Security & Maintenance

Requires ImpulseCore 1.61.19+

CVE tracking from three feeds, scheduled OS patching with pre-patch snapshots, maintenance scheduling, and bulk-patch admin actions — for every RustFS storage host the addon manages.

1. What the pipeline does

Every ImpulseObjects service is a tenant on a shared storage server, so patching happens per server, not per service. ImpulseObjects ships a per-service Collector (which reports each service as patched at the host level) and a ServerCollector + ServerActuator pair for the storage host fleet. ImpulseCore finds them on its own, runs the security tasks, owns all rendering, and keeps the results in its own mod_impulsecore_* tables.

The split: data and action live in ImpulseObjects (reading the host’s pending package updates and installing them through the server’s Admin Proxy, and taking a provider snapshot). Chrome and orchestration live in ImpulseCore (admin tabs, customer panels, scheduling, the patch walker, the CVE matcher, the email, the audit trail). SSH is used only if you have turned on HIGH RISK break-glass SSH and the Admin Proxy can’t be reached.

CVE feed (3 sources)

Ubuntu USN (hourly) for OS-level CVEs. CISA KEV (hourly) for actively-exploited. NVD by CPE (daily) for RustFS itself (cpe:2.3:a:rustfs:rustfs).

Critical-CVE auto-schedule

Critical (CVSS 9.0+) matches get a patch scheduled 24 hours out; KEV-listed (actively exploited) ones, 1 hour out. These patches can’t be deferred.

Pre-patch snapshot

Before a patch, the module takes a provider snapshot on Vultr, Hetzner, DigitalOcean, Linode (needs the Linode Backups service) and Proxmox VE. The snapshot id is recorded on the security event. If a patch fails, the snapshot is held for you to restore or delete — it is never restored automatically.

Maintenance scheduling

Schedule maintenance, provider downtime, custom windows and reboots from the Maintenance tab, with an optional customer email 24 hours ahead.

Server-level scope

Storage hosts get a per-server section in the admin Security tab with pending updates, reboot-required, kernel and RustFS version, and Schedule patch / Schedule reboot / bulk-patch buttons.

Brand-neutral customer email

Customer notices are standard, editable WHMCS email templates signed “The Support Team” — no vendor names — so resellers ship without scrubbing copy.

2. Admin Security tab

Open Operations → Security in the addon. Two stacked sections:

Shared servers

Server-level snapshot table, one row per active storage server. Each row shows tenant count, pending updates (security + total), reboot-required, the RustFS version running, kernel, when it was last collected, and per-server Schedule patch + Schedule reboot buttons. A bulk Schedule patches button appears above the table when servers have security updates pending. Scheduled work runs on ImpulseCore’s next 5-minute tick.

Services

Below the server table, one row per active ImpulseObjects service. Every service is reported as patched with its server, so no per-tenant update counts are shown.

CVE banner + staleness banner

If the matcher flags a Critical or KEV-listed CVE, a red banner anchors the top of the tab listing the affected hosts. High (CVSS 7.0–8.9) renders amber. A separate amber strip warns if the CVE feed itself is stale (no successful refresh for more than 6 hours).

Held snapshots

When a patch or its reboot fails after a snapshot was taken, ImpulseCore holds the snapshot instead of rolling the server back, raises a critical alert, and pauses automatic patching of that server. Restore it, delete it, or release the hold from ImpulseCore → Security. A held snapshot is deleted automatically after 7 days (24 hours if the failed patch changed nothing), with a warning a day before.

3. Admin Maintenance tab

Open Operations → Maintenance:

• Schedule maintenance — create a window of type Scheduled maintenance, Provider downtime, Custom or Reboot, with a title, time, optional description, and an option to email the customer 24 hours before. Patches aren’t created here — ImpulseCore schedules them for critical CVEs, and you schedule them from the Security tab.
• Recommended maintenance windows — the windows most customers chose, so server maintenance reaches the fewest customers outside their own window.
• Upcoming and active — planned and running windows.
• Recently completed — finished, cancelled and failed windows.

4. Customer Security tab

Each ImpulseObjects service in the client area has a Security tab. Because every service runs on a shared storage server, it shows a single neutral panel: patching is managed by your company (the WHMCS company name), updates are applied at the host level, and no action is required from the customer. It also shows when the service was last checked.

5. Cron tasks (Core-owned)

These tasks drive the pipeline. They run on ImpulseCore’s cron runner, not as ImpulseObjects tasks:

Task	Cadence	Purpose
security_collect	daily	Refresh per-service + per-server snapshots from registered Collectors.
cve_feed_refresh	hourly	Pull Ubuntu USN + CISA KEV.
nvd_product_feed_refresh	daily	Pull NVD CVEs by CPE for every active module’s cve_products.
security_apply_critical	hourly	Match snapshots against the CVE feed for Critical / KEV; schedule patches (24 hours out, 1 hour for KEV).
security_apply_window	5 min	Run due, planned schedules: snapshot → patch → reboot if needed; on failure, hold the snapshot for you.
maintenance_warn	daily	Send the 24-hour notice for windows marked to email the customer.
security_events_purge	daily	90-day retention sweep on events.
security_freshness_check	daily	Raise error-level alerts for stale snapshots or persistent collector errors.
security_snapshot_expiry	daily	Delete held and leftover pre-patch snapshots once their time is up.

One pipeline, all modules

The same tasks drive Security & Maintenance for every Impulse module on the install (ImpulseDB Postgres, ImpulseAuth, ImpulseSearch, and the rest). You don’t add a per-module cron set; modules register their Collector / Actuator classes and ride on Core’s runner.

6. What’s stored where

Table	Holds
mod_impulsecore_security_snapshots	Latest per-service snapshot.
mod_impulsecore_server_snapshots	Latest per-server snapshot for the storage hosts.
mod_impulsecore_security_events	Append-only event log (90-day retention).
mod_impulsecore_maintenance_schedules	Scheduled maintenance rows. One of service_id / server_id set per row.
mod_impulsecore_cve_feed	Upstream advisory cache (USN + KEV + NVD).
mod_impulsecore_patch_snapshot_holds	Pre-patch snapshots held after a failed patch.

ImpulseObjects never writes these tables directly — everything goes through the ImpulseCore::* facade. Listed here so you know where to point your SQL when debugging.