Pulse v4.25.0

What's Changed

New

• Expose scheduler staleness scores, circuit breaker state, and poll timing metrics via /api/monitoring/scheduler/health and the Monitoring UI.
• Harden pulse-sensor-proxy installs with audit logging, automated cleanup, AppArmor/Seccomp profiles, and updated install scripts (new deployments only).
• Ship an official Helm chart (pulse-4.25.0-helm.tgz / oci://ghcr.io/rcourtman/pulse-chart:v4.25.0) with agent manifests, secret management, and PVC defaults.
• Centralise structured logging controls so log level/format/rotation can be adjusted at runtime from Settings → System → Logging or LOG_* environment variables.
• Provide API token export/import flows with versioned bundles and transactional rollback.

Improvements

• Faster, more reliable Proxmox discovery spanning VE, PBS, and PMG clusters with better environment detection.
• Alert configuration UI clean-up, better toggle behaviour, and refined activation messaging.
• Expanded diagnostics tooling, including new monitoring documentation and temperature security guidance.
• Updated install, Kubernetes, and FAQ docs to cover the new metrics, logging options, and hardened proxy workflows.

Bug Fixes

• Resolve caching issues during first-run security setup and container discovery defaults.
• Fix rate-limit header handling and request ID propagation across the API and WebSocket layers.
• Address alert system crashes, memory leaks, and partial configuration updates.

Installation

Install / Upgrade (systemd / LXC / Proxmox VE):

curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | bash

Binary (amd64 example):

curl -LO https://github.com/rcourtman/Pulse/releases/download/v4.25.0/pulse-v4.25.0-linux-amd64.tar.gz
sudo systemctl stop pulse
sudo tar -xzf pulse-v4.25.0-linux-amd64.tar.gz -C /usr/local/bin pulse
sudo systemctl start pulse

Docker:

docker pull rcourtman/pulse:v4.25.0
docker stop pulse && docker rm pulse
docker run -d --name pulse \
  --restart unless-stopped \
  -p 7655:7655 -p 7656:7656 \
  -v /opt/pulse/data:/data \
  rcourtman/pulse:v4.25.0

Helm:

helm upgrade --install pulse oci://ghcr.io/rcourtman/pulse-chart \
  --version 4.25.0 \
  --namespace pulse \
  --create-namespace

Docker images are published as rcourtman/pulse:v4.25.0, rcourtman/pulse:4.25, rcourtman/pulse:4, and rcourtman/pulse:latest.

Downloads

• Multi-arch Linux tarballs (amd64, arm64, armv7)
• Standalone sensor proxy binaries
• Helm chart archive (pulse-4.25.0-helm.tgz)
• SHA256 checksums (checksums.txt)

v4.24.0-rc.3

Note for RC versions

This is a pre-release version for testing. Consider backing up your Pulse configuration before updating (snapshot for ProxmoxVE, volume backup for Docker, or copy /etc/pulse/ for manual installs).

What's Changed

New Features

• Multi-token API authentication system - Generate, manage, and revoke individual API tokens for each agent or automation. Each token can be labeled and tracked independently, making it easy to rotate credentials for compromised hosts without affecting others.
• Automated sensor proxy setup - The pulse-sensor-proxy installer now automatically configures container bind mounts and SSH authentication, streamlining temperature monitoring deployment.
• Alert acknowledgement with readable IDs - Alert IDs now use printable characters for easier acknowledgement via API and webhooks.

Improvements

• Enhanced Proxmox VE 8.4 memory reporting - Fixed cache-aware memory calculation for accurate available memory on PVE 8.4+ nodes.
• Smarter disk aggregation - Read-only guest filesystems are now ignored in disk space calculations, preventing false alerts.
• Docker agent installer refinements - Improved path handling and fallback logic for legacy Docker layouts.
• Temperature proxy diagnostics - Proxy status now included in diagnostics output for easier troubleshooting.
• Documentation updates - Added guides for proxy upgrades, guest agent permissions, Home Assistant battery automation, and Pi-hole sync operations.

