Sovran_Systems/Sovran_SystemsOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity
2,227 Commits 2 Branches 9 Tags
9ce169c4f02792968e98587ee6311351c0a3c87b
Commit Graph
2227 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Sovran SystemsandGitHub 9ce169c4f0 Merge pull request #428 from naturallaw777/fix/hub-load-performance 
perf: speed up Hub service status loading
v1.1.0 		2026-08-11 13:37:29 -05:00
naturallaw777 61287dfece perf: speed up Hub service status loading 2026-08-11 13:35:59 -05:00
Sovran SystemsandGitHub f48f210209 Merge pull request #427 from naturallaw777/fix/hub-service-version-badges 
fix: correct RTL and Mempool Hub versions
 2026-08-11 13:09:48 -05:00
naturallaw777 4193c56397 fix: correct RTL and Mempool Hub versions 2026-08-11 13:07:28 -05:00
naturallaw777 f85f1a2c9f Update Documentation 2026-08-11 12:18:21 -05:00
Sovran SystemsandGitHub 802474fe6d Merge pull request #426 from naturallaw777/fix/ddns-validation-placeholder 
Fix DDNS URL validation: replace ${IP} temporarily for validator, kee…
 2026-08-11 11:51:53 -05:00
Arena Agentandnaturallaw777 679c7a039f Fix DDNS URL validation: replace ${IP} temporarily for validator, keep placeholder for storage 2026-08-11 11:47:32 -05:00
CopilotandGitHub 1b43a34e9c Merge pull request #424 from naturallaw777/copilot/security-hardening-final 
Security hardening: key removal, session expiry, DDNS validation, journal allowlist, and production-backed tests
 2026-08-11 11:34:51 -05:00
copilot-swe-agent[bot]GitHubnaturallaw777
 		3f233beea0 njalla.nix: fail on ImportError; fix redundant except clause 
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-11 15:40:04 +00:00
copilot-swe-agent[bot]GitHubnaturallaw777
 		947c04834d Fix all 8 security hardening blockers for PR #423 
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-11 15:38:08 +00:00
naturallaw777 894707a87c Correctly escape DDNS placeholder in Nix string 2026-08-11 10:11:44 -05:00
naturallaw777 43fc01d350 Fix Nix interpolation in DDNS runner 2026-08-11 10:06:32 -05:00
naturallaw777 1f0a1ab865 Import consolidated security hardening from PRs #419 and #420 2026-08-11 09:57:06 -05:00
Sovran SystemsandGitHub 79f3e8efd8 Merge pull request #422 from naturallaw777/copilot/security-hardening-draft-pr-combined 
Consolidate security hardening for DDNS, support access, auth gating, and upgrade migrations
 2026-08-11 09:32:49 -05:00
copilot-swe-agent[bot]andGitHub ff6abf3b8e Initial plan 2026-08-11 14:00:34 +00:00
copilot-swe-agent[bot]GitHubnaturallaw777
 		a111de1ece Security hardening: fix all 8 blocking findings for PR #419 
Fix 1: Update support.js to collect SSH public key and POST JSON
Fix 2: Legacy njalla.sh migration - parse safely, archive non-executable, replace cron with systemd timer
Fix 3: DDNS SSRF prevention - allowlist only njal.la, reject other hosts, disable curl redirects
Fix 4: Legacy root support-key removal migration (_remove_legacy_root_support_key)
Fix 5: Automatic support-key expiration (expires_at + _expire_support_if_stale)
Fix 6: Move security helpers to security_helpers.py, tests import production code
Fix 7: Real NIP-19/Bech32 npub validation (_bech32_decode + _validate_npub)
Fix 8: Replace journalctl sudo wildcard with restricted sovran-journal-helper.py
Also: Make _write_hub_overrides() atomic with tempfile+os.replace
94 tests passing

