diff --git a/.gitignore b/.gitignore index 9d9e082a..3e1610e0 100644 --- a/.gitignore +++ b/.gitignore @@ -92,6 +92,23 @@ scripts/resilience/reports/ .codex-tmp/ .claude/ .pnpm-store/ + +# Key material and local databases — belt-and-braces so a stray key or a +# copied node database can never be committed. Open-source readiness plan, +# Phase 1 item 5: `.claude/settings.local.json` was previously only caught by +# a machine-global ignore rule, which protects one machine and no contributor. +*.key +*.pem +id_rsa* +*.sqlite +*.sqlite3 +*.db + +# ...except the throwaway TLS fixtures the appgate tests compile in via +# include_bytes!. They are documented non-identity material (see that +# directory's README) and are already tracked; the negation stops the rule +# above from silently dropping them if they are ever regenerated. +!core/archipelago/src/appgate/testdata/*.key **/__pycache__/ *.bak diff --git a/CHANGELOG.md b/CHANGELOG.md index 56c264ed..caea6164 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -460,14 +460,14 @@ - Saleor storefront proxying now forwards `X-Forwarded-Host`, fixing Next.js Server Actions requests that compared the browser origin with the internal `storefront-app:3000` upstream host. - Saleor storefront media now routes `/thumbnail/` and `/media/` through the same `9011` proxy to the Saleor API, fixing product image optimizer failures caused by `localhost:8000` media URLs. - The Saleor storefront container receives an explicit internal media origin so rewritten media URLs resolve inside the Podman network without exposing private API ports to browsers. -- Validation passed with `cargo fmt --all --check --manifest-path core/Cargo.toml`, `cargo check -p archipelago --manifest-path core/Cargo.toml`, and live checks on `100.114.134.21` for storefront HTML, static assets, GraphQL, media redirects, and optimized product images. +- Validation passed with `cargo fmt --all --check --manifest-path core/Cargo.toml`, `cargo check -p archipelago --manifest-path core/Cargo.toml`, and live checks on the staging node for storefront HTML, static assets, GraphQL, media redirects, and optimized product images. ## v1.7.81-alpha (2026-05-21) - Saleor storefront installs now use the prebuilt registry image instead of building the Next.js app on-device, avoiding Podman build failures during stack installation. - Existing Saleor stacks are repaired on adoption by recreating missing storefront containers, forcing the storefront app to bind `0.0.0.0:3000`, and resolving nginx upstreams dynamically after container restarts. - The shipped Saleor storefront image now includes public assets and omits Vercel-only Speed Insights injection, fixing broken static asset responses and the local `/_vercel/speed-insights/script.js` browser warning. -- Validation passed with `cargo fmt --all --check --manifest-path core/Cargo.toml`, `cargo check -p archipelago --manifest-path core/Cargo.toml`, and live checks on `100.114.134.21` for `9011` storefront, static assets, and proxied GraphQL. +- Validation passed with `cargo fmt --all --check --manifest-path core/Cargo.toml`, `cargo check -p archipelago --manifest-path core/Cargo.toml`, and live checks on the staging node for `9011` storefront, static assets, and proxied GraphQL. ## v1.7.80-alpha (2026-05-21) @@ -498,7 +498,7 @@ - Saleor installs now create or repair the `admin@example.com` staff account idempotently after sample data loads, use the correct dashboard mount path, and re-check stack containers after startup so stopped containers are caught. - NetBird embedded login now uses the upstream-compatible IdP signing-key behavior and sends ID tokens from the dashboard to the management API, fixing the post-signup `Unauthenticated` state while preserving the unified local proxy/logout routes. - Transient unnamed Podman helper containers created during app install tasks are hidden from My Apps, so generated names like `eager_keldysh` no longer appear as user applications. -- Validation passed with catalog/release JSON checks, `npm run type-check`, and `cargo fmt --all --check --manifest-path core/Cargo.toml`; live checks on `100.114.134.21` confirmed Saleor dashboard/API availability, generated Saleor admin login, NetBird OAuth availability, and NetBird logout redirects. +- Validation passed with catalog/release JSON checks, `npm run type-check`, and `cargo fmt --all --check --manifest-path core/Cargo.toml`; live checks on the staging node confirmed Saleor dashboard/API availability, generated Saleor admin login, NetBird OAuth availability, and NetBird logout redirects. ## v1.7.76-alpha (2026-05-20) @@ -529,7 +529,7 @@ - Mobile app launches for iframe-blocked apps now open the direct app URL in a new browser tab immediately instead of landing in a broken in-shell webview that requires a second tap. - Mobile My Apps/Websites tabs now react to route query changes, App Store pages label the mobile view as Discover, mobile filters have safe bottom spacing, and App Store search ignores the current category so searches cover all available apps. - My Apps search now surfaces matching App Store entries when the app is not installed, making it possible to jump directly from a failed My Apps search to the installable app details. -- NetBird self-host installs now prefer a `100.x` tailnet/CGNAT address for dashboard, management, relay, STUN, and auth redirect origins when one is present; live repair on `100.89.209.89` updated the existing stack from LAN origins to `100.89.209.89` and restored `netbird-server`. +- NetBird self-host installs now prefer a `100.x` tailnet/CGNAT address for dashboard, management, relay, STUN, and auth redirect origins when one is present; live repair on a fleet node updated the existing stack from LAN origins to its tailnet address and restored `netbird-server`. - App-session iframe frames now focus automatically and wrap the iframe in a scroll host so wheel/touch scrolling works in the active right frame without requiring an initial click. ## v1.7.72-alpha (2026-05-19) diff --git a/apps/fedimint/manifest.yml b/apps/fedimint/manifest.yml index f7a1cfbb..213ac459 100644 --- a/apps/fedimint/manifest.yml +++ b/apps/fedimint/manifest.yml @@ -67,7 +67,7 @@ app: # companion, a different container, and declaring it on this app made the # orchestrator try to publish 8175 from fedimintd — colliding with the # companion that already holds it, so start_container failed forever and - # fedimint crash-looped (100.82.34.38, 2026-08-05). The companion's nginx + # fedimint crash-looped (a fleet node, 2026-08-05). The companion's nginx # is pinned to 127.0.0.1, which is what actually closes that port; the # gate reports it rather than fronting it. - host: 8177 diff --git a/core/archipelago/src/api/rpc/package/pine_ha.rs b/core/archipelago/src/api/rpc/package/pine_ha.rs index 6ed13805..839693ca 100644 --- a/core/archipelago/src/api/rpc/package/pine_ha.rs +++ b/core/archipelago/src/api/rpc/package/pine_ha.rs @@ -725,7 +725,7 @@ async fn seed_assist_pipeline(storage: &std::path::Path, claude_entity: Option<& /// HA's zeroconf discovery stores a satellite as a fixed LAN IP. DHCP /// renumbering — or the whole node moving to a different network — strands /// the entry and the speaker silently drops (a test node 2026-07-23: entry -/// pinned to 192.0.2.16 while the LAN had become 192.168.63.0/24). HA +/// pinned to 192.0.2.16 while the LAN had become 192.0.2.0/24). HA /// never re-resolves on its own. This keeper probes each satellite entry and, /// when one stops answering, sweeps the node's local /24s for the same /// Wyoming port and rewrites the entry to the address that answers. diff --git a/core/archipelago/src/appgate/mod.rs b/core/archipelago/src/appgate/mod.rs index 9b104c9c..89ca818a 100644 --- a/core/archipelago/src/appgate/mod.rs +++ b/core/archipelago/src/appgate/mod.rs @@ -773,7 +773,7 @@ button:active {{ transform:translateY(1px); }} // NOT X-Frame-Options: DENY. My Apps opens an app in an embedded // frame, so a blanket DENY made every gated app render as "app is // not responding" the moment the gate challenged it (reported on - // 100.82.34.38, 2026-08-05). frame-ancestors is the modern control + // a fleet node, 2026-08-05). frame-ancestors is the modern control // and can be precise: only pages from this same node may frame the // login, on any port or scheme, which is exactly the dashboard. // Anything else — another site embedding it to harvest the node @@ -904,7 +904,7 @@ mod tests { /// The challenge must be framable by this node's own dashboard — My Apps /// opens apps in an embedded frame, and a blanket `X-Frame-Options: DENY` - /// turned every gated app into "app is not responding" (100.82.34.38, + /// turned every gated app into "app is not responding" (observed