Support hardened frontend ports and security context

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Merge pull request #204 from kerberos-io/feature/hub-passkey-configuration
2026-10-26 18:48:26 +00:00 · 2026-10-26 18:20:57 +00:00 · 2026-10-26 14:47:35 +01:00 · 2026-10-26 13:33:22 +00:00 · 2026-10-23 13:54:16 +02:00 · 2026-10-23 13:45:08 +02:00
25 changed files with 1306 additions and 68 deletions
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.156.0
+version: 0.167.1

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -31,6 +31,115 @@ Uninstall the Kerberos Hub chart

    helm uninstall hub -n kerberos-hub

+### Hardened frontend images
+
+New shell-free frontend images run as `65532:65532` and listen on port `8080`.
+Before selecting such an image tag, set the following values together. Defaults
+remain compatible with legacy images on port `80`; this chart does not upgrade
+the frontend image automatically. The Service and ingress remain on port `80`.
+
+```yaml
+kerberoshub:
+    frontend:
+        containerPort: 8080
+        securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            runAsGroup: 65532
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+                drop: ["ALL"]
+            seccompProfile:
+                type: RuntimeDefault
+        volumes:
+            - name: frontend-tmp
+              emptyDir:
+                  medium: Memory
+                  sizeLimit: 16Mi
+        volumeMounts:
+            - name: frontend-tmp
+              mountPath: /tmp
+```
+
+Merge the temporary volume into any existing branding/translation mounts rather
+than replacing them. Custom files must be readable by UID `65532`; mount them
+read-only. Only `/tmp` needs writes for generated public runtime configuration
+and nginx's PID/temp files. The web root stays read-only. Health checks can use
+`GET /healthz` on the named `http` container port. This setting applies to the
+primary frontend, not the separately configured legacy demo deployment.
+
+### Passkeys
+
+Users and sub-users can create and manage their own passkeys in **Profile >
+Passkeys**, then use **Sign in with a passkey** for passwordless authentication
+with device PIN/biometric verification. Existing password/MFA sign-in remains
+available. Enrollment and removal require the current password and an
+authenticator-app code when MFA is enabled.
+
+Deploy Hub API and frontend images that support passkeys before enabling this
+configuration; the chart version alone does not update the service image tags.
+Passkeys are disabled by default. Configure their trust explicitly:
+
+```yaml
+kerberoshub:
+    api:
+        passkeys:
+            enabled: true
+            rpId: "hub.example.com"
+            origins:
+                - "https://hub.example.com"
+            rpName: "Kerberos Hub"
+```
+
+| Value | Default | Purpose |
+| --- | --- | --- |
+| `kerberoshub.api.passkeys.enabled` | `false` | Inject passkey configuration into Hub API pods only |
+| `kerberoshub.api.passkeys.rpId` | `""` | Required when enabled; sets `PASSKEY_RP_ID` |
+| `kerberoshub.api.passkeys.origins` | `[]` | Required when enabled; exact trusted frontend origins, joined with commas into `PASSKEY_ORIGINS` |
+| `kerberoshub.api.passkeys.rpName` | `"Kerberos Hub"` | Display name; sets `PASSKEY_RP_NAME` |
+
+Use the **frontend's public hostname and origins**, not the API URL. Origins
+must have no path or trailing slash. Each origin hostname must equal the RP ID
+or be its subdomain. Include only trusted origins, especially when sharing an
+RP ID across tenant subdomains. Keep the RP ID stable: changing it makes
+existing passkeys unusable. The API validates the RP/origin relationship at
+runtime; missing/invalid configuration makes passkeys unavailable without
+affecting password/MFA sign-in.
+
+HTTPS and a compatible browser are required. Local development may use
+`rpId: "localhost"` with `origins: ["http://localhost:4200"]`.
+The frontend displays translated cancellation, verification and unavailable
+messages when a ceremony cannot complete.
+
+Apply values with a Helm upgrade or GitOps sync; changes trigger an API rollout.
+If these variables were previously configured through `kerberoshub.extraEnv`,
+remove those entries when enabling the dedicated settings to avoid duplicate
+environment variables. Setting `enabled: false` omits the chart-managed
+variables; any passkey variables supplied through `extraEnv` still take effect.
+
+The API's MongoDB identity needs reads on `users`, CRUD on `passkeys`, and
+insert/find-and-delete on `passkey_challenges`. It attempts to create the
+`passkey_challenge_expiry_ttl` index on `expiresAt` with
+`expireAfterSeconds: 0`; expiration and single-use enforcement work without the
+index, but the index is needed for automatic expired-challenge cleanup.
+
+### Sequence logging
+
+Set `kerberospipeline.sequence.logLevel` to control the Sequence service's
+`LOG_LEVEL` environment variable. The default is `info`; supported values are
+`debug`, `info`, `warn`, and `error` (lowercase).
+
+```yaml
+kerberospipeline:
+    sequence:
+        logLevel: "debug"
+```
+
+Apply the values with a Helm upgrade or GitOps sync. Changing the value updates
+the pod template and triggers a rollout. Debug logging includes Sequence
+processing checkpoints when supported by the deployed service image.
+
 ### Sprite Resolution

 `kerberospipeline.sprite.width` and `height` set the pixel dimensions of each
@@ -76,7 +185,7 @@ The inline examples use the following order, leaving gaps of ten:

 Enable the annotation in each service's existing environment values section.
 No separate example values file is required. These annotations do not change
-image tags or enable disabled services such as sprite.
+image tags or enable disabled services such as sprite or dominantColor.
 Deploy the compatible analysis bridge before replying workers, and select the
 fixed counting release; waves do not enforce minimum compatible image versions.
 The chart's default image tags are not a compatibility-tested rollout bundle.
@@ -99,6 +208,51 @@ workflow engine. These deployment-global, ops-managed workflows are read-only
 through the API; manage them in Helm values. There are no per-project on/off
 overrides.

+To run a global workflow on specific devices across organisations, select them
+by system tag. Enable `deviceTags.system` and define the tags in its catalog;
+owners assign them to devices in Hub (only catalog tags can be assigned):
+
+```yaml
+deviceTags:
+  system:
+    enabled: true
+    catalog:
+      - key: anpr-pilot
+        label: ANPR pilot
+        description: Runs licence plate recognition on this camera
+
+kerberoshub:
+  workflows:
+    definitions:
+      anpr-pilot:
+        id: "6720f3a1c2d4e5f60718293a"
+        enabled: true
+        triggers:
+          - type: automatic
+            systemTags: ["anpr-pilot"]
+        stages:
+          - operation: anpr
+```
+
+Every tag a trigger selects must be in the catalog; otherwise rendering fails,
+so a typo cannot silently match no device. Because owners set system tags, any
+owner could enroll devices into such a workflow, so `deviceTags.system.enabled`
+is `false` by default. When it is on, the catalog is rendered into the
+`device-system-tags` ConfigMap and mounted into Hub API
+(`DEVICE_SYSTEM_TAGS_FILE`), like the classification catalog. While it is off,
+Hub API gets no catalog (system tags cannot be set) and rendering fails on any workflow that mentions system
+tags anywhere (trigger `systemTags`, or a `device.systemTags` condition at any
+depth, in any key casing). Enable it only on deployments whose owners are
+trusted administrators (self-hosted), never on multi-tenant SaaS.
+
+The engine reads keys case-insensitively and ignores unknown ones, so a typo
+could silently widen a workflow to every device. Workflow definitions may
+therefore only use the keys `id`, `enabled`, `triggers` and `stages`, and
+triggers only the trigger fields the engine knows, spelled exactly; anything
+else fails rendering. System-tag workflows also need a hub-workflows image
+that understands `systemTags` (uug-ai/hub-workflows#87 or later): an older
+engine drops the field and would run the workflow on every device.
+
 Supply an explicit, stable `id` for new definitions:

 ```yaml
@@ -223,8 +377,8 @@ kerberospipeline:
 | `opentelemetry.enabled` | Enable or disable OpenTelemetry instrumentation. | `false` |
 | `opentelemetry.routingEnabled` | Enable or disable OpenTelemetry routing/export behavior. | `false` |
 | `opentelemetry.collector.endpoint` | OpenTelemetry collector endpoint used for trace export. | `"http://otel-collector:4317"` |
-| `opentelemetry.sampler.type` | Trace sampler, exported as `OTEL_TRACES_SAMPLER` (e.g. `parentbased_traceidratio`). Empty keeps the SDK default (sample everything). | `""` |
-| `opentelemetry.sampler.arg` | Sampler argument, exported as `OTEL_TRACES_SAMPLER_ARG` (e.g. `"0.1"` for ~10% of traces). | `""` |
+| `opentelemetry.apiSamplingRatios.operator` | hub-api: share of user and API-client requests traced (0–1), rendered as `TRACE_SAMPLER_RATIO_OPERATOR` (hub-api on trace v1.2.6+). With no ratio set, hub-api records every trace. hub-workflows, the `pipe-*` services and the workflow stages always follow the trace they continue (`parentbased_always_off`); uploads are sampled at the Vault. | `""` |
+| `opentelemetry.apiSamplingRatios.other` | hub-api: share of everything else traced (device heartbeats, agent uploads and live segments, background work), rendered as `TRACE_SAMPLER_RATIO_OTHER`; `0` turns it off. | `""` |
 | `openai.enabled` | Enable or disable OpenAI-backed semantic features. | `false` |
 | `openai.apikey` | OpenAI API key used when OpenAI integration is enabled. | `"xxx"` |
 | `kerberosvault.uri` | The default Kerberos Vault uri (you can add multiple within the app), by default `'https://api.storage.yourdomain.com'` | `"https://api.vault.yourdomain.com"` |
@@ -332,6 +486,7 @@ kerberospipeline:
 | `kerberoshub.frontend.sentry.url` | No longer used. | `"https://xxx@sentry.io/xxx"` |
 | `kerberoshub.frontend.stripe.publicKey` | Public key for `kerberoshub.frontend.stripe`. | `""` |
 | `kerberoshub.frontend.googlemaps.apikey` | Within Kerberos Hub frontend a couple of maps are being used, the google maps is leveraged for that. | `"xxxx"` |
+| `kerberoshub.frontend.googlemaps.placesApi` | Google Places API used for address autocomplete with the same `apikey`: `"legacy"` (Places API) or `"new"` (Places API (New), required for keys that cannot enable the legacy Places API). | `"legacy"` |
 | `kerberoshub.frontend.zendesk.url` | No longer used. | `"yourdomain.zendesk.com"` |
 | `kerberoshub.frontend.posthog.key` | The API key retrieved from the Posthog instance. | `"xxx"` |
 | `kerberoshub.frontend.posthog.url` | Posthog's endpoint (http/https). | `"https://posthog.domain.com"` |
@@ -358,6 +513,7 @@ kerberospipeline:
 | `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (e.g. `en`, `nl`, `pl`, `tr`, `fr`, `sv`, `de`). | `"en"` |
 | `kerberoshub.frontend.features.workflows.enabled` | Enable or disable the workflows feature in the frontend. | `"false"` |
 | `kerberoshub.frontend.features.audit.enabled` | Enable or disable the owner/admin Audit events page and navigation link. | `"true"` |
+| `kerberoshub.frontend.features.dayOverview.enabled` | Enable or disable the Day overview page and navigation menu. Role page permissions still apply. | `"true"` |
 | `kerberoshub.frontend.features.organisations.enabled` | Enable or disable the organisation feature family, including projects. When empty, child groups apply independently. | `""` |
 | `kerberoshub.frontend.features.organisations.switcherEnabled` | Enable or disable the organisation dropdown and switching. The current organisation remains visible when disabled. | `"false"` |
 | `kerberoshub.frontend.features.organisations.creationEnabled` | Enable or disable organisation creation. Requires organisation switching to be enabled. | `"false"` |
