145 releases 145 tags

RSS feed

• v1.12.11 16efb945e4

  Compare

  Morphit v1.12.11 Stable

  agorise released this 2026-08-20 02:29:07 +00:00 | 12 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.12.11

  Theme: finishing tor-only node bring-up. This release fixes the problems a real tor-only deployment hit end to end — the warrant canary silently fetching its freshness proofs over clearnet, the operator tag never appearing on the About page, a healthy relay being reported as down, and the Matrix chat link not opening. All are small, self-contained fixes so a tor-only node comes up clean without hand-tuning.

  Fixed

  The warrant canary no longer leaks over clearnet on a tor-only node. The canary auto-detects tor-only from the instance's origin, but setup accepted a free-text URL — so an origin that wasn't the node's real .onion silently disabled tor-only routing, and the freshness fetches (Blurt head, BTC head, news) went out over clearnet, revealing the node's IP. Two fixes close this: setup now defaults the instance URL to the node's own configured public origin (the .onion on a tor-only box), so auto-detection fires; and on a tor-only node the generator now auto-selects one of the node's own hidden .onion Blurt RPCs for the chain-head proof, so it fetches over Tor natively instead of pushing a clearnet RPC through a Tor exit (which those RPCs' firewalls reject). A tor-only node now signs a leak-free canary with no manual configuration.

  The operator tag now shows on the About page. The page read the operator tag from the build-time verify.json, so setting the tag in the settings editor and restarting the indexer never changed the displayed value — it only updated after a full frontend rebuild. The page now reads the tag from the live /v1/instance endpoint (falling back to the signed verify.json), so a tag change appears as soon as the indexer restarts.

  /v1/health no longer reports a healthy relay as down. The relay-reachability probe tried the configured URL, the host's own IP addresses, and the container bridge gateway — but not loopback, unless the configured URL already was loopback. On a bare-metal node whose relay binds 127.0.0.1, an empty or differently-pointed RELAY_HEALTH_URL made a perfectly healthy relay read as down, disagreeing with morphit-ops health and a direct curl. The probe now always tries 127.0.0.1 as well (preserving the configured port and path), so a local relay is always found.

  The Matrix chat link opens in a browser. The About page linked the group chat with the bare matrix: URI scheme, which most browsers have no handler for, so the link silently did nothing. It now uses the universal matrix.to link (the same one used elsewhere in the app); the room alias stays in the URL fragment, which browsers don't send to the matrix.to server, and the room is public.

  A tor-only node no longer falsely accuses a clearnet peer of a fee-redirection "mismatch". A tor-only node reaching a clearnet peer's /v1/instance over a Tor exit often gets a firewall challenge page instead of JSON. The probe treated any unreadable response as a "mismatch" — which is a fee-redirection accusation shown against a perfectly healthy instance. An unreadable response is now correctly classified as unreachable, not a mismatch. The actual fee-redirection checks (relay account and treasury) still run on well-formed responses, so nothing that could redirect fees slips through.

  Notes

  • No database migration in this release.
  • A related architectural limitation remains (a larger change for a future release): a peer's hidden (.onion/.i2p) addresses live only inside its /v1/instance response, not in its on-chain registration — so a tor-only node has no Tor-native way to reach a clearnet peer at all. This release stops the false accusation (above); fully probing clearnet peers from a tor-only node needs alt-network addresses added to the registration op.
  • Everything from v1.12.10 (the tor-only clearnet-probe fix, the /v1/health operational-snapshot resilience, and the federation mismatch-while-syncing suppression) is included.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    3 downloads · 2026-08-20 03:06:18 +00:00 · 1 KiB
  • morphit-v1.12.11-offline.tar.gz
    1 download · 2026-08-20 03:06:35 +00:00 · 708 MiB
  • morphit-v1.12.11-offline.tar.gz.sha256
    1 download · 2026-08-20 03:06:36 +00:00 · 98 B
  • morphit-v1.12.11.tar.gz
    3 downloads · 2026-08-20 03:06:17 +00:00 · 32 MiB
  • morphit-v1.12.11.tar.gz.sha256
    3 downloads · 2026-08-20 03:06:18 +00:00 · 90 B
• v1.12.10 4b12d403d5

