fix: What's New v1.3.0, backend bind 127.0.0.1 in deploy + systemd, dead man's switch permissions
- Added v1.3.0 release notes to Settings "What's New" modal - Deploy script now auto-fixes backend bind address (0.0.0.0 → 127.0.0.1) - All image-recipe systemd/service files updated to 127.0.0.1 - Fixed dead man's switch: alert-config.json owned by root, now chown'd - Removed unused toggleAutoSync function (build error) - Deploy script adds LND REST port 8080 to Tor config generation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Dorian
parent
1a74a930f7
commit
c037db9d42
@ -63,7 +63,7 @@ The ISO build script should:
|
||||
```ini
|
||||
[Service]
|
||||
User=root # Required for root Podman access
|
||||
Environment="ARCHIPELAGO_BIND=0.0.0.0:5678" # Backend API port
|
||||
Environment="ARCHIPELAGO_BIND=127.0.0.1:5678" # Backend API port
|
||||
Environment="ARCHIPELAGO_DEV_MODE=true" # Enable container auto-detection
|
||||
```
|
||||
|
||||
|
||||
@ -55,7 +55,7 @@ Review and update if needed:
|
||||
Verify in `configs/archipelago.service`:
|
||||
- [ ] `User=root` (required for Podman root context)
|
||||
- [ ] `Environment="ARCHIPELAGO_DEV_MODE=true"` (enables container detection)
|
||||
- [ ] `Environment="ARCHIPELAGO_BIND=0.0.0.0:5678"`
|
||||
- [ ] `Environment="ARCHIPELAGO_BIND=127.0.0.1:5678"`
|
||||
|
||||
Verify in `configs/nginx-archipelago.conf`:
|
||||
- [ ] Root path: `/opt/archipelago/web-ui`
|
||||
|
||||
@ -320,7 +320,7 @@ Wants=network-online.target
|
||||
[Service]
|
||||
Type=simple
|
||||
User=root
|
||||
Environment="ARCHIPELAGO_BIND=0.0.0.0:5678"
|
||||
Environment="ARCHIPELAGO_BIND=127.0.0.1:5678"
|
||||
Environment="ARCHIPELAGO_DEV_MODE=true"
|
||||
ExecStart=/usr/local/bin/archipelago
|
||||
Restart=on-failure
|
||||
@ -1212,7 +1212,7 @@ Wants=network-online.target
|
||||
[Service]
|
||||
Type=simple
|
||||
User=root
|
||||
Environment="ARCHIPELAGO_BIND=0.0.0.0:5678"
|
||||
Environment="ARCHIPELAGO_BIND=127.0.0.1:5678"
|
||||
Environment="ARCHIPELAGO_DEV_MODE=true"
|
||||
ExecStartPre=/bin/bash -c 'mkdir -p /etc/archipelago && echo "ARCHIPELAGO_HOST_IP=$(hostname -I 2>/dev/null | awk \"{print \$1}\")" > /etc/archipelago/host-ip.env'
|
||||
ExecStart=/usr/local/bin/archipelago
|
||||
|
||||
@ -6,7 +6,7 @@ Wants=network-online.target
|
||||
[Service]
|
||||
Type=notify
|
||||
User=archipelago
|
||||
Environment="ARCHIPELAGO_BIND=0.0.0.0:5678"
|
||||
Environment="ARCHIPELAGO_BIND=127.0.0.1:5678"
|
||||
# DEV_MODE disabled in production — enabled via override.conf on dev servers
|
||||
Environment="XDG_RUNTIME_DIR=/run/user/1000"
|
||||
ExecStartPre=/bin/bash -c 'mkdir -p /var/lib/archipelago && echo "ARCHIPELAGO_HOST_IP=$(hostname -I 2>/dev/null | awk "{print $$1}")" > /var/lib/archipelago/host-ip.env'
|
||||
|
||||
@ -76,10 +76,40 @@
|
||||
</button>
|
||||
</div>
|
||||
<div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
|
||||
<!-- alpha.9 — Current -->
|
||||
<!-- v1.3.0 — Current -->
|
||||
<div>
|
||||
<div class="flex items-center gap-2 mb-3">
|
||||
<span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.2.0-alpha.9</span>
|
||||