@@ -480,6 +636,7 @@ kerberospipeline:
 | `kerberoshub.monitordevice.tag` | The Docker image tag/version. | `"v1.4.0"` |
 | `kerberoshub.monitordevice.replicas` | Number of replicas for `kerberoshub.monitordevice`. | `1` |
 | `kerberoshub.monitordevice.logLevel` | Log verbosity level for `kerberoshub.monitordevice`. | `"info"` |
+| `kerberoshub.monitordevice.scanIntervalSeconds` | Seconds between device status scans. Sets how quickly a camera going offline or online is detected and, for accounts with "Group notifications" on, how long notifications are held to collect other cameras that change status at the same time. | `60` |
 | `kerberoshub.monitordevice.resources.requests.memory` | Memory request for `kerberoshub.monitordevice`. | `"10Mi"` |
 | `kerberoshub.monitordevice.resources.requests.cpu` | CPU request for `kerberoshub.monitordevice`. | `"10m"` |
 | `kerberoshub.reactivate.repository` | Container image repository for `kerberoshub.reactivate`. | `"uugai/hub-reactivatesubscriptions"` |
@@ -545,10 +702,12 @@ kerberospipeline:
 | `kerberospipeline.analysis.tag` | The Docker image tag/version. | `"v1.7.8"` |
 | `kerberospipeline.analysis.replicas` | Number of replicas for `kerberospipeline.analysis`. | `1` |
 | `kerberospipeline.analysis.logLevel` | Log verbosity level for `kerberospipeline.analysis`. | `"info"` |
+| `kerberospipeline.analysis.thumbnailRegeneration.enabled` | Regenerate thumbnails from the first frame of a classified moving object (`THUMBNAIL_REGENERATION_ENABLED`). Adds one thumbnail job per classified recording. Requires an analysis image that reads the flag. | `false` |
 | `kerberospipeline.analysis.dbCache.enabled` | Cache hot-path MongoDB lookups (site vault per device) in memory. Site changes apply after at most one TTL. | `false` |
 | `kerberospipeline.analysis.dbCache.ttl` | Lifetime of a cached lookup, as a Go duration (e.g. `"30s"`, `"5m"`). | `"5m"` |
 | `kerberospipeline.analysis.resources.requests.memory` | Memory request for `kerberospipeline.analysis`. | `"10Mi"` |
 | `kerberospipeline.analysis.resources.requests.cpu` | CPU request for `kerberospipeline.analysis`. | `"10m"` |
+| `kerberospipeline.dominantColor.enabled` | Deploy `pipe-dominantcolor` and let the analysis stage schedule it (`DOMINANTCOLOR_ENABLED`). Requires an analysis image that reads the flag. | `false` |
 | `kerberospipeline.dominantColor.repository` | The dominant color microservices is computing a top 3 color histogram. | `"ghcr.io/uug-ai/hub-pipeline-dominantcolors"` |
 | `kerberospipeline.dominantColor.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberospipeline.dominantColor.tag` | The Docker image tag/version. | `"v2.0.2"` |
@@ -562,6 +721,8 @@ kerberospipeline:
 | `kerberospipeline.thumbnail.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberospipeline.thumbnail.tag` | The Docker image tag/version. | `"v1.3.4"` |
 | `kerberospipeline.thumbnail.replicas` | Number of replicas for `kerberospipeline.thumbnail`. | `2` |
+| `kerberospipeline.thumbnail.prefetchCount` | Max unacknowledged RabbitMQ messages per pod (`RABBITMQ_PREFETCH_COUNT`); `0` keeps the service default of 5. Requires hub-pipeline-thumbnail ≥ v1.3.15. | `0` |
+| `kerberospipeline.sprite.prefetchCount` | Max unacknowledged RabbitMQ messages per pod (`RABBITMQ_PREFETCH_COUNT`); `0` keeps the service default of 5. Requires hub-pipeline-sprite ≥ v1.1.21. | `0` |
 | `kerberospipeline.thumbnail.logLevel` | Log verbosity level for `kerberospipeline.thumbnail`. | `"info"` |
 | `kerberospipeline.thumbnail.quality` | Configuration value for `kerberospipeline.thumbnail.quality`. | `"1"` |
 | `kerberospipeline.thumbnail.width` | Configuration value for `kerberospipeline.thumbnail.width`. | `"600"` |
@@ -623,6 +784,8 @@ kerberospipeline:
 | `email.templates.device` | The template which is send when a camera goes online or offline, by default `'device'`. | `"device"` |
 | `email.templates.alertTitle` | Email subject title for the `alert` template. | `"[Alert] Kerberos Hub detected something an event"` |
 | `email.templates.deviceTitle` | Email subject title for the `device` template. | `"[Device] A Kerberos Agent's status has been changed"` |
+| `email.templates.deviceGroup` | The template sent instead of `device` when several cameras of an account change status in the same scan and the account groups device notifications ("Group notifications"). SMTP only; see *Grouped camera status* below. | `"device_group"` |
+| `email.templates.deviceGroupTitle` | Email subject title for the `device_group` template. | `"[Device] Several cameras changed status"` |
 | `email.mailgun.apiKey` | The Mailgun API key linked to your Mailgun domain. | `""` |
 | `imagePullSecrets.name` | Docker registry secret name, which is also granted with the license. This allows you to download the Docker images. | `""` |
 | `kerberoshub.forwarder.pullPolicy` | The Docker registry pull policy. | `""` |
@@ -631,6 +794,126 @@ kerberospipeline:
 | `kerberoshub.frontend.ssoDomain` | The domain that's being used to activate SSO from the login page. | `""` |
 | `kerberoshub.frontend.stripe.apikey` | If using the public version, `stripe` can be used for automated billing and subscriptions. | `""` |

+### Email templates and variables
+
+Every email Hub sends is a template: an HTML file, plus a plain-text `.txt` version, containing `{{variable}}` placeholders that are filled in just before sending. This section lists which value each placeholder gets.
+
+#### Which template is used
+
+- `email.templates.<name>` sets the template name for each email (for example `email.templates.detection: "detection"`).
+- With `email.provider: smtp`, Hub reads `/mail/templates/<name>.html` and `/mail/templates/<name>.txt` from the container. If the files are not there, it uses its built-in template with that name. To use your own, mount a volume at `/mail` (see the commented `custom-email-templates` volume in `values.yaml`). The [`custom-layout/templates`](custom-layout/templates) folder holds a complete set to start from.
+- With `email.provider: mailgun`, `<name>` is a template stored in your Mailgun account. Mailgun receives `user`, `text`, `link`, `numberOfMedia`, `dataUsage` and the email-specific values below as template variables. The computed values (dates, camera, sites, groups, thumbnail) are only filled in with `smtp`.
+- Alert emails (`detection`) are only sent when `email.provider` is `smtp`.
+- A placeholder that has no value for that email stays in the email as literal text, so only use the placeholders listed for it. The bundled templates contain `{{tab1_href}}`, `{{tab1_title}}`, `{{tab2_href}}` and `{{tab2_title}}`; these are not filled in.
+
+#### Links
+
+- The **base URL** is `kerberoshub.frontend.schema` + `://` + `kerberoshub.frontend.url` (the `PUBLIC_URL` environment variable), for example `https://app.example.com`.
+- A **tenant URL** is the base URL with the first part of the host replaced by the recipient account's domain. With base URL `https://app.example.com` and account domain `acme`, the tenant URL is `https://acme.example.com`. Accounts without a domain use the base URL. Only the last two parts of the host are kept, so a base URL on `app.example.co.uk` becomes `acme.co.uk`.
+
+#### Alerts: `detection`
+
+Sent by the notification pipeline (`kerberospipeline.notify`) when a custom alert or the generic detection alert fires. The subject is `email.templates.alertTitle`; for a custom alert it is prefixed with the alert's name in brackets, for example `[Front door] Hub detected an event.`
+
+| Placeholder | Value |
+|---|---|
+| `{{user}}` | Name of the account that receives the alert: first and last name, or the username when both are empty. This is the account the camera belongs to, not the user who created the alert. |
+| `{{title}}` | The email subject. |
+| `{{text}}` | The alert message: what was detected, on which camera and when. |
+| `{{link}}` | **Custom alerts**: a signed link to the recording file. It stops working when the storage link expires. **Generic detection alert**: the recording's page in Hub, `<tenant URL>/media/<id>`. |
+| `{{medialink}}` | `https://app.kerberos.io/media/<id>`. Always this host; it does not follow `kerberoshub.frontend.url`. |
+| `{{thumbnail}}` | An `<img>` of the recording: embedded in the email for custom alerts, a signed thumbnail URL for the generic detection alert. |
+| `{{date}}`, `{{time}}`, `{{datetime}}` | Start of the recording, in the account's timezone. |
+| `{{eventdate}}`, `{{eventtime}}`, `{{eventdatetime}}` | When the alert was sent, in the account's timezone. |
+| `{{timezone}}` | The account's timezone. |
+| `{{devicename}}`, `{{deviceid}}` | Camera name and camera key. |
+| `{{sites}}`, `{{groups}}` | Comma-separated names of the sites and groups the camera belongs to. |
+| `{{classifications}}` | Comma-separated objects detected in the recording. |
+
+#### Camera status: `device`
+
+Sent by `hub-monitor-device` when a camera goes online, offline or idle. The subject is `email.templates.deviceTitle`.
+
+| Placeholder | Value |
+|---|---|
+| `{{user}}` | Username of the account the camera belongs to. |
+| `{{title}}` | The email subject. |
+| `{{text}}` | The status change, for example "`<camera>` is online, but the camera stream is not connected." |
+| `{{status}}` | `active` (online), `inactive` (offline) or `idle` (online, camera stream not connected). |
+| `{{devicename}}`, `{{deviceid}}` | Camera name and camera key. |
+| `{{eventdate}}`, `{{eventtime}}`, `{{eventdatetime}}` | When the status changed, in the server's timezone (normally UTC), not the account's. |
+| `{{link}}` | Not set; replaced with an empty value. |
+
+
+#### Grouped camera status: `device_group`
+
+Sent by `hub-monitor-device` instead of `device` when an account has **Group notifications** switched on (Alerts → Devices, stored as `notificationSettings.devices.groupNotifications`) and **several** of its cameras change status in the same scan. A change is held for one scan (`kerberoshub.monitordevice.scanIntervalSeconds`, default 60 seconds) so that cameras of the same outage arrive in one email. When only one camera changed, the usual `device` email is sent. The subject is `email.templates.deviceGroupTitle`; the template name is `email.templates.deviceGroup` (default `device_group`, so custom files are `device_group.html` and `device_group.txt`).
+
+| Placeholder | Value |
+|---|---|
+| `{{user}}` | Name of the account the cameras belong to: first and last name, or the username when both are empty. |
+| `{{title}}` | The email subject. |
+| `{{text}}` | One-line summary, for example "6 cameras changed status: 4 offline, 1 lost their camera stream, 1 back online." |
+| `{{count}}` | Number of cameras in the email. |
+| `{{status}}` | `active`, `inactive` or `idle` when all cameras have the same new status, otherwise `mixed`. |
+| `{{sections}}` | The cameras as HTML, one section per status and site, group or "Other cameras" (see below). |
+| `{{sectionsText}}` | The same sections as plain text, for `device_group.txt`. |
+| `{{link}}` | The cameras page, `<tenant URL>/devices`, built from `kerberoshub.frontend.schema` and `kerberoshub.frontend.url` (see *Links* above). |
+| `{{eventdate}}`, `{{eventtime}}`, `{{eventdatetime}}` | When the email was sent, in the server's timezone (normally UTC). |
+
+**Sections.** Sections are ordered by status (offline, camera stream lost, back online), then sites, groups and "Other cameras". Each camera is listed once: under the site or group that holds the most cameras of the email with the same status (a site wins a tie), or under "Other cameras" when it is in no site or group. A section title reads `Site Gate · Offline · all 3 cameras`, `Group Perimeter · Back online · 2 cameras` or `Other cameras · Camera stream lost · 1 camera`; "all" is added when every camera of the site or group is in the section. Each camera line has its name and a detail: `no response for 12 min`, `agent online, camera stream not connected` or `online`.
