chore(release): merge dev into main — v11 (security hardening, production readiness, Tabler/ApexCharts)

.env.example

@@ -10,6 +10,13 @@
 
 SERVER_PORT=8080
 
+# Docker image published by the release workflow (ghcr.io, multi-arch, cosign-signed).
+# Pin SERVERSUPERVISOR_VERSION to a specific tag (e.g. v9.2.0) for a reproducible
+# deployment instead of tracking "latest"; leave commented to use the default in
+# docker-compose.yml.
+# SERVERSUPERVISOR_IMAGE=ghcr.io/rem7474/serversupervisor
+# SERVERSUPERVISOR_VERSION=latest
+
 # Deployment environment. Set to "dev" or "development" for local work — the
 # server will then auto-generate a JWT_SECRET when none is provided and skip
 # the strict secret validation. Any other value (or unset) is treated as
@@ -75,10 +82,11 @@ DB_PASSWORD=your-secure-password-here
 # Authentication
 # ----------------------------------------
 
-# REQUIRED in production. Generate with: openssl rand -hex 32
-# Must be at least 32 characters. In APP_ENV=dev mode an ephemeral random
-# secret is generated automatically when this var is unset.
-JWT_SECRET=generate-a-random-long-secret-here
+# Secret used to sign JWT tokens.
+# Optional: if left empty, a secure random 64-character hex secret will be
+# generated on first boot and persisted in the database settings table.
+# To generate manually: openssl rand -hex 32
+JWT_SECRET=
 
 # JWT access token lifetime (default: 24h)
 # Supported units: h (hours), m (minutes), s (seconds)
@@ -87,9 +95,13 @@ JWT_EXPIRATION=24h
 # Refresh token lifetime (default: 168h = 7 days)
 REFRESH_TOKEN_EXPIRATION=168h
 
-# Default admin credentials (created on first startup)
+# Default admin credentials (created on first startup if no user exists).
+# - ADMIN_USER: username for initial account (default: admin).
+# - ADMIN_PASSWORD: if left empty, a secure random 16-character password is
+#   generated at first boot and printed in `docker compose logs server`. You will
+#   be prompted to change it upon first login.
 ADMIN_USER=admin
-ADMIN_PASSWORD=your-admin-password
+ADMIN_PASSWORD=
 
 # ----------------------------------------
 # Rate Limiting
@@ -101,6 +113,11 @@ RATE_LIMIT_RPS=100
 # Maximum burst size per IP (default: 200)
 RATE_LIMIT_BURST=200
 
+# Same, for the /api/agent/* routes. Agents report on a fixed interval and
+# must not be throttled like a browser.
+AGENT_RATE_LIMIT_RPS=20
+AGENT_RATE_LIMIT_BURST=40
+
 # ----------------------------------------
 # GitHub Release Tracking (optional)
 # ----------------------------------------
@@ -123,10 +140,14 @@ DOCKER_IMAGE_POLL_INTERVAL=6h
 # Alerts & Notifications (optional)
 # ----------------------------------------
 
-# Generic webhook URL for alert notifications (Discord, Slack, ntfy, custom...)
-# Leave empty to disable webhook alerts.
-# ntfy example:  https://ntfy.sh/your-topic
-# Discord example: https://discord.com/api/webhooks/...
+# ntfy server base URL. Alert rules using the "ntfy" channel take the scheme
+# and host from here; each rule can override the topic.
+# Example: https://ntfy.sh/your-topic
+#
+# This URL is ALSO the target of the deprecated "notify" channel, which POSTs
+# raw JSON to it. That payload matches no third-party schema in particular —
+# it will not render correctly as a Discord or Slack webhook. A real
+# Slack/Teams/Discord channel is ROADMAP.md item #6, not yet implemented.
 NOTIFY_URL=
 
 # SMTP configuration for email alerts
@@ -139,13 +160,26 @@ SMTP_FROM=serversupervisor@yourdomain.com
 SMTP_TO=admin@yourdomain.com
 SMTP_TLS=true
 
+# ntfy auth token, for a protected topic. Leave empty for a public topic.
+NTFY_AUTH_TOKEN=
+
 # ----------------------------------------
 # Metrics
 # ----------------------------------------
 
