Sovran_Systems/Sovran_SystemsOS
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 16 Wiki Activity

16 Releases 20 Tags

RSS Feed
  • v1.2.4 4233a245ed
    Compare

    v1.2.4 — Stable Release Stable

    naturallaw777 released this 2026-10-30 15:00:15 -05:00 | 3 commits to stable since this release

    Sovran_SystemsOS v1.2.4

    Sovran_SystemsOS v1.2.4 — Stable Release

    Security

    • Matrix Synapse: Pillow 13.0.0 backport (modules/pillow-security.nix).
      Pillow 13.0.0 (2026-10-16) is the only release that fixes CVE-2026-112900
      (EPS filename argument injection into Ghostscript, CVSS v4.0 9.2, every
      release 2.6.0 through 12.3.0), CVE-2026-112398 (FlashPix heap overflow) and
      the October 2026 TIFF/JPEG memory-corruption fixes — there is no 12.x
      backport. The pinned nixos-unstable still ships 12.3.0, and
      nix flake update nixpkgs does not help yet: the bump is merged into
      nixpkgs staging (#575689) and backported to release-26.05 (#576110), but
      staging-next is not merged into master. The overlay touches only the Python
      set Synapse runs on, so pkgs.python3Packages — and therefore the Sovran
      Hub — is unchanged. The sysroot hash is taken from nixpkgs-stable's
      known-good 13.0.0 build and verified to fetch python-pillow 13.0.0.
    • Matrix Synapse: Pillow security floor as an assertion. In the same
      style as the PHP floor in modules/php.nix, config.assertions now checks
      the Pillow that services.matrix-synapse.package actually loads, so a
      rolled-back nixpkgs pin (or a change to Synapse's Python environment) fails
      evaluation instead of silently shipping a vulnerable Pillow.
    • The overlay is self-disabling: once nixpkgs ships Pillow >= 13.0.0 the
      overridePythonAttrs version test is false, every derivation in Synapse's
      Python set is byte-identical to stock (drvPath unchanged, nothing rebuilt)
      and the file can be deleted along with its use in modules/synapse.nix.

    Added

    • tests/pillow-security-eval.nix — an evaluation check for the Pillow
      overlay: proves it moves the Pillow Synapse runs against (12.3.0 → 13.0.0),
      leaves pkgs.python3Packages (Hub) untouched, and reduces to an identity
      when the floor is below what nixpkgs ships. Run with
      NIXPKGS=/path/to/nixpkgs nix-instantiate --eval --strict tests/pillow-security-eval.nix.

    Fixed

    • versions.json: matrix-synapse.service 1.163.0 → 1.163.2, matching
      what the pinned nixpkgs actually builds. (The Hub renders
      pkgs.matrix-synapse.version at build time, so only the checked-in fallback
      file was stale.)
    • modules/php.nix: the security-floor comment cited the wrong flake.lock
      node. a8e753600fb4 is btc-clients' nixpkgs (bisq/sparrow only); the system
      is built from nixpkgs_2 = 31ecbaca1bde, which is where php85 = 8.5.12 was
      verified.

    Changed

    • BTCPay Server 2.4.5 → 2.4.6
    • Matrix Synapse 1.163.0 → 1.163.2
    • Ride The Lightning 0.15.13 → 0.15.16
    • Mempool 3.3.1 → 3.3.2
    • Sparrow Wallet 2.5.5 → 2.5.6
      Full changelog: CHANGELOG.md
    Downloads
  • v1.2.3 1ee932bcb2
    Compare

    v1.2.3 — Stable Release Stable

    naturallaw777 released this 2026-10-27 06:21:48 -05:00 | 11 commits to stable since this release

    Sovran_SystemsOS v1.2.3

    Sovran_SystemsOS v1.2.3 — Stable Release

    Added

    • Php: assert the security floor via config.assertions, not a module-level assert
    • Php: drop duplicate filter-test backport that breaks the php-filter build
    • Php: fix the filter tests that break the 8.5.12 build
    • Php: pin the shared interpreter to 8.5.12 for CVE-2026-109618/-109619

    Changed

    • Updated nixpkgs
    • Updated to Bisq 1.10.10

    Documentation

    • Update changelog and versions with nixpkgs and matrix-synapse 1.163.0
      Full changelog: CHANGELOG.md
    Downloads
  • v1.2.2 87aa9b741b
    Compare

    v1.2.2 — Stable Release Stable

    naturallaw777 released this 2026-10-21 14:23:51 -05:00 | 18 commits to stable since this release

    Sovran_SystemsOS v1.2.2 — Stable Release

    📦 Updated Software & Flakes

    • nixpkgs-stable (nixos-26.05): cd4ea8d57de1
      • Matrix Synapse: Upgraded from 1.162.0 to 1.163.0
    • Sovran_Bitcoin (v1.1.2): 63e104940ef4
      • Hotfix for Nostr Wallet Connect (NWC): fixes spending on LND 0.21, real internal preimages, and pay_keysend support

    🛠️ Hub Fixes

    • Login Verification: Made PAM fallback and libcrypt detection diagnosable in logs (journalctl -u sovran-hub-web).
    • GDM / Desktop Sync: Hub login strictly accepts the same password accepted by the desktop session.
    • System Passwords Tile: Handled legacy passwords gracefully to prevent UI crashes.