+
+`{{sections}}` is generated HTML with inline styles (email clients ignore stylesheets): per section a `<p>` with the title, followed by a `<table role="presentation" width="100%">` with one row per camera (name left, detail right). Place it where the camera list should appear; its look can't be changed from the template. For full control over the layout, use `{{sectionsText}}`. Camera, site and group names are HTML-escaped.
+
+`{{sectionsText}}` example:
+
+```text
+Site Gate · Offline · all 3 cameras
+- Gate camera 1 (no response for 4 min)
+- Gate camera 2 (no response for 4 min)
+- Gate camera 3 (no response for 4 min)
+
+Other cameras · Camera stream lost · 1 camera
+- Lobby camera (agent online, camera stream not connected)
+```
+
+**Custom templates** for this email are read by `hub-monitor-device`, so mount the `custom-email-templates` volume on `kerberoshub.monitordevice` as well (see the commented example in `values.yaml`).
+
+**Which channels are grouped.** Grouping applies to the channels people read: email, Slack, Telegram, Pushover, Pushbullet, SMS and Alexa. Webhooks, IFTTT and the real-time feed are never grouped: they keep receiving one notification per camera, with the same fields and at the same moment as without grouping, so existing integrations keep working.
+
+**When email stays per camera.** The grouped email is only sent with the SMTP mail provider. With SendGrid or Mailgun the template name is a template id in that account, so those keep one `device` email per camera. With SMTP, a deployment that mounts its own `device` template but no `device_group` template also keeps one email per camera, so a white-labelled device email never falls back to the default layout. Add a `device_group` template next to your `device` template to get grouped emails.
+
+#### Account and sharing emails
+
+Sent by the API (`kerberoshub.api`). The subject of each email is the matching `email.templates.<name>Title` value.
+
+| Email (`email.templates.*`) | Placeholder | Value |
+|---|---|---|
+| Registration (`welcome`) | `{{user}}` | New user's first and last name, or username. |
+| | `{{link}}` | Activation link: `<base URL>/login/activate/<token>`. |
+| | `{{token}}` | The activation token. |
+| Account activated (`activate`) | `{{user}}` | User's first and last name, or username. |
+| | `{{link}}` | `<base URL>/login`. |
+| Password reset (`forgot`) | `{{user}}` | User's first and last name, or username. |
+| | `{{password}}` | The newly generated password. |
+| | `{{ipaddress}}` | IP address the reset was requested from. |
+| Recording shared (`share`) | `{{user}}` | Sender's first and last name, or username. |
+| | `{{url}}` | Signed link to the recording file. |
+| | `{{title}}` | The email subject (`email.templates.shareTitle`). The share's own title is only used when that value is empty. |
+| | `{{body}}` | The notes the sender added to the share. |
+| Case shared (`share_case`) | `{{user}}` | Sender's first and last name, or email address. |
+| | `{{firstname}}`, `{{lastname}}` | Sender's first and last name. |
+| | `{{url}}` | `<base URL>/share/<token>`. |
+| | `{{expiry}}` | How long the share stays valid, for example "2 days" or "1 week". |
+| Case share code (`share_case_otp`) | `{{code}}` | One-time code to open the shared case. |
+| | `{{expiry}}` | How long the code stays valid. |
+| Task assigned (`assign_task`) | `{{assignee}}` | Assigned user's first and last name, or username. |
+| | `{{user}}` | Name of the user who assigned the task. |
+| | `{{task_name}}` | The task title. |
+| | `{{link}}` | `<tenant URL>/tasks/`, using the assigned user's domain. |
+
+The `newip`, `disable` and `highupload` templates are included, but no service currently sends them.
+
 ### Post installation

 After the installation you'll need to initialise the Mongodb with some objects. Have a look at the `mongodb/` folder, you'll find three files available:
@@ -669,19 +952,37 @@ Within the Kerberos Hub front-end you'll see the option to filter through classi
 The default shared classification list lives in
 [`templates/configMaps/catalogs/classifications.yaml`](templates/configMaps/catalogs/classifications.yaml),
 independently of workflow contracts. The chart uses this bundled definition
-unless a deployer provides a ConfigMap override. Each entry contains the stable classifier output
+unless a deployer defines the catalog inline or provides a ConfigMap override. Each entry contains the stable classifier output
 `key`, the user-facing `label`, and an `icon` key. Hub API exposes this catalog
 to alerts and filters. When the mounted catalog is unavailable, compatible Hub
 API versions fall back to the legacy `settings` document and then the built-in
 classification list. Set `classificationCatalogEnabled: false` to omit the
 ConfigMap and make Hub API use that fallback directly.

-Starting with chart **0.155.0**, the inline `classificationCatalog` values key is
-removed. Supplying it fails validation, including `null` and `[]`; it is never
-silently ignored or replaced with bundled defaults.
+The simplest way to customize the catalog is to define the complete list inline
+in your values (restored in chart **0.162.0** after its removal in 0.155.0):

-To customize the catalog, create a ConfigMap in the release namespace containing
-the complete JSON array, then use the per-file replacement interface:
+```yaml
+classificationCatalog:
+  - key: car
+    label: Car
+    icon: car
+  - key: forklift
+    label: Forklift
+```
+
+The list replaces the bundled defaults entirely (entries are not merged) and is
+rendered into the chart's `classification-catalog` ConfigMap, so Hub API and the
+bundled `catalogs/classifications.json` of workflow packaging use the same list
+and a change rolls the API pod. Each entry needs a `key` and `label`, `icon` is
+optional, and keys must be unique. Omitting the key (or `null`) keeps the bundled
+defaults; `[]` is rejected, so use `classificationCatalogEnabled: false` for the
+API fallback. An inline list cannot be combined with
+`classificationCatalogEnabled: false`, `classificationCatalogExistingConfigMap` or
+a per-file catalog replacement.
+
+Alternatively, create a ConfigMap in the release namespace containing the complete
+JSON array, then use the per-file replacement interface:

 ```yaml
 classificationCatalogEnabled: true
@@ -696,13 +997,8 @@ workflowConfiguration:
          replace: true
 ```

-To migrate, copy the existing list exactly (preserving keys, labels and icons)
-into the ConfigMap's JSON data, remove `classificationCatalog` from every values
-overlay and command-line override, and deploy the ConfigMap before the chart
-upgrade. A `null` value is not a migration: remove the key. The bundled list
-remains the default when no override is configured. If an old `[]` intentionally
-selected the API's runtime fallback, use `classificationCatalogEnabled: false`
-and configure workflow packaging without bundled defaults instead.
+Deploy that ConfigMap before the chart upgrade. The bundled list remains the
+default when no override is configured.

 The existing `classificationCatalogExistingConfigMap: hub-classification-catalog`
 option remains supported, including for deployments without workflow packaging.
@@ -1047,12 +1343,12 @@ not owned by workflows. A library may ship a catalog without implementing an API
 **effective** classification list under `/etc/kerberos/configuration`, using
 the directory layout above. The projected volume reuses the existing
 classification ConfigMap, including `classificationCatalogExistingConfigMap`
-overrides or explicit per-file replacements, rather
+overrides, an inline `classificationCatalog` or explicit per-file replacements, rather
 than storing another copy in the workflow ConfigMap.

 The default classification ConfigMap name, mount path, `CLASSIFICATION_CATALOG_FILE`
-and API endpoint remain unchanged. Inline `classificationCatalog` values,
-including `[]` and `null`, are rejected from chart 0.155.0 onward. The current API
+and API endpoint remain unchanged. An inline `classificationCatalog` list is
+rendered into that ConfigMap; `[]` is rejected. The current API
 still falls back to settings/built-in values for an empty/invalid mounted catalog. The preparatory
 bundle does not reproduce that runtime fallback and must not be treated as a
 resolved API catalog. The Start-specific loader shares the existing classification
@@ -1139,10 +1435,9 @@ A replacement for `catalogs/classifications.json` also supplies the standalone
 classification API. Both mounts use that ConfigMap and key, even when its key
 is not named `classifications.json`. The chart does not generate or checksum the
 replaced ConfigMap. To avoid two competing sources, do not combine this
-replacement with a nonempty `classificationCatalogExistingConfigMap`. That
-existing ConfigMap option remains supported when no per-file catalog replacement
-is configured. The retired inline `classificationCatalog` key is rejected
-regardless of the selected configuration.
+replacement with a nonempty `classificationCatalogExistingConfigMap` or an inline
+`classificationCatalog`. Those options remain supported when no per-file catalog
+replacement is configured.
 `classificationCatalogEnabled` must remain true when including defaults.

 This is whole-file replacement, not field-level YAML merging or catalog-entry
@@ -0,0 +1,431 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta
+            name="viewport"
+            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
+    />
+    <meta name="description" content="Kerberos.io Mailing">
+    <style type="text/css">
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 400;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 500;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 600;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter var';
+            font-weight: 100 900;
+            font-display: swap;
+            font-style: normal;
+            font-named-instance: 'Regular';
+            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
+        }
+
+        body{
+            background: #E5E5E5;
+            margin-top:0;
+            margin-bottom: 0;
+            margin-right: 0;
+            margin-left: 0;
+            padding-top: 0;
+            padding-left: 0;
+            padding-right: 0;
+            padding-bottom: 0;
+            font-family: 'Inter';
+        }
+        a, a:hover, a:active {
+            color: #262424;
+            text-decoration: none;
+        }
+
+        .corner-td{
+            width: 60px;
+        }
+
+        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
+        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
+        .ExternalClass {width: 100%;}
+        @media screen and (max-width:500px){
+            .tab-td{
+                padding-left: 10px!important;
+            }
+            .tab-td a h4{
+                font-size: 14px!important;
+            }
+            .corner-td{
+                width: 20px!important;
+            }
+            .company-name-td h3{
+                font-size: 16px!important;
+            }
+            table.header-table{
+                padding-top: 8px!important;
+                padding-right: 0px!important;
+                padding-bottom: 24px!important;
+                padding-left: 0px!important;
+            }
+            .colored-card-td  h4{
+                font-size: 14px!important;
+            }
+            .colored-card-td  h2{
+                font-size: 20px!important;
+            }
+            .colored-card-td  a p{
+                font-size: 12px!important;
+                width: 143px!important;
+            }
+            .colored-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td h3{
+                font-size: 18px!important;
+            }
+            .colorless-card-td p{
+                font-size: 14px!important;
+            }
+            .colorless-card-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 24px!important;
+                margin-bottom: 24px!important;
+            }
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:600px) {
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:650px) {
+            .footer-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 0px!important;
+                margin-bottom: 36px!important;
+            }
+        }
+    </style>
+</head>
+<body height="100%" width="100%">
+<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td height="36" align="left" class="company-name-td">
+                        <h3  width="36" height="36" style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;">Kerberos.io</h3>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
+                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab1_title}}</h4>
+                        </a>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
+                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab2_title}}</h4>
+                        </a>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
+                        <h4 style="font-family: Inter;
+                                        font-size: 16px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#b09fb9;">Hey, {{user}}</h4>
+						<h2 style=" font-family: Inter;
+                                        font-size: 24px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#FFFFFF;
+                                        padding-top: 12px;
+                                        margin-bottom: 0;
+                                        padding-bottom: 0;
+                                        padding-left: 0;
+                                        padding-right: 0;">Several of your cameras changed status</h2>
+                        <h2 style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#FFFFFF;
+                                        padding-top: 0;
+                                        padding-bottom: 24px;
+                                        padding-left: 0;
+                                        padding-right: 0;
+										color:#b09fb9;">{{text}}</h2>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td  class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
+                        <h3 style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;
+                                        width: 480px">What changed</h3>
+                        {{sections}}
+                        <p style=" font-family: Inter;
+                                        font-size: 14px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #6D6666;
+                                        margin-top: 12px;">Cameras that go offline together usually share a cause, such as a site losing its internet connection or power. Have a look into your Kerberos Hub account for the latest recordings and the status of your cameras.</p>
+
+						<a style="text-decoration: none;color: none;" href="{{link}}">
+                            <p style="font-family: Inter;
+                                                font-size: 14px;
+                                                font-style: normal;
+                                                line-height: 24px;
+                                                mso-line-height-rule:exactly;
+                                                letter-spacing: 0em;
+                                                text-align: left;
+                                                color:#FFFFFF;
+                                                background-color: #84559F;
+                                                padding-top: 6px;
+                                                padding-bottom: 6px;
+                                                padding-right: 16px;
+                                                padding-left: 16px;
+                                                width: 160px;
+                                                border-radius: 4px;
+												text-align: center;
+                                                cursor: pointer;">Go to Kerberos Hub -></p>
+                        </a>
+					</td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">Get in touch</h4>
+                                    <a style="text-decoration: none;color: none;" href="mailto:support@verstraeten.io">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 16px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">support@kerberos.io</p>
+                                    </a>
+                                    <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                    line-height: 16px;
+                                    mso-line-height-rule:exactly;
+                                    letter-spacing: 0em;
+                                    text-align: left;
+                                    color: #A69D9D;">9000 Ghent, BE</p>
+
+                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 24px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">https://kerberos.io</p>
+                                    </a>
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">About Kerberos</h4>
+                                    <p style=" font-family: Inter;
+                                                        font-size: 14px;
+                                                        font-style: normal;
+                                                        font-weight: 400;
+                                                        line-height: 24px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
+                                                        
+                                    
+                                    <p style="margin-top: 12px;">
+                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
+                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
+                                        </a>
+                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
+                                        </a>
+                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
+                                        </a>
+                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
+                                        </a>
+                                    </p>                
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                    <tr style="height: 50px">
+                        <td></td>
+                    </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+</body>
