fix: complete fips unit fallback coverage
This commit is contained in:
Dorian
parent
709922c293
commit
70996203f9
@ -1,5 +1,12 @@
|
||||
# Changelog
|
||||
|
||||
## v1.7.117-alpha (2026-07-27)
|
||||
|
||||
- FIPS startup is more reliable on nodes that have the packaged `fips.service` instead of Archipelago's `archipelago-fips.service`. Startup self-heal, onboarding, dashboard Start, and reconnect now use the systemd unit the node actually has, so FIPS no longer looks like it needs to be installed when it only needs to be started.
|
||||
- App screens over the FIPS mesh now bind their relay only to the node's FIPS address instead of reserving the same host ports Podman needs. This keeps apps such as FileBrowser and Botfights from restart-looping because the backend was already holding their published ports.
|
||||
- Public-source preparation now includes a Nostr Git hosting plan using `ngit`, NIP-34, and GRASP: anyone can clone, fork, review, and propose changes from their Archipelago node, while canonical merge authority stays with a small signed maintainer set in the style of Bitcoin Core.
|
||||
- Node OS release notes for v1.7.117 are still open; add any installer, service, kernel, firewall, or package changes here before cutting the release.
|
||||
|
||||
## v1.7.116-alpha (2026-07-27)
|
||||
|
||||
- Nodes no longer get stuck on "server starting up" after an update or reboot. On a node running many apps, the backend used to spend minutes recovering containers before it told the system it was ready, and anything that touched it during that window could leave it down for good. It now reports ready immediately and recovers in the background, and it always restarts itself if it ever does go down.
|
||||
|
||||
@ -56,12 +56,12 @@ pub(in crate::api::rpc) async fn save_pending_seed_encrypted(
|
||||
Ok(true)
|
||||
}
|
||||
|
||||
/// Best-effort: install fips.yaml + start archipelago-fips.service after the
|
||||
/// seed onboarding has written the fips_key to disk. Runs in a detached task
|
||||
/// so the user-facing RPC returns immediately — the systemctl calls can take
|
||||
/// a few seconds the first time on slow hardware. Any failure is logged but
|
||||
/// does not break onboarding; the user can still hit fips.install manually
|
||||
/// from the dashboard as an escape hatch.
|
||||
/// Best-effort: install fips.yaml + start the available FIPS systemd unit after
|
||||
/// seed onboarding has written the fips_key to disk. Runs in a detached task so
|
||||
/// the user-facing RPC returns immediately — the systemctl calls can take a few
|
||||
/// seconds the first time on slow hardware. Any failure is logged but does not
|
||||
/// break onboarding; the user can still hit fips.install manually from the
|
||||
/// dashboard as an escape hatch.
|
||||
fn spawn_post_onboarding_fips_activate(data_dir: std::path::PathBuf) {
|
||||
tokio::spawn(async move {
|
||||
let identity_dir = data_dir.join("identity");
|
||||
@ -78,11 +78,12 @@ fn spawn_post_onboarding_fips_activate(data_dir: std::path::PathBuf) {
|
||||
tracing::warn!("post-onboarding fips config install failed: {}", e);
|
||||
return;
|
||||
}
|
||||
if let Err(e) = crate::fips::service::activate(crate::fips::SERVICE_UNIT).await {
|
||||
tracing::warn!("post-onboarding archipelago-fips activate failed: {}", e);
|
||||
let unit = crate::fips::service::activation_unit().await;
|
||||
if let Err(e) = crate::fips::service::activate(unit).await {
|
||||
tracing::warn!("post-onboarding FIPS activate failed via {}: {}", unit, e);
|
||||
return;
|
||||
}
|
||||
tracing::info!("archipelago-fips auto-activated post-onboarding");
|
||||
tracing::info!("FIPS auto-activated post-onboarding via {}", unit);
|
||||
});
|
||||
}
|
||||
|
||||
@ -138,8 +139,8 @@ impl RpcHandler {
|
||||
// Initialize identity index at 0.
