From e30714f2d60696ded55587b7a3de03c422cc4009 Mon Sep 17 00:00:00 2001 From: Luxit Date: Mon, 26 Oct 2026 08:32:24 +0100 Subject: [PATCH] Sync the self-hosting stack --- CHANGELOG.md | 55 +++++++++++++++++++++++++++++++++++++++ kubernetes/02-config.yaml | 7 ++--- 2 files changed, 59 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8c5c934..c83f02e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,61 @@ one of them changed. An entry says which artefact and which version, so `web 0.1 Every version published to a channel appears here. Nothing is written from memory afterwards: a build cannot be published without its entry. +## 2026-10-26 — The script library `api 2.2.0` `web 2.2.0` + +**Scripts arrive in the RMM.** A new Scripts area, between Agents and Vault, holds the +organization's library of PowerShell 5.1, PowerShell 7, cmd, bash and sh scripts, and the history +of its runs. The Admin Center gains a platform library, under Scripts: what it publishes appears +read-only in every organization's library, where it runs like the organization's own scripts or is +copied into it to be adapted. Only a super-admin publishes a platform script. + +**A script has versions.** Each change is saved as a draft, and only a published version runs as a +library script; a draft runs only as a test, by someone allowed to run ad-hoc commands. Earlier +versions stay readable, can be compared and restored. Parameters reach the script as environment +variables under their own names — `$env:Target` in PowerShell, `"$Target"` in a shell, `!Target!` +in cmd — and never inside its code. A parameter can take a secret from the vault: it is handed to +the script for that run only, and masked in the output. + +**Run a script, or a one-off command, on many machines at once.** From Scripts, or from Assets — tick +machines and use the bar, or a machine's menu. A one-off command needs a stronger right than a +library script. The dialog shows which machines are ready, which are offline and will be waited for +(a day by default), and which are excluded and why, and asks you to type the number of machines +above a threshold. The run's page then follows every machine live: its status, its exit code and its +output as it is written. From there you can cancel some machines or all of them, re-run the failures, +the selection or everything, and export the results as CSV. The Runs tab lists past runs, yours or +everyone's, and a machine's drawer shows its own. A notice arrives in the bell when your run fails, +when a run of yours longer than a minute succeeds, or when someone else cancels it. + +**Runs survive a restart.** A run keeps going through an api restart or update, or a machine that +loses its connection: the job runs on the machine, and its result is collected when the machine is +reachable again. Scripts run as SYSTEM on Windows and root on Linux and macOS; running as the +signed-in user comes in a later version. + +**New rights decide who does what.** Roles gain a Scripts domain: *Run library scripts*, *Run ad-hoc +commands* (which requires the first) and *Manage the script library*. The two run rights can be +narrowed to folders of machines like the other machine rights. A fresh install gives all three to the +Owner and Administrator roles, and *Run library scripts* to the Operator role. An existing platform +gives them to the Owner only, and leaves its other roles as they are: add the rights in the role +editor. Platform roles gain the Scripts page of the Admin Center. + +**A platform switch stops every script.** Under Admin Center → Settings → Machines, *Scripts on this +platform* turned off refuses every new run and stops the ones running, after a confirmation. + +**Each organization sets its script policy.** In its Policies, the Scripts section sets how long +outputs are kept — 90 days by default, or for ever — and from how many machines a run asks for the +typed confirmation, 10 by default. Outputs are encrypted with the vault's key, and each organization +keeps at most 1 GB of them: past it, the oldest go first. Every run, cancel, output read and export is +recorded in the audit log. + +**Machines need agent 0.53.0**, published on the stable channel. A machine with an older agent is +excluded from a run, and the run dialog offers to update its agent. The limits on script jobs +running at once, `SCRIPT_MAX_RUNNING_JOBS` (200) and `SCRIPT_MAX_RUNNING_JOBS_PER_ORG` (50), now +apply. A second person's approval, schedules and the assistant's use of the library come in later +versions. + +Update the web image first, or both images at once. The database does not change. +`SCRIPTS_PREVIEW` can stay at `false`: it now hides only the library's next, unfinished parts. + ## 2026-10-26 — The agent can run the script library's jobs `agent 0.53.0` **The agent learns to run the script library's jobs.** A job survives an agent restart or a lost diff --git a/kubernetes/02-config.yaml b/kubernetes/02-config.yaml index 484d482..f5c2417 100644 --- a/kubernetes/02-config.yaml +++ b/kubernetes/02-config.yaml @@ -70,9 +70,10 @@ data: # first decides whether a restart leaves a closed transcript or a half-written one. RUN_SHUTDOWN_GRACE_SEC: "25" - # The script library is being built release by release, and every surface it adds stays hidden and - # every route it adds answers 404 until its milestone ships. "true" shows the unfinished area; it is - # for the team's own dev stack, never a customer platform. + # The script library ships with api and web 2.2.0: scripts, runs and their results need nothing here. + # Its next parts (approval, schedules, assistant tools) are built release by release and stay hidden, + # their routes answering 404, until they ship. "true" shows them; it is for the team's own dev stack, + # never a customer platform. SCRIPTS_PREVIEW: "false" # How many script jobs may run on machines at once, platform-wide and per organization. "0" stops # dispatching new ones; it cancels nothing.