  Compare

  Morphit v1.12.10 Stable

  agorise released this 2026-08-19 16:43:14 +00:00 | 13 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.12.10

  Theme: closing the last tor-only leaks and false alarms. This release stops a tor-only node from probing clearnet Blurt RPC endpoints in its stats page (which would reveal the node's real IP), fixes the /v1/health operational block so it stops reporting a healthy relay and host as down, stops a still-syncing node from falsely flagging a healthy peer as a fee-redirection "mismatch", and fixes the warrant-canary setup so it completes on a root-installed node instead of aborting. It also adds operator tooling: an indexer-database snapshot bootstrap (sync a new box in minutes from your own synced box) and the on-chain chain_snapshot_v1 anchor for publishing a canonical block_log snapshot.

  Fixed

  A tor-only node no longer probes clearnet RPC endpoints in the stats page. The "RPC endpoints" card refreshes by actively probing every node in its list — but that list always included the six clearnet Blurt RPCs, even on a tor-only node whose clearnet pool is empty. On a tor-only box that meant the indexer was still reaching those six operators over clearnet, revealing the node's real IP — the same class of exposure v1.12.9 closed for chain syncing. The probe list now includes the clearnet nodes only when the instance actually syncs over clearnet; a tor-only node probes and displays only its hidden (Tor/I2P) endpoints, matching what /v1/health already reports. Clearnet nodes are unchanged.

  /v1/health no longer reports a healthy relay and host as down. The operational block (relay reachability, host CPU/memory/disk, IPFS seeding) sampled all of its inputs in a single all-or-nothing pass, so one probe failing — or a single sample never completing — left the entire block frozen at its "unknown / down / not sampled" defaults, disagreeing with what morphit-ops health showed. Each input is now sampled independently: a failing probe keeps its previous value and never blanks the others, and a stalled refresh can no longer wedge the block permanently.

  A still-syncing node no longer falsely flags a healthy peer as "mismatch". The federation directory flags a peer whose advertised fee-treasury addresses differ from the canonical ones (a fee-redirection defense). But a node that is still catching up has an incomplete view of the chain, so its canonical-treasury baseline can be wrong — causing it to falsely accuse a healthy, fully-synced instance. The treasury check is now withheld while the local node is still syncing (it re-engages the moment the node is caught up). The relay-account and response-shape checks are unaffected, so a synced node's fee-redirection defense is unchanged.

  The warrant-canary setup completes on a root-installed node instead of aborting. On a root-installed /opt/morphit, canary setup run as a non-root operator died at a "permission denied" writing the public key into the root-owned source tree — before it ever wrote the refresh script or armed the weekly timer, leaving the node with no canary. Setup now stages the signed canary and public key in the operator-writable ~/.morphit/canary/, only reading the source tree for the template, and still publishes the artifacts into the served build directory. Say yes once and the canary signs, publishes, and arms its weekly refresh with no permission wall.

  Added

  Indexer-database snapshot bootstrap. A new node can sync in minutes instead of days by restoring an already-synced indexer's Postgres database and catching up only the small gap — which matters most for a tor-only node that can only sync over hidden RPC. snapshot-export.ts produces a portable snapshot (database dump plus a manifest); snapshot-bootstrap.ts verifies compatibility (exact chain-id match, schema not newer than this build, Postgres not newer than the host — all fail closed), requires an explicit trust acknowledgement, refuses to clobber a populated database, restores, and confirms. This is safe only between an operator's own boxes — you are trusting your own derived state. A public, signed snapshot is a separate decision and is not included here.

  On-chain chain_snapshot_v1 anchor. The publish side for a canonical Blurt block_log snapshot: @morphit posts a custom_json op pointing at the snapshot (IPFS CID, SHA-256, height, size, blurtd version, optional IPNS name and mirror URL), exactly the way releases are anchored. The block_log is the raw, self-verifying chain, so a node that fetches it re-checks every block on import — making it a zero-trust public artifact. Includes the op format + validator and a laptop broadcaster (dry-run by default).

