jd/rosbackup-packagemini
1
0
Fork 0
Code Issues Pull requests Projects Releases 6 Packages Wiki Activity Actions
6 releases 7 tags
  • v0.2.6 57712e552d

    v0.2.6
    All checks were successful
    release / release (push) Successful in 16s
    Details
    Stable

    Ghost released this 2026-06-20 19:20:44 +00:00 | 0 commits to main since this release

    Changed

    • Coherent status colors. One rule everywhere: dim keys, white facts (versions, names,
      counts, sizes, URLs, dates), green good-states (on/enabled/running/applied/enforcing/key-only),
      yellow caution, dim secondary notes only (parentheticals, uptime, commit ref). Removes the cyan
      sprinkled on some numbers/URLs and un-dims the Content/Sync values. Refreshed status screenshot.
    Downloads
  • v0.2.5 fd144fa7b4

    v0.2.5
    All checks were successful
    release / release (push) Successful in 18s
    Details
    Stable

    Ghost released this 2026-06-20 18:59:05 +00:00 | 3 commits to main since this release

    Validated end-to-end on a clean Rocky 9 re-provision, which surfaced and fixed several latent bugs
    the long-running deployment had been masking, and a full install/status UX overhaul.

    Fixed

    • bcrypt hash corruption: the compose $-escaping used ${h//$/$$}, where $$ expands to the
      shell PID — corrupting every basic-auth hash and crash-looping the web container. Now sed-based.
    • Status Sync box dropped before the first sweep completed: an unguarded grep under
      set -euo pipefail aborted the render. Status is now set +e (read-only reporting can't abort).
    • stderr noise from firewalld (ALREADY_ENABLED) and compose recreates is captured/suppressed.

    Changed

    • Unified, high-contrast CLI: install and status now share one visual language — green
      numbered [n] stage headers, bright text, indented ✓/• rows (no boxes, no red banners, no
      [packagemini] prefix). --verbose/PM_VERBOSE=1 streams raw tooling output; failures show the
      captured output. Timestamps render in RFC 5322 with the operator's timezone offset.
    • Timezone no longer prompted on every --all — the host zone is kept automatically (preset
      PM_TIMEZONE to change), so a re-run is fully non-interactive.

    Added

    • set-timezone <zone> command (sets host tz + .env TZ, reloads sync for release dates).
    • Refreshed documentation screenshots (status dashboard + deploy.sh --all install run).
    Downloads
  • v0.2.4 e9c42f51f1

    v0.2.4
    All checks were successful
    release / release (push) Successful in 17s
    Details
    Stable

    Ghost released this 2026-06-20 15:33:17 +00:00 | 14 commits to main since this release

    Supersedes 0.2.3 (whose release did not publish due to the workflow bug below). Carries the full
    supply-chain pinning from 0.2.3 plus the fix.

    Security

    • Supply-chain pinning. Base images by @sha256 digest (python:3.12-slim, caddy:2,
      caddy:2-builder, alpine:3); Caddy v2.11.4 + xcaddy modules caddy-dns/desec@v1.1.0 and
      mholt/caddy-ratelimit@v0.1.0; Python deps exact + pip --require-hashes; the caddy image for
      hash-password; lazydocker v0.25.2 with SHA-256 verification; release-workflow image + deps.
      See DESIGN.md → Supply chain.

    Fixed

    • Release workflow: the hashed requirements-dev.txt was missing pytest 9's pygments
      dependency, so pip --require-hashes failed in CI; added pygments==2.20.0. Verified in a clean venv.
    Downloads
  • v0.2.2 520ad02dcf

    v0.2.2
    All checks were successful
    release / release (push) Successful in 20s
    Details
    Stable

    Ghost released this 2026-06-20 14:57:59 +00:00 | 17 commits to main since this release

    Added

    • Manual TLS provider (web.tls.provider: manual) — import your own certificate (internal CA,
      wildcard, etc.) instead of ACME/DNS-01. New ./src/deploy.sh set-cert imports the leaf cert +
      key (+ optional intermediate and root CA), assembles the chain (leaf→intermediate→root), verifies
      the key matches the cert, and reloads; no token required. Documented in doc/MANUAL-X509-CERT.md.
    • doc/MANAGE.md — day-to-day management guide; referenced from the README.
    • Docs: web UI + status screenshots; "Status dashboard" section in DESIGN.md.
    Downloads
  • v0.2.1 4a97b9498a

    v0.2.1
    All checks were successful
    release / release (push) Successful in 20s
    Details
    Stable

    Ghost released this 2026-06-20 11:37:05 +00:00 | 26 commits to main since this release

    Fixed

    • Release workflow now uses the automatic per-run token (github.token) instead of a
      manually-created secret, checks out into a clean subdir, and surfaces the release-API HTTP
      status — so a vX.Y.Z tag actually publishes a Forgejo release with the CHANGELOG notes.