 # How many days to keep raw metrics (default: 30)
 METRICS_RETENTION_DAYS=30
 
+# How many days to keep audit log rows (default: 90). Can be refined per
+# category from Settings only (audit_retention_days_by_category) — a
+# per-category map doesn't fit a flat KEY=value env var.
+AUDIT_RETENTION_DAYS=90
+
+# How many days to keep web-log requests (default: 30) and network flows
+# (default: 14). Both tables grow fast on a busy reverse proxy.
+WEB_LOGS_RETENTION_DAYS=30
+NETWORK_FLOWS_RETENTION_DAYS=14
+
 # ----------------------------------------
 # Backups (docker-compose "postgres-backup" service)
 # ----------------------------------------
@@ -167,10 +201,12 @@ BACKUP_KEEP_MONTHS=6
 # TLS/Security
 # ----------------------------------------
 
-# Enable TLS for the server (false if behind reverse proxy with TLS termination)
+# NOTE: this does NOT make the server serve HTTPS — it only listens over
+# plain HTTP and is meant to sit behind a TLS-terminating reverse proxy.
+# TLS_ENABLED only forces the `Secure` flag on session cookies, so set it to
+# true whenever the app is reached over https://, even (especially) when the
+# proxy is the one terminating TLS.
 TLS_ENABLED=false
-# TLS_CERT_FILE=/etc/ssl/certs/server.pem
-# TLS_KEY_FILE=/etc/ssl/private/server.key
 
 # Extra allowed WebSocket origins (comma-separated)
 # Use when the app is behind a reverse proxy with a different domain
@@ -179,6 +215,35 @@ TLS_ENABLED=false
 #   ALLOWED_ORIGINS=https://supervisor.yourdomain.com,https://backup.yourdomain.com
 ALLOWED_ORIGINS=
 
+# WebAuthn (passkeys / security keys). Both are derived from BASE_URL and
+# ALLOWED_ORIGINS when left empty — only set them if the frontend genuinely
+# isn't served from the API's own origin.
+# WEBAUTHN_RP_ID=supervisor.yourdomain.com
+# WEBAUTHN_RP_ORIGINS=https://supervisor.yourdomain.com
+
+# ----------------------------------------
+# Web-log threat scoring (optional)
+# ----------------------------------------
+
+# The threat score of an IP in the Traffic/Threats views is a weighted sum of
+# signals. Defaults are calibrated for ordinary traffic — only touch these if
+# the scoring is too noisy or too lax on yours. Full table in the README.
+# THREAT_THRESHOLD_MEDIUM=15
+# THREAT_THRESHOLD_HIGH=50
+# THREAT_THRESHOLD_CRITICAL=150
+# THREAT_WEIGHT_HITS=2
+# THREAT_WEIGHT_BREADTH=3
+# THREAT_WEIGHT_STATUS_404=2
+# THREAT_WEIGHT_STATUS_4XX=1.5
+# THREAT_WEIGHT_STATUS_5XX=3
+# THREAT_WEIGHT_STATUS_3XX=1
+# THREAT_WEIGHT_STATUS_2XX=0.1
+# THREAT_WEIGHT_ADMIN_PANEL=3
+# THREAT_WEIGHT_WORDPRESS=2
+# THREAT_WEIGHT_PATH_TRAVERSAL=5
+# THREAT_WEIGHT_SUSPICIOUS_METHOD=2
+# THREAT_WEIGHT_KNOWN_SCANNER=4
+
 # WebAuthn (passkeys / security keys, an additional MFA factor alongside TOTP).
 # By default the Relying Party ID/origins are derived from BASE_URL/ALLOWED_ORIGINS
 # above, which is correct for the vast majority of deployments (frontend served

.github/dependabot.yml

@@ -4,6 +4,7 @@ updates:
   # ── Actions GitHub ────────────────────────────────────────
   - package-ecosystem: github-actions
     directory: /
+    target-branch: dev
     schedule:
       interval: weekly
       day: monday
@@ -13,7 +14,7 @@ updates:
       prefix: "ci"
     labels:
       - dependencies
-      - github-actions
+      - ci
     groups:
       github-actions:
         patterns:
@@ -22,6 +23,7 @@ updates:
   # ── Go - Serveur ──────────────────────────────────────────
   - package-ecosystem: gomod
     directory: /server
+    target-branch: dev
     schedule:
       interval: weekly
       day: monday
@@ -31,7 +33,6 @@ updates:
       prefix: "chore(server)"
     labels:
       - dependencies
-      - go
       - server
     # Grouper les mises à jour mineures/patch ensemble
     groups:
@@ -49,6 +50,7 @@ updates:
   # ── Go - Agent ────────────────────────────────────────────
   - package-ecosystem: gomod
     directory: /agent
+    target-branch: dev
     schedule:
       interval: weekly
       day: monday
@@ -58,7 +60,6 @@ updates:
       prefix: "chore(agent)"
     labels:
       - dependencies
-      - go
       - agent
     groups:
       agent-minor-patch:
@@ -73,6 +74,7 @@ updates:
   # ── npm - Frontend ────────────────────────────────────────
   - package-ecosystem: npm
     directory: /frontend
+    target-branch: dev
     schedule:
       interval: weekly
       day: tuesday    # décalé pour éviter trop de PRs le même jour
@@ -82,7 +84,6 @@ updates:
       prefix: "chore(frontend)"
     labels:
       - dependencies
-      - javascript
       - frontend
     # Grouper toutes les devDependencies ensemble
     groups:
@@ -111,6 +112,7 @@ updates:
   # ── Docker - images de base ───────────────────────────────────
   - package-ecosystem: docker
     directory: /server
+    target-branch: dev
     schedule:
       interval: weekly
       day: wednesday

