Melvin Strobl c604cfdf3b Device security and robustness (openpanel C0): check code, pnc, lenient report
- POST /devices/pair answers a 2-character `check`, listed by /devices/pending
  and shown beside each waiting entry; five codes a minute per address, and at
  50 waiting the oldest gives way instead of a 429
- portal-minted device tokens are asked for with the device's nonce (`pnc`) and
  held against it, so unpair and delete revoke them; one without `pnc` stands
  only while the nonce is 0
- a device credential acts as the device (`device_principal`), not as the
  approving superuser, so deleting that account unpairs nothing
- the report is validated port by port: unknown enum values read as `unknown`,
  unreadable ports and sections are left out and logged, `config` may name an
  entry of `config_schemas`; 422 only for no schema 1 or no object
- devices.json is parsed once per change (cached by stat), delete drops the
  report and keeps the nonce, a busy recheck runs in the background
- scope and io only from enabled flows (start/stop tells the devices), a port
  bound twice gives one io row
- the Devices tab's saves cancel and hold back device refetches until settled
2026-10-16 19:26:05 +02:00
2026-02-03 21:43:09 +01:00
2026-10-15 17:18:12 +02:00

Fluksio App

Fluksio is a node-based automation software that brings trust and reliability to your flow. It just works and looks good.

The core of Fluksio: a node-based, test-driven automation software built to scale. This repo holds the FastAPI backend, the flow engine, and the dashboard SPA, built into one image that serves all three on one port.

Layout

backend/        FastAPI + SQLModel + Alembic + SQLite
  fluksio/flow/ the flow engine (nodes, pipeline, state backends, controller)
  fluksio/cli.py  `fluksio serve` / `enroll` / `worker`
worker/         the `fluksio-worker` distribution: the agent and the node runner
frontend/       React 19 + TanStack Router + Tailwind 4 + shadcn/ui
docs/           the public documentation site (zensical), served on docs.${DOMAIN}
compose.yml     the single container, as the getting-started guide runs it
docker/         the operator stack: compose.yml → compose.dev.yml → compose.local.yml (+ compose.traefik.yml)
scripts/        generate-client.sh, test.sh

Install without Docker

Get started quickly by running

pip install fluksio
fluksio serve

Then, head over to fluksio.com, sign up and add a new instance. Using the code provided, run

fluksio enroll <code>

and you're ready to rock.

Fluksio is distributed at it's heart. A machine that should only run nodes for an engine elsewhere installs less:

pip install fluksio-worker
FLUKSIO_WORKER_TOKEN=… fluksio-worker --url wss://api.fluksio.com/api/v1/workers/attach --labels gpu

Getting started

Needs Docker with Compose v2, on x86-64 or arm64 such as a Raspberry Pi 4 or 5.

docker compose up -d           # http://localhost:8080
docker compose logs fluksio    # the admin password, printed once

Optional features (MQTT, InfluxDB, mail, …) are build-time extras; see EXTRAS in compose.yml.

For development, with hot reload behind Traefik on port 80 (also needs make and openssl):

make init          # once: .env with generated secrets, `proxy` network, prints the admin login
make dev-local     # full stack at http://app.localhost
make down          # stop it

Without Docker:

make install       # uv sync + bun install
make dev-utils     # proxy and mailcatcher only
make dev-backend   # FastAPI on :8000, hot reload
make dev-frontend  # Vite on :5173
make test           # pytest + Playwright (the e2e half on its own stack, behind make dev's Traefik)
make lint           # ruff + mypy + biome
make generate-client  # regenerate the frontend SDK from the OpenAPI schema

make help lists every target.

Documentation

The public site lives in docs/ and is built with zensical:

make docs-serve   # live preview on :8000
make docs         # static build into ./site

It is served at docs.${DOMAIN} by the docs service in docker/compose.yml, and .gitea/workflows/docs.yml builds it with --strict on every push.

License

Copyright (C) 2026 Melvin Strobl - GNU Affero General Public License v3.0 or later. See LICENSE.

S
Description
No description provided
Readme AGPL-3.0
9.4 MiB
Languages
Python 58.6%
TypeScript 38.7%
CSS 1.5%
JavaScript 0.4%
HTML 0.3%
Other 0.4%