+</html>
@@ -0,0 +1,22 @@
+Kerberos.io
+------------
+
+Hey, {{user}}
+
+Several of your cameras changed status
+{{text}}
+
+{{sectionsText}}
+
+Go to Kerberos Hub ->
+{{link}}
+
+Get in touch
+------------
+support@kerberos.io
+9000 Ghent, BE
+https://kerberos.io
+
+About Kerberos
+------------
+Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -1,7 +1,6 @@
 # Create these ConfigMaps in the release namespace before deploying the chart.
 # Keys contain complete contracts/catalogs; they are not merged with chart data.
-# Remove the retired classificationCatalog key from every values overlay.
-# Do not also set classificationCatalogExistingConfigMap.
+# Do not also set classificationCatalog or classificationCatalogExistingConfigMap.
 classificationCatalogEnabled: true
 workflowConfiguration:
  enabled: true
@@ -22,9 +22,6 @@

 {{/* Normalize both interfaces without changing the caller's values. */}}
 {{- define "hub.workflowConfiguration.settings" -}}
-{{- if hasKey .Values "classificationCatalog" -}}
-{{- fail "classificationCatalog is no longer supported; remove the values key and place the complete catalog in a ConfigMap, then use workflowConfiguration.configMaps with path: catalogs/classifications.json and replace: true" -}}
-{{- end -}}
 {{- $config := .Values.workflowConfiguration | default dict -}}
 {{- $unified := or (hasKey $config "includeDefaults") (hasKey $config "configMaps") -}}
 {{- $legacy := or (hasKey $config "existingConfigMap") (hasKey $config "items") (hasKey $config "extraConfigMaps") -}}
@@ -78,6 +75,17 @@
 {{- fail "a classifications.json replacement cannot be combined with classificationCatalogExistingConfigMap; choose one override mechanism" -}}
 {{- end -}}
 {{- end -}}
+{{- if not (kindIs "invalid" .Values.classificationCatalog) -}}
+{{- if not .Values.classificationCatalogEnabled -}}
+{{- fail "classificationCatalog requires classificationCatalogEnabled; remove the inline list to use the API fallback" -}}
+{{- end -}}
+{{- if .Values.classificationCatalogExistingConfigMap -}}
+{{- fail "classificationCatalog cannot be combined with classificationCatalogExistingConfigMap; choose one override mechanism" -}}
+{{- end -}}
+{{- if hasKey $replacements "catalogs/classifications.json" -}}
+{{- fail "classificationCatalog cannot be combined with a classifications.json replacement; choose one override mechanism" -}}
+{{- end -}}
+{{- end -}}
 {{- dict "enabled" $enabled "includeDefaults" $includeDefaults "configMaps" $normalizedSources "replacements" $replacements | toYaml -}}
 {{- end -}}

@@ -0,0 +1,51 @@
+{{/*
+The system tag catalog (deviceTags.system.catalog) uses the Hub shared choice
+catalog format: {key, label, description?}. values.schema.json validates each
+entry (key in stored device tag form, models.NormalizeDeviceTags: 1-64
+characters of a-z, 0-9, ".", "_", ":" and "-", starting and ending with a
+letter or digit) and that enabled is a boolean; keys must also be unique.
+*/}}
+{{- define "kerberoshub.deviceTags.system.validate" -}}
+{{- $seen := dict -}}
+{{- range $tag := (include "kerberoshub.deviceTags.system.catalog" . | fromJsonArray) -}}
+{{- $key := toString $tag.key -}}
+{{- if hasKey $seen $key -}}
+{{- fail (printf "deviceTags.system.catalog: duplicate key %q" $key) -}}
+{{- end -}}
+{{- $_ := set $seen $key true -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+The configured system tag catalog as a JSON array, whether or not system tags
+are enabled (missing values read as empty).
+*/}}
+{{- define "kerberoshub.deviceTags.system.catalog" -}}
+{{- $deviceTags := .Values.deviceTags | default dict -}}
+{{- $system := $deviceTags.system | default dict -}}
+{{- $system.catalog | default list | toJson -}}
+{{- end -}}
+
+{{/*
+Whether system tags are enabled (deviceTags.system.enabled): "true" or "".
+*/}}
+{{- define "kerberoshub.deviceTags.system.enabled" -}}
+{{- $deviceTags := .Values.deviceTags | default dict -}}
+{{- $system := $deviceTags.system | default dict -}}
+{{- if and (kindIs "bool" $system.enabled) $system.enabled -}}true{{- end -}}
+{{- end -}}
+
+{{/*
+The system tag catalog file hub-api reads (DEVICE_SYSTEM_TAGS_FILE), rendered
+from deviceTags.system.catalog into the device-system-tags ConfigMap.
+*/}}
+{{- define "kerberoshub.deviceTags.system.json" -}}
+{{- include "kerberoshub.deviceTags.system.validate" . -}}
+{{- $tags := list -}}
+{{- range $tag := (include "kerberoshub.deviceTags.system.catalog" . | fromJsonArray) -}}
+{{- $entry := dict "key" $tag.key "label" $tag.label -}}
+{{- with $tag.description }}{{- $_ := set $entry "description" . -}}{{- end }}
+{{- $tags = append $tags $entry -}}
+{{- end -}}
+{{- $tags | toJson -}}
+{{- end -}}
@@ -84,17 +84,25 @@ Usage: {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-api") | nin
 {{- end -}}

 {{/*
-OpenTelemetry sampler env entries, rendered only when configured. The OTel SDKs
-read these natively; unset keeps the SDK default (parentbased_always_on).
+OpenTelemetry sampling env.
+"hub.opentelemetry.samplerEnv" is for the services that only continue traces
+started elsewhere (hub-workflows, pipe-*, workflow stages): they follow the
+parent's sampling decision and never start traces of their own.
+"hub.opentelemetry.apiSamplerEnv" renders hub-api's per-class sampling ratios
+(opentelemetry.apiSamplingRatios) as TRACE_SAMPLER_RATIO_<CLASS>; empty values
+are not rendered.
 Usage: {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
 */}}
 {{- define "hub.opentelemetry.samplerEnv" -}}
-{{- with .Values.opentelemetry.sampler.type }}
 - name: OTEL_TRACES_SAMPLER
-  value: {{ . | quote }}
+  value: "parentbased_always_off"
+{{- end -}}
+
+{{- define "hub.opentelemetry.apiSamplerEnv" -}}
+{{- range $class, $ratio := (.Values.opentelemetry.apiSamplingRatios | default dict) }}
+{{- if ne (toString $ratio) "" }}
+- name: TRACE_SAMPLER_RATIO_{{ upper $class }}
+  value: {{ toString $ratio | quote }}
 {{- end }}
-{{- with .Values.opentelemetry.sampler.arg }}
- name: OTEL_TRACES_SAMPLER_ARG
-  value: {{ . | quote }}
 {{- end }}
 {{- end -}}
@@ -11,6 +11,28 @@
  {"key": "cell phone", "label": "Cell phone", "icon": "cell phone"}
 ]
 {{- end -}}
+{{/*
+The effective chart-rendered catalog: the inline classificationCatalog values
+list when set, otherwise the bundled defaults above. values.schema.json
+validates each entry ({key, label, icon?}); keys must also be unique.
+*/}}
+{{- define "hub.classificationCatalog.json" -}}
+{{- if kindIs "invalid" .Values.classificationCatalog -}}
+{{- include "hub.classificationCatalog.defaults" . | mustFromJson | toJson -}}
+{{- else if and (kindIs "slice" .Values.classificationCatalog) .Values.classificationCatalog -}}
+{{- $seen := dict -}}
+{{- range $entry := .Values.classificationCatalog -}}
+{{- $key := toString $entry.key -}}
+{{- if hasKey $seen $key -}}
+{{- fail (printf "classificationCatalog: duplicate key %q" $key) -}}
+{{- end -}}
+{{- $_ := set $seen $key true -}}
+{{- end -}}
+{{- .Values.classificationCatalog | toJson -}}
+{{- else -}}
+{{- fail "classificationCatalog must be omitted (bundled defaults) or a nonempty list; to use the API fallback set classificationCatalogEnabled: false" -}}
+{{- end -}}
+{{- end -}}
 {{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
 {{- if and .Values.classificationCatalogEnabled (not .Values.classificationCatalogExistingConfigMap) (not (hasKey $config.replacements "catalogs/classifications.json")) }}
 apiVersion: v1
@@ -20,5 +42,5 @@ metadata:
  namespace: {{ .Release.Namespace }}
 data:
  classifications.json: |-
-    {{- include "hub.classificationCatalog.defaults" . | mustFromJson | toPrettyJson | nindent 4 }}
+    {{- include "hub.classificationCatalog.json" . | mustFromJson | toPrettyJson | nindent 4 }}
 {{- end -}}
@@ -0,0 +1,12 @@
+{{- if include "kerberoshub.deviceTags.system.enabled" . }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: device-system-tags
+  namespace: {{ .Release.Namespace }}
+data:
+  # Rendered from deviceTags.system.catalog; hub-api reads it through
+  # DEVICE_SYSTEM_TAGS_FILE.