.github/labeler.yml

@@ -32,7 +32,7 @@ documentation:
   - changed-files:
     - any-glob-to-any-file:
       - '*.md'
-      - 'docs/**'
+      - 'wiki/**'
 
 database:
   - changed-files:

.github/workflows/README.md

@@ -40,20 +40,32 @@ lint bloquant (`agent/.golangci.yml`).
 ### CI Frontend (`ci-frontend.yml`) — push/PR sur `frontend/**`
 
 - Job `quality` : `npm ci` → lint → typecheck → **tests unitaires/composants
-  (`npm run test`, Vitest)** → build de production
-- Les tests navigateur (`npm run test:browser`, Playwright/Chromium, rendu
-  Chart.js / D3) **ne sont pas exécutés en CI** pour l'instant : bug amont de
-  l'optimiseur de deps Vite 8 (rolldown) en mode browser Vitest 4 (voir
-  `vitest.browser.config.ts`). À lancer en local ; rajouter un job
-  `browser-tests` une fois le correctif amont disponible.
+  (`npm run test`, Vitest, happy-dom)** → build de production
+- Job `browser-tests` : `npm ci` → installation de Playwright/Chromium →
+  **tests navigateur réels (`npm run test:browser`)**, pour tout ce qui
+  dépend d'un rendu effectif (ApexCharts SVG, carte du monde D3) que
+  happy-dom ne peut pas exécuter.
 
-### Security (`security.yml`) — lundi 6h UTC + push sur les manifests + manuel
+### Security (`security.yml`) — lundi 6h UTC + push/PR sur les manifests + manuel
+
+Scanners de dépendances/image — ne se déclenchent que quand un manifest
+(`go.mod`/`go.sum`/`package.json`/`package-lock.json`/`Dockerfile`) change,
+en push sur `main` **et** sur PR (pour bloquer une dépendance vulnérable
+avant le merge, pas après).
 
 - `govulncheck` (server + agent), version épinglée — **bloquant**
 - `nancy` (CVE des deps Go, server + agent) — **bloquant**
 - `npm audit --audit-level=moderate` (frontend) — **bloquant**
 - Trivy sur l'image server (SARIF → onglet Security) — informatif
-- CodeQL (`go`, `javascript`, `security-extended`)
+
+### CodeQL (`codeql.yml`) — lundi 6h UTC + push/PR sur `server|agent|frontend/**` + manuel
+
+Scan du code source lui-même (`go`, `javascript`, `security-extended`) —
+volontairement dans son **propre** workflow, pas dans `security.yml` :
+contrairement aux scanners de dépendances ci-dessus, CodeQL doit tourner sur
+tout changement de code (injection SQL, XSS, etc.), pas seulement quand un
+manifest bouge — sans pour autant faire tourner govulncheck/nancy/trivy sur
+chaque commit de code.
 
 ### Release (`release.yml`) — tags `vX.Y.Z[-pre]`
 

.github/workflows/ci-frontend.yml

@@ -58,10 +58,29 @@ jobs:
         env:
           NODE_ENV: production
 
-  # NOTE: the real-browser tests (`npm run test:browser`, Playwright/Chromium) are
-  # intentionally NOT run in CI yet. An upstream Vite 8 (rolldown) + Vitest 4
-  # browser-mode dep-optimizer bug breaks them (`init_shared_esm_bundler is not
-  # defined` at import; or a double Vue instance when worked around). See
-  # vitest.browser.config.ts for the full diagnosis. Run them locally with:
-  #   cd frontend && npx playwright install --with-deps chromium && npm run test:browser
-  # Re-add a `browser-tests` job here once the upstream optimizer bug is fixed.
+  browser-tests:
+    name: Real-browser tests
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./frontend
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci --no-audit
+
+      - name: Install Playwright Chromium
+        run: npx playwright install --with-deps chromium
+
+      - name: Real-browser tests
+        run: npm run test:browser