on a fleet node, /// 2026-08-05). It must still be uncacheable, and still refuse to be /// framed by a foreign origin, which `frame-ancestors` expresses and /// `X-Frame-Options` cannot. diff --git a/core/archipelago/src/fips/anchors.rs b/core/archipelago/src/fips/anchors.rs index fa702ffe..61f9959f 100644 --- a/core/archipelago/src/fips/anchors.rs +++ b/core/archipelago/src/fips/anchors.rs @@ -477,19 +477,19 @@ mod tests { fn lan_fips_anchors_builds_direct_entry() { let peer = crate::transport::PeerRecord { did: "did:key:zpeer".to_string(), - lan_address: Some("192.168.63.198:5678".to_string()), + lan_address: Some("192.0.2.198:5678".to_string()), fips_npub: Some("npub1peer".to_string()), ..Default::default() }; let out = lan_fips_anchors(&[peer]); assert_eq!(out.len(), 1); - assert_eq!(out[0].address, format!("192.168.63.198:{FIPS_UDP_PORT}")); + assert_eq!(out[0].address, format!("192.0.2.198:{FIPS_UDP_PORT}")); assert_eq!(out[0].transport, "udp"); // Peers missing either the LAN address or the npub produce nothing. let no_npub = crate::transport::PeerRecord { did: "did:key:zother".to_string(), - lan_address: Some("192.168.63.199:5678".to_string()), + lan_address: Some("192.0.2.199:5678".to_string()), ..Default::default() }; assert!(lan_fips_anchors(&[no_npub]).is_empty()); diff --git a/core/archipelago/src/fips/endpoints.rs b/core/archipelago/src/fips/endpoints.rs index 7fbcd9a0..ed266ff3 100644 --- a/core/archipelago/src/fips/endpoints.rs +++ b/core/archipelago/src/fips/endpoints.rs @@ -153,11 +153,11 @@ mod tests { let dir = tempfile::tempdir().unwrap(); let connected = vec![ConnectedPeer { npub: "npub1aaa".into(), - address: "100.114.134.21:2121".into(), + address: "100.64.0.21:2121".into(), transport: "udp".into(), }]; let map = record_connected(dir.path(), &connected).await; - assert_eq!(map["npub1aaa"].address, "100.114.134.21:2121"); + assert_eq!(map["npub1aaa"].address, "100.64.0.21:2121"); let reloaded = load(dir.path()).await; assert_eq!(reloaded, map); } @@ -192,7 +192,7 @@ mod tests { let connected = vec!["npub1conn".to_string()]; let lan = vec![SeedAnchor { npub: "npub1lan".into(), - address: "192.168.63.198:2121".into(), + address: "192.0.2.198:2121".into(), transport: "udp".into(), label: "LAN".into(), }]; diff --git a/neode-ui/mock-backend.js b/neode-ui/mock-backend.js index 3cb0f65b..9e92f789 100755 --- a/neode-ui/mock-backend.js +++ b/neode-ui/mock-backend.js @@ -2881,7 +2881,7 @@ app.post('/rpc/v1', (req, res) => { { name: 'wlan0', type: 'wifi', state: 'up', mac: 'dc:a6:32:12:ab:cd', ipv4: ['192.0.2.14/24'] }, { name: 'lo', type: 'loopback', state: 'up', mac: '00:00:00:00:00:00', ipv4: ['127.0.0.1/8'] }, { name: 'podman0', type: 'bridge', state: 'up', mac: '2e:f4:8a:11:22:33', ipv4: ['10.89.0.1/16'] }, - { name: 'tailscale0', type: 'tunnel', state: 'up', mac: '', ipv4: ['100.82.97.63/32'] }, + { name: 'tailscale0', type: 'tunnel', state: 'up', mac: '', ipv4: ['100.64.0.63/32'] }, ], }, }) @@ -3079,7 +3079,7 @@ app.post('/rpc/v1', (req, res) => { { did: 'did:key:z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH', onion: 'disc2xyz9wvu8tsr7qpo6nml5kji4hgf3edc2ba.onion', pubkey: 'disc2pub', node_address: '192.0.2.51' }, { did: 'did:key:z6MkfV2sQpXm4d8YtR1nWc7uHb3eKj9gLa5xPzD6oTiN8rEw', onion: 'disc3mn04pq15rs26tu37vw48xy59za60bc71de.onion', pubkey: 'disc3pub', node_address: '192.0.2.72' }, { did: 'did:key:z6MkrJ8pWx2yNc5vT9qLb4eHu7dKf1gMa3sPzE6oXiQ8nRvw', onion: 'disc4fg82hi93jk04lm15no26pq37rs48tu59vw.onion', pubkey: 'disc4pub', node_address: '100.64.0.6' }, - { did: 'did:key:z6MkhT4wQn8xPc2vL6sRb9eYu3dJf7gKa1mNzD5oWiE8tXvq', onion: 'disc5xy60za71bc82de93fg04hi15jk26lm37no.onion', pubkey: 'disc5pub', node_address: '100.101.7.23' }, + { did: 'did:key:z6MkhT4wQn8xPc2vL6sRb9eYu3dJf7gKa1mNzD5oWiE8tXvq', onion: 'disc5xy60za71bc82de93fg04hi15jk26lm37no.onion', pubkey: 'disc5pub', node_address: '100.64.0.23' }, ], }, }) diff --git a/tests/mesh/run-mesh-tests.sh b/tests/mesh/run-mesh-tests.sh index 7911dd8e..e55597bf 100755 --- a/tests/mesh/run-mesh-tests.sh +++ b/tests/mesh/run-mesh-tests.sh @@ -11,7 +11,7 @@ # Usage: # tests/mesh/run-mesh-tests.sh # layers 1+2 # MESH_TEST_LIVE=1 MESH_TEST_PW='...' tests/mesh/run-mesh-tests.sh -# MESH_TEST_HOST=100.113.100.55 ... # live-test a remote node +# MESH_TEST_HOST=100.64.0.55 ... # live-test a remote node set -u cd "$(dirname "$0")/../.." FAIL=0