    Changed

    • Install docs: clone the repo directly on the server (dnf install -y git + git clone)
      instead of scp — enables in-place git pull updates and an accurate commit ref in status.
    Downloads
  • v0.2.0 4f1ebf4797

    v0.2.0
    Some checks failed
    release / release (push) Failing after 27s
    Details
    Stable

    Ghost released this 2026-06-20 11:13:27 +00:00 | 28 commits to main since this release

    A large hardening, operability, and polish cycle: the mirror now runs rootless and
    self-hardens the host, the deploy.sh status/management UX was rebuilt, and the repo
    was reorganised into src/ + config/ + doc/.

    Added

    • System hardening (deploy.sh harden, also during install; opt out with --no-harden):
      guarded key-only SSH, fail2ban, hourly automatic security updates with auto-reboot,
      Docker-safe sysctl tuning, firewall least-privilege, and enforced filesystem permissions.
      Interactive enable/disable/re-apply per measure. Documented in doc/SYSTEM-HARDENING.md.
    • Web-tier abuse protection: fail2ban caddy-flood jail (firewall-bans HTTP 429 floods from
      the access log) + recidive jail; an optional SSH never-ban whitelist (PM_SSH_WHITELIST).
    • Security response headers (web.security_headers): nosniff, X-Frame-Options: DENY,
      Referrer-Policy, Server banner removed, and HSTS on HTTPS.
    • Management subcommands: status, start/stop/restart/down, logs, refresh,
      harden, set-fqdn, set-mirror-auth, set-mirror-creds, set-goaccess-creds,
      open-goaccess, and clear-config [data] (uninstall/reconfigure).
    • Status dashboard: boxed, colour-coded sections (System, Security, Services, Mirror,
      Mirror config, Content, Sync) with live sync progress, "last sweep X ago", blocked-IP count,
      effective rate limit, the outbound User-Agent, and the running version + commit ref.
    • Operator identity (operator.{name,email}): shown in the page footer and sent in the
      outbound User-Agent so MikroTik can contact whoever runs the mirror.
    • Timezone support (TZ): release/modified dates render in the operator's timezone in
      RFC 5322 format; deploy.sh prompts for and sets the host timezone.
    • Configurable TLS renewal window (web.tls.renewal_window_ratio).
    • config/env.example reference; repository-layout and disk-sizing docs in the README.

    Changed

    • Repository layout: deploy.sh, sync/, web/, monitor/ moved under src/;
      example config under config/; docs under doc/. Compose build contexts updated.
    • Containers run rootless (uid:gid 1000, no-new-privileges); Caddy keeps
      NET_BIND_SERVICE to bind 80/443. Host-bound data is owned by 1000:1000.
    • Rate limiting now defaults to all routes at 600 r/m (was feed-only at 60 r/m); tunable.
    • Download phase runs with parallel workers (default 2); release dates parsed from CHANGELOG.
    • Footer year is dynamic; redundant author link removed in favour of the repo link + version.

    Fixed

    • Completed architectures now skip all fetches/probes on later sweeps — no more per-sweep
      CDN hammering for files MikroTik doesn't offer (steady-state sweep dropped from minutes to seconds).
    • In-progress versions/architectures and *.part files are hidden until fully mirrored.
    • fail2ban requires the firewalld backend to actually enforce bans (ordered first, warned otherwise);
      re-applying an already-enabled measure now refreshes its config.
    • Real-time GoAccess board WebSocket fixed end-to-end (path, protocol, public port).

    Security

    • See Added — host hardening, rootless containers, web-tier abuse protection, and security
      headers are the headline of this release. See doc/SYSTEM-HARDENING.md.
    Downloads