lfg2025/archy
1
0
Fork 0
Code Issues 16 Pull Requests Actions Packages Projects Releases 44 Wiki Activity

docs(hardening): record the four user decisions of 2026-07-08

Browse Source 
Bitcoin RPC loopback+gateway bind DONE dd61a204; version = 1.8.0-alpha;
bitcoin multi-version rides the next OTA; 3ccc RF validation dropped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
archipelago 2026-07-08 20:29:56 -04:00
parent dd61a20413
commit ffc1ebd0f3
1 changed files with 15 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
docs/1.8.0-RELEASE-HARDENING-PLAN.md
View File

@ -140,16 +140,14 @@ modules; production request/boot paths are essentially panic-free. The real risk
revalidate) instead of blocking on systemctl. `image_verifier.rs` cosign sites have no
callers yet — handled with the §A cosign item. Tests: container 155 / transport 29 /
config 29 / package 46 all green.
- [ ] 🟡 **Restrict Bitcoin RPC exposure.** INVESTIGATED 2026-07-03 — the fix is NOT
`rpcallowip`: under rootless-podman NAT every forwarded connection reaches bitcoind
with an in-subnet source IP, so scoping `rpcallowip` blocks nothing (and container
consumers use archy-net DNS anyway). The actual exposure is the host-side publish
`8332:8332` (binds 0.0.0.0 → LAN can hit RPC, auth-only barrier; 4 write sites:
`bootstrap.rs:424`, `package/config.rs:694`, `package/install.rs:1333/2450`, plus
the knots manifest). Real fix = `127.0.0.1:8332:8332` host bind (P2P 8333 stays
public; zmq 28332/28333 should get the same look — unauthenticated). ⚠ May break
external wallets pointed straight at nodeIP:8332 — needs a user call + on-node gate
re-run, so NOT changed drive-by from the dev box.
- [x] 🟡 **Restrict Bitcoin RPC exposure.** DECIDED (user, 2026-07-08: break external
wallets) + DONE `dd61a204`: manifest port mappings grew a validated `bind` field;
bitcoin-knots/-core publish 8332 on `127.0.0.1` + the archy-net gateway `10.89.0.1`
only (in-node consumers dial host.archipelago/host.containers.internal → 10.89.0.1,
unaffected; P2P 8333 stays public); legacy config.rs strings get the same incl.
unauthenticated ZMQ 28332/28333. Unbound ports render byte-identical (no false-drift
wave). **Still to roll out:** catalog regen + re-sign for catalog-covered nodes;
each node's bitcoin container recreates once on deploy → restart lnd after (IP cache).
- [x] 🟡 **Move secret env out of plaintext channels → podman secrets.** DONE 2026-07-05,
**VERIFIED ON .228 2026-07-08**: recreate wave settled (only fedimint-gateway lagged —
restart-sensitive, converged via a controlled quadlet restart, healthy, 0 plaintext
@ -360,11 +358,13 @@ media (latest artifact only one minor behind).
`config.rs:256` once the .5 gate reports clean.
- [ ] 🟠 **Developer CLI suite** (`archy app validate/render/install/test`) — gates external
app publishing (`APP-PACKAGING-MIGRATION-PLAN.md` step 5).
- [ ] ⛔🟡 **Version-naming decision** (`1.7.99-alpha` → `1.8.0` vs `1.8.00-alpha`) — a one-line
call, then a mechanical bump + tag. **Needs your decision.**
- [ ] ⛔🟢 **Bitcoin multi-version fleet OTA** — `.228` working on branch; rollout timing is
held for your call (`docs/bitcoin-version-bulletproof-rollout.md`).
- [ ] ⛔🟢 **3ccc stock-Meshtastic RF validation** — code fix in place; needs a live radio send.
- [ ] 🟡 **Version bump + tag** — DECIDED (user, 2026-07-08): the release ships as
**`1.8.0-alpha`**. Remaining work is the mechanical bump + `create-release.sh` run
when the gate criteria are met.
- [ ] 🟢 **Bitcoin multi-version fleet OTA** — DECIDED (user, 2026-07-08): timing doesn't
matter; fold the branch into the next fleet OTA (`docs/bitcoin-version-bulletproof-rollout.md`).
- [x] ~~⛔🟢 **3ccc stock-Meshtastic RF validation**~~ — DROPPED per user 2026-07-08; the
code fix stays in, no live-radio validation will be scheduled.
---