947c04834d
Fix all 8 security hardening blockers for PR #423
...
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com >
2026-08-11 15:38:08 +00:00
a111de1ece
Security hardening: fix all 8 blocking findings for PR #419
...
Fix 1: Update support.js to collect SSH public key and POST JSON
Fix 2: Legacy njalla.sh migration - parse safely, archive non-executable, replace cron with systemd timer
Fix 3: DDNS SSRF prevention - allowlist only njal.la, reject other hosts, disable curl redirects
Fix 4: Legacy root support-key removal migration (_remove_legacy_root_support_key)
Fix 5: Automatic support-key expiration (expires_at + _expire_support_if_stale)
Fix 6: Move security helpers to security_helpers.py, tests import production code
Fix 7: Real NIP-19/Bech32 npub validation (_bech32_decode + _validate_npub)
Fix 8: Replace journalctl sudo wildcard with restricted sovran-journal-helper.py
Also: Make _write_hub_overrides() atomic with tempfile+os.replace
94 tests passing
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com >
2026-08-11 12:07:18 +00:00
f2ad9c1f17
Security hardening: fix DDNS injection, Nix injection, reboot auth, support key, sudo rules
...
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com >
2026-08-11 10:44:26 +00:00
2c223d1166
fix: add NBXplorer cookie auth and WorkingDirectory for BTCPay service
...
- Add btcexplorercookiefile to BTCPay deterministic config so NBXplorer
cookie authentication succeeds (fixes 401 Unauthorized)
- Set WorkingDirectory to package lib dir so ASP.NET Core can locate
wwwroot and LanguageService.ctor does not throw ArgumentNullException
- Update regression test to assert cookie file path and WorkingDirectory
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com >
2026-08-11 03:24:13 +00:00
1b6b1ade46
Fix BTCPay startup regression: add home dirs to service users
...
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com >
2026-08-11 03:12:27 +00:00
05a42bcc4b
feat: harden btcpay and nbxplorer config handling
...
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com >
2026-08-11 02:40:16 +00:00
