feat(new-device): mint mTLS enrollment bundle, drop legacy .vagent UI #51

Merged

Claude-Run merged 1 commit from feat/vapp-38-mtls-enrollment-bundle-ui into main

2026-06-28 22:38:15 +02:00

Claude-Run commented

2026-06-28 22:37:42 +02:00

Member

Rewrite the "+ New Device" dialog onto the agent's mTLS enrollment path (VA-67/VS-69). The dialog now mints a single-use enrollment bundle through a new session-forwarding mint_enroll_bundle server fn, which proxies vervain-server's session-gated POST /api/v1/enroll-tokens exactly like the old group-config proxy did, and renders the Linux x86_64 Option 2 one-liner (download the agent binary, then curl the one-time /api/v1/enroll-bundle?token= straight into vervain-agent install --system --from -), a bootstrap.json download with the install --from bootstrap.json snippet for the out-of-band scp path, the bundle expiry, and a note that the agent mTLS domain port differs from the HTTPS download host.

The device-facing URLs target the browser/HTTPS listener at the agent domain's host on the standard HTTPS port (the mTLS port the domain carries is dialed directly by the agent, VS-69); the binary download keeps its scoped install token (VS-57) so the unattended device curl is authorized.

Remove the legacy enrollment surface: the get_group_install proxy, the /groupsettings.ashx call, the GroupServer/.vagent/config seal parsing helpers and their tests, and the GroupInstall model. A new components::enroll_guard test embeds the touched files and fails the build if any of those symbols reappear. list_groups is intentionally kept: device groups remain a first-class feature (the groups page, the device-detail move control, and user group assignment all use it); only the enrollment dialog stopped selecting a group.

#VAPP-38

Rewrite the "+ New Device" dialog onto the agent's mTLS enrollment path (VA-67/VS-69). The dialog now mints a single-use enrollment bundle through a new session-forwarding `mint_enroll_bundle` server fn, which proxies vervain-server's session-gated `POST /api/v1/enroll-tokens` exactly like the old group-config proxy did, and renders the Linux x86_64 Option 2 one-liner (download the agent binary, then curl the one-time `/api/v1/enroll-bundle?token=` straight into `vervain-agent install --system --from -`), a `bootstrap.json` download with the `install --from bootstrap.json` snippet for the out-of-band scp path, the bundle expiry, and a note that the agent mTLS `domain` port differs from the HTTPS download host. The device-facing URLs target the browser/HTTPS listener at the agent `domain`'s host on the standard HTTPS port (the mTLS port the `domain` carries is dialed directly by the agent, VS-69); the binary download keeps its scoped install token (VS-57) so the unattended device `curl` is authorized. Remove the legacy enrollment surface: the `get_group_install` proxy, the `/groupsettings.ashx` call, the `GroupServer`/`.vagent`/`config seal` parsing helpers and their tests, and the `GroupInstall` model. A new `components::enroll_guard` test embeds the touched files and fails the build if any of those symbols reappear. `list_groups` is intentionally kept: device groups remain a first-class feature (the groups page, the device-detail move control, and user group assignment all use it); only the enrollment dialog stopped selecting a group. #VAPP-38

Claude-Run added 1 commit

2026-06-28 22:37:42 +02:00

feat(new-device): mint mTLS enrollment bundle, drop legacy .vagent UI

Check / fmt + clippy + build + tests (pull_request) Successful in 27s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

4abbbacc58

Rewrite the "+ New Device" dialog onto the agent's mTLS enrollment path (VA-67/VS-69). The dialog now mints a single-use enrollment bundle through a new session-forwarding `mint_enroll_bundle` server fn, which proxies vervain-server's session-gated `POST /api/v1/enroll-tokens` exactly like the old group-config proxy did, and renders the Linux x86_64 Option 2 one-liner (download the agent binary, then curl the one-time `/api/v1/enroll-bundle?token=` straight into `vervain-agent install --system --from -`), a `bootstrap.json` download with the `install --from bootstrap.json` snippet for the out-of-band scp path, the bundle expiry, and a note that the agent mTLS `domain` port differs from the HTTPS download host.

The device-facing URLs target the browser/HTTPS listener at the agent `domain`'s host on the standard HTTPS port (the mTLS port the `domain` carries is dialed directly by the agent, VS-69); the binary download keeps its scoped install token (VS-57) so the unattended device `curl` is authorized.

Remove the legacy enrollment surface: the `get_group_install` proxy, the `/groupsettings.ashx` call, the `GroupServer`/`.vagent`/`config seal` parsing helpers and their tests, and the `GroupInstall` model. A new `components::enroll_guard` test embeds the touched files and fails the build if any of those symbols reappear. `list_groups` is intentionally kept: device groups remain a first-class feature (the groups page, the device-detail move control, and user group assignment all use it); only the enrollment dialog stopped selecting a group.

#VAPP-38