d1bcf271f9
Closes failure mode FM5 from docs/bulletproof-containers.md: the v1.7.38 + v1.7.39 rollouts left every affected node on an unreachable UI (nginx 500) with no recovery path short of SSH. This release adds a self-check guardrail to the update flow. What changed: - apply_update() writes a pending-verify marker with old+new version and a 150s deadline immediately before scheduling the service restart. - verify_pending_update() runs from main.rs startup. If the marker is present and within its freshness window, the new binary waits 15s for nginx + backend to settle, then probes https://127.0.0.1/ every 5s for up to 90s (self-signed certs accepted). - On any probe success within the window, the marker is cleared and nothing else happens. - On window-exhaust, the new binary: 1. Moves the broken /opt/archipelago/web-ui to web-ui.failed.<ts> (quarantined, not deleted, so we can post-mortem). 2. Restores web-ui.bak on top of web-ui. 3. Calls rollback_update() to restore the previous binary. 4. Updates state.current_version to reflect the rollback. 5. systemctl --no-block restart archipelago so the OLD binary boots. - Markers older than 10 minutes are treated as stale and cleared without probing, so a crashed-during-startup marker from weeks ago cannot spontaneously roll back a healthy node on a later reboot. - rollback_update() binary copy now goes through host_sudo instead of tokio::fs::copy, so it escapes the service's ProtectSystem=strict mount namespace. Without this, the rollback silently failed with EROFS on /usr/local/bin and orphaned the rollback - the exact opposite of what auto-rollback is for. Tests: 4 new unit tests in update::tests covering marker round-trip, absent-marker noop, no-panic on verify_pending_update with nothing to verify, and an invariant assert that the 90s probe window stays below the 600s stale threshold. All passing. Side fix: scripts/create-release-manifest.sh was dying with exit 141 (SIGPIPE from tar tvzf pipe head pipe awk) under set -euo pipefail. Replaced with a single awk NR==1 that doesn't short-circuit the upstream pipe, so the release-build flow is idempotent again.
109 lines
2.9 KiB
TOML
109 lines
2.9 KiB
TOML
[package]
|
|
name = "archipelago"
|
|
version = "1.7.41-alpha"
|
|
edition = "2021"
|
|
description = "Archipelago Bitcoin Node OS - Native backend"
|
|
authors = ["Archipelago Team"]
|
|
|
|
[[bin]]
|
|
name = "archipelago"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
# Core dependencies
|
|
tokio = { version = "1", features = ["full"] }
|
|
serde = { version = "1.0", features = ["derive"] }
|
|
serde_json = "1.0"
|
|
anyhow = "1.0"
|
|
thiserror = "1.0"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
|
|
# HTTP and WebSocket
|
|
hyper = { version = "0.14", features = ["full", "http1"] }
|
|
hyper-util = { version = "0.1", features = ["full", "http1"] }
|
|
http-body-util = "0.1"
|
|
http-body = "1.0"
|
|
tower = "0.5"
|
|
tower-http = { version = "0.6", features = ["cors", "trace"] }
|
|
hyper-ws-listener = "0.3.0"
|
|
tokio-tungstenite = "0.20"
|
|
futures-util = "0.3"
|
|
|
|
# Our modules
|
|
archipelago-container = { path = "../container" }
|
|
archipelago-security = { path = "../security" }
|
|
archipelago-performance = { path = "../performance" }
|
|
|
|
|
|
# Database (optional for now - can use SQLite or skip)
|
|
# sqlx = { version = "0.7", features = ["sqlite", "runtime-tokio-rustls"] }
|
|
|
|
# Authentication
|
|
bcrypt = "0.15"
|
|
sha2 = "0.10.9"
|
|
hmac = "0.12.1"
|
|
uuid = { version = "1.0", features = ["v4"] }
|
|
regex = "1.10"
|
|
|
|
# Node identity (Ed25519 + X25519 key agreement)
|
|
ed25519-dalek = { version = "2.2.0", features = ["rand_core"] }
|
|
curve25519-dalek = "4.1.3"
|
|
rand = "0.8.5"
|
|
hex = "0.4"
|
|
bs58 = "0.5"
|
|
chrono = "0.4"
|
|
|
|
# BIP-39 mnemonic seed generation + BIP-32 HD key derivation
|
|
bip39 = { version = "=2.1.0", features = ["rand"] }
|
|
bitcoin = { version = "=0.32.5", features = ["rand-std"] }
|
|
|
|
# Configuration
|
|
toml = "0.8"
|
|
serde_yaml = "0.9"
|
|
|
|
# HTTP client (for LND REST proxy, Tor SOCKS for peer messaging)
|
|
# Uses rustls-tls for cross-compilation (no OpenSSL dependency)
|
|
reqwest = { version = "0.11", default-features = false, features = ["json", "socks", "rustls-tls"] }
|
|
|
|
# Nostr (node discovery + NIP-44 encrypted peer handshake)
|
|
nostr-sdk = { version = "0.44", features = ["nip04", "nip44"] }
|
|
|
|
# Backup encryption (DID identity export) + TOTP 2FA encryption
|
|
argon2 = "0.5.3"
|
|
chacha20poly1305 = "0.10.1"
|
|
base64 = "0.21"
|
|
|
|
# Full system backup (tar archive + gzip compression)
|
|
tar = "0.4"
|
|
flate2 = "1.0"
|
|
|
|
# TOTP 2FA
|
|
totp-rs = { version = "5.7", features = ["otpauth", "gen_secret"] }
|
|
qrcode = "0.14"
|
|
data-encoding = "2.6"
|
|
zeroize = { version = "1.8.2", features = ["derive"] }
|
|
|
|
# Mainline DHT (did:dht — BitTorrent DHT for decentralized identity)
|
|
mainline = "2"
|
|
zbase32 = "0.1"
|
|
bytes = "1"
|
|
|
|
# Mesh networking (Meshcore serial protocol over USB LoRa radios)
|
|
serial2-tokio = "0.1"
|
|
|
|
# Double Ratchet key derivation (Phase 3: encrypted mesh messaging)
|
|
hkdf = "0.12.4"
|
|
|
|
# Transport abstraction (Phase 2: mesh as federation transport)
|
|
ciborium = "0.2.2"
|
|
reed-solomon-erasure = "6.0"
|
|
mdns-sd = "0.18"
|
|
|
|
# Systemd watchdog notification
|
|
sd-notify = "0.4"
|
|
|
|
[dev-dependencies]
|
|
tokio-test = "0.4"
|
|
tempfile = "3.10"
|