diff --git a/plugins/acme-ssl/CHANGELOG.md b/plugins/acme-ssl/CHANGELOG.md index 2f0b1a214..733c94e9f 100644 --- a/plugins/acme-ssl/CHANGELOG.md +++ b/plugins/acme-ssl/CHANGELOG.md @@ -2,14 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. -- ACME certificates moved out of core. Termix no longer runs certbot; the - plugin talks to the CA directly. -- The domain, email, challenge type and Cloudflare token moved from Admin - Settings into this plugin's settings. The token is now stored encrypted. -- Renewal is automatic: a check every 12 hours renews within 30 days of - expiry. -- The 2.8 certbot account is not reused. A new ACME account is registered on - the first request. -- Uploading your own certificate stays in Admin Settings > HTTPS certificate. +Gets the HTTPS certificate Termix serves from Let's Encrypt or another ACME provider and renews it before it expires. Supports the HTTP challenge and the Cloudflare DNS challenge. diff --git a/plugins/acme-ssl/README.md b/plugins/acme-ssl/README.md index 7945260bd..f85c53bd1 100644 --- a/plugins/acme-ssl/README.md +++ b/plugins/acme-ssl/README.md @@ -1,36 +1,43 @@ # ACME Certificates -Gets the certificate Termix serves over HTTPS from Let's Encrypt, or any other -ACME certificate authority, and renews it before it expires. +Gets and renews the Termix HTTPS certificate from Let's Encrypt or another ACME provider. -Termix itself serves HTTPS. This plugin only gets certificates: it hands each -one to core, which checks that the key matches and swaps it in without a -restart. Turn the plugin off and the current certificate keeps being served, -but nothing renews it. Admin Settings > HTTPS certificate then warns with the -expiry date. +## Features + +- Gets a certificate from Let's Encrypt, Let's Encrypt staging or any ACME directory URL. +- Checks twice a day and renews when there is no certificate, the current one is self-signed, it does not cover the domain or it expires within 30 days. +- Swaps in the new certificate without a restart. +- Shows the current certificate and the last attempt, with a button to request one now. + +## Setup + +Pick a challenge type: + +- HTTP: the provider fetches `http:///.well-known/acme-challenge/...`, so port 80 must reach Termix. +- DNS (Cloudflare): needs a Cloudflare API token with Zone:DNS:Edit. Works when port 80 is closed. + +If you turn this plugin off, Termix keeps serving the current certificate but nothing renews it. Admin Settings > HTTPS certificate warns you before it expires. Uploading your own certificate is still done there. ## Settings -Admin settings, under Settings > Plugins > ACME Certificates: +### Admin -- **Renew automatically**: check twice a day and get a new certificate when - there is none, it is the self-signed one, it does not cover the domain, or - it expires within 30 days. -- **Domain** and **Email**. -- **Certificate authority**: Let's Encrypt, Let's Encrypt staging (for - testing without rate limits) or a custom ACME directory URL. -- **Challenge type**: - - **HTTP**: the CA fetches `http:///.well-known/acme-challenge/...`, - so port 80 must reach Termix. Core answers it. - - **DNS (Cloudflare)**: needs an API token with Zone:DNS:Edit. Works when - port 80 is closed. +- Renew automatically: turn automatic renewal on or off. +- Domain and Email: the domain to cover and the contact email for the provider. +- Certificate authority: Let's Encrypt, Let's Encrypt staging or a custom ACME directory URL. +- Challenge type: HTTP or DNS (Cloudflare). +- Cloudflare API token: used by the DNS challenge. Stored encrypted. -The status box shows the served certificate and the last attempt, and has a -button to request a certificate now. +## Permissions -## How it works +- `acme-ssl.manage`: Manage ACME certificates. Only admins have it by default. -It runs [acme-client](https://github.com/publishlab/node-acme-client) with -every request sent through `ctx.fetch`. The ACME account key is sealed with -`ctx.secrets.seal` and kept in `ctx.kv`. Certificates are written and loaded -through `ctx.system` (`system:tls`). +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/acme-ssl/manifest.json b/plugins/acme-ssl/manifest.json index 9cf571fca..b568e13cf 100644 --- a/plugins/acme-ssl/manifest.json +++ b/plugins/acme-ssl/manifest.json @@ -2,7 +2,7 @@ "id": "acme-ssl", "name": "ACME Certificates", "version": "1.0.0", - "description": "Gets and renews the Termix HTTPS certificate from Let's Encrypt or another ACME CA, with the http-01 or Cloudflare dns-01 challenge. Termix keeps serving the current certificate when this plugin is off, but it is no longer renewed.", + "description": "Gets and renews the Termix HTTPS certificate from Let's Encrypt or another ACME provider.", "author": { "name": "Termix" }, diff --git a/plugins/ai/CHANGELOG.md b/plugins/ai/CHANGELOG.md index 6a1bc3a37..2c06df521 100644 --- a/plugins/ai/CHANGELOG.md +++ b/plugins/ai/CHANGELOG.md @@ -2,4 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. + +Adds an AI assistant that can read your hosts, snippets, fleets, alerts and automations and suggest changes for you to approve. Works with Ollama, Anthropic, OpenAI, Google Gemini and any OpenAI compatible provider. diff --git a/plugins/ai/README.md b/plugins/ai/README.md index 2e7eb4ec1..15b9a7ad8 100644 --- a/plugins/ai/README.md +++ b/plugins/ai/README.md @@ -1,22 +1,52 @@ # AI Assistant -An AI assistant that can read your hosts, snippets, fleets, alerts and automations, and propose changes for you to approve. +An AI assistant that can read your hosts, snippets, fleets, alerts and automations, and suggest changes for you to approve. -Bundled with Termix and enabled by default. +## Features -## Layout +- Chat with an assistant that can read your hosts, snippets, fleets, alerts, automations, workspaces, network graph and homepage. +- The assistant suggests changes, and nothing is applied until you approve it. +- Can run read-only diagnostic commands on a host if you allow it. +- Open the assistant from the terminal toolbar with the current session as context. +- Works with Ollama, Anthropic, OpenAI, Google Gemini and any OpenAI compatible provider. - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx) / deactivate(), plus the routes - src/frontend/ the UI it registers - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +## Settings -## Commands +### Admin - npm run build bundle into dist/ - npm run test run this plugin's tests - npm run typecheck +- AI assistant: let users turn the assistant on. While this is off it is hidden for everyone. +- Allowed private AI hosts: hosts on your private network a provider may point at, such as a self-hosted Ollama. -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +### User + +- Enable the AI assistant: turn the assistant on for yourself. +- Allow read-only diagnostic commands: let the assistant run safe commands on your hosts. +- Providers: the AI providers, models and API keys you use. + +### Host + +- Enable AI Assistant: allow the assistant to work with this host. + +## Permissions + +- `ai.use`: Open the assistant and ask it things. Admins and users have it by default. +- `ai.manage_providers`: Add, edit and remove AI providers and their API keys. Admins and users have it by default. +- `ai.apply_proposals`: Let the assistant carry out the changes it suggests. Admins and users have it by default. +- `ai.services.use`: Let other features call the assistant for you. Admins and users have it by default. +- `ai.secrets.share`: Let other features use the stored AI API key without seeing it. Admins and users have it by default. + +## Services + +Uses from other plugins: + +- `workspaces.saved`, `network-topology.graph`, `snippets.access`, `fleets.access`, `terminal.history`, `automations.access` and `homepage.items` to read your data. Each one is optional. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/ai/manifest.json b/plugins/ai/manifest.json index deea21f23..dd86b399f 100644 --- a/plugins/ai/manifest.json +++ b/plugins/ai/manifest.json @@ -2,7 +2,7 @@ "id": "ai", "name": "AI Assistant", "version": "1.0.0", - "description": "An AI assistant that can read your hosts, snippets, fleets, alerts and automations, and propose changes for you to approve.", + "description": "An AI assistant that can read your hosts, snippets, fleets, alerts and automations, and suggest changes for you to approve.", "author": { "name": "Termix" }, diff --git a/plugins/alerts/CHANGELOG.md b/plugins/alerts/CHANGELOG.md index 6a1bc3a37..c67627315 100644 --- a/plugins/alerts/CHANGELOG.md +++ b/plugins/alerts/CHANGELOG.md @@ -2,4 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. + +Adds one inbox for every alert in Termix. Alerts can also be sent to webhooks, ntfy, Discord and email, with delivery rules to pick what goes where. diff --git a/plugins/alerts/README.md b/plugins/alerts/README.md index 312472877..39e274acd 100644 --- a/plugins/alerts/README.md +++ b/plugins/alerts/README.md @@ -2,22 +2,40 @@ One inbox for every alert, with delivery to webhooks, ntfy, Discord and email. -Bundled with Termix and enabled by default. Any plugin sends through -`ctx.notify.send`; this plugin is the hub that stores and delivers them. +## Features -## Layout +- One inbox for alerts from every part of Termix. +- Popups for new alerts, filtered by severity. +- Channels that send alerts to webhooks, ntfy, Discord and email. +- Delivery rules that pick which alerts go to which channel. +- Optional news from the Termix team, like security notices and new releases. - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx) / deactivate(), plus the routes - src/frontend/ the UI it registers - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +## Settings -## Commands +### Admin - npm run build bundle into dist/ - npm run test run this plugin's tests - npm run typecheck +- Termix announcements: show news from the Termix team in everyone's inbox. +- Keep alerts for (days): older alerts are removed from every inbox. +- SMTP server, port, TLS, username, password and from address: needed for email channels. Leave the server empty to turn email off. -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +### User + +- Alert popups: all alerts, warnings and critical, critical only, or none. + +## Permissions + +- `alerts.use`: Get alerts in the inbox and send them to your own channels. Admins and users have it by default. + +## For plugin authors + +Send an alert from any plugin with `ctx.notify.send()`. This plugin stores it and delivers it. Do not build a separate notification system into a plugin. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/automations/CHANGELOG.md b/plugins/automations/CHANGELOG.md index 6a1bc3a37..a53371a29 100644 --- a/plugins/automations/CHANGELOG.md +++ b/plugins/automations/CHANGELOG.md @@ -2,4 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. + +Runs actions on your hosts on a schedule or when something happens, like a host going down, a metric crossing a limit, a container event or an incoming webhook. Each automation is a list of steps, such as running a command, sending an alert or calling a URL. diff --git a/plugins/automations/README.md b/plugins/automations/README.md index a2e969fd1..f3c2e7449 100644 --- a/plugins/automations/README.md +++ b/plugins/automations/README.md @@ -1,22 +1,39 @@ # Automations -Trigger-and-action automation engine: schedules, metric/status/docker-event triggers, and multi-step actions across managed hosts. +Run actions on your hosts on a schedule or when something happens, like a host going down or a metric crossing a limit. -Bundled with Termix and enabled by default. +## Features -## Layout +- Triggers: a schedule, a host going up or down, a metric crossing a limit, a health check change, a container event, a Termix event or an incoming webhook. +- Steps: send an alert, call a URL, run a snippet or command, control a container or tunnel, wake a host, wait, set a variable, branch with if / otherwise, run another automation or stop. +- Run an automation on the host that triggered it or on any host or fleet you pick. +- See the output and errors of each step for every run. - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx) / deactivate(), plus the routes - src/frontend/ the UI it registers - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +## Permissions -## Commands +- `automations.view`: See automations and their runs. Admins and users have it by default. +- `automations.create`: Create automations. Admins and users have it by default. +- `automations.edit`: Change automations. Admins and users have it by default. +- `automations.delete`: Delete automations. Admins and users have it by default. +- `automations.run`: Run automations by hand. Admins and users have it by default. - npm run build bundle into dist/ - npm run test run this plugin's tests - npm run typecheck +## Services -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +Provides to other plugins: + +- `automations.access`: list and run automations. + +Uses from other plugins: + +- `snippets.access` for the run snippet step. Required. +- `fleets.access`, `tunnels.access`, `docker.containers`, `docker.events`, `host-metrics.viewers` and `wake-on-lan.send` for their steps and triggers. Each one is optional. