)
• load xterm dynamically to avoid SSR CJS named export error (db41761)
• lock state when updater go into error (28c0247)
• make bootstrap registration idempotent by upserting on hostname (98a935a)
• manifest build (dd5d522)
• master node auto-bootstrap — self-register agent via admin API on first boot (1d64a1f)
• merge errors (3d808ae)
• metrics error agent (4ac4ce8)
• migrate axum routes to 0.8 syntax and downgrade sysinfo to 0.32 (d29d12d)
• migration in docker dev enviroment and auth fix frontend (8140686)
• mtls handshake (cbe31b3)
• mtls heart beat (93fb782)
• mtls heart beat (869170f)
• mtls issue (26e0cb2)
• mulitple docker builds (9a857ca)
• mulitple docker builds (6a55d51)
• new structure project (5280c7e)
• new test version (109c775)
• nix compile error (8d6d32e)
• nix compile error (48d2bde)
• nix config error (6b5adf7)
• nix config with path (1d80789)
• nix container version (4e6da4e)
• nix error (ebfdf55)
• nix os config version (8ed2d60)
• nixos test version updated (0230d7f)
• nixos updater error (2b46867)
• nixos version (64cfcec)
• node deduplication and cluster telemetry (2259013)
• nodes offline check (353f803)
• path error in updater (e10e08f)
• patroni bootstrap error (5895235)
• patroni internal error from bootstrap (d52bc00)
• persistante update screen (f43c476)
• pin rust 1.88.0 via rust-overlay for edition2024/time crate support (2b6bc89)
• pipeline (d01b1ee)
• pipeline (25a9442)
• pipeline (4f38260)
• pipeline (3f6b004)
• pipeline build error (ddbfc81)
• pipeline docker build (c7d94c1)
• pipeline docker build (909cc1a)
• pipeline docker image (5f91789)
• pipeline docker image (c5743de)
• pipeline time (20e929c)
• pipeline time (a642161)
• pipleine (bcdc605)
• pipleine (885eadd)
• provide complete workspace structure to cargo-chef (d1c2022)
• provide complete workspace structure to cargo-chef (5bef937)
• proxy api requests to https gateway with insecure flag for dev (d65b24c)
• rate limit by authenticated user instead of shared ip bucket (4f166c3)
• rate-limit agents by API key hash instead of shared IP bucket (d4ab5ff)
• recreate resource group dns container when stale instead of skipping (b9949e5)
• recreate stale dns containers, drop loopback proxy shortcut, fix stats history query, and handle 401 in frontend (282e8cb)
• registry: make AgentStatus::from_str case-insensitive (e80d89b)
• registry: migrate route params from :param to {param} syntax (af9e2ec)
• remove NoNewPrivileges to allow sudo systemctl for binary restart (ddc22b8)
• remove ssh console button from node detail sheet (5bc2905)
• removed old scripts (dc19cb5)
• renovate (1b87f10)
• replace aws-lc-rs with ring for musl aarch64 (7fdc686)
• replace rustls-tls feature with rustls for reqwest 0.13 compat (bf6d095)
• repo (fa07190)
• resolve musl build failure for csf-updater binary (50a89e8)
• restrict binary dir permissions and verify sha256 checksum on download (2b3260f)
• retry metrics forwarding to gateway and log permanent failures as errors (62f9224)
• reverse proxy on registry routet through api gateway (6e2ce4f)
• rm enity folder in every project (dbd5178)
• rollback on failed update flow (a1109d2)
• route agent proxy calls via loopback when target is the local WireGuard tunnel IP (be9d879)
• script error (4b1b343)
• securtity issue fix sha-1 to sha-256 (4252495)
• securtiy issues on agent registration (228a81f)
• self kill error updater and manuell fix updater error (f17d096)
• set TLS_ENABLED=false in docker-compose and accept self-signed certs in agent (a14e75d)
• set working directory to /tmp for nixos-rebuild to avoid symlink permission error (74b7bd1)
• shared folder (bc7ce08)
• shared folder (752f4df)
• sign gateway tls cert from internal ca and persist container state across reboot (1a6180b)
• single-node patroni+etcd, remove haproxy (45952da)
• small change for testing updater (1f5509f)
• ssh error for dev (a6a4fc9)
• stop forwarding raw agent status codes as gateway response codes (f286562)
• strip digest newlines to prevent invalid image reference in manifest (fdd4d7e)
• strip trailing semicolon from parsed nix version strings (346e5f4)
• structure porject fix (8d40d6a)
• structure project (d2d83f1)
• swagger ui (54113f4)
• swagger ui (033f790)
• switch rustls provider from aws-lc-rs to ring for musl compat (7c6c62b)
• sync missing permissions to existing Admin role on startup (bf050ae)
• sync workload status on stop/restart and auto-detect gateway TLS SAN (7be20b8)
• test file updater (d9a485a)
• test file updater (6e55d23)
• test file updater (0cdebfb)
• test file updater (398adf1)
• test file updater (7f45bbc)
• test file updater (666f334)
• test file updtaer (b7241fc)
• test file updtaer (aae1373)
• token route for dev (97d0776)
• unblock agent log streaming and auto-allocate node ports (56a09fc)
• unblock manual updates, auto-allocate agent tunnel IP, fix ceph rbd config (a4ef5f8)
• update bollard, rand, sysinfo, axum FromRequestParts for dep updates (588d22b)
• update permission error (1d5a1c1)
• update permission error (f7b57ec)
• update test file (8c52df7)
• update test file (12def61)
• updater (e1b45c8)
• updater (a637575)
• updater backend (2c51cf4)
• updater error with images and pull (bbb8694)
• updater fix complete log (10e0943)
• updater fix complete log (87ed08e)
• updater flow (3d9b26c)
• updater flow with api-gateway (1de5b80)
• updater flow with api-gateway (5bf29ab)
• updater from frontend (0c4e596)
• updater from frontend (d6f72c3)
• updater frontend screen (30e638f)
• updater frontend screen (8cbfbdc)
• updater prevelidge error (af1bf41)
• updater prevelidge error (788a637)
• updater screen (7b48394)
• updater screen (2b153ba)
• updater test file (8a277df)
• updater test file (5008a78)
• updater test file (300475b)
• updater test file (c67ceba)
• updater test file (f3a5766)
• updater test file (05e1a16)
• updater test file (2dc6d5c)
• updater test file (b721cbe)
• updater: correct GitHub refs API path and treat 304 as no-op (e11c40e)
• updater: set explicit nixosConfigurations attr in flake URL to match csfx-node (bdaa676)
• updater: surface version resolution failures to etcd (9ad7152)
• use relative API URLs for same-origin deployment (16495a4)
• verify agent stream tls against internal ca and pull missing coredns image (69d4910)
• version docker image (8768620)
• wait for auth token before loading data on nodes, resource-groups and logs pages (9ff3735)
• wait for auth token before loading resource group on mount (b67e6f1)
• wait for ca file and order gateway after registry to avoid self-signed race (b1f256f)
• wire TLS through dev environment for gateway, agents, and registry (8028bae)
• workflow (c71c60f)

---

This PR was generated with Release Please. See documentation.

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels

[github-actions]

cargo audit found vulnerabilities:

• RUSTSEC-2026-0204 crossbeam-epoch@0.9.18: Invalid pointer dereference in fmt::Pointer impl for Atomic and Shared when the underlying pointer is invalid
• RUSTSEC-2023-0071 rsa@0.9.10: Marvin Attack: potential key recovery through timing sidechannels