  A sync profiler and a tor-only node doctor. apps/indexer/scripts/sync-profile.ts measures where initial sync time actually goes (fetch vs. commit vs. apply), so slow syncs can be diagnosed rather than guessed at. ops/morphit-node-doctor.sh checks a node end-to-end — clearnet-leak status, stray processes, hidden transports, canary, sync — and safely auto-fixes the clearnet pool on a tor-only box.

  Notes

  • No database migration in this release.
  • The snapshot bootstrap, the chain_snapshot_v1 broadcaster, and the tor-only routing added here are shape- and smoke-validated; the database dump/restore and the on-chain publish need a live run on real infrastructure to validate end-to-end (there is no synced database or signing key in CI).
  • Everything from v1.12.9 (tor-only hidden-only RPC, the canary routing over Tor, and web-push configuration on tor-only nodes) is included.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    5 downloads · 2026-08-19 17:18:44 +00:00 · 1 KiB
  • morphit-v1.12.10-offline.tar.gz
    1 download · 2026-08-19 17:18:59 +00:00 · 708 MiB
  • morphit-v1.12.10-offline.tar.gz.sha256
    1 download · 2026-08-19 17:18:59 +00:00 · 98 B
  • morphit-v1.12.10.tar.gz
    5 downloads · 2026-08-19 17:18:44 +00:00 · 32 MiB
  • morphit-v1.12.10.tar.gz.sha256
    5 downloads · 2026-08-19 17:18:44 +00:00 · 90 B
• v1.12.9 59da8e68ea

  Compare

  Morphit v1.12.9 Stable

  agorise released this 2026-08-18 15:35:12 +00:00 | 14 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.12.9

  Theme: a tighter tor-only node. This release stops a tor-only indexer from reaching clearnet Blurt RPC (which would reveal the node's real IP to those RPC operators), fixes web-push configuration on tor-only nodes so the relay never crash-loops over an invalid VAPID subject, and makes the warrant-canary restore itself automatically on upgrade for appliance/Ansible installs.

  Fixed

  Tor-only indexers now read the chain over hidden services only. A tor-only node was still reaching six clearnet Blurt RPC endpoints, exposing its real IP to those operators — the exact exposure tor-only exists to prevent. The indexer now empties its clearnet RPC pool on tor-only and reads purely over the hidden-service (.onion / .b32.i2p) pool; the "at least one chain source" requirement is now enforced over the combined local + clearnet + hidden pool, so a hidden-only configuration is valid while a truly source-less one is still rejected. Clearnet nodes are unchanged.

  Web push no longer misconfigures itself on tor-only nodes. The VAPID subject was derived as https://<domain>, which is a domain-less, invalid https:// on a tor-only node. It now derives a mailto: from the operator's contact URL when that is a mailto:, and otherwise stays empty — which cleanly disables push instead of producing an invalid subject. Clearnet nodes still derive https://<domain> as before. (The always-on in-tab ambient notifications — tab title and favicon unread badge — already work on tor-only regardless of push.)

  The warrant canary restores itself on upgrade for appliance/Ansible installs. An upgrade could leave the canary missing until the next weekly refresh on boxes provisioned with a system morphit-canary.service (rather than a ~/.morphit refresh script). The upgrade now triggers that service directly — the exact unit the weekly timer fires — and falls back to the home-directory refresh script for interactive installs. Either path restores the canary immediately with no manual step.

  Build-integrity manifests are now byte-identical regardless of deploy path. The .shipped build marker is excluded from /verify.json hashing (it's a build-system signal, not a served asset), so an instance that re-ran the manifest step and one that kept the shipped manifest now produce identical verify.json files.

  Small UI fix. On the "about this instance" page, a 56-character .onion origin now wraps instead of overflowing its cell.

  The warrant-canary refresh no longer reaches clearnet on a tor-only node. The weekly canary's freshness-proof fetches (Blurt chain-head, Bitcoin head, news headline) were going directly to clearnet endpoints on a tor-only node, which could reveal the node's real IP to those third parties — the same class of exposure this release closes for the indexer. On tor-only, all three now route through the co-located Tor SOCKS proxy (DNS resolved proxy-side, so nothing leaks), reaching the same freshness sources through a Tor exit. It is fail-safe: if the Tor proxy is down the canary degrades or holds rather than ever falling back to a direct clearnet connection. Clearnet nodes are byte-identical to before.