+  system-tags.json: |-
+    {{- include "kerberoshub.deviceTags.system.json" . | mustFromJson | toPrettyJson | nindent 4 }}
+{{- end -}}
@@ -125,6 +125,9 @@ spec:
        {{- if and .Values.classificationCatalogEnabled (not .Values.classificationCatalogExistingConfigMap) (not $catalogReplacement) }}
        checksum/classification-catalog: {{ include (print $.Template.BasePath "/configMaps/catalogs/classifications.yaml") . | sha256sum }}
        {{- end }}
+        {{- if include "kerberoshub.deviceTags.system.enabled" . }}
+        checksum/device-system-tags: {{ include (print $.Template.BasePath "/configMaps/catalogs/device-system-tags.yaml") . | sha256sum }}
+        {{- end }}
        {{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/start.yaml")) }}
        checksum/workflow-configuration: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/start.yaml") . | sha256sum }}
        {{- end }}
@@ -147,7 +150,8 @@ spec:
      {{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
      {{- $mongodbTLS := .Values.mongodb.tls }}
      {{- $classificationCatalogEnabled := .Values.classificationCatalogEnabled }}
-      {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      {{- $deviceSystemTagsEnabled := include "kerberoshub.deviceTags.system.enabled" . }}
+      {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled $deviceSystemTagsEnabled .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
      volumes:
      {{- if $workflowConfiguration.enabled }}
        - name: workflow-configuration
@@ -200,6 +204,11 @@ spec:
                path: classifications.json
            {{- end }}
      {{- end }}
+      {{- if $deviceSystemTagsEnabled }}
+        - name: device-system-tags
+          configMap:
+            name: device-system-tags
+      {{- end }}
      {{- with .Values.kerberoshub.api.volumes }}
        {{- toYaml . | nindent 8 }}
      {{- end }}
@@ -227,7 +236,7 @@ spec:
          ports:
            - containerPort: 80
              name: http
-          {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+          {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled $deviceSystemTagsEnabled .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
          volumeMounts:
          {{- if $workflowConfiguration.enabled }}
            - name: workflow-configuration
@@ -239,6 +248,11 @@ spec:
              mountPath: /etc/kerberos/classifications
              readOnly: true
          {{- end }}
+          {{- if $deviceSystemTagsEnabled }}
+            - name: device-system-tags
+              mountPath: /etc/kerberos/device-tags
+              readOnly: true
+          {{- end }}
          {{- with .Values.kerberoshub.api.volumeMounts}}
            {{- toYaml . | nindent 12 }}
          {{- end }}
@@ -261,6 +275,12 @@ spec:
            - name: CLASSIFICATION_CATALOG_FILE
              value: /etc/kerberos/classifications/classifications.json
            {{- end }}
+            {{- if $deviceSystemTagsEnabled }}
+            # System tag catalog (deviceTags.system.catalog): the only system
+            # tags owners can assign. Unset (disabled) disables system tags.
+            - name: DEVICE_SYSTEM_TAGS_FILE
+              value: /etc/kerberos/device-tags/system-tags.json
+            {{- end }}
            - name: ENVIRONMENT
              value: "{{ .Values.environment }}"
            - name: READ_ONLY
@@ -416,6 +436,15 @@ spec:
            - name: MFA_ISSUER
              value: "{{ .Values.kerberoshub.api.mfaIssuer }}"

+            {{- if .Values.kerberoshub.api.passkeys.enabled }}
+            - name: PASSKEY_RP_ID
+              value: {{ required "kerberoshub.api.passkeys.rpId is required when passkeys are enabled" .Values.kerberoshub.api.passkeys.rpId | quote }}
+            - name: PASSKEY_ORIGINS
+              value: {{ required "kerberoshub.api.passkeys.origins is required when passkeys are enabled" .Values.kerberoshub.api.passkeys.origins | join "," | quote }}
+            - name: PASSKEY_RP_NAME
+              value: {{ .Values.kerberoshub.api.passkeys.rpName | quote }}
+            {{- end }}
+
            # AWS (Legacy, use Kerberos Vault instead)
            - name: AWS_REGION
              value: "{{ .Values.kerberoshub.api.aws.region }}"
@@ -577,6 +606,6 @@ spec:
              value: "{{ .Values.opentelemetry.routingEnabled }}"
            - name: OTEL_EXPORTER_OTLP_ENDPOINT
              value: "{{ .Values.opentelemetry.collector.endpoint }}"
-            {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 12 }}
+            {{- include "hub.opentelemetry.apiSamplerEnv" $ | trim | nindent 12 }}
            {{- end }}
 {{- end }}
@@ -192,6 +192,8 @@ spec:
        # Google maps for using and displaying cameras, sites on a map
        - name: GOOGLEMAPS_KEY
          value: "{{ .Values.kerberoshub.frontend.googlemaps.apikey }}"
+        - name: GOOGLEMAPS_PLACES_API
+          value: "{{ .Values.kerberoshub.frontend.googlemaps.placesApi }}"

        # features > chart
        - name: CHART_COLORS
@@ -235,6 +237,8 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
        - name: FEATURE_AUDIT_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
+        - name: FEATURE_DAY_OVERVIEW_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.dayOverview.enabled }}"
        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
@@ -11,7 +11,7 @@ spec:
  ports:
  - protocol: TCP
    port: 80
-    targetPort: 80
+    targetPort: http
    name: http
  selector:
    app: hub-frontend
@@ -182,12 +182,16 @@ spec:
      - name: hub-frontend
        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
        imagePullPolicy: {{ .Values.kerberoshub.frontend.pullPolicy }}
+        {{- with .Values.kerberoshub.frontend.securityContext }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
        {{- with .Values.kerberoshub.frontend.resources }}
        resources:
          {{- toYaml . | nindent 12 }}
        {{- end }}
        ports:
-        - containerPort: 80
+        - containerPort: {{ .Values.kerberoshub.frontend.containerPort | default 80 }}
          name: http
        {{- with .Values.kerberoshub.frontend.volumeMounts}}
        volumeMounts:
@@ -275,6 +279,8 @@ spec:
        # Google maps for using and displaying cameras, sites on a map
        - name: GOOGLEMAPS_KEY
          value: "{{ .Values.kerberoshub.frontend.googlemaps.apikey }}"
+        - name: GOOGLEMAPS_PLACES_API
+          value: "{{ .Values.kerberoshub.frontend.googlemaps.placesApi }}"

        # Zendesk for support
        - name: ZENDESK_URL
@@ -314,6 +320,8 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
        - name: FEATURE_AUDIT_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
+        - name: FEATURE_DAY_OVERVIEW_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.dayOverview.enabled }}"
        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
@@ -67,6 +67,8 @@ spec:
            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-monitor-device") | nindent 12 }}
            - name: LOG_LEVEL
              value: "{{ .Values.kerberoshub.monitordevice.logLevel }}"
+            - name: DEVICE_SCAN_INTERVAL_SECONDS
+              value: "{{ .Values.kerberoshub.monitordevice.scanIntervalSeconds | default 60 }}"
            - name: READ_ONLY
              value: "{{ .Values.readonly }}"
            # Mail settings
@@ -82,6 +84,13 @@ spec:
              value: "{{ .Values.email.templates.device }}"
            - name: DEVICE_TITLE
              value: "{{ .Values.email.templates.deviceTitle }}"
+            - name: DEVICE_GROUP_TEMPLATE
+              value: "{{ .Values.email.templates.deviceGroup | default "device_group" }}"
+            - name: DEVICE_GROUP_TITLE
+              value: "{{ .Values.email.templates.deviceGroupTitle | default "[Device] Several cameras changed status" }}"
+            # Base URL for the link in grouped device notifications.
+            - name: PUBLIC_URL
+              value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"

            # - Plain SMTP
            - name: SMTP_SERVER
@@ -21,6 +21,64 @@ workflow later cannot silently alias another workflow's runs or references.
 {{- end -}}
 {{- $_ := set $identities $id $name -}}
 {{- end -}}
+{{- include "kerberoshub.workflows.validateSystemTags" . -}}
+{{- end -}}
+
+{{/*
+Guard the definitions that can select devices by system tag. The engine reads
+JSON keys case-insensitively and ignores unknown ones, so a misspelled or
+re-cased key silently changes what a definition selects (a dropped
+systemTags scope makes a global workflow run on every device). Therefore:
+  - definitions and triggers may only use the keys the engine knows, spelled
+    exactly (definition: id, enabled, triggers, stages; trigger: the
+    models.WorkflowTrigger fields);
+  - while deviceTags.system.enabled is false, no definition may mention system
+    tags anywhere (trigger systemTags, or a device.systemTags condition at any
+    depth, in triggers, shared conditions or stage needs), matched
+    case-insensitively on the whole definition;
+  - every system tag a trigger selects must be in deviceTags.system.catalog,
+    so a typo fails rendering instead of never matching a device.
+Disabled definitions are checked too, so enabling one cannot fail later.
+*/}}
+{{- define "kerberoshub.workflows.validateSystemTags" -}}
+{{- include "kerberoshub.deviceTags.system.validate" . -}}
+{{- $catalog := dict -}}
+{{- range $tag := (include "kerberoshub.deviceTags.system.catalog" . | fromJsonArray) -}}
+{{- $_ := set $catalog (toString $tag.key) true -}}
+{{- end -}}
+{{- $enabled := include "kerberoshub.deviceTags.system.enabled" . -}}
+{{- $definitionKeys := list "id" "enabled" "triggers" "stages" -}}
+{{- $triggerKeys := list "type" "edgeId" "sharedConditions" "devices" "siteIds" "groupIds" "systemTags" "classifications" "conditionMode" "conditions" "weeklySchedule" "surfaces" -}}
+{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
+{{- if $wf -}}
+{{- if not (kindIs "map" $wf) -}}
+{{- fail (printf "kerberoshub.workflows.definitions[%q] must be an object" $name) -}}
+{{- end -}}
+{{- if and (not $enabled) (contains "systemtags" (lower (toJson $wf))) -}}
+{{- fail (printf "kerberoshub.workflows.definitions[%q] selects devices by system tag (systemTags or a device.systemTags condition), but deviceTags.system.enabled is false" $name) -}}
+{{- end -}}
+{{- range $key, $_ := $wf -}}
+{{- if not (has $key $definitionKeys) -}}
+{{- fail (printf "kerberoshub.workflows.definitions[%q]: unknown key %q (allowed: %s). Keys are case-sensitive; a misspelled key would be ignored" $name $key (join ", " $definitionKeys)) -}}
+{{- end -}}
+{{- end -}}
+{{- range $i, $trigger := ($wf.triggers | default list) -}}
+{{- if not (kindIs "map" $trigger) -}}
+{{- fail (printf "kerberoshub.workflows.definitions[%q].triggers[%d] must be an object" $name $i) -}}
+{{- end -}}
+{{- range $key, $_ := $trigger -}}
+{{- if not (has $key $triggerKeys) -}}
+{{- fail (printf "kerberoshub.workflows.definitions[%q].triggers[%d]: unknown key %q (allowed: %s). Keys are case-sensitive; a misspelled key would be ignored and widen the trigger" $name $i $key (join ", " $triggerKeys)) -}}
+{{- end -}}
+{{- end -}}
+{{- range $tag := ($trigger.systemTags | default list) -}}
+{{- if not (hasKey $catalog (toString $tag)) -}}
+{{- fail (printf "kerberoshub.workflows.definitions[%q].triggers[%d].systemTags: %q is not in deviceTags.system.catalog; add it to the system tag catalog" $name $i (toString $tag)) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
 {{- end -}}

 {{/*
@@ -117,6 +117,14 @@ spec:
        - name: KERBEROS_STORAGE_PROVIDER
          value: {{ . | quote }}
        {{- end }}
+        {{- if $root.Values.opentelemetry.enabled }}
+
+        # OpenTelemetry tracing: the stage continues the engine's dispatch span
+        # (the run's traceparent) and follows its sampling decision.
