diff --git a/image-recipe/INTEGRATION-GUIDE.md b/image-recipe/INTEGRATION-GUIDE.md index 070e4e3e..7ebb0ced 100644 --- a/image-recipe/INTEGRATION-GUIDE.md +++ b/image-recipe/INTEGRATION-GUIDE.md @@ -63,7 +63,7 @@ The ISO build script should: ```ini [Service] User=root # Required for root Podman access -Environment="ARCHIPELAGO_BIND=0.0.0.0:5678" # Backend API port +Environment="ARCHIPELAGO_BIND=127.0.0.1:5678" # Backend API port Environment="ARCHIPELAGO_DEV_MODE=true" # Enable container auto-detection ``` diff --git a/image-recipe/ISO-BUILD-CHECKLIST.md b/image-recipe/ISO-BUILD-CHECKLIST.md index 907b1195..9f6ceb9b 100644 --- a/image-recipe/ISO-BUILD-CHECKLIST.md +++ b/image-recipe/ISO-BUILD-CHECKLIST.md @@ -55,7 +55,7 @@ Review and update if needed: Verify in `configs/archipelago.service`: - [ ] `User=root` (required for Podman root context) - [ ] `Environment="ARCHIPELAGO_DEV_MODE=true"` (enables container detection) -- [ ] `Environment="ARCHIPELAGO_BIND=0.0.0.0:5678"` +- [ ] `Environment="ARCHIPELAGO_BIND=127.0.0.1:5678"` Verify in `configs/nginx-archipelago.conf`: - [ ] Root path: `/opt/archipelago/web-ui` diff --git a/image-recipe/build-auto-installer-iso.sh b/image-recipe/build-auto-installer-iso.sh index 3e4d5f67..89ae450d 100755 --- a/image-recipe/build-auto-installer-iso.sh +++ b/image-recipe/build-auto-installer-iso.sh @@ -320,7 +320,7 @@ Wants=network-online.target [Service] Type=simple User=root -Environment="ARCHIPELAGO_BIND=0.0.0.0:5678" +Environment="ARCHIPELAGO_BIND=127.0.0.1:5678" Environment="ARCHIPELAGO_DEV_MODE=true" ExecStart=/usr/local/bin/archipelago Restart=on-failure @@ -1212,7 +1212,7 @@ Wants=network-online.target [Service] Type=simple User=root -Environment="ARCHIPELAGO_BIND=0.0.0.0:5678" +Environment="ARCHIPELAGO_BIND=127.0.0.1:5678" Environment="ARCHIPELAGO_DEV_MODE=true" ExecStartPre=/bin/bash -c 'mkdir -p /etc/archipelago && echo "ARCHIPELAGO_HOST_IP=$(hostname -I 2>/dev/null | awk \"{print \$1}\")" > /etc/archipelago/host-ip.env' ExecStart=/usr/local/bin/archipelago diff --git a/image-recipe/configs/archipelago.service b/image-recipe/configs/archipelago.service index c0a87d53..d468e469 100644 --- a/image-recipe/configs/archipelago.service +++ b/image-recipe/configs/archipelago.service @@ -6,7 +6,7 @@ Wants=network-online.target [Service] Type=notify User=archipelago -Environment="ARCHIPELAGO_BIND=0.0.0.0:5678" +Environment="ARCHIPELAGO_BIND=127.0.0.1:5678" # DEV_MODE disabled in production — enabled via override.conf on dev servers Environment="XDG_RUNTIME_DIR=/run/user/1000" ExecStartPre=/bin/bash -c 'mkdir -p /var/lib/archipelago && echo "ARCHIPELAGO_HOST_IP=$(hostname -I 2>/dev/null | awk "{print $$1}")" > /var/lib/archipelago/host-ip.env' diff --git a/neode-ui/src/views/Settings.vue b/neode-ui/src/views/Settings.vue index 6807df2a..e185f980 100644 --- a/neode-ui/src/views/Settings.vue +++ b/neode-ui/src/views/Settings.vue @@ -76,10 +76,40 @@
- +
- v1.2.0-alpha.9 + v1.3.0 + Mar 19, 2026 +
+
+
+

Full Security Audit

+

33 security findings from a comprehensive penetration test — all fixed. Backend now only accessible through nginx. Path traversal, SSRF, and XSS vulnerabilities eliminated. Federation requires cryptographic signatures. Session tokens rotate after 2FA. Destructive operations now require password confirmation.

+
+
+

Container Reliability

+

Memory limits on every container prevent one app from crashing the whole system. Crashed apps now show a red "crashed" badge with a restart button instead of disappearing. Smart health status shows "starting up", "healthy", or "unhealthy" in real time. Apps you stop stay stopped — no more auto-restart fighting.

+
+
+

Wallet on Home

+

The Home dashboard now shows your Bitcoin wallet with on-chain, Lightning, and ecash balances. Send, receive, and view transaction history right from the home screen. New Transactions modal shows your full history with confirmations.

+
+
+

LND Connect Fixed

+

Connect Your Wallet (Zeus, Zap, BlueWallet) now works over both local network and Tor. QR codes generate correctly with REST API access.

+
+
+

UI Polish

+

Mesh view redesigned. New glass button styles throughout. Restart button on running apps. Improved app status badges. Cleaner navigation on the Apps page.

+
+
+
+ + +
+
+ v1.2.0-alpha.9 Mar 18, 2026
diff --git a/scripts/deploy-to-target.sh b/scripts/deploy-to-target.sh index 4364ac88..7c66930a 100755 --- a/scripts/deploy-to-target.sh +++ b/scripts/deploy-to-target.sh @@ -789,6 +789,16 @@ MANIFEST_EOF sudo swapon /swapfile 2>/dev/null || true ' 2>&1 | tail -5 | sed 's/^/ /' || true + # Ensure backend binds to localhost only (security: no direct LAN access to port 5678) + progress "Securing backend bind address" + ssh $SSH_OPTS "$TARGET_HOST" ' + if grep -q "ARCHIPELAGO_BIND=0.0.0.0" /etc/systemd/system/archipelago.service 2>/dev/null; then + sudo sed -i "s/ARCHIPELAGO_BIND=0.0.0.0:5678/ARCHIPELAGO_BIND=127.0.0.1:5678/" /etc/systemd/system/archipelago.service + sudo systemctl daemon-reload + echo " Fixed: backend now binds to 127.0.0.1 only" + fi + ' 2>/dev/null || true + # Restart services progress "Restarting services" ssh $SSH_OPTS "$TARGET_HOST" "sudo systemctl start archipelago && sudo systemctl restart nginx"