  Notes

  • No database migration in this release.
  • The tor-only privacy work in this release (indexer hidden-only RPC + the canary routing over Tor) is code-complete but its live Tor routing was validated by shape/smoke, not end-to-end in CI — confirm on a real tor-only box that the canary's route = tor-only (SOCKS …) and the indexer reads only over hidden endpoints. Details in docs/AUDIT-cp760-v1.12.9-DELTA-DEEP-DEEP.md.
  • Everything from v1.12.8 (the build-integrity banner bootstrap fix) is included.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    4 downloads · 2026-08-18 16:10:31 +00:00 · 1 KiB
  • morphit-v1.12.9-offline.tar.gz
    1 download · 2026-08-18 16:10:49 +00:00 · 708 MiB
  • morphit-v1.12.9-offline.tar.gz.sha256
    2 downloads · 2026-08-18 16:10:50 +00:00 · 97 B
  • morphit-v1.12.9.tar.gz
    5 downloads · 2026-08-18 16:10:31 +00:00 · 32 MiB
  • morphit-v1.12.9.tar.gz.sha256
    5 downloads · 2026-08-18 16:10:31 +00:00 · 89 B
• v1.12.8 dba589e075

  Compare

  Morphit v1.12.8 Stable

  agorise released this 2026-08-18 00:45:08 +00:00 | 15 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.12.8

  Theme: the fix that stops the false "Build integrity check failed" banner now actually takes effect. v1.12.7 shipped the prebuilt frontend but couldn't deploy it on the same upgrade that delivered it (an upgrade runs the previous version's code); this release closes that gap at the build-script level, so it works on every upgrade from here on — from any prior version.

  Fixed

  The prebuilt frontend is now used no matter how old the upgrading node is. v1.12.7 made instances deploy the canonical prebuilt frontend instead of rebuilding it locally — but because morphit-ops upgrade runs the code of the version you're upgrading from, the v1.12.7 upgrade itself still rebuilt. The decision now lives in the build script (apps/web), which always comes from the new release, so upgrading to this version (and every version after) deploys the shipped, byte-identical frontend that matches the on-chain hashes — regardless of which version the node is coming from. Instances that were tripping the tamper banner will stop once they're on this release and re-registered.

  Notes

  • No database migration in this release.
  • After upgrading, a federated instance serves byte-for-byte the same frontend as the canonical build, so its /verify.json matches the on-chain-pinned hashes and the build-integrity check passes.
  • Everything from v1.12.7 (hidden-only RPC on tor-only sites, honest RPC-connectivity reporting, self-healing first backup, 15-second offline register timeout) is included.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    4 downloads · 2026-08-18 01:19:34 +00:00 · 1 KiB
  • morphit-v1.12.8-offline.tar.gz
    1 download · 2026-08-18 01:19:51 +00:00 · 708 MiB
  • morphit-v1.12.8-offline.tar.gz.sha256
    1 download · 2026-08-18 01:19:51 +00:00 · 97 B
  • morphit-v1.12.8.tar.gz
    5 downloads · 2026-08-18 01:19:34 +00:00 · 32 MiB
  • morphit-v1.12.8.tar.gz.sha256
    5 downloads · 2026-08-18 01:19:34 +00:00 · 89 B
• v1.12.7 d5c29b879b

  Compare

  Morphit v1.12.7 Stable

  agorise released this 2026-08-17 22:48:16 +00:00 | 16 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.12.7

  Theme: federated instances stop showing a false "Build integrity check failed" banner, tor-only visitors never touch the clear net, and health/backup reporting on a fresh node is honest and self-healing.

  Fixed

  Federated instances no longer show a false "Build integrity check failed" banner. Until now, each operator rebuilt the web frontend locally during install/upgrade, and because those builds aren't byte-reproducible across machines, an honest instance's assets didn't match the hashes published on-chain — tripping the tamper banner on every federated node. The release now ships one canonical, prebuilt frontend, and instances deploy those exact bytes instead of rebuilding (falling back to a local build only if the prebuilt is ever absent). Every instance now serves identical assets that match the on-chain pin. The frontend is generic — each instance still loads its own identity (name, addresses) at runtime — so one build serves the whole federation.

