Changelog

User-facing changes, newest first. For upgrade steps see Upgrading.

#2026-11-12: Remote access in the browser (1.4)

• SSH terminal in the browser. Add servers under Servers & SSH and open a terminal tab. OpsNexus signs in to the server itself with a saved credential or a password or key kept in the secret store. Secrets never reach the browser.
• Windows Remote Desktop (RDP) in the browser. Servers now have a type: SSH terminal or Remote Desktop. RDP runs through a new guacd service in Docker Compose. Options: domain (DOMAIN\user is split for you), security mode (any, NLA, TLS, RDP) and accepting self-signed certificates. The desktop follows the window size, copies the server's clipboard, and has Paste to server and Ctrl+Alt+Del.
• Full screen for both the terminal and the desktop. On a desktop, the toolbar hides and comes back when you move the mouse to the top edge. In Chromium-based browsers, keys such as Esc and the Windows key go to the server; hold Esc to leave full screen.
• Switch to Remote Desktop. When an SSH connection to port 3389 fails, the terminal offers to turn the server into a Remote Desktop server in one click. Connection errors on port 3389 explain the difference.
• Terminals open with a single-use ticket that lives 60 seconds. SSH host keys are trusted on first use and pinned. Sessions close after an idle time and a maximum length (TERMINAL_IDLE_MINUTES, TERMINAL_MAX_HOURS), are listed with who, where and when, and are recorded in the audit log. Admins can end other people's sessions.
• Permissions use the Cloud module: read to view, modify to add, edit and connect, full to delete servers, reset host keys and end others' sessions.

#2026-11-11: Infra designer production options, PDF reports, new plugins

Infra designer

• EC2: choose the OS from a list (Amazon Linux, Ubuntu, Debian, RHEL, SUSE, Windows Server 2019 to 2025) or an AMI ID. Key pairs can be generated by OpsNexus with a .pem download, or imported. Elastic IP and EFS mounts.
• CPU architecture choice (x86_64 or arm64 Graviton) for EC2 and Auto Scaling, with instance types listed per architecture.
• RDS: 11 engines including Oracle, SQL Server and Aurora; Single-AZ, Multi-AZ instance, Multi-AZ DB cluster and Aurora Serverless v2.
• New resources and options: EFS, custom IAM policies, Route 53 hosted zones, API custom domains, more S3 options, VPC endpoints, EC2 Instance Connect Endpoint, EKS Auto Mode.
• Permission check: before every deploy, OpsNexus simulates the credential's IAM permissions and stops with the exact missing actions and a ready policy.
• Connect: SSH, RDP, Session Manager and Instance Connect commands per instance; Windows passwords decrypted in OpsNexus.
• Terraform now uses a modules/stack plus environments/<env> layout. Deployed stacks are not re-created.
• Smart defaults: changing one setting moves dependent settings to a valid value. Values you chose yourself are kept.
• Production hardening of the templates: locked default security group, zones pinned by name, metadata hop limit 1, KMS key policies for encrypted alarm topics and queues, RDS enhanced monitoring and log export, load balancer access logs.

Reports and plugins

• PDF report plugins: Infra stack report, Pipeline report, Cloud inventory report and Cost report, with styles, chart types, sections and saved layouts per project.
• Six new pipeline plugins: terraform-plan-report, iac-security-scan (Checkov), infracost-estimate, aws-cost-guard, opsnexus-infra-deploy and pdf-report.
• Every plugin has its own image. Custom plugins can set icon:.
• Fixes found by running the plugins: Checkov's JUnit report is written again, aws-cost-guard with on_exceed: warn no longer fails the build, Python plugins stream their log as they run.

Platform

• The web container re-resolves the API's address every 10 seconds, so recreating the api container no longer causes 502 errors until web restarts.

#2026-11-10: Infra designer for AWS

• Design: build AWS stacks per project, blank or from a template, and get Terraform and a JSON spec to download, plus an architecture diagram.
• Validation of the whole design at once: references, cycles, CIDR math and subnet capacity, naming and AWS rules.
• Plan, approve, apply: the Deploy tab runs Terraform on your build agents as an OpsNexus pipeline. The plan is shown before anyone approves. Approving and destroying need cloud: full. One active deployment per stack.
• Terraform state in OpsNexus: an HTTP backend with locking, encrypted at rest, the last 20 versions kept, download and force-unlock for admins.
• 23 resource types in 10 categories by the end of the day, covering networking, compute, containers, serverless, databases, storage, messaging, DNS, certificates, security and monitoring, all connected. Access grants write least-privilege IAM policies. (The 2026-11-11 release brought this to 27.)

#2026-11-09: Projects permissions, security fixes, MFA QR code

• User manager: a Projects column and per-project access for each person: No access, Project admin, Developer, Viewer or Custom (a level per module).
• Sharing switches: organization admins can allow or stop sharing agents, secrets and variables, notifications and plugins with every project.
• Plugins per project: a plugin is installed in one project or shared. A project's own plugin wins over a shared one with the same name.
• Security fixes: dependency upgrades remove all critical and high findings (PyJWT, cryptography, python-multipart, dnspython, React Router). The web container runs as a non-root user.
• Health checks: the worker and scheduler have their own checks and no longer show as unhealthy while working.
• MFA setup shows a QR code, drawn on the OpsNexus server (never by an online service), with the key in groups of four and a Copy button.

#2026-11-08: Projects, build artifacts, agent 1.3 and 1.4

Projects

• Organizations now contain projects. Pipelines, builds, artifacts, integrations, agents, secrets and variables belong to a project or are shared with all projects.
• Then every module became project-aware: registries, deploy targets, Kubernetes clusters, cloud accounts, costs and budgets, domains, alert rules, security findings, dashboards, reports and notifications.
• Project roles: Project admin, Developer and Viewer. The header shows the current project with a switcher.
• On upgrade, everything moves into a Default project. Existing agents, secrets, variables, channels and rules become shared, so nothing stops working.

Build artifacts

• Runs keep files: reports and build outputs, stored per pipeline and build. Files are archived after every run, including failed ones.
• Security reports (Trivy, SARIF, Gitleaks, Checkov, Dependency-Check) are imported into Security → Findings. JUnit XML shows passed and failed counts.
• New Artifacts → Build artifacts page.
• Plugin inputs can be multichoice. Trivy plugin 1.1.1: multi-select scanners and severity, full JSON report archived, one scan instead of two.

Build agents

• 1.3.0: an unregistered agent no longer exits and restarts in a loop. It logs the fix once and checks again every 5 minutes. Running the install command again with a new token re-registers it, even with the same volume. ONX_URL always overrides the saved address, and installed agents get set-url.
• 1.3.0: new AGENT_URL setting for the address agents use, and an editable OpsNexus address field on the install page. Warnings for localhost and host.docker.internal.
• 1.3.1: clear messages when Git can't access a repository, including the GitHub fine-grained token rules.
• 1.3.2: a stale registration token never stops a working agent; it keeps using its saved registration.
• 1.4.0: agents archive the pipeline's artifact patterns after each run.

Pipelines

• Verify connection checks the credential, repository, branch and pipeline file before saving.
• The configure page shows one section at a time as tabs, warns about unsaved changes, and keeps plugin steps on save.

Artifacts page

• Docker Hub namespaces accept user, user/repo or a pasted Docker Hub address. Registry settings can be edited.
• Fixed a blank Artifacts page. A page that crashes now shows the error with Try again and Reload instead of a blank screen.