Critical fixes:
- Add [:safe] option to binary_to_term to prevent RCE attacks
- Implement whitelist validation for String.to_atom conversions
- Add input validation before String.to_existing_atom usage
Changes:
- MIB compiler and cache: Use safe binary deserialization
- SNMP contexts: Whitelist protocol, device type, and source atoms
- API controllers: Validate error message keys before atom conversion
- Reduce function nesting to comply with Credo standards
All 6,145 tests passing with zero Credo issues.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Replace Docker-based builds with Nix flakes for reproducible builds.
Changes:
- Use nixos/nix:latest image with `nix` tag requirement
- Build Docker image with `nix build .#dockerImage`
- Add optional Cachix integration for binary caching
- Load image with `docker load < result`
- Keep existing deploy stage unchanged
Benefits:
- Reproducible builds across all environments
- Binary caching via Cachix (faster subsequent builds)
- All dependencies pinned in flake.lock
- Image size similar to Docker builds (~507 MB compressed)
Requirements:
- GitLab Runner with Nix installed and `nix` tag
- Docker socket mounted for loading/pushing images
- Optional: CACHIX_AUTH_TOKEN for binary caching
See docs/gitlab-runner-nix-setup.md for runner setup instructions.
The old Docker-based config is available in git history if rollback needed.
Nix build fixes:
- Override beamPackages.elixir to use 1.19.5 instead of default 1.18.4
- Add explicit buildPhase to compile dependencies before application
- Remove postInstall phase (Mix automatically includes priv/ in release)
- Set HEX_OFFLINE=false to allow dependency fetching in Nix sandbox
Docker image build now succeeds (~507 MB compressed).
Also remove .claude/settings.local.json from git tracking (keep local).
File remains in working directory but is now properly ignored.
Add git and cacert to nativeBuildInputs and set SSL certificate
environment variables. This fixes the SSL certificate verification
error when fetching heroicons from GitHub.
Override configurePhase to explicitly run 'mix deps.get' before
compilation. This ensures hex dependencies (like ecto) are available
when vendored path dependencies (oban_met) are compiled.
The postUnpack step was deleting deps directories which may have
been removing vendored dependencies. cleanSourceWith already handles
source filtering, so postUnpack is redundant and potentially harmful.
Remove buggy conditional that was always true. Now the filter
correctly excludes only build artifacts while including all
source files including vendor directory.
Replace sourceFilesBySuffices with cleanSourceWith to ensure
vendor directory and all dependencies are properly included.
This fixes the oban_met compilation error.
Find the erts include path dynamically instead of relying on
erlang.version which may not match the actual erts version.
This fixes 'erl_nif.h' file not found error.
Instead of hardcoding the version in the path, find the release
directory dynamically. This fixes the 'undefined variable version'
error during Docker image build.
Ignore local Nix development directories and files:
- .nix-mix/ - Mix cache
- .nix-hex/ - Hex cache
- .nix-postgres/ - PostgreSQL data directory
- .nix-redis/ - Redis data directory
- .nix-services-started - Service flag file
These are created by the Nix dev shell and should not be
committed to the repository.
- Check if PostgreSQL/Redis already running before starting
- Install Hex and Rebar3 non-interactively on shell entry
- Only run migrations if deps directory exists
- Better error messages with log file locations
This fixes issues when:
- Port 5432 is already in use (existing PostgreSQL)
- Port 6379 is already in use (existing Redis)
- Mix prompts for Hex installation interactively
Add Nix overlay to pin specific versions matching .tool-versions:
- Erlang: OTP 28.3 (via erlang_28)
- Elixir: 1.19.5-otp-28 (via beam.packages.erlang_28.elixir_1_19)
This ensures the Nix build environment matches the asdf-based
development setup exactly, providing consistency across all
development and build environments.
Use stdenv.isLinux instead of lib.isLinux to properly check if
inotify-tools should be included. This fixes the undefined variable
error when evaluating the flake on macOS.
- Make inotify-tools Linux-only (not available on Darwin)
- Replace nixfmt-rfc-style with nixfmt (deprecated warning)
- Add flake.lock for reproducible builds
Changes:
- nix/shell.nix: Conditionally include inotify-tools only on Linux
- flake.nix: Use pkgs.nixfmt instead of pkgs.nixfmt-rfc-style
- flake.lock: Lock dependencies for reproducibility
- Move last_discovery_at update to after successful processing so failed
discoveries are retried on the next poll cycle instead of being blocked
for 24 hours
- Add disabled assignment check to agent polling target query so devices
with enabled=false assignments don't leak through site/org cascade
- Wrap spawned polling data processing in try/rescue so crashes are logged
instead of silently disappearing
Comprehensive documentation covering architecture, usage, technical
details, and future enhancements for the job monitoring dashboard.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Added integration tests for real-time updates and metrics display.
Also fixed dialyzer warnings in worker event broadcasting by removing
unreachable error handling branches.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add Job Monitoring card to admin dashboard with:
- Hero icon for visual identification
- Brief description of monitoring capabilities
- Link to /admin/monitoring dashboard
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add LiveView for real-time job monitoring dashboard:
- Subscribe to job:lifecycle PubSub topic for live updates
- Display health metrics (completed, failed, avg duration, active jobs)
- Show active operations with real-time updates
- Display problems section (stuck/failed job counts)
- Add router entry under /admin/monitoring
Tests verify PubSub subscription and basic rendering.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add Events.broadcast_job_event calls to track job lifecycle:
- :started when job begins executing
- :completed when job finishes (including :discard status)
- :failed when job crashes with error
- Track duration in seconds for all job executions
Wrap main logic in try/rescue to ensure events broadcast even on crash.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add Events.broadcast_job_event calls to track job lifecycle:
- :started when job begins executing
- :completed/:failed when job finishes
- Track duration in seconds for all job executions
Broadcast events enable real-time monitoring of polling operations.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Create JobMonitoring.Metrics module with calculate_all/0 to provide
comprehensive metrics including execution counts, success rates,
queue depths, and average execution times.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Add list_failed_jobs/0 to return retryable and cancelled jobs
and list_recent_completions/1 to return completed, cancelled,
or discarded jobs with configurable limit.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
