From e2b8560c65075ff076449153a3e8292d13d447dc Mon Sep 17 00:00:00 2001
From: Debian <linux@myhorse.netcell-it.de>
Date: Thu, 28 May 2026 15:23:30 +0200
Subject: [PATCH] fix(audit): log system.upgrade trigger

Upgrade war die einzige system-Mutation ohne Audit-Eintrag. Alle
anderen (maintenance, service-restart, haproxy-reload, IPv6, render-
configs, auto-update) loggen bereits. Jetzt wird system.upgrade mit
actor + unit-Name geloggt.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 VERSION                         | 2 +-
 cmd/edgeguard-api/main.go       | 2 +-
 cmd/edgeguard-ctl/main.go       | 2 +-
 cmd/edgeguard-scheduler/main.go | 2 +-
 internal/handlers/system.go     | 4 ++++
 5 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/VERSION b/VERSION
index c4c90b9..dc96943 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.1.131
+1.1.132
diff --git a/cmd/edgeguard-api/main.go b/cmd/edgeguard-api/main.go
index a8b1fd4..cb98d5c 100644
--- a/cmd/edgeguard-api/main.go
+++ b/cmd/edgeguard-api/main.go
@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-var version = "1.1.131"
+var version = "1.1.132"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
diff --git a/cmd/edgeguard-ctl/main.go b/cmd/edgeguard-ctl/main.go
index 3072bc5..97addf8 100644
--- a/cmd/edgeguard-ctl/main.go
+++ b/cmd/edgeguard-ctl/main.go
@@ -11,7 +11,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/setup"
 )
 
-var version = "1.1.131"
+var version = "1.1.132"
 
 const usage = `edgeguard-ctl — EdgeGuard CLI
 
diff --git a/cmd/edgeguard-scheduler/main.go b/cmd/edgeguard-scheduler/main.go
index 962aec4..1fc6f8f 100644
--- a/cmd/edgeguard-scheduler/main.go
+++ b/cmd/edgeguard-scheduler/main.go
@@ -41,7 +41,7 @@ import (
 	"git.netcell-it.de/projekte/edgeguard-native/internal/services/tlscerts"
 )
 
-var version = "1.1.131"
+var version = "1.1.132"
 
 const (
 	// renewTickInterval — how often we re-evaluate expiring certs.
diff --git a/internal/handlers/system.go b/internal/handlers/system.go
index 5f54b02..ac2ded4 100644
--- a/internal/handlers/system.go
+++ b/internal/handlers/system.go
@@ -881,6 +881,10 @@ rm -f /var/lib/edgeguard/upgrade.sh
 		_ = fallback.Process.Release()
 	}
 
+	if h.Audit != nil {
+		_ = h.Audit.Log(c.Request.Context(), actorOf(c), "system.upgrade",
+			"", gin.H{"unit": unitName}, h.NodeID)
+	}
 	c.JSON(http.StatusAccepted, response.Envelope{
 		Data:    gin.H{"status": "upgrading", "unit": unitName},
 		Error:   nil,