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ $root.Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $root | trim | nindent 8 }}
+        {{- end }}

        # Per-stage tuning knobs. Any key/value under services.<name>.env is
        # rendered verbatim as container env, so a worker can be tuned from
@@ -122,6 +122,14 @@ spec:
        - name: SPRITE_ENABLED
          value: "{{ .Values.kerberospipeline.sprite.enabled }}"

+        # Dominant colors
+        - name: DOMINANTCOLOR_ENABLED
+          value: "{{ .Values.kerberospipeline.dominantColor.enabled }}"
+
+        # Thumbnail regeneration from classified frames (opt-in)
+        - name: THUMBNAIL_REGENERATION_ENABLED
+          value: {{ .Values.kerberospipeline.analysis.thumbnailRegeneration.enabled | default false | quote }}
+
        # In-memory cache for hot-path MongoDB lookups
        - name: DB_CACHE_ENABLED
          value: {{ .Values.kerberospipeline.analysis.dbCache.enabled | default false | quote }}
@@ -1,4 +1,4 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) (eq .Values.kerberospipeline.dominantColor.enabled true) -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -69,6 +69,8 @@ spec:
            name: mongodb-config
        env:
        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-sequence") | nindent 8 }}
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.sequence.logLevel }}"
        - name: CLOUD_PROVIDER
          value: "{{ .Values.cloudProvider }}"
        - name: QUEUE_SYSTEM
@@ -87,6 +87,10 @@ spec:
          value: "{{ .Values.rabbitmq.username }}"
        - name: RABBITMQ_PASSWORD
          value: "{{ .Values.rabbitmq.password }}"
+        {{- with .Values.kerberospipeline.sprite.prefetchCount }}
+        - name: RABBITMQ_PREFETCH_COUNT
+          value: {{ . | quote }}
+        {{- end }}

        # There is an option to store the sprites in a storage provider in Kerberos Vault.
        - name: VAULT_SPRITE_ENABLED
@@ -87,6 +87,10 @@ spec:
          value: "{{ .Values.rabbitmq.username }}"
        - name: RABBITMQ_PASSWORD
          value: "{{ .Values.rabbitmq.password }}"
+        {{- with .Values.kerberospipeline.thumbnail.prefetchCount }}
+        - name: RABBITMQ_PREFETCH_COUNT
+          value: {{ . | quote }}
+        {{- end }}

        # Thumbnail generation
        - name: THUMBNAIL_QUALITY
@@ -95,6 +99,8 @@ spec:
          value: "{{ .Values.kerberospipeline.thumbnail.width }}"
        - name: THUMBNAIL_HEIGHT
          value: "{{ .Values.kerberospipeline.thumbnail.height }}"
+        - name: THUMBNAIL_SKIP_NON_KEYFRAMES
+          value: "{{ .Values.kerberospipeline.thumbnail.skipNonKeyframes }}"

        # There is an option to store the thumbnails in a storage provider in Kerberos Vault.
        # This will lower storage in mongodb.
@@ -8,8 +8,53 @@
      "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
    },
    "classificationCatalog": {
-      "not": {},
-      "description": "Removed in 0.155.0. Store the complete catalog in a ConfigMap and use workflowConfiguration.configMaps with replace: true at catalogs/classifications.json."
+      "type": ["array", "null"],
+      "minItems": 1,
+      "description": "Optional inline classification catalog in the Hub shared choice catalog format; replaces the bundled defaults in the chart's classification-catalog ConfigMap. Omit (or null) for the bundled defaults. Keys must be unique (checked when rendering).",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["key", "label"],
+        "properties": {
+          "key": {"type": "string", "minLength": 1},
+          "label": {"type": "string", "minLength": 1},
+          "icon": {"type": "string", "minLength": 1}
+        }
+      }
+    },
+    "deviceTags": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "system": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Owners may assign system tags and global workflows may select devices by them. Only for deployments whose owners are trusted (self-hosted)."
+            },
+            "catalog": {
+              "type": "array",
+              "description": "The system tags owners can assign, in the Hub shared choice catalog format (key, label) plus an optional description. Keys must be unique (checked when rendering).",
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["key", "label"],
+                "properties": {
+                  "key": {
+                    "type": "string",
+                    "maxLength": 64,
+                    "pattern": "^[a-z0-9]([a-z0-9._:-]*[a-z0-9])?$"
+                  },
+                  "label": {"type": "string", "minLength": 1},
+                  "description": {"type": "string"}
+                }
+              }
+            }
+          }
+        }
+      }
    },
    "kerberoshub": {
      "type": "object",
@@ -17,6 +62,38 @@
        "api": {
          "type": "object",
          "properties": {
+            "passkeys": {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "enabled": {"type": "boolean"},
+                "rpId": {
+                  "type": "string",
+                  "description": "Stable WebAuthn relying-party hostname, without scheme, port or path. Must match each frontend origin's hostname or be its parent domain."
+                },
+                "origins": {
+                  "type": "array",
+                  "uniqueItems": true,
+                  "items": {
+                    "type": "string",
+                    "pattern": "^https://[^/?#]+$|^http://localhost(:[0-9]+)?$"
+                  },
+                  "description": "Exact trusted frontend origins, with no path or trailing slash. HTTPS is required except for HTTP localhost development."
+                },
+                "rpName": {"type": "string"}
+              },
+              "if": {
+                "required": ["enabled"],
+                "properties": {"enabled": {"const": true}}
+              },
+              "then": {
+                "required": ["rpId", "origins"],
+                "properties": {
+                  "rpId": {"minLength": 1},
+                  "origins": {"minItems": 1}
+                }
+              }
+            },
            "corsAllowedOrigins": {
              "type": "array",
              "items": {
@@ -82,8 +82,39 @@ classificationCatalogEnabled: true
 # When set, do not create a catalog ConfigMap; this replaces bundled defaults.
 classificationCatalogExistingConfigMap: ""
 # Defaults live in templates/configMaps/catalogs/classifications.yaml.
-# Inline classificationCatalog values are no longer accepted (including null/[]).
-# Use a ConfigMap item with path: catalogs/classifications.json and replace: true.
+# Optionally define the complete catalog inline instead; it replaces the
+# defaults in the chart's classification-catalog ConfigMap (and so the bundled
+# catalogs/classifications.json). Entries are {key, label, icon?} with unique
+# keys. Do not combine it with classificationCatalogExistingConfigMap or a
+# catalogs/classifications.json replacement in workflowConfiguration.
+# classificationCatalog:
+#   - key: car
+#     label: Car
+#     icon: car
+
+# Device tags, grouped by type. System tags are defined here and assigned by
+# owners (a multi-select on the device page); global workflows select devices
+# across organisations by system tag (`systemTags` in a trigger). Owners set
+# them, so any owner could enroll devices into such a workflow: enable only
+# where owners are the deployment's administrators (self-hosted), never on
+# multi-tenant SaaS. While disabled, hub-api gets an empty catalog (system tags
+# cannot be set) and rendering fails on workflows that select devices by
+# system tag.
+deviceTags:
+  system:
+    enabled: false # a boolean (true/false), not a string
+    # The only system tags owners can assign, in the Hub shared choice catalog
+    # format (as catalogs/classifications.json) plus an optional description.
+    # Rendered into the device-system-tags ConfigMap for hub-api.
+    #   key          stored tag: 1-64 characters of a-z, 0-9, ".", "_", ":" or
+    #                "-", starting and ending with a letter or digit; unique.
+    #   label        display name.
+    #   description  optional help text shown with the tag.
+    # Workflow trigger systemTags must exist here; otherwise rendering fails.
+    catalog: []
+    #  - key: anpr-pilot
+    #    label: ANPR pilot
+    #    description: Runs licence plate recognition on this camera

 # Configuration packaging only: consuming contracts requires a compatible
 # API/frontend. Enabling this mounts files but does not register stage workers.
@@ -97,7 +128,7 @@ workflowConfiguration:
  # Replacement requires includeDefaults: true and a known bundled destination path.
  # Unmarked collisions and repeated custom destinations are rejected.
  # Replacing catalogs/classifications.json also supplies the classification API:
-  # do not combine it with classificationCatalogExistingConfigMap.
+  # do not combine it with classificationCatalogExistingConfigMap or classificationCatalog.
  # Legacy existingConfigMap/items/extraConfigMaps remain supported, but cannot
  # be mixed with includeDefaults/configMaps. Both interfaces are omitted here
  # so Helm's default merging does not introduce a false mixed configuration.
@@ -178,17 +209,27 @@ opentelemetry:
    # the collector terminates TLS. A scheme-less value defaults to TLS and
    # fails against a plaintext collector ("server gave HTTP response to HTTPS client").
    endpoint: "http://otel-collector:4318"
-  # Trace sampling, passed to the services as OTEL_TRACES_SAMPLER and
-  # OTEL_TRACES_SAMPLER_ARG. Leave empty to keep the SDK default, which records
-  # every trace. Example: keep ~10% of traces, and follow the parent's decision
-  # for spans that continue an upstream trace:
-  #   type: "parentbased_traceidratio"
-  #   arg: "0.1"
-  # Supported types: always_on, always_off, traceidratio, parentbased_always_on,
-  # parentbased_always_off, parentbased_traceidratio.
-  sampler:
-    type: ""
-    arg: ""
+  # Trace sampling is decided where a trace starts:
+  # - Uploads start at the Vault, whose deployment sets their rate
+  #   (TRACE_SAMPLER_RATIO_UPLOAD / TRACE_SAMPLER_RATIO_OTHER).
+  # - hub-api starts its own traces; apiSamplingRatios below sets its rates.
+  # hub-workflows, the pipe-* services and the workflow stages only continue
+  # traces started elsewhere: they follow that decision and never start traces
+  # of their own (OTEL_TRACES_SAMPLER=parentbased_always_off, not configurable).
+  #
+  # apiSamplingRatios: hub-api's sampling ratio (0 to 1) per kind of work,
+  # rendered as TRACE_SAMPLER_RATIO_<CLASS> (hub-api on trace library v1.2.6+).
+  # Empty values are not rendered; with none set, hub-api records every trace.
+  #   operator: requests from users and API clients (UI, API tokens).
+  #   other:    everything else hub-api starts: device heartbeats, agent uploads
+  #             and live segments, background work, queries outside a request.
+  #             Unset with operator set: records everything.
+  # Example: ~10% of user requests, 1% of everything else:
+  #   operator: "0.1"
+  #   other: "0.01"
+  apiSamplingRatios:
+    operator: ""
+    other: ""
 ############################################
 # OpenAI configuration (semantic search)
 #
@@ -351,6 +392,13 @@ kerberoshub:

    # MFA issuer name
    mfaIssuer: "yourdomain.com"
+    # WebAuthn passkeys for users and sub-users; requires compatible API/frontend images.
+    # Use the public frontend hostname/origins, not the API URL. Keep rpId stable.
+    passkeys:
+      enabled: false
+      rpId: "" # e.g. "hub.example.com", without scheme, port or path.
+      origins: [] # e.g. ["https://hub.example.com"]; exact origins, no trailing slash.
+      rpName: "Kerberos Hub"
    # Admin API's are made available for automation of Kerberos Hub.
    # To access those API's (e.g. creation of owner users), an API key needs to be provided.
    apiKey: "a-random-admin-api-key"
@@ -426,6 +474,9 @@ kerberoshub:
    pullPolicy: IfNotPresent
    tag: "v1.13.9"
    replicas: 2
+    # Hardened frontend images listen on 8080; retain 80 for existing images.
+    containerPort: 80
+    securityContext: {}
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Set to false to skip rendering the hub-frontend Service (e.g. when an
    # external/shared Service is managed elsewhere).
@@ -551,6 +602,9 @@ kerberoshub:
      # Audit events are visible to owner/admin users when enabled.
      audit:
        enabled: "true" # Enable or disable the Audit events page and navigation link 'true' or 'false'
+      # Day overview page and its navigation menu; role page permissions still apply.