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/automations/manifest.json b/plugins/automations/manifest.json index b01122c39..4fc967228 100644 --- a/plugins/automations/manifest.json +++ b/plugins/automations/manifest.json @@ -2,7 +2,7 @@ "id": "automations", "name": "Automations", "version": "1.0.0", - "description": "Trigger-and-action automation engine: schedules, metric/status/docker-event triggers, and multi-step actions across managed hosts.", + "description": "Run actions on your hosts on a schedule or when something happens, like a host going down or a metric crossing a limit.", "author": { "name": "Termix" }, diff --git a/plugins/docker/CHANGELOG.md b/plugins/docker/CHANGELOG.md index bdb38094e..997d01d5d 100644 --- a/plugins/docker/CHANGELOG.md +++ b/plugins/docker/CHANGELOG.md @@ -2,21 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. -- Runs entirely through the plugin SDK: no imports from Termix core. -- Connects through Termix's one SSH pipeline, so TOTP, Warpgate, jump hosts - and proxies behave the same as in the terminal. A wrong TOTP code asks - again instead of ending the connect. -- Each host's Docker switch and container runtime are this plugin's host - settings now, moved over on upgrade. The host editor shows them in the - Plugins tab. -- The API lives at `/plugin-api/docker/` and the console at - `/plugin-ws/docker/console`. Disabling the plugin closes open consoles and - enabling it again works without a restart. -- New `docker.use` permission, given to the admin and user roles. -- Provides `docker.containers` (list containers, start, stop and the rest) - and `docker.events` (container state changes) for other plugins, which - Automations uses for its Docker step and trigger. -- The Docker homepage widget comes from this plugin. -- Downloaded logs are the plain log text. +Manages Docker and Podman containers over SSH. List, inspect, start, stop and remove containers, read their logs and open a console inside them. diff --git a/plugins/docker/README.md b/plugins/docker/README.md index aef9c0d36..1c4f089e0 100644 --- a/plugins/docker/README.md +++ b/plugins/docker/README.md @@ -1,34 +1,39 @@ # Docker -Container management over SSH: list, inspect, start, stop and view logs for Docker or Podman containers, plus an interactive container console. +Manage Docker and Podman containers over SSH, with logs and a container console. -Bundled with Termix and enabled by default. +## Features + +- List, inspect, start, stop, restart, pause and remove containers. +- Read and download container logs. +- Open an interactive console inside a container. +- Works with Docker or Podman. +- Adds a Docker widget to the homepage. + +## Settings + +### Host + +- Enable Docker: show the Docker tab for this host. +- Container Runtime: Docker or Podman. + +## Permissions + +- `docker.use`: Use Docker. Admins and users have it by default. ## Services -- `docker.containers` 1.0.0: `listContainers(hostId, { all? })` and - `action(hostId, container, "start" | "stop" | "restart" | "pause" | -"unpause" | "remove")`, run over a pooled SSH connection as the caller. -- `docker.events` 1.0.0: `subscribe(hostId, listener)` calls the listener - with `{ hostId, container, event }` when a container exits, starts, - restarts or turns unhealthy, polled about once a minute as the caller. - Subscribing the same listener again is a no-op. +Provides to other plugins: -Both need `docker.use`. +- `docker.containers`: list containers and start, stop, restart, pause, unpause or remove them. +- `docker.events`: get notified when a container starts, exits, restarts or turns unhealthy. -## Layout +## Development - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx) / deactivate(), plus the routes - src/frontend/ the UI it registers - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` -## Commands - - npm run build bundle into dist/ - npm run test run this plugin's tests - npm run typecheck - -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/docker/manifest.json b/plugins/docker/manifest.json index b6f28b353..ac76d6ad9 100644 --- a/plugins/docker/manifest.json +++ b/plugins/docker/manifest.json @@ -2,7 +2,7 @@ "id": "docker", "name": "Docker", "version": "1.0.0", - "description": "Container management over SSH: list, inspect, start, stop and view logs for Docker or Podman containers, plus an interactive container console.", + "description": "Manage Docker and Podman containers over SSH, with logs and a container console.", "author": { "name": "Termix" }, diff --git a/plugins/file-manager/CHANGELOG.md b/plugins/file-manager/CHANGELOG.md new file mode 100644 index 000000000..2ea4ae7ea --- /dev/null +++ b/plugins/file-manager/CHANGELOG.md @@ -0,0 +1,7 @@ +# Changelog + +## 1.0.0 + +First release, bundled with Termix 2.9.0. + +Browse, edit and transfer files over SFTP. Includes a code editor, a trash you can restore from, bookmarks and transfers between two hosts. diff --git a/plugins/file-manager/README.md b/plugins/file-manager/README.md new file mode 100644 index 000000000..1591025cb --- /dev/null +++ b/plugins/file-manager/README.md @@ -0,0 +1,40 @@ +# File Manager + +Browse, edit and transfer files over SFTP, including between two hosts. + +## Features + +- Browse, upload, download, rename, move and delete files over SFTP. +- Edit files in a built-in code editor. +- Transfer files between two hosts in the SFTP tab. +- Restore deleted files from the trash until they are cleaned up. +- Save bookmarks to folders you use often. +- Browse local files in the desktop app. + +## Settings + +### Host + +- Enable File Manager: show the file manager for this host. +- Default Path: the folder to open first. +- SCP Legacy Mode: use SCP for hosts without a working SFTP server. + +## Permissions + +- `file-manager.use`: Browse, edit and transfer files. Admins and users have it by default. + +## Services + +Provides to other plugins: + +- `files.sftp`: read and write files on a host. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/file-manager/manifest.json b/plugins/file-manager/manifest.json index 40e5c66e3..8e19edd8b 100644 --- a/plugins/file-manager/manifest.json +++ b/plugins/file-manager/manifest.json @@ -2,7 +2,7 @@ "id": "file-manager", "name": "File Manager", "version": "1.0.0", - "description": "Browse, edit and transfer files over SFTP, including host-to-host transfers.", + "description": "Browse, edit and transfer files over SFTP, including between two hosts.", "author": { "name": "Termix" }, diff --git a/plugins/fleets/CHANGELOG.md b/plugins/fleets/CHANGELOG.md index 6a1bc3a37..1db7b7c57 100644 --- a/plugins/fleets/CHANGELOG.md +++ b/plugins/fleets/CHANGELOG.md @@ -2,4 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. + +Groups hosts into fleets, either by hand or by tag. Run commands, package actions and file transfers on every host in a fleet at once, and see an inventory of its hosts. diff --git a/plugins/fleets/README.md b/plugins/fleets/README.md index 362fafdac..468598ab6 100644 --- a/plugins/fleets/README.md +++ b/plugins/fleets/README.md @@ -1,22 +1,34 @@ # Fleets -Group hosts into fleets by static membership or tag rules, and run commands, package actions, and file transfers across every member at once. +Group hosts into fleets and run commands, package actions and file transfers on all of them at once. -Bundled with Termix and enabled by default. +## Features -## Layout +- Group hosts into fleets by hand or by tag. Hosts with a matching tag join on their own. +- Run a command on every host in a fleet at once and see each result. +- Run package actions, like updates, across a fleet. +- Transfer files to and from every host in a fleet. +- See an inventory of the hosts in a fleet. +- Share fleets with other users or roles. - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx) / deactivate(), plus the routes - src/frontend/ the UI it registers - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +## Permissions -## Commands +- `fleets.view`: See fleets, their hosts and inventory. Admins and users have it by default. +- `fleets.manage`: Create, edit, delete and share fleets. Admins and users have it by default. +- `fleets.execute`: Run commands, package actions and file transfers on a fleet. Admins and users have it by default. - npm run build bundle into dist/ - npm run test run this plugin's tests - npm run typecheck +## Services -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +Provides to other plugins: + +- `fleets.access`: list fleets and run actions on them. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/fleets/manifest.json b/plugins/fleets/manifest.json index 152a0381b..2e1533728 100644 --- a/plugins/fleets/manifest.json +++ b/plugins/fleets/manifest.json @@ -2,7 +2,7 @@ "id": "fleets", "name": "Fleets", "version": "1.0.0", - "description": "Group hosts into fleets by static membership or tag rules, and run commands, package actions, and file transfers across every member at once.", + "description": "Group hosts into fleets and run commands, package actions and file transfers on all of them at once.", "author": { "name": "Termix" }, diff --git a/plugins/homepage/CHANGELOG.md b/plugins/homepage/CHANGELOG.md index 65a24fbe7..6dfde6621 100644 --- a/plugins/homepage/CHANGELOG.md +++ b/plugins/homepage/CHANGELOG.md @@ -2,21 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. -- Homepage and the dashboard's service links moved out of core's own - servers on ports 30006 (dashboard) and 30012 (homepage), and now serve - under `/plugin-api/homepage`. -- Owns its data: core's `homepage_items`, `homepage_layouts` and - `dashboard_service_links` tables are renamed to `p_homepage_*` on first - activation. -- The favicon, RSS, ping and custom-API outbound requests now go through - `ctx.fetch` instead of a raw fetch, keeping the same SSRF guard. -- New `homepage.use` permission, given to the admin and user roles. -- Offers `homepage.items` v1 to other plugins; the AI assistant reads it - optionally. -- The dashboard's "Dashboard / Homepage" toggle is now a contribution to - core's generic `dashboard.secondaryView` slot rather than a hardcoded - homepage case. -- Core's uptime, recent-activity and database-health routes stayed on the - main server, now under `/dashboard` rather than a dedicated port. +Adds a custom page of widgets, like clocks, notes, host status, RSS feeds and an embedded terminal. Also adds service link buttons to the dashboard. diff --git a/plugins/homepage/README.md b/plugins/homepage/README.md index 1a1caf092..5a9c3b2e6 100644 --- a/plugins/homepage/README.md +++ b/plugins/homepage/README.md @@ -1,57 +1,31 @@ # Homepage -A customizable widget canvas (clock, notes, host status, RSS feeds, an -embedded terminal, and more) plus the dashboard's service link buttons. +A custom widget page and service links for your servers and services. -Bundled with Termix and enabled by default. It imports only -`@termix/plugin-sdk`. +## Features -## What it does +- A page of widgets you can move, resize, pan and zoom. Open it from the command palette. +- Widgets for clocks, notes, folders, host status, bookmarks, weather, RSS feeds, ping checks, calendars, countdowns, search, images, custom APIs, an embedded terminal and more. +- Other features can add their own widgets, like Docker, Tunnels, File Manager and Host Metrics. +- Service link buttons and a homepage preview for the dashboard. +- Widgets and service links sync between the desktop app and a server. -- **The canvas**: a pannable, zoomable grid of widgets, opened as its own - tab (singleton, `?view=homepage`) or from the command palette. Widgets - save their own layout and config. -- **Widget types**: clock, notes, markdown notes, folders, host status, - host grid, bookmarks, weather, iframe embed, RSS feed, ping status, - recent activity, Termix uptime, system overview, an embedded SSH terminal, - quick connect, calendar, countdown, search bar, text banner, image, - custom API, service grid, dashboard links, search shortcuts and link - trees. Other plugins (docker, tunnels, file-manager, host-metrics) add - their own widget types through `app.registerHomepageWidget`; the widget - type registry itself lives in core - (`src/ui/plugin-host/homepage-widget-registry.ts`) so those widgets keep - working with this plugin disabled. -- **Dashboard cards**: `service_links` (clickable service URL buttons) and - `homepage_preview` (a read-only scaled preview of the canvas), both - offered in the dashboard's card tray. The dashboard's "Dashboard / - Homepage" toggle is a contribution to core's generic - `dashboard.secondaryView` slot. -- **Outbound requests**: the favicon, RSS, ping and custom-API widgets fetch - through `ctx.fetch`, which keeps the SSRF guard (private and loopback - addresses refused, no redirects, DNS pinned) every other plugin's outbound - call gets. -- **`homepage.items`**: a service the AI assistant reads optionally, to list - a user's homepage tiles. +## Permissions -## Layout +- `homepage.use`: Use the homepage. Admins and users have it by default. - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx), routes, the