Bug Fixes

• Token timestamp display - Fixed API token creation and last-used timestamps to display correctly in the UI.
• Docker agent download - Added fallback agent download logic for legacy Docker setups.

Installation

Testing v4.24.0-rc.3:

# Install script
curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | bash -s -- --version v4.24.0-rc.3

# Docker
docker pull rcourtman/pulse:v4.24.0-rc.3
docker run -d --name pulse -p 7655:7655 -v pulse-data:/etc/pulse rcourtman/pulse:v4.24.0-rc.3

Downloads

Pre-built binaries available below for linux-amd64, linux-arm64, and linux-armv7.

Pulse v4.24.0-rc.2

Pulse v4.24.0-rc.2

What's New

See the v4.24.0-rc.1 changelog for the full list of features in v4.24.0.

In addition to that, rc.2 fixes:

• Setup script menu now uses numbered options [1/2/3] instead of [I/r/c] for better usability (maintains backward compatibility)
• Temperature SSH verification endpoint now requires authentication

Installation

Docker

docker pull rcourtman/pulse:v4.24.0-rc.2

Binary Installation

Download the appropriate tarball for your architecture:

# Linux AMD64
wget https://github.com/rcourtman/Pulse/releases/download/v4.24.0-rc.2/pulse-v4.24.0-rc.2-linux-amd64.tar.gz
tar xzf pulse-v4.24.0-rc.2-linux-amd64.tar.gz

Feedback

This is a release candidate. Please test in your environment and report any issues before the final v4.24.0 release.

v4.24.0-rc.1

Warning

This release has been superseded by v4.24.0-rc.2

rc.1 contains two issues that are fixed in rc.2:

• Setup script menu used confusing [I/r/c] format instead of numbered [1/2/3] options
• Temperature SSH verification endpoint was missing authentication

Please use v4.24.0-rc.2 instead.

---

Note for RC versions

This is a pre-release version for testing. Consider backing up your Pulse configuration before updating (snapshot for ProxmoxVE, volume backup for Docker, or copy /etc/pulse/ for manual installs).

What's Changed

New Feature: Defense-in-Depth Temperature Monitoring

Background:

Temperature monitoring traditionally uses SSH key authentication—the same trusted method used by infrastructure automation tools like Ansible, Terraform, and SaltStack. This works well for native installations where Pulse runs directly on the host OS.

For containerized deployments, this meant storing SSH keys inside the container. While this is functional and widely used across the industry, it doesn't take full advantage of modern container isolation capabilities. We can do better.

The Architecture: pulse-sensor-proxy

v4.24.0 introduces a new proxy architecture that treats containers as untrusted while keeping the same seamless user experience:

1. Host-side proxy service - A minimal Go daemon runs on the Proxmox host with systemd hardening
2. Credentials stay on the host - SSH keys live in /var/lib/pulse-sensor-proxy/ssh/ with strict filesystem permissions (0600)
3. Unix socket communication - Pulse talks to the proxy via socket, authenticated by Linux kernel SO_PEERCRED (UID/PID verification)
4. Defense-in-depth SSH restrictions - Keys use forced commands (command="sensors -j"), no port forwarding, no PTY allocation, IP restrictions
5. Observability built-in - Prometheus metrics endpoint, structured audit logging with correlation IDs, rate limiting per client

What This Means:

If a container is ever compromised (through any software running in it), there are no cluster credentials to extract. The attack stops at the container boundary. Temperature monitoring continues working—Pulse just talks to a local socket.

