ITWorx Pulse release export
bd774932d5
Public source validation / validate (push) Failing after 3m8s
4.3 KiB
4.3 KiB
ADR 0009 — Upstream and dependency baseline after M0 research
Status: Accepted for M1 planning; exact package versions remain pinned during M1 implementation.
Context
M0 must verify current upstream capabilities and avoid selecting unsupported or abandoned dependencies. The target Unraid host is 7.2.2 with its native Unraid API online. The local development host has Node.js 24.18.1 and pnpm 10.33.0 but no Go toolchain.
Decision
- Use the native Unraid GraphQL API as the first inventory adapter. Unraid 7.2+ includes the API in the OS, and programmatic access supports API keys, cookies, and SSO/OIDC. Pulse uses a least-privilege read-only API key or equivalent controlled identity; it must not use mutation capabilities.
- Keep Prometheus-compatible history as an external server-side datasource. Pulse uses the stable
/api/v1/queryand/api/v1/query_rangeAPIs through bounded semantic queries; the browser never contacts Prometheus directly. - Use Authentik OIDC/OAuth2 as the production identity integration. The server performs authorization-code exchange and token validation; public/browser flows use PKCE where applicable. Per-provider issuer/discovery is the default because authentik documents it as the recommended issuer mode.
- Implement the frontend with React + TypeScript + Vite, using the current React documentation baseline (19.2) and Vite's supported Node requirement. Use GridStack as the dashboard-grid candidate; retain a measured-equivalent escape hatch. Do not commit exact package versions until M1 lockfile/bootstrap work.
- Prefer Go's standard library for the initial backend transport and pin a currently supported Go release in M1. The official Go release policy supports a major release until two newer majors exist. The baseline is maintained at Go 1.26.6 after the M13 release image gate identified fixed standard-library findings in 1.26.5.
License and support record
| Component | Upstream license observed | Support/compatibility note |
|---|---|---|
| Go toolchain | BSD-style (official Go distribution) | Use an official currently supported release; Go is not installed locally yet. |
| React | MIT | Official React docs list 19.2 as latest major baseline. |
| Vite | MIT | Official docs require Node 20.19+ or 22.12+; local Node 24.18.1 satisfies the documented floor. |
| GridStack | MIT | Candidate only; verify package release and transitive dependencies during M1. |
| Prometheus API/source | Apache 2.0 | External source; Pulse does not redistribute Prometheus in the application image. |
| authentik integration | MIT core with documented directory/component exceptions | Pulse integrates with the deployed provider; it does not embed or redistribute authentik. |
Consequences
- M1 must provision Go, generate lockfiles, run license/dependency checks, and pin exact versions from official release metadata.
- Prometheus location remains unresolved in the actual Unraid environment: no local 9090 listener/container was found. Datasource onboarding must support an explicitly configured external endpoint and report Unknown when absent/stale.
- The frontend runtime remains a static React/Vite artifact served behind the API/reverse proxy, preserving the no-infrastructure-access browser boundary.
Sources accessed 2026-08-01
- Unraid API overview and Unraid API usage
- Go release history
- Prometheus HTTP API and PromQL basics
- authentik OAuth 2.0/OIDC provider
- React versions and React reference
- Vite getting started and compatibility
- React MIT license, Vite MIT license, GridStack MIT license, Prometheus Apache 2.0 license, and authentik license