  A visitor on a tor-only site never opens a clearnet connection. When a page is served from a .onion/.i2p address, the app now uses a hidden-service-only RPC pool with no clearnet fall-through at all — a Tor/I2P visitor's browser can never reach out to the clear net, not even as a fallback. Clearnet instances are unchanged (they still try hidden nodes first for Tor-Browser visitors, then clearnet).

  "Blurt RPC connectivity" is reported honestly on a fresh/offline node. The indexer counted an RPC endpoint as healthy merely because it wasn't in a cooldown — which is true of every endpoint the instant the node starts, before any probe has run. So a fresh or offline node briefly claimed RPC connectivity it didn't have. An endpoint now counts as healthy only after a real success, so a not-yet-connected node honestly reports zero.

  A fresh node's first backup now lands on its own. On a fresh (especially offline) node the indexer can take a couple of minutes to finish migrating its schema; the first backup would fire before the schema existed, correctly skip, and then wait until the next daily run — leaving the operator at "no backup yet." The install now retries the first backup until a real dump lands.

  morphit-ops register run offline fails fast instead of hanging. The registration broadcast now times out after 15 seconds with a clear message rather than blocking on an unreachable RPC.

  Notes

  • No database migration in this release.
  • Instances install/upgrade faster now (no local frontend rebuild in the common case).
  • If you operate an instance: after upgrading, your served /verify.json will match the canonical on-chain hashes, so the build-integrity check passes.

  Downloads

  • Source code (ZIP)
    2 downloads
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    2 downloads · 2026-08-17 23:22:41 +00:00 · 1 KiB
  • morphit-v1.12.7-offline.tar.gz
    2 downloads · 2026-08-17 23:22:58 +00:00 · 708 MiB
  • morphit-v1.12.7-offline.tar.gz.sha256
    3 downloads · 2026-08-17 23:22:58 +00:00 · 97 B
  • morphit-v1.12.7.tar.gz
    4 downloads · 2026-08-17 23:22:41 +00:00 · 32 MiB
  • morphit-v1.12.7.tar.gz.sha256
    3 downloads · 2026-08-17 23:22:41 +00:00 · 89 B
• v1.12.6 86222253fd

  Compare

  Morphit v1.12.6 Stable

  agorise released this 2026-08-17 17:12:26 +00:00 | 17 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.12.6

  Theme: the guided install never hangs, online or offline. The "list your instance" step now completes instantly on an offline/air-gapped install instead of blocking on a chain broadcast that has no network to reach.

  Fixed

  The install's "list your instance on the federated directory" step no longer hangs offline. On an offline or air-gapped install, that step signs your registration and tries to broadcast it to the chain — but with no network, the broadcast RPC calls had nothing to answer them and blocked until the operator pressed Ctrl-C. The step now checks whether the box can actually reach the chain first: if it can't, it skips the live attempt and relies on the deferred registration (which was already armed), so the install finishes cleanly and publishes your instance automatically the moment the box comes online. Nothing about the behavior on an online install changes — it still lists immediately.

  morphit-ops register run offline fails fast instead of hanging. The registration broadcast now times out after 30 seconds with a clear message ("this box may not be online yet") rather than blocking indefinitely, so a manual registration on a not-yet-connected box returns control to you instead of appearing frozen.