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-11 12:07:18 +00:00
copilot-swe-agent[bot]GitHubnaturallaw777
 		9b77b04741 Fix IP validation in DDNS and document journalctl sudo rule 
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-11 10:45:50 +00:00
copilot-swe-agent[bot]GitHubnaturallaw777
 		f2ad9c1f17 Security hardening: fix DDNS injection, Nix injection, reboot auth, support key, sudo rules 
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-11 10:44:26 +00:00
copilot-swe-agent[bot]andGitHub 590ed134b7 Initial plan 2026-08-11 10:35:07 +00:00
Sovran SystemsandGitHub cc438aa524 Merge pull request #418 from naturallaw777/fix/btcpay-version-display 
fix: report configured BTCPay Server version
 2026-08-11 05:18:59 -05:00
Arena.ai Agentandnaturallaw777 0d0a1888f9 fix: report configured BTCPay Server version 2026-08-11 05:15:11 -05:00
Sovran SystemsandGitHub 14b8258420 Merge pull request #417 from naturallaw777/copilot/fix-nixos-service-startup-regressions-again 
Fix Matrix SIGPIPE crash and RTL v0.15.8 config schema regressions
 2026-08-10 22:43:24 -05:00
copilot-swe-agent[bot]GitHubnaturallaw777
 		09b34997e4 Fix Matrix SIGPIPE and RTL v0.15.8 config schema regressions 
- modules/synapse.nix: replace tr|head pipeline (causes SIGPIPE under
  set -euo pipefail) with pwgen -sA0 20 1 which is already in PATH
- modules/bitcoin/rtl.nix: lowercase Authentication->authentication and
  Settings->settings per RTL v0.15.8 schema; add lnServerUrl pointing
  to LND REST endpoint; move swapServerUrl/boltzServerUrl inside
  settings; apply same fixes to CLN branch

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-11 03:41:41 +00:00
copilot-swe-agent[bot]andGitHub a372b88488 Initial plan 2026-08-11 03:39:21 +00:00
Sovran SystemsandGitHub 7716c950cd Merge pull request #415 from naturallaw777/copilot/fix-btcpay-runtime-regressions 
fix(btcpay): NBXplorer cookie auth and WorkingDirectory for wwwroot
 2026-08-10 22:25:27 -05:00
copilot-swe-agent[bot]GitHubnaturallaw777
 		2c223d1166 fix: add NBXplorer cookie auth and WorkingDirectory for BTCPay service 
- Add btcexplorercookiefile to BTCPay deterministic config so NBXplorer
  cookie authentication succeeds (fixes 401 Unauthorized)
- Set WorkingDirectory to package lib dir so ASP.NET Core can locate
  wwwroot and LanguageService.ctor does not throw ArgumentNullException
- Update regression test to assert cookie file path and WorkingDirectory