+      dayOverview:
+        enabled: "true" # Enable or disable the Day overview page and navigation menu 'true' or 'false'
      # Organisation controls remain visible as a read-only current organisation when switching is disabled.
      organisations:
        enabled: "" # Enable or disable the organisation feature family, including projects; when empty, child groups apply independently
@@ -675,6 +729,7 @@ kerberoshub:
      publicKey: ""
    googlemaps: # Google maps is used inside the application to visualise cameras and sites.
      apikey: "xxxx"
+      placesApi: "legacy" # Places API for address autocomplete: "legacy" (default) or "new" for keys with Places API (New) enabled. Uses the same apikey.
    zendesk: # We can use different support tools, for now we use Zendesk but others can be integrated
      url: "yourdomain.zendesk.com"
    posthog: # Posthog is used for auditing and user interaction logging
@@ -836,7 +891,9 @@ kerberoshub:
    #   triggers  how a run OPENS. Omit for a single bare automatic trigger
    #             (opens for every recording); the per-stage `needs` then decide
    #             which stages FIRE. Narrow with device/schedule triggers, e.g.
-    #             `- {type: automatic, devices: [{key: <device-key>}]}`.
+    #             `- {type: automatic, devices: [{key: <device-key>}]}`, or by
+    #             device label across organisations, e.g.
+    #             `- {type: automatic, systemTags: [anpr-pilot]}` (see deviceTags).
    #   stages    the executable stages, each {operation, dispatch?, needs?,
    #             needsMode?}. dispatch is "always" (default) or "conditional";
    #             a conditional stage's `needs` are upstream dependencies, each
@@ -1024,6 +1081,10 @@ kerberoshub:
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    logLevel: "info" # possible values: trace, debug, info, warn, error
+    # Seconds between device status scans. Sets how quickly a camera going
+    # offline/online is detected and, with "Group notifications" on, how long
+    # notifications are held to collect other cameras that change at the same time.
+    scanIntervalSeconds: 60
    resources:
      requests:
        memory: 10Mi
@@ -1155,6 +1216,7 @@ kerberospipeline:
    #volumeMounts:
    #  - name: extra
    #    mountPath: /data
+    logLevel: "info" # possible values: debug, info, warn, error
    resources:
      requests:
        memory: 10Mi
@@ -1229,7 +1291,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "40"
    pullPolicy: IfNotPresent
-    tag: "v1.8.5"
+    tag: "v1.8.22"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1240,6 +1302,12 @@ kerberospipeline:
    #  - name: extra
    #    mountPath: /data
    logLevel: "info" # possible values: trace, debug, info, warn, error
+    # Opt-in: after classification, re-enqueue the recording on the thumbnail
+    # queue to regenerate its thumbnail from the first frame of a tracked moving
+    # object (THUMBNAIL_REGENERATION_ENABLED). Adds one thumbnail job per
+    # classified recording; size pipe-thumbnail accordingly before enabling.
+    thumbnailRegeneration:
+      enabled: false
    # In-memory cache for hot-path MongoDB lookups (site vault per device).
    # Site changes apply after at most one TTL; each replica caches separately.
    dbCache:
@@ -1250,6 +1318,10 @@ kerberospipeline:
        memory: 10Mi
        cpu: 10m
  dominantColor:
+    # Opt-in: deploys pipe-dominantcolor and tells the analysis stage to schedule
+    # it (DOMINANTCOLOR_ENABLED). Requires an analysis image that reads the flag;
+    # older images always publish to the dominantcolor queue.
+    enabled: false # Enable or disable dominant color extraction 'true' or 'false'
    repository: ghcr.io/uug-ai/hub-pipeline-dominantcolors
    deploymentAnnotations: {}
    # deploymentAnnotations:
@@ -1279,8 +1351,9 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "50"
    pullPolicy: IfNotPresent
-    tag: "v1.3.10"
+    tag: "v1.3.15"
    replicas: 2 # Number of pods for the service.
+    prefetchCount: 0 # Max unacknowledged RabbitMQ messages per pod; 0 = service default (5).
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
    #volumes:
@@ -1293,6 +1366,7 @@ kerberospipeline:
    quality: "1" # 1 (best) - 31 (worst)
    width: "600"
    height: "-1"
+    skipNonKeyframes: true # Decode keyframes only for faster extraction; disable when exact-frame output is required.
    kerberosvault:
      enabled: true # If you want to use Kerberos Vault to store the thumbnails
    resources:
@@ -1330,8 +1404,9 @@ kerberospipeline:
    #   argocd.argoproj.io/sync-wave: "50"
    repository: ghcr.io/uug-ai/hub-pipeline-sprite
    pullPolicy: IfNotPresent
-    tag: "v1.1.16"
+    tag: "v1.1.21"
    replicas: 5 # Number of pods for the service.
+    prefetchCount: 0 # Max unacknowledged RabbitMQ messages per pod; 0 = service default (5).
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
    #volumes:
@@ -1409,5 +1484,9 @@ email:
    disabled: "disable"
    highupload: "highupload"
    device: "device"
+    # Sent instead of "device" when several cameras of an account change status
+    # in the same scan and the account groups device notifications.
+    deviceGroup: "device_group"
    alertTitle: "[Alert] Kerberos Hub detected something an event"
    deviceTitle: "[Device] A Kerberos Agent's status has been changed"
+    deviceGroupTitle: "[Device] Several cameras changed status"
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CHART_DIR="${1:-charts/hub}"
+
+extract_passkeys() {
+  awk '
+    /^---/ { deployment=0; name=""; variable="" }
+    /^kind: Deployment$/ { deployment=1 }
+    deployment && /^  name:/ { name=$2 }
+    deployment && /- name: PASSKEY_/ { variable=$3; next }
+    variable != "" && /value:/ {
+      value=$0
+      sub(/^[[:space:]]*value: /, "", value)
+      print name, variable, value
+      variable=""
+    }
+  ' | sort
+}
+
+assert_passkeys() {
+  local rendered="$1" expected="$2" actual count expected_count
+  actual="$(printf '%s\n' "$rendered" | extract_passkeys)"
+  if [[ "$actual" != "$expected" ]]; then
+    printf 'Unexpected passkey environment:\n%s\nExpected:\n%s\n' "$actual" "$expected" >&2
+    return 1
+  fi
+  count="$(printf '%s\n' "$rendered" | awk '/- name: PASSKEY_/ { count++ } END { print count+0 }')"
+  expected_count="$(printf '%s\n' "$expected" | awk 'NF { count++ } END { print count+0 }')"
+  if [[ "$count" != "$expected_count" ]]; then
+    echo "Passkey variables leaked outside the expected Deployment or were duplicated" >&2
+    return 1
+  fi
+}
+
+CONFIGURED_FLAGS=(
+  --set-json kerberoshub.api.passkeys.enabled=true
+  --set-json 'kerberoshub.api.passkeys.rpId="example.com"'
+  --set-json 'kerberoshub.api.passkeys.origins=["https://hub.example.com","https://legacy.example.com:8443"]'
+  --set-json 'kerberoshub.api.passkeys.rpName="Example Hub"'
+)
+expected="$(printf '%s\n' \
+  'hub-api PASSKEY_ORIGINS "https://hub.example.com,https://legacy.example.com:8443"' \
+  'hub-api PASSKEY_RP_ID "example.com"' \
+  'hub-api PASSKEY_RP_NAME "Example Hub"' | sort)"
+
+for mode in all ui pipeline; do
+  default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode")"
+  assert_passkeys "$default_render" ""
+  configured_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" "${CONFIGURED_FLAGS[@]}")"
+  if [[ "$mode" == pipeline ]]; then
+    assert_passkeys "$configured_render" ""
+  else
+    assert_passkeys "$configured_render" "$expected"
+  fi
+  echo "OK ($mode): defaults opt out; enabled settings affect Hub API only"
+done
+
+disabled_render="$(helm template hub "$CHART_DIR" "${CONFIGURED_FLAGS[@]}" --set kerberoshub.api.passkeys.enabled=false)"
+assert_passkeys "$disabled_render" ""
+
+localhost_render="$(helm template hub "$CHART_DIR" --set mode=ui \
+  --set kerberoshub.api.passkeys.enabled=true \
+  --set-string kerberoshub.api.passkeys.rpId=localhost \
+  --set-json 'kerberoshub.api.passkeys.origins=["http://localhost:4200"]')"
+assert_passkeys "$localhost_render" "$(printf '%s\n' \
+  'hub-api PASSKEY_ORIGINS "http://localhost:4200"' \
+  'hub-api PASSKEY_RP_ID "localhost"' \
+  'hub-api PASSKEY_RP_NAME "Kerberos Hub"' | sort)"
+
+legacy_render="$(helm template hub "$CHART_DIR" --set mode=ui \
+  --set-json 'kerberoshub.extraEnv=[{"name":"PASSKEY_RP_ID","value":"example.com"}]')"
+printf '%s\n' "$legacy_render" | grep -q -- '- name: PASSKEY_RP_ID'
+
+expect_invalid() {
+  local output
+  if output="$(helm template hub "$CHART_DIR" "${CONFIGURED_FLAGS[@]}" "$@" 2>&1)"; then
+    echo "Invalid passkey settings unexpectedly rendered: $*" >&2
+    return 1
+  fi
+  if [[ "$output" != *"passkeys"* ]]; then
+    printf 'Rendering failed for an unexpected reason:\n%s\n' "$output" >&2
+    return 1
+  fi
+}
+
+expect_invalid --set-string kerberoshub.api.passkeys.rpId=
+expect_invalid --set-json 'kerberoshub.api.passkeys.origins=[]'
+expect_invalid --set-json 'kerberoshub.api.passkeys.origins=["https://hub.example.com/"]'
+expect_invalid --set-json 'kerberoshub.api.passkeys.origins=["http://hub.example.com"]'
+expect_invalid --set-json 'kerberoshub.api.passkeys.origins=["https://hub.example.com","https://hub.example.com"]'
+expect_invalid --set-json 'kerberoshub.api.passkeys.origins="https://hub.example.com"'
+expect_invalid --set-json 'kerberoshub.api.passkeys.enabled="true"'
+expect_invalid --set-json 'kerberoshub.api.passkeys.rpId=123'
+expect_invalid --set-json 'kerberoshub.api.passkeys.rpName=123'
+expect_invalid --set-string kerberoshub.api.passkeys.origin=https://hub.example.com
+
+echo "All Hub passkey configuration checks passed."