  Notes

  • No database migration in this release.
  • These changes only affect the offline/air-gapped install and manual-registration paths; an online install and normal registration are unchanged.
  • A registration that couldn't be broadcast (offline) is never lost — the deferred first-online registration publishes it automatically once the box has connectivity.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    3 downloads · 2026-08-17 17:47:06 +00:00 · 1 KiB
  • morphit-v1.12.6-offline.tar.gz
    2 downloads · 2026-08-17 17:47:21 +00:00 · 698 MiB
  • morphit-v1.12.6-offline.tar.gz.sha256
    1 download · 2026-08-17 17:47:21 +00:00 · 97 B
  • morphit-v1.12.6.tar.gz
    3 downloads · 2026-08-17 17:47:06 +00:00 · 12 MiB
  • morphit-v1.12.6.tar.gz.sha256
    3 downloads · 2026-08-17 17:47:06 +00:00 · 89 B
• v1.12.5 25b29a4d7d

  Compare

  Morphit v1.12.5 Stable

  agorise released this 2026-08-17 06:49:15 +00:00 | 18 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.12.5

  Theme: the tor-only relay comes up on its own. This release closes the last crashes on the hidden-service install path — a fresh tor-only node now boots every service, unattended, with no manual steps. Plus honest reporting fixes and a backup safeguard.

  Fixed

  The relay no longer crash-loops on a tor-only node. A tor-only node has no clearnet domain, so its Web Push (VAPID) subject rendered as a domain-less https://, which the relay rejected — taking the whole relay down over an optional feature. The relay now treats an unusable VAPID subject as "web push disabled" and boots normally (web push is a clearnet-only browser feature and doesn't apply to a tor-only node anyway). The operator gets a clear, non-alarming log line explaining push is off.

  Dynamic DNS is no longer set up — or flagged — on a tor-only node. A tor-only node has no clearnet domain for dynamic DNS to update, so the ddns role is now skipped entirely and the install summary no longer expects or reports the morphit-ddns.timer. No more spurious "dynamic DNS ✗" on a hidden-service install.

  The relay is no longer mislabeled "answered, but not as the relay." The health command's classifier was treating the relay's /v1/health (which has no chain-head field, because it isn't an indexer) as an indexer that hadn't synced. A healthy relay now reports correctly.

  Backups never keep a schemaless fragment. If a backup runs before the indexer has migrated its schema (a race possible on a fresh node), it now skips cleanly instead of keeping a tiny, useless dump that health would flag as "failing." The next run captures a real backup once the schema exists.

  Notes

  • No database migration in this release.
  • All fixes are on the tor-only install path or in operational reporting; clearnet nodes are unaffected (a clearnet relay with a valid VAPID subject still has web push enabled exactly as before).
  • With this release, a fully air-gapped tor-only install brings up every service — indexer, relay, transports, canary, backups — on its own after first connectivity.

  Downloads

  • Source code (ZIP)
    2 downloads
  • Source code (TAR.GZ)
    2 downloads

  ---

  • distribution-anchor.env
    3 downloads · 2026-08-17 07:24:28 +00:00 · 1 KiB
  • morphit-v1.12.5-offline.tar.gz
    3 downloads · 2026-08-17 07:24:45 +00:00 · 698 MiB
  • morphit-v1.12.5-offline.tar.gz.sha256
    1 download · 2026-08-17 07:24:45 +00:00 · 97 B
  • morphit-v1.12.5.tar.gz
    4 downloads · 2026-08-17 07:24:28 +00:00 · 12 MiB
  • morphit-v1.12.5.tar.gz.sha256
    3 downloads · 2026-08-17 07:24:28 +00:00 · 89 B
• v1.12.4 2f6ebe1b03

  Compare

  Morphit v1.12.4 Stable

  agorise released this 2026-08-17 01:25:00 +00:00 | 19 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.12.4

  Theme: tor-only nodes work end to end, and operators can move between clearnet and tor. A node installed with no clearnet — no domain, no TLS — now boots cleanly, reports its health honestly, and (once you re-register) advertises its .onion to the federation. Plus: relay keys are always encrypted, and the stats page gained the RPC-endpoints view.

  Fixed

  Tor-only nodes now boot. A node installed in tor-only mode previously crash-looped: the relay rejected its own http://…onion origin (demanding https), and the indexer had no public origin set (the template assumed a clearnet domain). Both are fixed — .onion/.i2p origins are recognized as self-authenticating and served over http, and the tor-only install now points the indexer's public origin at the onion.

  The .b32.i2p address is written correctly. The i2p-address derivation split the address across two lines, corrupting the value and printing a harmless-but-alarming shell error at every service start. It's now a single clean line. This affected every install with i2p enabled, clearnet included.

