Security & Maintenance

Requires ImpulseCore 1.61.13+

CVE tracking from Ubuntu USN, CISA KEV, and NVD by Postgres CPE. Scheduled OS + Postgres patching with pre-patch snapshots where the provider supports them. Customer-visible maintenance windows.

1. What the pipeline does

ImpulseDB Postgres ships per-service Collector + Actuator classes for dedicated tenants and parallel ServerCollector + ServerActuator classes for the shared-tier Postgres host fleet. ImpulseCore finds them on its own, runs the security tasks, owns all rendering, and keeps the results in its own mod_impulsecore_* tables. The module never writes those tables directly — everything goes through the ImpulseCore::* facade.

Status is read and updates are applied through each server’s Admin Proxy. SSH is used only if you have turned on HIGH RISK break-glass SSH and the Admin Proxy can’t be reached. Read replicas are listed, but their patch status isn’t collected.

CVE feed (3 sources)

Ubuntu USN (hourly) for OS-level CVEs. CISA KEV (hourly) for actively-exploited. NVD by CPE (daily) for Postgres itself via cpe:2.3:a:postgresql:postgresql.

Critical-CVE auto-schedule

Critical (CVSS 9.0+) matches get a patch scheduled 24 hours out; KEV-listed (actively exploited) ones, 1 hour out. These can’t be deferred, and a dedicated customer is emailed straight away.

Pre-patch snapshot

Vultr, Hetzner, DigitalOcean, Linode (needs the Linode Backups service) and Proxmox VE take a provider snapshot before a patch; EC2, Azure and Google Cloud don’t. If a snapshot can’t be taken, the patch still runs, without one.

Customer maintenance windows

Default Sunday 02:00 for 60 minutes, in your WHMCS time zone. Customers on dedicated hosts can change it. Standard patches can be deferred once, up to 14 days.

Server-level scope

Shared Postgres hosts get a per-server section in the admin Security tab with pending updates, reboot-required, kernel and Postgres version, and Schedule patch / Schedule reboot / bulk-patch buttons.

Brand-neutral customer email

Customer notices are standard, editable WHMCS email templates signed “The Support Team” — no vendor names — so resellers ship without scrubbing copy.

2. Admin Security tab

Open Operations → Security in the addon. Two stacked sections:

Shared servers

Server-level snapshot table, one row per active Postgres host. Each row shows tenant count, pending updates (security + total), reboot-required, the Postgres version running, kernel, when it was last collected, and per-server Schedule patch + Schedule reboot buttons. A bulk Schedule patches button appears above the table when servers have security updates pending. Scheduled work runs on ImpulseCore’s next 5-minute tick.

Services

Per-tenant rows for active services. Dedicated services show their own pending updates and get their own Schedule patch / Schedule reboot buttons. Shared-tier services are reported as patched with their host — per-tenant counts are not surfaced because the host (not the tenant) is what actually gets patched.

CVE banner + staleness banner

Critical / KEV-listed matches render a red banner anchoring the top of the tab. High (CVSS 7.0–8.9) renders amber. A separate amber strip warns if the CVE feed itself is stale (no successful cve_feed_refresh for more than 6 hours).

3. Customer Maintenance tab

The security and maintenance panels appear on the Maintenance tab of the customer’s service.

Shared infrastructure

On the shared tier, the panel says patching is managed by your company (the WHMCS company name), that updates are applied at the host level, and that no action is required from the customer. It also shows when the service was last checked.

Dedicated host

• Pending update count, reboot-required indicator.
• Next scheduled patch with linked CVEs.
• Defer button — one deferral per patch, up to 14 days after the patch first became applicable.
• Maintenance window editor (default Sunday 02:00 for 60 minutes).
• Recent security events for the service.

Critical CVEs bypass deferral

For Critical or KEV-listed CVEs, the customer sees a banner on their service, and the patch can’t be deferred — it goes out at the scheduled time.

4. Snapshot support by provider

Pre-patch snapshots use each provider’s own snapshot API:

Provider	Snapshot	Restore
Vultr	POST /v2/snapshots with instance_id	POST /v2/instances/{id}/restore
Hetzner	POST /v1/servers/{id}/actions/create_image with type=snapshot	Rebuild from the snapshot image
DigitalOcean	POST /v2/droplets/{id}/actions with type=snapshot	POST /v2/droplets/{id}/actions with type=restore
Linode	POST /v4/linode/instances/{id}/backups (needs the Backups service)	POST /v4/linode/instances/{id}/backups/{backup_id}/restore
Proxmox VE	VM snapshot	Roll back to the snapshot

The provider snapshot id is recorded on the security event for audit.

When a patch fails

With ImpulseCore 1.61.17 or later, a failed patch’s snapshot is held for you instead of restored automatically: ImpulseCore raises a critical alert, pauses automatic patching of that server, and lets you restore the snapshot, delete it, or release the hold from ImpulseCore → Security. Held snapshots are deleted automatically after 7 days, with a warning a day before. Older ImpulseCore versions restore the snapshot automatically. On a plan or provider without snapshots (for example a Linode without Backups), a failed patch has nothing to roll back to.

5. Cron tasks (Core-owned)

These tasks drive the pipeline. They run on ImpulseCore’s cron runner, alongside ImpulseDB Postgres’s own tasks:

Task	Cadence	Purpose
security_collect	daily	Refresh per-service + per-server snapshots from registered Collectors.
cve_feed_refresh	hourly	Pull Ubuntu USN + CISA KEV.
nvd_product_feed_refresh	daily	Pull NVD CVEs by CPE for every active module’s cve_products.
security_apply_critical	hourly	Match snapshots against the CVE feed for Critical / KEV; schedule patches (24 hours out, 1 hour for KEV).
security_apply_window	5 min	Run due, planned schedules whose window is open: snapshot → patch → reboot if needed.
maintenance_warn	daily	Send the 24-hour notification email.
security_events_purge	daily	90-day retention sweep on events.
security_freshness_check	daily	Raise error-level alerts for stale snapshots or persistent collector errors.
security_snapshot_expiry	daily	Delete held and leftover pre-patch snapshots once their time is up (ImpulseCore 1.61.17+).

6. Force a sweep right now

If you don’t want to wait for the next cron tick:

UPDATE mod_impulsecore_cron_tasks SET next_run_at = NOW()
WHERE name = 'security_collect';
-- or 'cve_feed_refresh' / 'nvd_product_feed_refresh' /
--    'security_apply_critical' / 'security_apply_window' /
--    'maintenance_warn' / 'security_events_purge' /
--    'security_freshness_check'

The task runs on ImpulseCore’s next runner tick.