Phase 8: hardening (startup drift check, audit log viewer, deploy docs, README) (!8) · Merge requests · Hop179 / Rax

Aiho Tehisaru requested to merge feature/hardening into trunk Sep 09, 2026

Summary

Startup self-check: on boot, compares every rack_bindings.proxmox_environment value against the currently-configured Proxmox environments and logs a loud warning (not fatal) for any drift — e.g. a rack still bound to a renamed/deleted environment.
Audit log viewer: /audit lists every applied Plan (newest first, capped at 200 rows); /audit/{id} shows its actions (kind/before/after/status/error) and the full Plan JSON snapshot. New store queries ListAuditPlans/GetAuditPlan alongside the existing LatestAuditPlanForDevice/ListAuditActions.
hash-password subcommand: the Makefile already had a hash-password target, but cmd/rax never implemented it. Wired it up now (go run ./cmd/rax hash-password prompts for a password on stdin, prints its bcrypt hash) — this is how an operator actually generates LOCAL_ADMIN_PASSWORD_HASH.
Deployment docs: docker-compose.yml now documents both a host-level Caddy option and a sibling caddy compose service option; added Caddyfile.example for both.
README: covers config surface, the separate-Rax-Proxmox-tokens deployment prerequisite (Rax needs its own Proxmox API tokens, never the operator's personal ones), local dev, deployment, the audit log, and the startup check.

gofmt -l . clean
go build ./...
go vet ./...
go test ./... — all packages pass, including new store tests (TestDriftedRackBindingEnvironments, TestAudit_ListAuditPlans_NewestFirst) and web tests (TestAuditLogHandler_ListsPlansNewestFirst, TestAuditPlanDetailHandler_ShowsActions, TestAuditPlanDetailHandler_MissingReturns404)

🤖 Generated with Claude Code