  Health tells the truth when it can't see the chain. A node that hasn't established a chain head yet — just restarted, or offline — no longer reports a false "synced" with a bogus zero-block lag. It reports "unknown" until it has a real chain head to compare against.

  Changed

  Operators can update their registration — and move between clearnet and tor. Re-registering now updates your instance's origin, display name, and contact URL instead of being refused as "already registered." This is how you switch a node from a clearnet domain to a .onion (or back) and have the federation follow you. Your tag stays permanent (first-come-first-served, so nobody can take a name that's yours), and only the account that owns the registration can change it.

  Relay keys are always stored encrypted. The setup wizard and key-rotation no longer offer a plaintext option. The relay unlocks an encrypted key automatically at boot from a host-bound sealed credential — no prompt, and a stolen disk can't decrypt it — so plaintext storage carried real risk for no benefit.

  Stats page: RPC endpoints and the data note now live here. The "updated / building an aggregator" note is on its own card, and the RPC-endpoints list moved from settings to the stats page, where it's public transparency about which nodes an instance syncs from.

  Notes

  • No database migration in this release.
  • The registration change is consensus-level: every indexer applies the same upsert, so the federation converges. It's backward-compatible — a first-time registration behaves exactly as before.
  • Existing clearnet nodes are unaffected by the tor-only fixes.

  Downloads

  • Source code (ZIP)
    4 downloads
  • Source code (TAR.GZ)
    2 downloads

  ---

  • distribution-anchor.env
    4 downloads · 2026-08-17 01:59:58 +00:00 · 1 KiB
  • morphit-v1.12.4-offline.tar.gz
    2 downloads · 2026-08-17 02:00:16 +00:00 · 698 MiB
  • morphit-v1.12.4-offline.tar.gz.sha256
    2 downloads · 2026-08-17 02:00:16 +00:00 · 97 B
  • morphit-v1.12.4.tar.gz
    3 downloads · 2026-08-17 01:59:58 +00:00 · 12 MiB
  • morphit-v1.12.4.tar.gz.sha256
    4 downloads · 2026-08-17 01:59:58 +00:00 · 89 B
• v1.12.3 3d0cc36eab

  Compare

  Morphit v1.12.3 Stable

  agorise released this 2026-08-16 04:04:17 +00:00 | 20 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.12.3

  Theme: the offline-appliance path finishes itself, completely. A node installed with no internet now — the moment it first connects — brings up its Tor/I2P transports, publishes its warrant canary, and registers itself on-chain, all unattended and with the active key kept encrypted the whole time. Plus honest health reporting and safer key defaults.

  Fixed

  On-chain registration now completes automatically on an offline install — without ever storing your passphrase in plaintext. When you opt into "list my instance" during setup, first-online now unlocks your encrypted active key the same way the relay does — from the host-bound sealed credential (decrypted only in RAM, for the one registration call) — and publishes the registration the moment the box is online. Previously this silently failed for encrypted keys, leaving you to register by hand.

  The warrant canary now actually publishes on first-online. The publish step was invoking the refresh script with the wrong shell, so it exited before doing anything. It now runs correctly, so a fresh install signs and serves its canary on its own once it can fetch the freshness proofs.

  Tor and i2pd reseed/bootstrap on first connection. A node installed offline starts these daemons with no network; first-online now restarts them when connectivity appears, so i2pd actually reseeds instead of sitting with an empty database, and the hidden nodes come up on their own.

  Health: the reachable-node count and the "catching up from N nodes" line both match the list shown. No more "9/10" or "9 nodes" when all ten are green — both are counted from the same per-node list.

  Changed

  The relay active key is always stored encrypted. The setup wizard and the key-rotation command no longer offer a plaintext option. Since the relay unlocks an encrypted key automatically at boot (from a host-bound sealed credential, with no prompt to hang on and no way for a stolen disk to decrypt it), plaintext storage carried real risk for no operational benefit. Encrypted is now simply the way keys are stored.

  Clearer, accurate wording throughout the key-setup flow and operator docs. Corrected stale text that claimed the relay "prompts for the passphrase at startup" (it unlocks automatically), including an operations-guide warning that wrongly said a reboot could leave the relay waiting for a passphrase indefinitely.

