diff --git a/CHANGELOG.md b/CHANGELOG.md index 4c8ddf29..3ca2e5f6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## v1.7.117-alpha (2026-07-27) + +- FIPS startup is more reliable on nodes that have the packaged `fips.service` instead of Archipelago's `archipelago-fips.service`. Startup self-heal, onboarding, dashboard Start, and reconnect now use the systemd unit the node actually has, so FIPS no longer looks like it needs to be installed when it only needs to be started. +- App screens over the FIPS mesh now bind their relay only to the node's FIPS address instead of reserving the same host ports Podman needs. This keeps apps such as FileBrowser and Botfights from restart-looping because the backend was already holding their published ports. +- Public-source preparation now includes a Nostr Git hosting plan using `ngit`, NIP-34, and GRASP: anyone can clone, fork, review, and propose changes from their Archipelago node, while canonical merge authority stays with a small signed maintainer set in the style of Bitcoin Core. +- Node OS release notes for v1.7.117 are still open; add any installer, service, kernel, firewall, or package changes here before cutting the release. + ## v1.7.116-alpha (2026-07-27) - Nodes no longer get stuck on "server starting up" after an update or reboot. On a node running many apps, the backend used to spend minutes recovering containers before it told the system it was ready, and anything that touched it during that window could leave it down for good. It now reports ready immediately and recovers in the background, and it always restarts itself if it ever does go down. diff --git a/core/archipelago/src/api/rpc/seed_rpc.rs b/core/archipelago/src/api/rpc/seed_rpc.rs index 82daa407..a84762e5 100644 --- a/core/archipelago/src/api/rpc/seed_rpc.rs +++ b/core/archipelago/src/api/rpc/seed_rpc.rs @@ -56,12 +56,12 @@ pub(in crate::api::rpc) async fn save_pending_seed_encrypted( Ok(true) } -/// Best-effort: install fips.yaml + start archipelago-fips.service after the -/// seed onboarding has written the fips_key to disk. Runs in a detached task -/// so the user-facing RPC returns immediately — the systemctl calls can take -/// a few seconds the first time on slow hardware. Any failure is logged but -/// does not break onboarding; the user can still hit fips.install manually -/// from the dashboard as an escape hatch. +/// Best-effort: install fips.yaml + start the available FIPS systemd unit after +/// seed onboarding has written the fips_key to disk. Runs in a detached task so +/// the user-facing RPC returns immediately — the systemctl calls can take a few +/// seconds the first time on slow hardware. Any failure is logged but does not +/// break onboarding; the user can still hit fips.install manually from the +/// dashboard as an escape hatch. fn spawn_post_onboarding_fips_activate(data_dir: std::path::PathBuf) { tokio::spawn(async move { let identity_dir = data_dir.join("identity"); @@ -78,11 +78,12 @@ fn spawn_post_onboarding_fips_activate(data_dir: std::path::PathBuf) { tracing::warn!("post-onboarding fips config install failed: {}", e); return; } - if let Err(e) = crate::fips::service::activate(crate::fips::SERVICE_UNIT).await { - tracing::warn!("post-onboarding archipelago-fips activate failed: {}", e); + let unit = crate::fips::service::activation_unit().await; + if let Err(e) = crate::fips::service::activate(unit).await { + tracing::warn!("post-onboarding FIPS activate failed via {}: {}", unit, e); return; } - tracing::info!("archipelago-fips auto-activated post-onboarding"); + tracing::info!("FIPS auto-activated post-onboarding via {}", unit); }); } @@ -138,8 +139,8 @@ impl RpcHandler { // Initialize identity index at 0. crate::seed::save_identity_index(&self.config.data_dir, 0).await?; - // fips_key is now on disk — auto-activate archipelago-fips so the - // user doesn't have to hit an "Activate" button. Detached task; + // fips_key is now on disk — auto-activate FIPS so the user doesn't + // have to hit a manual Start button. Detached task; // the onboarding RPC returns immediately. spawn_post_onboarding_fips_activate(self.config.data_dir.clone()); diff --git a/core/archipelago/src/server.rs b/core/archipelago/src/server.rs index 904495ec..44aba302 100644 --- a/core/archipelago/src/server.rs +++ b/core/archipelago/src/server.rs @@ -891,7 +891,7 @@ impl Server { // Post-onboarding auto-activation for archipelago-fips. Runs once // at startup: if fips_key is on disk, install /etc/fips/fips.yaml // (schema-refreshed) and start the service. This removes the - // need for a user-facing "Activate" button — the node comes up + // need for a user-facing manual Start button — the node comes up // with FIPS running whenever the seed has been onboarded. Also // self-heals legacy raw-byte fips.key files (load_fips_keys // rewrites them as bech32 nsec the first time they're read). diff --git a/docs/OPEN-SOURCE-READINESS-PLAN.md b/docs/OPEN-SOURCE-READINESS-PLAN.md index 153717e6..378c0e7a 100644 --- a/docs/OPEN-SOURCE-READINESS-PLAN.md +++ b/docs/OPEN-SOURCE-READINESS-PLAN.md @@ -47,9 +47,10 @@ Completed locally in this pass: container/deployment docs toward public contributor expectations. - Fixed native FIPS activation fallback: nodes that have the packaged `fips.service` but not `archipelago-fips.service` now start the available - unit instead of repeatedly failing activation against a missing unit. The UI - now labels the action as `Start` instead of making native FIPS look like an - installable app. + unit instead of repeatedly failing activation against a missing unit. This + now covers startup, supervisor self-heal, manual dashboard start/reconnect, + and post-onboarding activation. The UI now labels the action as `Start` + instead of making native FIPS look like an installable app. - Fixed the FIPS app-port relay design so it binds relays to the node's FIPS ULA instead of wildcard `[::]`, avoiding collisions with Podman-published app ports such as FileBrowser `8083` and Botfights `9100`. diff --git a/neode-ui/src/views/settings/AccountInfoSection.vue b/neode-ui/src/views/settings/AccountInfoSection.vue index 6b2dfbff..edfc52be 100644 --- a/neode-ui/src/views/settings/AccountInfoSection.vue +++ b/neode-ui/src/views/settings/AccountInfoSection.vue @@ -362,6 +362,19 @@ init()
+ +
+
+ v1.7.117-alpha + July 27, 2026 +
+
+

FIPS startup is more reliable on nodes that have the packaged fips.service instead of Archipelago's archipelago-fips.service. Startup self-heal, onboarding, dashboard Start, and reconnect now use the systemd unit the node actually has, so FIPS no longer looks like it needs to be installed when it only needs to be started.

+

App screens over the FIPS mesh now bind their relay only to the node's FIPS address instead of reserving the same host ports Podman needs. This keeps apps such as FileBrowser and Botfights from restart-looping because the backend was already holding their published ports.

+

Public-source preparation now includes a Nostr Git hosting plan using ngit, NIP-34, and GRASP: anyone can clone, fork, review, and propose changes from their Archipelago node, while canonical merge authority stays with a small signed maintainer set in the style of Bitcoin Core.

+

Node OS release notes for v1.7.117 are still open; add any installer, service, kernel, firewall, or package changes here before cutting the release.

+
+