@@ -51,21 +51,21 @@ expected="$(printf '%s\n' \
  'pipe-counting 50' 'pipe-sequence 60' 'pipe-monitor 70' | sort)"

 for mode in all pipeline; do
-  default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true)"
+  default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true --set kerberospipeline.dominantColor.enabled=true)"
  assert_waves "$default_render" ""
  if printf '%s\n' "$default_render" | grep -q '^  annotations: null'; then
    echo "Empty annotations must be omitted" >&2
    exit 1
  fi
-  configured_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true)"
+  configured_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true --set kerberospipeline.dominantColor.enabled=true)"
  assert_waves "$configured_render" "$expected"
  echo "OK ($mode): defaults opt out; per-service values assign all ten Deployment waves"
 done

-disabled_sprite="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=pipeline)"
-assert_waves "$disabled_sprite" "$(printf '%s\n' "$expected" | grep -v '^pipe-sprite ')"
+disabled_optional="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=pipeline)"
+assert_waves "$disabled_optional" "$(printf '%s\n' "$expected" | grep -v -e '^pipe-sprite ' -e '^pipe-dominantcolor ')"

-ui_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=ui --set kerberospipeline.sprite.enabled=true)"
+ui_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=ui --set kerberospipeline.sprite.enabled=true --set kerberospipeline.dominantColor.enabled=true)"
 assert_waves "$ui_render" ""

 # Exercise zero/negative strings and an unrelated annotation on the same map.
Author	SHA1	Message	Date
Cédric VerstraetenandCopilot	b520e2ecc1	Support hardened frontend ports and security context Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-10-26 18:20:57 +00:00
Cédric Verstraeten	c42388b96f	Merge pull request #204 from kerberos-io/feature/hub-passkey-configuration Add Hub API passkey configuration and bump chart to 0.167.0	2026-10-26 14:47:35 +01:00
Cédric VerstraetenandCopilot	04d6990460	feat(hub): configure API passkeys and bump chart to 0.167.0 Add opt-in API-only WebAuthn configuration, value validation, deployment documentation and rendering checks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-10-26 13:33:22 +00:00
KilianandClaude Opus 5.5	5af6472826	feat(hub): grouped device alerts — scan interval and device_group email (0.166.0) (#201 ) * feat(hub): configurable device scan interval for hub-monitor-device (0.166.0) kerberoshub.monitordevice.scanIntervalSeconds (default 60) is passed as DEVICE_SCAN_INTERVAL_SECONDS: the pause between device status scans, which also sets how long grouped device notifications are held. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(hub): device_group email for grouped camera status notifications - custom-layout/templates/device_group.html\|.txt: the email sent instead of device when several cameras of an account change status in one scan and the account groups device notifications. - email.templates.deviceGroup / deviceGroupTitle, passed to hub-monitor-device as DEVICE_GROUP_TEMPLATE / DEVICE_GROUP_TITLE, plus PUBLIC_URL for the link to the cameras page. - README: full reference for the device_group email (placeholders, how sections are built and rendered, custom templates, webhook device_statuses) and the correct {{status}} values of the device email. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(hub): device_group webhook data keys and whole-group section titles Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(hub): device_sections on grouped device webhooks Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(hub): name the device grouping toggle Group notifications Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(hub): drop device_statuses/device_sections webhook fields Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(hub): grouped device notifications skip webhooks and IFTTT; SMTP-only email Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-23 13:54:16 +02:00
KilianandClaude Opus 5.5	e0a273422e	feat(hub): one sampling model — follow-only downstream, per-class hub-api ratios (#200 ) * feat(hub): per-class trace sampling ratios for hub-api Add opentelemetry.apiSamplingRatios (operator, default), rendered for hub-api as TRACE_SAMPLER_RATIO_<CLASS> (trace library v1.2.5+): operator covers user and API-client requests, default everything else hub-api starts (device heartbeats, agent uploads and live segments, background work). Empty values are not rendered, so defaults leave the manifests unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(hub): one sampling model, follow-only downstream Downstream services (hub-workflows, pipe-, workflow stages) only continue traces started at the Vault or hub-api, so they now always render OTEL_TRACES_SAMPLER=parentbased_always_off when OpenTelemetry is enabled instead of a free-form opentelemetry.sampler, which a non-parent-based value would have turned into independent re-sampling. hub-api is configured only through opentelemetry.apiSamplingRatios (TRACE_SAMPLER_RATIO_<CLASS>); opentelemetry.apiSampler is removed. Neither removed value is used by any environment except production's sampler.type: parentbased_always_off, which is now the fixed behaviour, so production renders unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> refactor(hub): rename hub-api's catch-all sampling class to other trace v1.2.6 renames the catch-all class from default to other and rejects TRACE_SAMPLER_RATIO_DEFAULT. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-23 13:45:08 +02:00
Cédric Verstraeten	71e2db095e	Merge pull request #202 from kerberos-io/feature/pipeline-sequence-log-level feature/pipeline-sequence-log-level	2026-10-23 10:54:42 +02:00
Cédric Verstraeten	356f510ba9	Merge branch 'main' into feature/pipeline-sequence-log-level	2026-10-23 10:45:44 +02:00
Cédric Verstraeten	95ffe47edb	Configure sequence logs and thumbnail keyframes Expose Sequence LOG_LEVEL with an info default and document its configuration. Add thumbnail skipNonKeyframes, enabled by default for faster extraction. Bump the Hub chart to 0.159.1.	2026-10-23 10:44:59 +02:00
KilianandClaude Opus 5.5	abb22276ca	feat(hub): split the OTel sampler for hub-api and trace workflow stages (#199 ) opentelemetry.sampler now applies only to the services downstream of the Vault (hub-workflows, pipe-*, workflow stages), which continue the Vault's trace and should run parentbased_always_off; hub-api, which starts its own traces for user requests, gets opentelemetry.apiSampler. Workflow stages (hub-stage.yaml) had no OTEL_EXPORTER_OTLP_ENDPOINT, so their tracing ran in no-op mode; they now get the endpoint and the downstream sampler when opentelemetry is enabled. Defaults are empty, so the only rendered change is the stage endpoint. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 13:58:44 +02:00
KilianandClaude Opus 5.5	331df9d4af	docs(hub): document email template variables (#198 ) Explain how email templates are selected (SMTP files under /mail/templates vs built-in vs Mailgun), how the base and tenant URLs are built from kerberoshub.frontend, and which value each {{variable}} gets in the alert, camera status, account and sharing emails. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 16:08:18 +02:00
KilianandClaude Opus 5.5	17dd600872	feat(hub): make analysis thumbnail regeneration opt-in (0.163.0) (#197 ) Add kerberospipeline.analysis.thumbnailRegeneration.enabled (default false), passed to pipe-analysis as THUMBNAIL_REGENERATION_ENABLED. When enabled, analysis regenerates thumbnails from the first frame of a classified moving object, adding one thumbnail job per classified recording. Requires an analysis image that reads the flag. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 18:22:29 +02:00
KilianandClaude Opus 5.5	4880dc1197	feat(hub): allow defining the classification catalog inline in values (0.162.0) (#196 ) Restore the optional classificationCatalog values key removed in 0.155.0. A nonempty list ({key, label, icon?}, unique keys) replaces the bundled defaults in the chart's classification-catalog ConfigMap, so Hub API and the bundled catalogs/classifications.json share it. Omitted or null keeps the defaults; [] is rejected. Combining it with classificationCatalogEnabled: false, classificationCatalogExistingConfigMap or a classifications.json replacement fails rendering. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 15:24:00 +02:00
KilianandClaude Opus 5.5	805dfe405b	feat(hub): add frontend Google Places API selector (0.161.0) (#195 ) Add kerberoshub.frontend.googlemaps.placesApi, rendered as GOOGLEMAPS_PLACES_API on the hub-frontend and hub-frontend-demo deployments. Defaults to "legacy" so existing keys keep working; "new" switches address autocomplete to Places API (New) with the same apikey. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 15:14:23 +02:00
Kilian	e861dbecc3	Merge pull request #194 from kerberos-io/feat/workflow-label-triggers feat(hub): device system tags and system-tag global workflows (0.160.0)	2026-10-16 13:57:39 +02:00
Kilian BouteandClaude Opus 5.5	a35e701cb2	feat(hub): align the system tag catalog with the chart's catalog conventions - Catalog entries use the Hub shared choice catalog format (key, label) plus an optional description, as catalogs/classifications.json does. - values.schema.json now validates deviceTags (enabled boolean; entries with a stored-form key, a label, an optional description; no unknown keys), so mistakes fail like other values; templates keep the uniqueness and workflow cross-checks. - The catalog stays inline in values (Helm checks workflow systemTags against it) but reaches hub-api like the classification catalog: the device-system-tags ConfigMap mounted at /etc/kerberos/device-tags, named by DEVICE_SYSTEM_TAGS_FILE, with a checksum annotation. The DEVICE_SYSTEM_TAGS JSON env var is gone (hub-api#672 reads the file). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-16 08:24:21 +00:00
Kilian BouteandClaude Opus 5.5	7cddafbe93	feat(hub): harden the system tag gate for workflow definitions The engine reads JSON keys case-insensitively and ignores unknown ones, so the previous exact-path checks could be bypassed (SystemTags, nested or shared conditions, nested stage needs) and a typo (systemTag:, trigger:) silently removed a workflow's device scope. - While deviceTags.system.enabled is false, any mention of system tags in a definition (case-insensitive, any depth) fails rendering. - Definitions may only use id, enabled, triggers and stages, and triggers only the models.WorkflowTrigger fields, spelled exactly. - deviceTags.system.enabled must be a boolean; the string "false" enabled it. Production's definitions still render. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-16 08:07:41 +00:00
Kilian BouteandClaude Opus 5.5	5c6198eff2	feat(hub): rename device labels to typed device tags (system tags) Root deviceLabelsEnabled/deviceLabels become deviceTags.system.enabled and deviceTags.system.catalog, leaving room for more tag types. hub-api gets DEVICE_SYSTEM_TAGS, and workflow triggers select devices with systemTags (condition path device.systemTags). Matches uug-ai/models#284. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 08:47:47 +00:00
Kilian BouteandClaude Opus 5.5	f2ab8c8505	feat(hub): gate device labels with a root deviceLabelsEnabled flag Replace kerberoshub.workflows.labelTriggers (and hub-workflows' WORKFLOW_LABEL_TRIGGERS_ENABLED) with one deployment-wide switch next to the catalog. While it is off, hub-api gets an empty catalog and rendering fails on any workflow that selects devices by label (trigger labels or device.labels conditions). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 08:12:52 +00:00
Kilian BouteandClaude Opus 5.5	7472d44683	feat(hub): add the device label catalog Root deviceLabels is the deployment's device label catalog: the only labels owners can assign to devices (value, name, description). It is rendered as DEVICE_LABELS on hub-api; empty (the default) disables device labels. Labels are a device concept, so the catalog lives at the root next to the classification catalog; workflows only refer to it. Rendering fails when a catalog value is invalid or duplicated, or when a workflow trigger selects a label that is not in the catalog, so a typo cannot silently match no device. labelTriggers stays the separate trust switch for global workflows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 07:47:14 +00:00
Kilian BouteandClaude Opus 5.5	004377e69d	feat(hub): allow label-scoped global workflows (0.160.0) Add kerberoshub.workflows.labelTriggers (default false), rendered as WORKFLOW_LABEL_TRIGGERS_ENABLED on hub-workflows. It lets global workflow definitions select devices across organisations by owner-set device label (trigger `labels`); the engine refuses such definitions until it is enabled. Owners set labels, so enable it only where owners are trusted administrators (self-hosted), never on multi-tenant SaaS. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-15 07:16:11 +00:00
KilianandClaude Opus 5.5	664c587300	feat(hub): make the dominant color stage opt-in (#193 ) * feat(hub): make the dominant color stage opt-in Add kerberospipeline.dominantColor.enabled (default false). It gates the pipe-dominantcolor deployment and is projected to pipe-analysis as DOMINANTCOLOR_ENABLED, so the producer and consumer follow one value. Requires a hub-pipeline-analysis image that reads DOMINANTCOLOR_ENABLED: older images always publish to kcloud-dominantcolor-queue.fifo, which would back up once the consumer is removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore(hub): bump analysis to v1.8.22 for DOMINANTCOLOR_ENABLED v1.8.22 is the first hub-pipeline-analysis release that reads the flag (uug-ai/hub-pipeline-analysis#114). Chart version moves to 0.159.0 since 0.158.0 was taken on main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 14:52:23 +02:00
KilianandClaude Opus 5.5	c538f3da0b	feat(hub): add frontend day overview feature flag (0.158.0) (#192 ) Add kerberoshub.frontend.features.dayOverview.enabled, rendered as FEATURE_DAY_OVERVIEW_ENABLED on the hub-frontend and hub-frontend-demo deployments. Defaults to "true" so the Day overview page stays visible. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-14 14:35:36 +02:00
KilianandClaude Opus 5.5	40b17c5c37	feat(hub): make sprite and thumbnail prefetch count configurable (#191 ) Add kerberospipeline.{sprite,thumbnail}.prefetchCount, rendered as RABBITMQ_PREFETCH_COUNT only when greater than 0, and bump the images to the releases that read it (sprite v1.1.21, thumbnail v1.3.15). Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 13:17:45 +02:00