    Full Changelog: CHANGELOG.md

    Downloads
  • v1.2.1 1d59a995e8
    Compare

    Sovran_SystemsOS v1.2.1 Stable

    naturallaw777 released this 2026-10-18 16:14:59 -05:00 | 25 commits to stable since this release

    Sovran_SystemsOS v1.2.1

    Sovran_SystemsOS v1.2.1 — Stable Release

    Highlights

    • Sovran_Bitcoin 1.1.1 Integration: Replaces the third-party Alby Hub daemon with the zero-fetch, Nix-native Sovran NWC daemon (sovran-nwc 2.0.0) and updates Ride The Lightning (RTL) to 0.15.13.
    • Mullvad VPN on Desktop Role: Ships the stock NixOS Mullvad VPN daemon and GUI application on the Desktop Only role (modules/mullvad.nix), keeping Server + Desktop and Bitcoin Node Only network routing untouched.
    • Password & Keyring Cleanup: Unified single-password model (modules/password-model.nix) eliminating redundant desktop keyring prompts.
    • Updated Flake Inputs & Services: Updates nixpkgs (nixos-unstable), nixpkgs-stable (nixos-26.05), nixvim, and btc-clients (Bisq2 2.1.14).

    Added

    • Mullvad VPN (Desktop Role Only): Install the Mullvad VPN app and daemon on the Desktop Role only (modules/mullvad.nix).
    • Password & Keyring Cleanup: Unified password model (modules/password-model.nix) — one password, one truth, no prompts.

    Changed

    • Flake Lock & Ecosystem Updates (flake.lock):
      • Sovran_Bitcoin 1.1.1 (5c13bf5): Nix-native sovran-nwc 2.0.0, Ride The Lightning 0.15.13, electrs 0.12.0 (bindex / bitcoind rest=1), and expanded btcpayserver RPC whitelist for NBXplorer 2.6.17
      • btc-clients (990d29e): Bisq 1.10.9, Bisq2 2.1.14, Sparrow 2.5.5
      • nixpkgs (nixos-unstable) (fe13242):
        • Bitcoin Core 31.1
        • LND 0.21.4-beta
        • Electrs 0.12.0
        • BTCPay Server 2.4.5
        • Mempool 3.3.1
        • Matrix Synapse 1.162.0
        • LiveKit 1.13.8
        • Vaultwarden 1.37.4
        • Haven Relay 1.2.2
        • Caddy 2.11.7
        • Tor 0.4.9.14
        • GNOME Remote Desktop 50.2
      • nixpkgs-stable (nixos-26.05) (26f4107) & nixvim (453dc9c)
    • Documentation (README.md, SECURITY.md): Clarified Hub local-network operation, SSH Remote Access, Mullvad VPN behavior on Desktop Only, and service exposure.

    Fixed

    • password-model.nix: Fixed Nix string escaping in the password generator fallback.
    • flake.nix: Replaced deprecated pkgs.system with pkgs.stdenv.hostPlatform.system for btc-clients packages.
    • modules/sovran-bitcoin-integration.nix:
      • Guarded config.networking.domain against null/empty values when both haven and nwc-wallets features are enabled.
      • Updated electrs.service and bitcoind.service for electrs 0.12.0 (bindex / rest=1, dropped --daemon-p2p-addr, automatic pre-0.12.0 RocksDB cleanup) and expanded the btcpayserver RPC whitelist for NBXplorer 2.6.17.

    Full changelog: CHANGELOG.md

    Downloads
  • v1.2.0 3a87302645
    Compare

    v1.2.0 — Stable Release Stable

    naturallaw777 released this 2026-10-02 02:40:46 -05:00 | 39 commits to stable since this release

    Sovran_SystemsOS v1.2.0

    Sovran_SystemsOS v1.2.0 — Stable Release

    Added

    • Ssh: don't open port 22 for the loopback-only sshd
    • Bitcoin: drop the stray UDP 3051 firewall rule
    • Installer: raise generated password entropy from ~23 to ~33 bits
    • Caddy: stop filtering the RTL and Mempool sites by client address
    • Hub: serve the Hub on its own port instead of through Caddy
    • Hub: answer the local network only, whichever way a client arrives
    • Hub: make the login lockout that LOGIN_FAIL_MAX described
    • Caddy: serve the Hub, RTL and Mempool sites to local clients only
    • Docs, hub, installer: say Server + Desktop makes the home IP public
    • Ddns: take the public IP from Njal.la only and give it to LiveKit

    Changed

    • Updated nixpkgs and Sovran_Bitcoin update and the new Bisq 1.10.9
      Full changelog: CHANGELOG.md
    Downloads
  • v1.1.7 70ccf1eba1
    Compare

    v1.1.7 — Stable Release Stable

    naturallaw777 released this 2026-09-21 18:09:17 -05:00 | 51 commits to stable since this release