Architecture Diagram:

┌─────────────────────────────────────────┐
│ LXC/Docker Container                    │
│  ┌────────────────────────────────┐     │
│  │  Pulse Backend                 │     │
│  │  - No SSH keys stored          │     │
│  │  - Talks to proxy via socket   │     │
│  └────────────────────────────────┘     │
└──────────────┬──────────────────────────┘
               │ Unix Socket
               │ (SO_PEERCRED auth)
┌──────────────▼──────────────────────────┐
│ Proxmox Host                            │
│  ┌────────────────────────────────┐     │
│  │  pulse-sensor-proxy service    │     │
│  │  - Manages SSH keys            │     │
│  │  - Systemd hardening           │     │
│  │  - Rate limiting               │     │
│  │  - Audit logging               │     │
│  └────────────────────────────────┘     │
│           │                              │
│           │ SSH (restricted keys)        │
│           ▼                              │
│  ┌────────────────────────────────┐     │
│  │  Cluster Nodes (pve1, pve2...) │     │
│  │  - sensors -j forced command   │     │
│  │  - No port forwarding          │     │
│  │  - IP restrictions optional    │     │
│  └────────────────────────────────┘     │
└─────────────────────────────────────────┘

What's Included:

• New pulse-sensor-proxy binary (multi-arch: amd64, arm64, armv7)
• Automatic installation during Pulse LXC setup
• Migration guide for existing deployments
• Key rotation script with dry-run and rollback support
• Prometheus metrics endpoint for monitoring
• Comprehensive documentation (security hardening, operations, troubleshooting)

For Existing Deployments:

After updating, containerized installations will see a migration banner with a streamlined upgrade path. The process is straightforward and non-disruptive:

# On your Proxmox host
curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/scripts/install-sensor-proxy.sh | \
  bash -s -- --ctid <your-pulse-container-id>

This installs the proxy, migrates SSH keys to the host, and updates the container configuration. Temperature monitoring continues working without interruption.

Documentation:

• Security Hardening Guide: /docs/PULSE_SENSOR_PROXY_HARDENING.md - 960 lines covering systemd security, key rotation, incident response, Prometheus monitoring, and production rollout procedures
• Temperature Monitoring: /docs/TEMPERATURE_MONITORING.md - Updated with proxy architecture details and troubleshooting

Other Improvements

• Multi-architecture Docker agent binaries now included in Docker image (/opt/pulse/bin/pulse-*)
• Enhanced setup script with guided menu for proxy installation/removal
• Automatic SSH key migration during proxy installation
• Legacy deployment detection on health endpoint for smooth transition planning

Installation

Testing v4.24.0-rc.1:

# Install script (ProxmoxVE/LXC/systemd)
curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | bash -s -- --version v4.24.0-rc.1

# Docker
docker pull rcourtman/pulse:v4.24.0-rc.1
docker run -d --name pulse -p 7655:7655 -v pulse-data:/etc/pulse rcourtman/pulse:v4.24.0-rc.1

Testing Focus Areas

This RC introduces a new defense-in-depth architecture for temperature monitoring. Key areas to test:

1. New Installations: Deploy on a fresh LXC container and verify proxy auto-setup works
2. Migrations: Existing containerized installs should see migration banner and upgrade smoothly
3. Key Rotation: Test the rotation script (pulse-sensor-proxy-rotate-keys.sh) with --dry-run and actual rotation
4. Multi-Architecture: Verify Docker deployments work on both x86_64 and ARM Proxmox hosts
5. Failure Modes: Stop the proxy service, observe graceful fallback in Pulse logs
6. Monitoring: Check Prometheus metrics endpoint at http://127.0.0.1:9127/metrics on proxy host

Notes:

• Native (non-containerized) Pulse installations continue using direct SSH (no proxy needed)
• Standalone Proxmox nodes work but only monitor that single node
• Requires passwordless root SSH between cluster nodes (standard for Proxmox clusters)

Please report any issues or feedback on GitHub before this is promoted to stable 4.24.0.

