v3.2.92 — Bulk-add endpoints to customers

What's new

• Add: Customer cards are now clickable to expand an inline panel showing all assigned endpoints with online/offline status dots — no need to open Edit just to see assignments
• Add: Bulk-add multiple endpoints to a customer at once using a checkbox list with a "Select all" shortcut (replaces the one-at-a-time dropdown)
• Fix: Replaced browser alert()/confirm() dialogs in the Customers page with inline modal confirmations

Closes #8

v3.2.91 — Endpoints list fix (NFS/permissions)

What's new

• Fix: Endpoints page now falls back to the UrBackup HTTP API when the SQLite DB is unreadable (fixes fresh installs with NFS-mounted storage where /var/urbackup/backup_server.db permissions differ from the service user)
• Fix: Endpoints page shows a clear error banner with the actual error message and a fix command (sudo chmod 644 /var/urbackup/backup_server.db) instead of silently showing an empty list
• Fix: UrBackup DB connection resets and retries on stale cached connections (handles NFS remount without service restart)

Closes #7

v3.2.90 — Security Hardening + Folder ZIP Download

Security Fixes (all tested)

Fix	Status
Fail-fast on missing APP_SECRET_KEY / JWT_SECRET	✅
CORS lockdown toggle in Settings (dynamic, no restart)	✅
realpath symlink protection in file browser	✅
SQLite write via stdin (injection hardening)	✅
getClientAuthkey now admin-only	✅
Rate limiting: 10 req/min on /api/2fa + /api/auth/change-password	✅ tested (429 confirmed)
Helmet CSP headers	✅
Temp dir 0o777 → 0o750	✅
UrBackup session TTL 30m → 10m	✅
TOTP window 2 → 1	✅
Generic 5xx error messages (no stack leakage)	✅
Graceful DB pool shutdown on SIGTERM	✅
Default admin password: admin123 (logs change warning)	✅
File download size limit: 2 GB max	✅

New: CORS Lockdown Setting

Settings → Client Installer → Security — toggle to restrict API to configured FQDN only. Off by default. Takes effect immediately.

New: Folder ZIP Download

File Browser now shows a .zip button on every folder. Streams the folder contents as a ZIP archive.

New: Redesigned File Browser Calendar

• Two-panel layout: calendar left, backup selector right
• Backup count badges on days (×3 for multiple)
• Incremental vs full backup icons
• Cleaner empty state with guidance

v3.2.89 — Remote Agent Install Command

What's New

Added

• Get Install Command: Remote servers on the Servers page now have a Get Install Command button. It generates a one-time curl command that connects back to St0r via the configured server FQDN over HTTPS (e.g., https://stor.agit8or.net). Copy it, run it on the remote server, and the agent installs and registers automatically — no manual key entry needed.
• Public agent install endpoints (token-protected, no JWT required):
  • GET /api/agent-install/:token — serves dynamic bash installer
  • GET /api/agent-package/:token — streams agent tarball
  • POST /api/agent-register — receives and stores agent API key after install

Also in this release (since v3.2.87)

• Servers page with local + remote server management
• stor-agent daemon for remote servers
• SSH-based auto-install option
• Per-server CPU/memory/disk/network metrics (30s auto-refresh)
• OS updates, St0r updates, UrBackup updates, reboot per server
• Settings: removed broken "Automatic Backup Database Repair" checkbox
• File Browser: calendar date picker replaces flat backup card grid

v3.2.88 — Servers + Remote Agent

What's New in v3.2.88

Servers Page + stor-agent

A new Servers page lets you manage this server and any number of remote Linux servers directly from the St0r UI.

stor-agent

A lightweight management daemon (agent/) that installs on remote servers:

• Runs on port 7420 with API key authentication
• Exposes endpoints for system metrics, OS updates, reboots, St0r updates, and UrBackup updates
• Ships with a systemd service file and an install.sh script
• Auto-generates a unique API key on first run

Agent Installation

Two options:

1. SSH Auto-Install — Add SSH credentials to the server in St0r. Click "Auto-Install via SSH" and St0r handles the rest (copies agent, runs install, captures the API key).
2. Manual Install — Run the curl command on the remote server, then paste the API key into St0r.