<span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.3.0</span>
|
||||
<span class="text-xs text-white/40">Mar 19, 2026</span>
|
||||
</div>
|
||||
<div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
|
||||
<div>
|
||||
<h4 class="text-white font-medium mb-1">Full Security Audit</h4>
|
||||
<p>33 security findings from a comprehensive penetration test — all fixed. Backend now only accessible through nginx. Path traversal, SSRF, and XSS vulnerabilities eliminated. Federation requires cryptographic signatures. Session tokens rotate after 2FA. Destructive operations now require password confirmation.</p>
|
||||
</div>
|
||||
<div>
|
||||
<h4 class="text-white font-medium mb-1">Container Reliability</h4>
|
||||
<p>Memory limits on every container prevent one app from crashing the whole system. Crashed apps now show a red "crashed" badge with a restart button instead of disappearing. Smart health status shows "starting up", "healthy", or "unhealthy" in real time. Apps you stop stay stopped — no more auto-restart fighting.</p>
|
||||
</div>
|
||||
<div>
|
||||
<h4 class="text-white font-medium mb-1">Wallet on Home</h4>
|
||||
<p>The Home dashboard now shows your Bitcoin wallet with on-chain, Lightning, and ecash balances. Send, receive, and view transaction history right from the home screen. New Transactions modal shows your full history with confirmations.</p>
|
||||
</div>
|
||||
<div>
|
||||
<h4 class="text-white font-medium mb-1">LND Connect Fixed</h4>
|
||||
<p>Connect Your Wallet (Zeus, Zap, BlueWallet) now works over both local network and Tor. QR codes generate correctly with REST API access.</p>
|
||||
</div>
|
||||
<div>
|
||||
<h4 class="text-white font-medium mb-1">UI Polish</h4>
|
||||
<p>Mesh view redesigned. New glass button styles throughout. Restart button on running apps. Improved app status badges. Cleaner navigation on the Apps page.</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- alpha.9 -->
|
||||
<div>
|
||||
<div class="flex items-center gap-2 mb-3">
|
||||
<span class="text-xs font-mono px-2 py-0.5 rounded bg-white/10 text-white/60">v1.2.0-alpha.9</span>
|
||||
<span class="text-xs text-white/40">Mar 18, 2026</span>
|
||||
</div>
|
||||
<div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
|
||||
|
||||
@ -789,6 +789,16 @@ MANIFEST_EOF
|
||||
sudo swapon /swapfile 2>/dev/null || true
|
||||
' 2>&1 | tail -5 | sed 's/^/ /' || true
|
||||
|
||||
# Ensure backend binds to localhost only (security: no direct LAN access to port 5678)
|
||||
progress "Securing backend bind address"
|
||||
ssh $SSH_OPTS "$TARGET_HOST" '
|
||||
if grep -q "ARCHIPELAGO_BIND=0.0.0.0" /etc/systemd/system/archipelago.service 2>/dev/null; then
|
||||
sudo sed -i "s/ARCHIPELAGO_BIND=0.0.0.0:5678/ARCHIPELAGO_BIND=127.0.0.1:5678/" /etc/systemd/system/archipelago.service
|
||||
sudo systemctl daemon-reload
|
||||
echo " Fixed: backend now binds to 127.0.0.1 only"
|
||||
fi
|
||||
' 2>/dev/null || true
|
||||
|
||||
# Restart services
|
||||
progress "Restarting services"
|
||||
ssh $SSH_OPTS "$TARGET_HOST" "sudo systemctl start archipelago && sudo systemctl restart nginx"
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user