Downloads

Pre-built binaries available below for linux-amd64, linux-arm64, and linux-armv7.

v4.23.0

What's Changed

Bug Fixes

• Attempted to address node configuration API issue where partial updates could lose existing field values
• Potential fix for Docker agent installation on containers using BusyBox wget (Alpine Linux and similar minimal images)
• Improved NVMe temperature detection to prevent false readings

Improvements

• Better dashboard responsiveness with improved temperature display logic
• Enhanced diagnostic data collection for memory usage troubleshooting
• Improved error handling for Docker agent downloads with automatic fallback between wget and curl
• Better sanitization of diagnostic data when reporting issues to GitHub

Installation

Install/Update:

# Install script (ProxmoxVE/LXC/systemd)
curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | bash

# Docker
docker pull rcourtman/pulse:latest
docker run -d --name pulse -p 7655:7655 -v pulse-data:/etc/pulse rcourtman/pulse:latest

Downloads

Pre-built binaries available below for linux-amd64, linux-arm64, and linux-armv7.

v4.22.0

Pulse v4.22.0, shipping after six release candidates, brings the highlights below.

New Features

• Docker Monitoring Deploy the Settings one-liner to stream container health, restart counts, and resource graphs into a dedicated dashboard; one agent can fan out to multiple Pulse instances.
• Proxmox Mail Gateway Integration Track mail throughput, queue depth, and appliance health alongside your PVE and PBS estate.
• Update Experience Preview pending changes in a confirmation modal, then follow an inline progress tracker that records each download and install step while archiving history.
• Scoped API Tokens Generate operation-specific tokens for external tools like the Docker agent, with instant revocation when access needs to be pulled.
• Settings Overhaul Navigate clearer tabs and use the command builder to produce pre-filled agent install commands with URLs and tokens.

Improvements

• GitHub Update Checks Smarter rate limiting prevents noisy errors during busy windows.
• Alert Settings Refreshed layout makes thresholds and escalation rules easier to tune.
• Documentation Added full walkthroughs for Docker monitoring and API token workflows.

Bug Fixes

• Linux Container Metrics Corrected memory usage math for accurate graphs.
• Resilience Hardened reconnect logic for nodes that temporarily drop offline.

Installation

Install/Update:

# Install script (ProxmoxVE/LXC/systemd)
curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | bash

# Docker
docker pull rcourtman/pulse:latest
docker run -d --name pulse -p 7655:7655 -v pulse-data:/etc/pulse rcourtman/pulse:latest

Downloads

Pre-built binaries available below for linux-amd64, linux-arm64, and linux-armv7.

Docker agent included: Each release archive contains both the main Pulse binary and the pulse-docker-agent binary for monitoring Docker hosts.

v4.22.0-rc.6

Note for RC versions

This is a pre-release version for testing. Consider backing up your Pulse configuration before updating (snapshot for ProxmoxVE, volume backup for Docker, or copy /etc/pulse/ for manual installs).

What's Changed

New Features

• Quiet hours improvements with better timezone handling and suppression options

Improvements

• Improved container disk usage tracking for more accurate LXC storage reporting
• Docker agent installer now ships directly in the container image for easier deployment
• Update system now auto-detects release channel (stable/RC) from current version
• Better caching for update checks with per-channel cache management
• Automatic cleanup of failed update temporary directories on startup

Bug Fixes

• Update manager now handles "no releases found" errors more gracefully
• Fixed Docker container permissions for bundled scripts

Development

• Added AGENTS.md documentation for AI assistant collaboration
• Added quiet hours test coverage

Known Issues

• TypeScript type errors in PMG threshold UI (frontend build succeeds but type-check fails)
• WebSocket test failure: TestWebSocketSendsInitialState expects "welcome" but receives "update:progress"

These issues will be addressed in the next RC.

