feat: add Runtime Policy management, sensor rendering, and openHop branding

[yellowcooln]

Overview

This PR adds Repeater Runtime Policy management to openHop Glass, enabling policy creation, validation, editing, and synchronization directly from the Glass interface.

It also introduces runtime policy sync status tracking, generic Repeater sensor rendering, openHop branding updates, deployment improvements, and dependency refreshes for the 1.1.0 release.

Key Changes

Runtime Policy Management

Adds first-class support for managing Repeater runtime policies from Glass.

Features include:

• Policy templates
• Policy validation
• Visual and JSON policy editing
• Runtime policy_sync command generation
• Policy object and group management
• Group-backed rule conditions
• Runtime policy sync status tracking

Supported sync states include:

• Queued
• Dispatched
• Success
• Failed
• Partial

The policy editor now supports:

• Repeater HTTP IDs
• Rule IDs
• Condition fields
• Object references
• Group references

Generic Repeater Sensor Rendering

Glass now renders generic Repeater sensor data as structured metric cards instead of raw JSON.

Additional improvements include:

• Nested metric formatting
• Generic sensor rendering

UI Improvements

Includes several UI refinements:

• Improved Runtime Policy table styling
• Better light-mode sidebar contrast
• Theme toggle improvements
• Improved map/theme behavior

openHop Branding

Updates Glass branding throughout the application:

• openHop logos
• Product labels
• Favicon/browser integration
• Documentation
• Migration notes

Existing Docker Compose projects, volumes, and databases remain compatible, allowing upgrades without data migration or loss.

Deployment & Installer

Updates deployment tooling:

• Improved Proxmox LXC installer defaults
• Better installer validation
• Improved update-helper behavior
• Better startup diagnostics
• Updated default resource sizing
• Maintains compatibility with existing Glass deployments

Dependencies

• Updated backend dependencies
• Updated frontend dependencies
• Cleared npm audit findings
• Updated version metadata to 1.1.0
• Updated changelog and release notes

Validation

Backend:

• Ruff lint: ✅
• Pytest: 46 passed

Frontend:

• Production build: ✅
• Existing Vite chunk-size warning remains non-blocking

Additional validation:

• git diff --check passed

Live Verification

Verified on a deployed openHop Glass instance.

Confirmed:

• Backend healthy
• Frontend healthy
• Mosquitto healthy
• PostgreSQL healthy
• /healthz returns OK
• OpenAPI reports version 1.1.0
• Updated branding displayed correctly
• Browser console free of JavaScript errors
• No backend exceptions or frontend runtime errors observed after deployment

Assessment

This PR significantly expands Glass by introducing centralized Runtime Policy management for Repeaters while improving telemetry presentation, deployment tooling, and overall application polish. The changes remain backward compatible with existing deployments and have been validated through automated tests, production builds, and live deployment verification.

[yellowcooln]

Update since c689b4f (chore: clean up backend lint):

Commits added:

• f55fdbf — Docker/container timezone alignment
• 0468ba3 — frontend timestamp normalization and sticky refresh access

Issues addressed / tagged:

• Addresses Time Zone Consistency with Logs #11 — Time Zone Consistency with Logs
  • Compose now bind-mounts host /etc/localtime into services, including the dev and prod frontend paths.
  • Frontend timestamp rendering now treats timezone-less API timestamps as UTC before converting to the browser's local time, so packet/log tables line up with other local-time displays.
• Addresses UI Addition: Refresh Button that stays when scrolling #12 — Refresh Button that stays when scrolling
  • The top Network Operations header is now sticky, keeping the global Refresh/Theme/Logout controls available while scrolling long dashboard content.

Also confirmed already-covered by this branch:

• insights topology link does not work. #1 — Dashboard topology navigation now points to /insights-topology, and /insights/topology redirects there.
• edit policy templates #9 — Runtime Policy templates can be selected, edited, and saved.
• Fleet? #7 — Main sidebar wording uses Network instead of Fleet; internal/service identifiers still use fleet where appropriate.

Verification performed:

• docker compose config --quiet
• npm --prefix frontend run build
• Ad-hoc timestamp behavior check under TZ=America/New_York
• Live test host check on 192.168.20.228: all Glass containers reported EDT -0400 after recreate, backend health passed, and frontend responded with openHop Glass title.

[yellowcooln]

Additional Glass issue pass pushed to yellowcooln:feat/repeater-dev-policy-glass at f4e3679.

New commit:

• f4e3679 fix: address remaining Glass issue workflows

Issues addressed/advanced:

• Addresses fleet > commands > node name #2: Command Queue now supports repeater checkbox targeting from the command page, keeps the existing node dropdown for single-target commands, and fixes all/selected repeater queueing to send actual queue payloads per node.
• Addresses Fleet map - missing map #3: Network map now uses the standard OpenStreetMap tile layer with OSM attribution so a base map renders behind repeater markers.
• Addresses repeaters list - login to repeater pymc site #4: Repeater inventory/detail now have a simple Open Repeater button. It opens a new tab using the repeater inform_ip recorded by Glass, falling back to the host/IP the browser used to connect to Glass.
• Partially addresses Repeater convert pub key #5: Repeater detail now exposes a single-repeater Sync Transport Keys action using the existing transport_keys_sync command. I did not invent a new command beyond the backend-supported action.
• Addresses Example policy templates #6: Runtime Policy now includes example templates for high-airtime logging, noisy low-signal dropping, and trusted pubkey allow-list patterns.

Changelog:

• Updated CHANGELOG.md under [Unreleased] with the new issue-work changes.

Verification:

• npm --prefix frontend run build passes locally.
• python3 -m compileall -q backend/app passes locally.
• git diff --check passes locally.
• Deployed the changed files to the test host (192.168.20.228), rebuilt the Docker stack, and verified:
  • backend container is healthy
  • backend health endpoint returns ok
  • frontend returns <title>openHop Glass</title>
  • docker exec openhop_glass_frontend npm run build passes on-host.

Note:

• npx tsc --noEmit is not a usable current gate in this repo as-is; it fails on pre-existing project config/type setup (@types/node/Vue shim/Vite declarations), not on this specific change.

[yellowcooln]

Updated this branch with the Repeater Open UI fixes and kept the changelog under the existing 1.1.0 release notes.

Summary:

• Added a separate per-repeater Open Repeater URL override for Tailscale/VPN management links, without changing the inform/control IP Glass uses for heartbeats and commands.
• Updated Open Repeater link generation to include the Repeater web UI port and avoid Docker bridge gateway IPs such as 172.18.0.1 for browser targets.
• Added DB migration/API/schema support for the override and tests to confirm it stays separate from inform_ip.

Verification:

• npm --prefix frontend run build
• python -m pytest backend/tests/test_inform_control_plane_api.py backend/tests/test_core_api.py (31 passed)
• python -m compileall on changed backend modules
• git diff --check
• Deployed and smoke-checked on the Glass test host.