|
||||
crate::seed::save_identity_index(&self.config.data_dir, 0).await?;
|
||||
|
||||
// fips_key is now on disk — auto-activate archipelago-fips so the
|
||||
// user doesn't have to hit an "Activate" button. Detached task;
|
||||
// fips_key is now on disk — auto-activate FIPS so the user doesn't
|
||||
// have to hit a manual Start button. Detached task;
|
||||
// the onboarding RPC returns immediately.
|
||||
spawn_post_onboarding_fips_activate(self.config.data_dir.clone());
|
||||
|
||||
|
||||
@ -891,7 +891,7 @@ impl Server {
|
||||
// Post-onboarding auto-activation for archipelago-fips. Runs once
|
||||
// at startup: if fips_key is on disk, install /etc/fips/fips.yaml
|
||||
// (schema-refreshed) and start the service. This removes the
|
||||
// need for a user-facing "Activate" button — the node comes up
|
||||
// need for a user-facing manual Start button — the node comes up
|
||||
// with FIPS running whenever the seed has been onboarded. Also
|
||||
// self-heals legacy raw-byte fips.key files (load_fips_keys
|
||||
// rewrites them as bech32 nsec the first time they're read).
|
||||
|
||||
@ -47,9 +47,10 @@ Completed locally in this pass:
|
||||
container/deployment docs toward public contributor expectations.
|
||||
- Fixed native FIPS activation fallback: nodes that have the packaged
|
||||
`fips.service` but not `archipelago-fips.service` now start the available
|
||||
unit instead of repeatedly failing activation against a missing unit. The UI
|
||||
now labels the action as `Start` instead of making native FIPS look like an
|
||||
installable app.
|
||||
unit instead of repeatedly failing activation against a missing unit. This
|
||||
now covers startup, supervisor self-heal, manual dashboard start/reconnect,
|
||||
and post-onboarding activation. The UI now labels the action as `Start`
|
||||
instead of making native FIPS look like an installable app.
|
||||
- Fixed the FIPS app-port relay design so it binds relays to the node's FIPS
|
||||
ULA instead of wildcard `[::]`, avoiding collisions with Podman-published app
|
||||
ports such as FileBrowser `8083` and Botfights `9100`.
|
||||
|
||||
@ -362,6 +362,19 @@ init()
|
||||
</button>
|
||||
</div>
|
||||
<div class="overflow-y-auto flex-1 min-h-0 space-y-6 pr-1">
|
||||
<!-- v1.7.117-alpha -->
|
||||
<div>
|
||||
<div class="flex items-center gap-2 mb-3">
|
||||
<span class="text-xs font-mono px-2 py-0.5 rounded bg-orange-500/20 text-orange-300">v1.7.117-alpha</span>
|
||||
<span class="text-xs text-white/40">July 27, 2026</span>
|
||||
</div>
|
||||
<div class="space-y-3 text-sm text-white/80 pl-3 border-l border-white/10">
|
||||
<p>FIPS startup is more reliable on nodes that have the packaged fips.service instead of Archipelago's archipelago-fips.service. Startup self-heal, onboarding, dashboard Start, and reconnect now use the systemd unit the node actually has, so FIPS no longer looks like it needs to be installed when it only needs to be started.</p>
|
||||
<p>App screens over the FIPS mesh now bind their relay only to the node's FIPS address instead of reserving the same host ports Podman needs. This keeps apps such as FileBrowser and Botfights from restart-looping because the backend was already holding their published ports.</p>
|
||||
<p>Public-source preparation now includes a Nostr Git hosting plan using ngit, NIP-34, and GRASP: anyone can clone, fork, review, and propose changes from their Archipelago node, while canonical merge authority stays with a small signed maintainer set in the style of Bitcoin Core.</p>
|
||||
<p>Node OS release notes for v1.7.117 are still open; add any installer, service, kernel, firewall, or package changes here before cutting the release.</p>
|
||||
</div>
|
||||
</div>
|
||||
<!-- v1.7.116-alpha -->
|
||||
<div>
|
||||
<div class="flex items-center gap-2 mb-3">
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user