Installation

Testing v4.22.0-rc.6:

# Install script
curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | bash -s -- --version v4.22.0-rc.6

# Docker
docker pull rcourtman/pulse:v4.22.0-rc.6
docker run -d --name pulse -p 7655:7655 -v pulse-data:/etc/pulse rcourtman/pulse:v4.22.0-rc.6

Downloads

Pre-built binaries available below for linux-amd64, linux-arm64, and linux-armv7.

v4.22.0-rc.5

Note for RC versions

This is a pre-release version for testing. Consider backing up your Pulse configuration before updating.

What's Changed

New Features

• New interactive command builder for Docker agent installation with improved token management
• Token validation endpoint for testing API token validity

Bug Fixes

• Fixed authentication bypass vulnerability with URL path normalization (security fix)
• Fixed proxy authentication to properly reject unauthenticated requests
• Fixed update history to use configurable data directory instead of hardcoded path

Installation

Testing v4.22.0-rc.5:

# Install script
curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | bash -s -- --version v4.22.0-rc.5

# Docker
docker pull rcourtman/pulse:v4.22.0-rc.5
docker run -d --name pulse -p 7655:7655 -v pulse-data:/etc/pulse rcourtman/pulse:v4.22.0-rc.5

Downloads

Pre-built binaries available below for linux-amd64, linux-arm64, and linux-armv7.

v4.22.0-rc.4

Note for RC versions

This is a pre-release version for testing. Consider backing up your Pulse configuration before updating.

What's Changed

New Features

• Proxmox Mail Gateway (PMG) Monitoring - Full support for monitoring Proxmox Mail Gateway instances with mail flow statistics, spam/virus detection, quarantine status, and queue monitoring
• In-App Update System - New update UI with update history tracking, progress monitoring, and automated update support for ProxmoxVE deployments
• Docker Agent CI/CD - Automated Docker agent image building via GitHub Actions

Improvements

• Enhanced discovery system with PMG support
• Better update notification handling for RC releases
• Improved mock data generation for PMG instances
• Updated install script with version-specific installation support

Bug Fixes

• Fixed PMG monitoring test coverage with queue endpoint support
• Resolved TypeScript type safety issues in Settings and UpdateBanner components
• Removed unused imports and variables across frontend components
• Fixed version synchronization between VERSION file and Go code

Installation

Testing v4.22.0-rc.4:

# Install script
curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | bash -s -- --version v4.22.0-rc.4

# Docker
docker pull rcourtman/pulse:v4.22.0-rc.4
docker run -d --name pulse -p 7655:7655 -v pulse-data:/etc/pulse rcourtman/pulse:v4.22.0-rc.4

Downloads

Pre-built binaries available below for linux-amd64, linux-arm64, and linux-armv7.

v4.22.0-rc.3

Note for RC versions

This is a pre-release version for testing. Consider backing up your Pulse configuration before updating.

What's Changed

Improvements

• Standard Authorization header support - API now accepts Authorization: Bearer <token> header in addition to X-API-Token, improving compatibility with standard HTTP clients and tools
• Alert delay UI improvements - Alert delay settings are now collapsible, making the alerts page cleaner and easier to navigate
• Disk usage for stopped guests - Dashboard now shows the last reported disk usage for stopped VMs and containers instead of hiding the information
• Shared storage display - Fixed rendering of shared storage across multiple nodes in the storage view
• Alerts page layout - Fixed sidebar width constraints to prevent layout overflow on smaller screens
• Docker agent access - Docker agent installation script and binary downloads no longer require authentication

Bug Fixes

• Fixed alerts page sidebar being squished on certain screen sizes
• Fixed alert delay input field width and centering

Installation

Testing v4.22.0-rc.3:

# Install script
curl -fsSL https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh | bash -s -- --version v4.22.0-rc.3

# Docker
docker pull rcourtman/pulse:v4.22.0-rc.3
docker run -d --name pulse -p 7655:7655 -v pulse-data:/etc/pulse rcourtman/pulse:v4.22.0-rc.3

Downloads

Pre-built binaries available below for linux-amd64, linux-arm64, and linux-armv7.