  Small wording: a fresh install's i2pd warm-up note now says "~10 minutes," and the registration-permanence prompt reads "only superseded by a fresh register op."

  Notes

  • No database migration in this release.
  • Existing installs are unaffected; the automation and key-default changes apply to fresh and re-run setups.
  • Nothing here touches trading, fees, or on-chain formats.

  Downloads

  • Source code (ZIP)
    2 downloads
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    4 downloads · 2026-08-16 04:41:08 +00:00 · 1 KiB
  • morphit-v1.12.3-offline.tar.gz
    3 downloads · 2026-08-16 04:41:25 +00:00 · 698 MiB
  • morphit-v1.12.3-offline.tar.gz.sha256
    2 downloads · 2026-08-16 04:41:25 +00:00 · 97 B
  • morphit-v1.12.3.tar.gz
    3 downloads · 2026-08-16 04:41:08 +00:00 · 12 MiB
  • morphit-v1.12.3.tar.gz.sha256
    4 downloads · 2026-08-16 04:41:08 +00:00 · 89 B
• v1.12.2 2eb9cd68ce

  Compare

  Morphit v1.12.2 Stable

  agorise released this 2026-08-15 22:57:54 +00:00 | 21 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.12.2

  Theme: finish the offline-appliance story and make the node's own health report tell the truth. A node installed with no internet now completes itself the moment it comes online — TLS, on-chain registration, the warrant canary, and the Tor/I2P transports — with no manual steps. The health command reports sync state, node counts, backups, and the canary honestly.

  Fixed

  A node installed offline now finishes itself when it first gets internet — including the hidden transports and the canary. The "first-online" completion step already handled TLS and registration; it now also restarts Tor and i2pd (which, started with no network during an air-gapped install, would otherwise sit forever without bootstrapping) and publishes the warrant canary (whose freshness proofs need network). So a fully air-gapped install comes up complete the moment a link appears — no manual restart, no manual canary setup.

  The warrant canary sets itself up on an offline install instead of silently failing. The canary setup aborted early on an air-gapped box because of a preflight check for a tool it only needs when actually publishing. It now arms the refresh script and weekly timer offline and defers only the network-dependent first publish — which first-online then does automatically once the box is online.

  Health: sync state reads "unknown" when the node can't reach any RPC, instead of a false "synced." If every Blurt RPC endpoint is unreachable, the node genuinely can't see the chain head, so the health command now reports the sync state, chain head, and lag as "unknown" rather than showing a misleading "synced / 0 blocks behind."

  Health: the reachable-node count matches the list of nodes shown. The "N/10 reachable" header is now counted from the same per-node list printed below it, so it can't disagree with the ✓/✗ rows (e.g. showing "9/10" when all ten are green).

  Health: the first database backup happens right after install, not up to half an hour later. A fresh node now takes its first backup as soon as the indexer is up, instead of waiting on the backup timer's randomized delay — so the health command shows a real dump promptly.

  Health: layout + wording polish. The TLS and AIDE lines align with the Services block above them, and a not-yet-published canary reads as a calm "not published yet — it needs network for its freshness proofs" rather than an alarming "missing."

  Notes

  • No database migration in this release.
  • Everything here is about install-time and operational reporting; there are no changes to trading, fees, or on-chain formats.
  • Existing healthy nodes are unaffected; the fixes matter most for fresh and air-gapped installs.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    3 downloads · 2026-08-15 23:32:59 +00:00 · 1 KiB
  • morphit-v1.12.2-offline.tar.gz
    4 downloads · 2026-08-15 23:33:15 +00:00 · 698 MiB
  • morphit-v1.12.2-offline.tar.gz.sha256
    1 download · 2026-08-15 23:33:15 +00:00 · 97 B
  • morphit-v1.12.2.tar.gz
    4 downloads · 2026-08-15 23:32:59 +00:00 · 12 MiB
  • morphit-v1.12.2.tar.gz.sha256
    3 downloads · 2026-08-15 23:32:59 +00:00 · 89 B