security+feat: v1.3.0 — pentest remediation, container reliability, UI overhaul
Security (33 pentest findings addressed):
- CRITICAL: backend binds 127.0.0.1, path traversal in tor.rs/dwn fixed
- HIGH: federation requires signatures, XSS login redirect, RBAC viewer restricted
- HIGH: tar slip prevention, S3 SSRF validation, backup ID validation
- MEDIUM: remember-me random secret, TOTP session rotation, password re-auth
- LOW: CSP unsafe-inline removed, CORS dev-only, onion/webhook validation
Container reliability:
- Memory limits on all 37 containers (OOM prevention)
- Exited vs stopped state distinction with health-aware status badges
- Crash recovery coordination (no more restart cascade)
- User-stopped tracking survives reboots
- Tiered boot recovery (databases → core → services → apps)
UI:
- Wallet TransactionsModal, health-aware app status badges
- Restart button on containers, exited/crashed red state
- Mesh view overhaul, glass button updates, BaseModal/ToggleSwitch
- Apps sticky header removed, dev faucet, mutable mock wallet
Infrastructure:
- LND REST port 8080 exposed over Tor (LND Connect fix)
- Nginx cookie_session fix, deploy script Tor config updated
- Dev environment: podman auto-start, boot mode simulation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-19 12:44:31 +00:00
|
|
|
---
|
2026-03-19 23:03:11 +00:00
|
|
|
name: v1.3.0 Session Status (March 19 late)
|
|
|
|
|
description: Massive session — 33 pentest fixes, container reliability, federation, mesh channel, 30+ commits
|
security+feat: v1.3.0 — pentest remediation, container reliability, UI overhaul
Security (33 pentest findings addressed):
- CRITICAL: backend binds 127.0.0.1, path traversal in tor.rs/dwn fixed
- HIGH: federation requires signatures, XSS login redirect, RBAC viewer restricted
- HIGH: tar slip prevention, S3 SSRF validation, backup ID validation
- MEDIUM: remember-me random secret, TOTP session rotation, password re-auth
- LOW: CSP unsafe-inline removed, CORS dev-only, onion/webhook validation
Container reliability:
- Memory limits on all 37 containers (OOM prevention)
- Exited vs stopped state distinction with health-aware status badges
- Crash recovery coordination (no more restart cascade)
- User-stopped tracking survives reboots
- Tiered boot recovery (databases → core → services → apps)
UI:
- Wallet TransactionsModal, health-aware app status badges
- Restart button on containers, exited/crashed red state
- Mesh view overhaul, glass button updates, BaseModal/ToggleSwitch
- Apps sticky header removed, dev faucet, mutable mock wallet
Infrastructure:
- LND REST port 8080 exposed over Tor (LND Connect fix)
- Nginx cookie_session fix, deploy script Tor config updated
- Dev environment: podman auto-start, boot mode simulation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-19 12:44:31 +00:00
|
|
|
type: project
|
|
|
|
|
---
|
|
|
|
|
|
2026-03-19 23:03:11 +00:00
|
|
|
## Deployed to .228 + .198
|
2026-03-19 16:12:01 +00:00
|
|
|
|
2026-03-19 23:03:11 +00:00
|
|
|
### What's Live
|
|
|
|
|
- All 33 pentest security fixes (backend + frontend + nginx)
|
2026-03-19 16:12:01 +00:00
|
|
|
- Container reliability: memory limits in scripts, crash recovery coordination, health badges
|
2026-03-19 23:03:11 +00:00
|
|
|
- Federation & Peers: DID persistence, rotation, node names, two-column layout, invite types
|
|
|
|
|
- Archipelago public channel in Mesh (Tor messaging)
|
|
|
|
|
- LND Connect with CORS fix (bulletproof)
|
|
|
|
|
- ElectrumX headers.subscribe fix
|
|
|
|
|
- FileBrowser auto-login
|
|
|
|
|
- Lightning channel backup export
|
|
|
|
|
- App iframe auto-retry
|
|
|
|
|
- Install progress persists across navigation
|
2026-03-19 16:12:01 +00:00
|
|
|
|
2026-03-19 23:03:11 +00:00
|
|
|
### Active Bugs (fix next session)
|
|
|
|
|
1. **Archipelago channel**: sent messages don't show to sender (no local echo), .228 says "no peers found"
|
|
|
|
|
2. **Web5 Send Message modal**: should redirect to Mesh chat, not show its own modal
|
|
|
|
|
3. **Cloud peer files**: "Operation failed" when browsing .198 files from .228 — Tor connection issue
|
|
|
|
|
4. **Server name save**: not persisting — no `server-name.txt` on server
|
|
|
|
|
5. **Node names**: still showing DIDs in some places (cloud peer header, some federation contexts)
|
|
|
|
|
6. **Tor**: ControlPort 0 fix applied manually but needs to be in deploy script/torrc generation
|
|
|
|
|
7. **Connected Nodes container**: not filling height, needs max-height fix in Web5 view
|
2026-03-19 16:12:01 +00:00
|
|
|
|
2026-03-19 23:03:11 +00:00
|
|
|
### Outstanding Tasks
|
|
|
|
|
- Tor restart button in Network UI
|
|
|
|
|
- Auto-restart Tor when features fail
|
|
|
|
|
- ISO build for alpha tester
|
|
|
|
|
- Deploy to Tailscale nodes (Arch 1/2/3)
|
|
|
|
|
- .198 stabilization (containers, memory limits)
|
|
|
|
|
- Container memory limits recreation on existing servers
|
|
|
|
|
- Meshcore public channel investigation (radio messages not showing)
|
|
|
|
|
- AIUI API key settings
|
|
|
|
|
- Message notification → open Mesh chat (not Web5)
|
|
|
|
|
- Loading state on Archipelago channel send ("Decentralization takes a sec")
|
2026-03-19 16:12:01 +00:00
|
|
|
|
2026-03-19 23:03:11 +00:00
|
|
|
### Deploy Notes
|
|
|
|
|
- Backend binary: atomic swap via `cp -new` + `mv`
|
|
|
|
|
- Tor fix: remove `ControlPort 0` from torrc, chown debian-tor
|
|
|
|
|
- LND UI: rebuild with `--no-cache` for CORS credentials fix
|
|
|
|
|
- Always sync: frontend, nginx config, docker UIs, scripts, core source
|
2026-03-19 16:12:01 +00:00
|
|
|
|
2026-03-19 23:03:11 +00:00
|
|
|
**Why:** Session continuity for the massive v1.3.0 effort.
|
|
|
|
|
**How to apply:** Read at start of next session. Fix active bugs first, then ISO build.
|