    Sovran_SystemsOS v1.1.7

    Sovran_SystemsOS v1.1.7 — Stable Release

    Added

    • Postgresql: drop per-database autovacuum ALTERs (rejected by Postgres)
    • Synapse: performance tuning for 32 GB Server+Desktop hosts
    • Nextcloud, postgresql: fix Nextcloud 35 DB warnings on 32 GB hosts
    • Clean up flake.nix by removing comments and LiveKit override

    Changed

    • Updated nixpkgs
    • Updated to php85 and fixes
    • Updated to proper syntax to prevent build errors.
    • Updated flake lock which contains Bisq 1.10.8 and Bisq2 2.1.13
      Full changelog: CHANGELOG.md
    Downloads
  • v1.1.6 74405b2ffc
    Compare

    v1.1.6 — Stable Release Stable

    naturallaw777 released this 2026-09-15 15:17:20 -05:00 | 60 commits to stable since this release

    Sovran_SystemsOS v1.1.6

    Sovran_SystemsOS v1.1.6 — Stable Release

    Added

    • Rename 'The Sovran Hub' to 'The Hub' in README
    • Rename 'Sovran Hub' to 'The Hub' in README

    Changed

    • Updated nix packages includes the new mempool version

    Documentation

    • Update Sovran Hub screenshot to the v1.1.5 redesign
      Full changelog: CHANGELOG.md
    Downloads
  • v1.1.5 499676569e
    Compare

    v1.1.5 — Stable Release Stable

    naturallaw777 released this 2026-09-09 08:41:10 -05:00 | 65 commits to stable since this release

    Sovran_SystemsOS v1.1.5

    Sovran_SystemsOS v1.1.5 — Stable Release

    Added

    • Hub: don't claim the OS "keeps itself current" on the dashboard
    • Hub: point RTL credentials at /rtl/ and bump dev version to 0.15.12
    • Make dashboard cards uniform and symmetric; stop clipping update text
    • Add boot splash; separate Systems Operational and Security icons
    • Extend welcome dashboard background to the panel edges
    • Add welcome dashboard as default view
    • Monochrome updater glyph; fix oversized dialog header icon
    • Merge Bitcoin categories into one; rename Self-Hosted Apps to Personal Apps
    • Neutral graphite theme; branded updater icon
    • Simplify Systems Operational, reword Domain Status, blue restart buttons
    • Polish pass: sysops wording, QR size, NWC toolbar, logo, diagnostics placement
    • Rework Update System dialog to the approved design; match rebuild dialog
    • Redesign The Hub web UI: softer dark theme, sidebar nav, status widgets
    • Nixpkgs update
    • Switch LibreOffice from fresh to stable version
    • Ui: simplify element-calling port modal — trim verbose steps and remove extra verification task

    Changed

    • Updated nixpkgs
    • Updated Sovran-Bitcoin
    • Updated flake to build through the new sovran-bitcoin input

    Fixed

    • Fix role fit-and-finish: Desktop-only router note, narrow-viewport layout
    • Self-heal truncated/corrupt Nix downloads and keep failed updates retryable
      Full changelog: CHANGELOG.md
    Downloads
  • v1.1.4 93492e88fb
    Compare

    v1.1.4 — Stable Release Stable

    naturallaw777 released this 2026-09-02 15:14:04 -05:00 | 87 commits to stable since this release

    Sovran_SystemsOS v1.1.4

    Sovran_SystemsOS v1.1.4 — Stable Release

    Added

    • Element-calling: fix Nix string interpolation of LAN_CIDR echo
    • Docs/hub: update Element Calling port guidance to the new port set
    • Element-calling: fix Wi-Fi calls and tighten media/TURN ports
    • Flake: pin LiveKit to 1.13.6 for rtc.advertise_internal_ip support

    Changed

    • Updated nixpkgs
    • Updated sovran-bitcon
    • Dedupe NWC tooling — use Sovran_Bitcoin's sovran-nwc
    • Update sovran-bitcoin flake input
    • Extract bitcoin stack into Sovran_Bitcoin flake input

    Fixed

    • Set lnurl domainFile for Hub-managed Lightning Address domain
    • Correct disablewallet casing
    • Fixed typo
      Full changelog: CHANGELOG.md
    Downloads
  • v1.1.3 043981a34b
    Compare

    v1.1.3 — Stable Release Stable

    naturallaw777 released this 2026-08-27 09:24:39 -05:00 | 101 commits to stable since this release

    Sovran_SystemsOS v1.1.3

    Sovran_SystemsOS v1.1.3 — Stable Release

    Added

    • Sparrow update
    • Nixpkgs update with bisq and bisq2
    • Albyhub: re-harvest hashes for fixed sovran tag
    • Albyhub default.nix hash update
    • Albyhub default.nix fix
    • Albyhub: build from sovran fork tag (LND-only, no frontend)
    • Vendor v1.24.0 LND-only, no-frontend build
    • Ux: simplify domain and router setup guidance

    Fixed

    • Evaluate local vendored package versions directly
    • Use proxyVendor to preserve secp256k1-zkp cgo headers
      Full changelog: CHANGELOG.md
    Downloads