Per-Server Cards

Each server shows:

• CPU / Memory / Disk gauge bars (auto-refresh every 30 seconds)
• Uptime, hostname, network throughput
• Check OS Updates — shows count of upgradable apt packages
• Apply OS Updates — runs apt-get upgrade with live log output
• Reboot — with confirmation dialog
• Update St0r / Update UrBackup (remote servers)

---

Bug Fixes

• Settings page: Removed "Automatic Backup Database Repair" checkbox. The autoshutdown key is silently ignored by UrBackup's general_save API — testing confirmed the value never persists. The label was also incorrect (autoshutdown means "shutdown computer after backup", not database repair).
• File Browser: The backup selection section now shows a calendar date picker instead of a flat grid of all backup cards. Days with backups are highlighted with a dot. Clicking a day auto-selects single backups or shows a card picker for multiple.

---

Full changelog: CHANGELOG.md

v3.2.87 — Documentation update

What's New in v3.2.87

Documentation Page Refresh

The in-app Documentation page has been fully updated to reflect all features added since v3.2.0.

Features Overview expanded from 6 generic cards to 8 accurate cards:

• Real-Time Monitoring
• Client Management (with version display and storage limit bars)
• Storage Limits
• Standby Replication
• Security & Access Control
• One-Click Updates
• Advanced Settings
• Modern UI

New documentation sections added:

• Replication — target setup walkthrough, trigger modes (scheduled / after backup / both), alert channels, encrypted credential storage
• Security & Access Control — admin vs read-only roles, TOTP 2FA setup steps, security defaults (HttpOnly JWT, bcrypt, helmet.js, rate limiting, AES-256-GCM)
• Updates — St0r auto-update with automatic rollback, UrBackup server apt upgrade with live log

Existing sections updated:

• Clients: now documents version display under endpoint name and color-coded storage limit progress bars
• Settings: SMTP/email configuration, Pushover notifications, internet client installer
• Quick Reference: default password corrected to admin123, UrBackup internet port 55415 added

Also includes (from v3.2.83–86, released earlier today)

• Fix: SMTP server and SSL/TLS checkbox now persist correctly in Settings → Email & Alerts
• Add: UrBackup server update card on About page (installed vs latest, one-click apt upgrade)
• Add: UrBackup client software version shown under each endpoint name on the Clients page
• Remove: UrBackup Client Versions card removed from About page (info moved to Clients page)
• Add: README, CHANGELOG, and About page key features updated

---

Full changelog: CHANGELOG.md

v3.2.86

Remove UrBackup Client Versions card from About page. Client versions are now shown on the Clients page (/clients) under each endpoint name.

v3.2.85

New Feature

UrBackup client version is now displayed under each endpoint's name on the Clients page (/clients). Version is shown in small monospace text and comes directly from the UrBackup status API — only visible for clients that have reported their version.

v3.2.84

New Features

UrBackup Server Updates (About page)

• Shows installed UrBackup server version vs latest available on GitHub
• One-click update via apt (apt-get install --only-upgrade urbackup-server) with live terminal log output
• Confirmation flow before updating; orange highlight when update is available
• Restarts urbackupsrv service automatically after upgrade

UrBackup Client Versions (About page)

• New table showing all connected clients with their reported client software version, OS, and online/offline status
• Versions are reported by the clients themselves via the UrBackup status API
• Refresh button to re-fetch current state

v3.2.83

Bug Fixes

• Fix: SMTP Server and SSL/TLS checkbox not persisting in Settings → Email & Alerts

  The server settings GET response was merging settings in the wrong priority order — the direct SQLite read (which can contain stale empty-string default rows) was overwriting values saved via the UrBackup API. SMTP Server, Use SSL/TLS, and any other email fields that UrBackup stores via its general_save API will now load correctly after being saved.