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-11 03:24:13 +00:00
copilot-swe-agent[bot]andGitHub 503bd2467d Initial plan 2026-08-11 03:22:13 +00:00
Sovran SystemsandGitHub 57070644cc Merge pull request #414 from naturallaw777/copilot/fix-btcpay-startup-regression 
Fix BTCPay Server startup crash: assign home directories to service users
 2026-08-10 22:13:18 -05:00
copilot-swe-agent[bot]GitHubnaturallaw777
 		1b6b1ade46 Fix BTCPay startup regression: add home dirs to service users 
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-11 03:12:27 +00:00
copilot-swe-agent[bot]andGitHub a7b149f58a Initial plan 2026-08-11 03:11:02 +00:00
Sovran SystemsandGitHub 90f89f14ba Merge pull request #413 from naturallaw777/copilot/harden-btcpay-nbxplorer-integration 
Harden BTCPay/NBXplorer secret handling and deterministic config generation
 2026-08-10 22:01:00 -05:00
copilot-swe-agent[bot]GitHubnaturallaw777
 		dcfee1fb32 fix: address btcpay hardening review feedback 
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-11 02:44:12 +00:00
copilot-swe-agent[bot]GitHubnaturallaw777
 		05a42bcc4b feat: harden btcpay and nbxplorer config handling 
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-11 02:40:16 +00:00
copilot-swe-agent[bot]andGitHub 9befcd06e6 Initial plan 2026-08-11 02:34:27 +00:00
Sovran SystemsandGitHub c9169164b5 Merge pull request #412 from naturallaw777/copilot/fix-btcpayserver-hmac-authentication 
fix(btcpayserver): register bitcoin-HMAC-btcpayserver as managed nix-bitcoin secret
 2026-08-10 21:27:10 -05:00
copilot-swe-agent[bot]GitHubnaturallaw777
 		cb84ca839f fix: register bitcoin-HMAC-btcpayserver as managed secret owned by bitcoind user 
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-11 02:25:21 +00:00
copilot-swe-agent[bot]andGitHub 6d59441b13 Initial plan 2026-08-11 02:24:45 +00:00
CopilotandGitHub 5475e33d08 Merge pull request #410 from naturallaw777/copilot/409-update-fetch-node-modules 
Unblock flake checks and document vendored nix-bitcoin packaging provenance
 2026-08-10 21:07:38 -05:00
copilot-swe-agent[bot]andSovran Systems 88896f00c4 Add provenance headers and fix flake checks for PR409 
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-10 21:07:10 -05:00
CopilotandGitHub cb2d6de0ef Merge pull request #409 from naturallaw777/copilot/fix-nixos-build-mempool-3-2-1 
Restore upstream nix-bitcoin fetchNodeModules helper to fix mempool and RTL builds
 2026-08-10 21:07:08 -05:00
copilot-swe-agent[bot]GitHubnaturallaw777
 		c2dce6cf94 Restore upstream nix-bitcoin fetchNodeModules for mempool and RTL packages 
Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
 2026-08-10 23:24:31 +00:00
copilot-swe-agent[bot]andGitHub 7879a2771d Initial plan 2026-08-10 23:21:00 +00:00
Sovran SystemsandGitHub 820d850d00 Refactor Nix build configuration for mempool 2026-08-10 18:07:46 -05:00
Sovran SystemsandGitHub d733187ec5 Update npm dependencies and patch handling in default.nix 2026-08-10 17:40:53 -05:00
Sovran SystemsandGitHub f7b1f42e0e Update npmDepsHash for backend and frontend packages 2026-08-10 17:33:21 -05:00
Sovran Systems 03fb7791eb Mempool: use postPatch to copy lock file for npmDeps fetcher 
prefetch-npm-deps runs in the deps fetcher's buildPhase and checks for
package-lock.json at CWD (repo root). postPatch runs in both the
fetcher and the main build, so we copy the lock file there. The main
build then cds into the subdir in buildPhase.

npmDepsHash values remain placeholders (lib.fakeHash).
 2026-08-10 17:21:42 -05:00
Sovran Systems 953cacc72c Mempool: use preBuild cd instead of postUnpack so npmDeps fetcher finds lock files 
postUnpack did not run in the npmDeps fixed-output derivation, so
prefetch-npm-deps couldn't find package-lock.json. preBuild runs in
both the fetcher and main build, ensuring consistent CWD for the lock
file lookup. Backend patch moved to prePatch/postPatch so it only
applies in the main build.

npmDepsHash values remain placeholders (lib.fakeHash).
 2026-08-10 17:15:07 -05:00
Sovran Systems 6021691b3f Mempool: fix npmDeps fetcher — postUnpack instead of sourceRoot, postPatch instead of patches 
The `patches` attribute was being applied inside the npmDeps
fixed-output derivation where patch runs interactively and fails.
sourceRoot also caused the deps fetcher to hash a different tree than
expected. Now:

- postUnpack cds into the subdir for both the fetcher and main build
- postPatch applies the mining-pool patch only in the main build
- npmDepsHash values remain placeholders (lib.fakeHash)
 2026-08-10 17:11:30 -05:00
Sovran Systems 4d8bb06d41 Mempool: switch backend and frontend to buildNpmPackage with placeholder npmDepsHash 
npm ci in buildPhase hangs because the Nix build sandbox has no network
access. buildNpmPackage pre-fetches dependencies as a fixed-output
derivation with network access, then the main build runs offline.

npmDepsHash values are placeholders (lib.fakeHash) — the first builds
will fail with hash mismatches that report the correct hashes.
 2026-08-10 17:07:02 -05:00
Sovran SystemsandGitHub b96d2bcb24 Update npmDepsHash with correct hash value 2026-08-10 12:46:02 -05:00