outbound proxy routes - src/frontend/ the canvas, widgets, dialogs and dashboard cards - migrations/ one .sql per dialect, generated from src/backend/tables.ts - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +## Services -## Data +Provides to other plugins: -- `p_homepage_homepage_items`, `p_homepage_homepage_layouts` and - `p_homepage_dashboard_service_links`, adopted from core's `homepage_items`, - `homepage_layouts` and `dashboard_service_links`. +- `homepage.items`: list a user's homepage widgets. -Core's own uptime, recent-activity and database-health routes are unrelated -to the canvas and stay on the main server -(`src/backend/database/routes/dashboard-routes.ts`, mounted at -`/dashboard`). +## Development -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/homepage/manifest.json b/plugins/homepage/manifest.json index ccbc32ec3..2a809cd5b 100644 --- a/plugins/homepage/manifest.json +++ b/plugins/homepage/manifest.json @@ -2,7 +2,7 @@ "id": "homepage", "name": "Homepage", "version": "1.0.0", - "description": "A customizable widget canvas and dashboard service links for your servers and services.", + "description": "A custom widget page and service links for your servers and services.", "author": { "name": "Termix" }, diff --git a/plugins/host-metrics/CHANGELOG.md b/plugins/host-metrics/CHANGELOG.md index 6a1bc3a37..096c84fa3 100644 --- a/plugins/host-metrics/CHANGELOG.md +++ b/plugins/host-metrics/CHANGELOG.md @@ -2,4 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. + +Shows live CPU, memory, disk, network and process stats for your hosts, with history charts. Also adds tools to manage services, packages, firewall rules, cron jobs, users, SSL certificates, logs and WireGuard. diff --git a/plugins/host-metrics/README.md b/plugins/host-metrics/README.md index 29847abc2..6369bd961 100644 --- a/plugins/host-metrics/README.md +++ b/plugins/host-metrics/README.md @@ -1,26 +1,54 @@ # Host Metrics -Live CPU, memory, disk, network and process metrics, plus host management (services, packages, firewall, cron, users, SSL, logs, WireGuard). Other plugins add manager cards through the `host-metrics.managers` slot (Tailscale does). +Live CPU, memory, disk, network and process stats, plus tools to manage services, packages, firewall rules, cron jobs, users and more. -The host list's online and offline dot is core's own status check, not this plugin. A working metrics login is what turns a reachable host online. +## Features -Bundled with Termix and enabled by default. +- Live CPU, memory, disk, network, temperature and process stats. +- History charts for each host. +- Tools to manage services, packages, firewall rules, cron jobs, users, SSL certificates, logs and WireGuard. +- A drag and drop layout you can change per host. +- Other features can add their own tools. Tailscale does. -## Layout +## Setup - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx) / deactivate(), the poller and the routes - src/frontend/ the UI it registers - src/shared/ types both sides use - migrations/ adopts core's four metrics tables (sqlite, postgres, mysql) - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +The online dot in the host list comes from Termix itself, not this plugin. A working metrics login is what marks a reachable host as online. -## Commands +## Settings - npm run build bundle into dist/ - npm run test run this plugin's tests - npm run typecheck +### Admin -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +- Metrics interval (seconds): how often a host is checked while someone views it. +- History retention (days): how long history is kept. +- Metrics on for new hosts: whether new hosts start with metrics turned on. + +### User + +- Temperature unit: Celsius or Fahrenheit. + +### Host + +- Collect metrics: turn metrics on for this host. +- Metrics interval (seconds): override the admin interval. +- Enabled widgets: which widgets to show. +- Excluded mounts and Monitored paths: which disks to hide or watch. + +## Permissions + +- `host-metrics.use`: View metrics and use the host tools. Admins and users have it by default. + +## Services + +Provides to other plugins: + +- `host-metrics.viewers`: read a host's current metrics. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/host-metrics/manifest.json b/plugins/host-metrics/manifest.json index 7e29bcfa7..337f4ce03 100644 --- a/plugins/host-metrics/manifest.json +++ b/plugins/host-metrics/manifest.json @@ -2,7 +2,7 @@ "id": "host-metrics", "name": "Host Metrics", "version": "1.0.0", - "description": "Live CPU, memory, disk, network and process metrics, plus host management (services, packages, firewall, cron, users, SSL, logs, WireGuard).", + "description": "Live CPU, memory, disk, network and process stats, plus tools to manage services, packages, firewall rules, cron jobs, users and more.", "author": { "name": "Termix" }, diff --git a/plugins/ldap/CHANGELOG.md b/plugins/ldap/CHANGELOG.md new file mode 100644 index 000000000..eb8e5ac51 --- /dev/null +++ b/plugins/ldap/CHANGELOG.md @@ -0,0 +1,7 @@ +# Changelog + +## 1.0.0 + +First release, bundled with Termix 2.9.0. + +Lets users sign in with a username and password checked against an LDAP or Active Directory server. Members of an admin group can be made admins. diff --git a/plugins/ldap/README.md b/plugins/ldap/README.md new file mode 100644 index 000000000..971e1b0b0 --- /dev/null +++ b/plugins/ldap/README.md @@ -0,0 +1,29 @@ +# LDAP + +Sign in with a username and password checked against an LDAP or Active Directory server. + +## Features + +- Sign in with a username and password checked against an LDAP or Active Directory server. +- Add more than one directory. Each gets its own option on the login screen. +- Make members of an admin group Termix admins. + +## Settings + +### Admin + +- Directories: the LDAP servers, search bases and admin group for each directory. + +## Permissions + +- `ldap.manage`: Add, edit and remove LDAP directories. Only admins have it by default. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/network-topology/CHANGELOG.md b/plugins/network-topology/CHANGELOG.md index 6a1bc3a37..2d661ff55 100644 --- a/plugins/network-topology/CHANGELOG.md +++ b/plugins/network-topology/CHANGELOG.md @@ -2,4 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. + +Shows your hosts and how they connect as an interactive graph. Hosts can be grouped, and each user's graph is saved. diff --git a/plugins/network-topology/README.md b/plugins/network-topology/README.md index 0d6b8819a..deb77594f 100644 --- a/plugins/network-topology/README.md +++ b/plugins/network-topology/README.md @@ -1,22 +1,31 @@ # Network Topology -Visualize hosts and their connections as an interactive graph, saved per user. +Show your hosts and how they connect as an interactive graph. -Bundled with Termix and enabled by default. +## Features -## Layout +- Show your hosts and the links between them as an interactive graph. +- Put hosts into groups, and groups inside other groups. +- Import and export the graph as JSON. +- Add the graph to the dashboard as a card. +- Each user's graph is saved and syncs between the desktop app and a server. - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx) / deactivate(), plus the routes - src/frontend/ the UI it registers - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +## Permissions -## Commands +- `network-topology.use`: Use the network graph. Admins and users have it by default. - npm run build bundle into dist/ - npm run test run this plugin's tests - npm run typecheck +## Services -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +Provides to other plugins: + +- `network-topology.graph`: read a user's graph. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/network-topology/manifest.json b/plugins/network-topology/manifest.json index d475dc082..69e2e8403 100644 --- a/plugins/network-topology/manifest.json +++ b/plugins/network-topology/manifest.json @@ -2,7 +2,7 @@ "id": "network-topology", "name": "Network Topology", "version": "1.0.0", - "description": "Visualize hosts and their connections as an interactive graph, saved per user.", + "description": "Show your hosts and how they connect as an interactive graph.", "author": { "name": "Termix" }, diff --git a/plugins/opkssh/CHANGELOG.md b/plugins/opkssh/CHANGELOG.md new file mode 100644 index 000000000..5c818c00c --- /dev/null +++ b/plugins/opkssh/CHANGELOG.md @@ -0,0 +1,7 @@ +# Changelog + +## 1.0.0 + +First release, bundled with Termix 2.9.0. + +Adds the OPKSSH login type. Termix signs you in with your identity provider in the browser and gets a short-lived SSH certificate from OpenPubkey SSH. diff --git a/plugins/opkssh/README.md b/plugins/opkssh/README.md index 17517a1a9..246167ac6 100644 --- a/plugins/opkssh/README.md +++ b/plugins/opkssh/README.md @@ -1,34 +1,42 @@ # OPKSSH -Adds the `opkssh` SSH auth type: Termix signs you in with your identity -provider in the browser, gets a short-lived SSH certificate from -[OpenPubkey SSH](https://github.com/openpubkey/opkssh), and caches it for 24 -hours. +Connect to hosts with short-lived SSH certificates from OpenPubkey SSH, after signing in with your identity provider. -## Config +## Features -`/plugins/opkssh/config.yml`, OPKSSH's own config format. A -template is written there the first time someone signs in without one. An -install upgraded from 2.8 has its old `/.opk/config.yml` copied -here. +- Adds the OPKSSH login type to the host editor. +- Signs you in with your identity provider in the browser and gets a short-lived SSH certificate from [OpenPubkey SSH](https://github.com/openpubkey/opkssh). +- Keeps the certificate for 24 hours. -`redirect_uris` in that file are OPKSSH's local listener on the Termix -server and must be localhost (or left out). The public callback is passed -to OPKSSH as `--remote-redirect-uri`; register it with your identity -provider. The plugin's admin settings page shows it: -`/plugin-api/opkssh/callback`, or `/host/opkssh-callback` -while "Use the old redirect URI" is on. +## Setup -## Binary +The config file lives at `/plugins/opkssh/config.yml` and uses the OPKSSH config format. A template is written there the first time someone signs in without one. Installs upgraded from 2.8 have their old `/.opk/config.yml` copied here. -The plugin runs `opkssh` pinned to one release and its SHA-256. It looks, in -order, at: +`redirect_uris` in that file is the local listener OPKSSH opens on the Termix server. It must be localhost or left out. Register the public callback shown in the admin settings with your identity provider instead. -1. `OPKSSH_BUNDLED_DIR/` (default `/opkssh-bundled`). The Docker - image bakes the binary into `/app/opkssh-bundled`, so offline installs - never download it. +### Binary + +The plugin runs one pinned release of `opkssh` and checks its SHA-256. It looks for the binary in this order: + +1. `OPKSSH_BUNDLED_DIR/`, which defaults to `/opkssh-bundled`. The Docker image ships it at `/app/opkssh-bundled`, so offline installs never download it. 2. `/plugins/opkssh/bin/`, a copy downloaded earlier. 3. A download from the GitHub release. -Any copy whose checksum does not match is ignored. `OPKSSH_VERSION` picks -another release; `OPKSSH_SHA256` must then give its checksum. +A copy with the wrong checksum is ignored. Set `OPKSSH_VERSION` to use another release, and `OPKSSH_SHA256` to its checksum. + +## Settings + +### Admin + +- Redirect URI: register `/plugin-api/opkssh/callback` with your identity provider. +- Use the old redirect URI: keep sending the 2.8 URI `/host/opkssh-callback`. Upgraded installs keep this on until you turn it off. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/opkssh/manifest.json b/plugins/opkssh/manifest.json index b2e5347a2..60fca372c 100644 --- a/plugins/opkssh/manifest.json +++ b/plugins/opkssh/manifest.json @@ -2,7 +2,7 @@ "id": "opkssh", "name": "OPKSSH", "version": "1.0.0", - "description": "Sign in to hosts with short-lived SSH certificates from OpenPubkey SSH, using your identity provider in the browser.", + "description": "Connect to hosts with short-lived SSH certificates from OpenPubkey SSH, after signing in with your identity provider.", "author": { "name": "Termix" }, diff --git a/plugins/proxmox/CHANGELOG.md b/plugins/proxmox/CHANGELOG.md index 6a1bc3a37..95d41f13e 100644 --- a/plugins/proxmox/CHANGELOG.md +++ b/plugins/proxmox/CHANGELOG.md @@ -2,4 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. + +Finds the VMs and containers on a Proxmox VE node through an SSH host and imports them as Termix hosts. Can keep them in sync on a schedule and shows node stats. diff --git a/plugins/proxmox/README.md b/plugins/proxmox/README.md index 466f90322..db60425fd 100644 --- a/plugins/proxmox/README.md +++ b/plugins/proxmox/README.md @@ -1,22 +1,29 @@ # Proxmox -Discover Proxmox VE guests over an existing SSH host, import them as Termix hosts, and keep them in sync. +Find Proxmox VE guests through an SSH host, import them as hosts and keep them in sync. -Bundled with Termix and enabled by default. +## Features -## Layout +- Find the VMs and containers on a Proxmox VE node through an SSH host you already have. +- Import them as Termix hosts with the login type you choose. +- Keep imported hosts in sync on a schedule. +- Show node and guest stats in the Proxmox tab. - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx) / deactivate(), plus the routes - src/frontend/ the UI it registers - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +## Settings -## Commands +### Host - npm run build bundle into dist/ - npm run test run this plugin's tests - npm run typecheck +- Proxmox: mark this host as a Proxmox node and set how guests are imported. +- Default Auth Type: the login type given to imported guests. +- Auto sync guests and Sync interval (minutes): check the node for changes on a schedule. The minimum is 5 minutes. +- Proxmox stats: show the stats tab for this host. -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/proxmox/manifest.json b/plugins/proxmox/manifest.json index c3a7ff47a..afd8cc7ff 100644 --- a/plugins/proxmox/manifest.json +++ b/plugins/proxmox/manifest.json @@ -2,7 +2,7 @@ "id": "proxmox", "name": "Proxmox", "version": "1.0.0", - "description": "Discover Proxmox VE guests over an existing SSH host, import them as Termix hosts, and keep them in sync.", + "description": "Find Proxmox VE guests through an SSH host, import them as hosts and keep them in sync.", "author": { "name": "Termix" }, diff --git a/plugins/remote-desktop/CHANGELOG.md b/plugins/remote-desktop/CHANGELOG.md index 4c4bf3fab..0b364ff91 100644 --- a/plugins/remote-desktop/CHANGELOG.md +++ b/plugins/remote-desktop/CHANGELOG.md @@ -2,16 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. -- Runs entirely through the plugin SDK: no imports from Termix core. -- Remote Desktop's admin switch and guacd URL, each user's RDP defaults and - every host's RDP, VNC and Telnet options are this plugin's settings now, - moved over on upgrade. -- The user's RDP defaults now apply to saved hosts too, not only Quick Connect. -- Provides `sessions.live` for RDP, VNC and Telnet, so these sessions can be - shared and presented in collab rooms. -- Jump host tunnels and the macOS VNC proxy close with their session instead - of after an hour. -- Opening the Windows Remote Desktop client goes through the desktop app's - backend. +Adds RDP, VNC and Telnet sessions in the browser through guacd. Supports clipboard, file transfer through RDP drive redirection, session recording and session sharing. diff --git a/plugins/remote-desktop/README.md b/plugins/remote-desktop/README.md index a0bdcc53e..78448efea 100644 --- a/plugins/remote-desktop/README.md +++ b/plugins/remote-desktop/README.md @@ -1,60 +1,70 @@ # Remote Desktop -RDP, VNC and Telnet sessions over guacd, with clipboard, file transfer through -RDP drive redirection, session recording and session sharing. +RDP, VNC and Telnet sessions in the browser, with clipboard, file transfer, recording and sharing. -## guacd +## Features -guacd (the Apache Guacamole proxy daemon that speaks RDP, VNC and Telnet) is an -external service this plugin talks to over TCP. The stock Docker compose runs -it as its own `guacamole/guacd` container. This plugin never starts it. +- Connect to hosts over RDP, VNC or Telnet from any browser. +- Clipboard sync and file transfer through RDP drive redirection. +- Session recording and session sharing, when those plugins are on. +- Jump host support. +- Opens the Windows Remote Desktop client from the desktop app. -Where to find it is the admin setting **guacd URL** (`host:port`). The -`GUACD_URL`, or `GUACD_HOST` and `GUACD_PORT`, environment variables override -the setting, so a compose file stays the source of truth where it sets them. -Changing the setting rebuilds the connection server without a restart. +## Setup -Other environment variables the plugin reads: +This plugin needs guacd, the Apache Guacamole proxy that speaks RDP, VNC and Telnet. The Docker compose file runs it as its own `guacamole/guacd` container. This plugin never starts guacd itself. -| Variable | What it sets | -| ------------------------------ | --------------------------------------------------------------------------- | -| `GUACD_TUNNEL_HOST` | The name guacd uses to reach Termix for a jump host tunnel (default termix) | -| `GUACD_RECORDING_PATH` | Where guacd writes recordings, as guacd sees it | -| `GUACD_RECORDING_BACKEND_PATH` | The same folder as Termix sees it | -| `GUACD_DRIVE_PATH` | The root of each user's RDP drive folder on the guacd host | -| `GUACAMOLE_ENCRYPTION_KEY` | The connection token key; derived from `JWT_SECRET` when unset | +Set where guacd runs with the guacd URL admin setting. The `GUACD_URL`, or `GUACD_HOST` and `GUACD_PORT`, environment variables override that setting. + +Other environment variables: + +| Variable | What it sets | +| ------------------------------ | --------------------------------------------------------------------------------- | +| `GUACD_TUNNEL_HOST` | The name guacd uses to reach Termix for a jump host tunnel. Defaults to `termix`. | +| `GUACD_RECORDING_PATH` | Where guacd writes recordings, as guacd sees it. | +| `GUACD_RECORDING_BACKEND_PATH` | The same folder, as Termix sees it. | +| `GUACD_DRIVE_PATH` | The root of each user's RDP drive folder on the guacd host. | +| `GUACAMOLE_ENCRYPTION_KEY` | The connection token key. Made from `JWT_SECRET` when not set. | ## Settings -- **Admin**: turn Remote Desktop on or off, and the guacd URL. -- **User**: RDP defaults (colour depth, resize method, wallpaper, clipboard - and the rest). A host's own values win; anything a host leaves on its - default takes the user's. -- **Host**: the RDP, VNC and Telnet switches, ports, security mode, - certificate handling and every guacd parameter, edited in the host - editor's RDP, VNC and Telnet tabs. The toolbar switch is in the Plugins tab. +### Admin -The logins (users, passwords, stored credentials, domain) stay on the host in -core, because sharing decides which of them a recipient may use. +- Enable Remote Desktop: turn remote desktop on or off. +- guacd URL: where guacd runs, as `host:port`. Changes apply without a restart. -## Capabilities +### User -- `credentials:read`: guacd needs the host's RDP, VNC or Telnet password in - plain text, so the plugin reads it through `ctx.credentials`. A shared - recipient only ever gets the owner's shared snapshot or their own override. -- `ssh:connect`, `credentials:use`: jump host tunnels, through - `ctx.ssh.jumpChain`, or the tunnels plugin's `tunnels.access` for a single - hop when it is running. -- `network:serve`: the routes and the `/display` socket. -- `desktop:window`: opening the Windows Remote Desktop client from the desktop - app. -- `hosts:read`: the online indicator while a session is open. -- `ui:surface`: everything the frontend registers. +- RDP defaults: color depth, resize method, wallpaper, font smoothing, audio, printing, drive redirection and clipboard. A host's own values win over these. + +### Host + +- RDP, VNC and Telnet: turn each protocol on and set its port. +- RDP security mode and Ignore certificate errors. +- guacd settings: every other guacd option. +- Remote desktop toolbar: show the toolbar in the session. + +## Permissions + +- `remote-desktop.sessions`: Let session sharing and recording reach your remote desktop sessions. Admins and users have it by default. ## Services -Provides `sessions.live` under the names `rdp`, `vnc` and `telnet`, which is -how session sharing and collab rooms find a live session and mint a viewer -token for it. Uses `recordings.writer` (session-recording) to decide whether -to record and to list finished recordings, and `tunnels.access` (tunnels) -for single-hop jump tunnels. Both are optional. +Provides to other plugins: + +- `sessions.live` as `rdp`, `vnc` and `telnet`: find a live session so it can be shared. + +Uses from other plugins: + +- `recordings.writer` to record sessions. Optional. +- `tunnels.access` for single-hop jump host tunnels. Optional. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/remote-desktop/manifest.json b/plugins/remote-desktop/manifest.json index 49d767a46..af3489ab6 100644 --- a/plugins/remote-desktop/manifest.json +++ b/plugins/remote-desktop/manifest.json @@ -2,7 +2,7 @@ "id": "remote-desktop", "name": "Remote Desktop", "version": "1.0.0", - "description": "RDP, VNC and Telnet remote desktop sessions, with clipboard, drive redirection, session recording and session sharing.", + "description": "RDP, VNC and Telnet sessions in the browser, with clipboard, file transfer, recording and sharing.", "author": { "name": "Termix" }, diff --git a/plugins/secret-sources/CHANGELOG.md b/plugins/secret-sources/CHANGELOG.md new file mode 100644 index 000000000..3e2bbb6b0 --- /dev/null +++ b/plugins/secret-sources/CHANGELOG.md @@ -0,0 +1,7 @@ +# Changelog + +## 1.0.0 + +First release, bundled with Termix 2.9.0. + +Fetches host passwords and keys from 1Password when you connect, using op:// references, so they are not stored in Termix. diff --git a/plugins/secret-sources/README.md b/plugins/secret-sources/README.md new file mode 100644 index 000000000..f820fb7d4 --- /dev/null +++ b/plugins/secret-sources/README.md @@ -0,0 +1,25 @@ +# Secret Sources + +Fetch host secrets from 1Password when you connect instead of storing them in Termix. + +## Features + +- Connect a 1Password Connect server as a secret source. +- Use `op://` references in a host's password or key fields instead of the secret itself. +- Secrets are fetched each time you connect and are not stored in Termix. + +## Settings + +### Admin + +- Private endpoint allowlist: private or loopback hosts a secret source may reach, one per line. A self-hosted 1Password Connect server usually needs its address listed here. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/secret-sources/manifest.json b/plugins/secret-sources/manifest.json index 6d16c8b28..05f55ea4f 100644 --- a/plugins/secret-sources/manifest.json +++ b/plugins/secret-sources/manifest.json @@ -2,7 +2,7 @@ "id": "secret-sources", "name": "Secret Sources", "version": "1.0.0", - "description": "Pull host secrets from an external password manager at connect time instead of storing them, using op:// references.", + "description": "Fetch host secrets from 1Password when you connect instead of storing them in Termix.", "author": { "name": "Termix" }, diff --git a/plugins/serial/CHANGELOG.md b/plugins/serial/CHANGELOG.md index 7cd11af6a..c55fc4d0e 100644 --- a/plugins/serial/CHANGELOG.md +++ b/plugins/serial/CHANGELOG.md @@ -2,7 +2,6 @@ ## 1.0.0 -Converted from core's `src/backend/hosts/serial.ts` and -`src/ui/features/serial/` in Termix 2.9.0. Its own port (30011) and nginx -blocks are gone; it now serves `/plugin-ws/serial/console` like every other -plugin. +First release, bundled with Termix 2.9.0. + +Opens a serial console to a device plugged into your computer. The desktop app talks to the device directly, and the browser uses Web Serial. diff --git a/plugins/serial/README.md b/plugins/serial/README.md index ce7ac8e93..5592a1f59 100644 --- a/plugins/serial/README.md +++ b/plugins/serial/README.md @@ -1,32 +1,23 @@ # Serial -Serial console access over a device attached to the machine running Termix: -the desktop app talks to it through the backend's `serialport` binding, and a -browser without the desktop app falls back to the Web Serial API. +Open a serial console to a device plugged into your computer. -Bundled with Termix and enabled by default. +## Features -## Layout +- Open a serial console to a device plugged into your computer. +- The desktop app talks to the device directly. +- In a browser, the plugin uses Web Serial. - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx) / deactivate(), the /console WS route - src/frontend/ the rail panel, the tab and their shared transport - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +## Setup -## Native dependency +The desktop app uses the `serialport` npm package, which has a native binary. The build does not bundle it. See "native dependencies" in `packages/plugin-sdk/ARCHITECTURE.md` for how Docker, Electron and dev each get a working copy. -`serialport` (and its native `@serialport/bindings-cpp` binding) is this -plugin's own npm dependency rather than a host-provided one, but the build -never bundles it: see "native dependencies" in -packages/plugin-sdk/ARCHITECTURE.md for why, and how Docker, Electron and dev -each end up with a working binary anyway. +## Development -## Commands +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` - npm run build bundle into dist/ - npm run test run this plugin's tests - npm run typecheck - -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/serial/manifest.json b/plugins/serial/manifest.json index ca1790e68..c3319d320 100644 --- a/plugins/serial/manifest.json +++ b/plugins/serial/manifest.json @@ -2,7 +2,7 @@ "id": "serial", "name": "Serial", "version": "1.0.0", - "description": "Serial console access over a locally attached device.", + "description": "Open a serial console to a device plugged into your computer.", "author": { "name": "Termix" }, diff --git a/plugins/session-recording/CHANGELOG.md b/plugins/session-recording/CHANGELOG.md index 20c363a29..a4e735e92 100644 --- a/plugins/session-recording/CHANGELOG.md +++ b/plugins/session-recording/CHANGELOG.md @@ -2,15 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. -- Session recording moved out of core's `/session_logs` routes and now serves - under `/plugin-api/session-recording` through core's connect pipeline. -- Owns its data: core's `session_recordings` table is renamed to - `p_session_recording_session_recordings` on first activation. -- New `session-recording.view` permission, given to the admin and user roles. -- Offers `recordings.writer` to other plugins: `open()`/`append()`/`persist()` - for an incremental writer (ssh-terminal), `createFinished()` for a recording - already written to disk (remote desktop's guacd recordings). -- Retention days becomes an admin plugin setting; per-host recording becomes - a host plugin setting. +Records SSH terminal sessions so you can play them back, copy their text or download them. Old recordings are removed after a set number of days. diff --git a/plugins/session-recording/README.md b/plugins/session-recording/README.md index 0ce390b03..9fd006886 100644 --- a/plugins/session-recording/README.md +++ b/plugins/session-recording/README.md @@ -1,24 +1,41 @@ # Session Recording -Records terminal sessions and lets you play them back or download them. +Record terminal sessions and play them back or download them later. -Bundled with Termix and enabled by default. It imports only -`@termix/plugin-sdk`. +## Features -## What it does +- Records SSH terminal sessions as they happen. +- Play a recording back, skip through it and copy its text. +- Download a recording as a file or as plain text. +- Removes recordings older than a set number of days. +- Keeps recordings when a user is deleted, with the user's name removed. -- **Recording**: an SSH terminal session is recorded as an asciicast, written - incrementally in 300ms batches as it happens (issue #1049). -- **Playback**: view a recording inline, scrub through it, copy its plain - text, or download it as a recording file or plain text. -- **Retention**: an admin setting prunes recordings older than a configured - number of days, checked at startup and every 24 hours. -- **Per-host switch**: recording can be turned off for a host. -- **`recordings.writer`**: a service other plugins consume. `open(meta)` - starts an incremental recording (ssh-terminal); `createFinished(input)` - inserts a row for a recording the caller already wrote to disk itself - (remote desktop's guacd recordings). +## Settings -Recordings outlive the account they were made under: deleting a user -anonymizes their recordings rather than deleting them, since a recording is -evidence about the host as much as about the person. +### Admin + +- Retention (days): remove recordings older than this. Checked at startup and once a day. + +### Host + +- Enable session recording: record sessions on this host. + +## Permissions + +- `session-recording.view`: View and download session recordings. Admins and users have it by default. + +## Services + +Provides to other plugins: + +- `recordings.writer`: start a recording and add to it as a session runs, or save a recording that is already finished. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/session-recording/manifest.json b/plugins/session-recording/manifest.json index 3d8bb94f9..8db7d183a 100644 --- a/plugins/session-recording/manifest.json +++ b/plugins/session-recording/manifest.json @@ -2,7 +2,7 @@ "id": "session-recording", "name": "Session Recording", "version": "1.0.0", - "description": "Records terminal sessions and lets you play them back or download them.", + "description": "Record terminal sessions and play them back or download them later.", "author": { "name": "Termix" }, diff --git a/plugins/session-sharing/CHANGELOG.md b/plugins/session-sharing/CHANGELOG.md index 8a1c198dd..f9e465f00 100644 --- a/plugins/session-sharing/CHANGELOG.md +++ b/plugins/session-sharing/CHANGELOG.md @@ -2,19 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. -- Session sharing and collaboration rooms moved out of core and now serve - under `/plugin-api/session-sharing`. The old `/session-sharing` and - `/collab` routes are gone; guest links (`?view=shared` and - `?view=collab-guest`) keep working. -- Owns its data: core's `session_shares`, `session_share_participants`, - `collab_rooms` and `collab_room_members` tables are renamed into this - plugin on first activation. -- The instance-wide sharing switch and each host's sharing switch moved into - this plugin's admin and host settings. -- New `session-sharing.use` permission, given to the admin and user roles. -- Provides `sessions.sharing` and the `sessions.sharing.guests` registry entry, - which the terminal uses for member and guest joins. -- The share button moved from the tab bar into the terminal and remote - desktop toolbars. +Share a live terminal or remote desktop session by link or with another user, read-only or with input. Collaboration rooms let a presenter show sessions to a group. diff --git a/plugins/session-sharing/README.md b/plugins/session-sharing/README.md index 4b124953c..d5a3da019 100644 --- a/plugins/session-sharing/README.md +++ b/plugins/session-sharing/README.md @@ -1,31 +1,45 @@ # Session Sharing -Share a live terminal or remote desktop session by link or with another user, -and present sessions to a group in collaboration rooms. +Share a live terminal or remote desktop session by link or with another user, and present sessions in collaboration rooms. -Bundled with Termix and enabled by default. It imports only -`@termix/plugin-sdk`. +## Features -## What it does +- Share a live terminal or remote desktop session by link or with one user. +- Pick read-only or read and write, and set when the share expires. +- Collaboration rooms where a presenter shows a session to a group and can hand control to a member. +- Guest links for people without a Termix account. +- The share button is in the terminal and remote desktop toolbars. -- **Shares**: a link for anonymous guests, or a grant for one user, read-only - or read-write, with an expiry. The share button sits in the terminal and - remote desktop toolbars. -- **Rooms**: members watch one stage, the live session the presenter shows. - The presenter or host can hand input control to a member, and a room can - have an anonymous guest link. -- **`sessions.sharing`**: member joins and room events for the terminal - socket. Guest joins go through `sessions.sharing.guests` on `ctx.registry`, - because a guest has no user for a service's permission check. +## Settings -It reaches live sessions only through the `sessions.live` service, keyed by -session type: ssh-terminal provides `ssh`, remote desktop provides `rdp`, -`vnc` and `telnet`. +### Admin -## Layout +- Allow Session Sharing: turn sharing on or off for everyone. - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx), routes, the room hub, the services - src/frontend/ share dialog, guest views, rooms panel and tab - migrations/ one .sql per dialect, generated from src/backend/tables.ts - tests/ backend (node) and frontend (jsdom) +### Host + +- Allow Session Sharing: allow sharing sessions on this host. + +## Permissions + +- `session-sharing.use`: Share sessions and join rooms. Admins and users have it by default. + +## Services + +Provides to other plugins: + +- `sessions.sharing`: join a shared session or room from the terminal. + +Uses from other plugins: + +- `sessions.live` to reach live SSH, RDP, VNC and Telnet sessions. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/session-sharing/manifest.json b/plugins/session-sharing/manifest.json index 52b024fe3..231c57a4d 100644 --- a/plugins/session-sharing/manifest.json +++ b/plugins/session-sharing/manifest.json @@ -2,7 +2,7 @@ "id": "session-sharing", "name": "Session Sharing", "version": "1.0.0", - "description": "Share a live terminal or remote desktop session by link or with another user, and present sessions to a group in collaboration rooms.", + "description": "Share a live terminal or remote desktop session by link or with another user, and present sessions in collaboration rooms.", "author": { "name": "Termix" }, diff --git a/plugins/snippets/CHANGELOG.md b/plugins/snippets/CHANGELOG.md new file mode 100644 index 000000000..8774d7fe6 --- /dev/null +++ b/plugins/snippets/CHANGELOG.md @@ -0,0 +1,7 @@ +# Changelog + +## 1.0.0 + +First release, bundled with Termix 2.9.0. + +Save commands and notes in folders, then run or paste them into a terminal. Snippets support variables and can be shared with other users or roles. diff --git a/plugins/snippets/README.md b/plugins/snippets/README.md new file mode 100644 index 000000000..7db72bc71 --- /dev/null +++ b/plugins/snippets/README.md @@ -0,0 +1,41 @@ +# Snippets + +Save commands and notes, then run or paste them into a terminal. Supports variables and sharing. + +## Features + +- Save commands and notes and sort them into folders. +- Run a snippet or paste it into a terminal. +- Use variables like `$HOST` and `$INPUT_1` that are filled in when the snippet runs. +- Share snippets and folders with other users or roles. +- Snippets sync between the desktop app and a server. + +## Settings + +### User + +- Collapse folders by default: start each folder closed when you open the Snippets panel. + +## Permissions + +- `snippets.view`: See your own and shared snippets. Admins and users have it by default. +- `snippets.create`: Create snippets, notes and folders. Admins and users have it by default. +- `snippets.edit`: Change snippets and folders. Admins and users have it by default. +- `snippets.delete`: Delete snippets and folders. Admins and users have it by default. +- `snippets.share`: Share snippets and folders. Admins and users have it by default. + +## Services + +Provides to other plugins: + +- `snippets.access`: read and run snippets. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/snippets/manifest.json b/plugins/snippets/manifest.json index ff811f983..cae197067 100644 --- a/plugins/snippets/manifest.json +++ b/plugins/snippets/manifest.json @@ -2,7 +2,7 @@ "id": "snippets", "name": "Snippets", "version": "1.0.0", - "description": "Saved commands and notes you can run or paste into a terminal, with variables and sharing.", + "description": "Save commands and notes, then run or paste them into a terminal. Supports variables and sharing.", "author": { "name": "Termix" }, diff --git a/plugins/ssh-terminal/CHANGELOG.md b/plugins/ssh-terminal/CHANGELOG.md index c1fd28d04..fa20f92b8 100644 --- a/plugins/ssh-terminal/CHANGELOG.md +++ b/plugins/ssh-terminal/CHANGELOG.md @@ -2,6 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. The terminal, its session manager, the desktop -app's local terminal and command history live in this plugin now, with their -settings under the plugin's own admin and host settings. +First release, bundled with Termix 2.9.0. + +Adds SSH terminal sessions with jump hosts, host key checks, command history and a terminal toolbar. Sessions can stay alive after a disconnect, and the desktop app gets a local terminal. diff --git a/plugins/ssh-terminal/README.md b/plugins/ssh-terminal/README.md new file mode 100644 index 000000000..510525f4e --- /dev/null +++ b/plugins/ssh-terminal/README.md @@ -0,0 +1,56 @@ +# SSH Terminal + +SSH terminal sessions with jump hosts, host key checks, command history and a local terminal in the desktop app. + +## Features + +- SSH terminal sessions with jump hosts and host key checks. +- Keeps a session alive on the server after a disconnect, so reopening the tab picks up where you left off. +- Command history with autocomplete. +- A toolbar docked to the terminal with host tools and live stats. +- Paste or upload images to the host from the terminal. +- A local terminal in the desktop app. +- Attaches to tmux sessions when Tmux Monitor is on. + +## Settings + +### Admin + +- Keep sessions after disconnect and Terminal Session Persistence: keep a disconnected terminal alive, and for how long. +- Command History and Command history for new hosts: allow history, and whether new hosts start with it on. +- Touch Input: options for using the terminal on a touch screen. +- Image Storage: where pasted and uploaded images are kept, and how many and how large. + +### Host + +- Enable Terminal: offer an SSH terminal for this host. +- Enable Terminal Toolbar: show the toolbar for this host. +- Command History: record commands run on this host. + +## Permissions + +- `ssh-terminal.sessions`: Let other features, like session sharing and recording, reach your live terminal sessions. Admins and users have it by default. +- `ssh-terminal.history`: Read command history. Admins and users have it by default. + +## Services + +Provides to other plugins: + +- `sessions.live` as `ssh`: find a live terminal session so it can be shared. +- `terminal.history`: read a user's command history. + +Uses from other plugins: + +- `tmux.sessions` to attach to tmux. Optional. +- `sessions.sharing` for shared sessions. Optional. +- `recordings.writer` to record sessions. Optional. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/ssh-terminal/manifest.json b/plugins/ssh-terminal/manifest.json index aef35d47e..05c502fb2 100644 --- a/plugins/ssh-terminal/manifest.json +++ b/plugins/ssh-terminal/manifest.json @@ -2,7 +2,7 @@ "id": "ssh-terminal", "name": "SSH Terminal", "version": "1.0.0", - "description": "Interactive SSH terminal sessions, with jump hosts, host key verification, command history and the desktop app's local terminal.", + "description": "SSH terminal sessions with jump hosts, host key checks, command history and a local terminal in the desktop app.", "author": { "name": "Termix" }, diff --git a/plugins/sso/CHANGELOG.md b/plugins/sso/CHANGELOG.md new file mode 100644 index 000000000..481314832 --- /dev/null +++ b/plugins/sso/CHANGELOG.md @@ -0,0 +1,7 @@ +# Changelog + +## 1.0.0 + +First release, bundled with Termix 2.9.0. + +Lets users sign in with an OpenID Connect provider, GitHub or Google. Each provider gets its own login button, and group claims can make users admins. diff --git a/plugins/sso/README.md b/plugins/sso/README.md new file mode 100644 index 000000000..86c0991db --- /dev/null +++ b/plugins/sso/README.md @@ -0,0 +1,30 @@ +# Single sign-on + +Sign in with an OpenID Connect provider, GitHub or Google. Each provider gets its own button on the login screen. + +## Features + +- Sign in with any OpenID Connect provider, GitHub or Google. +- Each provider gets its own button on the login screen. +- Make members of an admin group Termix admins, read from a group claim. +- Supports back-channel logout. + +## Settings + +### Admin + +- Providers: add a provider, then register the redirect URI it shows with your identity provider. Providers set up before 2.9 keep the old redirect URI until you turn it off. + +## Permissions + +- `sso.manage`: Add, edit and remove SSO providers. Only admins have it by default. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/sso/manifest.json b/plugins/sso/manifest.json index 1fdc8254c..dbb9a2881 100644 --- a/plugins/sso/manifest.json +++ b/plugins/sso/manifest.json @@ -2,7 +2,7 @@ "id": "sso", "name": "Single sign-on", "version": "1.0.0", - "description": "Sign in with an OpenID Connect provider, GitHub or Google. Each provider you add gets its own button on the login screen.", + "description": "Sign in with an OpenID Connect provider, GitHub or Google. Each provider gets its own button on the login screen.", "author": { "name": "Termix" }, diff --git a/plugins/step-ca/CHANGELOG.md b/plugins/step-ca/CHANGELOG.md index d3fc5a77e..d2c370f96 100644 --- a/plugins/step-ca/CHANGELOG.md +++ b/plugins/step-ca/CHANGELOG.md @@ -2,15 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. -- Step CA sign-in moved out of core. The callback is now - `/plugin-api/step-ca/callback`; the 2.8 URI `/host/step-ca-callback` - still works and upgraded installs keep sending it until an admin turns - off "Use the old redirect URI". -- The CA URL, fingerprint, provisioner and private endpoint list moved from - Admin Settings into this plugin's settings. -- Issued certificates are stored encrypted in the plugin's own table, so - they survive a restart. Certificates cached by 2.8 are not carried over; - the next connection asks for one sign-in. -- The terminal shows the sign-in dialog for Step CA hosts again. +Adds the Step CA login type. Termix signs you in through a smallstep step-ca OIDC provisioner and gets a short-lived SSH certificate from the CA. diff --git a/plugins/step-ca/README.md b/plugins/step-ca/README.md index 499642349..8aaabba4a 100644 --- a/plugins/step-ca/README.md +++ b/plugins/step-ca/README.md @@ -1,31 +1,33 @@ # Step CA -Adds the `stepca` SSH auth type: Termix signs you in with the identity -provider behind a [smallstep step-ca](https://smallstep.com/docs/step-ca/) -OIDC provisioner, has the CA sign a fresh key, and keeps the short-lived SSH -certificate until it expires. +Connect to hosts with short-lived SSH certificates from a smallstep step-ca server, after signing in through its OIDC provisioner. -Termix never runs the `step` binary. It talks to the CA's HTTPS API -(`/root/`, `/provisioners`, `/1.0/ssh/sign`) and to the identity -provider directly, through core's outbound request guard. +## Features + +- Adds the Step CA login type to the host editor. +- Signs you in through the identity provider behind a [smallstep step-ca](https://smallstep.com/docs/step-ca/) OIDC provisioner. +- Has the CA sign a fresh key and keeps the certificate until it expires. +- Talks to the CA's HTTPS API directly, so the `step` binary is never needed. + +## Setup + +When `REDIS_URL` is set and you run more than one Termix instance, a callback that reaches the wrong instance is handed to the one that started the sign-in. `TERMIX_STEP_CA_REDIS_PREFIX` changes the key prefix, which defaults to `termix:step-ca`. ## Settings -Admin settings, under Settings > Plugins > Step CA: +### Admin -- **CA URL**, **Root fingerprint** and **OIDC provisioner name**. Leave all - three empty to turn Step CA off. -- **Allowed private Step CA hosts**: the CA and, if it is internal, the - identity provider. Anything private that is not listed is refused. -- **Redirect URI**: register it with the identity provider: - `/plugin-api/step-ca/callback`, or - `/host/step-ca-callback` while "Use the old redirect URI" is on. +- CA URL, Root fingerprint and OIDC provisioner name: leave all three empty to turn Step CA off. +- Allowed private Step CA hosts: the CA and, if it is internal, the identity provider. Private hosts not on this list are refused. +- Redirect URI: register `/plugin-api/step-ca/callback` with your identity provider. +- Use the old redirect URI: keep sending the 2.8 URI `/host/step-ca-callback`. Upgraded installs keep this on until you turn it off. -An install upgraded from 2.8 has its Step CA settings copied in and keeps -the old redirect URI turned on. +## Development -## Several instances +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` -With `REDIS_URL` set, a callback that reaches another Termix instance is -handed to the one that started the sign-in. `TERMIX_STEP_CA_REDIS_PREFIX` -changes the key prefix (default `termix:step-ca`). +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/step-ca/manifest.json b/plugins/step-ca/manifest.json index 4db90eee2..26c3277e3 100644 --- a/plugins/step-ca/manifest.json +++ b/plugins/step-ca/manifest.json @@ -2,7 +2,7 @@ "id": "step-ca", "name": "Step CA", "version": "1.0.0", - "description": "Sign in to hosts with short-lived SSH certificates from a smallstep step-ca server, using its OIDC provisioner in the browser. Termix calls the CA's HTTPS API directly and never runs the step binary.", + "description": "Connect to hosts with short-lived SSH certificates from a smallstep step-ca server, after signing in through its OIDC provisioner.", "author": { "name": "Termix" }, diff --git a/plugins/tailscale/CHANGELOG.md b/plugins/tailscale/CHANGELOG.md index 6a1bc3a37..ec3d7e98f 100644 --- a/plugins/tailscale/CHANGELOG.md +++ b/plugins/tailscale/CHANGELOG.md @@ -2,4 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. + +Lets you browse devices on your tailnet and pick one when adding a host. Also shows the Tailscale SSH sign-in check when a host asks for it. diff --git a/plugins/tailscale/README.md b/plugins/tailscale/README.md index 1af0b5482..517ad6e19 100644 --- a/plugins/tailscale/README.md +++ b/plugins/tailscale/README.md @@ -1,22 +1,32 @@ # Tailscale -Browse and connect to tailnet devices, manage the Tailscale API key, and show the Tailscale SSH re-authentication dialog. +Browse and connect to devices on your tailnet, and handle Tailscale SSH sign-in checks. -Bundled with Termix and enabled by default. +## Features -## Layout +- Browse the devices on your Tailscale or Headscale tailnet. +- Pick a device when adding a host to fill in its address. +- Shows the Tailscale SSH sign-in check when a host asks for it. +- Adds a Tailscale tool to Host Metrics. - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx) / deactivate(), plus the routes - src/frontend/ the UI it registers - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +## Settings -## Commands +### Admin - npm run build bundle into dist/ - npm run test run this plugin's tests - npm run typecheck +- API key: a Tailscale or Headscale API key for your tailnet. +- API base URL: leave empty for Tailscale, or point it at a Headscale instance. +- Device list: check that the key works and see how many devices are reachable. -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +## Permissions + +- `tailscale.devices.view`: See the devices on the tailnet. Only admins have it by default. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/tailscale/manifest.json b/plugins/tailscale/manifest.json index e5e046cb6..371e801e9 100644 --- a/plugins/tailscale/manifest.json +++ b/plugins/tailscale/manifest.json @@ -2,7 +2,7 @@ "id": "tailscale", "name": "Tailscale", "version": "1.0.0", - "description": "Browse and connect to tailnet devices, manage the Tailscale API key, and show the Tailscale SSH re-authentication dialog.", + "description": "Browse and connect to devices on your tailnet, and handle Tailscale SSH sign-in checks.", "author": { "name": "Termix" }, diff --git a/plugins/termix-identity/CHANGELOG.md b/plugins/termix-identity/CHANGELOG.md index 57d453645..ef7f79dcc 100644 --- a/plugins/termix-identity/CHANGELOG.md +++ b/plugins/termix-identity/CHANGELOG.md @@ -2,13 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. -- Termix ID moved out of core. The resolver is now - `/plugin-api/termix-identity/u/`; the 2.8 URLs under - `/termix-id/u/` redirect to it. -- Handles, published keys and certificate authorities are kept on upgrade. - The CA private key is now encrypted with the installation key instead of - the owner's data key, so issuing a certificate no longer needs the data - key unlocked. -- New `termix-identity.use` permission, granted to admins and users. +Publish your SSH public keys under a public handle that servers can fetch into authorized_keys. Each handle can also run its own SSH certificate authority. diff --git a/plugins/termix-identity/README.md b/plugins/termix-identity/README.md index aac17bd13..21f50f444 100644 --- a/plugins/termix-identity/README.md +++ b/plugins/termix-identity/README.md @@ -1,33 +1,37 @@ # Termix Identity -Claim a public handle and publish your SSH public keys under it. Any server -can then pull them into `authorized_keys`: +Publish your SSH public keys under a public handle and run your own SSH certificate authority. + +## Features + +- Claim a public handle and publish your SSH public keys under it. +- Run your own SSH certificate authority for each handle. +- Issue short-lived certificates for your Ed25519 keys. + +## Setup + +Any server can pull your keys into `authorized_keys`: ```bash curl -fsSL https:///plugin-api/termix-identity/u/ >> ~/.ssh/authorized_keys ``` -Add `/` (for example `/ED25519`) to serve only one key type. The -resolver needs no login and is never cached. +Add `/`, for example `/ED25519`, to get only one key type. This URL needs no login and is never cached. -## Certificate authority +To use the certificate authority, point `TrustedUserCAKeys` on your servers at the public key from `/u//ca`. Rotating the CA revokes every certificate it issued. Certificates are downloaded once and not stored, so Termix hosts do not use them to connect. -Each handle can have its own SSH certificate authority. Servers trust it with -`TrustedUserCAKeys`, using the public key from `/u//ca`. Termix then -issues short-lived certificates for your Ed25519 keys. Rotating the CA -revokes every certificate it issued. The CA private key is stored encrypted -with the installation key. +The 2.8 URLs under `/termix-id/u/` redirect here, so existing scripts keep working. Use `curl -L` to follow the redirect. -Certificates are downloaded once and never stored, so hosts in Termix do not -use them to connect. This plugin adds no SSH auth type. +## Permissions -## Old URLs +- `termix-identity.use`: Claim a handle, publish keys and run a CA. Admins and users have it by default. -The 2.8 resolver URLs (`/termix-id/u/`, `/termix-id/u//` -and `/termix-id/u//ca`) permanently redirect here, so servers that -fetch them from scripts keep working. `curl -L` follows the redirect. +## Development -## Permission +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` -`termix-identity.use` lets a user claim a handle, publish keys and run a CA. -Admins and users have it by default. +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/termix-identity/manifest.json b/plugins/termix-identity/manifest.json index ba15873f1..ae39d0e64 100644 --- a/plugins/termix-identity/manifest.json +++ b/plugins/termix-identity/manifest.json @@ -2,7 +2,7 @@ "id": "termix-identity", "name": "Termix Identity", "version": "1.0.0", - "description": "Publish your SSH public keys under a public handle that servers can fetch into authorized_keys, and run your own SSH certificate authority to issue short-lived user certificates.", + "description": "Publish your SSH public keys under a public handle and run your own SSH certificate authority.", "author": { "name": "Termix" }, diff --git a/plugins/tmux-monitor/CHANGELOG.md b/plugins/tmux-monitor/CHANGELOG.md index d4f418215..2b8c9ae63 100644 --- a/plugins/tmux-monitor/CHANGELOG.md +++ b/plugins/tmux-monitor/CHANGELOG.md @@ -2,13 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. -- Tmux monitoring moved out of core's own server on port 30010 and now serves - under `/plugin-api/tmux-monitor` through core's connect pipeline. -- Owns its data: core's `tmux_session_tags` table is renamed to - `p_tmux_monitor_session_tags` on first activation, and each host's monitor - switch moves into this plugin's host settings. -- New `tmux-monitor.use` permission, given to the admin and user roles. -- Offers `tmux.sessions` to other plugins, so the terminal can attach to, - create and wait for tmux sessions without importing this plugin. +Browse and control tmux sessions, windows and panes across your hosts. Create, rename and close them, tag sessions and attach a terminal to any pane. diff --git a/plugins/tmux-monitor/README.md b/plugins/tmux-monitor/README.md index 43ef3bfeb..f2036ebd5 100644 --- a/plugins/tmux-monitor/README.md +++ b/plugins/tmux-monitor/README.md @@ -2,41 +2,36 @@ Browse and control tmux sessions, windows and panes across your hosts. -Bundled with Termix and enabled by default. It imports only -`@termix/plugin-sdk`. +## Features -## What it does +- See the tmux sessions, windows and panes on every host with the monitor on. +- CPU, memory and GPU use for each pane, and search across pane history. +- Create, rename and close sessions and windows, and split and close panes. +- Attach a terminal to any pane. +- Tag sessions with your own labels. -- **Overview**: sessions, windows and panes for every host with the monitor - enabled, refreshed on a poll, with per-pane CPU/memory/GPU metrics and a - search across pane scrollback. -- **Control**: create, rename and kill sessions and windows, split and kill - panes, and attach a real terminal to a pane in place. -- **Tags**: per-user labels on a session, saved per host so everyone who - monitors it can tag it differently. -- **`tmux.sessions`**: a service the ssh-terminal plugin consumes, optionally, - to detect tmux on connect, attach or create a session, and wait for a new - one to appear. The terminal keeps working without this plugin; it just - skips tmux attach. +## Settings -Every command runs over a pooled connection through `ctx.ssh.withConnection`, -so it gets host key checks, auth providers, proxies and jump hosts like every -other transport. +### Host -## Layout +- Enable Tmux Monitor: show this host in the monitor. - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx), routes, the tmux exec helpers, the service - migrations/ one .sql per dialect, generated from src/backend/tables.ts - src/frontend/ the tab, host action, session tree and pane preview - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +## Permissions -## Data +- `tmux-monitor.use`: Use Tmux Monitor. Admins and users have it by default. -- `p_tmux_monitor_session_tags`, adopted from core's `tmux_session_tags`. -- Host setting `enableTmuxMonitor`, copied from the `ssh_data` column of the - same name by core's `tmux-monitor-settings-migration.ts`. +## Services -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +Provides to other plugins: + +- `tmux.sessions`: find, attach to and create tmux sessions. The terminal uses this to attach to tmux on connect. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/totp/CHANGELOG.md b/plugins/totp/CHANGELOG.md new file mode 100644 index 000000000..9715975fa --- /dev/null +++ b/plugins/totp/CHANGELOG.md @@ -0,0 +1,7 @@ +# Changelog + +## 1.0.0 + +First release, bundled with Termix 2.9.0. + +Asks for a code from an authenticator app after signing in. Comes with backup codes in case you lose your phone. diff --git a/plugins/totp/README.md b/plugins/totp/README.md new file mode 100644 index 000000000..d9b30974d --- /dev/null +++ b/plugins/totp/README.md @@ -0,0 +1,19 @@ +# TOTP + +Ask for a code from an authenticator app after signing in, with backup codes in case you lose your phone. + +## Features + +- Ask for a code from an authenticator app after signing in. +- Backup codes you can download and use if you lose your phone. +- Add more than one device. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/totp/manifest.json b/plugins/totp/manifest.json index 78f530fe7..b4e439764 100644 --- a/plugins/totp/manifest.json +++ b/plugins/totp/manifest.json @@ -2,7 +2,7 @@ "id": "totp", "name": "TOTP", "version": "1.0.0", - "description": "Ask for a code from an authenticator app after signing in, with backup codes for when the phone is not at hand.", + "description": "Ask for a code from an authenticator app after signing in, with backup codes in case you lose your phone.", "author": { "name": "Termix" }, diff --git a/plugins/tunnels/CHANGELOG.md b/plugins/tunnels/CHANGELOG.md index 52c146013..89ca44180 100644 --- a/plugins/tunnels/CHANGELOG.md +++ b/plugins/tunnels/CHANGELOG.md @@ -2,17 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. -- Tunnels moved out of core's own server on port 30003 and now serve under - `/plugin-api/tunnels` and `/plugin-ws/tunnels`. -- Both SSH legs of a tunnel now go through core's connect pipeline, so a host - with an unknown or changed host key is refused the same way every other - connection refuses it. -- Owns its data: core's `c2s_tunnel_presets` table is renamed to - `p_tunnels_presets` on first activation, and each host's tunnel switch and - saved tunnels move into this plugin's host settings. -- New `tunnels.use` permission, given to the admin and user roles. -- Offers `tunnels.access` to other plugins, used by web-endpoint and - automations. A tunnel that drops on its own emits - `plugin.tunnels.tunnel_disconnected`. +Adds SSH port forwarding between servers, with local, remote and SOCKS5 tunnels that can start on boot. The desktop app can also open local tunnels. diff --git a/plugins/tunnels/README.md b/plugins/tunnels/README.md index 330c4f17f..00851c728 100644 --- a/plugins/tunnels/README.md +++ b/plugins/tunnels/README.md @@ -1,44 +1,37 @@ # Tunnels -SSH port forwarding between servers, and client tunnels from the desktop app. +SSH port forwarding between servers, plus local tunnels from the desktop app. -Bundled with Termix and enabled by default. It imports only -`@termix/plugin-sdk`. +## Features -## What it does +- Local, remote and dynamic (SOCKS5) SSH tunnels saved on a host. +- Start tunnels from the Tunnels tab or the host editor, or on boot. +- Route a tunnel through a second host. +- Local tunnels from the desktop app, with saved presets. +- Adds a tunnels widget to the homepage. -- **Server tunnels**: local, remote and dynamic (SOCKS5) forwards saved on a - host, started from the Tunnels tab, the host editor or at boot when marked - auto-start. A tunnel either rides the source host's connection alone, or - opens a second SSH leg to a Termix endpoint host through a channel on the - source connection. -- **Client tunnels**: the desktop app listens locally and relays each - connection over `/plugin-ws/tunnels/c2s/stream`; presets of that list are - saved per user. -- **`tunnels.access`**: a service other plugins call. `forward()` opens an - on-demand forward and resolves once it works (web-endpoint uses it); - `start`/`stop`/`status`/`list` work on saved tunnels by name (automations). +## Settings -Both SSH legs go through `ctx.ssh.connect`, so tunnels get host key checks, -auth providers, proxies and jump hosts like every other transport. The -endpoint leg passes its forwardOut channel as `sock`. +### Host -## Layout +- Enable tunnels and the list of saved tunnels for this host. - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx), the tunnel manager, routes, relay, service - src/shared/ types and tunnel naming used by both bundles - migrations/ one .sql per dialect, generated from src/backend/tables.ts - src/frontend/ the tab, host editor section, rail panel and widget - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +## Permissions -## Data +- `tunnels.use`: Use tunnels. Admins and users have it by default. -- `p_tunnels_presets`, adopted from core's `c2s_tunnel_presets`. -- Host settings `enableTunnel` and `tunnelConnections`, copied from the - `ssh_data` columns of the same names by core's - `tunnels-settings-migration.ts`. +## Services -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +Provides to other plugins: + +- `tunnels.access`: open a tunnel on demand, or start, stop and check saved tunnels. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/tunnels/manifest.json b/plugins/tunnels/manifest.json index 8ba85d8a9..9816c54a5 100644 --- a/plugins/tunnels/manifest.json +++ b/plugins/tunnels/manifest.json @@ -2,7 +2,7 @@ "id": "tunnels", "name": "Tunnels", "version": "1.0.0", - "description": "SSH port forwarding between servers, and client tunnels from the desktop app.", + "description": "SSH port forwarding between servers, plus local tunnels from the desktop app.", "author": { "name": "Termix" }, diff --git a/plugins/vault/CHANGELOG.md b/plugins/vault/CHANGELOG.md index 757423768..7602aa48b 100644 --- a/plugins/vault/CHANGELOG.md +++ b/plugins/vault/CHANGELOG.md @@ -2,16 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. -- Vault SSH signing moved out of core. The callback is now - `/plugin-api/vault/oidc/callback`; the 2.8 URI `/vault/oidc/callback` - still works and upgraded installs keep sending it until an admin turns - off "Use the old redirect URI". -- Profiles keep their ids and sync ids. A host's profile is now a host - setting of this plugin. -- Signed certificates are stored encrypted with the installation key. - Certificates cached by 2.8 are not carried over; the next connection asks - for one sign-in. -- Sharing a profile needs the "Share Vault profiles" permission, which - admins have by default. +Adds the Vault login type. Termix signs you in to Vault with OIDC in the browser and gets a short-lived SSH certificate from Vault's SSH secrets engine. diff --git a/plugins/vault/README.md b/plugins/vault/README.md index 990a877ba..766ea881b 100644 --- a/plugins/vault/README.md +++ b/plugins/vault/README.md @@ -1,29 +1,40 @@ # HashiCorp Vault -Adds the `vault` SSH auth type: Termix signs you in to Vault with OIDC in the -browser, has Vault's SSH secrets engine sign a fresh key, and keeps the -short-lived certificate until it expires. +Connect to hosts with short-lived SSH certificates from HashiCorp Vault, after signing in to Vault with OIDC. -Termix talks to Vault's HTTP API directly (`auth//oidc/auth_url`, -`auth//oidc/callback`, `/sign/`). No Vault token, -AppRole secret or long-lived key is ever stored. +## Features -## Profiles +- Adds the Vault login type to the host editor. +- Signs you in to Vault with OIDC in the browser. +- Has Vault's SSH secrets engine sign a fresh key and keeps the certificate until it expires. +- Never stores a Vault token, AppRole secret or long-lived key. -A profile holds the connection settings only: the Vault address and -namespace, the OIDC mount and role, the SSH secrets mount and signer role, -the valid principals and the key type. Pick one in the host editor after -choosing "Vault" as the authentication type, and manage profiles from the -same place. Users with the "Share Vault profiles" permission can share a -profile with everyone. +## Setup + +A profile holds the Vault address and namespace, the OIDC mount and role, the SSH secrets mount and signer role, the valid principals and the key type. Pick Vault as the login type in the host editor, then choose or create a profile there. Profiles sync between the desktop app and a server. ## Settings -Admin settings, under Settings > Plugins > HashiCorp Vault: +### Admin -- **Redirect URI**: add it to `allowed_redirect_uris` in each Vault OIDC - role: `/plugin-api/vault/oidc/callback`, or - `/vault/oidc/callback` while "Use the old redirect URI" is on. +- Redirect URI: add `/plugin-api/vault/oidc/callback` to `allowed_redirect_uris` in each Vault OIDC role. +- Use the old redirect URI: keep sending the 2.8 URI `/vault/oidc/callback`. Upgraded installs keep this on until you turn it off. -An install upgraded from 2.8 that used Vault keeps the old redirect URI -turned on. +### Host + +- Vault signer profile: the profile this host uses. + +## Permissions + +- `vault.use`: Sign in to hosts with Vault. Admins and users have it by default. +- `vault.share`: Share Vault profiles with everyone. Only admins have it by default. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/vault/manifest.json b/plugins/vault/manifest.json index 16a8384ec..5dc56d2b2 100644 --- a/plugins/vault/manifest.json +++ b/plugins/vault/manifest.json @@ -2,7 +2,7 @@ "id": "vault", "name": "HashiCorp Vault", "version": "1.0.0", - "description": "Sign in to hosts with short-lived SSH certificates from a HashiCorp Vault SSH secrets engine, after an OIDC sign-in to Vault in the browser.", + "description": "Connect to hosts with short-lived SSH certificates from HashiCorp Vault, after signing in to Vault with OIDC.", "author": { "name": "Termix" }, diff --git a/plugins/wake-on-lan/CHANGELOG.md b/plugins/wake-on-lan/CHANGELOG.md new file mode 100644 index 000000000..0ff114a90 --- /dev/null +++ b/plugins/wake-on-lan/CHANGELOG.md @@ -0,0 +1,7 @@ +# Changelog + +## 1.0.0 + +First release, bundled with Termix 2.9.0. + +Wakes a sleeping host by sending a Wake-on-LAN packet to its MAC address. diff --git a/plugins/wake-on-lan/README.md b/plugins/wake-on-lan/README.md new file mode 100644 index 000000000..c72bd6b4d --- /dev/null +++ b/plugins/wake-on-lan/README.md @@ -0,0 +1,35 @@ +# Wake-on-LAN + +Wake a sleeping host by sending a Wake-on-LAN packet to its MAC address. + +## Features + +- Wake a sleeping host by sending a Wake-on-LAN packet to its MAC address. +- Automations can wake a host as one of their steps. + +## Settings + +### Host + +- MAC address: the network card to wake. +- Broadcast address: where to send the packet. + +## Permissions + +- `wake-on-lan.send`: Send Wake-on-LAN packets. Admins and users have it by default. + +## Services + +Provides to other plugins: + +- `wake-on-lan.send`: wake a host. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/wake-on-lan/manifest.json b/plugins/wake-on-lan/manifest.json index c7845dad1..7c9289e45 100644 --- a/plugins/wake-on-lan/manifest.json +++ b/plugins/wake-on-lan/manifest.json @@ -2,7 +2,7 @@ "id": "wake-on-lan", "name": "Wake-on-LAN", "version": "1.0.0", - "description": "Wake a sleeping host by sending a Wake-on-LAN magic packet to its MAC address.", + "description": "Wake a sleeping host by sending a Wake-on-LAN packet to its MAC address.", "author": { "name": "Termix" }, diff --git a/plugins/warpgate/CHANGELOG.md b/plugins/warpgate/CHANGELOG.md new file mode 100644 index 000000000..75468638b --- /dev/null +++ b/plugins/warpgate/CHANGELOG.md @@ -0,0 +1,7 @@ +# Changelog + +## 1.0.0 + +First release, bundled with Termix 2.9.0. + +Lets you connect through a Warpgate SSH bastion. Its browser approval shows as a sign-in dialog, and your saved password is sent for you. diff --git a/plugins/warpgate/README.md b/plugins/warpgate/README.md new file mode 100644 index 000000000..0c00e5477 --- /dev/null +++ b/plugins/warpgate/README.md @@ -0,0 +1,25 @@ +# Warpgate + +Connect through a Warpgate SSH bastion. Its browser approval shows as a sign-in dialog and your saved password is sent for you. + +## Features + +- Connect through a [Warpgate](https://github.com/warp-tech/warpgate) SSH bastion. +- Warpgate's browser approval shows as a sign-in dialog. +- Your saved password is sent to Warpgate for you. + +## Settings + +### Host + +- Warpgate Gateway: this host connects through Warpgate. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/warpgate/manifest.json b/plugins/warpgate/manifest.json index ce09d39c5..c2b570c7e 100644 --- a/plugins/warpgate/manifest.json +++ b/plugins/warpgate/manifest.json @@ -2,7 +2,7 @@ "id": "warpgate", "name": "Warpgate", "version": "1.0.0", - "description": "Connect through a Warpgate SSH bastion: its browser approval shows as a sign-in dialog, and the stored password answers its password prompt.", + "description": "Connect through a Warpgate SSH bastion. Its browser approval shows as a sign-in dialog and your saved password is sent for you.", "author": { "name": "Termix" }, diff --git a/plugins/web-endpoint/CHANGELOG.md b/plugins/web-endpoint/CHANGELOG.md index 6a1bc3a37..30b7265a2 100644 --- a/plugins/web-endpoint/CHANGELOG.md +++ b/plugins/web-endpoint/CHANGELOG.md @@ -2,4 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. + +Opens a host's web UI in a tab or a separate desktop window, either directly or over an SSH tunnel. diff --git a/plugins/web-endpoint/README.md b/plugins/web-endpoint/README.md index 85df3f1aa..b7bba86da 100644 --- a/plugins/web-endpoint/README.md +++ b/plugins/web-endpoint/README.md @@ -1,65 +1,40 @@ # Web Endpoint -Opens a host's web UI from Termix, either directly or through an SSH tunnel, in an -embedded tab or an isolated desktop window. +Open a host's web UI in a tab or a separate desktop window, directly or over an SSH tunnel. -Each host can define up to 16 endpoints (`MAX_WEB_ENDPOINTS`). An endpoint is either: +## Features -- **direct** — the browser loads `scheme://host:port/path` itself, or -- **tunnel** — the backend opens a local SSH forward to the target port and the frame - loads it over loopback. +- Open a host's web UI in a tab or a separate desktop window. +- Connect directly, or over an SSH tunnel when the web UI is only reachable from the host. +- Up to 16 endpoints per host. -## Layout +## Setup -| Path | What it is | -| ------------------------------------- | ---------------------------------------------------------------------- | -| `backend/index.mjs` | Plugin entry: `activate` starts the service, `deactivate` stops it. | -| `backend/routes.ts` | `POST /open` — opens or reuses the forward and returns the bound port. | -| `frontend/WebEndpointTab.tsx` | The embedded viewer (a `credentialless` sandboxed iframe). | -| `frontend/web-endpoint-api.ts` | Client for the open route plus the Electron bridges. | -| `frontend/web-endpoint-url.ts` | URL building and the cookie/reachability refusal rules. | -| `frontend/web-endpoint-validation.ts` | Editor-side mirror of the backend normalizer. | +Each endpoint is one of two kinds: -## What stays in core +- Direct: your browser loads `scheme://host:port/path` itself. +- Tunnel: Termix opens an SSH tunnel to the port and loads it from there. Unused tunnels close after ten minutes. -This plugin owns its lifecycle, not all of its code. Three pieces deliberately stay in -Termix proper: +Tunnel endpoints need the Tunnels plugin. -- **`host-web-endpoints.ts`** (`src/backend/database/routes/`). Despite sitting in - `routes/` it has no router — it is the `webUiConfig` normalizer, imported by `host.ts`, - `host-bulk-routes.ts` and `host-normalizers.ts` to sanitize the column on every host - save and list. Disabling this plugin must not stop that validation, and core cannot - import plugin code in any case. -- **The Electron half** (`electron/web-endpoint-window.cjs` plus the - `open-isolated-web-endpoint` and `allow-invalid-certificate-for-origin` handlers in - `main.cjs`). `BrowserWindow` and `session` are main-process-only, the renderer is what - invokes those channels, and the main process loads no plugin code today. -- **`HostEditorWebUiSection.tsx`** (`src/ui/sidebar/`). It is a section inside the host - editor's General tab and takes the core-owned `{ form, setField }` pair, the same - reason docker leaves `HostDockerTab` in core. +## Settings -The `enableWebUi` and `webUiConfig` columns stay on core's `ssh_data` table, declared -here through `contributes.hostCapability`. +### Host -## Tunnels +- Enable web endpoints and the list of endpoints for this host. -A tunnel endpoint opens through the tunnels plugin, a hard dependency. `POST /open` -calls `forward()` on its `tunnels.access` service, which connects through core's SSH -pipeline, binds the local listener, probes the target once and only then returns the -bound port. The forward runs under the reserved `web::` name, so -the tunnels plugin never retries it and closes it after ten idle minutes. +## Services -## Routing +Uses from other plugins: -Core mounts the route at `/plugin-api/web-endpoint/open` through `ctx.http.router()`, -which the generic `/plugin-api/` block in both nginx configs already proxies. +- `tunnels.access` to open tunnels. Required. -## Tests +## Development -Backend tests are in `src/backend/tests/plugins/web-endpoint/` (the backend vitest -project only globs `src/backend/**`). Frontend tests sit beside the source here, which -the frontend project picks up via `plugins/**/frontend/**/*.test.{ts,tsx}`. +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` -`web-endpoint-validation.test.ts` deliberately imports the backend normalizer as well as -the editor one and runs both over the same samples, so the two implementations cannot -drift. +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/web-endpoint/manifest.json b/plugins/web-endpoint/manifest.json index 96faa08d3..5fea709e7 100644 --- a/plugins/web-endpoint/manifest.json +++ b/plugins/web-endpoint/manifest.json @@ -2,7 +2,7 @@ "id": "web-endpoint", "name": "Web Endpoint", "version": "1.0.0", - "description": "Open a host's web UI in a tab or an isolated desktop window, directly or over an SSH tunnel.", + "description": "Open a host's web UI in a tab or a separate desktop window, directly or over an SSH tunnel.", "author": { "name": "Termix" }, diff --git a/plugins/webauthn/CHANGELOG.md b/plugins/webauthn/CHANGELOG.md new file mode 100644 index 000000000..785187ffc --- /dev/null +++ b/plugins/webauthn/CHANGELOG.md @@ -0,0 +1,7 @@ +# Changelog + +## 1.0.0 + +First release, bundled with Termix 2.9.0. + +Lets users sign in with a passkey or security key instead of a password. A passkey that checks your PIN or fingerprint also counts as a second factor. diff --git a/plugins/webauthn/README.md b/plugins/webauthn/README.md new file mode 100644 index 000000000..0bdee9c0c --- /dev/null +++ b/plugins/webauthn/README.md @@ -0,0 +1,19 @@ +# Passkeys + +Sign in with a passkey or security key instead of a password. A passkey that checks your PIN or fingerprint also counts as a second factor. + +## Features + +- Sign in with a passkey or security key instead of a password. +- A passkey that checks your PIN or fingerprint also counts as a second factor. +- Add more than one passkey, including synced ones. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/webauthn/manifest.json b/plugins/webauthn/manifest.json index fff8f2786..503b30265 100644 --- a/plugins/webauthn/manifest.json +++ b/plugins/webauthn/manifest.json @@ -2,7 +2,7 @@ "id": "webauthn", "name": "Passkeys", "version": "1.0.0", - "description": "Sign in with a passkey or security key instead of a password. A passkey that checks your PIN or fingerprint also counts as the second factor.", + "description": "Sign in with a passkey or security key instead of a password. A passkey that checks your PIN or fingerprint also counts as a second factor.", "author": { "name": "Termix" }, diff --git a/plugins/workspaces/CHANGELOG.md b/plugins/workspaces/CHANGELOG.md index 3ff1fdf72..8dd8eb59b 100644 --- a/plugins/workspaces/CHANGELOG.md +++ b/plugins/workspaces/CHANGELOG.md @@ -2,14 +2,6 @@ ## 1.0.0 -Bundled with Termix 2.9.0. +First release, bundled with Termix 2.9.0. -- Owns its data: core's `user_workspaces` table is renamed to - `p_workspaces_workspaces` on first activation, keeping every saved workspace. -- New `workspaces.use` permission, given to the admin and user roles. Without - it the rail item is hidden and the routes answer 403. -- Saved workspaces sync between the desktop app and a server. The per-device - "Last Session" does not. -- Offers `workspaces.saved` to other plugins, used by the AI assistant. -- A tab from a plugin that is off is kept as a placeholder when a workspace is - applied, instead of being dropped. +Save your open tabs and split layouts as named workspaces and bring them back later. Workspaces sync between the desktop app and a server. diff --git a/plugins/workspaces/README.md b/plugins/workspaces/README.md index 2c041d7b8..3afec8233 100644 --- a/plugins/workspaces/README.md +++ b/plugins/workspaces/README.md @@ -1,26 +1,30 @@ # Workspaces -Save and restore named tab/split layouts per user. +Save and restore named tab and split layouts. -Bundled with Termix and enabled by default. This is the reference -conversion: it imports only `@termix/plugin-sdk`, and "Converting a feature -into a plugin" in packages/plugin-sdk/ARCHITECTURE.md points here for each step. +## Features -## Layout +- Save your open tabs and split layouts as a named workspace. +- Open a workspace later to bring every tab back. +- Tabs from a feature that is turned off are kept as placeholders. +- Saved workspaces sync between the desktop app and a server. - manifest.json id, capabilities and what this plugin contributes - src/backend/ activate(ctx), the table, repository and routes - migrations/ one .sql per dialect, generated from src/backend/tables.ts - src/frontend/ the UI it registers - locales/en.json its strings (English only; the rest are translated) - tests/backend/ vitest, node - tests/frontend/ vitest, jsdom +## Permissions -## Commands +- `workspaces.use`: Use workspaces. Admins and users have it by default. - npm run build bundle into dist/ - npm run test run this plugin's tests - npm run typecheck - npx termix-plugin migrations after changing src/backend/tables.ts +## Services -See packages/plugin-sdk/ARCHITECTURE.md for the contract this follows. +Provides to other plugins: + +- `workspaces.saved`: list a user's saved workspaces. + +## Development + +```bash +npm run build # build into dist/ +npm run test # run this plugin's tests +npm run typecheck # type-check this plugin +``` + +See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract. diff --git a/plugins/workspaces/manifest.json b/plugins/workspaces/manifest.json index 16ec3c50f..3c4987522 100644 --- a/plugins/workspaces/manifest.json +++ b/plugins/workspaces/manifest.json @@ -2,7 +2,7 @@ "id": "workspaces", "name": "Workspaces", "version": "1.0.0", - "description": "Save and restore named tab/split layouts per user.", + "description": "Save and restore named tab and split layouts.", "author": { "name": "Termix" },