OpenVox-gui 3.6 is out Today’s release brings the biggest feature openvox-gui has shipped to date: a full PE-style agent installer, plus comprehensive security hardening across every privileged endpoint. Current download is v3.6.2 -- get it from the [Releases page](https://github.com/cvquesty/openvox-gui/releases/latest). OpenVox Agent Installer If you’ve ever migrated to OpenVox from Puppet Enterprise and missed the

curl ... | sudo bash

agent bootstrap, this release closes that gap.

bash
# Linux
curl -k --noproxy <fqdn> https://<fqdn>:8140/packages/install.bash | sudo bash


powershell
# Windows
[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
$wc = New-Object Net.WebClient; $wc.Proxy = $null
iex $wc.DownloadString('https://<fqdn>:8140/packages/install.ps1')

The script that downloads to your agent is fully self-configuring -- no

--server

arg required. It discovers the puppetserver FQDN by reading the kernel’s TCP state (

/proc/net/tcp

) and reverse-DNSing the IP of the curl connection that just downloaded it. It then installs the puppet CA into the system trust store so subsequent

apt-get update

/

dnf upgrade openvox-agent

work without any

--insecure

/

Verify-Peer=false

band-aids, sets

no_proxy

so apt/yum bypass corporate proxies for your local mirror, and installs

openvox-agent

from a local OpenVox package mirror at

/opt/openvox-pkgs/

. The mirror is populated nightly from

<http://yum.voxpupuli.org|yum.voxpupuli.org>

,

<http://apt.voxpupuli.org|apt.voxpupuli.org>

, and

<http://downloads.voxpupuli.org|downloads.voxpupuli.org>

and served on the standard puppetserver port (8140) via a static-content mount drop-in -- no new firewall rules. RHEL family, Debian, Ubuntu, Windows, and macOS are all covered out of the box. The whole agent bring-up workflow now lives on a single page: paste the install one-liner on your agent, wait for the CSR to appear in Infrastructure -> Agent Install -> Pending Certificate Requests, click Sign, done. Full feature reference: [docs/INSTALLER.md](https://github.com/cvquesty/openvox-gui/blob/main/docs/INSTALLER.md). Security Hardening 3.6 closes every CRITICAL and HIGH finding from an internal security audit: • Per-route role enforcement on every privileged endpoint (Bolt, Cert Authority, Configuration, ENC, PQL Console). Pre-3.6, an authenticated

viewer

could still trigger Bolt commands as root, sign certs, edit Hiera, or restart the puppet stack -- now each endpoint declares the minimum role it requires. • Deploy webhook (

/api/deploy/webhook

) now requires HMAC-SHA256 signature verification with a shared secret. Disabled by default; opt in via

OPENVOX_GUI_DEPLOY_WEBHOOK_SECRET

. • JWT logout actually revokes the token via a server-side

jti

denylist. Pre-3.6,

/logout

only deleted the cookie -- the JWT stayed cryptographically valid for its full 24-hour expiry. • LDAP bind password encrypted at rest with Fernet (AES-128-CBC + HMAC-SHA256). Plaintext values are read transparently and re-encrypted on next save. • Sudoers wildcards tightened -- replaced the dangerous

openssl x509 *

and

puppetserver ca *

patterns with explicit per-form rules. • 3.6.2 also folds in two Dependabot patches:

postcss

8.5.6 -> 8.5.12 (XSS) and

python-multipart

0.0.22 -> 0.0.26 (DoS). UI reorganization Infrastructure is now a top-level nav group (Certificate Authority / Orchestration / Agent Install), so the agent bring-up workflow has a proper home. The Agent Install page consolidates Install Commands, Mirror Status, Sync Log, and Pending Certificate Requests into one screen. Upgrading

bash
sudo /opt/openvox-gui/scripts/update_local.sh

Full release notes: [v3.6.0](https://github.com/cvquesty/openvox-gui/releases/tag/v3.6.0) (feature release) and [v3.6.2](https://github.com/cvquesty/openvox-gui/releases/tag/v3.6.2) (current). Issues / feedback / PRs all welcome.